A method and device for detecting counterfeit dumb terminals

Abstract

The present invention provides a counterfeit dumb terminal detection method and device, the method comprising: obtaining operating system information of a device to be accessed; comparing the operating system information with a pre-constructed network fingerprint snapshot, and determining whether the device to be accessed is a counterfeit dumb terminal according to the comparison result. The present invention obtains the operating system information of the device to be accessed, compares the operating system information of the current device with a legitimate network fingerprint, and determines whether it is a counterfeit dumb terminal according to the comparison result. Through the above-mentioned identification and detection method for illegal counterfeiting of dumb terminals, the dumb terminal device is prevented from accessing the network due to counterfeiting of IP addresses, MAC addresses, etc., and then using this to attack the network. It can be used to detect any dumb terminal device that cannot install client management, with a wide range of applications and strong detection capabilities.

Description

Technical Field

[0001] The present invention relates to the technical field of counterfeit dumb terminal detection, and in particular to a counterfeit dumb terminal detection method and device. Background Art

[0002] With the rapid development of computer technology and the emergence of the Internet of Things, the traditional "terminal device" has changed. It is not only servers, office computers and laptops, but also includes printers, fingerprint scanners, IP phones, IP cameras or tailored cloud desktop thin terminal devices and other "dumb terminals". Such devices have certain common characteristics. First, they use proprietary operating systems, have poor interactivity, and cannot install security agent software for host-level protection; second, they have relatively high permissions in the network, and firewalls generally allow full access to them. In view of these two characteristics, if a counterfeit attack occurs, it is easy to break through the existing security protection system of the network, and there are serious security risks such as network attacks and data leaks.

[0003] Traditional counterfeit identification detection technology cannot truly solve the above security issues due to inherent defects such as the need to install software agents. At present, for the management of dumb devices, MAC binding is generally performed on the switch, or a whitelist is used in the terminal access control solution to access the network, that is, the MAC address can be successfully connected to the network if it is in the whitelist.

[0004] With the rapid iteration and update of IoT devices, new data privacy protection methods such as device random MAC or private MAC have emerged. Traditional counterfeit identification detection technology based on MAC address as its unique identity identifier for device network authentication has great defects. Summary of the invention

[0005] The present invention provides a counterfeit dumb terminal detection method and device, which are used to solve the defects of the prior art in which the MAC address is used as the unique identifier of the dumb terminal for device network access authentication, and realize accurate detection of the counterfeit dumb terminal.

[0006] The present invention provides a counterfeit dumb terminal detection method, comprising the following steps.

[0007] Obtain operating system information of the device to be connected; The operating system information is compared with a pre-built network fingerprint snapshot, and based on the comparison result, it is determined whether the device to be connected is a counterfeit dumb terminal.

[0008] According to the counterfeit dumb terminal detection method provided by the present invention, the operating system information includes the default TTL value, default window size, ACK sequence number, and initial sequence number of the operating system; Wherein, the default TTL value is used to characterize the survival time of the data packet; The default window size is used to characterize the size of the TCP receive or send window; The ACK sequence number is used to represent the initial sequence number of the data packet processed by different operating systems for TCP / IP; The initial sequence number is used to represent the sequence number carried by each data packet during the data transmission process.

[0009] According to the counterfeit dumb terminal detection method provided by the present invention, the step of obtaining the operating system information of the device to be connected specifically includes: Monitor the TCP / IP data flow to obtain the TCP / IP data message sent by the device to be connected; The operating system information of the device to be connected is obtained according to the TCP / IP data message header feature.

[0010] According to the counterfeit dumb terminal detection method provided by the present invention, the step of obtaining the operating system information of the device to be connected specifically includes: Sending a TCP / IP detection sequence to the device to be connected, and receiving a response from the device to be connected to the TCP / IP detection sequence; The response is parsed to obtain operating system information of the device to be connected.

[0011] According to the counterfeit dumb terminal detection method provided by the present invention, the network fingerprint snapshot is constructed in the following manner: Build operating system network fingerprint feature library; The fingerprint features in the network fingerprint feature library of the operating system are combined according to the categories of dumb terminals to form a network fingerprint snapshot of each dumb terminal.

[0012] According to the counterfeit dumb terminal detection method provided by the present invention, the operating system network fingerprint feature library is constructed by the following steps: Get TCP / IP protocol between different operating systems and different versions of the same operating system; Extracting the TTL value of the IP message header, the MSS value of the TCP message header, the window size, the window expansion factor, and the TCP option field in each of the TCP / IP protocols; The TTL value of each IP message header, the MSS value of the TCP message header, the window size, the window expansion factor, and the TCP option field are associated with the operating system corresponding to each TCP / IP protocol to form an operating system network fingerprint feature library.

[0013] According to the counterfeit dumb terminal detection method provided by the present invention, the steps of combining the fingerprint features in the network fingerprint feature library of the operating system according to the category of the dumb terminal to form a network fingerprint snapshot of each dumb terminal specifically include: Obtain dumb terminal devices that have successfully joined the network, and learn fingerprint feature combinations of each dumb terminal device during initialization; Checking the operating system corresponding to each TCP / IP protocol of the dumb terminal device, and recording the operating system corresponding to each TCP / IP protocol; Each fingerprint feature combination is associated with an operating system corresponding to each TCP / IP protocol to generate a unique network fingerprint snapshot for each operating system.

[0014] According to the counterfeit dumb terminal detection method provided by the present invention, the operating system information is compared with a pre-built network fingerprint snapshot, and the step of determining whether the device to be connected is a counterfeit dumb terminal according to the comparison result specifically includes: Verifying the operating system information of the device to be connected with the network fingerprint snapshot in the network fingerprint feature library of the operating system; If the verification is consistent, the device to be connected is a legal dumb terminal; If the verification is inconsistent, the device to be connected is a rogue dumb terminal.

[0015] The present invention also provides a counterfeit dumb terminal detection device comprising the following modules: An acquisition module is used to obtain operating system information of the device to be connected; The determination module is used to compare the operating system information with a pre-built network fingerprint snapshot, and determine whether the device to be connected is a counterfeit dumb terminal according to the comparison result.

[0016] The present invention also provides an electronic device, comprising a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the processor implements any of the above-mentioned counterfeit dumb terminal detection methods when executing the computer program.

[0017] The present invention also provides a non-transitory computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the counterfeit dumb terminal detection method described in any one of the above is implemented.

[0018] The present invention also provides a computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the computer program implements any of the above-mentioned counterfeit dumb terminal detection methods.

[0019] The counterfeit dumb terminal detection method and device provided by the present invention obtains the operating system information of the device to be accessed; compares the operating system information with the pre-built network fingerprint snapshot, and determines whether the device to be accessed is a counterfeit dumb terminal according to the comparison result, thereby more accurately judging whether the dumb terminal is counterfeited. Through the above-mentioned identification and detection method for illegal counterfeiting of dumb terminals, it is avoided that the dumb terminal device accesses the network due to counterfeiting of IP addresses, MAC addresses, etc., and then attacks the network. It can be used to detect any dumb terminal device that cannot install client management, with a wide range of applications and strong detection capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0021] Figure 1 The figure is a flow chart of a counterfeit dumb terminal detection method provided by an embodiment of the present invention.

[0022] Figure 2 It is a schematic diagram of a process for obtaining operating system information provided by an embodiment of the present invention.

[0023] Figure 3 It is a schematic diagram of the structure of a TCP message provided by an embodiment of the present invention.

[0024] Figure 4 It is a flow chart of TCP feature collection and detection provided by an embodiment of the present invention.

[0025] Figure 5 It is an application deployment diagram of the counterfeit dumb terminal detection method provided by an embodiment of the present invention.

[0026] Figure 6 It is a schematic diagram of the process of fingerprint feature matching of a device to be connected provided by an embodiment of the present invention.

[0027] Figure 7 It is a structural schematic diagram of a counterfeit dumb terminal detection device provided by an embodiment of the present invention.

[0028] Figure 8 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0029] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0030] The present invention is described in detail below in conjunction with the accompanying drawings of the specification. The specific operating method in the method embodiment can also be applied to the device embodiment or the system embodiment. In the description of the present invention, unless otherwise specified, "at least one" includes one or more. "Multiple" refers to two or more. For example, at least one of A, B and C includes: A exists alone, B exists alone, A and B exist at the same time, A and C exist at the same time, B and C exist at the same time, and A, B and C exist at the same time. In the present invention, " / " means or, for example, A / B can mean A or B; "and / or" in this article is only a kind of association relationship that describes the associated objects, indicating that there can be three relationships. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone.

[0031] The present invention will be described in detail below in conjunction with specific implementation modes.

[0032] In some specific embodiments of the present invention, Figure 1 As shown, this solution provides a counterfeit dumb terminal detection method, including: Step 100: Obtain operating system information of the device to be connected; Step 200: Compare the operating system information with a pre-built network fingerprint snapshot, and determine whether the device to be connected is a counterfeit dumb terminal based on the comparison result.

[0033] It should be noted that the existing counterfeit dumb terminal detection solution cannot install security agent software for host-level protection; it has relatively high permissions in the network, and the firewall generally allows all access rights to it; and the device network access authentication based on MAC address cannot accurately detect counterfeit dumb terminals. Therefore, if a counterfeit attack occurs, it is easy to break through the existing security protection system of the network, posing serious security risks such as network attacks and data leaks.

[0034] Therefore, the present invention obtains the operating system information of the device to be accessed, and determines whether the device to be accessed is a counterfeit dumb terminal according to the comparison result between the operating system information and the pre-built network fingerprint snapshot.

[0035] In some possible implementations of the present invention, the operating system information includes a default TTL value, a default window size, an ACK sequence number, and an initial sequence number of the operating system; Wherein, the default TTL value is used to characterize the survival time of the data packet; The default window size is used to represent the size of the TCP (Transmission Control Protocol) receiving or sending window; The ACK sequence number is used to represent the initial sequence number of the data packet processed by different operating systems for TCP / IP; The initial sequence number is used to represent the sequence number carried by each data packet during the data transmission process.

[0036] Specifically, this embodiment provides a specific form of operating system information. By collecting operating system information related to TCP / IP, the operating system of the dumb terminal is defined according to TCP / IP, so that the operating system can be identified by detecting TCP / IP.

[0037] Specifically, the operating system type and version are very important metadata for terminal type identification, and the principle of the TCP / IP feature library mainly relies on the different implementations of the network protocol stack by different operating systems. Therefore, the corresponding operating system is determined according to different TCP / IP features.

[0038] In a possible embodiment, the TCP / IP protocol stack fingerprints of different terminal device operating systems are different, and these operating system differences can be used as the basis for protocol stack fingerprint identification: TTL: (Time-To-Live), which is the "lifetime" of a data packet, indicates how many hops a data packet can go through before being discarded. The default TTL values ​​of different operating systems are often different. The TTL values ​​of common operating systems are shown in Table 1.

[0039] Table 1

[0040] Window Size: WSIZE for short, TCP receive (send) window size. It determines how many data packets the receiving machine sends an ACK packet after receiving them. The default Window Size of different device types and operating systems is basically a constant. Generally, UNIX has a larger Window Size. Windows, routers, switches, etc. have a smaller Window Size.

[0041] ACK sequence number: Different operating systems handle TCP / IP ACK sequence numbers differently. If you send a FIN packet to a closed TCP port, most operating systems will set the sequence number of the response ACK packet to the initial sequence number of the packet sent, while Windows and some printers will send an ACK packet with the initial sequence number plus 1.

[0042] Initial Sequence Number (ISN): During data transmission, each data packet carries a sequence number, which is calculated based on the ISN and the number of bytes transmitted. Some UNIX systems use the traditional 64K increment method; Linux 2.0, OpenVMS, AIX and other systems use the true random method; Windows systems use the system's clock counter as the basis for ISN, and add a random offset each time it is generated to ensure that each ISN is unique.

[0043] In some possible implementations of the present invention, the step of obtaining operating system information of the device to be connected specifically includes: Monitor the TCP / IP data flow to obtain the TCP / IP data message sent by the device to be connected; The operating system information of the device to be connected is obtained according to the TCP / IP data message header feature.

[0044] Specifically, this embodiment provides an implementation method for obtaining operating system information of a device to be connected, by monitoring a TCP / IP data stream and determining the operating system information of the device to be connected according to TCP / IP data message header features.

[0045] In some possible implementations of the present invention, the step of obtaining operating system information of the device to be connected specifically further includes: Sending a TCP / IP detection sequence to the device to be connected, and receiving a response from the device to be connected to the TCP / IP detection sequence; The response is parsed to obtain operating system information of the device to be connected.

[0046] Specifically, this embodiment provides another implementation method for obtaining the operating system information of the device to be connected, by sending a TCP / IP detection sequence to the device to be connected, and determining the operating system information of the device to be connected according to the response analysis result of the device to be connected.

[0047] In a possible embodiment, Figure 2 As shown, Figure 2It is a flow chart of obtaining operating system information provided by an embodiment of the present invention. The operating system information of the terminal can be analyzed from the header features of the sent or responded TCP / IP data message by monitoring the TCP / IP data stream or sending a specific TCP / IP detection sequence to the target terminal.

[0048] Specifically, the operating system type and version are very important metadata for terminal type identification, and the main principle of the TCP / IP feature library relies on the different implementations of the network protocol stack in different operating systems. The terminal's operating system information can be analyzed from the header features of the sent or responded TCP / IP data packets by monitoring the TCP / IP data stream or sending a specific TCP / IP detection sequence to the target terminal.

[0049] In some possible implementations of the present invention, the network fingerprint snapshot is constructed in the following manner: Build an operating system network fingerprint feature library; The fingerprint features in the network fingerprint feature library of the operating system are combined according to the categories of dumb terminals to form a network fingerprint snapshot of each dumb terminal.

[0050] Specifically, this embodiment provides an implementation method of a network fingerprint snapshot, by constructing an operating system network fingerprint feature library, and forming a network fingerprint snapshot of each terminal device according to the result of combining the fingerprint features in the operating system network fingerprint feature library according to the category of dumb terminals.

[0051] Furthermore, in some possible implementations of the present invention, the operating system network fingerprint feature library is constructed by the following steps: Get TCP / IP protocol between different operating systems and different versions of the same operating system; Extracting the TTL value of the IP message header, the MSS value of the TCP message header, the window size, the window expansion factor, and the TCP option field in each of the TCP / IP protocols; The TTL value of the IP message header, the MSS value of the TCP message header, the window size, the window expansion factor, and the TCP option field in each of the TCP / IP protocols are used as fingerprint features to construct the operating system network fingerprint feature library.

[0052] Specifically, this embodiment provides an implementation method of an operating system network fingerprint feature library, by acquiring the TCP / IP protocol between different operating systems and different versions of the same operating system, extracting specific features in the TCP / IP protocol, to form an operating system network fingerprint feature library.

[0053] It is worth mentioning that there are three situations mentioned above when detecting whether a TCP port is open: port open, port rejected, and port unresponsive. All three situations can be analyzed as part of their feature metadata.

[0054] Therefore, this embodiment studies the TCP / IP protocol through a terminal fingerprint detection and identification method. Figure 3 As shown, Figure 3 It is a structural diagram of a TCP message provided by an embodiment of the present invention. Specifically, the TCP / IP protocol implementation between different operating systems and different versions of the same operating system is investigated, and an operating system feature library based on TCP / IP features is studied and obtained, which mainly includes: the TTL value (Time-To-Live) of the IP message header, and the MSS value (Maximum Segment Size) of the TCP message header, the window size WSIZE (Window Size), the window expansion factor (scale), the TCP option field (options), etc.

[0055] Furthermore, through terminal fingerprint snapshot storage, that is, through TCP feature detection technology, the network fingerprint features of the terminal operating system are detected, and the network fingerprint feature attributes of the terminal device are recorded, such as: IP address, MAC address, system type, open ports, etc., the resolved network fingerprint features are generated into fingerprint snapshot storage.

[0056] In some possible implementations of the present invention, the step of combining the fingerprint features in the network fingerprint feature library of the operating system according to the category of dumb terminals to form a network fingerprint snapshot of each dumb terminal specifically includes: Obtain dumb terminal devices that have successfully joined the network, and learn fingerprint feature combinations of each dumb terminal device during initialization; Checking the operating system corresponding to each TCP / IP protocol of the dumb terminal device, and recording the operating system corresponding to each TCP / IP protocol; Each fingerprint feature combination is associated with an operating system corresponding to each TCP / IP protocol to generate a unique network fingerprint snapshot for each operating system.

[0057] In some possible implementations of the present invention, the step of comparing the operating system information with a pre-built network fingerprint snapshot and determining whether the device to be connected is a counterfeit dumb terminal according to the comparison result specifically includes: Verifying the operating system information of the device to be connected with the network fingerprint snapshot in the network fingerprint feature library of the operating system; If the verification is consistent, the device to be connected is a legal dumb terminal; If the verification is inconsistent, the device to be connected is a rogue dumb terminal.

[0058] Specifically, when the device to be accessed applies for access, the operating system information of the device to be accessed can be compared with the network fingerprint snapshots in the operating system network fingerprint feature library. If the operating system information matches any network fingerprint snapshot, it is judged to be a legitimate dumb terminal, otherwise, it is judged to be an impersonated dumb terminal.

[0059] Specifically, this embodiment provides an implementation method for determining whether the device to be accessed is a counterfeit dumb terminal, by comparing the operating system information of the device to be accessed with each of the network fingerprint snapshots, and judging whether it is a counterfeit dumb terminal based on the matching situation between the operating system information and the network fingerprint snapshot.

[0060] In a possible embodiment, when a device applies for access, the operating system information of the device can be obtained, and the operating system information can be matched with a pre-stored network fingerprint snapshot to confirm whether it is a counterfeit dumb terminal; the operating system of the network device can also be checked, and the feature combination of each device can be learned during initialization, and the corresponding operating system can be recorded. When the learning is completed, the various devices are checked regularly to see if there are any changes. If there are any changes, access to the network is prohibited.

[0061] In a specific embodiment, Figure 4 As shown, Figure 4 It is a TCP feature collection and detection flow chart provided by an embodiment of the present invention. In the TCP feature collection stage, which can be regarded as a TCP learning stage, all TCP ports of online devices are scanned and the returned feature information is recorded. During initialization, the feature combination of each corresponding device is learned to generate a network fingerprint snapshot, and the operating system corresponding to each set of feature combinations is recorded, and the corresponding relationship between it and the MAC address is associated to form an operating system network fingerprint feature library.

[0062] During the counterfeit dumb terminal detection phase, after a device has been legally connected to the network, in order to prevent the device from being replaced without triggering re-authentication, such as counterfeiting the IP / MAC address, it is necessary to perform an online check on the connected device. The system periodically uses TCP features to check whether the online device is the same as the network fingerprint snapshot learned during the TCP feature collection phase. If it is within the fault tolerance range, it is normal. Otherwise, an alarm is issued that it may be counterfeited.

[0063] In a possible embodiment, Figure 5 As shown, Figure 5It is an application deployment diagram of the counterfeit dumb terminal detection method provided by an embodiment of the present invention. This embodiment deploys the connection relationship between the dumb terminal and the device fingerprint detection system, realizes terminal identification based on TCP multi-dimensional features based on TCP feature detection technology, and performs effective security control after the device is connected, which greatly improves the overall security of the system and makes up for the risks and loopholes of traditional counterfeit identification and detection technology in the MAC address counterfeiting of dumb devices.

[0064] In a possible embodiment, for the fingerprint feature matching of the device to be connected, Figure 6 The process implementation, Figure 6 FIG. 1 is a flow chart of fingerprint feature matching of a device to be connected provided by an embodiment of the present invention, such as Figure 6 As shown, first, the fingerprint features of each real dumb terminal are initialized and learned, and the fingerprint features are analyzed with the fingerprint commonality of similar devices. According to the fingerprint commonality analysis results, a fingerprint inspection strategy is formulated. When the device to be connected is a counterfeit dumb terminal, the device is counterfeited and inserted, and the fingerprint inspection result of the device to be connected does not match the pre-formulated fingerprint inspection strategy. In this case, the system determines that it is a counterfeit dumb terminal and sends an alarm signal.

[0065] Specifically, the fingerprint checking strategy refers to verifying each operating system with a pre-stored fingerprint feature combination of the operating system. If the verification is consistent, it is a legitimate and authentic dumb terminal. If the verification is inconsistent, it is identified as a counterfeit dumb terminal.

[0066] The embodiment of the present invention provides a counterfeit dumb terminal detection method, which is aimed at the identification and detection of illegal counterfeiting behaviors of dumb terminals such as IP phones, IP cameras, printers, etc., to avoid the dumb terminal devices accessing the network due to counterfeiting of IP addresses, MAC addresses, etc., and then attacking the network. The embodiment of the present invention first collects the device attributes such as IP addresses, MAC addresses, TCP port numbers of dumb terminals and generates network fingerprint snapshots, and periodically compares the current device attributes with the legal network fingerprint. If the attributes do not match or the attributes are tampered with, it is judged as counterfeiting behavior; this embodiment sends a specific query message and parses the response of the dumb terminal, and can extract the device fingerprint features without installing a client or plug-in. The system can obtain the detailed access information and terminal attribute values ​​of the dumb terminal, and the detailed information can be used to more accurately determine whether the dumb terminal is counterfeited.

[0067] Therefore, compared with the existing terminal counterfeit detection method, the counterfeit dumb terminal detection scheme proposed in the embodiment of the present invention realizes the identification of dumb terminal device counterfeit behavior based on deep network fingerprint identification, which can be used to detect any dumb terminal device that cannot be installed with client management, such as cameras, printers, card readers, etc. It has a wide range of applications and strong detection capabilities.

[0068] The counterfeit dumb terminal detection device provided by the present invention is described below. The counterfeit dumb terminal detection device described below and the counterfeit dumb terminal detection method described above can be referred to each other.

[0069] In some specific embodiments of the present invention, Figure 7 As shown, this solution provides a counterfeit dumb terminal detection device, including: An acquisition module 71 is used to acquire operating system information of a device to be connected; The determination module 72 is used to compare the operating system information with a pre-built network fingerprint snapshot, and determine whether the device to be connected is a counterfeit dumb terminal according to the comparison result.

[0070] The implementation principle and beneficial effects of the counterfeit dumb terminal detection device provided in the embodiment of the present invention are similar to the implementation principle and beneficial effects of the counterfeit dumb terminal detection method shown in the above embodiment. Please refer to the implementation principle and beneficial effects of the counterfeit dumb terminal detection method shown in the above embodiment, and no further details will be given here.

[0071] Figure 8 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 8 As shown, the electronic device may include: a processor 810, a communication interface 820, a memory 830 and a communication bus 840, wherein the processor 810, the communication interface 820 and the memory 830 communicate with each other through the communication bus 840. The processor 810 may call the logic instructions in the memory 830 to execute the counterfeit dumb terminal detection method, which includes: obtaining the operating system information of the device to be connected; comparing the operating system information with the pre-built network fingerprint snapshot, and determining whether the device to be connected is a counterfeit dumb terminal according to the comparison result.

[0072] In addition, the logic instructions in the above-mentioned memory 830 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0073] On the other hand, the present invention also provides a computer program product, which includes a computer program. The computer program can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the counterfeit dumb terminal detection method provided by the above methods, and the method includes: obtaining operating system information of the device to be accessed; comparing the operating system information with a pre-built network fingerprint snapshot, and determining whether the device to be accessed is a counterfeit dumb terminal based on the comparison result.

[0074] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, it is implemented to execute the counterfeit dumb terminal detection method provided by the above-mentioned methods. The method includes: obtaining operating system information of the device to be accessed; comparing the operating system information with a pre-built network fingerprint snapshot, and determining whether the device to be accessed is a counterfeit dumb terminal based on the comparison result.

[0075] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0076] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0077] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for detecting a counterfeit dumb terminal, characterized in that: include: Obtain operating system information of the device to be connected; The operating system information is compared with a pre-built network fingerprint snapshot, and based on the comparison result, it is determined whether the device to be connected is a counterfeit dumb terminal.

2. The method for detecting a counterfeit dumb terminal according to claim 1, characterized in that: The operating system information includes the default TTL value, default window size, ACK sequence number, and initial sequence number of the operating system; Wherein, the default TTL value is used to characterize the survival time of the data packet; The default window size is used to characterize the size of the TCP receive or send window; The ACK sequence number is used to represent the initial sequence number of the data packet processed by different operating systems for TCP / IP; The initial sequence number is used to represent the sequence number carried by each data packet during the data transmission process.

3. The method for detecting a counterfeit dumb terminal according to claim 2, characterized in that: The steps of obtaining the operating system information of the device to be connected include: Monitor the TCP / IP data flow to obtain the TCP / IP data message sent by the device to be connected; The operating system information of the device to be connected is obtained according to the TCP / IP data message header feature.

4. The method for detecting a counterfeit dumb terminal according to claim 2, characterized in that: The steps of obtaining the operating system information of the device to be connected include: Sending a TCP / IP detection sequence to the device to be connected, and receiving a response from the device to be connected to the TCP / IP detection sequence; The response is parsed to obtain operating system information of the device to be connected.

5. The method for detecting a counterfeit dumb terminal according to claim 3 or 4, characterized in that: The network fingerprint snapshot is constructed in the following way: Build an operating system network fingerprint feature library; The fingerprint features in the network fingerprint feature library of the operating system are combined according to the categories of dumb terminals to form a network fingerprint snapshot of each dumb terminal.

6. The method for detecting a counterfeit dumb terminal according to claim 5, characterized in that: The operating system network fingerprint feature library is constructed by the following steps: Get TCP / IP protocol between different operating systems and different versions of the same operating system; Extracting the TTL value of the IP message header, the MSS value of the TCP message header, the window size, the window expansion factor, and the TCP option field in each of the TCP / IP protocols; The TTL value of the IP message header, the MSS value of the TCP message header, the window size, the window expansion factor, and the TCP option field in each of the TCP / IP protocols are used as fingerprint features to construct the operating system network fingerprint feature library.

7. The method for detecting a counterfeit dumb terminal according to claim 6, characterized in that: The step of combining the fingerprint features in the network fingerprint feature library of the operating system according to the category of dumb terminals to form a network fingerprint snapshot of each dumb terminal specifically includes: Obtain dumb terminal devices that have successfully joined the network, and learn fingerprint feature combinations of each dumb terminal device during initialization; Checking the operating system corresponding to each of the TCP / IP protocols of the dumb terminal device, and recording the operating system corresponding to each of the TCP / IP protocols; Each fingerprint feature combination is associated with an operating system corresponding to each TCP / IP protocol to generate a unique network fingerprint snapshot for each operating system.

8. The method for detecting a counterfeit dumb terminal according to claim 7, characterized in that: The step of comparing the operating system information with a pre-built network fingerprint snapshot and determining whether the device to be connected is a counterfeit dumb terminal according to the comparison result specifically includes: Verifying the operating system information of the device to be connected with the network fingerprint snapshot in the network fingerprint feature library of the operating system; If the verification is consistent, the device to be connected is a legal dumb terminal; If the verification is inconsistent, the device to be connected is a rogue dumb terminal.

9. A counterfeit dumb terminal detection device, characterized in that: include: An acquisition module is used to obtain operating system information of the device to be connected; The determination module is used to compare the operating system information with a pre-built network fingerprint snapshot, and determine whether the device to be connected is a counterfeit dumb terminal according to the comparison result.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the counterfeit dumb terminal detection method according to any one of claims 1 to 8 is implemented.

Images