Intelligent portraying method and system for online equipment in power distribution network

Abstract

The invention discloses an intelligent portraying method and system for online equipment in a power distribution network, and relates to the technical field of network security in the power distribution network, and the intelligent portraying method and system for the online equipment in the power distribution network comprises the following steps: collecting the whole network flow of the power distribution network. Basic information such as IP addresses, physical addresses and equipment types of surviving online equipment is automatically detected and obtained from network traffic of the power distribution network, traffic analysis and behavior analysis of communication between the equipment are further implemented, and the overall view of online equipment and network communication behaviors in the power distribution network is visually presented in real time. Normal equipment and normal network communication behaviors in the power distribution network can be found, fault equipment, external equipment and cheating equipment in the power distribution network can be found, abnormal traffic and abnormal attacks in network communication of the power distribution network can be found, the transparency of the network operation state of the power distribution network is enhanced, and the network communication efficiency is improved. And the capability of timely discovering network operation abnormity and attack behaviors of the power distribution network is improved.

Description

Technical Field

[0001] The present invention relates to the field of network security in power distribution networks, and specifically to a method and system for intelligent profiling of online devices in distribution networks. Background Art

[0002] A distribution network refers to an electric power grid that receives electric energy from a transmission network or a regional power plant, and distributes it locally or step by step according to voltage to various users through distribution facilities. It is composed of overhead lines, cables, poles and towers, distribution transformers, disconnectors, reactive power compensators and some ancillary facilities. It plays an important role in distributing electric energy in the power grid. The distribution network has the characteristics of multiple voltage levels, complex network structure, diverse equipment types, many and wide operating points, and a relatively poor safety environment. Therefore, the distribution network also has relatively more safety risk factors. In addition, since the function of the distribution network is to provide electric energy to various users, this puts higher requirements on the safe and reliable operation of the distribution network.

[0003] At the same time, there are a large number of network communication devices in the distribution network, including various IoT terminal devices, including field acquisition equipment, smart terminals, local communication access, and edge IoT agent devices. They have characteristics such as diverse terminal types and wide distribution range. These network terminal devices in the distribution network are equipped with processors and embedded systems. The reliability and security of their operation are directly related to the overall operational safety and stability of the Energy Internet. Unfortunately, however, research shows that due to factors such as system tailoring, application customization, difficulty in online upgrades, and proprietary and complex communication protocols in these embedded terminal devices in the distribution network, most devices have security risks and security vulnerabilities. In addition, due to the limited computing resources of these terminal devices, in order to ensure real-time and availability, the system design often fails to consider information security requirements. There are many problems such as illegal operation and maintenance, illegal external connections, use of high-risk ports, and use of unknown connections. Most of the distribution network terminals currently in service and on sale are in an unprotected state. As a typical industrial Internet structure, the distribution network is a critical infrastructure, and its security is related to the national economy and people's livelihood and the country's strategic security.

[0004] Conducting comprehensive operational monitoring of a large number of terminal devices in the distribution network, timely and accurately grasping the operating status of terminal devices, and gaining insight into equipment risks and network security risks in the operation of the distribution network are important links in the safe production management of the distribution network.

[0005] The present invention uses intelligent device profiling technology to detect and obtain basic information such as the IP address, physical address, device type, and device attributes of online devices from the distribution network traffic, and further implements traffic analysis and behavior analysis of communications between devices to achieve intelligent profiling of online devices in the distribution network, and present a full picture of the devices and network communications in the distribution network in real time through visual display, thereby enhancing the transparency of the distribution network operation status, improving the ability to promptly detect abnormalities in the distribution network operation, and improving the ability to detect network attacks on the distribution network. Summary of the Invention

[0006] The purpose of the present invention is to provide a method and system for intelligent profiling of online devices in a distribution network to solve the problems raised in the above background technology.

[0007] To achieve the above objectives, the present invention provides the following technical solution: a method for intelligent profiling of online devices in a distribution network, comprising the following steps:

[0008] Step 1: Collect the traffic of the entire distribution network;

[0009] Step 2: Analyze the traffic of the entire distribution network, extract characteristic information of various online devices, generate an online device information database, and assign trust marks to online devices;

[0010] Step 3: Analyze the entire distribution network traffic, extract the communication information of online devices, generate an online device communication information database, and mark the communication behavior of online devices as risky.

[0011] Step 4: Based on the data in the online device information library and the online device communication information library, a visual portrait of all online devices in the distribution network is drawn;

[0012] The method of step 1 is: using mirroring technology on the core switch or edge switch of the distribution network to collect real-time traffic of the entire distribution network;

[0013] The specific steps of step 2 include:

[0014] Step 2.1: Classify the IP data packets in the collected real-time traffic of the entire distribution network according to the source IP addresses in the data packets. All IP data packets with the same source IP address are classified into the same category.

[0015] Step 2.2: Extract device feature information corresponding to the source IP address in the same type of IP data packets, including IP address, physical address, TCP / IP protocol fingerprint, port fingerprint, and banner fingerprint information;

[0016] Step 2.3: Match the extracted device TCP / IP protocol fingerprint with the pre-established TCP / IP protocol fingerprint library to determine the device's operating system type and version. Match the extracted device port fingerprint with the pre-established port fingerprint library to determine the device's service type. Match the extracted device banner fingerprint information with the pre-established banner fingerprint library to determine the device's service software type, version, device type, and manufacturer information. Generate an online device information library based on the extracted device feature information and matching information.

[0017] Step 2.4: Compare the device's IP address with the pre-established legal IP address range to determine whether the device's IP address is legal. Devices with legal IP addresses are marked as trusted devices, while devices with illegal IP addresses are marked as untrusted devices.

[0018] The specific steps of step 3 include:

[0019] Step 3.1: Classify the IP data packets in the collected real-time traffic of the entire distribution network according to the source IP address and destination IP address in the data packets. All IP data packets with the same source IP address and destination IP address are classified into the same class.

[0020] Step 3.2: For all IP data packets of the same category that are classified by the same source IP address and destination IP address, collect statistics on the characteristic information of the data packets communicated between the source IP address and the destination IP address, including: the total number, number of bytes, and average packet length of the data packets sent from the source IP address to the destination IP address; the total number, number of bytes, and average packet length of the data packets received from the source IP address from the destination IP address; the total number, total number of bytes, and average packet length of the data packets between the source IP address and the destination IP address; the protocol type, the total number of protocol packets, and the average protocol packet length; the communication start time and communication duration;

[0021] Step 3.3: For all IP data packets of the same category classified by the same source IP address and destination IP address, statistics are collected on the communication session flow characteristics between the source IP address and the destination IP address, including: the port number used by the source IP address, the port number used by the destination IP address, the connection mode, the number of sent packets, the number of received packets, the number of sent bytes, the number of received bytes, the total number of packets, the total number of bytes, the packet length distribution, the send-receive ratio, the session start time, and the session duration;

[0022] Step 3.4: Use a pre-trained communication behavior risk detector that combines a convolutional neural network and a long short-term memory neural network to detect the collected real-time traffic of the entire distribution network. Based on the detection results, the communication session flow in step 3.3 is marked as risky.

[0023] Step 3.5: Based on the communication data packet characteristic information described in step 3.2, the communication session flow characteristic information described in step 3.3, and the communication session flow risk tag information described in step 3.4, a distribution network online device communication information database is generated with the source IP address as the primary key;

[0024] The specific steps of step 4 include:

[0025] Step 4.1: Based on the online device information database, visualize the basic information of all online devices in the distribution network, including: IP address, physical address, operating system type, operating system version, service type, service software type, service software version, device type, manufacturer information, and trust mark;

[0026] Step 4.2: Based on the online device communication information database, visually draw the communication information of all online devices in the distribution network, including: data packet feature information communicating with different destination IP addresses, session flow feature information communicating with different destination IP addresses, and session flow risk markers.

[0027] Preferably, an intelligent portrait system for online devices in a distribution network includes: a network traffic collector, a network traffic library, a fingerprint library, a communication behavior risk detector, an online device portrait analyzer, an online device information library, an online device communication information library and a visualization portrait module.

[0028] Preferably, the network traffic collector is used to collect real-time traffic of the entire distribution network using a mirroring technology on a core switch or an edge switch of the distribution network and store the collected network traffic in a network traffic library.

[0029] Preferably, the fingerprint library includes a TCP / IP protocol fingerprint library, a port fingerprint library and a Banner fingerprint library.

[0030] Preferably, the communication behavior risk detector uses a two-layer neural network learning machine that combines a convolutional neural network and a long short-term memory neural network, which can extract the spatial and temporal features of network communication data packets. It is trained using CIC-IDS and CIC-IoT sample data sets and has the ability to detect abnormal traffic and attacks in the network.

[0031] Preferably, the communication behavior risk detector is trained using CIC-IDS and CIC-IoT sample data sets, and has the ability to detect abnormal traffic and attacks in the network.

[0032] Preferably, the online device portrait analyzer uses the methods of step 2 and step 3 to generate an online device information library and an online device communication information library and implement device trust marking and communication behavior risk marking.

[0033] Preferably, the online device information library includes the device's IP address, physical address, operating system type, operating system version, service type, service software type, service software version, device type, manufacturer information and trust mark.

[0034] Preferably, the online device communication information library includes the device's IP address, destination IP address, communication data packet feature information of step 3.2, and communication session flow feature information and session flow risk marker of step 3.3.

[0035] Preferably, the visualization portrait module uses the method described in step 4 to present the portraits of all online devices in the distribution network in a visual manner.

[0036] Compared with the prior art, the present invention has the following beneficial effects:

[0037] The present invention uses intelligent device profiling technology to automatically detect and obtain basic information such as the IP address, physical address, device type, device attributes, and service type of surviving online devices from the distribution network traffic, and further implements traffic analysis and behavior analysis of communication between devices, and presents a full picture of online devices and network communication behaviors in the distribution network in real time. It can not only discover normal devices and normal network communication behaviors in the distribution network, but also help to discover faulty devices, external devices and deceptive devices in the distribution network, discover abnormal traffic and abnormal attacks in the distribution network communication, enhance the transparency of the distribution network operation status, and improve the ability to promptly discover distribution network operation anomalies and attack behaviors. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 Schematic diagram of the process of the intelligent profiling method of online devices in the distribution network of the present invention;

[0039] Figure 2 This is a schematic diagram of the structure of the communication behavior risk detector in the present invention;

[0040] Figure 3 This is a schematic diagram of the structure of the intelligent profiling system for online devices in the distribution network of the present invention;

[0041] Figure 4 This is a partial result diagram of the first intelligent portrait of the present invention;

[0042] Figure 5 This is the result diagram of the second intelligent portrait part of the present invention. DETAILED DESCRIPTION

[0043] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0044] Example 1: Please refer to Figure 1-Figure 5 The present invention provides a technical solution: a method for intelligent profiling of online devices in a distribution network, comprising the following steps:

[0045] Step 1: Collect the traffic of the entire distribution network;

[0046] Step 2: Analyze the traffic of the entire distribution network, extract characteristic information of various online devices, generate an online device information database, and assign trust marks to online devices;

[0047] Step 3: Analyze the entire distribution network traffic, extract the communication information of online devices, generate an online device communication information database, and mark the communication behavior of online devices as risky.

[0048] Step 4: Based on the data in the online device information library and the online device communication information library, a visual portrait of all online devices in the distribution network is drawn;

[0049] The method of step 1 is: using mirroring technology on the core switch or edge switch of the distribution network to collect real-time traffic of the entire distribution network;

[0050] The specific steps of step 2 include:

[0051] Step 2.1: Classify the IP data packets in the collected real-time traffic of the entire distribution network according to the source IP addresses in the data packets. All IP data packets with the same source IP address are classified into the same category.

[0052] Step 2.2: Extract device feature information corresponding to the source IP address in the same type of IP data packets, including IP address, physical address, TCP / IP protocol fingerprint, port fingerprint, and banner fingerprint information;

[0053] Step 2.3: Match the extracted device TCP / IP protocol fingerprint with the pre-established TCP / IP protocol fingerprint library to determine the device's operating system type and version. Match the extracted device port fingerprint with the pre-established port fingerprint library to determine the device's service type. Match the extracted device banner fingerprint information with the pre-established banner fingerprint library to determine the device's service software type, version, device type, and manufacturer information. Generate an online device information library based on the extracted device feature information and matching information.

[0054] Step 2.4: Compare the device's IP address with the pre-established legal IP address range to determine whether the device's IP address is legal. Devices with legal IP addresses are marked as trusted devices, while devices with illegal IP addresses are marked as untrusted devices.

[0055] The specific steps of step 3 include:

[0056] Step 3.1: Classify the IP data packets in the collected real-time traffic of the entire distribution network according to the source IP address and destination IP address in the data packets. All IP data packets with the same source IP address and destination IP address are classified into the same class.

[0057] Step 3.2: For all IP data packets of the same category classified by the same source IP address and destination IP address, collect statistics on the characteristic information of the data packets communicated between the source IP address and the destination IP address, including: the total number, number of bytes, and average packet length of the data packets sent from the source IP address to the destination IP address; the total number, number of bytes, and average packet length of the data packets received from the source IP address from the destination IP address; the total number, total number of bytes, and average packet length of the data packets between the source IP address and the destination IP address; the protocol type, the total number of protocol packets, and the average protocol packet length; the communication start time and communication duration;

[0058] Step 3.3: For all IP packets of the same class that are classified by the same source IP address and destination IP address, collect statistics on the communication session flow characteristics between the source IP address and the destination IP address, including: the port number used by the source IP address, the port number used by the destination IP address, the connection mode, the number of packets sent, the number of packets received, the number of bytes sent, the number of bytes received, the total number of packets, the total number of bytes, the packet length distribution, the send-receive ratio, the session start time, and the session duration;

[0059] Step 3.4: Use a pre-trained communication behavior risk detector that combines a convolutional neural network and a long short-term memory neural network to detect the collected real-time traffic of the entire distribution network. Based on the detection results, the communication session flow in step 3.3 is marked as risky.

[0060] Step 3.5: Based on the communication data packet feature information of step 3.2, the communication session flow feature information of step 3.3, and the communication session flow risk tag information of step 3.4, a communication information database of online devices in the distribution network is generated with the source IP address as the primary key;

[0061] The specific steps of step 4 include:

[0062] Step 4.1: Based on the online device information database, visualize the basic information of all online devices in the distribution network, including: IP address, physical address, operating system type, operating system version, service type, service software type, service software version, device type, manufacturer information, and trust mark;

[0063] Step 4.2: Based on the online device communication information database, visually draw the communication information of all online devices in the distribution network, including: data packet feature information communicating with different destination IP addresses, session flow feature information communicating with different destination IP addresses, and session flow risk markers.

[0064] The specific implementation of this embodiment is as follows:

[0065] Step 1: Collect real-time network traffic from the distribution network by time period and store it in the network traffic database. According to the requirements for distribution network security monitoring, the collection period is 5 minutes. That is, the device profile is the result of the 5-minute profile, and the profile result is refreshed every 5 minutes. The collection of distribution network network traffic is achieved by using port mirroring technology on the core switch of the distribution network. The collected real-time traffic of the entire distribution network is stored in the standard PCAP data packet format.

[0066] Step 2: Analyze the traffic of the entire distribution network, extract characteristic information of various online devices, generate an online device information database, and assign trust marks to online devices;

[0067] The network traffic database contains a massive amount of network data packets. Each data packet is sent by a device with a specific source IP address. Therefore, the source IP address in the data packet can be used to discover all online devices, including virtual and spoofed devices in the network.

[0068] Step 2.1: Classify the IP data packets in the collected real-time traffic of the entire distribution network according to the source IP addresses in the data packets. All IP data packets with the same source IP address are classified into the same category.

[0069] According to the message header format of the IP protocol, the source IP address can be obtained from the IP data packet;

[0070] Step 2.2: Extract device feature information corresponding to the source IP address in the same type of IP data packets, including IP address, physical address, TCP / IP protocol fingerprint, port fingerprint, and banner fingerprint information;

[0071] Different network assets have different values ​​for the total length (LEN), window (WIN), packet time to live (TTL), whether to fragment (DF), maximum segment size (MSS), and OPT in the IP header. Therefore, these fields of different network assets can be used to form TCP / IP protocol fingerprint characteristics. The following table shows some TCP / IP protocol fingerprint information.

[0072]

[0073] According to the IANA standard, port numbers 0 to 1023 contained in data packets correspond to different protocols. The protocol information can be inferred from the port number to determine the service type of the network asset. Some port fingerprint characteristics are shown in the following table.

[0074] Protocol / Service Type Port value HTTP 80,8080 DNS 53 SMTP 25 POP3 110 FTP 20,21 Telnet 23 HTTPS 443 TFTP 69 SNMP 161,162 NTP 123 DHCP 67,68 SSH 22

[0075] By using this feature, we can match the port fingerprint features based on the extracted traffic data of different protocols. The corresponding network asset provides the corresponding service type, thus accurately matching the service information provided by the asset.

[0076] Banner fingerprints can be used to match undisguised and unobfuscated server software. Information such as the server version can also be used as fingerprints. Among application layer protocols, HTTP is one of the most widely used. Different network assets may use different web services, and the content of HTTP response packets may also vary. This information can also be used as fingerprints for matching and identification. Combining these as fingerprints can greatly improve the accuracy of network asset identification. For example, when the Server field in the HTTP response packet header displays "Server: Apache? 2.5.1 (Ubuntu)", this information indicates that the server is running Apache version 2.5.1 and the operating system is Linux Ubuntu. In addition, the banner information in the UA field in the response packet header can also be used as a fingerprint. Some values ​​are shown in the table below.

[0077] Network assets UA Windows XP Windows NT 5.1 Windows Server 2003 Windows NT 5.2 Windows Server 2008 Windows NT 6.0 Windows 7 Windows NT 6.1 Windows 8 Windows NT 6.2 Windows 10 Windows NT 10.0 Linux Linux

[0078] Therefore, the Server and UA fields can be used to identify most operating systems / service software types and versions;

[0079] Step 2.3: Match the extracted device TCP / IP protocol fingerprint with the pre-established TCP / IP protocol fingerprint library to determine the device's operating system type and version. Match the extracted device port fingerprint with the pre-established port fingerprint library to determine the device's service type. Match the extracted device banner fingerprint information with the pre-established banner fingerprint library to determine the device's service software type, version, device type, and manufacturer information. Generate an online device information library based on the extracted device feature information and matching information.

[0080] The online device information database contains the device's IP address, physical address, operating system type, operating system version, service type, service software type, service software version, device type, manufacturer information, and trust mark. The online device information database is stored in a standard structured database table.

[0081] Step 2.4: Compare the device's IP address with the pre-established legal IP address range to determine whether the device's IP address is legal. Devices with legal IP addresses are marked as trusted devices, while devices with illegal IP addresses are marked as untrusted devices.

[0082] The legal IP address range is specified by the network administrator. The source IP address of the discovered trusted device is within the legal IP address range. Illegal IP addresses may be the IP addresses of external devices or IP addresses used in spoofing attacks.

[0083] Step 3: Network communication is end-to-end communication. The communicating parties are identified by source and destination IP addresses. Multiple communication processes can exist between the two ends using different ports and different connection methods. Here, the communication data packets between specific ports between the two ends are defined as an end-to-end session flow. Communication with the same source and destination IP addresses may have multiple session flows between different ports.

[0084] Step 3.1: Classify the IP data packets in the collected real-time traffic of the entire distribution network according to the source IP address and destination IP address in the data packets. All IP data packets with the same source IP address and destination IP address are classified into the same class.

[0085] Step 3.2: For all IP data packets of the same category classified by the same source IP address and destination IP address, collect statistics on the characteristic information of the data packets communicated between the source IP address and the destination IP address, including: the total number, number of bytes, and average packet length of the data packets sent from the source IP address to the destination IP address; the total number, number of bytes, and average packet length of the data packets received from the source IP address from the destination IP address; the total number, total number of bytes, and average packet length of the data packets between the source IP address and the destination IP address; the protocol type, the total number of protocol packets, and the average protocol packet length; the communication start time and communication duration;

[0086] The statistics of communication packet data feature information in step 3.2 are statistics of all end-to-end data packets between the source IP address and the destination IP address, without distinguishing the session flows;

[0087] Step 3.3: For all IP packets of the same class that are classified by the same source IP address and destination IP address, collect statistics on the communication session flow characteristics between the source IP address and the destination IP address, including: the port number used by the source IP address, the port number used by the destination IP address, the connection mode, the number of packets sent, the number of packets received, the number of bytes sent, the number of bytes received, the total number of packets, the total number of bytes, the packet length distribution, the send-receive ratio, the session start time, and the session duration;

[0088] The statistics of communication session flow characteristics in step 3.3 are based on the session flow statistics of end-to-end communication between the source IP address and the destination IP address;

[0089] Step 3.4: Use a pre-trained communication behavior risk detector that combines a convolutional neural network and a long short-term memory neural network to detect the collected real-time traffic of the entire distribution network. Based on the detection results, the communication session flow in step 3.3 is marked as risky.

[0090] The deep learning neural network structure used by the communication behavior risk detector is as follows: Figure 2 As shown in the figure, the data packet first passes through the convolution layer, pooling layer and fully connected layer of the convolutional neural network for information feature extraction. The number of convolution layers and pooling layers can be adjusted according to the results of sample data training, including one or more convolution layers and pooling layers, and finally using one fully connected layer. The number of LSTM layers in the long short-term memory network is also adjusted according to the results of sample data training, including one or more LSTM layers, using one LSTM fully connected layer, and finally using a Softmax classification function to obtain the classification result of the data packet.

[0091] Distribution networks contain a wide variety of devices, including general-purpose network devices and a large number of IoT devices. Therefore, there are many types of network attacks against distribution networks, including both general-purpose network and IoT attacks. To ensure that the communication behavior risk detector can effectively detect both general-purpose network and IoT attacks, the deep learning neural network of the communication behavior risk detector was trained using the CIC-IDS2017 / 2018 and CIC-IoT2023 training sample datasets.

[0092] The communication behavior risk detector trained on the CIC-IDS2017 / 2018 and CIC-IoT2023 sample datasets has risk labeling types for communication session flows as shown in Table 4 (non-attack types are marked as Normal);

[0093] Normal Attack IoT attacks Bruteforce attack Dictionarybruteforce DoSattack DoS Webattack Arpspoofing Infiltrationattack DNSspoofing Botnetattack DDoS PortScan Recon Webattack Mirai

[0094] Step 3.5: Based on the communication data packet feature information of step 3.2, the communication session flow feature information of step 3.3, and the communication session flow risk tag information of step 3.4, a communication information database of online devices in the distribution network is generated with the source IP address as the primary key;

[0095] After steps 1 to 3, the discovery, communication behavior analysis, and security marking of online devices in the distribution network are realized, and the information conditions for profiling online devices in the distribution network are available;

[0096] Step 4: Based on the data in the online device information library and the online device communication information library, a visual portrait of all online devices in the distribution network is drawn;

[0097] Step 4.1: Based on the online device information database, visualize the basic information of all online devices in the distribution network, including: IP address, physical address, operating system type, operating system version, service type, service software type, service software version, device type, manufacturer information, and trust mark;

[0098] The basic information of online devices is displayed in the form of a right-click menu. When the mouse focus is on a device, clicking the right-click menu will visualize the basic information of the device.

[0099] Step 4.2: Based on the online device communication information database, visualize the communication information of all online devices in the distribution network, including: data packet characteristics of communication with different destination IP addresses, session flow characteristics of communication with different destination IP addresses, and session flow risk markers;

[0100] To visualize the communication information of online devices, first use the right-click menu to visualize the IP addresses of other destination endpoint devices that communicate with the device end-to-end. Double-click one of the destination endpoint IP addresses to visualize the communication information between the online device and the destination endpoint IP address.

[0101] For online devices marked as untrusted devices and communication information marked as abnormal session flows, they are centrally displayed in a visual manner and given warning marks to facilitate managers to monitor the safety of distribution network operations. Some results of the intelligent portrait are as follows: Figure 4 、 Figure 5 shown.

[0102] Example 2: Please refer to Figure 1-Figure 5 The present invention provides a technical solution: an intelligent portrait system for online equipment in a distribution network. The present invention makes corresponding improvements to the technical problems mentioned in the background technology. The system includes: a network traffic collector, a network traffic library, a fingerprint library, a communication behavior risk detector, an online equipment portrait analyzer, an online equipment information library, an online equipment communication information library and a visualization portrait module.

[0103] As a further limitation of the present invention, the network traffic collector is used to collect real-time traffic of the entire distribution network using a mirroring technology on a core switch or an edge switch of the distribution network and store the collected network traffic in a network traffic database;

[0104] The fingerprint library includes TCP / IP protocol fingerprint library, port fingerprint library, and Banner fingerprint library;

[0105] The communication behavior risk detector uses a two-layer neural network learning machine that combines a convolutional neural network and a long short-term memory neural network. It can extract the spatial and temporal characteristics of network communication packets. It is trained using CIC-IDS and CIC-IoT sample data sets and has the ability to detect abnormal traffic and attacks in the network.

[0106] The communication behavior risk detector is trained using CIC-IDS and CIC-IoT sample datasets and is capable of detecting abnormal traffic and attacks in the network.

[0107] Using the methods of steps 2 and 3, generate an online device information library and an online device communication information library and implement device trust tags and communication behavior risk tags;

[0108] Online device information library, including the device's IP address, physical address, operating system type, operating system version, service type, service software type, service software version, device type, manufacturer information, and trust mark;

[0109] Online device communication information library, including the device's IP address, destination IP address, communication data packet characteristics from step 3.2, communication session flow characteristics from step 3.3, and session flow risk markers;

[0110] The visualization portrait module uses the method in step 4 to visually present the portraits of all online devices in the distribution network.

[0111] The specific implementation of this embodiment is as follows:

[0112] The system includes: a network traffic collector, a network traffic library, a fingerprint library, a communication behavior risk detector, an online device profile analyzer, an online device information library, an online device communication information library, and a visualization profile module. The network traffic collector collects traffic from the entire distribution network by using a mirror port on the core switch of the distribution network. The network traffic library stores the collected network traffic in the standard PCAP packet format, using a dedicated server as storage. The TCP / IP protocol fingerprint library, port fingerprint library, and Banner fingerprint library are stored in standard structured database tables. The convolutional neural network in the communication behavior risk detector uses two convolutional layers and two pooling layers, and the long short-term memory network is implemented using two LSTM layers. It has been pre-trained with the CIC-IDS2017 / 2018 and CIC-IoT2023 sample data sets, with a risk labeling accuracy of over 98%. The online device profile analyzer, communication behavior risk detector, and visualization profile module are all integrated into a Windows platform software. The online device information library and the online device communication information library are stored in standard MySQL structured database tables.

[0113] It should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that includes a list of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus.

[0114] While embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions, and variations may be made to these embodiments without departing from the principles and spirit of the invention, and that the scope of the invention is defined by the appended claims and their equivalents.

Claims

1. A method for intelligent profiling of online devices in a distribution network, characterized by: The following steps are involved: Step 1: Collect the traffic of the entire distribution network; Step 2: Analyze the traffic of the entire distribution network, extract various online device feature information, generate an online device information database, and trust mark the online devices; Step 3: Analyze the traffic of the entire distribution network, extract the communication information of online devices, generate an online device communication information database, and mark the communication behavior of online devices as risk; Step 4: Draw a visual portrait of all online devices in the distribution network based on the data of the online device information library and the online device communication information library; The method of step 1 is: using mirroring technology on the core switch or edge switch of the distribution network to collect the real-time traffic of the entire distribution network; The specific steps of step 2 include: Step 2.1: Classify the IP data packets in the collected real-time traffic of the entire distribution network according to the source IP addresses in the data packets, and all IP data packets with the same source IP address are classified into the same category; Step 2.2: Extract the device feature information corresponding to the source IP address in the same type of IP data packets, including IP address, physical address, TCP / IP protocol fingerprint, port fingerprint and Banner fingerprint information; Step 2.3: Match the extracted device TCP / IP protocol fingerprint with the pre-established TCP / IP protocol fingerprint library to determine the device's operating system type and version, match the extracted device port fingerprint with the pre-established port fingerprint library to determine the device's service type, match the extracted device Banner fingerprint information with the pre-established Banner fingerprint library to determine the device's service software type, version, device type and manufacturer information, and generate an online device information library based on the extracted device feature information and matching information; Step 2.4: Compare the IP address of the device with the pre-established legal IP address range to determine whether the IP address of the device is legal. The device corresponding to the legal IP address is marked as a trusted device, and the device corresponding to the illegal IP address is marked as an untrusted device; The specific steps of step 3 include: Step 3.1: Classify the IP data packets in the collected real-time traffic of the entire distribution network according to the source IP address and the destination IP address in the data packets, and all IP data packets with the same source IP address and destination IP address are classified into the same category; Step 3.2: For all IP data packets of the same category classified by the same source IP address and destination IP address, statistics are collected on the characteristic information of the communication data packets between the source IP address and the destination IP address, including: the total number, number of bytes and average packet length of the data packets sent from the source IP address to the destination IP address, the total number, number of bytes and average packet length of the data packets received from the source IP address from the destination IP address, the total number, total number of bytes and average packet length of the data packets between the source IP address and the destination IP address, the protocol type, the total number of protocol packets and the average protocol packet length, the communication start time and the communication duration; Step 3.3: For all IP data packets of the same category classified by the same source IP address and destination IP address, statistics are collected on the communication session flow characteristics information between the source IP address and the destination IP address, including: the port number used by the source IP address, the port number used by the destination IP address, the connection mode, the number of sent packets, the number of received packets, the number of sent bytes, the number of received bytes, the total number of packets, the total number of bytes, the packet length distribution, the sending and receiving ratio, the session start time, and the session duration; Step 3.4: The collected real-time traffic of the entire distribution network is detected using a pre-trained communication behavior risk detector that combines a convolutional neural network and a long short-term memory neural network, and the communication session flow in step 3.3 is marked as risk based on the detection results; Step 3.5: Based on the communication data packet characteristic information described in step 3.2, the communication session flow characteristic information described in step 3.3, and the communication session flow risk marking information described in step 3.4, a distribution network online device communication information library is generated with the source IP address as the primary key; The specific steps of step 4 include: Step 4.1: Based on the online device information database, draw the basic information of all online devices in the distribution network in a visual manner, including: IP address, physical address, operating system type, operating system version, service type, service software type, service software version, device type and manufacturer information and trust mark; Step 4.2: Based on the online device communication information database, visually draw the communication information of all online devices in the distribution network, including: data packet feature information communicating with different destination IP addresses, session flow feature information communicating with different destination IP addresses, and session flow risk markers.

2. An intelligent portrait system for online equipment in a distribution network, characterized by: The system includes: a network traffic collector, a network traffic library, a fingerprint library, a communication behavior risk detector, an online device portrait analyzer, an online device information library, an online device communication information library and a visual portrait module.

3. The intelligent portrait system of online equipment in a distribution network according to claim 2, characterized in that: The network traffic collector is used to collect the real-time traffic of the entire distribution network by using the mirroring technology on the core switch or the edge switch of the distribution network and store the collected network traffic in the network traffic library.

4. The intelligent portrait system for online devices in a distribution network according to claim 2, characterized in that: The fingerprint library includes a TCP / IP protocol fingerprint library, a port fingerprint library, and a Banner fingerprint library.

5. The intelligent portrait system for online devices in a distribution network according to claim 2, characterized in that: The communication behavior risk detector uses a two-layer neural network learning machine that combines a convolutional neural network and a long short-term memory neural network to extract spatial and temporal features of network communication data packets. It is trained using CIC-IDS and CIC-IoT sample data sets and has the ability to detect abnormal traffic and attacks in the network.

6. The intelligent portrait system of online equipment in a distribution network according to claim 5, characterized in that: The communication behavior risk detector is trained using CIC-IDS and CIC-IoT sample data sets, and has the ability to detect abnormal traffic and attacks in the network.

7. The intelligent portrait system of online equipment in a distribution network according to claim 2, characterized in that: The online device portrait analyzer uses the methods of step 2 and step 3 to generate an online device information library and an online device communication information library and implement device trust tags and communication behavior risk tags.

8. The intelligent portrait system for online devices in a distribution network according to claim 2, characterized in that: The online device information library includes the device's IP address, physical address, operating system type, operating system version, service type, service software type, service software version, device type, manufacturer information, and trust mark.

9. The intelligent portrait system for online devices in a distribution network according to claim 2, characterized in that: The online device communication information library includes the device's IP address, destination IP address, communication data packet feature information of step 3.2, communication session flow feature information of step 3.3, and session flow risk mark.

10. The intelligent online device portrait system in a distribution network according to claim 2, characterized in that: The visualization portrait module uses the method described in step 4 to present the portraits of all online devices in the distribution network in a visual manner.

Images