Network asset fingerprint identification method and device based on Bayesian algorithm

Abstract

The invention provides a network asset fingerprint identification method and device based on a Bayesian algorithm. The method comprises the following steps: acquiring response data of network assets in multiple modes; performing data preprocessing operation and feature extraction operation on the acquired response data; constructing a network asset fingerprint identification model based on a convolutional neural network, taking the extracted feature data as the input of the network asset fingerprint identification model, and training the network asset fingerprint identification model by using a Bayesian machine learning algorithm; and performing fingerprint identification and classification on the new network assets by using the network asset fingerprint identification model. According to the method, the Bayesian neural network architecture suitable for the network asset identification and classification problem is selected, so that the features in the response data can be automatically extracted, the local mode and the spatial correlation are captured, and the classification accuracy of the model on different types of network assets is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of network asset identification, and in particular to a network asset fingerprint identification method and device based on a Bayesian algorithm. Background Art

[0002] In today's digital age, cyberspace has become an important resource for enterprises and organizations. Effective management and protection of network assets are crucial to ensuring network security and maintaining normal business operations.

[0003] Network asset fingerprinting refers to the process of identifying and classifying these assets by collecting and analyzing the characteristics of devices, systems, and applications in the network. However, existing network asset fingerprinting technologies have many defects. Existing network asset fingerprinting methods often rely on manually configured rules or simple pattern matching, which is not only inefficient but also difficult to guarantee accuracy. In addition, existing network asset fingerprinting methods are prone to misjudgment and missed judgment when facing complex and changing network environments and large amounts of network traffic. At the same time, existing technologies also have limitations in data collection. For example, some methods can only collect limited network asset information and cannot fully understand the characteristics of network assets, thus affecting the accuracy of fingerprinting. In addition, existing network asset fingerprinting technologies perform poorly when dealing with interception by network security equipment. With the improvement of network security awareness, various types of security equipment are constantly upgraded, and existing network asset fingerprinting technologies are easily blocked by these security equipment, resulting in the inability to obtain key asset information. Moreover, existing technologies are also insufficient in adapting to changes in the network environment. When the network topology changes and new applications and services are launched, existing identification technologies often cannot be adjusted and adapted in time, thus affecting their effectiveness and practicality.

[0004] To sum up, the existing network asset fingerprint recognition technology has many problems such as high operation and maintenance cost, low efficiency, low accuracy, easy interception by security equipment and poor adaptability, which seriously restricts the effective management of network assets and the protection of network security. Summary of the invention

[0005] In view of this, the present invention provides a network asset fingerprint identification method and device based on a Bayesian algorithm to solve at least one of the above-mentioned problems.

[0006] In order to achieve the above object, the present invention adopts the following scheme:

[0007] According to a first aspect of the present invention, a network asset fingerprint recognition method based on a Bayesian algorithm is provided, the method comprising: collecting response data of network assets using a variety of methods; performing data preprocessing operations and feature extraction operations on the collected response data; constructing a network asset fingerprint recognition model based on a convolutional neural network, using the extracted feature data as input of the network asset fingerprint recognition model, and training the network asset fingerprint recognition model using a Bayesian machine learning algorithm; and using the network asset fingerprint recognition model to perform fingerprint recognition and classification on new network assets.

[0008] As an embodiment of the present invention, the method for collecting response data of network assets by using multiple methods includes: collecting response data of network assets by using network traffic monitoring, port scanning, DNS query, WHOIS query, and HTTP request.

[0009] As an embodiment of the present invention, the data preprocessing operation and feature extraction operation on the collected response data in the above method include: performing a data cleaning operation on the collected response data, the data cleaning operation including missing value processing, outlier processing and duplicate value processing; extracting key features that can represent the network asset fingerprint from the cleaned response data; standardizing the key features and performing dimensionality reduction using principal component analysis.

[0010] As an embodiment of the present invention, the method described above constructs a network asset fingerprint recognition model based on a convolutional neural network, uses the extracted feature data as the input of the network asset fingerprint recognition model, and uses the Bayesian machine learning algorithm to train the network asset fingerprint recognition model, including: selecting a convolutional neural network as the architecture of the network asset fingerprint recognition model; defining a prior distribution for the weight and bias parameters of the network asset fingerprint recognition model; defining a likelihood function for the network asset fingerprint recognition model; using a variational inference method to perform Bayesian inference, specifically including: initializing an optimizable variational distribution to approximate the posterior distribution; calculating the evidence lower bound ELBO, and using an optimization operator to maximize the ELBO; using a reparameterization technique to sample from the variational distribution to calculate the gradient of the ELBO; iteratively updating the parameters of the variational distribution until the ELBO converges; and using a test set to evaluate the performance of the network asset fingerprint recognition model until the performance meets the requirements.

[0011] According to a second aspect of the present invention, there is provided a network asset fingerprint recognition device based on a Bayesian algorithm, the device comprising: a data acquisition unit, used to collect response data of network assets using a variety of methods; a data processing unit, used to perform data preprocessing operations and feature extraction operations on the collected response data; a model training unit, used to construct a network asset fingerprint recognition model based on a convolutional neural network, using the extracted feature data as input of the network asset fingerprint recognition model, and using a Bayesian machine learning algorithm to train the network asset fingerprint recognition model; a fingerprint recognition unit, used to use the network asset fingerprint recognition model to perform fingerprint recognition and classification on new network assets.

[0012] As an embodiment of the present invention, the data collection unit is specifically used to collect response data of network assets by means of network traffic monitoring, port scanning, DNS query, WHOIS query, and HTTP request.

[0013] As an embodiment of the present invention, the above-mentioned data processing unit includes: a data cleaning module, which is used to perform data cleaning operations on the collected response data, and the data cleaning operations include missing value processing, outlier processing and duplicate value processing; a feature extraction module, which is used to extract key features that can represent network asset fingerprints from the cleaned response data; a standardization and dimensionality reduction module, which is used to standardize the key features and use principal component analysis to perform dimensionality reduction operations.

[0014] As an embodiment of the present invention, the above-mentioned model training unit includes: an architecture selection module, which is used to select a convolutional neural network as the architecture of the network asset fingerprint recognition model; a prior distribution definition module, which is used to define a prior distribution for the weight and bias parameters of the network asset fingerprint recognition model; a likelihood function definition module, which defines a likelihood function for the network asset fingerprint recognition model; a Bayesian inference module, which uses a variational inference method to perform Bayesian inference, specifically including: initializing an optimizable variational distribution to approximate the posterior distribution; calculating the evidence lower bound ELBO, and using an optimization operator to maximize the ELBO; using a reparameterization technique to sample from the variational distribution to calculate the gradient of the ELBO; iteratively updating the parameters of the variational distribution until the ELBO converges; a performance evaluation module, which is used to evaluate the performance of the network asset fingerprint recognition model using a test set until the performance meets the requirements.

[0015] According to a third aspect of the present invention, there is provided an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above method when executing the computer program.

[0016] According to a fourth aspect of the present invention, there is provided a computer-readable storage medium having a computer program stored thereon, wherein the computer program implements the steps of the above method when executed by a processor.

[0017] The network asset fingerprint identification method and device based on the Bayesian algorithm proposed in the present invention can automatically extract features from the response data and capture local patterns and spatial correlations by selecting a Bayesian neural network architecture suitable for the network asset identification and classification problem. Appropriate prior distributions are defined for the weights and bias parameters of the neural network to reflect reasonable assumptions about the parameters, while constraining the parameters during the inference process. An accurate likelihood function is defined for the network asset identification and classification problem to measure the difference between the model prediction and the true label, thereby improving the classification accuracy of the model for different categories of network assets. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the prior art descriptions. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. In the drawings:

[0019] Figure 1 It is a flowchart of a network asset fingerprint identification method based on a Bayesian algorithm provided in an embodiment of the present application;

[0020] Figure 2 It is a schematic diagram of a process for collecting network asset response data when a network topology structure changes according to an embodiment of the present application;

[0021] Figure 3 is a flow chart of a data preprocessing operation and a feature extraction operation provided by an embodiment of the present invention;

[0022] Figure 4 It is a schematic diagram of the process of training a network asset fingerprint recognition model provided in an embodiment of the present application;

[0023] Figure 5 is a flow chart of training a network asset fingerprint recognition model provided by another embodiment of the present application;

[0024] Figure 6 It is a schematic diagram of the structure of a network asset fingerprint recognition device based on a Bayesian algorithm provided in an embodiment of the present application;

[0025] Figure 7 is a structural diagram of a data processing unit provided in an embodiment of the present application;

[0026] Figure 8It is a structural diagram of a model training unit provided in an embodiment of the present application;

[0027] Fig. 9 It is a structural schematic diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0028] To make the purpose, technical solution and advantages of the embodiments of the present invention more clear, the embodiments of the present invention are further described in detail below in conjunction with the accompanying drawings. Here, the exemplary embodiments of the present invention and their descriptions are used to explain the present invention, but are not intended to limit the present invention.

[0029] The information collected in the technical solution of this application is information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of relevant data comply with the relevant laws, regulations and standards of relevant countries and regions, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0030] The acquisition, transmission, storage, use, and processing of data in the technical solution of this application comply with the relevant provisions of national laws and regulations.

[0031] It should be noted that in the embodiments of the present application, certain software, components, models and other existing solutions in the industry may be mentioned, and they should be regarded as exemplary. Their purpose is only to illustrate the feasibility of implementing the technical solution of the present application, but it does not mean that the applicant has or will necessarily use the solution.

[0032] like Figure 1 The figure is a flow chart of a network asset fingerprint identification method based on a Bayesian algorithm provided in an embodiment of the present application, the method comprising the following steps:

[0033] Step S101: Collect response data of network assets using multiple methods.

[0034] This step uses a variety of methods to collect response data of network assets, aiming to obtain comprehensive and accurate network asset feature information and provide a data basis for subsequent fingerprint identification. The response data here includes but is not limited to IP address, port number, protocol type, data packet content, etc.

[0035] Preferably, in this step, collecting the response data of the network assets by using multiple methods may include: collecting the response data of the network assets by using network traffic monitoring, port scanning, DNS query, WHOIS query, and HTTP request.

[0036] Network traffic monitoring: It is to monitor network traffic and capture data packets passing through network devices. This method can obtain real-time activity information of network assets, including the source, destination, protocol type, etc. of the data packets.

[0037] Port scanning: It is to identify open ports and their corresponding services by performing port scanning on the target network assets. This can help understand the service types and potential security risks of network assets.

[0038] DNS query: It is to query the DNS records of the target network assets to obtain information such as domain name, IP address, MX record (mail server), NS record (domain name server), etc., which helps to understand the basic information and structure of the network assets.

[0039] WHOIS query: Send a WHOIS query request (for example, query a domain name), and the received response contains domain name registration information, such as registrant, registration date, registrar, etc.

[0040] HTTP request: Send HTTP request to the target network asset, analyze the returned HTTP response header and content, and obtain information such as server type, operating system version, and programming language used. This method can provide in-depth understanding of the application layer characteristics of network assets.

[0041] In order to deal with the interception of network security equipment, this application can further adopt traffic obfuscation to ensure the acquisition of network asset response data, that is, traffic obfuscation technology can be used to disguise the collected traffic as normal network traffic to reduce the risk of being detected by network security equipment. However, it should be pointed out that the network asset data collected by this application are all allowed to be collected within the scope of authorization and comply with relevant laws and regulations. It is only due to the complexity of the current network environment in which network assets are located, such as the installation of security equipment, that collection is difficult.

[0042] Further preferably, in order to timely collect data of network assets in response to changes in the network topology to ensure the timeliness and effectiveness of data collection, the embodiment of the present application may also include the following when collecting response data of network assets: Figure 2 Steps shown:

[0043] Step S201: monitor the target network environment to determine whether there is a change in the network environment.

[0044] When monitoring in this step, a variety of methods can be used, such as using network management protocols or tools such as SNMP to monitor changes in the network topology in real time, including device online / offline, link status changes, etc.; or real-time analysis of network traffic, identifying abnormal situations such as traffic surges and abnormal traffic patterns, and determining whether the network environment has changed; or regularly scanning the network to identify new services or applications online and record their relevant information; or monitoring configuration changes of network devices, such as firewall rules, routing tables, etc., to promptly discover the impact of configuration adjustments on the network environment.

[0045] Step S202: When the monitored network environment changes, the target list for data collection is dynamically updated, and collection parameters are adjusted and collection strategies are switched.

[0046] The target list for data collection is dynamically updated in this step. For example, newly-added devices will be automatically added to the collection targets. Parameter adjustment is to adjust the following data collection parameters according to changes in the network environment: sampling rate, timeout period, detection frequency, and port range. Among them, the sampling rate can be dynamically adjusted according to the size of the network traffic to avoid excessive collection burden; the timeout period can be dynamically adjusted according to the network delay to avoid collection interruption; the detection frequency can be dynamically adjusted according to the activity level of the network assets to avoid excessive detection; the port range can be dynamically adjusted according to the service type of the network assets to improve detection efficiency. Policy switching is to automatically switch different data collection strategies according to the network environment (such as network congestion), such as switching to passive data collection mode when the network is congested.

[0047] Step S203: Execute data collection operation according to the adjusted data collection strategy.

[0048] The above steps S201-S203 clearly describe the process of the adaptive data collection method, emphasizing its dynamic adjustment and adaptive capabilities, so that the application can effectively collect network asset data in a complex and changing network environment.

[0049] Through the above method, step S101 can more effectively collect the response data of network assets, providing a solid data foundation for subsequent feature extraction and model training, which not only improves the comprehensiveness and accuracy of data collection, but also enhances the ability to resist network security devices.

[0050] Step S102: performing data preprocessing and feature extraction operations on the collected response data.

[0051] Preferably, Figure 3 As shown, this step may further include the following sub-steps:

[0052] Step S1021: performing data cleaning operations on the collected response data, wherein the data cleaning operations include missing value processing, abnormal value processing, and duplicate value processing.

[0053] Missing value processing refers to the need to adopt appropriate strategies to deal with missing data. Common methods include: deletion, filling and prediction. Deletion means that if the proportion of missing values ​​is small, you can consider directly deleting the samples containing missing values; filling means using statistics such as mean, median, mode to fill missing values, or using more complex interpolation methods to fill; prediction means using machine learning models to predict missing values.

[0054] Outliers are data points that are significantly different from other data, which may be caused by measurement errors or other reasons. Methods for dealing with outliers include: deletion, replacement, and transformation. Deletion refers to directly deleting outliers; replacement refers to replacing outliers with other values, such as replacing them with the mean or median; transformation refers to transforming data, such as logarithmic transformation or Box-Cox transformation, to reduce the impact of outliers.

[0055] Duplicate value processing refers to removing duplicate data and retaining unique data.

[0056] Step S1022: extract key features that can represent the network asset fingerprint from the cleaned response data.

[0057] This step extracts key features that can represent the fingerprint of network assets from the cleaned data. The key features here include but are not limited to: packet length distribution features, protocol field features, traffic pattern features, etc. The selection of features needs to be adjusted according to the actual situation, and the distinguishability and redundancy of the features should be considered.

[0058] Step S1023: Standardize the key features and use principal component analysis to perform dimensionality reduction.

[0059] Feature standardization is to convert feature data into data with the same dimension and distribution. Commonly used methods include Z-score standardization and MinMax standardization, which can prevent certain features from having too much impact on the model due to different dimensions.

[0060] Principal component analysis (PCA) dimensionality reduction refers to using PCA to reduce the dimensionality of high-dimensional features, reduce data redundancy, improve computational efficiency, and avoid the curse of dimensionality. PCA maps the original features to a new feature space through linear transformation, retaining the principal component with the largest variance. However, it should be noted that the number of principal components to be retained needs to be selected according to the actual situation to balance information loss and computational efficiency.

[0061] Step S103: construct a network asset fingerprint recognition model based on a convolutional neural network, use the extracted feature data as input of the network asset fingerprint recognition model, and train the network asset fingerprint recognition model using a Bayesian machine learning algorithm.

[0062] Preferably, Figure 4 As shown, this step may further include the following sub-steps:

[0063] Step S1031: Select a convolutional neural network as the architecture of the network asset fingerprint recognition model.

[0064] In this embodiment, the reason for choosing CNN as the network architecture is its advantages: first, CNN can automatically learn features without manually designing complex feature extractors, which is very effective for processing complex and diverse network asset fingerprint data. It can capture local patterns and spatial correlations in message data, such as message header information, repeated occurrence of specific fields, etc. Secondly, CNN has good robustness to noise and data changes, and can maintain good performance in the face of different network environments and data changes. The sharing of weights and local connections reduces sensitivity to specific locations. Finally, CNN can effectively process large-scale data, which is very important for tasks such as network asset fingerprinting that usually require processing large amounts of data.

[0065] Step S1032: defining a priori distribution for weight and bias parameters of the network asset fingerprint recognition model.

[0066] The prior distribution is defined for the weight (ω) and bias (β) parameters of the network asset fingerprint recognition model. The present invention adopts a Gaussian prior distribution: ω~N(0,σω2) The weight obeys a Gaussian distribution with a mean of 0 and a variance of σ2. β~N(0,σβ2) The bias obeys a Gaussian distribution with a mean of 0 and a variance of σ2. Among them, σ2 is a small positive number, reflecting the prior uncertainty assumption of the parameter, and N represents a normal distribution. This embodiment chooses the Gaussian prior distribution because it is more common in Bayesian inference, has good mathematical properties, and is easy to calculate.

[0067] Step S1033: defining a likelihood function for the network asset fingerprint recognition model.

[0068] The likelihood function L(θ) is defined to measure the difference between the model prediction and the true label. Assume that there are N network assets returning message data points, and each data point x i Belongs to one of the k categories, with y i Represents its category label, then the weighted likelihood function of the entire data set is:

[0069]

[0070] Among them, wi is the category y i The prior probability, p(y i |x i ,θ) is the predicted category y given the input xi and model parameters θ i probability.

[0071] Step S1034: Use variational inference to perform Bayesian inference, specifically including: initializing an optimizable variational distribution to approximate the posterior distribution; calculating the evidence lower bound ELBO, and using an optimization operator to maximize the ELBO; using a reparameterization technique to sample from the variational distribution to calculate the gradient of the ELBO; iteratively updating the parameters of the variational distribution until the ELBO converges.

[0072] Step S1035: Use the test set to evaluate the performance of the network asset fingerprint recognition model until the performance meets the requirements.

[0073] Use the test set to evaluate the performance of the trained model. The evaluation indicators in this step can include accuracy, precision, recall, F1 value, etc. The iterative training and evaluation process continues until the model performance meets the preset requirements.

[0074] Further preferably, the above step S103 is to build a network asset fingerprint recognition model based on a convolutional neural network, but it cannot learn the potential representation of the network asset fingerprint. In order to learn the potential representation of the network asset fingerprint, this step S103 can also be replaced by the following steps: build a network asset fingerprint recognition model based on a variational autoencoder (VAE) and a Bayesian layer. Specifically, it may include the following steps: Figure 5 The relevant steps shown are:

[0075] Step S501: Design the encoder and decoder network architecture to form the basic framework of VAE. The encoder maps the input network asset fingerprint features to a low-dimensional latent representation vector z and defines a probability distribution for z (e.g., a Gaussian distribution, whose mean and variance are output by the encoder). At the same time, define a prior distribution for the latent vector z, such as a standard normal distribution N(0, I). Finally, define a likelihood function to measure the difference between the features reconstructed by the decoder and the original features (e.g., using MSE).

[0076] Step S502: Based on the VAE model and likelihood function defined in step S501, as well as the prior distribution of the potential vector z, a complete objective function, the evidence lower bound ELBO, is constructed. ELBO contains reconstruction loss and KL divergence terms. Variational inference, especially the reparameterization technique, is used to calculate the gradient of ELBO, and the optimization algorithm (such as Adam) is used to iteratively update the parameters of the encoder and decoder until ELBO converges.

[0077] Step S503: Use an independent test set to evaluate the performance of the trained VAE model. Evaluation indicators include reconstruction error (measurement of the decoder reconstruction capability) and fingerprint recognition accuracy (measurement of the model's accuracy in fingerprinting network assets). Based on the evaluation results, adjust the model parameters or architecture to improve model performance.

[0078] Through the above steps, since VAE can learn the potential representation of network asset fingerprints, it can better capture the essential features in the data, thereby improving the generalization ability of the model. Moreover, by applying a prior distribution to the potential representation, VAE can better control the complexity of the model and avoid overfitting, thereby improving the generalization ability and robustness of the model, which is especially important when dealing with changes in network environment and noisy data.

[0079] Step S104: Use the network asset fingerprint recognition model to perform fingerprint recognition and classification on new network assets.

[0080] From the above, it can be seen that the network asset fingerprint recognition method based on the Bayesian algorithm proposed in the present invention can automatically extract features from the response data and capture local patterns and spatial correlations by selecting a Bayesian neural network architecture suitable for the network asset recognition and classification problem. Define appropriate prior distributions for the weights and bias parameters of the neural network to reflect reasonable assumptions about the parameters, and constrain the parameters during the inference process. Define an accurate likelihood function for the network asset recognition and classification problem, measure the difference between the model prediction and the true label, and improve the classification accuracy of the model for different categories of network assets.

[0081] like Figure 6 The figure shows a schematic diagram of the structure of a network asset fingerprint identification device based on the Bayesian algorithm provided by an embodiment of the present application, the device comprises: a data acquisition unit 610, a data processing unit 620, a model training unit 630 and a fingerprint identification unit 640, which are connected in sequence. Among them:

[0082] The data collection unit 610 is used to collect response data of network assets using multiple methods.

[0083] The data processing unit 620 is used to perform data preprocessing operations and feature extraction operations on the collected response data.

[0084] The model training unit 630 is used to construct a network asset fingerprint recognition model based on a convolutional neural network, use the extracted feature data as the input of the network asset fingerprint recognition model, and train the network asset fingerprint recognition model using a Bayesian machine learning algorithm.

[0085] The fingerprint recognition unit 640 is used to perform fingerprint recognition and classification on new network assets using the network asset fingerprint recognition model.

[0086] Preferably, the data collection unit 610 is specifically used to collect response data of network assets by means of network traffic monitoring, port scanning, DNS query, WHOIS query, and HTTP request.

[0087] Preferably, Figure 7 As shown, the data processing unit 620 includes: a data cleaning module 621, which is used to perform data cleaning operations on the collected response data, and the data cleaning operations include missing value processing, abnormal value processing and duplicate value processing; a feature extraction module 622, which is used to extract key features that can represent network asset fingerprints from the cleaned response data; a standardization and dimensionality reduction module 623, which is used to standardize the key features and use principal component analysis to perform dimensionality reduction operations.

[0088] Preferably, Figure 8 As shown, the above-mentioned model training unit 630 includes: an architecture selection module 631, which is used to select a convolutional neural network as the architecture of the network asset fingerprint recognition model; a prior distribution definition module 632, which is used to define a prior distribution for the weight and bias parameters of the network asset fingerprint recognition model; a likelihood function definition module 633, which defines a likelihood function for the network asset fingerprint recognition model; a Bayesian inference module 634, which uses a variational inference method to perform Bayesian inference, specifically including: initializing an optimizable variational distribution to approximate the posterior distribution; calculating the evidence lower bound ELBO, and using an optimization operator to maximize the ELBO; using a reparameterization technique to sample from the variational distribution to calculate the gradient of the ELBO; iteratively updating the parameters of the variational distribution until the ELBO converges; a performance evaluation module 635, which is used to evaluate the performance of the network asset fingerprint recognition model using a test set until the performance meets the requirements.

[0089] For a detailed description of the above-mentioned units and modules, please refer to the corresponding description in the aforementioned method embodiment, which will not be further elaborated here.

[0090] From the above, it can be seen that the network asset fingerprint identification device based on the Bayesian algorithm proposed by the present invention can automatically extract features from the response data and capture local patterns and spatial correlations by selecting a Bayesian neural network architecture suitable for the network asset identification and classification problem. Define appropriate prior distributions for the weights and bias parameters of the neural network to reflect reasonable assumptions about the parameters, and constrain the parameters during the inference process. Define an accurate likelihood function for the network asset identification and classification problem, measure the difference between the model prediction and the true label, and improve the classification accuracy of the model for different categories of network assets.

[0091] Fig. 9 is a schematic diagram of an electronic device provided by an embodiment of the present invention. Fig. 9The electronic device shown is a general data processing device, which includes a general computer hardware structure, which at least includes a processor 801 and a memory 802. The processor 801 and the memory 802 are connected via a bus 803. The memory 802 is suitable for storing one or more instructions or programs executable by the processor 801. The one or more instructions or programs are executed by the processor 801 to implement the steps in the above-mentioned network asset fingerprint identification method based on the Bayesian algorithm.

[0092] The processor 801 may be an independent microprocessor or a collection of one or more microprocessors. Thus, the processor 801 executes the commands stored in the memory 802 to execute the method flow of the embodiment of the present invention as described above to realize the processing of data and the control of other devices. The bus 803 connects the above-mentioned multiple components together, and at the same time connects the above-mentioned components to the display controller 804 and the display device and the input / output (I / O) device 805. The input / output (I / O) device 805 may be a mouse, a keyboard, a modem, a network interface, a touch input device, a somatosensory input device, a printer, and other devices known in the art. Typically, the input / output (I / O) device 805 is connected to the system via an input / output (I / O) controller 806.

[0093] The memory 802 may store software components such as an operating system, a communication module, an interaction module, and an application program. Each of the modules and applications described above corresponds to a set of executable program instructions that implement one or more functions and methods described in the embodiments of the invention.

[0094] An embodiment of the present invention further provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of the network asset fingerprint identification method based on the Bayesian algorithm are implemented.

[0095] From the above, it can be seen that the network asset fingerprint identification method and device based on the Bayesian algorithm proposed in the present invention can automatically extract features from the response data and capture local patterns and spatial correlations by selecting a Bayesian neural network architecture suitable for the network asset identification and classification problem. Define appropriate prior distributions for the weights and bias parameters of the neural network to reflect reasonable assumptions about the parameters, and constrain the parameters during the inference process. Define an accurate likelihood function for the network asset identification and classification problem, measure the difference between the model prediction and the true label, and improve the classification accuracy of the model for different categories of network assets.

[0096] The preferred embodiments of the present invention are described above with reference to the accompanying drawings. Many features and advantages of these embodiments are clear from this detailed description, and therefore the claims are intended to cover all such features and advantages of these embodiments that fall within their true spirit and scope. In addition, since many modifications and changes are easily conceivable to those skilled in the art, it is not intended to limit the embodiments of the present invention to the precise structure and operation illustrated and described, but all suitable modifications and equivalents falling within its scope may be covered.

[0097] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0098] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0099] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0100] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0101] The specific embodiments described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A network asset fingerprint identification method based on Bayesian algorithm, characterized in that: The method comprises: Collect response data of network assets using various methods; Performing data preprocessing and feature extraction operations on the collected response data; Constructing a network asset fingerprint recognition model based on a convolutional neural network, using the extracted feature data as input to the network asset fingerprint recognition model, and using a Bayesian machine learning algorithm to train the network asset fingerprint recognition model; The network asset fingerprint recognition model is used to perform fingerprint recognition and classification on new network assets.

2. The network asset fingerprint identification method based on Bayesian algorithm as claimed in claim 1, characterized in that: The method of collecting the response data of network assets by using multiple methods includes: collecting the response data of network assets by using network traffic monitoring, port scanning, DNS query, WHOIS query, and HTTP request.

3. The network asset fingerprint identification method based on Bayesian algorithm as claimed in claim 1, characterized in that: The data preprocessing operation and feature extraction operation performed on the collected response data include: Performing data cleaning operations on the collected response data, wherein the data cleaning operations include missing value processing, outlier value processing, and duplicate value processing; Extract key features that can represent network asset fingerprints from the cleaned response data; The key features are standardized and the principal component analysis method is used to perform dimensionality reduction.

4. The network asset fingerprint identification method based on Bayesian algorithm as claimed in claim 1, characterized in that: The step of constructing a network asset fingerprint recognition model based on a convolutional neural network, using the extracted feature data as input of the network asset fingerprint recognition model, and training the network asset fingerprint recognition model using a Bayesian machine learning algorithm includes: Select convolutional neural network as the architecture of the network asset fingerprint recognition model; defining a prior distribution for weight and bias parameters of the network asset fingerprinting model; defining a likelihood function for the network asset fingerprint recognition model; Use variational inference to perform Bayesian inference, including: initializing an optimizable variational distribution to approximate the posterior distribution; calculating the evidence lower bound ELBO and maximizing ELBO using an optimization operator; using the reparameterization technique to sample from the variational distribution to calculate the gradient of ELBO; iteratively updating the parameters of the variational distribution until ELBO converges; The performance of the network asset fingerprint recognition model is evaluated using the test set until the performance meets the requirements.

5. A network asset fingerprint recognition device based on Bayesian algorithm, characterized in that: The device comprises: A data collection unit, used for collecting response data of network assets using multiple methods; A data processing unit, used for performing data preprocessing and feature extraction operations on the collected response data; A model training unit, used to construct a network asset fingerprint recognition model based on a convolutional neural network, use the extracted feature data as input of the network asset fingerprint recognition model, and train the network asset fingerprint recognition model using a Bayesian machine learning algorithm; The fingerprint recognition unit is used to perform fingerprint recognition and classification on new network assets using the network asset fingerprint recognition model.

6. The network asset fingerprint identification device based on the Bayesian algorithm as claimed in claim 5, characterized in that: The data collection unit is specifically used to collect response data of network assets by means of network traffic monitoring, port scanning, DNS query, WHOIS query, and HTTP request.

7. The network asset fingerprint recognition device based on Bayesian algorithm as claimed in claim 5, characterized in that: The data processing unit comprises: A data cleaning module, used to perform data cleaning operations on the collected response data, wherein the data cleaning operations include missing value processing, abnormal value processing and duplicate value processing; A feature extraction module is used to extract key features that can represent the fingerprint of network assets from the cleaned response data; The standardization and dimension reduction module is used to standardize the key features and perform dimension reduction using the principal component analysis method.

8. The network asset fingerprint identification device based on Bayesian algorithm as claimed in claim 5, characterized in that: The model training unit comprises: An architecture selection module, used to select a convolutional neural network as the architecture of the network asset fingerprint recognition model; A prior distribution definition module, used to define a prior distribution for weight and bias parameters of the network asset fingerprint recognition model; A likelihood function definition module, defining a likelihood function for the network asset fingerprint recognition model; The Bayesian inference module uses the variational inference method to perform Bayesian inference, including: initializing an optimizable variational distribution to approximate the posterior distribution; calculating the evidence lower bound ELBO and maximizing ELBO using an optimization operator; using the reparameterization technique to sample from the variational distribution to calculate the gradient of ELBO; iteratively updating the parameters of the variational distribution until ELBO converges; The performance evaluation module is used to evaluate the performance of the network asset fingerprint recognition model using a test set until the performance meets the requirements.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 4 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 4 are implemented.

Images