Power Internet of Things terminal fingerprint feature extraction method, device, equipment and medium

Abstract

The invention belongs to the technical field of power Internet of Things, and particularly relates to a power Internet of Things terminal fingerprint feature extraction method, device and equipment and a medium. The method comprises the following steps: extracting time domain feature information and frequency domain feature information of a transient signal of equipment; performing feature extraction on the time domain feature information and the frequency domain feature information by using a feature learning network to obtain final time domain feature representation and frequency domain feature representation; splicing the time domain feature representation and the frequency domain feature representation to obtain a terminal physical fingerprint feature; extracting each data packet from the interaction flow, and extracting behavior feature information of each data packet; and splicing and combining the behavior characteristic information to obtain the behavior fingerprint characteristics of the electric power Internet of Things terminal. According to the method, hardware-software full-level identity attribute information of the terminal is extracted, software attribute information identification is carried out on the basis of hardware attribute information identification, software fingerprints easy to implement and anti-repudiation hardware fingerprints are bound, and unique and credible identification is carried out on the identity of the terminal.

Description

Technical Field

[0001] The present invention belongs to the technical field of electric power Internet of Things, and specifically relates to a method, device, equipment and medium for extracting fingerprint features of electric power Internet of Things terminals. Background Art

[0002] In the era of the power Internet of Things, the network environment is filled with a huge number of IoT devices with different functions and types. How to accurately identify and effectively supervise these devices in a complex and dangerous network environment is an urgent problem that the power Internet of Things needs to solve. Due to factors such as scale and complexity, diversity, resource limitations, and physical security, the security of the power Internet of Things requires more fine-grained control compared to traditional Internet security. It is necessary to adopt multi-level and multi-dimensional security identification and authentication measures to establish a more reliable and secure IoT ecosystem to ensure the availability of power equipment and systems.

[0003] On the one hand, there are many types of power Internet of Things terminals. Due to the limitation of environmental resources, most power sensing terminals do not have high security configuration, and it is difficult to achieve high authentication strength under low configuration to deal with security authentication issues; on the other hand, the identity authentication scheme of traditional Internet of Things devices, whether based on lightweight public key algorithm or pre-shared key authentication technology, has problems such as key leakage and high key generation and distribution costs. With the development of emerging terminal software and hardware fingerprint technology, it has the characteristics of high security and easy implementation, and can be used for the identity authentication of terminals in power Internet of Things scenarios. However, due to the complexity of power Internet of Things terminals, although hardware fingerprints are anti-repudiation, they are easily affected by interference from the signal transmission environment. In the extraction of software fingerprint features, terminal interaction traffic and behavior characteristics are easy to obtain, but the traffic characteristics of the power Internet of Things are simple and consistent, and the binding with the terminal is not high, especially it is difficult to distinguish terminals of the same type and model. Summary of the invention

[0004] The object of the present invention is to provide a method, device, equipment and medium for extracting fingerprint features of a power Internet of Things terminal, so as to at least solve one of the technical problems in the prior art.

[0005] In order to achieve the above object, the present invention adopts the following technical solution: In a first aspect of the present invention, a method for extracting fingerprint features of a power Internet of Things terminal is provided, wherein the fingerprint features of the power Internet of Things terminal include physical fingerprint features and behavioral fingerprint features of the terminal; the method comprises the following steps: Acquire a device transient signal of a power Internet of Things terminal, and extract time domain characteristic information and frequency domain characteristic information of the device transient signal; Using a preset feature learning network, extracting features from the time domain feature information and the frequency domain feature information to obtain a final time domain feature representation and a frequency domain feature representation; splicing the time domain feature representation and the frequency domain feature representation to obtain a terminal physical fingerprint feature; Extracting each data packet from the interactive traffic of the power IoT terminal, and extracting behavioral feature information of each data packet; The behavioral feature information of each data packet is spliced ​​and combined to obtain the behavioral fingerprint characteristics of the power Internet of Things terminal.

[0006] Furthermore, extracting time domain feature information and frequency domain feature information of the transient signal of the device includes: Perform signal sampling point interval extraction processing on the device transient signal to obtain a non-repetitive device transient signal segment; Performing up-sampling processing on the transient signal segment of the device to obtain an expanded transient signal segment; The expanded transient signal segment is segmented to obtain a plurality of sub-sample segments; for each sub-sample segment, the characteristic arrays corresponding to the instantaneous phase, the instantaneous frequency and the instantaneous amplitude are counted respectively; the characteristic arrays of all sub-sample segments are constructed as the time domain characteristic information of the power Internet of Things terminal; The transient signal segment of the device is converted from the time domain to the frequency domain to obtain frequency domain characteristic information of the power Internet of Things terminal.

[0007] Furthermore, a preset feature learning network is used to extract features from the time domain feature information and the frequency domain feature information to obtain final time domain feature representation and frequency domain feature representation, including: The feature learning network includes a GRU model and a CNN model; The GRU model is used to extract features from the time domain feature information, and the CNN model is used to extract features from the frequency domain feature information.

[0008] Furthermore, the behavior feature information of each data packet is extracted, including: For a single data packet, the key block is identified based on the information entropy of each byte position in the data packet; All key blocks in the same data packet are combined into a key block set as the behavior feature information of the current data packet.

[0009] Furthermore, the key blocks are identified based on the information entropy of each byte position in the data packet, including: Multiple data packets in the interactive traffic are stacked together; each data packet is left-aligned; the local information entropy of each left-aligned data packet is calculated according to the byte position; and the key block is determined according to the entropy value calculation result of the local information entropy.

[0010] In a second aspect of the present invention, a device for extracting fingerprint features of a power Internet of Things terminal is provided, wherein the fingerprint features of the power Internet of Things terminal include physical fingerprint features and behavioral fingerprint features of the terminal; the device comprises: A first information extraction module is used to obtain a device transient signal of the power Internet of Things terminal, and extract time domain feature information and frequency domain feature information of the device transient signal; A feature learning module is used to extract the time domain feature information and the frequency domain feature information using a preset feature learning network to obtain a final time domain feature representation and a frequency domain feature representation; and to concatenate the time domain feature representation and the frequency domain feature representation to obtain a terminal physical fingerprint feature; A second information extraction module is used to extract each data packet from the interactive traffic of the power Internet of Things terminal, and extract the behavior feature information of each data packet; The feature splicing module is used to splice and combine the behavioral feature information of each data packet to obtain the behavioral fingerprint features of the power Internet of Things terminal.

[0011] Furthermore, in the first information extraction module, extracting the time domain feature information and the frequency domain feature information of the transient signal of the device includes: Perform signal sampling point interval extraction processing on the device transient signal to obtain a non-repetitive device transient signal segment; Performing up-sampling processing on the transient signal segment of the device to obtain an expanded transient signal segment; The expanded transient signal segment is segmented to obtain a plurality of sub-sample segments; for each sub-sample segment, the characteristic arrays corresponding to the instantaneous phase, the instantaneous frequency and the instantaneous amplitude are counted respectively; the characteristic arrays of all sub-sample segments are constructed as the time domain characteristic information of the power Internet of Things terminal; The transient signal segment of the device is converted from the time domain to the frequency domain to obtain frequency domain characteristic information of the power Internet of Things terminal.

[0012] Furthermore, in the second information extraction module, behavior feature information of each data packet is extracted, including: For a single data packet, the key block is identified based on the information entropy of each byte position in the data packet; All key blocks in the same data packet are combined into a key block set as the behavior feature information of the current data packet.

[0013] In a third aspect of the present invention, an electronic device is provided, comprising a processor and a memory, wherein the processor is used to execute a computer program stored in the memory to implement the above-mentioned method for extracting fingerprint features of a power Internet of Things terminal.

[0014] According to a fourth aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores at least one instruction, and when the at least one instruction is executed by a processor, the method for extracting fingerprint features of a power Internet of Things terminal as described above is implemented.

[0015] Compared with the prior art, the beneficial effects of the present invention are as follows: The method of the present invention obtains the device transient signal of the power Internet of Things terminal, extracts the time domain feature information and frequency domain feature information of the device transient signal; uses a preset feature learning network to extract the time domain feature information and the frequency domain feature information, and obtains the final time domain feature representation and the frequency domain feature representation; splices the time domain feature representation and the frequency domain feature representation to obtain the terminal physical fingerprint feature; extracts each data packet from the interactive traffic of the power Internet of Things terminal, extracts the behavior feature information of each data packet; splices and combines the behavior feature information of each data packet to obtain the behavior fingerprint feature of the power Internet of Things terminal. The method extracts the identity attribute information of the terminal "hardware-software" at all levels, and performs software attribute information recognition on the basis of hardware attribute information recognition, thereby realizing the binding of the easy-to-implement software fingerprint with the anti-repudiation hardware fingerprint, uniquely and reliably identifying the terminal identity, effectively improving the security and robustness of terminal device recognition, and thereby utilizing the terminal asset detection technology combined with active and passive to realize the extraction of terminal physical and behavior fingerprint feature information. The power Internet of Things terminal fingerprint feature extraction device, electronic device and computer-readable storage medium provided by the present invention also solve the problems raised in the background technology section.

[0016] During the terminal physical fingerprint feature extraction process, this solution jointly models the time domain feature information and the frequency domain feature information into a unified model, uses the feature learning network to further learn deeper and richer time domain feature representations and frequency domain feature representations, and uses splicing operations to generate multimodal fusion features to achieve more reliable device hardware attribute identification.

[0017] In the process of extracting behavioral fingerprint features, this solution does not strictly rely on identifying specific fields of data packets. It has a wider applicability than previous methods that rely on this information. It can extract features without knowing prior protocol information. In addition, the extraction of behavioral features focuses on the research based on network data packet behavior, models the behavior of network data packets for device communication, constructs a sequence to summarize device behavior, and retains the timing relationship between interactive data packets in the network flow. Compared with the single data packet level, it not only considers the device behavior itself, but also includes the timing information of the interactive behavior, so as to classify different devices. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The drawings constituting a part of the present application are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings: Figure 1 A schematic diagram of a flow chart of a method for extracting fingerprint features of a power IoT terminal according to an embodiment of the present invention; Figure 2 Schematic diagram of the principle of the method for extracting fingerprint features of a power IoT terminal in an embodiment of the present invention; Figure 3 This is a diagram showing the architecture of a method for extracting physical fingerprint features of a terminal in an embodiment of the present invention; Figure 4 Schematic diagram of comparison before and after signal sampling point interval decimation processing in an embodiment of the present invention; Figure 5 : A signal diagram before and after upsampling in an embodiment of the present invention; Figure 6 It is a frequency domain feature extraction diagram in an embodiment of the present invention; Figure 7 It is a frequency domain characteristic diagram of different equipment terminals in an embodiment of the present invention; Figure 8 This is a diagram showing the architecture of a behavior fingerprint feature extraction method in an embodiment of the present invention; Fig. 9 A flowchart of key block identification in an embodiment of the present invention; Fig.10 It is an information entropy distribution diagram of different device terminals in an embodiment of the present invention; Fig.11 A schematic diagram of behavior information modeling in an embodiment of the present invention; Fig.12 A schematic diagram of sequence information modeling in an embodiment of the present invention; Fig.13 A comparison of ablation experiment results in an embodiment of the present invention; Fig.14 It is a performance diagram for identifying different parameter values ​​in the embodiment of the present invention; Fig.15 This is a structural block diagram of a fingerprint feature extraction device for a power IoT terminal according to an embodiment of the present invention; Fig.16 The present invention is a structural block diagram of an electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0019] The present invention will be described in detail below with reference to the accompanying drawings and in combination with embodiments. It should be noted that the embodiments and features in the embodiments of the present application can be combined with each other without conflict.

[0020] The following detailed description is an exemplary description, which is intended to provide further detailed description of the present invention. Unless otherwise specified, all technical terms used in the present invention have the same meaning as those generally understood by those skilled in the art to which the present application belongs. The terms used in the present invention are only for describing specific embodiments, and are not intended to limit exemplary embodiments according to the present invention.

[0021] Example 1 The embodiment of the present invention aims at the problem of secure access to power Internet of Things devices and provides a method for extracting fingerprint features of power Internet of Things terminals, which can achieve multi-level and high-accuracy security authentication based on the fingerprint features of device software and hardware.

[0022] In this solution, the fingerprint features of the power IoT terminal that need to be extracted include the physical fingerprint features and behavioral fingerprint features of the terminal.

[0023] To this end, this solution generates a more comprehensive feature representation by capturing the feature information of different modes of device transient signals. Terminal physical fingerprint feature extraction consists of multimodal feature extraction, multimodal feature fusion and hardware attribute information recognition, such as Figure 3 As shown in the figure. Multimodal feature extraction mainly extracts the time domain feature representation and frequency domain feature representation of the power IoT terminal. Multimodal feature fusion mainly combines the time domain feature representation and the frequency domain feature representation to obtain multimodal fusion features as the physical fingerprint features of the terminal. Hardware attribute information recognition uses a pre-trained recognition model and takes the multimodal fusion features as input to identify the device identity corresponding to the hardware attribute information of the power IoT terminal.

[0024] In order to achieve full-level identity authentication of power IoT devices and effectively improve the reliability of device identification, this application extracts the behavioral characteristics of the device through steps such as behavioral information modeling and sequence information modeling to identify the device software attribute information. The method architecture diagram is shown below: Figure 8As shown, on the basis of hardware-level authentication, through software-level authentication, the full-level "hardware-software" authentication of the terminal is further realized. At present, device fingerprint extraction based on network traffic mostly focuses on specific field information in the data packet. Due to the diversity of protocols adopted by power Internet of Things terminals, this scheme directly extracts data packet feature information from the hexadecimal byte stream of the message, without the need to parse the data packet content. It can perform feature extraction in the case of unknown prior protocol information, and has a wider applicability, even if the data packet is encrypted. It will not be affected. The terminal behavior feature extraction proposed in this application mainly includes two steps: behavior information modeling and sequence information modeling. Behavior information modeling is for the level of a single data packet, and sequence information modeling is for the level of data packet sequence. The behavior fingerprint characteristics of the device are extracted by using the behavior information modeling and sequence information modeling steps to identify the device software attribute information.

[0025] like Figure 1 and Figure 2 As shown, a method for extracting fingerprint features of a power IoT terminal includes the following steps: S1. Obtain a device transient signal of a power Internet of Things terminal, and extract time domain feature information and frequency domain feature information of the device transient signal.

[0026] Specifically, the time domain characteristic information and frequency domain characteristic information of the device transient signal are extracted, including: performing signal sampling point interval extraction processing on the device transient signal to obtain non-repetitive device transient signal segments; performing upsampling processing on the device transient signal segments to obtain expanded transient signal segments; performing segmentation processing on the expanded transient signal segments to obtain a plurality of sub-sample segments; for each sub-sample segment, statistically analyzing the characteristic arrays corresponding to the instantaneous phase, instantaneous frequency and instantaneous amplitude respectively; constructing the characteristic arrays of all sub-sample segments as the time domain characteristic information of the power Internet of Things terminal; converting the device transient signal segments from the time domain to the frequency domain to obtain the frequency domain characteristic information of the power Internet of Things terminal.

[0027] More specifically, the signal sampling point interval extraction process is performed on the device transient signal, including: for the original transient signal, sampling points are extracted from different starting points at a certain interval to form non-repeating new samples, and the basic characteristics of the original signal are retained. Figure 4 As shown, the left side is the original device transient signal segment in the data set, and the right side is the preprocessed transient signal segment.

[0028] As a specific example, Figure 5As shown in the figure, the number of sample points in the transient signal segment of the device is 300. This solution increases the number of sample points in the transient signal segment by 10 times through upsampling, obtaining 3000 sample points to highlight the local features in the signal. The upsampled 3000 sample points are then divided into 10 segments, each containing 300 sample points. Time domain feature extraction is performed for each segment of samples, and the Hilbert transform is used to generate instantaneous phase, frequency and amplitude values ​​for each segment of 300 samples.

[0029] The Hilbert transform calculation formula is as follows:

[0030]

[0031]

[0032]

[0033] in, is the input signal, is the Hilbert transform result, , , They represent the instantaneous phase, instantaneous frequency and instantaneous amplitude respectively.

[0034] The statistical indicators and related calculations used in this scheme are shown in Table 1, where: Represents the instantaneous phase, frequency or amplitude of each sample segment, and N is the number of sample points contained in each sample segment.

[0035] The standard deviation and variance are used to measure the dispersion of data; the arithmetic mean and median are trend measures used to describe the central tendency of the data distribution; the arithmetic mean gives equal weight to data points and is a good expression of the center of the data for a data set that follows a normal distribution. Unlike the arithmetic mean, the harmonic mean gives higher weight to smaller values ​​and can provide more accurate estimates for cases where there are extreme values ​​or deviations in the data set. The geometric mean can represent the relative relationship between values ​​in a data set. Skewness is a statistic used to assess the asymmetry of a distribution. When the arithmetic mean and median are not equal, skewness shows deviations from a normal distribution and measures the degree of deviation between individual sample values ​​and the mean. Kurtosis is a statistical characteristic that provides information about the density of sample values ​​within a distribution, indicating whether the values ​​are tightly clustered around the mean or distributed over a wider range.

[0036] While calculating the median, the lower class boundary l of the median class, the size of the median class interval h, the frequency f corresponding to the median class, the total number of observations N (the sum of the frequencies), and the cumulative frequency c of reaching the median class are specifically considered.

[0037] Table 1 Statistical indicators and their calculation formulas

[0038] The instantaneous phase, instantaneous frequency and instantaneous amplitude of each sample are calculated using the above statistics to obtain the features shown in Table 2, thereby generating a feature array for each sample . Extract the feature arrays of all segments and construct the sequence time domain features , that is, the time domain characteristic information related to the device.

[0039] Table 2 Feature description

[0040] As a specific example, the device transient signal segment is converted from the time domain to the frequency domain through FFT to obtain a representation of the device transient signal in the frequency domain.

[0041] The formula for FFT conversion is as follows:

[0042]

[0043] Among them, x(n) is the input signal, that is, the preprocessed transient signal segment of the device, N is the length of the input signal, and X(k) represents the complex value of the kth frequency component in the frequency domain. It is the frequency domain characteristic sequence of the signal.

[0044] like Figure 6 As shown in the figure, the left side is the transient signal segment after preprocessing, and the right side is the single-sided spectrum diagram corresponding to the signal segment, that is, the frequency domain feature information related to the device. Figure 7 The frequency domain characteristic information of different terminal devices is displayed. As can be seen from the figure, the frequency domain characteristic information of different devices is obviously different.

[0045] S2. Using a preset feature learning network, extract the time domain feature information and the frequency domain feature information to obtain a final time domain feature representation and a frequency domain feature representation; and concatenate the time domain feature representation and the frequency domain feature representation to obtain a terminal physical fingerprint feature.

[0046] Specifically, a preset feature learning network is used to perform feature extraction on the time domain feature information and the frequency domain feature information to obtain the final time domain feature representation and the frequency domain feature representation, including: the feature learning network includes a GRU model and a CNN model; the GRU model is used to extract the time domain feature information, and the CNN model is used to extract the frequency domain feature information.

[0047] Optionally, for the captured time-frequency domain information, a feature learning network is used to further extract local important information, and by learning different modal features separately, a deeper feature expression is captured. The feature learning network is composed of a GRU model and a CNN model, which learn the input time domain feature information and frequency domain feature information respectively to generate the final time domain feature representation and frequency domain feature representation.

[0048] 1) Time domain feature extraction based on GRU GRU is a variant of recurrent neural network. Compared with the traditional RNN structure, GRU introduces some gating mechanisms, which allows the model to adaptively select how much historical information should be retained and how much new information should be updated at the current moment. These gating mechanisms can effectively alleviate the gradient vanishing and gradient exploding problems of RNN models, while also being able to capture longer-term dependencies and improve the model's expressiveness and generalization capabilities.

[0049] GRU is similar to LSTM, but has only two gating units: reset gate and update gate. The reset gate determines how much information from the previous state needs to be forgotten, and the update gate determines how much new information needs to be integrated. Compared with LSTM, GRU has fewer parameters, lower computational cost, and faster training speed.

[0050] The algorithm flow of using the GRU model to further learn time domain feature information is as follows:

[0051] The specific steps are: ① Initialize the GRU model; define model related parameters; ② Input the feature matrix into the GRU model: For each time step t, input the feature matrix xt and the hidden state ht-1 of the previous time step into the GRU model to obtain the output ht of the current time step; ③ Get the output of the GRU model: merge the output ht of all time steps to get the final feature representation.

[0052] 2) Frequency domain feature extraction based on CNN model The CNN model further extracts frequency domain feature information. The local connection and weight sharing mechanism of CNN enables it to capture local features more effectively. In the convolution layer, multiple convolution kernels of different sizes can be used to capture feature information at multiple levels of abstraction, thereby obtaining deeper frequency domain features.

[0053] In the frequency domain feature extraction task, the purpose of the convolution layer is to further learn the input frequency domain feature information. Each convolution kernel can be regarded as a specific filter. The sliding window convolution operation on the input frequency domain feature information can effectively extract the local features of the input data.

[0054] The convolution kernel is convolved with the input frequency domain feature information to obtain the feature matrix corresponding to each convolution kernel. The formula for the convolution operation is:

[0055] Among them, S represents the feature matrix extracted after the convolution layer operation, and the weight matrix W and the bias vector b are the parameters learned by the network. is the activation function.

[0056] After the convolution operation, it is necessary to perform nonlinear mapping on the convolution results to enhance the expressive power of the feature matrix so as to better capture deeper frequency domain feature information.

[0057] Nonlinear mapping is achieved by using an activation function, which can map the convolution result into a nonlinear space. Common activation functions include ReLU, sigmoid, and tanh, among which ReLU is one of the most commonly used activation functions, which can maintain nonlinearity and has a relatively fast calculation speed. In the present invention, the ReLU function is used as the activation function, and the formula for nonlinear mapping is as follows:

[0058] The feature representations generated by all convolution kernels are merged to generate the final frequency domain features.

[0059] Specifically, the time domain feature representation and the frequency domain feature representation are spliced, including: f t and frequency domain feature representation f k performs multimodal feature fusion, and the result f As input to the classifier: .

[0060] Optionally, after obtaining the physical fingerprint features of the terminal, the physical fingerprint features of the terminal are used as input to a first recognition model, and the first recognition model outputs a classification probability, thereby preliminarily detecting the identity of the device terminal; wherein the first recognition model uses a fully connected neural network and a softmax activation function.

[0061] As a specific example, the softmax activation function calculates the classification probability of the device category, and the calculation formula is:

[0062] in, represents the softmax activation function, f i represents the multimodal fusion feature representation of device i, Indicates the device i The recognition probability of the classification result, w and b Denotes weights and biases.

[0063] S3. Extract each data packet from the interactive traffic of the power IoT terminal, and extract behavioral feature information of each data packet.

[0064] Specifically, the behavior feature information of each data packet is extracted, including: for a single data packet, identifying key blocks based on the information entropy of each byte position in the data packet; combining all key blocks in the same data packet into a key block set as the behavior feature information of the current data packet.

[0065] Specifically, the key blocks are identified based on the information entropy of each byte position in the data packet, including: stacking multiple data packets in the interactive traffic together; left-aligning each data packet; calculating the local information entropy of each left-aligned data packet according to the byte position; and determining the key blocks according to the entropy value calculation result of the local information entropy.

[0066] Optionally, this solution utilizes information entropy to analyze the byte stream of a single data packet in the interactive traffic of the terminal device, distinguish the importance of fields, analyze key blocks that may become behavioral feature information, identify patterns or regularities in specific behaviors, and generate feature information of a single data packet.

[0067] Optionally, behavioral information modeling uses information entropy to analyze the byte stream of a single data packet in the interactive traffic of the terminal device, distinguish the importance of the field, and analyze the key blocks that may become behavioral feature information to identify the pattern or regularity in a specific behavior and generate feature information for a single data packet. Statistical calculations are performed on the byte stream of the data packet of the interactive traffic of the same power IoT device, and the type and number of bytes appearing at each position are counted, and the entropy of the current position is calculated. The randomness of the field is displayed by the distribution of entropy at different byte positions, thereby determining the key blocks that may become behavioral feature information.

[0068] like Fig. 9 As shown, the specific process of key block identification is designed as follows: Packet stacking: Stacking multiple packets in device interaction traffic together; where multiple packets cover various behavior modes of the device, it is possible to capture specific patterns or regularities in the packet content in the entire data set.

[0069] Left alignment: Left-align the data packets, that is, align from the first byte of different data packets. The purpose is to identify byte changes at the same position through entropy calculation, and then find possible key blocks.

[0070] Entropy calculation: The local information entropy is calculated for the data in the stacked area according to the byte position. The local information entropy is used to determine the relatively stable byte position. Specifically, all bytes appearing at a certain byte position are regarded as a sequence containing n different bytes. The information entropy of this specific position is defined as:

[0071] Among them, m i is byte t i The number of occurrences of , m is the length of the sequence at that particular position.

[0072] Key block identification: Based on the entropy calculation results, analyze and determine the locations that can be identified as key blocks. Specifically, Fig.10 The entropy distribution of the byte stream of the data packets from the interactive traffic of different power IoT devices at different positions is shown. Some byte positions have very low entropy, indicating that the content of the position is relatively stable and can be selected as a key block. In particular, for equal probability events, each are equal to , the value of information entropy approaches 1, and the power Internet of Things equipment has more periodic information under normal working conditions, and there are equal probability situations in specific locations, that is, it may be a variable field with a small number of byte value types. Therefore, this scheme also identifies the position where the information entropy approaches 1 as a key block.

[0073] S4. Combine the behavior feature information of each data packet to obtain the behavior fingerprint feature of the power IoT terminal.

[0074] In order to describe the specific process of behavioral information modeling, this solution makes the following problem definition. This solution defines the content of the data packet It is composed of different fields of the message, and the corresponding hexadecimal byte stream data is The key blocks are determined based on the entropy analysis of different byte positions. All key blocks form a key block set Skey, which can be used as the behavioral feature information of the current data packet, such as Fig.11 shown.

[0075] like Fig.10 As shown, since the distribution positions of key blocks are mainly concentrated at the front end and the back end of the data packet, in the behavioral information modeling stage, in an optional embodiment of the present scheme, m bytes are intercepted from the forward and reverse directions of each data packet byte stream to form the behavioral characteristic information S of the data packet, and the length value of the characteristic field is L=2m.

[0076] The process of sequence information modeling is as follows Fig.11 As shown in the figure, based on the interactive traffic of the target power IoT device, the behavioral feature information of g consecutive data packets is extracted to construct a behavioral feature sequence , Fbehavior is the behavioral feature fingerprint of the terminal device.

[0077] Preferably, the solution also uses an LDA (Linear Discriminant Analysis) algorithm to reduce the dimension of the behavior features, and thereby identify the device software attribute information.

[0078] LDA is based on maximizing the ratio of the inter-class scatter matrix to the intra-class scatter matrix to select the best projection direction, thereby achieving dimensionality reduction and classification of data. In the dimensionality reduction process, LDA projects the samples into a low-dimensional subspace, so that samples of different categories are separated as much as possible after projection, while retaining the category information of the samples to the greatest extent. This process is achieved by optimizing the objective function, which improves the inter-class scatter matrix while minimizing the intra-class scatter matrix, so as to achieve the purpose of effectively extracting features and maximizing classification performance.

[0079] like Figure 2 As shown, the physical fingerprint features and behavioral fingerprint features of the terminal are used to jointly identify the power equipment terminal. Specifically, after the first recognition model recognizes, the behavioral fingerprint features are used as the input of the second recognition model, and the second recognition model performs further recognition, and comprehensively considers the recognition results of the first and second recognition models to obtain the identity recognition result of the power equipment terminal.

[0080] The present invention extracts the identity attribute information of the "hardware-software" full-level of the power Internet of Things terminal, and performs software attribute information identification based on the hardware attribute information identification, thereby binding the anti-repudiation hardware fingerprint with the easy-to-implement software fingerprint, uniquely and reliably identifying the terminal identity, and effectively improving the security and robustness of terminal device identification.

[0081] Verification Example The present invention targets electric power Internet of Things devices and captures the full-level "hardware-software" identity attribute information of the terminal for device identity recognition through multimodal hardware fingerprint elements extracted based on transient signals and behavioral fingerprint elements extracted based on interactive traffic.

[0082] In order to verify the effectiveness of the method proposed in the present invention and understand the classification performance of software and hardware level identity authentication, the present invention designed the following experiments: By designing experiments to delete time domain feature information, frequency domain feature information and feature learning network ablation, the effectiveness of the multimodal hardware fingerprint element extraction method proposed in the method of the present invention is verified.

[0083] By conducting experiments under different feature field lengths in behavior sequence modeling and different sequence lengths in sequence information modeling, the optimal parameter setting values ​​are verified and determined, and the features are optimized to obtain the best classification effect.

[0084] The classification and recognition performance of the method of the present invention is evaluated by conducting classification comparison experiments on the software and hardware recognition methods proposed in the method of the present invention and the existing terminal equipment recognition methods.

[0085] Experimental Dataset For the six power IoT devices shown in Table 3, the Bluetooth signals and network interaction traffic of the devices are collected, so that the hardware-level identity authentication of the devices can be performed through the transient signal segment of the collected signals, and the software-level identity authentication of the devices can be performed based on the collected network interaction traffic.

[0086] Table 3 Introduction to equipment types

[0087] Evaluation indicators For the classification task of device identity recognition, accuracy is used as the evaluation indicator. At the same time, in order to more comprehensively evaluate the classification performance, in addition to accuracy, the true positive rate, false positive rate and F1 score are supplemented as evaluation indicators of the device identity recognition task. The calculation method of the above evaluation indicators is:

[0088]

[0089]

[0090]

[0091] Among them, TP represents the number of samples correctly classified as category A and actually belong to category A, TN represents the number of samples correctly classified as non-category A and actually belong to non-category A, FP represents the number of samples incorrectly classified as category A but actually belong to non-category A, and FN represents the number of samples incorrectly classified as non-category A but actually belong to category A.

[0092] Ablation experiment and result analysis Since the multimodal hardware fingerprint feature extraction method contains multiple key components, multiple variants are designed in the experiment to verify the effectiveness of each part of the method.

[0093] Method 1: Based on the multimodal hardware fingerprint element extraction method, the time domain feature information is deleted, the CNN model is used to learn the frequency domain feature information, the frequency domain feature representation is generated, and finally the device is identified through the fully connected neural network and softmax function.

[0094] Method 2: Based on the multimodal hardware fingerprint element extraction method, the frequency domain feature information is deleted, the time domain feature information is learned through the GRU model, the time domain feature representation is generated, and finally the device is identified through the fully connected neural network and softmax function.

[0095] Method 3: Based on the multimodal hardware fingerprint feature extraction method, the feature learning network is deleted. The multimodal fusion features of this variant are directly concatenated from the original frequency domain feature information and time domain feature information. This comparison method is used to verify the effectiveness of the feature learning network.

[0096] The accuracy and F1 score results of the ablation experiment are as follows Fig.13 As shown in the figure, we can see that: By comparing the recognition results of method 1, method 2 and the method of the present invention, it can be seen that the recognition performance of the method of the present invention is better than that of method 1 and method 2, indicating that the combination of time domain information and frequency domain information can provide more comprehensive device hardware attribute information, thereby improving the accuracy of device hardware-level identity authentication.

[0097] Comparing the experimental results of method 3 and the method of the present invention, it is found that the recognition accuracy and F1 score of the method of the present invention are better than those of method 3. This shows that the feature learning network can capture deeper feature expressions, thereby improving recognition performance.

[0098] Parameter setting and analysis In the device software level authentication stage, the device-related software attribute information is extracted through behavior information modeling and sequence information modeling. In order to analyze the impact of the feature field length L in behavior information modeling and the sequence length g in sequence information modeling on the classification performance, different feature field length values ​​L and sequence length values ​​g are set for experiments. The accuracy is used as an evaluation indicator to measure the performance under the influence of different length values. The experimental results are shown in the figure. Fig.14 shown.

[0099] The recognition performance under different parameter values ​​is shown in Fig.14 As shown in the figure, we can see that: 1) The influence of feature field length in the behavior information modeling stage: As the feature field length increases, the classification accuracy changes continuously. When the feature field length value L is 72, the accuracy is the highest and then tends to be flat.

[0100] 2) Influence of sequence length in the sequence information modeling stage: As the sequence length changes, the classification accuracy shows a trend of increasing and then flattening. When the sequence length g is 20, the classification accuracy is the highest.

[0101] In summary, in the present invention, the feature field length value is set to 72, and the sequence length in the sequence information modeling stage is set to 20. Based on this setting, software-level identity recognition can achieve better classification performance.

[0102] Comparative experiment and result analysis Hardware-level authentication At present, a lot of research methods have been proposed in the field of terminal identification. Among them, hardware fingerprint feature authentication technology is mostly based on a single time domain feature or frequency domain feature, and software fingerprint feature authentication is more based on statistical features. The present invention proposes to combine software and hardware fingerprint feature authentication technology to achieve full-level device identity authentication. In order to verify the effectiveness of the method of the present invention, several typical software and hardware fingerprint feature authentication methods are selected below for comparison with the software and hardware level identity authentication methods proposed in the method of the present invention. The performance of these methods is shown in Table 4 and Table 5.

[0103] Table 4 Performance comparison of hardware fingerprint feature authentication methods

[0104] Table 5 Performance comparison of software fingerprint feature authentication methods

[0105] From Table 4 and Table 5, we can see that: 1) The hardware-level identity authentication method proposed in the present invention has a higher recognition accuracy than the hardware fingerprint feature authentication method that only uses time domain features or frequency domain features, which shows that combining time and frequency domain features can capture more comprehensive feature information, which is beneficial to improving the recognition accuracy of the device hardware level.

[0106] 2) The performance of the software fingerprint feature authentication method based on statistical features is weaker than that of the software-level identity authentication method proposed in this invention, which indicates that behavioral features can better capture the behavioral patterns and dynamic changes of devices than statistical features, thus having higher accuracy in terminal identification. In addition, it can be clearly found that device identification based on data stream extraction features has a higher accuracy rate, indicating that feature extraction based on the data stream level can provide a global perspective and contain richer feature information.

[0107] Therefore, in order to address the access security issues of power Internet of Things devices that are large in scale, scattered in distribution, and have different communication methods, and taking into account the wide variety of power Internet of Things devices and the complex services, this application, in the hardware-level authentication stage, captures more comprehensive device hardware attribute information through the proposed multimodal hardware fingerprint element extraction method combined with time-frequency domain feature information, and at the same time uses a feature learning network to further obtain deeper feature expressions. In the software-level authentication stage, the behavioral information modeling and sequence information modeling proposed in the present invention are used to extract device-related behavioral features, and feature extraction can be performed in the case of unknown prior protocol information, effectively improving the scope of application of the method.

[0108] The experimental results show that the present application method can achieve a high recognition accuracy rate in both software and hardware level authentication stages. By identifying software attribute information based on hardware attribute information identification, the terminal's "hardware-software" full-level identity authentication is realized, effectively improving the security of device identity identification.

[0109] Example 2 like Fig.15 As shown, based on the same inventive concept as the above embodiment, the present invention also provides a device for extracting fingerprint features of a power Internet of Things terminal, and the fingerprint features of the power Internet of Things terminal include the physical fingerprint features and behavioral fingerprint features of the terminal; The device comprises: A first information extraction module is used to obtain a device transient signal of the power Internet of Things terminal, and extract time domain feature information and frequency domain feature information of the device transient signal; A feature learning module is used to extract the time domain feature information and the frequency domain feature information using a preset feature learning network to obtain a final time domain feature representation and a frequency domain feature representation; and to concatenate the time domain feature representation and the frequency domain feature representation to obtain a terminal physical fingerprint feature; A second information extraction module is used to extract each data packet from the interactive traffic of the power Internet of Things terminal, and extract the behavior feature information of each data packet; The feature splicing module is used to splice and combine the behavioral feature information of each data packet to obtain the behavioral fingerprint features of the power Internet of Things terminal.

[0110] In the first information extraction module, time domain feature information and frequency domain feature information of the transient signal of the device are extracted, including: Perform signal sampling point interval extraction processing on the device transient signal to obtain a non-repetitive device transient signal segment; Performing up-sampling processing on the transient signal segment of the device to obtain an expanded transient signal segment; The expanded transient signal segment is segmented to obtain a plurality of sub-sample segments; for each sub-sample segment, the characteristic arrays corresponding to the instantaneous phase, the instantaneous frequency and the instantaneous amplitude are counted respectively; the characteristic arrays of all sub-sample segments are constructed as the time domain characteristic information of the power Internet of Things terminal; The transient signal segment of the device is converted from the time domain to the frequency domain to obtain frequency domain characteristic information of the power Internet of Things terminal.

[0111] In the second information extraction module, the behavior feature information of each data packet is extracted, including: For a single data packet, the key block is identified based on the information entropy of each byte position in the data packet; All key blocks in the same data packet are combined into a key block set as the behavior feature information of the current data packet.

[0112] Example 3 like Fig.16 As shown, the present invention also provides an electronic device 100 for implementing a method for extracting fingerprint features of a power IoT terminal; The electronic device 100 includes a memory 101 , at least one processor 102 , a computer program 103 stored in the memory 101 and executable on the at least one processor 102 , and at least one communication bus 104 .

[0113] The memory 101 can be used to store a computer program 103. The processor 102 implements the steps of a method for extracting fingerprint features of a power Internet of Things terminal in Example 1 by running or executing the computer program stored in the memory 101 and calling the data stored in the memory 101.

[0114] The memory 101 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc.; the data storage area may store data (such as audio data) created according to the use of the electronic device 100, etc. In addition, the memory 101 may include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), at least one disk storage device, a flash memory device, or other non-volatile solid-state storage devices.

[0115] At least one processor 102 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The processor 102 may be a microprocessor or any conventional processor, etc. The processor 102 is the control center of the electronic device 100, and uses various interfaces and lines to connect various parts of the entire electronic device 100.

[0116] The memory 101 in the electronic device 100 stores a plurality of instructions to implement a method for extracting fingerprint features of a power IoT terminal, and the processor 102 can execute the plurality of instructions to implement: Acquire a device transient signal of a power Internet of Things terminal, and extract time domain characteristic information and frequency domain characteristic information of the device transient signal; Using a preset feature learning network, extracting features from the time domain feature information and the frequency domain feature information to obtain a final time domain feature representation and a frequency domain feature representation; splicing the time domain feature representation and the frequency domain feature representation to obtain a terminal physical fingerprint feature; Extracting each data packet from the interactive traffic of the power IoT terminal, and extracting behavioral feature information of each data packet; The behavioral feature information of each data packet is spliced ​​and combined to obtain the behavioral fingerprint characteristics of the power Internet of Things terminal.

[0117] Example 4 If the module / unit integrated in the electronic device 100 is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present invention implements all or part of the processes in the above-mentioned embodiment method, and can also be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned method embodiments when executed by the processor. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. Computer-readable media may include: any entity or device capable of carrying computer program code, recording medium, U disk, mobile hard disk, disk, optical disk, computer memory and read-only memory (ROM, Read-Only Memory).

[0118] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0119] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0120] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0121] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0122] In the description of this specification, the description with reference to the terms "one embodiment", "example", "specific example", etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner.

[0123] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents. Any modification or equivalent replacement that does not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A method for extracting fingerprint features of a power IoT terminal, characterized in that: The fingerprint characteristics of the power Internet of Things terminal include the physical fingerprint characteristics and behavioral fingerprint characteristics of the terminal; the method comprises the following steps: Acquire a device transient signal of a power Internet of Things terminal, and extract time domain characteristic information and frequency domain characteristic information of the device transient signal; Using a preset feature learning network, extracting features from the time domain feature information and the frequency domain feature information to obtain a final time domain feature representation and a frequency domain feature representation; splicing the time domain feature representation and the frequency domain feature representation to obtain a terminal physical fingerprint feature; Extracting each data packet from the interactive traffic of the power IoT terminal, and extracting behavioral feature information of each data packet; The behavioral feature information of each data packet is spliced ​​and combined to obtain the behavioral fingerprint characteristics of the power Internet of Things terminal.

2. The method for extracting fingerprint features of a power IoT terminal according to claim 1 is characterized in that: Extracting time domain feature information and frequency domain feature information of the transient signal of the device, including: Perform signal sampling point interval extraction processing on the device transient signal to obtain a non-repetitive device transient signal segment; Performing up-sampling processing on the transient signal segment of the device to obtain an expanded transient signal segment; The expanded transient signal segment is segmented to obtain a plurality of sub-sample segments; for each sub-sample segment, the characteristic arrays corresponding to the instantaneous phase, the instantaneous frequency and the instantaneous amplitude are counted respectively; the characteristic arrays of all sub-sample segments are constructed as the time domain characteristic information of the power Internet of Things terminal; The transient signal segment of the device is converted from the time domain to the frequency domain to obtain frequency domain characteristic information of the power Internet of Things terminal.

3. The method for extracting fingerprint features of a power IoT terminal according to claim 1, characterized in that: The feature learning network includes a GRU model and a CNN model; Using a preset feature learning network, feature extraction is performed on the time domain feature information and the frequency domain feature information to obtain a final time domain feature representation and a frequency domain feature representation, including: The GRU model is used to extract features from the time domain feature information, and the CNN model is used to extract features from the frequency domain feature information.

4. The method for extracting fingerprint features of a power IoT terminal according to claim 1, characterized in that: Extract behavioral feature information of each data packet, including: For a single data packet, the key block is identified based on the information entropy of each byte position in the data packet; All key blocks in the same data packet are combined into a key block set as the behavior feature information of the current data packet.

5. The method for extracting fingerprint features of a power IoT terminal according to claim 4 is characterized in that: Identify key blocks based on the information entropy of each byte position in the data packet, including: Multiple data packets in the interactive traffic are stacked together; each data packet is left-aligned; the local information entropy of each left-aligned data packet is calculated according to the byte position; and the key block is determined according to the entropy value calculation result of the local information entropy.

6. A fingerprint feature extraction device for a power IoT terminal, characterized in that: The fingerprint characteristics of the power Internet of Things terminal include the physical fingerprint characteristics and behavioral fingerprint characteristics of the terminal; the device includes: A first information extraction module is used to obtain a device transient signal of the power Internet of Things terminal, and extract time domain feature information and frequency domain feature information of the device transient signal; A feature learning module is used to extract the time domain feature information and the frequency domain feature information using a preset feature learning network to obtain a final time domain feature representation and a frequency domain feature representation; and to concatenate the time domain feature representation and the frequency domain feature representation to obtain a terminal physical fingerprint feature; A second information extraction module is used to extract each data packet from the interactive traffic of the power Internet of Things terminal, and extract the behavior feature information of each data packet; The feature splicing module is used to splice and combine the behavioral feature information of each data packet to obtain the behavioral fingerprint features of the power Internet of Things terminal.

7. The fingerprint feature extraction device for power IoT terminal according to claim 6 is characterized in that: In the first information extraction module, time domain feature information and frequency domain feature information of the transient signal of the device are extracted, including: Perform signal sampling point interval extraction processing on the device transient signal to obtain a non-repetitive device transient signal segment; Performing up-sampling processing on the transient signal segment of the device to obtain an expanded transient signal segment; The expanded transient signal segment is segmented to obtain a plurality of sub-sample segments; for each sub-sample segment, the characteristic arrays corresponding to the instantaneous phase, the instantaneous frequency and the instantaneous amplitude are counted respectively; the characteristic arrays of all sub-sample segments are constructed as the time domain characteristic information of the power Internet of Things terminal; The transient signal segment of the device is converted from the time domain to the frequency domain to obtain frequency domain characteristic information of the power Internet of Things terminal.

8. The fingerprint feature extraction device for power IoT terminal according to claim 6 is characterized in that: In the second information extraction module, the behavior feature information of each data packet is extracted, including: For a single data packet, the key block is identified based on the information entropy of each byte position in the data packet; All key blocks in the same data packet are combined into a key block set as the behavior feature information of the current data packet.

9. An electronic device, characterized in that: It comprises a processor and a memory, wherein the processor is used to execute a computer program stored in the memory to implement the power Internet of Things terminal fingerprint feature extraction method as described in any one of claims 1 to 5.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores at least one instruction, and when the at least one instruction is executed by the processor, the power Internet of Things terminal fingerprint feature extraction method as described in any one of claims 1 to 5 is implemented.

Images