Attack anomaly feature extraction modeling method for heterogeneous device fingerprints

Abstract

The invention discloses a heterogeneous device fingerprint-oriented attack anomaly feature extraction modeling method, which adopts a random forest algorithm to perform multi-dimensional attribute learning of communication flow, and can not only process a large amount of data, but also quickly identify potential attack features from the data. According to the method provided by the invention, the flow characteristics of each device are integrated and extracted, and the exclusive device fingerprint database is constructed. The fingerprint database not only contains unique fingerprint information of various devices, but also can be dynamically updated along with the access of new devices and the change of traffic characteristics. The fingerprint database with strong pertinence enables the identification of the equipment to be more accurate, and can effectively distinguish normal traffic from potential attack traffic. The capability is particularly important in a heterogeneous equipment environment, and can ensure the safety management and control of a power system on various equipment.

Description

Technical Field

[0001] The present invention belongs to the field of cyberspace security technology, and in particular relates to an attack anomaly feature extraction and modeling method for heterogeneous device fingerprints. Background Art

[0002] With the rapid development of Internet of Things (IoT) technology, more and more smart devices are widely used in various industries, especially in power systems. The access scale of these devices is constantly expanding, making device fingerprint generation technology gradually become the focus of research and industry. Device fingerprint technology helps identify and authenticate devices by analyzing the traffic characteristics generated by devices in the network, thereby enhancing the security of the network. However, since many power equipment manufacturers and suppliers lack the necessary network security expertise, these devices often have security vulnerabilities in design and implementation.

[0003] Attackers can easily access the internal network by exploiting these vulnerabilities and launch various attacks, bringing serious security risks to the power system. In recent years, regarding the security issues existing in power companies, literature research shows that the proportion of corporate employees connecting a large number of IoT devices to corporate networks is as high as 25%-50%. These devices, such as surveillance cameras, network routers, and PLCs in control systems, have become the main targets of attackers due to their inherent security flaws.

[0004] Device fingerprint technology plays a vital role in today's network security environment, especially in key areas such as the Internet of Things and power systems. Device fingerprints can not only effectively identify and verify devices connected to the network, but also help security teams to conduct in-depth analysis and monitoring of network traffic. With the surge in the number of devices, the traditional identification method based on IP addresses and MAC addresses can no longer meet security needs. Device fingerprint technology provides a more accurate and comprehensive identification method by analyzing the behavioral characteristics and traffic patterns of devices.

[0005] In the power industry, the importance of device fingerprints is particularly prominent. Various smart devices used in power systems, such as surveillance cameras, sensors, and control systems, often face security threats from both inside and outside. By building and applying device fingerprints, companies can monitor device access in real time and quickly identify potential security risks, thereby reducing the chances of vulnerabilities being attacked. In addition, device fingerprint technology can help companies meet increasingly stringent compliance requirements and security standards, providing strong support for the company's network security system.

[0006] In the power industry, the security of equipment is directly related to the stability and reliability of the system. With the increasing reliance on smart grids and automation systems, any cyber attack or equipment failure may lead to large-scale power outages, data leaks, and even economic losses. Therefore, it is particularly important to implement effective access control and real-time monitoring. At present, many power companies have not established a complete security detection mechanism, resulting in the existence of vulnerable equipment and weak network security defense. Summary of the invention

[0007] In order to solve the problems existing in the prior art, the present invention proposes an attack anomaly feature extraction modeling method for heterogeneous device fingerprints.

[0008] The technical solution of the present invention is as follows: A method for extracting attack anomaly features from fingerprints of heterogeneous devices, comprising: Step 1) Monitor the communication traffic of the equipment in the power system in real time and obtain the communication data packets of different equipment; Step 2) extracting multi-dimensional attribute features from the communication data packet to form a feature matrix based on the communication data packet; Step 3) Based on the feature matrix, a unique fingerprint of the device is constructed, and then according to the unique fingerprint of the device, a device fingerprint library storing unique fingerprints corresponding to different devices is constructed; Step 4) Develop a rule engine for communication traffic identification, build a device fingerprint library through the feature index of the attack traffic, and then associate the attack feature knowledge graph with the attack traffic to identify the attack type of the attack traffic; Step 5) Building a device monitoring model based on the random forest algorithm. The input of the device detection model is the communication data packet of the device, and the output is the potential threat features contained in the communication data packet. Based on the monitored communication traffic, the device type is indexed according to the device fingerprint library, and then matched through the formulated rule engine to lock the potential threat features and attack types corresponding to the monitored communication traffic; Step 6) dynamically updating the device fingerprint library according to the communication data packets of the newly connected devices in the power system.

[0009] Furthermore, the equipment in the power system includes a camera, a router and a power generation side PLC.

[0010] Furthermore, the specific method of step 1) includes: Real-time flow monitoring is performed on the equipment in the power system, and the collected original network flow is divided into multiple sessions. A data flow is determined by the same source IP address, destination IP address, source port number, destination port number and transport layer protocol type to form communication data packets for different devices.

[0011] Furthermore, the specific method of step 2) includes: Step 2-1) For the communication data packets of the device, extract several key features with device attributes from the PCAP file of the original traffic data; Step 2-2) Based on the extracted key features, the feature vectors are transformed according to the set transformation rules to form a feature matrix with device behavior differences.

[0012] Furthermore, the key features include ARP and LLC in link layer protocols, IP, ICMP and ICMPV6 in network layer protocols, TCP and UDP in transport layer protocols, HTTP, HTTPS, DNS and SSDP in application layer protocols, data packet length, IP address, source port number and destination port number.

[0013] Furthermore, the set conversion rules include a port interval modeling method, a protocol 0 / 1 modeling method, and an IP address change frequency modeling method.

[0014] Furthermore, the specific method of step 3) includes: The row vectors of the feature matrix are concatenated to form a unique fingerprint of the device, and then a device fingerprint library storing unique fingerprints corresponding to different devices is constructed based on the unique fingerprint of the device.

[0015] Furthermore, the specific method of step 4) includes: Step 4-1) Extract multi-dimensional attribute features from the attack traffic to obtain the features of the attack traffic, and then formulate a rule engine for communication traffic identification. Use the features of the attack traffic to index the fingerprints in the device fingerprint library, thereby realizing the association between the attack traffic and the device fingerprint library; Step 4-2) Based on the characteristics of the attack traffic, the attack traffic is associated with an attack characteristic knowledge graph having the characteristics of the attack traffic and the attack type.

[0016] Furthermore, the specific method of step 5) includes: Step 5-1) Based on the random forest algorithm, a parcel feature selection algorithm is used to learn and train the traffic characteristics of the device to build a device monitoring model; the input of the device detection model is the communication data packet of the device, and the output is the potential threat characteristics contained in the communication data packet; the learning and training process adopts the bagging strategy and random attribute selection; Step 5-2) Monitor the communication traffic sent by the device in real time, and index the device type based on the feature vector of the corresponding exclusive fingerprint in the device fingerprint library; then match it through the established rule engine to lock the potential threat characteristics and attack types corresponding to the communication traffic.

[0017] Compared with the prior art, the present invention has the following beneficial effects: The present invention proposes a method for extracting and modeling attack anomaly features for heterogeneous device fingerprints. The method uses a random forest algorithm to learn the multi-dimensional attributes of communication traffic. This method can not only process large amounts of data, but also quickly identify potential attack features from it. Compared with traditional detection methods, random forests have higher accuracy and robustness when processing complex data. This enables enterprises to detect abnormal traffic in a timely manner before an attack occurs, thereby effectively reducing the risk of the system being attacked. This efficient anomaly detection capability provides a strong guarantee for the safety of the power system.

[0018] The method of the present invention integrates and extracts the traffic characteristics of each device to build a dedicated device fingerprint library. The fingerprint library not only contains the unique fingerprint information of various devices, but can also be dynamically updated as new devices are connected and traffic characteristics change. This highly targeted fingerprint library makes device identification more accurate and can effectively distinguish normal traffic from potential attack traffic. This capability is particularly important in a heterogeneous device environment and can ensure the safe control of various devices by the power system.

[0019] The method of the present invention can timely identify and respond to attack traffic by real-time monitoring of the flow of power system equipment and combining the rule engine with the attack feature knowledge graph. This systematic monitoring and early warning mechanism not only improves the ability to identify known attack patterns, but also enhances the ability to defend against new attacks. Enterprises can respond to attacks in the early stages of their occurrence, thereby reducing potential losses and impacts. This real-time monitoring and early warning system is crucial to ensuring the stability and security of the power system. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 It is a flow chart of the attack anomaly feature extraction modeling method for heterogeneous device fingerprints in an embodiment; Figure 2 A structural block diagram of potential attack types output by a rule engine is constructed in an embodiment. DETAILED DESCRIPTION

[0021] The present invention is further explained below in conjunction with the accompanying drawings and specific embodiments. It should be understood that these embodiments are only used to illustrate the present invention and are not used to limit the scope of the present invention. After reading the present invention, various equivalent modifications of the present invention by those skilled in the art all fall within the scope defined by the claims attached to this application.

[0022] Example: The present invention provides a method for extracting abnormal attack features from heterogeneous device fingerprints. Figure 1 and Figure 2 As shown, the following steps are included: Step 1) Monitor the communication traffic of devices in the power system and obtain communication data packets of different devices; Step 2) extracting multi-dimensional attribute features of the communication data packet, extracting 15 key features, and forming a feature matrix based on the communication data packet flow according to the feature change strategy; Step 3) Based on the feature matrix, a unique fingerprint of the device is constructed, and then according to the unique fingerprint of the device, a device fingerprint library storing unique fingerprints corresponding to different devices is constructed; Step 4) Develop a rule engine for communication traffic identification, build a device fingerprint library through the feature index of the attack traffic, and then associate the attack feature knowledge graph with the attack traffic to identify the attack type of the attack traffic; Step 5) Building a device monitoring model based on the random forest algorithm. The input of the device detection model is the communication data packet of the device, and the output is the potential threat features contained in the communication data packet. Based on the monitored communication traffic, the device type is indexed according to the device fingerprint library, and then matched through the formulated rule engine to lock the potential threat features and attack types corresponding to the monitored communication traffic; Step 6) dynamically updating the device fingerprint library according to the communication data packets of the newly connected devices in the power system.

[0023] Furthermore, the equipment in the power system includes cameras, routers, and power generation side PLC, etc.

[0024] Furthermore, the specific method of step 1) includes: Real-time flow monitoring of equipment in the power system is carried out, and the collected original network flow is divided into multiple sessions. A data flow is determined by the same source IP address, destination IP address, source port number, destination port number and transport layer protocol type to form communication data packets for different devices. This design ensures that the communication flow of each device can be fully collected.

[0025] Furthermore, in order to prevent suspicious devices from bypassing the detection mechanism, continuous traffic monitoring is adopted to periodically collect traffic characteristics corresponding to different IP data flows, minimize the underreporting rate of devices, and ensure that traffic is collected in a real power grid environment to improve data reliability.

[0026] Furthermore, the specific method of step 2) includes: Step 2-1) For the communication data packets of the device, extract several key features with device attributes from the PCAP file of the original traffic data; Step 2-2) Based on the extracted key features, the feature vectors are transformed according to the set transformation rules to form a feature matrix with device behavior differences.

[0027] Furthermore, key features include ARP and LLC in link layer protocols, IP, ICMP and ICMPV6 in network layer protocols, TCP and UDP in transport layer protocols, HTTP, HTTPS, DNS and SSDP in application layer protocols), packet length, IP address, source port number and destination port number.

[0028] Furthermore, the conversion rules set include port interval modeling (divided into 0~3 according to the port number size), protocol 0 / 1 modeling (the protocol existence feature value is 1, and non-existence is 0), and IP address change frequency modeling. This design ensures standardization and consistency of feature values.

[0029] Furthermore, the specific method of step 3) includes: The row vectors of the feature matrix are concatenated to form the unique fingerprint of the device. Then, based on the unique fingerprint of the device, a device fingerprint library storing the unique fingerprints corresponding to different devices is constructed to achieve accurate correspondence between the device and the unique fingerprint.

[0030] Furthermore, the specific method of step 4) includes: Step 4-1) Extract multi-dimensional attribute features from the attack traffic to obtain the features of the attack traffic, and then formulate a rule engine for communication traffic identification. Use the features of the attack traffic to index the fingerprints in the device fingerprint library, thereby realizing the association between the attack traffic and the device fingerprint library; Step 4-2) Based on the characteristics of the attack traffic, the attack traffic is associated with an attack characteristic knowledge graph having the characteristics of the attack traffic and the attack type.

[0031] Furthermore, the specific method of step 5) includes: Step 5-1) Based on the random forest algorithm, a parcel feature selection algorithm is used to learn and train the traffic characteristics of the device to build a device monitoring model; the input of the device detection model is the communication data packet of the device, and the output is the potential threat characteristics contained in the communication data packet; the learning and training process adopts the bagging strategy and random attribute selection to improve the accuracy and generalization ability of the model; Step 5-2) Monitor the communication traffic sent by the device in real time to perform traffic analysis, and index the device type based on the feature vector of the corresponding exclusive fingerprint in the device fingerprint library; then match the rules through the established rule engine, perform security monitoring and lock the potential threat characteristics and attack types corresponding to the communication traffic, and warn security personnel to lock potential attacks on suspicious devices.

[0032] The above description is only a specific implementation of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by a technician familiar with the technical field within the technical scope disclosed by the present invention should be covered by the protection scope of the present invention.

Claims

1. A method for extracting attack anomaly features from heterogeneous device fingerprints, characterized in that: include: Step 1) Monitor the communication traffic of the equipment in the power system in real time and obtain the communication data packets of different equipment; Step 2) extracting multi-dimensional attribute features from the communication data packet to form a feature matrix based on the communication data packet; Step 3) Based on the feature matrix, a unique fingerprint of the device is constructed, and then according to the unique fingerprint of the device, a device fingerprint library storing unique fingerprints corresponding to different devices is constructed; Step 4) Develop a rule engine for communication traffic identification, build a device fingerprint library through the feature index of the attack traffic, and then associate the attack feature knowledge graph with the attack traffic to identify the attack type of the attack traffic; Step 5) Building a device monitoring model based on the random forest algorithm. The input of the device detection model is the communication data packet of the device, and the output is the potential threat features contained in the communication data packet. Based on the monitored communication traffic, the device type is indexed according to the device fingerprint library, and then matched through the formulated rule engine to lock the potential threat features and attack types corresponding to the monitored communication traffic; Step 6) dynamically updating the device fingerprint library according to the communication data packets of the newly connected devices in the power system.

2. The attack anomaly feature extraction modeling method for heterogeneous device fingerprints according to claim 1 is characterized in that: The equipment in the power system includes a camera, a router and a PLC on the power generation side.

3. The attack anomaly feature extraction modeling method for heterogeneous device fingerprints according to claim 1 is characterized in that: The specific methods of step 1) include: Real-time flow monitoring is performed on the equipment in the power system, and the collected original network flow is divided into multiple sessions. A data flow is determined by the same source IP address, destination IP address, source port number, destination port number and transport layer protocol type to form communication data packets for different devices.

4. The attack anomaly feature extraction modeling method for heterogeneous device fingerprints according to claim 1 is characterized in that: The specific methods of step 2) include: Step 2-1) For the communication data packets of the device, extract several key features with device attributes from the PCAP file of the original traffic data; Step 2-2) Based on the extracted key features, the feature vectors are transformed according to the set transformation rules to form a feature matrix with device behavior differences.

5. The attack anomaly feature extraction modeling method for heterogeneous device fingerprints according to claim 4 is characterized in that: The key features include ARP and LLC in link layer protocols, IP, ICMP and ICMPV6 in network layer protocols, TCP and UDP in transport layer protocols, HTTP, HTTPS, DNS and SSDP in application layer protocols, data packet length, IP address, source port number and destination port number.

6. The attack anomaly feature extraction modeling method for heterogeneous device fingerprints according to claim 4 is characterized in that: The set conversion rules include port interval modeling method, protocol 0 / 1 modeling method and IP address change frequency modeling method.

7. The attack anomaly feature extraction and modeling method for heterogeneous device fingerprints according to claim 1 is characterized in that: The specific methods of step 3) include: The row vectors of the feature matrix are concatenated to form a unique fingerprint of the device, and then a device fingerprint library storing unique fingerprints corresponding to different devices is constructed based on the unique fingerprint of the device.

8. The attack anomaly feature extraction and modeling method for heterogeneous device fingerprints according to claim 1 is characterized in that: The specific methods of step 4) include: Step 4-1) Extract multi-dimensional attribute features from the attack traffic to obtain the features of the attack traffic, and then formulate a rule engine for communication traffic identification. Use the features of the attack traffic to index the fingerprints in the device fingerprint library, thereby realizing the association between the attack traffic and the device fingerprint library; Step 4-2) Based on the characteristics of the attack traffic, the attack traffic is associated with an attack characteristic knowledge graph having the characteristics of the attack traffic and the attack type.

9. The attack anomaly feature extraction modeling method for heterogeneous device fingerprints according to claim 8 is characterized in that: The specific methods of step 5) include: Step 5-1) Based on the random forest algorithm, a parcel feature selection algorithm is used to learn and train the traffic characteristics of the device to build a device monitoring model; the input of the device detection model is the communication data packet of the device, and the output is the potential threat characteristics contained in the communication data packet; the learning and training process adopts the bagging strategy and random attribute selection; Step 5-2) Monitor the communication traffic sent by the device in real time, and index the device type based on the feature vector of the corresponding exclusive fingerprint in the device fingerprint library; then match it through the established rule engine to lock the potential threat characteristics and attack types corresponding to the communication traffic.

Images