Method for judging attribution of surveying and mapping nodes of cyberspace surveying and mapping organization

Abstract

The invention provides a network space surveying and mapping organization surveying and mapping node affiliation discrimination method, and relates to the field of network detection, and the method comprises the steps: collecting the load data of a first service detection packet from a client through a low-interaction honeypot; based on the load data of the first service probe packet, a feature selection algorithm is operated to select a plurality of key load fields as features of surveying and mapping node organization identification; mapping the field value of the selected load field to the pixel of the picture through semantic coding, and coding according to the type of the field to generate a feature picture; classifying the feature pictures by using an IOMatch model, and identifying organizations to which the surveying and mapping nodes belong; and aggregating the identification results of the plurality of service probe packets from the same surveying and mapping node, and determining the final organization affiliation of the surveying and mapping node by using a voting mechanism and an integrated learning method. According to the invention, an organization affiliation discrimination algorithm based on the first service detection data packet is designed, and accurate surveying and mapping node organization affiliation discrimination can be realized.

Description

Technical Field

[0001] The present application relates to the field of network detection, and in particular to a method for determining the ownership of mapping nodes in a network space mapping organization. Background Art

[0002] With the rapid development of the internet, cyberscanning activity has increased significantly, particularly large-scale detections by cyberspace mapping organizations (such as Censys and Shodan). These organizations use public IP addresses to conduct network-wide scans, obtaining information about active hosts and services. This information can expose known vulnerabilities and become a potential threat to cyberattacks. Therefore, accurately identifying the organizations to which mapped nodes belong is crucial for network security.

[0003] Existing coarse-grained identification methods primarily rely on WHOIS queries and IP geolocation to obtain the ownership information of mapping nodes. However, these methods cannot accurately identify specific mapping organizations, and are particularly difficult to identify "unowned mapping nodes" (e.g., nodes not included in official public lists). Furthermore, while fine-grained methods can identify more unowned nodes, they are limited by the need for a large number of idle public IP addresses and their strong reliance on the characteristics of mapping nodes, resulting in poor feature robustness.

[0004] Therefore, existing technologies have problems such as insufficient accuracy, poor generalizability and poor feature robustness when identifying the organizational affiliation of surveying and mapping nodes, and are unable to effectively deal with complex network security threats in real environments. Summary of the Invention

[0005] The present application aims to solve one of the technical problems in the related art at least to a certain extent.

[0006] To this end, the purpose of this application is to propose a method for determining the ownership of mapping nodes in a cyberspace mapping organization.

[0007] To achieve the above objectives, the present application proposes a method for determining the ownership of a mapping node in a cyberspace mapping organization, including:

[0008] The payload data of the first service probe packet from the client is collected through a low-interaction honeypot;

[0009] Based on the payload data of the first service detection packet, a feature selection algorithm is run to select several key payload fields as features for mapping node organization identification;

[0010] Map the field values ​​of the selected payload fields to the pixels of the image through semantic coding, and encode them according to the field type to generate a feature image;

[0011] Using the IOMatch model to classify the feature images and identify the organization to which the mapping node belongs;

[0012] The recognition results of multiple service detection packages from the same mapping node are aggregated, and the final organizational affiliation of the mapping node is determined using a voting mechanism and an ensemble learning method.

[0013] Optionally, the collecting of payload data of the first service probe packet from the client through the low-interaction honeypot includes:

[0014] Configure multiple low-interaction honeypots in a protected network environment, where the low-interaction honeypots are deployed on a cloud computing platform or a local network, and configure multiple common services, including HTTP, TLS, and DNS;

[0015] Capturing the first service probe packet sent by the client when establishing a connection through the low-interaction honeypot, and recording and storing its payload data;

[0016] The payload data of each first-time service detection packet is annotated with the organization to which its mapping node belongs.

[0017] Optionally, the step of marking the payload data of each first service detection packet and marking the organization to which the mapping node belongs includes:

[0018] Based on the surveying and mapping node data published on the official website of the surveying and mapping organization, the surveying and mapping node IP addresses published by the cyberspace surveying and mapping organization are used as labels to mark the surveying and mapping nodes;

[0019] Alternatively, use the reverse DNS resolution data publicly available on the Internet to resolve the domain name associated with each detection source IP address; by extracting the organization name from the domain name, label the mapping node with the corresponding organization label;

[0020] Among them, the surveying and mapping nodes that cannot be marked by the above two methods are classified as unknown categories.

[0021] Optionally, based on the payload data of the first service detection packet, a feature selection algorithm is run to select several key payload fields as features for mapping node organization identification, including:

[0022] Use label encoding to encode each field and calculate the mutual information value between it and the surveying organization marked by the surveying node;

[0023] The fields are sorted according to the mutual information value, and the first n most recognizable fields are selected as features for subsequent mapping node organization identification.

[0024] Optionally, mapping the field value of the selected payload field to pixels of an image through semantic coding and encoding the field according to the type of the field to generate a feature image includes:

[0025] For option fields, each possible option value is mapped to a pixel in the image, and the brightness of the corresponding pixel is set according to the presence or absence of the option value. If the payload field contains a specific option value, the brightness of the corresponding pixel is set to 255, otherwise it is set to 0. For string fields, their ASCII values ​​are used for encoding, and each character is mapped to a pixel position in the image, and the ASCII value of the character is used as the brightness value of the pixel. If the number of characters exceeds the preset value, only the first p characters are selected for encoding. For integer fields, the integer value is converted to a fixed-width binary representation, each binary bit is mapped to a pixel, and the brightness of the corresponding pixel is set according to the binary value, with a brightness of 255 representing 1 and a brightness of 0 representing 0.

[0026] Define each image as a rectangle of r*c pixels, fill all encoded field values ​​into the image in a preset order, and generate a feature image containing option fields, string fields, and integer fields; among them, if the number of options in the option field exceeds the preset number, delete the options that appear less than m times in the current dataset. If the number of remaining options plus the pixel usage of the string and integer fields exceeds r*c pixels, sort all option values ​​in descending order of frequency, and select the first u options to participate in image construction.

[0027] Optionally, the training process of the IOMatch model includes:

[0028] For each service, a dedicated IOMatch model is trained to learn the payload characteristics of the initial service detection and classify the given feature images. The IOMatch model can learn from image samples of known and unknown categories, where the classification result consists of K+1 categories, where the first K categories correspond to known organizational categories and the K+1th category represents unknown organizational categories.

[0029] During the training process, tissue samples related to all disclosed mapping node IPs are considered as unknown class samples for model training and evaluation.

[0030] Optionally, aggregating the identification results of multiple service detection packets from the same mapping node and using a voting mechanism and an ensemble learning method to determine the final organizational affiliation of the mapping node includes:

[0031] For a certain period of time W t The identification results of multiple service detection packets from the same mapping node are sorted by the IP address of the mapping node.i and service type S j Grouping to obtain several sets of data packet level recognition results

[0032] For multiple detection packets of the same service sent by the same mapping node, a voting mechanism is applied to select the organization with the highest voting ratio as the final identification result of the corresponding service of the mapping node. The formula is:

[0033]

[0034] Based on the service-level recognition results of the same mapping node, an ensemble learning method is used to aggregate and obtain accurate mapping node-level recognition results. By aggregation We get J as the total number of service types.

[0035] Optionally, the service-level recognition results of the same mapping node are aggregated using an ensemble learning method to obtain accurate mapping node-level recognition results. include:

[0036] An ensemble learning method based on multiple logistic regression models is used to make weighted decisions on service-level recognition results. A logistic regression model is constructed for each known organization category, with a total of K models. For the kth model, the output of the recognition is the probability P of the corresponding organization. k Expressed as:

[0037]

[0038] Where σ is the sigmoid function, w k and b k Represent the weight vector and bias term of the k-th model respectively, and X is the t Feature vector of the service-level identification result of the same IP within the time period;

[0039] The threshold-based classification rule is used to determine the final organizational affiliation. If the probabilities output by all K logistic regression models are lower than the set threshold θ, the sample is classified as the unknown class. Otherwise, the model with the highest probability exceeding θ is selected to determine the organization to which the mapping node belongs. The formulated classification rule is:

[0040]

[0041] The OVR method is used for training the logistic regression model, and the weights are learned through the cross-entropy loss function. The threshold θ is optimized through equidistant search to optimize the F1 score and balance the recognition performance of known and unknown categories.

[0042] Optionally, the method supports periodic incremental updates, which are performed weekly by default, including:

[0043] In the initial training phase, the dataset and labels from the first week are used for initialization to determine the fields used for features. Once these fields are selected, they remain unchanged. Subsequent updates will only expand the image encoding based on these fields and update the IOMatch and logistic regression models.

[0044] At the end of each cycle, process the newly collected honeypot data X t , and update the dataset X t The label L of the organization to which the mapping node belongs t , and then perform image coding expansion, IOMatch model update and logistic regression model update in turn.

[0045] Optionally, the image encoding extension process includes: encoding extensions for HTTP and TLS service types to add newly observed option values; in the first week's dataset, encoding each field starting with the first six key fields and filling them into the designated position; in subsequent time periods, any newly observed option values ​​are appended to the end of the image to update the image encoding;

[0046] The IOMatch model update process includes: at the end of each cycle, saving the IOMatch model parameters obtained from the current training to a checkpoint file and performing incremental training in the next cycle;

[0047] The logistic regression model update process includes: at the end of each cycle, loading the logistic regression model parameters of the previous cycle; combining the service-level recognition result set of the current cycle with the label data of this cycle to update the parameters of the logistic regression model.

[0048] The technical solutions provided by the embodiments of this application bring at least the following beneficial effects:

[0049] Compared to existing darknet-based methods for traffic collection and attribution determination, this application designs an organization attribution determination algorithm based on first-time service detection packets by using a honeypot-based traffic collection solution, thereby achieving more accurate organization attribution determination of surveying nodes. Furthermore, this application can facilitate the analysis of network detection behavior and the formulation of network security policies, and is suitable for multiple application scenarios including network intrusion detection systems and network intrusion prevention systems.

[0050] Additional aspects and advantages of the present application will be given in part in the description below, and in part will become apparent from the description below, or will be learned through practice of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the following description of the embodiments in conjunction with the accompanying drawings, in which:

[0052] Figure 1 A flowchart of a method for determining ownership of mapping nodes in a network space mapping organization provided by an embodiment of the present application;

[0053] Figure 2 A system architecture diagram of a method for determining ownership of mapping nodes in a network space mapping organization provided by an embodiment of the present application;

[0054] FIG3( a ) is a schematic diagram of encoding selected fields of an HTTP probe packet into an image according to an embodiment of the present application;

[0055] FIG3( b ) is a schematic diagram of image encoding for updating HTTP service provided in an embodiment of the present application. DETAILED DESCRIPTION

[0056] The following describes in detail embodiments of the present application. Examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present application, and should not be construed as limiting the present application.

[0057] With the rapid development of the internet, cyberscanning activity has increased significantly, particularly large-scale detection campaigns initiated by cyberspace mapping organizations (such as Censys and Shodan). These organizations utilize advanced scanning techniques and extensive server resources to frequently probe the public IP address space, acquiring information about active hosts and deployed services. This information is not only crucial for network security but may also reveal services associated with known vulnerabilities, thereby facilitating potential cyberattacks. Therefore, accurately identifying the mapping organizations behind these scanning activities plays a crucial role in maintaining network security and provides a key basis for developing network security strategies.

[0058] Currently, most mapping nodes conduct network scanning via public IP addresses, making the identity of mapping nodes in cyberspace mapping organizations a critical research issue in the field of cybersecurity. Identifying the organizations to which mapping nodes belong helps network protection systems promptly detect potential scanning activities and implement appropriate defensive measures. However, determining the organizational affiliation of mapping nodes in real-world scenarios still faces numerous challenges.

[0059] In the existing technology, coarse-grained organization identification methods mainly rely on WHOIS queries and IP geolocation technology, and perform attribution analysis by mapping the IP addresses of mapping nodes to coarse-grained information such as cloud computing companies, autonomous systems (AS) or countries. This type of method can usually provide approximate mapping node attribution information, but cannot accurately identify the identity of the mapping organization behind it. In addition, this method has a large identification blind spot for "unaffiliated mapping nodes" (Unaffiliated Scanners) that do not have domain names and are not included in any official public mapping node list, resulting in the inability to effectively identify the organizational affiliation of such nodes, limiting the applicability and accuracy of the technology in practical applications.

[0060] Another type of method is based on the analysis of traffic data collected by darknet (darknet monitoring area, referring to the idle IP address range used for traffic monitoring), aiming to identify the source of unattributed mapping nodes at a more granular level. This method can identify the organizational information of more unknown mapping nodes, but it has the following problems: the darknet-based method requires a large number of routable and unused public IP addresses, which limits its widespread application in real-world environments; this method relies on the temporal and statistical characteristics of mapping nodes, but in real-world environments, the characteristics of mapping nodes vary significantly, resulting in poor feature stability, which in turn affects the recognition effect; for "unattributed mapping nodes" that cannot be automatically identified, existing technologies still rely on manual intervention for classification and verification, and cannot fully achieve automated identification.

[0061] Coarse-grained organization identification methods suffer from insufficient accuracy. The attribution information obtained through IP geolocation and WHOIS queries typically only reflects coarse-grained information at the cloud computing company, autonomous system (AS), or country level, and cannot accurately identify the specific organization to which a mapping node belongs. Furthermore, these methods have a blind spot for identifying "unowned mapping nodes" that lack domain names and are not included in official public lists. This makes it impossible to identify the affiliation of these unknown organizations, affecting the accuracy and operability of practical applications.

[0062] Fine-grained organizational identification methods have problems such as poor scalability, insufficient feature robustness, and reliance on manual evaluation. The darknet-based analysis method requires the deployment of a large number of idle IP addresses, and the actual deployment cost is high, making it difficult to popularize. This method relies on the temporal and statistical characteristics of the mapping nodes, but these characteristics may vary greatly between different mapping nodes, resulting in insufficient robustness of the method and difficulty in coping with complex situations in the real environment. For the identified "unowned mapping nodes", existing technologies usually require manual intervention for verification and cannot fully realize automated judgment, which increases labor costs and management difficulties.

[0063] In general, existing technologies for identifying the organizations to which surveying and mapping nodes belong suffer from a series of issues, including low accuracy, poor scalability, and insufficient feature stability, failing to fully meet the demands of actual network security protection. Therefore, accurately and efficiently identifying the organizational affiliation of surveying and mapping nodes, particularly those with no affiliation, remains a pressing challenge in the field of network security.

[0064] In order to solve the above problems, the present invention provides a method for determining the ownership of network space mapping organizations and mapping nodes. Figure 1 This is a flow chart of a method for determining the ownership of network space mapping organizations and mapping nodes provided by an embodiment of the present application. Figure 1 As shown, the method includes the following steps:

[0065] Step 101: collect payload data of the first service probe packet from the client through a low-interaction honeypot.

[0066] In the embodiment of the present application, step 101 is implemented by a flow collection module, specifically as follows: Figure 2 This module uses low-interaction honeypot technology to collect network probe traffic. Deployed on a cloud computing platform or local network, the low-interaction honeypot captures the initial service probe packets from the client to collect traffic and identify the attribution of the mapping node.

[0067] In a protected network environment, the embodiment of the present application configures multiple low-interaction honeypots. These honeypots are deployed in a cloud computing platform or a local network and are configured with multiple common services (such as HTTP, TLS, DNS, etc.). These common services can effectively attract detection traffic from various surveying and mapping nodes. Through low-interaction honeypot technology, only limited interaction with the client is possible, reducing the risk of the honeypot being attacked.

[0068] When a client establishes a connection with the honeypot, the honeypot captures the initial service probe packet sent by the client at the beginning of the connection and records its payload data. This initial service probe packet usually contains basic information about the client when initiating the connection, which is very important for subsequent attribution determination.

[0069] To support machine learning model training and subsequent organizational identification, the payload data of each initial service probe packet needs to be annotated. Specifically, the annotation process includes the following steps:

[0070] (1) Based on the mapping node data published on the official websites of surveying and mapping organizations, the mapping nodes are labeled using the mapping node IP addresses published on the official websites of cyberspace mapping organizations such as Censys, Rapid7, and Driftnet. These publicly available mapping node data provide reliable source information, which helps to accurately identify the ownership of mapping nodes.

[0071] (2) Using publicly available reverse DNS resolution data on the Internet, we parse the domain name associated with each probe source IP address, extract the organization name from the domain name, and assign the corresponding organization label to the mapping node. This method relies on reverse DNS resolution technology and can effectively extract organizational information related to the mapping node.

[0072] It should be noted that for those mapping nodes that cannot be annotated by the above two methods, the embodiment of the present application will classify them as "unknown". These nodes may be new or unpublished mapping nodes and cannot be directly annotated using existing public resources.

[0073] Step 102: Based on the payload data of the first service detection packet, a feature selection algorithm is run to select several key payload fields as features for mapping node organization identification.

[0074] In the embodiment of the present application, step 102 is performed by Figure 2 The feature selection module shown is implemented. In this module, the embodiment of the present application performs statistical analysis on the fields of the first service detection packet payload received by each service, and selects n key fields in each service for feature encoding of the next module based on the statistical information. Specifically, each field is first encoded using label encoding, and then the mutual information (MI) value between it and the surveying and mapping organization marked by the surveying and mapping node is calculated. According to the calculated mutual information value, the fields will be sorted, and the top n most recognizable fields will be selected as features for subsequent surveying and mapping node organization identification.

[0075] It is understandable that since the payload of services such as HTTP contains many fields (for example, HTTP may include dozens of fields), encoding all fields as features may result in excessive resource consumption and include fields that are irrelevant to distinguishing surveying and mapping node organizations. This redundancy may reduce recognition accuracy. Therefore, the feature selection module proposed in the embodiment of the present application uses the classic mutual information (MI) algorithm to select n key fields from the many fields of the service. The specific steps are as follows:

[0076] First, an embodiment of the present application uses label coding to encode the payload field in each first service detection packet. Then, the mutual information (MI) value between each field and the surveying and mapping organization marked by the surveying and mapping node is calculated. The mutual information value can reflect the correlation between the field and the target variable. The higher the MI value, the more important the field is for identifying the belonging of the surveying and mapping node organization. Then, the present application sorts the fields according to the calculated mutual information value. The top n fields with the highest MI values ​​are selected as features, and these features will be used for identifying the surveying and mapping node organization in subsequent steps.

[0077] In addition, in order to adapt to dynamically changing load characteristics, the feature selection module proposed in the embodiment of the present application supports periodic incremental updates. When continuously training the same data source, the selection of service fields will be initialized according to the above method. In this process, the feature selection module only uses the collected data to determine the key fields of the service when the system is initially used (i.e., the first cycle). The system will not change the selected fields in subsequent updates, but will focus on updating the specific values ​​of these selected fields.

[0078] It is worth noting that although the embodiments of the present application use low-interaction honeypot traffic as input, it is not limited to this specific data source. Since the present application relies entirely on the first service detection packets of the mapping nodes, any network traffic collection system that can capture these first service detection packets can use the present application to identify organizations related to the mapping nodes. Potential inputs include scanning traffic filtered by network intrusion detection systems (NIDS), traffic collected by reactive network telescopes (such as Spoki), and traffic provided by interactive cloud network telescopes (such as DScope). As long as the first service detection data packet is available, the present application can be effectively applied.

[0079] Step 103 : Map the field value of the selected payload field to the pixels of the image through semantic coding, and perform coding according to the type of the field to generate a feature image.

[0080] In the embodiment of the present application, step 103 is performed by Figure 2 The semantic encoding module shown is implemented. This module converts the field value of the payload field selected in step 102 into an image format for subsequent feature extraction and tissue attribution identification. To meet the input requirements of the IOMatch model, this application designs a new semantic encoding method that divides the selected fields into option fields, string fields, and integer fields according to their type, and designs different encoding schemes for each type of field.

[0081] Specifically, the semantic encoding process in step 103 includes:

[0082] For option fields (such as HTTP User-Agent and TLS hash algorithm fields), these fields may contain multiple options, and their values ​​are composed of a combination of these options. The embodiment of the present application first identifies all possible option values ​​in the data set and maps each option value to a pixel in the image. If the payload of the detection data packet contains a specific option value, the brightness of the corresponding pixel is set to 255 (indicating that the option value exists); if there is no option value, the brightness of the pixel is set to 0. In the incremental update scenario, the new training set may introduce additional option values, so each time the period is updated, the new option value will be appended to the end of the image to ensure the correctness of the image size.

[0083] For fields consisting of a single string (such as the URL field of an HTTP service, such as " / " or " / login.html"), the embodiment of the present application uses the ASCII value of the string for encoding. Each character is mapped to a pixel in the image, and the ASCII value of the character determines the brightness of the pixel, which ranges from 0 to 255. In order to effectively utilize pixel resources, the present application only encodes the first p characters of the string field, and the value of p is usually less than 50.

[0084] For fields containing only an integer (such as the fields in the DNS service's probe packet), the integer value will be converted to a fixed-width binary representation. Each binary bit corresponds to a pixel in the image. When the binary value is 1, the brightness of the pixel is set to 255, and when the binary value is 0, the brightness is set to 0.

[0085] Regarding image size, each image is defined as an r × c pixel rectangle, into which all encoded field values ​​are padded in a pre-set order. Field values ​​are padded row by row from left to right, as shown in Figure 3(a). To accommodate the IOMatch model's requirement for color image input, the padded rectangular image is replicated across all three RGB channels.

[0086] In addition, since the number of options in the option field may be very large, this application has designed a strategy to ensure that the image size remains within the range of r×c pixels. The specific steps are as follows:

[0087] First, remove option values ​​that appear fewer than m times in the current dataset to avoid including too many uncommon option values ​​in the image. If the number of options remaining in the option field plus the total number of pixels occupied by the string and integer fields exceeds r × c pixels, sort the option values ​​in descending order of frequency and select the first u option values ​​for image construction. Here, the value of u is determined by the number of remaining pixels (i.e., r × c minus the number of pixels occupied by the string and integer fields), ensuring that the final image size meets the input requirements of the IOMatch model.

[0088] Through this semantic encoding method, embodiments of the present application can effectively convert field values ​​into image format, thereby providing strong support for subsequent feature extraction and tissue attribution discrimination. This encoding method not only improves the efficiency of information representation, but also adapts to dynamically changing field features and the need for incremental updates. Through reasonable pixel allocation and option filtering strategies, the generated feature image is ensured to be of moderate size and contain information for all key fields.

[0089] Step 104: Use the IOMatch model to classify the feature images and identify the organization to which the mapping node belongs.

[0090] In the embodiment of the present application, step 104 is performed by Figure 2 The organization identification module shown in the figure uses the IOMatch model to classify the generated feature images and identify the organization to which the mapping node belongs. For each service, a dedicated IOMatch model is trained. This model is specifically used to learn the payload characteristics of the first service probe packet and classify the given feature images.

[0091] The core advantage of the IOMatch model lies in its ability to handle open-set recognition problems. Specifically, during training, the IOMatch model utilizes image samples of both known and unknown categories. This allows it to not only identify known tissue categories but also detect mapping nodes in unknown tissues. The classification results consist of K+1 categories, where the first K categories correspond to known tissue categories, and the K+1th category represents unknown tissue categories.

[0092] In the embodiment of the present application, the training and classification process of the IOMatch model is as follows:

[0093] Training Process: Each IOMatch model is specifically designed to learn from initial service detection data for a specific service. The model is trained based on the features of this data. During training, the model receives labeled feature image samples containing information about mapping nodes of known organizations. Furthermore, the model receives samples of unknown categories, originating from undisclosed cyberspace mapping nodes. To enhance the model's generalization capabilities, samples from organizations associated with all disclosed mapping node IP addresses are treated as unknown samples for training and evaluation.

[0094] Classification process: The trained IOMatch model classifies each feature image and determines the tissue category to which it belongs. For mapping nodes of known categories, the model identifies the specific tissue affiliation; for mapping nodes of unknown tissues, the model classifies them as unknown.

[0095] Step 105 , aggregating the identification results of multiple service detection packets from the same mapping node, and using a voting mechanism and an ensemble learning method to determine the final organizational affiliation of the mapping node.

[0096] In the embodiment of the present application, step 105 is performed by Figure 2 The result aggregation module implementation shown.

[0097] It should be noted that a mapping node may perform multiple service detections over a period of time, or even initiate multiple service sessions for the same service, thereby sending multiple initial service detection packets. Therefore, to obtain accurate mapping node-level identification results, a result aggregation method is required that can aggregate the detection results of multiple services and multiple data packets initiated by the same mapping node within a certain period of time.

[0098] The IOMatch model outputs the packet-level recognition results, that is, it outputs the organization affiliation for each packet. t The identification results within the embodiment of the present application are the identification results of multiple service detection packets from the same mapping node according to the IP address ip of the mapping node. i and service type S j Grouping to obtain several sets of data packet level recognition results A single mapping node can send multiple detection packets for the same service. This embodiment of the application applies a simple voting mechanism to the recognition results of multiple detection packets of the same service sent by each mapping node within a period of time. The organization with the highest voting ratio is selected as the final recognition result of the service corresponding to the mapping node. The formula is:

[0099]

[0100] Then, an integrated learning method is needed to aggregate the service-level recognition results of the same mapping node to obtain accurate mapping node-level recognition results. Indicates that W t The mapping node level recognition results in the aggregation Get, where J is the total number of service types.

[0101] The present application designs an integrated learning method based on multiple logistic regression models, which can achieve approximate weighted decision-making for each service-level identification result of the same mapping node. Logistic regression is a generalized linear model that estimates the probability P of an event based on a given set of independent variables X, where the value of P is between 0 and 1, and the probability calculation is implemented by a logistic function (Sigmoid function). The embodiment of the present application extends this method to the multi-classification task of the embodiment of the present application by constructing multiple logistic regression models to summarize the service-level identification results. For each known organizational category, the present application constructs a logistic regression model, so there are a total of K models. For the kth model, the output is the probability P of the corresponding organization. k Expressed as:

[0102]

[0103] Where σ is the sigmoid function, w k and b k Represent the weight vector and bias term of the k-th model respectively, and X is the t The feature vector of the service level identification result of the same IP in the time period. The independent variable X represents a set of t The service level identification result of the same IP in the time period. The element x of X i Defined as Each element Each model is one-hot encoded using K+1 binary values ​​(K+1 represents K known categories and 1 unknown category). Only one of these values ​​is set to 1; this bit position indicates the ordinal number of the identified organization. Therefore, the dimension of the weight vector for each model is J*(K+1), and the weight reflects the model's confidence in the organization identification result for each service.

[0104] Since unknown class samples do not have tissue labels, it is difficult to train an accurate unknown class logistic regression model. Therefore, the embodiment of the present application proposes a threshold-based classification rule, which is based only on the logistic regression model of K known classes for classification. The specific rule is: if the probability output by all K models is lower than the threshold θ, the sample is classified as an unknown class. Otherwise, the model with the highest probability and exceeding θ will be selected, and its corresponding tissue will be used as the recognition result. The formulated classification rules are as follows:

[0105]

[0106] The model training and threshold θ selection rules are as follows: The logistic regression model is trained using the "One-Versus-Rest" (OVR) method. For each model, mapped nodes belonging to the organization represented by the current model are considered positive samples, while mapped nodes not belonging to the organization are considered negative samples. The service-level recognition results of positive and negative samples are input into the model as the independent variable X for weight learning. The weight learning process uses cross-entropy as the loss function. The threshold θ is selected by performing an equidistant search on the training set. The search goal is to optimize the optimal F1 score to balance the recognition performance of known and unknown classes.

[0107] It should be noted that this application also supports periodic incremental updates, which are done through Figure 2 The system update module implementation shown in the figure. This application defaults to weekly updates. During the initial training phase, the service field selection is initialized using the first week's dataset and labels to determine the fields to use as features. Once these fields are selected, they remain unchanged. Subsequent updates only extend the image encoding based on these fields and update the IOMatch and logistic regression models.

[0108] At the end of each cycle, the embodiment of the present application processes the newly collected honeypot data X t , and update the dataset X t The label L of the organization to which the mapping node belongs t , and then perform image coding expansion, IOMatch model update and logistic regression model update in turn.

[0109] Specifically, the image encoding extension process is as follows: HTTP and TLS are encoded and extended to account for new options that may appear in the option type field. Figure 3(a) shows an example of image encoding for an HTTP service probe packet, starting with the first six key fields selected from the first week's dataset, encoding each field and filling it into the designated position. In the period after the first week, the image format may need to be updated. Figure 3(b) provides an illustrative update example, after encoding the first six fields of the first week, any newly observed option values ​​in the second week's data are appended to the end of the image. Similarly, for subsequent datasets, newly observed option values ​​are identified and added to the updated image encoding.

[0110] The IOMatch model update process is as follows: at the end of each cycle, the model parameters are saved to the checkpoint file, and incremental training is performed using new data in the next cycle. For example, when entering a new time period t, the embodiment of the present application will load the parameters obtained from the training of the previous time period from the checkpoint file, and then use the data of the current time period X t and label L t Continue training the IOMatch model and update the model parameters.

[0111] The logistic regression model update process is similar to the IOMatch model update method. At the end of each cycle, the embodiment of the present application loads the logistic regression model parameters of the previous cycle and combines the service-level recognition result set of the current cycle with the label data of the current cycle to update the parameters of the logistic regression model.

[0112] It should be understood that the various forms of the processes shown above can be used to reorder, add, or delete steps. For example, the steps described in this application can be performed in parallel, sequentially, or in a different order, as long as the desired results of the technical solution of this application can be achieved. This is not limited herein.

[0113] The above specific embodiments do not constitute a limitation on the scope of protection of this application. Those skilled in the art will appreciate that various modifications, combinations, sub-combinations, and substitutions may be made based on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this application shall be included within the scope of protection of this application.

Claims

1. A method for determining the ownership of mapping nodes in a network space mapping organization, characterized in that: include: The payload data of the first service probe packet from the client is collected through a low-interaction honeypot; Based on the payload data of the first service detection packet, a feature selection algorithm is run to select several key payload fields as features for mapping node organization identification; Map the field values ​​of the selected payload fields to the pixels of the image through semantic coding, and encode them according to the field type to generate a feature image; Using the IOMatch model to classify the feature images and identify the organization to which the mapping node belongs; The recognition results of multiple service detection packages from the same mapping node are aggregated, and the final organizational affiliation of the mapping node is determined using a voting mechanism and an ensemble learning method.

2. The method according to claim 1, characterized in that The payload data of the first service probe packet from the client is collected through the low-interaction honeypot, including: Configure multiple low-interaction honeypots in a protected network environment, where the low-interaction honeypots are deployed on a cloud computing platform or a local network, and configure multiple common services, including HTTP, TLS, and DNS; Capturing the first service probe packet sent by the client when establishing a connection through the low-interaction honeypot, and recording and storing its payload data; The payload data of each first-time service detection packet is annotated with the organization to which its mapping node belongs.

3. The method according to claim 2, characterized in that The marking of the payload data of each first service detection packet and the organization to which the mapping node belongs includes: Based on the surveying and mapping node data published on the official website of the surveying and mapping organization, the surveying and mapping node IP addresses published by the cyberspace surveying and mapping organization are used as labels to mark the surveying and mapping nodes; Alternatively, use the reverse DNS resolution data publicly available on the Internet to resolve the domain name associated with each detection source IP address; by extracting the organization name from the domain name, label the mapping node with the corresponding organization label; Among them, the surveying and mapping nodes that cannot be marked by the above two methods are classified as unknown categories.

4. The method according to claim 3, characterized in that Based on the payload data of the first service detection packet, a feature selection algorithm is run to select several key payload fields as features for mapping node organization identification, including: Use label encoding to encode each field and calculate the mutual information value between it and the surveying organization marked by the surveying node; The fields are sorted according to the mutual information value, and the first n most recognizable fields are selected as features for subsequent mapping node organization identification.

5. The method according to claim 4, characterized in that The method maps the field value of the selected payload field to the pixels of the image through semantic coding, and encodes the field according to the type of the field to generate a feature image, including: For option fields, each possible option value is mapped to a pixel in the image, and the brightness of the corresponding pixel is set according to the presence or absence of the option value. If the payload field contains a specific option value, the brightness of the corresponding pixel is set to 255, otherwise it is set to 0. For string fields, their ASCII values ​​are used for encoding, and each character is mapped to a pixel position in the image, and the ASCII value of the character is used as the brightness value of the pixel. If the number of characters exceeds the preset value, only the first p characters are selected for encoding. For integer fields, the integer value is converted to a fixed-width binary representation, each binary bit is mapped to a pixel, and the brightness of the corresponding pixel is set according to the binary value, with a brightness of 255 representing 1 and a brightness of 0 representing 0. Define each image as a rectangle of r*c pixels, fill all encoded field values ​​into the image in a preset order, and generate a feature image containing option fields, string fields, and integer fields; among them, if the number of options in the option field exceeds the preset number, delete the options that appear less than m times in the current dataset. If the number of remaining options plus the pixel usage of the string and integer fields exceeds r*c pixels, sort all option values ​​in descending order of frequency, and select the first u options to participate in image construction.

6. The method according to claim 5, characterized in that The training process of the IOMatch model includes: For each service, a dedicated IOMatch model is trained to learn the payload characteristics of the initial service detection and classify the given feature images. The IOMatch model can learn from image samples of known and unknown categories, where the classification result consists of K+1 categories, where the first K categories correspond to known organizational categories and the K+1th category represents unknown organizational categories. During the training process, tissue samples related to all disclosed mapping node IPs are considered as unknown class samples for model training and evaluation.

7. The method according to claim 6, characterized in that The identification results of multiple service detection packages from the same mapping node are aggregated, and a voting mechanism and an ensemble learning method are used to determine the final organizational affiliation of the mapping node, including: For a certain period of time W t The identification results of multiple service detection packets from the same mapping node are sorted by the IP address of the mapping node. i and service type S j Grouping to obtain several sets of data packet level recognition results For multiple detection packets of the same service sent by the same mapping node, a voting mechanism is applied to select the organization with the highest voting ratio as the final identification result of the corresponding service of the mapping node. The formula is: Based on the service-level recognition results of the same mapping node, an ensemble learning method is used to aggregate and obtain accurate mapping node-level recognition results. By aggregation j=1,…,J, where J is the total number of service types.

8. The method according to claim 7, characterized in that The above method uses the ensemble learning method to aggregate the service-level recognition results of the same mapping node to obtain accurate mapping node-level recognition results. include: An ensemble learning method based on multiple logistic regression models is used to make weighted decisions on service-level recognition results. A logistic regression model is constructed for each known organization category, with a total of K models. For the kth model, the output of the recognition is the probability P of the corresponding organization. k Expressed as: Among them, σ is the sigmoid function, w k and b k Represent the weight vector and bias term of the k-th model respectively, and X is the t Feature vector of the service-level identification result of the same IP within the time period; The threshold-based classification rule is used to determine the final organizational affiliation. If the probabilities output by all K logistic regression models are lower than the set threshold θ, the sample is classified as the unknown class. Otherwise, the model with the highest probability exceeding θ is selected to determine the organization to which the mapping node belongs. The formulated classification rule is: The OVR method is used for training the logistic regression model, and the weights are learned through the cross-entropy loss function. The threshold θ is optimized through equidistant search to optimize the F1 score and balance the recognition performance of known and unknown categories.

9. The method according to claim 8, characterized in that The method supports periodic incremental updates, with weekly updates as the default, including: In the initial training phase, the dataset and labels from the first week are used for initialization to determine the fields used for features. Once these fields are selected, they remain unchanged. Subsequent updates will only expand the image encoding based on these fields and update the IOMatch and logistic regression models. At the end of each cycle, process the newly collected honeypot data X t , and update the dataset X t The label L of the organization to which the mapping node belongs t , and then perform image coding expansion, IOMatch model update and logistic regression model update in turn.

10. The method according to claim 9, characterized in that The image encoding extension process includes: encoding and extending the HTTP and TLS service types to add newly observed option values; in the first week of the dataset, encoding each field starting with the first six key fields and filling them into the designated position; in subsequent time periods, any newly observed option values ​​are appended to the end of the image to update the image encoding; The IOMatch model update process includes: at the end of each cycle, saving the IOMatch model parameters obtained from the current training to a checkpoint file and performing incremental training in the next cycle; The logistic regression model update process includes: at the end of each cycle, loading the logistic regression model parameters of the previous cycle; combining the service-level recognition result set of the current cycle with the label data of this cycle to update the parameters of the logistic regression model.

Images