Industrial internet-oriented equipment fingerprint extraction method and system

Abstract

The invention discloses an industrial internet-oriented equipment fingerprint extraction method and system. The method comprises the following steps of: acquiring data; generating an attribute feature subset; preprocessing the traffic data; extracting features; generating a fusion feature vector; and outputting the equipment category of the industrial internet equipment. According to the invention, the attribute features and the traffic features of the equipment are effectively fused, and the identity recognition rate of the equipment is effectively improved; kernel density estimation is introduced, so that the accuracy of a probability density function of an equipment attribute characteristic value is improved; the redundancy of the equipment attribute feature values is effectively reduced through an expert information weighting mechanism, and the flow features are extracted for the improved MobileNetV2 by adopting the lightweight network model, so that the feature selection and extraction speed is improved, and the identification efficiency and the identification accuracy of the equipment fingerprints are improved.

Description

Technical Field

[0001] The present invention relates to the field of identity authentication technology, and in particular to a device fingerprint extraction method and system for the industrial Internet. Background Art

[0002] The Industrial Internet, as a product of the deep integration of new-generation information technology and manufacturing, is leading a new round of changes in the global industry. It connects machines, sensors, people and systems to collect, exchange and analyze data to optimize production processes, improve efficiency and reduce costs. The core of the Industrial Internet lies in the Internet of Things technology, which enables devices to be interconnected and interoperable, and realizes intelligent management and decision support. The Internet of Things technology has improved the informationization and intelligence level of the Industrial Internet, but it has also introduced a large number of information security vulnerabilities, posing a great threat to the safe and stable operation of the system, such as physical safety, operational safety, data security, etc. Therefore, the identity identification of relevant Internet of Things devices is particularly important.

[0003] However, the Industrial Internet faces a series of challenges in device authentication. First, due to the wide variety and brands of industrial equipment, there is a lack of unified authentication standards, which leads to compatibility and interoperability issues between devices. Second, the complexity of the industrial environment requires that the authentication mechanism must be highly reliable and secure to prevent malicious attacks and data leakage. In addition, with the rapid development of the Industrial Internet, the number of devices has increased dramatically. The traditional centralized authentication method is unable to cope with large-scale device authentication, and a more flexible and efficient authentication mechanism is needed.

[0004] Existing equipment authentication mainly focuses on two aspects: identity recognition technology and device recognition technology. Among them, identity recognition, such as password-based and electronic identification card-based identity recognition methods, faces many difficulties in the application of IoT business systems due to security vulnerabilities and relatively high application costs. Device recognition achieves identity authentication by leveraging the unique characteristics of the device itself, without the need for traditional username and password systems, such as device fingerprint-based device recognition methods. It does not require demanding computing and storage resources for the device itself, and can adapt well to the actual conditions of various types of equipment in industrial environments, contributing to the safe and stable operation of the industrial Internet.

[0005] Existing identification methods based on device fingerprints mostly focus on the traffic generated when the terminal device interacts with the server. However, the devices in the industrial Internet environment have an extremely complex and diverse attribute feature system. The organic integration of device attribute features and traffic information generated during the communication process, so that they together constitute the information set of device fingerprints, can further improve the accuracy, reliability and security of identification.

[0006] Chinese patent CN 118503685 A discloses a device fingerprint extraction method and system based on device attributes and passive traffic characteristics, which provides a reliable and secure device identification method and system based on the integration of device attribute characteristics and traffic information.

[0007] However, in the process of implementing the technical solution of the invention in the embodiment of the present application, the inventors of the present application found that the above-mentioned technology has at least the following technical problems: First, the above-mentioned technology lacks precision or has redundancy in processing the characteristic values ​​of device attributes, which affects the efficiency and accuracy of device fingerprint extraction. Secondly, the above-mentioned technology uses the improved EfficientNet to extract traffic features. Although it has good performance, its computational overhead is relatively high, and there is still room for optimization for resource-constrained edge devices. Finally, the above-mentioned technology is mainly aimed at power Internet of Things devices and cannot meet the requirements of diversity, complexity and dynamics of industrial Internet devices. Summary of the invention

[0008] The present invention can solve the shortcomings of the prior art in extracting device fingerprints by providing a device fingerprint extraction method and system for the industrial Internet.

[0009] In order to solve the above technical problems, the present invention provides a device fingerprint extraction method for industrial Internet, comprising the following steps: (1) Data collection: Collect device attribute information and traffic data of industrial Internet devices, and construct a device attribute feature set F={f1,f2,...f m}, where m is a positive integer greater than or equal to 2; (2) Generate attribute feature subset F f ; Estimate any feature f in the attribute feature set F by kernel density estimation i The characteristic value (f ij ), the probability density function is: , In the formula, p(f ij ) is the eigenvalue f ij The probability of appearing in the data set; D is the data set, K is the kernel function, h is the bandwidth, n is the number of samples in the data set, and x is the value of a single sample in the data set; The attribute feature set F feature pair (f i , f j ) between the mutual information I(f i , f j )for: , The mutual information I(fi , f j ) Arrange in descending order, and select the set of features with the largest mutual information value as the expert feature set F1; The expert feature set F1 is associated with the remaining feature set F, and the two feature sets (f 1i， f 2j ) between the mutual information I(f 1i , f 2j ) are arranged in ascending order, and the feature set with the smallest mutual information value is selected as the auxiliary feature set Fa; , Among them, f 1i is any feature in the expert feature set, f 2j is any feature in the remaining feature set; The attribute feature subset F f = F1U F a ; (3) Traffic data preprocessing: preprocess the traffic data collected in step (1) and convert the data traffic into a grayscale image; (4) Feature extraction: Use the L2 normalization method to normalize the statistical value of the information value in the attribute feature subset to generate the attribute feature vector T norm ;Use the improved lightweight network model to extract features from the preprocessed traffic data and generate traffic feature vectors; (5) Generating a fused feature vector: performing vector concatenation of the attribute feature vector and the traffic feature vector to obtain the fused feature vector; (6) Performing full-connection layer classification on the fused feature vector and outputting the device category of the industrial Internet device.

[0010] In a preferred embodiment of the present invention, in step (1), the device attribute information includes a device serial number, device general parameters, device communication parameters and device hardware parameters.

[0011] In a preferred embodiment of the present invention, in step (3), the pretreatment method comprises: Data segmentation: First, the traffic data is segmented based on the flow, and then the second segmentation is performed based on the session on the basis of the flow; Anonymization: Anonymize the port number, protocol type, IP address, and MAC address information in the traffic data; Data conversion: unify the session data into a fixed size and convert the traffic data into a grayscale image.

[0012] In a preferred embodiment of the present invention, in step (4), the processing steps of the L2 normalization method are: For a given eigenvector T=[t1,t2,...t n ], calculate the L2 norm of the feature vector, , Divide each element of the feature vector by its L2 norm to obtain a normalized feature vector: .

[0013] In a preferred embodiment of the present invention, in step (4), the improved lightweight network model is an improved MobileNet_V2 model, and the improved MobileNet_V2 model includes: an input layer, a convolutional layer, an improved bottleneck layer, an average pooling layer, a fully connected layer and an output layer.

[0014] In a preferred embodiment of the present invention, the improved bottleneck layer comprises: Lightweight attention mechanism ECA; The second layer, 1×1 convolution layer, batch normalization BN layer and activation function Relu6; The third layer is a 3×3 convolution depthwise convolution layer, a batch normalization BN layer, and Relu6; The 4th layer, 3×3 convolution, BN layer and linear activation function Linear.

[0015] In a preferred embodiment of the present invention, the lightweight attention mechanism ECA includes a global average pooling layer, the convolution kernel is a 1×1 one-dimensional convolution layer, and the Sigmoid activation function is used for weight normalization.

[0016] In a preferred embodiment of the present invention, in step (5), the vector splicing method is one-dimensional feature vector splicing.

[0017] In a preferred embodiment of the present invention, in step (6), the method of performing full connection layer classification on the fused feature vector is: pass Activation function for classification: , In the formula, x i is the i-th element in the input vector, and k is the dimension of the input vector.

[0018] In order to solve the above technical problems, the present invention also provides a device fingerprint extraction system for the industrial Internet, including: Data collection module, used to collect device attribute information and flow data of industrial Internet devices; A data processing module, used to perform feature selection on the device attribute information, obtain an attribute feature subset, and perform preprocessing operations on the flow data; A feature extraction module, used to perform a normalization operation on the information value of the attribute feature subset to generate an attribute feature vector, and to perform feature extraction on the preprocessed traffic data using a lightweight network model to generate a traffic feature vector; The device fingerprint library construction module is used to perform vector concatenation on the attribute feature vector and the traffic feature vector to obtain a fused feature vector as the device fingerprint information.

[0019] The beneficial effects of the present invention are as follows: the present invention provides a device fingerprint extraction method and system for the industrial Internet, by collecting data, generating attribute feature subsets, preprocessing flow data, The steps of feature extraction and generating fused feature vectors realize the effective fusion of device attribute features and traffic features, effectively improving the device identification rate; by introducing kernel density estimation, the accuracy of the probability density function of device attribute feature values ​​is improved; the redundancy of device attribute feature values ​​is effectively reduced through the expert information weighting mechanism, and the improved lightweight network model is used to extract traffic features, which improves the speed of feature selection and extraction, and helps to improve the recognition efficiency and accuracy of device fingerprints. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 It is a process flow diagram of a device fingerprint extraction method for industrial Internet according to the present invention; Figure 2 It is a schematic diagram of the module structure of the lightweight attention mechanism ECA; Figure 3 Schematic diagram of the inverted residual module for improving MobileNet_V2. DETAILED DESCRIPTION

[0021] The preferred embodiments of the present invention are described in detail below in conjunction with the accompanying drawings so that the advantages and features of the present invention can be more easily understood by those skilled in the art, thereby making a clearer and more definite definition of the protection scope of the present invention.

[0022] The present invention discloses a device fingerprint extraction method and system for the industrial Internet, which utilizes the attribute characteristics of each device in the industrial Internet and the traffic characteristics to perform feature fusion, generates a unique device fingerprint, makes full use of the device information in the industrial Internet system, obtains a more comprehensive feature set, and thus improves the device recognition rate and the security of the industrial Internet system; at the same time, the deep learning model part is lightweight, making the method more suitable for the industrial Internet system. The fingerprint information generated by the present invention has the characteristics of uniqueness and non-forgeability, can meet the requirements of industrial Internet devices for security and lightweight computing, is conducive to data privacy protection, and improves the accuracy of device recognition. Example 1

[0023] A device fingerprint extraction method for industrial Internet, specifically comprising the following steps: (1) Data collection: The device attribute information of each device in the industrial Internet is obtained by device scanning, and the device attribute feature set F={f1,f2,...f m}, where m is a positive integer greater than or equal to 2, indicating the number of features.

[0024] The device attribute information includes device serial number / ID, device general parameters, device communication parameters, device hardware parameters, etc., which are unique attribute information possessed by each industrial Internet terminal device.

[0025] Collect traffic data of industrial Internet devices: Use network monitoring tools, such as network devices (routers, switches) or servers, to monitor or record network traffic data generated by industrial Internet devices during communication. When a new device communicates with the gateway, the gateway records n communication data traffic packets during the device setup phase.

[0026] (2) Perform feature selection on the information in the collected device attribute feature set to generate the attribute feature subset F f .

[0027] The specific method is to delete redundant or irrelevant features in the device attribute information set according to the feature selection method of improved expert information weighting mechanism, and select device attributes with uniqueness, unforgeability and stability as the attribute feature subset.

[0028] The steps of the feature selection method for improving the expert information weighting mechanism are as follows: Kernel density estimation (KDE) is introduced to estimate the probability density function of the eigenvalue more accurately. Kernel density estimation is used to estimate any feature f in the attribute feature set F. i The characteristic value (f ij) probability density function (i.e., probability density function p(f i )p(f j )), the formula is: , In the formula, p(f ij ) is the eigenvalue f ij The probability of appearing in the data set; D is the data set, K is the kernel function, h is the bandwidth, n is the number of samples in the data set, and x is the value of a single sample in the data set; The interactions between features are considered and their interdependence is evaluated by calculating the mutual information between feature pairs.

[0029] For the feature pair in the attribute feature set F (f i , f j ), the mutual information I(f i , f j )for: , The mutual information I(f i , f j ), is the amount of information contained in a random variable about another random variable. The larger the mutual information, the more important the feature is, and vice versa.

[0030] The mutual information I(f i , f j ) are arranged in descending order, and multiple features with the largest mutual information value are selected, and the set is the expert feature set F1; the part of the device attribute feature set F excluding the expert feature set F1 is the remaining feature set F2; The expert feature set F1 is combined with the remaining feature set F2 to calculate the mutual information I(f 1i ,f 2j ), where f 1i is any feature in the expert feature set F1, f 2j is any feature in the remaining feature set.

[0031] The two feature sets (f 1i， f 2j ) between the mutual information I(f 1i , f 2j ) are arranged in ascending order, and multiple features with the smallest mutual information value are selected to reduce the redundancy of the features. The set is used as the auxiliary feature set Fa to avoid repeated calculations and improve the speed of feature selection; , The obtained expert feature set F1 and the auxiliary feature set F a Merge to form the final attribute feature subset Ff , used for subsequent model training or other analysis tasks; That is, the attribute feature subset F f = F1U F a .

[0032] This feature extraction method processes device attribute feature values ​​with high accuracy, effectively reduces redundancy, and helps to improve the efficiency and accuracy of device fingerprint extraction.

[0033] (3) Traffic data preprocessing: Preprocess the traffic data collected in step (1) and convert the data traffic into a grayscale image.

[0034] Specifically, the pretreatment method includes: Data segmentation: First, the traffic data is segmented based on the flow, i.e., rough segmentation, and then the second segmentation is performed based on the session on the basis of the flow, i.e., fine segmentation. By combining the advantages of both flow-based and session-based data segmentation, the characteristics of network behavior can be captured more accurately, which is conducive to improving the accuracy of device identification; Anonymization: During the data cleaning phase, other sensitive information, such as port numbers, protocol types, IP addresses, MAC addresses, etc. in traffic data, is anonymized to prevent the classification network from overfitting this information. Data conversion: The session data is unified into a fixed size, the extra-long part is truncated, and the missing part is filled with 0. After the size is fixed, the traffic data is converted into a grayscale image. For example, the fixed size is 784 bytes and converted into a 28×28 grayscale image.

[0035] (4) Feature extraction: Perform statistical numerical analysis on the information values ​​in the attribute feature subset, normalize the statistical information using the L2 normalization method, distribute all statistical values ​​in the range of [0, 1], and generate the attribute feature vector T norm ; Use the improved lightweight network model to extract the traffic characteristics of the preprocessed traffic data and generate a traffic feature vector.

[0036] Specifically, the processing steps of the L2 normalization method are as follows: For a given eigenvector T=[t1,t2,...t n ], calculate the L2 norm (Euclidean norm) of the eigenvector: , Divide each element of the feature vector by its L2 norm to obtain a normalized feature vector T norm : .

[0037] The improved lightweight network model is an improved MobileNet_V2 model. By introducing a lightweight attention mechanism ECA into the linear bottleneck inverted residual structure of the lightweight MobileNet_V2 model, the model's ability to extract key traffic features in industrial Internet devices is significantly improved. The improved MobileNet_V2 model includes: an input layer, a convolutional layer, an improved bottleneck layer, an average pooling layer, a fully connected layer, and an output layer.

[0038] The bottleneck layer consists of three layers, each of which contains three combined structures. The bottleneck inverted residual module specifically includes: The first layer uses a 1x1 convolution kernel and uses the ReLU6 linear activation function after the convolution layer. The expression of the ReLU6 function is: ,

[0039] Where x is the input value.

[0040] The second layer uses Depthwise convolution with a convolution kernel size of 3x3 and an activation function of ReLU6. The number of convolution kernels is the same as the depth of the input feature matrix. The third layer uses a normal 1x1 convolution layer and a linear activation function Linear, which is expressed as: ,

[0041] Where x is the input value.

[0042] The improved bottleneck layer mainly adds a lightweight attention mechanism ECA to the linear bottleneck inverted residual structure of MobileNet_ V2. Figure 3 As shown in the figure, the specific implementation includes: adding a lightweight attention mechanism ECA in front of the first layer of the linear bottleneck inverted residual structure, including GlobalAvgPool, 1×1 convolution layer and Sigmoid activation function; the second layer includes 1×1 convolution, batch normalization BN layer and activation function Relu6; the third layer includes a Depthwise convolution layer of 3×3 convolution, a batch normalization BN layer and Relu6; the fourth layer includes 3×3 convolution, BN layer and linear activation function Linear.

[0043] Specifically, the lightweight attention mechanism ECA includes a global average pooling layer (GlobalAvgPool), a 1×1 one-dimensional convolutional layer with a convolution kernel, and a sigmoid activation function for weight normalization, such as Figure 2 shown.

[0044] The implementation process of the lightweight attention mechanism ECA includes: First, the input H×W×C feature map matrix is ​​transformed into 1×1×C aggregated features through global average pooling, which is expressed as: , in, X is the input feature map, H and W are the height and width of the feature map, respectively.

[0045] Secondly, the convolution operation is performed by adaptively calculating the one-dimensional convolution kernel size, which is expressed as: , in, W is the convolution kernel weight, b is the bias term, Represents a convolution operation.

[0046] Again, the weights are normalized using the Sigmoid activation function, and its expression is: , Finally, the normalized weights are multiplied by the corresponding elements of the original input feature map to obtain the final output feature map, which is expressed as: , Among them, ⊙ represents element-by-element multiplication.

[0047] This improved lightweight network model, namely the improved MobileNet_V2 model, while maintaining a lightweight design, enhances the ability to focus on the key characteristics of network traffic generated by industrial Internet devices through the ECA mechanism, which can effectively reduce computing overhead and is particularly suitable for resource-constrained industrial Internet edge devices.

[0048] (5) Generate a fused feature vector: perform vector concatenation of the attribute feature vector and the traffic feature vector, i.e., perform feature fusion, generate the fused feature vector, and construct a device fingerprint library.

[0049] Specifically, the attribute feature vector and the traffic feature vector are expanded, and one-dimensional feature vector splicing is performed to obtain a fused feature vector with more comprehensive feature information, which serves as the device fingerprint required in the industrial Internet device identity recognition process.

[0050] (6) Performing full-connection layer classification on the fused feature vector and outputting the device category of the industrial Internet device.

[0051] Specifically, according to the fused feature vector, classification is performed using a fully connected layer to output the category of industrial Internet equipment.

[0052] The output of the fully connected layer is passed through Activation function for classification: , In the formula, x i is the i-th element in the input vector, and k is the dimension of the input vector.

[0053] The function is usually used in the output layer of multi-classification problems to output the predicted probability of each category. Example 2

[0054] In order to implement a device fingerprint extraction method for industrial Internet in Example 1, the present invention also provides a device fingerprint extraction system for industrial Internet, including: Data collection module, used to collect device attribute information and flow data of industrial Internet devices; A data processing module, used to perform feature selection on the device attribute information, obtain an attribute feature subset, and perform preprocessing operations on the flow data; A feature extraction module, used to perform a normalization operation on the information value of the attribute feature subset to generate an attribute feature vector, and to perform feature extraction on the preprocessed traffic data using a lightweight network model to generate a traffic feature vector; The device fingerprint library construction module is used to perform vector concatenation on the attribute feature vector and the traffic feature vector to obtain a fused feature vector as the device fingerprint information.

[0055] Finally, the fully connected layer is classified according to the device fingerprint information, and the device category of the industrial Internet device is output.

[0056] The present invention provides a device fingerprint extraction method and system for the industrial Internet, which utilizes the device attribute characteristics and traffic characteristics of industrial Internet devices to perform feature fusion, and combines the attribute characteristics of industrial Internet devices to obtain a more comprehensive feature set, generate a unique device fingerprint, thereby improving the device recognition rate, improving the security of industrial Internet edge devices, improving the accuracy of device recognition, and improving the identity authentication mechanism.

[0057] To address the limited computing and storage capabilities of industrial Internet edge devices, a lightweight network model is used to extract features from traffic data.

[0058] The fingerprint information generated by the present invention is unique and cannot be forged, can meet the requirements of industrial Internet equipment for security and lightweight computing, is conducive to data privacy protection, and provides a data basis for identity recognition.

[0059] The above descriptions are merely embodiments of the present invention and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A device fingerprint extraction method for industrial Internet, characterized in that: The steps include: (1) Data collection: For each device in the Industrial Internet, collect its attribute information and traffic data, and construct the device attribute feature set F={f1,f2,...f m }, where m is a positive integer greater than or equal to 2; (2) Generate attribute feature subset F f ; Estimate any feature f in the attribute feature set F corresponding to each device by kernel density estimation i The characteristic value (f ij ), the probability density function is: ， In the formula, p(f ij ) is the eigenvalue f ij The probability of appearing in the data set; D is the data set, K is the kernel function, h is the bandwidth, n is the number of samples in the data set, and x is the value of a single sample in the data set; The feature pair (f i , f j ) between the mutual information I(f i , f j )for: , The mutual information I(f i , f j ) Arrange in descending order, and select the set of features with the largest mutual information value as the expert feature set F1; The expert feature set is associated with the remaining feature set, and the mutual information I(f 1i , f 2j ) are arranged in ascending order, and the feature set with the smallest mutual information value is selected as the auxiliary feature set Fa; ， Among them, f 1i is any feature in the expert feature set, f 2j is any feature in the remaining feature set; The attribute feature subset F f = F1U F a ; (3) Traffic data preprocessing: preprocess the traffic data collected in step (1) and convert the data traffic into a grayscale image; (4) Feature extraction: Use the L2 normalization method to normalize the statistical value of the information value in the attribute feature subset to generate the attribute feature vector T norm ;Use the improved lightweight network model to extract features from the preprocessed traffic data and generate traffic feature vectors; (5) Generating a fused feature vector: performing vector concatenation of the attribute feature vector and the traffic feature vector to obtain the fused feature vector; (6) Performing full-connection layer classification on the fused feature vector and outputting the device category of the industrial Internet device.

2. According to the device fingerprint extraction method for industrial Internet according to claim 1, it is characterized in that: In step (1), the device attribute information includes the device serial number, device general parameters, device communication parameters and device hardware parameters.

3. The device fingerprint extraction method for industrial Internet according to claim 1 is characterized in that: In step (3), the pretreatment method includes: Data segmentation: First, the traffic data is segmented based on the flow, and then the second segmentation is performed based on the session on the basis of the flow; Anonymization: Anonymize the port number, protocol type, IP address, and MAC address information in the traffic data; Data conversion: unify the session data into a fixed size and convert the traffic data into a grayscale image.

4. The method for extracting device fingerprints for industrial Internet according to claim 1 is characterized in that: In step (4), the processing steps of the L2 normalization method are: For a given eigenvector T=[t1,t2,...t n ], calculate the L2 norm of the feature vector, ， Divide each element of the feature vector by its L2 norm to obtain a normalized feature vector: 。 5. The method for extracting device fingerprints for industrial Internet according to claim 1 is characterized in that: In step (4), the improved lightweight network model is an improved MobileNet_V2 model, and the improved MobileNet_V2 model includes: an input layer, a convolution layer, an improved bottleneck layer, an average pooling layer, a fully connected layer and an output layer; the improved bottleneck layer includes a plurality of hierarchical convolution modules.

6. The method for extracting device fingerprints for industrial Internet according to claim 5 is characterized in that: The improved bottleneck layer includes: The lightweight attention mechanism ECA located before the first layer; The second layer, 1×1 convolution layer, batch normalization BN layer and activation function Relu6; The third layer is a 3×3 convolution depthwise convolution layer, a batch normalization BN layer, and an activation function Relu6; The 4th layer, 3×3 convolution, BN layer and linear activation function Linear; Activation functions for layers 2 and 3 ; Linear activation function for layer 4 ; x is the input value.

7. The method for extracting fingerprints of devices for industrial Internet according to claim 6 is characterized in that: The lightweight attention mechanism ECA includes a global average pooling layer, a 1×1 one-dimensional convolution layer with a convolution kernel, and a Sigmoid activation function for weight normalization.

8. The method for extracting device fingerprints for industrial Internet according to claim 1 is characterized in that: In step (5), the vector splicing method is one-dimensional feature vector splicing.

9. The method for extracting device fingerprints for industrial Internet according to claim 1 is characterized in that: In step (6), the method for performing full connection layer classification on the fused feature vector is: pass Activation function for classification: ， In the formula, x i is the i-th element in the input vector, and k is the dimension of the input vector.

10. A device fingerprint extraction system for industrial Internet, characterized in that: include: Data collection module, used to collect device attribute information and flow data of industrial Internet devices; A data processing module, used to perform feature selection on the device attribute information, obtain an attribute feature subset, and perform preprocessing operations on the flow data; A feature extraction module, used to perform a normalization operation on the information value of the attribute feature subset to generate an attribute feature vector, and to perform feature extraction on the preprocessed traffic data using a lightweight network model to generate a traffic feature vector; The device fingerprint library construction module is used to perform vector concatenation on the attribute feature vector and the traffic feature vector to obtain a fused feature vector as the device fingerprint information.

Images