A device terminal identification method for RIS phased array network deployment

Abstract

This invention discloses a device terminal identification method for RIS phased array network deployment, relating to the field of terminal detection. The method includes: Step S1: collecting an initial feature set of the target identification terminal and monitoring abnormal attack behaviors suffered by the target identification terminal; Step S2: constructing a local outlier method to screen out effective attack behaviors and labeling a composite feature set; Step S3: constructing a machine learning model to perform mixed clustering calculations on the initial feature set and the composite feature set, and labeling the final result as a correlation scalar; Step S4: setting a dynamic threshold strategy for the correlation scalar to determine whether the target identification terminal needs to be re-identified. This invention, by continuing to monitor potential abnormal attack behaviors during the initial attack response lag period and introducing a local outlier detection method to capture dynamic changes in real time, has the advantages of ensuring that RIS phased array network terminals are only re-identified for influential attack behaviors and improving the accuracy of identifying potential secondary attacks.

Description

Technical Field

[0001] This invention relates to the field of terminal detection, and more specifically to a method for identifying device terminals used in RIS phased array network deployment. Background Technology

[0002] Traditional terminal authentication methods primarily rely on static information, such as MAC addresses or user credentials. However, these methods are easily forged or stolen, making it difficult to meet the accurate identification requirements of access terminals in high-security scenarios. To enhance physical layer perception of terminal behavior characteristics, recent research has introduced sensing devices such as Reconfigurable Intelligent Surface (RIS) phased arrays to improve the wireless propagation environment and assist in enhancing the spatial granularity of signal feature identification. RIS possesses characteristics such as controllable reflection and directional transmission, which can enhance channel state perception capabilities in physical space, contributing to improved interpretability and tracking capabilities of terminal behavior to some extent.

[0003] In scenarios where RIS phased arrays are deployed, existing WAPI-converged network access RIS phased array device authentication mechanisms primarily rely on static identity information and single-point behavioral data for terminal identification and management, failing to establish a time-series model for the terminal's behavioral changes within the network. In practical applications, malicious terminals often do not maintain a continuous abnormal state but rather conceal their attack intent through intermittent triggering, phased penetration, or delayed execution. When existing systems identify potential temporally abnormal behavior, a significant response lag is often required to assess the specific location of abnormal data points before making a concrete authentication assessment. This response lag may provide attackers with sufficient time for secondary attacks, leading to biases in the authentication results prior to the secondary attack. Consequently, when screening digital terminal devices vulnerable to complex attacks, the accuracy of identifying previous attack results is low. Summary of the Invention

[0004] This invention provides a device terminal identification method for RIS phased array network deployment, which solves the problem that existing RIS phased array network deployment terminals, when encountering dynamic attacks, lack accurate identification of potential secondary abnormal attacks during the identification response lag period, resulting in deviations in the identification of the degree of the initial attack on the terminal.

[0005] This invention is achieved through the following technical solution:

[0006] A device terminal authentication method for RIS phased array network deployment, the method comprising:

[0007] Step S1: Monitor the target identification terminal in the RIS phased array system that has been subjected to the initial network attack, collect the initial feature set in the target identification terminal, and monitor the abnormal attack behavior of the target identification terminal during the response lag time of identifying the initial network attack.

[0008] Step S2: Construct a local outlier method to filter out effective attack behaviors in abnormal attack behaviors according to their effectiveness, extract the initial feature set of the target identification terminal corresponding to the effective attack behavior, and label it as a composite feature set;

[0009] Step S3: Construct a machine learning model, use the machine learning model to perform mixed clustering calculations on the initial feature set and the composite feature set according to the effective attack behavior, and label the final generated result as a correlation scalar representing the target identification terminal features;

[0010] Step S4: Set a dynamic threshold policy to identify and judge the correlation scalar. Valid attack behaviors corresponding to correlation scalars that do not conform to the dynamic threshold policy are judged as having no valid correlation with the initial network attack, and the target identification terminal does not need to be re-identified; valid attack behaviors corresponding to correlation scalars that conform to the dynamic threshold policy are judged as having a valid correlation with the initial network attack, and the target identification terminal needs to be re-identified.

[0011] Because identifying the specific location of abnormal data points often requires a considerable response lag time for evaluation, this lag may give attackers ample time to launch secondary attacks, leading to biases in the identification results prior to these secondary attacks. This results in low accuracy in identifying previous attack results when screening digital terminal devices vulnerable to complex attacks. Therefore, this invention provides a device terminal identification method for RIS phased array network deployments. It addresses the problem that existing WAPI converged network devices, when encountering dynamic attacks, lack accurate identification of potential secondary abnormal attacks during the response lag time, leading to biases in the initial attack severity assessment.

[0012] Furthermore, the local outlier method includes the LOF outlier factor method; the process of the local outlier method to screen out valid attack behaviors includes:

[0013] All abnormal data points caused by abnormal attacks are normalized, and each abnormal data point is set as an independent sample point; the number of neighbors used in the local density calculation is set, the nearest neighbor set of the corresponding number of neighbors is calculated for each sample point and used to calculate the local density of the sample point, and the LOF value of each sample point is calculated based on the local density.

[0014] A first density threshold is set for the LOF value. When the LOF value of a sample point is greater than the first density threshold, the abnormal attack behavior corresponding to the current sample point is determined to be a valid attack behavior that has an impact on the initial network attack. When the LOF value of a sample point is less than or equal to the first density threshold, the abnormal attack behavior corresponding to the current sample point is determined to have no effective impact on the initial network attack.

[0015] Furthermore, the initial feature set is constructed based on the RIS feature signals collected by the target identification terminal under the RIS phased array reflection path; the RIS feature signals are labeled with the spatial channel change features captured by the RIS enhancement path.

[0016] Furthermore, the calculation process for the LOF value is set as follows:

[0017] Let the LOF value be the ratio of the average local density of the nearest neighbor samples to the local density of the target sample point;

[0018] Wherein, the preset number of nearest neighbors is denoted as f, the distance value of the nearest neighbor sample with an ordinal number f from the target sample point in the nearest neighbor sample is d, and the set of sample points in the nearest neighbor sample whose distance from the target sample point is less than or equal to d is denoted as the set of nearest neighbor points, and the average local density of the nearest neighbor sample is the average local density of all the sets of nearest neighbor points of the target sample point.

[0019] Furthermore, a second density threshold is set for the LOF value, and the first density threshold is greater than the second density threshold. When the LOF value of a sample point is less than or equal to the second density threshold, it is determined that the abnormal attack behavior corresponding to the current sample point has no impact on the initial network attack. When the LOF value of a sample point is between the second density threshold and the first density threshold, it is determined that the abnormal attack behavior corresponding to the current sample point has a potential impact on the target identification terminal. The abnormal attack behavior corresponding to the current sample point is marked as a potential attack behavior, and defensive patching is performed on the abnormal data points caused by the potential attack behavior.

[0020] Furthermore, the process of using machine learning models to perform hybrid clustering calculations includes:

[0021] Step A1: The initial feature set and the composite feature set are weighted and merged according to the same type of data to form a multidimensional feature matrix containing multiple multidimensional data related to effective attack behaviors, and the data points in the multidimensional feature matrix are normalized.

[0022] Step A2: Preset the cluster size range and iteration count, use the K-means clustering method to calculate the cluster centers, randomly generate a set of initial centroids, assign each data point to the nearest centroid, and then update and calculate the centroid of each cluster along the iteration count;

[0023] Step A3: After completing the iteration, the cluster with the largest centroid spacing is marked as an anomalous behavior cluster with potential effective anomalous behavior. The data samples corresponding to the anomalous behavior cluster are marked as correlation scalars. The correlation scalars are then denormalized and output.

[0024] Furthermore, the process of updating the centroid includes:

[0025] Let the centroid be denoted by μ, and let x i Let ω(x) represent the i-th data point. i ) represents data point x i The weights, let the cluster ordinal number be k, let C be... k Let |C| represent the set of all data points in the k-th cluster. k | indicates the total number of data points.

[0026] Then the centroid μ of the k-th cluster k The calculation formula is expressed as: .

[0027] Furthermore, the inverse normalization process uses Min-Max inverse normalization to process each data point, and compares the inverse normalized feature set with the historical behavior data of the target identification terminal along the time series points for re-evaluation.

[0028] Furthermore, the dynamic threshold strategy includes: setting a correlation threshold range for the correlation scalar and setting a sliding window mechanism to monitor the historical judgment error in real time;

[0029] The sliding window mechanism is defined as follows: a target identification rate that indicates the result needs to be re-identified is preset, and an initial time window of fixed length is preset; the initial time window records the judgment result of the target identification terminal each time, including whether re-identification is not required and whether re-identification is required; each time the sliding window is updated, the actual identification rate that indicates the result needs to be re-identified within the initial time window is calculated.

[0030] When the actual recognition rate is higher than the target recognition rate, the correlation threshold range is narrowed; when the actual recognition rate is lower than the target recognition rate, the correlation threshold range is expanded.

[0031] Furthermore, a reference value for the identification frequency is set for the length of the initial time window; when the number of identifications per unit time reaches the reference value for the identification frequency, the initial time window is updated.

[0032] Furthermore, when the number of identifications per unit time reaches the identification frequency benchmark value, the target identification rate is dynamically adjusted to minimize the total number of false positives.

[0033] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0034] The behavior of RIS phased array network deployment terminals after being attacked is usually intermittent or phased. This invention enhances the ability to perceive dynamic attacks by continuing to monitor potential abnormal attack behaviors during the initial attack identification response lag period and capturing the dynamic changes of the target identification terminal in real time, thus avoiding the blind spot of the system after the initial attack.

[0035] By introducing a local outlier detection method, "effective attacks" directly related to the attack behavior are further screened after the initial attack, and irrelevant or noisy data is eliminated. This avoids bias caused by irrelevant abnormal interference, ensures that only influential attack behaviors are re-identified, and improves the accuracy of identifying potential secondary attacks. Attached Figure Description

[0036] The accompanying drawings, which are included to provide a further understanding of embodiments of the invention and form part of this application, do not constitute a limitation thereof. In the drawings:

[0037] Figure 1 This is a schematic diagram of the structure of the present invention. Detailed Implementation

[0038] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the embodiments and accompanying drawings. The illustrative embodiments and descriptions of this invention are only for explaining this invention and are not intended to limit this invention. Example

[0039] like Figure 1 As shown, this embodiment is a device terminal authentication method for RIS phased array network deployment. The method includes:

[0040] Step S1: Monitor the target identification terminal in the RIS phased array system that has been subjected to the initial network attack, collect the initial feature set in the target identification terminal, and monitor the abnormal attack behavior of the target identification terminal during the response lag time of identifying the initial network attack.

[0041] Step S2: Construct a local outlier method to filter out effective attack behaviors in abnormal attack behaviors according to their effectiveness, extract the initial feature set of the target identification terminal corresponding to the effective attack behavior, and label it as a composite feature set;

[0042] Step S3: Construct a machine learning model, use the machine learning model to perform mixed clustering calculations on the initial feature set and the composite feature set according to the effective attack behavior, and label the final generated result as a correlation scalar representing the target identification terminal features;

[0043] Step S4: Set a dynamic threshold policy to identify and judge the correlation scalar. Valid attack behaviors corresponding to correlation scalars that do not conform to the dynamic threshold policy are judged as having no valid correlation with the initial network attack, and the target identification terminal does not need to be re-identified; valid attack behaviors corresponding to correlation scalars that conform to the dynamic threshold policy are judged as having a valid correlation with the initial network attack, and the target identification terminal needs to be re-identified.

[0044] The RIS (Reflective Array) is a smart reflective surface composed of a large number of controllable metasurface units. The phased array traditionally refers to an antenna system that directionally controls the beam direction by adjusting the phase difference between the transmitted or received signals from multiple antennas. In specific implementations, the RIS phased array can refer to viewing the RIS device as a passive phased array or a smart reflective phased array, a system based on reconfigurable smart surface technology that simulates and extends the beam control function of traditional phased arrays by intelligently controlling the reflection characteristics of a large number of units. The target authentication terminal of the RIS phased array system refers to a terminal device selected by the system for identity authentication or behavior analysis in a wireless network integrating the RIS reflective array system. The communication behavior and channel characteristics of this terminal will be controlled by the RIS system and used as the basis for identification. The initial network attack refers to the first or early network attack that the terminal has just encountered, including but not limited to unauthorized access, man-in-the-middle attacks, attempts to tamper with communication protocols, and deceiving server authentication. These attacks are usually probing and exploratory; sometimes attackers do not immediately reveal all their attack intentions but gradually penetrate. At this stage, the system has detected or suspects an attack, but is still in a response lag period of further confirmation and evaluation. The initial feature set represents the state information of the target authentication terminal at the initial time point, referring to the various characteristics or attribute data of the terminal recorded by the system in real time when the terminal first suffers an initial network attack. In practical applications, the initial feature set may include data records such as network layer information, encryption authentication information, communication behavior characteristics, and security event logs. The response lag time refers to the processing time required for the system to analyze the attack source, attack method, and verify abnormal behavior after detecting an attack. In actual systems, this process is usually not instantaneous and may take tens of milliseconds, several seconds, or even longer; this period is called the "response lag time." Traditional systems often pause monitoring after the initial attack is detected, waiting for the authentication results before deciding on subsequent actions. This makes it easy for attackers to further penetrate or hide during the gap. During this response lag time, the terminal may continue to suffer new abnormal behaviors. The system needs to perform real-time monitoring during this period to observe whether new abnormal attack behaviors have occurred, rather than waiting for the initial authentication to be fully completed before re-analyzing.

[0045] The local outlier method is used to filter out attack behaviors that have a real impact on system security and eliminate irrelevant or minor anomalous attacks. All anomalous attack behaviors are evaluated according to their actual threat level to system security, retaining only those truly threatening and effective attack behaviors. This completes the first screening of anomalous attack behaviors. The local outlier method refers to identifying points in the dataset that are significantly different from other data points (i.e., outliers). In attack behavior detection, these outliers usually represent potential security threats. Local outliers mean not just anomalous data on a global scale, but anomalies relative to the surrounding environment or neighboring data; that is, a data point may be inconspicuous in the entire dataset, but its difference from its neighboring data may be very large, sufficient to be considered anomaly. Anomalous attack behaviors refer to terminal behaviors inconsistent with normal network behavior, typically manifested as sudden traffic surges, irregular communication patterns, or unauthorized access, and are part of or part of an attack. Effective attack behaviors refer to attack behaviors that can actually affect network security, posing a substantial threat to the target system, network, or terminal. The composite feature set refers to a batch of labeled feature datasets collected and extracted at the time of effective attack activation. It is a dynamic extension of the original feature set, incorporating the actual changes in the terminal under the influence of an attack. As a specific implementation, for example, assume the target terminal initially exhibits normal signal strength, stable packet frequency, normal CPU usage, and stable connection – this is the initial feature set. Later, an anomaly is detected within a certain time lag, indicating pre-penetration probing attack behavior, such as the terminal starting to send a large number of small packets at irregular intervals, and a sudden increase in CPU usage. After local outlier analysis, this is identified as a valid attack. The terminal's signal changes, packet frequency changes, and abnormal CPU load data at this point are extracted and labeled as a composite feature set. The parameter categories of this composite feature set are consistent with those of the initial feature set.

[0046] Clustering is a common unsupervised machine learning method that aims to group samples in a dataset based on certain similarities or proximity. In this embodiment, the goal of clustering is to classify the behavioral characteristics of a terminal based on effective attack behaviors. After clustering, it can identify which behavioral patterns remain consistent throughout the initial and subsequent attacks, and which may be triggered by new attacks. During the clustering process, the model comprehensively processes data from two feature sets and analyzes their similarities and correlations to identify potential attack behaviors or newly emerging abnormal patterns. The correlation scalar is a numerical value representing the similarity or strength of relationship between one of the target identification terminal's current parameter features, such as behavioral patterns or attack behaviors, and the initial network attack features. Here, this parameter feature does not need to know what specific parameter it measures; the correlation scalar is only used to measure whether effective attack behaviors have a substantial impact on the identification result of the initial network attack. If the correlation scalar value is high, it indicates that the currently monitored features are highly correlated with previously recorded attack features, possibly indicating that the terminal is encountering further attacks and needs to be re-identified. If the value is low, it indicates that the current attack behavior is not strongly correlated with the initial attack characteristics, possibly suggesting that the attack has stopped or been mitigated, and therefore, re-identification of the terminal is unnecessary. The correlation scalar can be considered the output of a machine learning model; it is a comprehensive assessment of the target terminal's state based on calculations during clustering algorithms, feature extraction, and the learning process. The dynamic threshold strategy refers to automatically adjusting a threshold for determining the effectiveness of an attack based on changes in the attack situation. This threshold is not fixed; it dynamically adjusts with changes in certain factors. If the correlation scalar value is lower than the dynamic threshold, it indicates that subsequent attack behavior has a low correlation with the initial attack, the attack may have ended, or there is no further threat. In this case, the attack behavior is determined to have no effective correlation with the initial attack, and the target terminal does not need to be re-identified; the system considers there is no further threat and can continue to trust the terminal. If the correlation scalar value is higher than the dynamic threshold, it indicates that there is a strong correlation between the subsequent attack and the initial attack. This may indicate that the attack has not completely ended or that the attacker is carrying out a more complex penetration. In this case, the attack is determined to be effectively correlated with the initial attack, and the system considers the terminal's security to be threatened. The system needs to re-identify the terminal, which may trigger stricter security measures or re-examine the terminal's identity and behavior.

[0047] More specifically, as a feasible implementation, the initial feature set is constructed based on the RIS feature signals acquired by the target identification terminal under the RIS phased array reflection path; the RIS feature signals are labeled with the spatial channel variation features captured by the RIS enhancement path.

[0048] The RIS phased array reflection path refers to the path a signal takes from the transmitter to the receiver after reflection through the RIS system. By controlling the configuration of the RIS system, the signal propagation characteristics, such as reflection angle, attenuation, and time delay, can be altered. The RIS signal, through variations in the reflection path, provides a unique signal characteristic for each target terminal, containing information about the target terminal's location and environment. Traditional feature acquisition methods typically rely on terminal identity information, such as MAC address, IP address, or behavior logs, which are more dependent on the data link layer and network layer. However, by using signal characteristics under the RIS reflection path, more refined and dynamic terminal behavior information can be obtained from the physical layer. These signal characteristics are more spatially diverse and less easily disguised or tampered with, thus enhancing the accurate identification of target terminals. RIS characteristic signals refer to specific signals generated and controlled by the RIS reflection array, containing characteristics such as reflection angle, signal strength, propagation path, and arrival time. Unlike traditional signals, RIS characteristic signals have unique spatial attributes, reflecting the influence of the RIS array on the signal. The RIS enhancement path refers to the signal path formed after reflection through the RIS system; these paths may exhibit different propagation characteristics compared to traditional signal transmission paths. In practical applications, by analyzing the signal data and spatial channel variation characteristics collected by the RIS system, the system classifies and labels these signals based on their spatiotemporal variations. This implementation improves the accuracy of terminal identification through physical layer signal characteristics, enabling the system to more efficiently identify abnormal behavior in complex network environments.

[0049] Example 2

[0050] In this embodiment, the local outlier method includes the LOF outlier factor method; the process of the local outlier method to screen out valid attack behaviors includes:

[0051] All abnormal data points caused by abnormal attacks are normalized, and each abnormal data point is set as an independent sample point; the number of neighbors used in the local density calculation is set, the nearest neighbor set of the corresponding number of neighbors is calculated for each sample point and used to calculate the local density of the sample point, and the LOF value of each sample point is calculated based on the local density.

[0052] A first density threshold is set for the LOF value. When the LOF value of a sample point is greater than the first density threshold, the abnormal attack behavior corresponding to the current sample point is determined to be a valid attack behavior that has an impact on the initial network attack. When the LOF value of a sample point is less than or equal to the first density threshold, the abnormal attack behavior corresponding to the current sample point is determined to have no effective impact on the initial network attack.

[0053] The LOF outlier factor method measures the anomalousness of a point by comparing its local density with that of its neighbors. Before outlier detection, all relevant data points of anomalous attack behaviors need to be normalized. This step is to eliminate the influence of data with different dimensions or scales, ensuring that all data points are compared under the same standard. Treating each anomalous data point as an independent sample point facilitates the calculation of its local density and relative "abnormality." The number of neighbors to consider when calculating local density is set, i.e., the neighborhood range of each data point. This neighborhood range will affect the density calculation result; that is, it determines how data points within the local range influence the density calculation of the target data point. For each sample point, the density of its neighbors is calculated, i.e., the distribution of neighboring points is calculated. If the density within a point's neighborhood is high, it indicates that the point may be within the normal range; conversely, if the neighborhood density is low, the point may be an anomalous point. The first density threshold is used to determine whether an anomalous data point belongs to a valid attack behavior. If the LOF value of a data point is greater than the first density threshold, it indicates that the point's behavior is anomalous and significant within its neighborhood. Therefore, it is considered to have an impact on the initial attack, and the anomalous behavior is determined to be a valid attack. If the LOF value of a data point is less than or equal to the threshold, it indicates that the data point is similar to other points in its neighborhood and may simply be noise or non-aggressive behavior. Therefore, the anomalous behavior is determined not to have a valid impact on the initial attack. Through the above process, the solution can effectively distinguish which anomalous behaviors still affect the attack result after the initial attack, thereby enabling re-identification of the terminal.

[0054] Furthermore, as a feasible implementation method, the calculation process for the LOF value is set as follows:

[0055] Let the LOF value be the ratio of the average local density of the nearest neighbor samples to the local density of the target sample point;

[0056] Wherein, the preset number of nearest neighbors is denoted as f, the distance value of the nearest neighbor sample with an ordinal number f from the target sample point in the nearest neighbor sample is d, and the set of sample points in the nearest neighbor sample whose distance from the target sample point is less than or equal to d is denoted as the set of nearest neighbor points, and the average local density of the nearest neighbor sample is the average local density of all the sets of nearest neighbor points of the target sample point.

[0057] The ratio of the LOF values ​​reflects whether the target point is in an area with a significantly lower density than its neighbors, thus determining whether the point is an outlier. A preset number of nearest neighbors, f, defines the number of nearest neighbors of the target sample point to consider when calculating the LOF value. A nearest neighbor is the sample point that is spatially closest to the target point. The nearest neighbor distance for f is set to d, representing the distance between the target sample point and its f-th nearest neighbor. This distance value is typically used to determine the size of the nearest neighbor set. The target sample point and the sample points whose distance is less than or equal to d form a nearest neighbor set. This set includes the target sample point and its f closest sample points, forming the basis for calculating the local density of the target sample point. The average local density of the target sample point's nearest neighbors is calculated by calculating the local density of all the nearest neighbor sets of the target sample point, obtaining the average value of this set. Local density is typically the reciprocal of the distance between the target point and its neighbors, or a distance-weighted density value.

[0058] More specifically, as a feasible implementation method, a second density threshold is set for the LOF value, and the first density threshold is greater than the second density threshold. When the LOF value of a sample point is less than or equal to the second density threshold, it is determined that the abnormal attack behavior corresponding to the current sample point has no impact on the initial network attack. When the LOF value of a sample point is between the second density threshold and the first density threshold, it is determined that the abnormal attack behavior corresponding to the current sample point has a potential impact on the target identification terminal. The abnormal attack behavior corresponding to the current sample point is marked as a potential attack behavior, and defensive patching is performed on the abnormal data points caused by the potential attack behavior.

[0059] The second density threshold is used to further refine the determination of anomalous attack behavior. Compared to the first density threshold, the second density threshold is larger, used to distinguish whether a particular anomalous attack behavior is considered to have effectively impacted the initial network attack. The second density threshold provides a standard for identifying potential attack behaviors. Setting this threshold helps identify attack behaviors that have not yet had a direct impact but may develop into threats later. If the LOF value of a sample point is less than or equal to the second density threshold, it indicates that the anomalous behavior of that data point has no impact on the initial network attack, and may even be noise or non-malicious behavior. In this case, the system will determine that the anomalous attack behavior corresponding to that sample point has no impact on the initial attack, and therefore will not perform further processing or identification. If the LOF value of a sample point is between the second density threshold and the first density threshold, the anomalous behavior corresponding to that point is determined to be a potential attack behavior. Potential attack behaviors refer to behaviors that may not pose an immediate threat but may develop into a real attack in the future, or persistent malicious behavior. For such potential attack behaviors, the system will mark them as potential attack behaviors and take defensive patching measures. Such remedial measures can include, for example, encrypted communication, enhanced authentication, and higher-frequency monitoring, thereby preventing potential attack risks in advance. For abnormal data points identified as potential attack behaviors, the system no longer waits for them to evolve into a serious attack before taking action, but instead performs defensive remediation in advance. This allows the system to respond in the early stages of potential attacks, preventing further deterioration. For intermittent attacks or phased penetration attacks that develop gradually, this helps reduce future attack risks. In specific implementation, since the LOF value is set as the ratio of the average local density of neighboring samples to the local density of the target sample point, the second density threshold can be set to 1.1 or 1.2. When the LOF value is less than 1, it means that the local density of the point is higher than that of its neighbors, indicating that the point is a very normal and stable point, and may even be the center point or core sample of a cluster. Setting the second density threshold slightly higher than 1 aims to provide redundancy space, allowing for slight density differences; at the same time, sample points with LOF values ​​greater than 1.1 or 1.2 are considered potential attack behaviors. Therefore, it can effectively screen out potential threat behaviors, avoiding overly strict or lenient judgments. The first density threshold can be set according to empirical rules, for example, to a value between 1.5 and 2.0.

[0060] Example 3

[0061] In this embodiment, the process of performing hybrid clustering calculations using a machine learning model includes:

[0062] Step A1: The initial feature set and the composite feature set are weighted and merged according to the same type of data to form a multidimensional feature matrix containing multiple multidimensional data related to effective attack behaviors, and the data points in the multidimensional feature matrix are normalized.

[0063] Step A2: Preset the cluster size range and iteration count, use the K-means clustering method to calculate the cluster centers, randomly generate a set of initial centroids, assign each data point to the nearest centroid, and then update and calculate the centroid of each cluster along the iteration count;

[0064] Step A3: After completing the iteration, the cluster with the largest centroid spacing is marked as an anomalous behavior cluster with potential effective anomalous behavior. The data samples corresponding to the anomalous behavior cluster are marked as correlation scalars. The correlation scalars are then denormalized and output.

[0065] The data points from the initial feature set and the composite feature set are weighted and merged to form a multidimensional feature matrix. This matrix contains multidimensional data related to effective attack behavior. Different feature sets may have different levels of importance. For example, the initial feature set may represent basic information about network access, while the composite feature set may represent features caused by attack behavior. By merging these data points, multidimensional features related to attack behavior can be better captured. To eliminate the influence of different feature scales, the data in the multidimensional feature matrix needs to be normalized. The cluster number range refers to the number of clusters into which the data is expected to be divided before performing K-means clustering. The core objective of the K-means clustering method is to divide the data points into a specified number of clusters, and each cluster has a center, called the cluster centroid. The goal of clustering is to make the data points within a cluster as similar as possible, while maximizing the differences between clusters. When starting K-means clustering, several data points are randomly selected as the initial cluster centroids. These initial centroids are randomly generated, so the position of the initial cluster centroids may be different each time K-means clustering is run.

[0066] More specifically, after the initial centroids are selected, K-means clustering calculates the distance from each data point to each centroid. Each data point is assigned to the cluster containing the nearest centroid. This process is called cluster assignment. After the data points are assigned, the centroids are recalculated: the centroids of each cluster need to be recalculated. During recalculation, the feature values ​​of all data points within the cluster are averaged to obtain new centroids. This process continues, meaning that after each centroid update, data points are redistributed according to the new centroids. This process iterates repeatedly until the number of iterations is exhausted. The cluster centroid spacing refers to the distance between the centroids of different clusters. Clusters with larger centroid spacing usually indicate that these clusters have greater behavioral differences. In K-means clustering, the distance between the centroids of different clusters is usually calculated to determine whether they belong to completely different categories. In this embodiment, if the centroid of a certain cluster is far away from the centroids of other clusters and the distance reaches its maximum, it means that the behavior of this cluster is significantly different from that of other clusters, and this cluster is identified as an anomalous behavior cluster associated with effective attack behavior. Data samples within a cluster are labeled with a correlation scalar. During clustering, the magnitude of the correlation scalar indicates whether a sample point is related to potential attack behavior. The higher the correlation, the more likely that the point is to be part of an attack.

[0067] In one feasible implementation, the denormalization process uses Min-Max denormalization to process each data point, and compares the denormalized feature set along the time series points with the historical behavior data of the target identification terminal for re-evaluation.

[0068] Min-Max inverse normalization is a common method in data preprocessing. It restores the normalized data to its original range using the following formula: x = x norm ×(max(x)-min(x))+min(x), where x represents the original data, and max(x) and min(x) represent the maximum and minimum values ​​of the original data, respectively. norm This represents the normalized value, which brings the denormalized data back to its original scale. The time series data is arranged chronologically and records the historical behavior of the target identification terminal. Through time series analysis, the regularity and trend of terminal behavior can be determined. The purpose of comparing the denormalized data and the historical behavior data is to assess the consistency and differences between the current behavior and historical behavior. By comparing the denormalized data and the historical behavior data, the system can re-evaluate the behavior of the target terminal, and if obvious abnormal behavior is found, the system can issue an early warning.

[0069] Furthermore, as a feasible implementation method, the centroid update calculation process includes:

[0070] Let the centroid be denoted by μ, and let x i Let ω(x) represent the i-th data point. i ) represents data point x i The weights, let the cluster ordinal number be k, let C be... k Let |C| represent the set of all data points in the k-th cluster. k | indicates the total number of data points.

[0071] Then the centroid μ of the k-th cluster k The calculation formula is expressed as: .

[0072] The centroid μ k Centroid represents the center of all data points in cluster k. It is the weighted average of all data points in the cluster and is used to redistribute data points based on their distance from the cluster center. The goal of centroid calculation is to make the data points within the cluster as close to the cluster center as possible, minimizing the squared error within the cluster. The weight ω(x) of each data point is... i The weight of the data point reflects its proportion in the calculation of the cluster centroid. Data points with higher weights have a greater impact on the location of the cluster centroid, while data points with lower weights have a smaller impact. The total number of data points |C k | represents the total number of elements, 1 / |C k | represents the normalization factor, used to standardize the weighted sum. The ∑ xi ∙ω(x i )∙x i This represents a weighted summation of all data points in cluster k; the ω(x) i )⋅x i This represents the contribution of the data point to the centroid. The summation process accumulates the weighted contributions of all data points within the cluster. The calculated centroid is a weighted average, ensuring that different data points have different impacts on the cluster's position when calculating its center location.

[0073] Example 4

[0074] The dynamic threshold strategy includes: setting a correlation threshold range for the correlation scalar and setting a sliding window mechanism to monitor the historical judgment error in real time;

[0075] The sliding window mechanism is defined as follows: a target identification rate that indicates the result needs to be re-identified is preset, and an initial time window of fixed length is preset; the initial time window records the judgment result of the target identification terminal each time, including whether re-identification is not required and whether re-identification is required; each time the sliding window is updated, the actual identification rate that indicates the result needs to be re-identified within the initial time window is calculated.

[0076] When the actual recognition rate is higher than the target recognition rate, the correlation threshold range is narrowed; when the actual recognition rate is lower than the target recognition rate, the correlation threshold range is expanded.

[0077] The correlation threshold range is used to determine whether there is a valid correlation between effective attack behavior and the initial network attack. The target identification rate represents the desired accuracy or the frequency of re-identification. This target value reflects the proportion of targets that the system should re-identify under ideal conditions. The initial time window is a fixed-length time window used to record the judgment result of each target identification terminal, including cases where re-identification is not required and cases where re-identification is required. The initial time window is used to collect identification results within a certain period for subsequent judgment and adjustment. Whenever the time window slides, the actual identification rate that needs to be re-identified is represented within the statistical window. The actual identification rate refers to the ratio of the number of terminals that actually need to be re-identified within the current window period to the total number of judgments.

[0078] If the number of terminals requiring re-identification within the window exceeds the target identification rate, it indicates that the system may be over-identifying during the judgment process. To reduce false positives and over-identification, the system will narrow the correlation threshold range, i.e., increase the sensitivity to the correlation scalar and reduce unnecessary re-identification. If the number of terminals requiring re-identification within the window is lower than the target identification rate, it means that the system's identification accuracy may be insufficient, failing to identify terminals requiring re-identification in a timely manner. To improve the identification rate, the system will expand the correlation threshold range, reducing the requirement for the correlation scalar, enabling the system to more sensitively identify terminals requiring re-identification. Through the sliding window mechanism, the system can evaluate and adjust the threshold range in real time, allowing the dynamic threshold strategy to adjust according to the actual identification situation. This enables the system to adapt to changes and effectively respond to different attack scenarios.

[0079] Furthermore, as a feasible implementation method, a reference value for the identification frequency is set for the length of the initial time window; when the number of identifications per unit time reaches the reference value for the identification frequency, the initial time window is updated; when the number of identifications per unit time reaches the reference value for the identification frequency, the target identification rate is dynamically adjusted to minimize the total number of false positives.

[0080] The identification frequency baseline is a preset value, representing the minimum threshold number of target identification operations per unit time. This baseline is used to determine when the initial time window needs to be updated and the system adjusted. The baseline ensures that the system monitors and evaluates the identification status of the target terminal sufficiently frequently. When the number of identifications per unit time reaches the preset baseline, it means that the system has enough data to evaluate the current identification accuracy. At this time, the initial time window is updated, meaning the window content slides to the latest data, allowing the system to make new evaluations and adjustments based on the current identification results. The identification frequency baseline ensures the system's response speed to changes, avoids long delays, and keeps the window evaluation always up-to-date, thus better adapting to dynamic changes in the network.

[0081] The target recognition rate represents the desired re-identification frequency, and the system uses this value to set the expected recognition result. When the number of identifications per unit time reaches a baseline value, the system adjusts the target recognition rate based on the actual identification situation, such as false positives and false negatives. The purpose of adjusting the target recognition rate is to minimize the total number of false positives. If the actual re-identification ratio is too high, it may indicate that the threshold is too lenient, leading to more false positives. In this case, the target recognition rate will be reduced to decrease the frequency of re-identification. Conversely, if the actual re-identification ratio is too low, it may indicate that the threshold is too strict, leading to more false negatives. In this case, the target recognition rate will be increased to increase the frequency of re-identification. The sliding window mechanism and dynamic adjustment strategy enable the system to update its strategy based on real-time identification data, reducing false positives and false negatives and improving the overall security of the network.

[0082] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for identifying device terminals in RIS phased array network deployment, characterized in that, The method includes: Step S1: Monitor the target identification terminal in the RIS phased array system that has been subjected to the initial network attack, collect the initial feature set in the target identification terminal, and monitor the abnormal attack behavior of the target identification terminal during the response lag time of identifying the initial network attack. Step S2: Construct a local outlier method to filter out effective attack behaviors in abnormal attack behaviors according to their effectiveness, extract the initial feature set of the target identification terminal corresponding to the effective attack behavior, and label it as a composite feature set; Step S3: Construct a machine learning model, use the machine learning model to perform mixed clustering calculations on the initial feature set and the composite feature set according to the effective attack behavior, and label the final generated result as a correlation scalar representing the target identification terminal features; Step S4: Set a dynamic threshold policy to identify and judge the correlation scalar. Valid attack behaviors corresponding to correlation scalars that do not conform to the dynamic threshold policy are judged as having no valid correlation with the initial network attack, and the target identification terminal does not need to be re-identified; valid attack behaviors corresponding to correlation scalars that conform to the dynamic threshold policy are judged as having a valid correlation with the initial network attack, and the target identification terminal needs to be re-identified.

2. The device terminal identification method for RIS phased array network deployment according to claim 1, characterized in that, The local outlier method includes the LOF outlier factor method; The process of filtering out valid attack behaviors using the local outlier method includes: All abnormal data points caused by abnormal attack behaviors are normalized, and each abnormal data point is set as an independent sample point. Set the number of neighbors to be used in the local density calculation, calculate the nearest neighbor set of the corresponding number of neighbors for each sample point and use it to calculate the local density of the sample point, and calculate the LOF value of each sample point based on the local density; A first density threshold is set for the LOF value. When the LOF value of a sample point is greater than the first density threshold, the abnormal attack behavior corresponding to the current sample point is determined to be a valid attack behavior that has an impact on the initial network attack. When the LOF value of a sample point is less than or equal to the first density threshold, the abnormal attack behavior corresponding to the current sample point is determined to have no effective impact on the initial network attack.

3. The device terminal identification method for RIS phased array network deployment according to claim 2, characterized in that, The calculation process for the LOF value is set as follows: Let the LOF value be the ratio of the average local density of the nearest neighbor samples to the local density of the target sample point; Wherein, the preset number of nearest neighbors is denoted as f, the distance value of the nearest neighbor sample with an ordinal number f from the target sample point in the nearest neighbor sample is d, and the set of sample points in the nearest neighbor sample whose distance from the target sample point is less than or equal to d is denoted as the set of nearest neighbor points, and the average local density of the nearest neighbor sample is the average local density of all the sets of nearest neighbor points of the target sample point.

4. The device terminal identification method for RIS phased array network deployment according to claim 3, characterized in that, A second density threshold is set for the LOF value, and the first density threshold is greater than the second density threshold. When the LOF value of a sample point is less than or equal to the second density threshold, it is determined that the abnormal attack behavior corresponding to the current sample point has no impact on the initial network attack. When the LOF value of a sample point is between the second density threshold and the first density threshold, it is determined that the abnormal attack behavior corresponding to the current sample point has a potential impact on the target identification terminal. The abnormal attack behavior corresponding to the current sample point is marked as a potential attack behavior, and defensive patching is performed on the abnormal data points caused by the potential attack behavior.

5. The device terminal identification method for RIS phased array network deployment according to claim 1, characterized in that, The initial feature set is constructed based on the RIS feature signals collected by the target identification terminal under the RIS phased array reflection path; the RIS feature signals are labeled with the spatial channel change features captured by the RIS enhancement path.

6. The device terminal identification method for RIS phased array network deployment according to claim 1, characterized in that, The process of performing hybrid clustering calculations using machine learning models includes: Step A1: The initial feature set and the composite feature set are weighted and merged according to the same type of data to form a multidimensional feature matrix containing multiple multidimensional data related to effective attack behaviors, and the data points in the multidimensional feature matrix are normalized. Step A2: Preset the cluster size range and iteration count, use the K-means clustering method to calculate the cluster centers, randomly generate a set of initial centroids, assign each data point to the nearest centroid, and then update and calculate the centroid of each cluster along the iteration count; Step A3: After completing the iteration, the cluster with the largest centroid spacing is marked as an anomalous behavior cluster with potential effective anomalous behavior. The data samples corresponding to the anomalous behavior cluster are marked as correlation scalars. The correlation scalars are then denormalized and output.

7. A device terminal identification method for RIS phased array network deployment according to claim 6, characterized in that, The process of updating the centroid includes: Let the centroid be denoted by μ, and let x i Let ω(x) represent the i-th data point. i ) represents data point x i The weights, let the cluster ordinal number be k, let C be... k Let |C| represent the set of all data points in the k-th cluster. k | indicates the total number of data points. Then the centroid μ of the k-th cluster k The calculation formula is expressed as: .

8. A device terminal identification method for RIS phased array network deployment according to claim 6, characterized in that, The inverse normalization process uses Min-Max inverse normalization to process each data point, and then compares the inverse normalized feature set with the historical behavior data of the target identification terminal along the time series points for re-evaluation.

9. A device terminal identification method for RIS phased array network deployment according to claim 1, characterized in that, The dynamic threshold strategy includes: setting a correlation threshold range for the correlation scalar and setting a sliding window mechanism to monitor historical judgment error in real time; The sliding window mechanism is defined as follows: a target identification rate that indicates the result needs to be re-identified is preset, and an initial time window of fixed length is preset; the initial time window records the judgment result of the target identification terminal each time, including whether re-identification is not required and whether re-identification is required; each time the sliding window is updated, the actual identification rate that indicates the result needs to be re-identified within the initial time window is calculated. When the actual recognition rate is higher than the target recognition rate, the correlation threshold range is narrowed; when the actual recognition rate is lower than the target recognition rate, the correlation threshold range is expanded.

10. A device terminal identification method for RIS phased array network deployment according to claim 9, characterized in that, A reference value for the identification frequency is set for the length of the initial time window; when the number of identifications per unit time reaches the reference value for the identification frequency, the initial time window is updated. When the number of identifications per unit time reaches the identification frequency benchmark value, the target identification rate is dynamically adjusted to minimize the total number of false positives.

Images