Equipment fingerprint determination method and device, equipment, medium and product

Abstract

The invention discloses an equipment fingerprint determination method and device, equipment, a medium and a product. The method comprises the following steps: acquiring target information of target equipment; and determining a device fingerprint corresponding to the target device according to the target information. Through the technical scheme of the invention, the unique fingerprint can be generated by actively scanning and collecting the equipment information for the power terminal which is not included in the security management and control system, so that the unique identification of the equipment can be identified in a simple and non-intrusive manner.

Description

Technical Field

[0001] Embodiments of the present invention relate to the field of communication and information security technology, and in particular, to a method, apparatus, device, medium and product for determining a device fingerprint. Background Art

[0002] Due to the widespread access of massive new power business terminals, heterogeneity and complexity of ownership, it is currently difficult to take into account the problem of identity identification of different types of equipment terminals, and thus it is difficult to achieve non-modification, non-invasive identification and blocking of illegal terminals and safe access to legal terminals. For business terminals included in the security management and control system, the terminal identity based on the unique hardware identifier of the device is often used to extract the device fingerprint information of the terminal. Common hardware identifiers include the network card MAC (Media Access Control Address) address, CPU ID (CPU Identifier), hard disk serial number, etc. However, it can only effectively solve the extraction of physical characteristic identity identifiers of the controlled business terminal, and is not applicable to business terminals that are not included in the security management and control system. Summary of the invention

[0003] The embodiments of the present invention provide a method, apparatus, device, medium and product for determining a device fingerprint, so as to generate a unique fingerprint for a power terminal that is not included in the safety management and control system by actively scanning and collecting device information, thereby realizing unique identification of the device in a simple and non-invasive manner.

[0004] According to one aspect of the present invention, a method for determining a device fingerprint is provided, comprising:

[0005] Get target information of target device;

[0006] A device fingerprint corresponding to the target device is determined according to the target information.

[0007] In some embodiments of the present invention, the target information is an initial sequence number;

[0008] Determining a device fingerprint corresponding to the target device according to the target information includes:

[0009] Analyze the target quantity of initial sequence numbers to obtain analysis results;

[0010] Determine a pseudo-random number generator attribute corresponding to the target device according to the analysis result;

[0011] The pseudo-random number generator attribute corresponding to the target device is determined as a device fingerprint corresponding to the target device.

[0012] In some embodiments of the present invention, the target information is a data packet carrying a synchronization sequence number flag;

[0013] Determining a device fingerprint corresponding to the target device according to the target information includes:

[0014] A first timeout retransmission value corresponding to a data packet carrying a synchronization sequence number mark sent by the target device is obtained, and the first timeout retransmission value is determined as a device fingerprint corresponding to the target device.

[0015] In some embodiments of the present invention, the target information is a data packet carrying an end flag;

[0016] Determining a device fingerprint corresponding to the target device according to the target information includes:

[0017] A second timeout retransmission value corresponding to a data packet carrying an end mark sent by the target device is obtained, and the second timeout retransmission value is determined as a device fingerprint corresponding to the target device.

[0018] In some embodiments of the present invention, the target information is an echo response;

[0019] Determining a device fingerprint corresponding to the target device according to the target information includes:

[0020] Determine a round trip time according to an echo response returned by the target device, the round trip time being the time between a timestamp corresponding to when the echo request is sent to the target device and a timestamp corresponding to when the echo response returned by the target device is received, the echo response being generated after the target device receives the echo request;

[0021] A probability density function corresponding to the round-trip time is determined as a device fingerprint corresponding to the target device.

[0022] In some embodiments of the present invention, the target information is a response message;

[0023] Determining a device fingerprint corresponding to the target device according to the target information includes:

[0024] Determine a receiving timestamp according to a response message returned by the target device;

[0025] Determining a clock deviation according to the receiving timestamp and the initiating timestamp of sending the request message to the target device, wherein the response message is generated after the target device receives the request message;

[0026] The clock deviation is determined as a device fingerprint corresponding to the target device.

[0027] According to another aspect of the present invention, a device fingerprint determination apparatus is provided, the apparatus comprising:

[0028] An acquisition module, used to acquire target information of a target device;

[0029] A determination module is used to determine a device fingerprint corresponding to the target device according to the target information.

[0030] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0031] at least one processor; and

[0032] a memory communicatively connected to the at least one processor; wherein,

[0033] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can perform the device fingerprint determination method described in any embodiment of the present invention.

[0034] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the device fingerprint determination method described in any embodiment of the present invention when executed.

[0035] According to another aspect of the present invention, an embodiment of the present invention further provides a computer program product, the computer program product includes a computer program, and when the computer program is executed by a processor, the device fingerprint determination method described in any embodiment of the present invention is implemented.

[0036] The embodiment of the present invention obtains the target information of the target device and determines the device fingerprint corresponding to the target device according to the target information. Through the technical solution of the present invention, it is possible to generate a unique fingerprint for the power terminal that is not included in the safety management and control system by actively scanning and collecting device information, thereby realizing the unique identification of the device in a simple and non-invasive way.

[0037] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments are briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without creative work.

[0039] Figure 1 is a flow chart of a method for determining a device fingerprint in an embodiment of the present invention;

[0040] Figure 2 is a structural schematic diagram of a device fingerprint determination apparatus in an embodiment of the present invention;

[0041] Figure 3 It is a schematic diagram of the structure of an electronic device for implementing the device fingerprint determination method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0042] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0043] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and their meanings are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0044] It is understandable that before using the technical solutions disclosed in the embodiments of the present disclosure, the types, scope of use, usage scenarios, etc. of the personal information involved in the present disclosure should be informed to the user and the user's authorization should be obtained in an appropriate manner in accordance with relevant laws and regulations.

[0045] Embodiment 1

[0046] Existing fingerprint extraction technologies are mainly divided into two parts: passive and active. In the passive fingerprint extraction process, the device fingerprint is extracted by collecting information generated by the device and using data from the device without interacting with the device. For example, the characteristics of the device are extracted by analyzing the received radio frequency signal. Radio frequency fingerprint recognition is a technology that uses the characteristics of radio signals to identify devices or users. The extraction steps generally include: (1) data preprocessing, namely signal acquisition, signal filtering, normalization processing and other steps; (2) feature extraction, including time domain features, frequency domain features or time-frequency domain features; (3) feature selection, mainly including feature screening, namely selecting the most representative features, and feature dimensionality reduction, namely reducing the feature dimension through methods such as PCA (Principal Component Analysis); (4) classification recognition, namely using machine learning algorithms (such as support vector machines, neural networks, etc.) to train classification models. Compared with active fingerprint extraction, passive fingerprint extraction usually requires more processing resources and is more expensive. At the same time, passive fingerprint extraction relies on extracting features from network traffic. If data packets are lost or data quality is not high, it may affect recognition accuracy. At the same time, changes in the network environment, such as network delays and jitters, will also affect the effect of fingerprint extraction. In addition, passive fingerprint extraction cannot actively obtain more system information, which may lead to reduced accuracy.

[0047] Active fingerprinting technology generates unique fingerprints by actively scanning and collecting device information. These fingerprints can be used to identify and track specific devices or user behaviors. Compared with passive fingerprinting, active methods can obtain more comprehensive and detailed data, thereby improving the accuracy of identification. Active fingerprinting usually involves actively scanning the network to collect device response data, including obtaining the device's MAC address, IP address, operating system version, browser information, etc. After data collection, the data needs to be preprocessed and feature extracted. Feature extraction is the core link of fingerprint extraction. By analyzing the statistical characteristics and pattern characteristics of the data, key information that can characterize the device or user behavior is extracted. Based on the extracted feature information, a fingerprint library is generated for comparison and identification in the subsequent detection process.

[0048] In summary, passive fingerprint extraction relies on the data generated by the device during normal operation. If the device does not generate enough data, or the data is not detailed enough, the accuracy and completeness of the fingerprint extraction will be affected. Compared with passive fingerprint extraction, active methods are able to obtain more comprehensive and detailed data, thereby improving the accuracy of recognition. In addition, passive methods usually need to wait for the device to generate and transmit data, which may cause delays in fingerprint extraction and fail to detect and respond to potential threats in real time. Active fingerprint extraction technology generates unique fingerprints by actively scanning and collecting device information.

[0049] In order to overcome the shortcomings of passive fingerprint extraction, an embodiment of the present invention proposes a fingerprint extraction technology based on an active interactive response device.

[0050] Figure 1 is a flow chart of a device fingerprint determination method in an embodiment of the present invention. This embodiment is applicable to the case of non-intrusive power device fingerprint determination based on physical signal characteristics. The method can be executed by a device fingerprint determination device in an embodiment of the present invention. The device can be implemented in software and / or hardware, such as Figure 1 As shown, the method specifically comprises the following steps:

[0051] S101. Obtain target information of a target device.

[0052] In this embodiment, the target device may be a device to be subjected to fingerprint extraction. For example, the target device may be a power terminal that is not included in the security management and control system.

[0053] The target information may be information sent by the target device to the system, and the system in this embodiment may be a system for determining a device fingerprint.

[0054] The fingerprint extraction in the embodiment of the present invention mainly involves the TCP (Transmission Control Protocol) protocol and the UDP (User Datagram Protocol) protocol of the transport layer in the OSI (Open Systems Interconnection Model) model.

[0055] There are three extraction methods involved in the TCP protocol. The target information can be the ISN (Initial Sequence Number) generated by the target device, the data packet with the SYN (Synchronize Sequence Numbers) flag sent by the target device, and the data packet with the FIN (Finish) flag sent by the target device.

[0056] There are two extraction methods involved in the UDP protocol, and the target information can be an ICMP (Internet Control Message Protocol) echo response and an ICMP timestamp response message respectively.

[0057] S102: Determine a device fingerprint corresponding to the target device according to the target information.

[0058] As we know, device fingerprinting is a technology used to identify and distinguish different network devices. It creates a unique "fingerprint" by collecting and analyzing device-specific information, which can be used to identify the device. Device fingerprinting technology has a wide range of applications in network security, user behavior analysis, fraud detection and other fields.

[0059] Specifically, for different target information sent by the target device, different methods are used to determine the device fingerprint corresponding to the target device.

[0060] The embodiment of the present invention obtains the target information of the target device and determines the device fingerprint corresponding to the target device according to the target information. Through the technical solution of the present invention, it is possible to generate a unique fingerprint for the power terminal that is not included in the safety management and control system by actively scanning and collecting device information, thereby realizing the unique identification of the device in a simple and non-invasive way.

[0061] Optionally, the target information is an initial sequence number.

[0062] During the TCP connection process, since the initial sequence number (ISN) is mostly generated by the pseudo-random number generator of the target device, the properties of the pseudo-random number generator of the target device can be inferred through enough ISN samples, and then used as the fingerprint of the target device. The specific implementation process is as follows:

[0063] Determine the device fingerprint corresponding to the target device based on the target information, including:

[0064] Analyze the target number of initial sequence numbers to obtain analysis results.

[0065] The target number may be the number of ISNs sent by the target device, which is preset by the user according to actual needs or experience values, and is not limited in this embodiment.

[0066] In actual operation, the target device initiates a TCP connection to the system. The target device generates an ISN for communicating with the system and tracks every packet in each TCP connection to ensure that the conversation continues intact. After receiving enough packets, the system analyzes the ISN samples.

[0067] Exemplarily, the ISN sent by the target device may be analyzed, statistics such as mean and variance may be calculated, a distribution graph may be drawn, the distribution of the ISN may be analyzed, possible patterns or regularities may be found, and analysis results may be obtained.

[0068] Specifically, install and configure the packet capture tool to capture TCP traffic, start the packet capture tool and begin capturing network traffic, filter the SYN packets (initial connection requests) in TCP, extract and record the initial sequence number (ISN) for each captured TCP SYN packet, and export the captured ISN samples to a file, analyze the ISN samples, calculate the mean, variance and other statistics of the samples, and draw a distribution graph.

[0069] The pseudo-random number generator property corresponding to the target device is determined according to the analysis result.

[0070] Specifically, based on the analysis results, a mathematical model is established to further infer the properties of the pseudo-random number generator corresponding to the target device.

[0071] The pseudo-random number generator attribute corresponding to the target device is determined as a device fingerprint corresponding to the target device.

[0072] In actual operation, since different target devices use different pseudo-random number generators, the random numbers show different patterns or different probability distributions. Therefore, the ISN generation algorithm properties can be inferred from the ISN sample, and the system uses this property as the fingerprint of the target device.

[0073] The technical solution of the embodiment of the present invention uses an ISN sample to obtain the properties of the device pseudo-random number generator, thereby determining the device fingerprint of the target device. ISN is the initial sequence number generated when a TCP connection is established, and is usually determined by the pseudo-random number generator of the device. By analyzing multiple ISN samples, the characteristics of the device PRNG can be inferred, thereby identifying the unique fingerprint of the device. Since the characteristics of the PRNG vary between different devices, this method can provide high device identification accuracy, and the characteristics of the pseudo-random number generator are difficult for attackers to imitate, thereby improving the reliability of the fingerprint.

[0074] Optionally, the target information is a data packet carrying a synchronization sequence number flag.

[0075] By setting up the corresponding firewall, the timeout retransmission value of the target device's SYN_ACK response during TCP connection is used as the device fingerprint. The specific implementation process is as follows:

[0076] Determine the device fingerprint corresponding to the target device based on the target information, including:

[0077] A first timeout retransmission value corresponding to a data packet carrying a synchronization sequence number mark sent by a target device is obtained, and the first timeout retransmission value is determined as a device fingerprint corresponding to the target device.

[0078] In this embodiment, the first timeout retransmission value may be the number of retransmissions of a data packet with a SYN flag sent by the target device to the system.

[0079] Specifically, the system sends a TCP data packet with a SYN flag to the target device to try to establish a connection, and the target device sends a data packet in response. In this embodiment, the corresponding firewall software is installed according to different operating systems, and firewall rules are set in the system to prevent the target device from transmitting TCP data packets with a SYN (synchronous sequence number) flag and an ACK flag. The firewall blocks the reception of the data packet, and the target device continues to retransmit. At the same time, the system is set to count the delay time between each retransmission until the target device stops retransmitting. Finally, the statistical results are used as the device fingerprint of the target device.

[0080] In actual operation, by configuring firewall rules, set the timeout value of SYN_ACK response, and capture and record all incoming TCP SYN requests and corresponding SYN_ACK responses. In addition, ensure that the logging function of the firewall is enabled and output the log to the specified file, regularly check and analyze the firewall log, extract the timeout retransmission value of the SYN_ACK response, and establish a fingerprint database based on the timeout retransmission value of different target devices. By comparing the captured SYN_ACK timeout retransmission value with the value in the fingerprint database, the target device can be identified.

[0081] Optionally, the target information is a data packet carrying an end flag.

[0082] By setting up the corresponding firewall, the timeout retransmission value of the target device's FIN_ACK response during TCP connection is used as the device fingerprint. The specific implementation process is as follows:

[0083] Determine the device fingerprint corresponding to the target device based on the target information, including:

[0084] A second timeout retransmission value corresponding to a data packet carrying an end mark sent by the target device is obtained, and the second timeout retransmission value is determined as a device fingerprint corresponding to the target device.

[0085] In this embodiment, the second timeout retransmission value may be the number of retransmissions of the target device when sending a data packet with a FIN mark to the system.

[0086] Specifically, the system sends a TCP data packet with a SYN flag to the target device to try to establish a connection. The target device sends a data packet in response. The system sends an acknowledgment data packet in response to complete the connection. The system sends a TCP data packet with FIN and ACK flags to the target device to try to terminate the connection. The target device sends a data packet in response. Firewall rules are set in the system to prevent the target device from receiving TCP data packets with FIN (end) flag and ACK flag. The firewall rules set by the system prevent the reception of data packets, and the target device continues to retransmit. At the same time, the system is set to count the delay time between each retransmission until the target device stops retransmitting. Finally, the statistical results are used as the device fingerprint of the target device.

[0087] In actual operation, by configuring firewall rules, set the timeout value of FIN_ACK response, and capture and record all incoming TCP FIN requests and corresponding FIN_ACK responses. In addition, ensure that the logging function of the firewall is enabled and output the log to the specified file, regularly check and analyze the firewall log, extract the timeout retransmission value of the FIN_ACK response, and establish a fingerprint database based on the timeout retransmission value of different target devices. By comparing the captured FIN_ACK timeout retransmission value with the value in the fingerprint database, the target device can be identified.

[0088] The technical solution of the embodiment of the present invention determines the device fingerprint of the target device by setting a firewall to obtain the timeout retransmission value of the SYN_ACK response and the FIN_ACK response. By setting the firewall and capturing the timeout retransmission value of the response, the device fingerprint can be further refined. Combining multiple TCP parameters (such as SYN_ACK and FIN_ACK responses) can more comprehensively describe the device characteristics. This method increases the complexity of fingerprint extraction, making it more difficult for attackers to forge device fingerprints.

[0089] Optionally, the target information is an echo response.

[0090] It is known that ICMP-ECHO request and response, commonly referred to as ping operation, is a basic network tool used to measure network delay or RTT (Round-Trip Time). ICMP-ECHO request is sent by the sender, and the receiver returns an ICMP-ECHO response after receiving the request. The sender calculates the round-trip time by comparing the timestamps of sending the request and receiving the response. In this embodiment, the echo request can specifically be an ICMP-ECHO echo request, and the echo response can specifically be an ICMP-ECHO echo response.

[0091] In the UDP protocol, the ICMP-ECHO round-trip time distribution is used as the device fingerprint. The specific implementation process is as follows:

[0092] Determine the device fingerprint corresponding to the target device based on the target information, including:

[0093] Determine the round-trip time based on the echo response returned by the target device.

[0094] The round trip time is the time between the timestamp corresponding to when the echo request is sent to the target device and the timestamp corresponding to when the echo response returned by the target device is received. The echo response is generated after the target device receives the echo request.

[0095] In actual operation, the round trip time is modeled. Assume that the system (S) sends an ICMP echo response to the target device (R), simplifying the transmission chain as follows Figure 1 As shown, the observed round trip time can be modeled as:

[0096] t rtt =t ping +t pong ;

[0097] t ping =t NIC (S)+t NET (S to R)+t NIC (R)+t OS (R);

[0098] t pong =t NIC (R)+t NET (R to S)+t NIC (S)+t OS (S);

[0099] Among them, t rtt is the round trip time, i.e., the total time from when the system (S) sends an ICMP-ECHO request to when the target device (R) responds to the ICMP-ECHO response; t ping is the ping time, i.e., the time to send the ICMP-ECHO request, including the system (S) NIC processing time, network propagation time, target device (R) NIC processing time, and target device (R) operating system processing time; t NIC (S) is the time taken by the system (S) network interface card (NIC) to process the ICMP-ECHO request; t NET (S to R) is the propagation time of the ICMP-ECHO request from the system (S) through the network to the target device (R); t NIC (R) is the time taken by the target device (R) network interface card (NIC) to process the ICMP-ECHO request; t OS (R) is the time taken by the target device’s (R) operating system to process the ICMP-ECHO request and generate a response; tpong is the pong time, i.e., the time to send the ICMP-ECHO response, including the target device (R) NIC processing time, network propagation time, system (S) NIC processing time, and system (S) operating system processing time; t NIC (R) is the time for the target device (R) network interface card (NIC) to process the ICMP-ECHO response; t NET (R to S) is the propagation time of the ICMP-ECHO response from the target device (R) through the network back to the system (S); t NIC (S) is the time for the system (S) network interface card (NIC) to process the ICMP-ECHO response; t OS (S) is the time it takes for the system's operating system to process the ICMP-ECHO response.

[0100] The probability density function corresponding to the round trip time is determined as the device fingerprint corresponding to the target device.

[0101] After the round-trip time is determined, the target devices are classified according to the round-trip time distribution. Specifically, a group of target devices can be pinged repeatedly and the round-trip time can be collected. Based on these measurement results, the PDF (Probability Density Function) of the round-trip time is estimated and used as the fingerprint of the target device. In the actual estimation operation process, a kernel density estimator can be used, which is not limited in this embodiment.

[0102] In actual operation, you can install and configure network monitoring tools, send ICMP-ECHO requests to the IP address of the target device, and record the round-trip time of each request. Analyze the distribution of round-trip time, draw a distribution graph of round-trip time, and establish a fingerprint database based on the round-trip time distribution of different target devices. Store these distribution graphs and statistical data in the database. When extracting fingerprints from the target device, you can compare the PDF of the round-trip time of the target device to be fingerprinted with the PDF in the fingerprint database to identify the target device.

[0103] The technical solution of the embodiment of the present invention uses the ICMP-ECHO round-trip time distribution as the device fingerprint. Since RTT data can be obtained in real time, the unique network characteristics of the device can be identified by analyzing the distribution of RTT.

[0104] Optionally, the target information is a response message.

[0105] In actual operation, the system sends an ICMP timestamp request message, and the target device sends an ICMP timestamp response message in response. In this embodiment, the response message can specifically be an ICMP timestamp response message. The system uses the ICMP timestamp message to calculate the clock deviation as the device fingerprint. The specific implementation process is as follows:

[0106] Determine the device fingerprint corresponding to the target device based on the target information, including:

[0107] The receiving timestamp is determined based on the response message returned by the target device.

[0108] The receiving timestamp may be the timestamp when the system receives the ICMP timestamp response message sent by the target device.

[0109] Specifically, the system continuously sends ICMP timestamp request messages, and correspondingly, the target device continuously sends ICMP timestamp response messages in response. For the i-th message, As the initiation timestamp, As the receiving timestamp.

[0110] The clock deviation is determined based on the receiving timestamp and the initiating timestamp of sending the request message to the target device.

[0111] The response message is generated after the target device receives the request message.

[0112] It should be noted that the clock deviation may be the clock deviation between the system and the target device.

[0113] Specifically, you can represents the time difference between the i-th message and the first message, represents the observed offset. If the target device p has received n ICMP timestamp request messages, then set is the offset of p, is the clock deviation of p, that is The slope of the straight line connecting the point set. Afterwards, the clock deviation is calculated and used as the device fingerprint. In this embodiment, the problem of clock deviation can be regarded as a linear programming problem. Assume that (ax+b) represents The lower limit line, this line needs to be as close as possible To achieve this, the line must be minimized The sum of the distances between all points in , where y i -(ax i +b)≥0, i=0,...,n represents the constraints of the problem, is the objective function.

[0114] The clock deviation is determined as a device fingerprint corresponding to the target device.

[0115] Specifically, install and configure network monitoring tools to capture ICMP timestamp request and response packets in network traffic. Secondly, write a script to record the timestamp, source IP, and destination IP of each data packet, and calculate the clock deviation between the source device and the target device based on the captured timestamp data. Then, analyze the distribution of clock deviation and draw a distribution graph of clock deviation. According to the clock deviation distribution of different target devices, establish a fingerprint database. Later, when extracting the fingerprint of the target device, the target device can be identified by comparing the captured clock deviation distribution with the data in the fingerprint database.

[0116] The technical solution of the embodiment of the present invention uses the clock deviation calculated by the ICMP timestamp message as the device fingerprint. The ICMP timestamp message contains the time information of the device. The clock deviation of different devices may be different, and the clock deviation is a unique feature of the device and is difficult to imitate.

[0117] The technical solution of the embodiment of the present invention proposes a device fingerprint extraction technology based on active interactive response, which mainly involves the transport layer protocols in the IOS model, namely the TCP protocol and the UDP protocol. In the TCP protocol, the device fingerprint is extracted by three methods: using ISN samples to obtain the properties of the device pseudo-random number generator, and setting a firewall to obtain the timeout retransmission value of the SYN_ACK response and the FIN_ACK response; in the UDP protocol, the ICMP-ECHO round-trip time distribution and the clock deviation calculated by the ICMP timestamp message are used as device fingerprints. The technical solution of the embodiment of the present invention has the characteristics of high precision, difficulty in forging, multi-dimensional analysis and real-time in device fingerprint extraction, and can uniquely identify the device in a simple and non-invasive way.

[0118] Embodiment 2

[0119] Figure 2 is a schematic diagram of the structure of a device fingerprint determination device in an embodiment of the present invention. This embodiment can be applied to the case of non-intrusive power device fingerprint determination based on physical signal characteristics. The device can be implemented in software and / or hardware. The device can be integrated in any device that provides the function of device fingerprint determination, such as Figure 2 As shown, the device fingerprint determination apparatus specifically includes: an acquisition module 201 and a determination module 202.

[0120] Wherein, the acquisition module 201 is used to acquire target information of the target device;

[0121] The determination module 202 is configured to determine a device fingerprint corresponding to the target device according to the target information.

[0122] Optionally, the target information is an initial sequence number;

[0123] The determination module 202 is specifically used for:

[0124] Analyze the target quantity of initial sequence numbers to obtain analysis results;

[0125] Determine a pseudo-random number generator attribute corresponding to the target device according to the analysis result;

[0126] The pseudo-random number generator attribute corresponding to the target device is determined as a device fingerprint corresponding to the target device.

[0127] Optionally, the target information is a data packet carrying a synchronization sequence number flag;

[0128] The determination module 202 is specifically used for:

[0129] A first timeout retransmission value corresponding to a data packet carrying a synchronization sequence number mark sent by the target device is obtained, and the first timeout retransmission value is determined as a device fingerprint corresponding to the target device.

[0130] Optionally, the target information is a data packet carrying an end mark;

[0131] The determination module 202 is specifically used for:

[0132] A second timeout retransmission value corresponding to a data packet carrying an end mark sent by the target device is obtained, and the second timeout retransmission value is determined as a device fingerprint corresponding to the target device.

[0133] Optionally, the target information is an echo response;

[0134] The determination module 202 is specifically used for:

[0135] Determine a round trip time according to an echo response returned by the target device, the round trip time being the time between a timestamp corresponding to when the echo request is sent to the target device and a timestamp corresponding to when the echo response returned by the target device is received, the echo response being generated after the target device receives the echo request;

[0136] A probability density function corresponding to the round-trip time is determined as a device fingerprint corresponding to the target device.

[0137] Optionally, the target information is a response message;

[0138] The determination module 202 is specifically used for:

[0139] Determine a receiving timestamp according to a response message returned by the target device;

[0140] Determining a clock deviation according to the receiving timestamp and the initiating timestamp of sending the request message to the target device, wherein the response message is generated after the target device receives the request message;

[0141] The clock deviation is determined as a device fingerprint corresponding to the target device.

[0142] The above-mentioned product can execute the device fingerprint determination method provided by any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0143] Embodiment 3

[0144] Figure 3 A schematic diagram of the structure of an electronic device 30 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0145] like Figure 3 As shown, the electronic device 30 includes at least one processor 31, and a memory connected to the at least one processor 31, such as a read-only memory (ROM) 32, a random access memory (RAM) 33, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 31 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 32 or the computer program loaded from the storage unit 38 to the random access memory (RAM) 33. In the RAM 33, various programs and data required for the operation of the electronic device 30 can also be stored. The processor 31, the ROM 32, and the RAM 33 are connected to each other through a bus 34. An input / output (I / O) interface 35 is also connected to the bus 34.

[0146] A number of components in the electronic device 30 are connected to the I / O interface 35, including: an input unit 36, such as a keyboard, a mouse, etc.; an output unit 37, such as various types of displays, speakers, etc.; a storage unit 38, such as a disk, an optical disk, etc.; and a communication unit 39, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 39 allows the electronic device 30 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0147] The processor 31 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 31 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The processor 31 performs the various methods and processes described above, such as the device fingerprint determination method:

[0148] Get target information of target device;

[0149] A device fingerprint corresponding to the target device is determined according to the target information.

[0150] In some embodiments, the device fingerprint determination method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 38. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 30 via the ROM 32 and / or the communication unit 39. When the computer program is loaded into the RAM 33 and executed by the processor 31, one or more steps of the device fingerprint determination method described above may be performed. Alternatively, in other embodiments, the processor 31 may be configured to perform the device fingerprint determination method in any other appropriate manner (e.g., by means of firmware).

[0151] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0152] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0153] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, device, or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0154] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0155] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0156] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0157] In one embodiment, the embodiment of the present invention further includes a computer program product, the computer program product includes a computer program, and when the computer program is executed by a processor, the device fingerprint determination method of any embodiment of the present invention is implemented.

[0158] In the process of implementation, the computer program product can be written in one or more programming languages ​​or a combination thereof to perform the computer program code of the present invention, including object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computer (for example, using an Internet service provider to connect through the Internet).

[0159] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0160] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for determining a device fingerprint, characterized in that: include: Get target information of target device; A device fingerprint corresponding to the target device is determined according to the target information.

2. The method according to claim 1, characterized in that The target information is an initial sequence number; Determining a device fingerprint corresponding to the target device according to the target information includes: Analyze the target quantity of initial sequence numbers to obtain analysis results; Determine a pseudo-random number generator attribute corresponding to the target device according to the analysis result; The pseudo-random number generator attribute corresponding to the target device is determined as a device fingerprint corresponding to the target device.

3. The method according to claim 1, characterized in that The target information is a data packet carrying a synchronization sequence number mark; Determining a device fingerprint corresponding to the target device according to the target information includes: A first timeout retransmission value corresponding to a data packet carrying a synchronization sequence number mark sent by the target device is obtained, and the first timeout retransmission value is determined as a device fingerprint corresponding to the target device.

4. The method according to claim 1, characterized in that: The target information is a data packet carrying an end mark; Determining a device fingerprint corresponding to the target device according to the target information includes: A second timeout retransmission value corresponding to a data packet carrying an end mark sent by the target device is obtained, and the second timeout retransmission value is determined as a device fingerprint corresponding to the target device.

5. The method according to claim 1, characterized in that The target information is an echo response; Determining a device fingerprint corresponding to the target device according to the target information includes: Determine a round trip time according to an echo response returned by the target device, the round trip time being the time between a timestamp corresponding to when the echo request is sent to the target device and a timestamp corresponding to when the echo response returned by the target device is received, the echo response being generated after the target device receives the echo request; A probability density function corresponding to the round-trip time is determined as a device fingerprint corresponding to the target device.

6. The method according to claim 1, characterized in that The target information is a response message; Determining a device fingerprint corresponding to the target device according to the target information includes: Determine a receiving timestamp according to a response message returned by the target device; Determining a clock deviation according to the receiving timestamp and the initiating timestamp of sending the request message to the target device, wherein the response message is generated after the target device receives the request message; The clock deviation is determined as a device fingerprint corresponding to the target device.

7. A device fingerprint determination apparatus, characterized in that: include: An acquisition module, used to acquire target information of a target device; A determination module is used to determine a device fingerprint corresponding to the target device according to the target information.

8. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can perform the device fingerprint determination method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the device fingerprint determination method according to any one of claims 1 to 6 when executed.

10. A computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the device fingerprint determination method according to any one of claims 1 to 6 is implemented.

Images