Cyberspace mapping organization mapping node attribution determination method

Abstract

The application provides a network space mapping organization mapping node attribution distinguishing method, and relates to the field of network detection, wherein the method comprises the following steps: collecting the load data of the first service detection packet from the client through a low-interaction honeypot; based on the load data of the first service detection packet, running a feature selection algorithm to select a plurality of key load fields as the features for identifying the mapping node organization; mapping the field values of the selected load fields to the pixels of a picture through semantic coding, and generating a feature picture according to the types of the fields; using an IOMatch model to classify the feature picture, and identifying the organization to which the mapping node belongs; and aggregating the identification results of a plurality of service detection packets from the same mapping node, and using a voting mechanism and an integrated learning method to determine the final organization attribution of the mapping node. The application designs an organization attribution distinguishing algorithm based on the first service detection packet, and can accurately distinguish the organization attribution of the mapping node.

Description

Technical Field

[0001] This application relates to the field of network detection, and in particular to a method for determining the affiliation of mapping nodes in a cyberspace mapping organization. Background Technology

[0002] With the rapid development of the internet, scanning activities in cyberspace have increased significantly, especially large-scale probes launched by cyberspace mapping organizations (such as Censys and Shodan). These organizations conduct full-network scans using public IP addresses to obtain host activity and service information. This information may expose known vulnerabilities, becoming a potential threat to cyberattacks. Therefore, accurately identifying the organization to which a mapping node belongs is crucial for network security.

[0003] In existing technologies, coarse-grained identification methods mainly obtain the attribution information of surveying and mapping nodes through WHOIS queries and IP geolocation technology. However, these methods cannot accurately identify specific surveying and mapping organizations, especially for "unclaimed surveying and mapping nodes" (such as nodes not listed in the official public list). In addition, although fine-grained methods can identify more unclaimed nodes, they are limited by the need for a large number of idle public IP addresses and are highly dependent on the characteristics of surveying and mapping nodes, resulting in poor feature robustness.

[0004] Therefore, existing technologies suffer from insufficient accuracy, poor generalizability, and poor feature robustness in identifying the organizational affiliation of mapping nodes, and cannot effectively address complex cybersecurity threats in real-world environments. Summary of the Invention

[0005] This application aims to at least partially address one of the technical problems in the related art.

[0006] Therefore, the purpose of this application is to propose a method for determining the affiliation of mapping nodes in a cyberspace mapping organization.

[0007] To achieve the above objectives, this application proposes a method for determining the affiliation of mapping nodes in a cyberspace mapping organization, comprising:

[0008] Payload data from the first service probe packet from the client is collected via a low-interaction honeypot;

[0009] Based on the payload data of the first service probe packet, a feature selection algorithm is run to select several key payload fields as features for mapping node organization identification.

[0010] The selected payload field values ​​are mapped to the pixels of the image through semantic encoding, and the data is encoded according to the field type to generate a feature image;

[0011] The feature images are classified using the IOMatch model to identify the organization to which the mapping node belongs;

[0012] The identification results of multiple service probe packets from the same mapping node are aggregated, and a voting mechanism and ensemble learning method are used to determine the final organizational affiliation of the mapping node.

[0013] Optionally, the collection of payload data from the first service probe packet from the client via the low-interaction honeypot includes:

[0014] Configure multiple low-interaction honeypots in a protected network environment. The low-interaction honeypots are deployed on a cloud computing platform or local network and configured with multiple commonly used services, including HTTP, TLS and DNS.

[0015] The low-interaction honeypot captures the first service probe packet sent by the client when establishing a connection, records and stores its payload data;

[0016] The payload data of each initial service probe package is labeled, along with the organization to which its mapping node belongs.

[0017] Optionally, the annotation of the payload data for each initial service probe package, including the labeling of the organization to which its mapping node belongs, includes:

[0018] Based on the mapping node data published on the official website of the mapping organization, the mapping nodes were labeled using the IP addresses of the mapping nodes published by the Cyberspace Mapping Organization.

[0019] Alternatively, use publicly available reverse DNS resolution data from the internet to resolve the domain names associated with each probe source IP address; and by extracting the organization names from the domain names, assign the corresponding organization labels to the mapping nodes;

[0020] Among them, survey nodes that cannot be labeled using the above two methods are classified as unknown.

[0021] Optionally, based on the payload data of the initial service probe packet, a feature selection algorithm is run to select several key payload fields as features for mapping node organization identification, including:

[0022] Each field is encoded using label encoding, and the mutual information value between it and the mapping organization labeled by the mapping node is calculated.

[0023] The fields are sorted according to the mutual information values, and the top n most distinctive fields are selected as features for subsequent mapping node organization identification.

[0024] Optionally, the step of mapping the field values ​​of the selected payload fields to pixels of the image through semantic encoding, and encoding them according to the type of the fields to generate a feature image, includes:

[0025] For the option field, each possible option value is mapped to a pixel in the image, and the brightness of the corresponding pixel is set according to the presence or absence of the option value. If the load field contains a specific option value, the brightness of the corresponding pixel is set to 255, otherwise it is 0. For the string field, its ASCII value is used for encoding, each character is mapped to a pixel position in the image, and the ASCII value of the character is used as the brightness value of that pixel. If the number of characters exceeds a preset value, only the first p characters are selected for encoding. For the integer field, the integer value is converted into a fixed-width binary representation, each binary bit corresponds to a pixel, and the brightness of the corresponding pixel is set according to the binary value. A brightness of 255 represents 1, and a brightness of 0 represents 0.

[0026] Each image is defined as a rectangle of r*c pixels. All encoded field values ​​are filled into the image in a preset order to generate a feature image containing option fields, string fields, and integer fields. If the number of options in the option field exceeds a preset number, options that appear less than m times in the current dataset are deleted. If the number of remaining options plus the pixel usage of the string and integer fields exceeds r*c pixels, all option values ​​are sorted in descending order of frequency, and the top u options are selected to participate in image construction.

[0027] Optionally, the training process of the IOMatch model includes:

[0028] For each service, a dedicated IOMatch model is trained to learn the payload features of the first service probe and classify the given feature images. The IOMatch model can learn using image samples of known and unknown categories, where the classification result consists of K+1 categories, where the first K categories correspond to known organization categories and the K+1 category represents unknown organization categories.

[0029] During training, organization samples associated with all disclosed mapping node IPs are treated as unknown samples and used for model training and evaluation.

[0030] Optionally, the aggregation of identification results from multiple service probe packets from the same mapping node, and the determination of the final organizational affiliation of the mapping node using a voting mechanism and ensemble learning method, includes:

[0031] For a certain time period W t The identification results within the mapping node are sorted by the IP address of the mapping node from the identification results of multiple service probe packets from the same mapping node.i Service type S j The data packets are grouped to obtain several sets of data packet-level recognition results.

[0032] For multiple probe packets for the same service sent by the same mapping node, a voting mechanism is applied to select the organization with the highest voting percentage as the final identification result for the service corresponding to that mapping node. The formula is expressed as:

[0033]

[0034] Based on the identification results of various service levels of the same mapping node, an ensemble learning method is used to aggregate them, resulting in accurate mapping node-level identification results. By aggregation J represents the total number of service types.

[0035] Optionally, the process involves aggregating the identification results of various service-level data points for the same mapping node using an ensemble learning method to obtain accurate mapping node-level identification results. include:

[0036] An ensemble learning approach based on multiple logistic regression models is employed for weighted decision-making of service-level identification results. A logistic regression model is constructed for each known organization category, resulting in a total of K models. For the k-th model, the output is the probability P of identifying the corresponding organization. k Represented as:

[0037]

[0038] Where σ is the sigmoid function, w k and b k Let X represent the weight vector and bias term of the k-th model, respectively, and let X be the weight vector and bias term of the model in W. t Feature vector of service-level identification results for the same IP within a time period;

[0039] A threshold-based classification rule is used to determine the final organization affiliation. If the probabilities output by all K logistic regression models are lower than a set threshold θ, the sample is classified as an unknown class. Otherwise, the model with the highest probability exceeding θ is selected to determine the organization to which the mapping node belongs. The formulaic classification rule is as follows:

[0040]

[0041] The logistic regression model is trained using the OVR method, and weights are learned through the cross-entropy loss function. The threshold θ is optimized by equidistant search to improve the F1 score and balance the recognition performance of known and unknown categories.

[0042] Optionally, the method supports periodic incremental updates, with weekly updates by default, including:

[0043] During the initial training phase, the dataset and labels from the first week are used for initialization to determine the fields used for features. Once these fields are selected, they remain unchanged, and subsequent updates will only expand the image encoding based on these fields and update the IOMatch and logistic regression models.

[0044] At the end of each cycle, process the newly collected honeypot data X. t and update dataset X t The tag L of the organization to which the surveying and mapping node belongs t Then, image encoding expansion, IOMatch model update, and logistic regression model update are performed sequentially.

[0045] Optionally, the image encoding extension process includes: extending the encoding for HTTP and TLS service types, adding newly observed option values; encoding each field in the first week's dataset, starting with the first six key fields, and filling them into designated positions; in subsequent time periods, any newly observed option values ​​are appended to the end of the image, updating the image encoding;

[0046] The IOMatch model update process includes: at the end of each cycle, saving the currently trained IOMatch model parameters to the checkpoint file, and performing incremental training in the next cycle;

[0047] The logistic regression model update process includes: at the end of each period, loading the logistic regression model parameters from the previous period; and combining the service-level identification result set of the current period with the label data of the current period to update the parameters of the logistic regression model.

[0048] The technical solutions provided by the embodiments of this application bring at least the following beneficial effects:

[0049] Compared to existing methods for traffic collection and attribution determination based on Darknet, this application designs an organization attribution determination algorithm based on first-service probe packets by using a honeypot-based traffic collection scheme, thereby achieving more accurate attribution determination of mapping node organizations. Furthermore, this application can facilitate the analysis of network probe behavior and the formulation of network security strategies, and is applicable to multiple application scenarios including network intrusion detection systems and network intrusion prevention systems.

[0050] Additional aspects and advantages of this application will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of this application. Attached Figure Description

[0051] The above and / or additional aspects and advantages of this application will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, wherein:

[0052] Figure 1 This is a flowchart illustrating a method for determining the affiliation of mapping nodes in a cyberspace mapping organization, as provided in an embodiment of this application.

[0053] Figure 2 This is a system architecture diagram of a method for determining the affiliation of mapping nodes in a cyberspace mapping organization, provided in an embodiment of this application.

[0054] Figure 3(a) is a schematic diagram of encoding selected fields of an HTTP probe data packet into an image according to an embodiment of this application;

[0055] Figure 3(b) is a schematic diagram of the image encoding of the HTTP update service provided in the embodiments of this application. Detailed Implementation

[0056] The embodiments of this application are described in detail below. Examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain this application, and should not be construed as limiting this application.

[0057] With the rapid development of the internet, scanning activities in cyberspace have increased significantly, especially large-scale probing activities initiated by cyberspace mapping organizations (such as Censys and Shodan). These organizations utilize advanced scanning technologies and substantial server resources to frequently probe the public IP address space, acquiring information on host activity and deployed services. This information is not only crucial for network security but may also reveal services related to known vulnerabilities, thereby supporting potential cyberattacks. Therefore, accurately identifying the mapping organizations behind these scanning activities is vital for maintaining network security and provides a key basis for developing network security strategies.

[0058] Currently, most mapping nodes conduct network scanning using public IP addresses, making the identification of mapping nodes within cyberspace mapping organizations a crucial research issue in the field of cybersecurity. Identifying the organization to which a mapping node belongs helps network protection systems promptly detect potential scanning activities and take appropriate defensive measures. However, determining the organizational affiliation of mapping nodes still faces many challenges in real-world scenarios.

[0059] In existing technologies, coarse-grained organization identification methods mainly rely on WHOIS queries and IP geolocation techniques. This involves mapping the IP addresses of mapping nodes to coarse-grained information such as cloud computing companies, Autonomous Systems (AS), or countries for attribution analysis. These methods typically provide general attribution information for mapping nodes but cannot accurately identify the underlying mapping organization. Furthermore, this approach has significant blind spots for identifying "unaffiliated scanners"—nodes without domain names and not listed in any official public mapping node lists—thus limiting the applicability and accuracy of the technology in practical applications.

[0060] Another approach analyzes traffic data collected from the darknet (a range of idle IP addresses used for traffic monitoring), aiming to identify the source of unowned mapping nodes at a more granular level. This method can identify more organizational information about unknown mapping nodes, but it suffers from the following problems: The darknet-based method requires a large number of routable and unused public IP addresses, limiting its widespread application in real-world environments; this method relies on the temporal and statistical characteristics of mapping nodes, but in real-world environments, the characteristics of mapping nodes vary significantly, leading to poor feature stability and affecting identification accuracy; for "unowned mapping nodes" that cannot be automatically identified, current technology still requires manual intervention for classification and verification, failing to achieve fully automated identification.

[0061] Coarse-grained organization identification methods suffer from insufficient accuracy. Attribution information obtained using IP geolocation and WHOIS queries typically only reflects coarse-grained levels such as cloud computing companies, Autonomous Systems (AS), or countries, failing to accurately identify the specific mapping organization to which a mapping node belongs. Furthermore, these methods have blind spots in identifying "unattributed mapping nodes" that lack domain names and are not listed in official public lists, thus failing to identify the affiliation of these unknown organizations and impacting the accuracy and operability of practical applications.

[0062] Fine-grained organization identification methods suffer from poor generalization, insufficient feature robustness, and reliance on manual evaluation. Darknet-based analysis methods require deploying a large number of idle IP addresses, resulting in high costs and limited adoption in practice. These methods rely on the temporal and statistical characteristics of mapping nodes, but these characteristics can vary significantly between different nodes, leading to insufficient robustness and difficulty in handling complex real-world situations. For identified "unclaimed mapping nodes," current technologies typically require manual verification, failing to achieve fully automated judgment and increasing labor costs and management complexity.

[0063] In summary, existing technologies suffer from a series of problems in identifying the organizational affiliation of mapping nodes, including low accuracy, poor generalizability, and insufficient feature stability, failing to fully meet the needs of practical network security protection. Therefore, accurately and efficiently identifying the organizational affiliation of mapping nodes, especially the affiliation of "unaffiliated mapping nodes," remains a pressing problem to be solved in the field of network security.

[0064] To address the aforementioned problems, embodiments of this application provide a method for determining the affiliation of mapping nodes within a cyberspace mapping organization. Figure 1 This is a flowchart illustrating a method for determining the affiliation of mapping nodes in a cyberspace mapping organization, as provided in an embodiment of this application. Figure 1 As shown, the method includes the following steps:

[0065] Step 101: Collect payload data of the first service probe packet from the client through a low-interaction honeypot.

[0066] In this embodiment of the application, step 101 is implemented through a traffic collection module, specifically as follows: Figure 2 As shown, this module employs low-interaction honeypot technology to collect network probe traffic. Low-interaction honeypots are deployed on cloud computing platforms or local networks, capturing initial service probe packets from clients to collect traffic and determine the attribution of mapping nodes.

[0067] In a protected network environment, this application embodiment configures multiple low-interaction honeypots. These honeypots are deployed on a cloud computing platform or local network and configured with several commonly used services (such as HTTP, TLS, DNS, etc.). These commonly used services can effectively attract probe traffic from various mapping nodes. Through low-interaction honeypot technology, limited interaction with the client is achieved, reducing the risk of the honeypot being attacked.

[0068] When a client establishes a connection with the honeypot, the honeypot captures the initial service probe packet sent by the client at the beginning of the connection and records its payload data. This initial service probe packet typically contains basic information about the client when initiating the connection, which is crucial for subsequent attribution determination.

[0069] To support machine learning model training and subsequent organization affiliation determination, the payload data of each initial service probe packet needs to be labeled. Specifically, the labeling process includes the following steps:

[0070] (1) Based on the mapping node data published on the official websites of mapping organizations, mapping nodes are labeled using the IP addresses of mapping nodes published on the official websites of network space mapping organizations such as Censys, Rapid7, and Driftnet. This publicly available mapping node data provides reliable source information, which helps to accurately identify the affiliation of mapping nodes.

[0071] (2) Using publicly available reverse DNS resolution data from the Internet, the organization name is extracted from the domain name associated with each probe source IP address by resolving the domain name, and the corresponding organization label is then affixed to the mapping node. This method relies on reverse DNS resolution technology, which can effectively extract organization information related to the mapping node.

[0072] It should be noted that for surveying nodes that cannot be labeled using the above two methods, this application embodiment will classify them as "unknown". These nodes may be new or undisclosed surveying nodes that cannot be directly labeled using existing public resources.

[0073] Step 102: Based on the payload data of the first service probe packet, run the feature selection algorithm to select several key payload fields as features for mapping node organization identification.

[0074] In this embodiment of the application, step 102 is achieved through... Figure 2 The feature selection module shown is implemented as follows. In this module, the embodiments of this application perform statistical analysis on the fields of the initial service probe packet payload received by each service, and select n key fields from each service for feature encoding in the next module based on the statistical information. Specifically, each field is first encoded using label encoding, and then the mutual information (MI) value between it and the mapping organization labeled by the mapping node is calculated. Based on the calculated MI value, the fields are sorted, and the top n most identifiable fields are selected as features for subsequent mapping node organization identification.

[0075] It is understandable that, since the payload of services such as HTTP contains numerous fields (e.g., HTTP may include dozens of fields), encoding all fields as features could lead to excessive resource consumption and include fields irrelevant to distinguishing mapping node organizations; this redundancy could reduce recognition accuracy. Therefore, the feature selection module proposed in this application uses the classic mutual information (MI) algorithm to select n key fields from the numerous fields of the service. The specific steps are as follows:

[0076] First, this embodiment uses label encoding to encode the payload fields in each initial service probe packet. Then, the mutual information (MI) value between each field and the mapping organization labeled by the mapping node is calculated. The MI value reflects the correlation between the field and the target variable; the higher the MI value, the more important the field is for identifying the mapping node's organizational affiliation. Next, this application sorts the fields based on the calculated MI values. The top n fields with the highest MI values ​​are selected as features, which will be used in subsequent steps for identifying the mapping node's organizational affiliation.

[0077] Furthermore, to adapt to dynamically changing load characteristics, the feature selection module proposed in this application supports periodic incremental updates. During continuous training on the same data source, the selection of service fields is initialized according to the method described above. In this process, the feature selection module only uses the collected data to determine the key fields of the service during the initial use of the system (i.e., the first period). In subsequent updates, the system does not change the selected fields but focuses on updating the specific values ​​of these selected fields.

[0078] It is worth noting that although this application uses low-interaction honeypot traffic as input, it is not limited to this specific data source. Since this application relies entirely on the first-service probe packets from the mapping node, any network traffic collection system capable of capturing these first-service probe packets can use this application to identify organizations associated with the mapping node. Potential inputs include scan traffic filtered by a Network Intrusion Detection System (NIDS), traffic collected by reactive network telescopes (such as Spoki), and traffic provided by interactive cloud network telescopes (such as DScope). This application can be effectively applied as long as first-service probe packets are available.

[0079] Step 103: The field values ​​of the selected payload fields are mapped to the pixels of the image through semantic encoding, and the field is encoded according to its type to generate a feature image.

[0080] In this embodiment of the application, step 103 is achieved through... Figure 2 The semantic encoding module shown is implemented. This module converts the field values ​​of the payload fields selected in step 102 into image format for subsequent feature extraction and organization attribution identification. To adapt to the input requirements of the IOMatch model, this application designs a novel semantic encoding method. This method classifies the selected fields into option fields, string fields, and integer fields according to their types, and designs different encoding schemes for each type of field.

[0081] Specifically, the semantic encoding process in step 103 includes:

[0082] For option fields (such as HTTP User-Agent and TLS hash algorithm fields), these fields may contain multiple options, and their values ​​are combinations of these options. This embodiment first identifies all possible option values ​​in the dataset and maps each option value to a pixel in the image. If the payload of the probe packet contains a specific option value, the brightness of the corresponding pixel is set to 255 (indicating the presence of that option value); if the option value is not present, the brightness of the pixel is set to 0. In incremental update scenarios, new training sets may introduce additional option values; therefore, each time a periodic update occurs, the new option values ​​are appended to the end of the image to ensure the correct image size.

[0083] For fields consisting of a single string (such as URL fields in HTTP services, e.g., " / " or " / login.html"), this application embodiment uses the ASCII value of the string for encoding. Each character maps to a pixel in the image, and the ASCII value of the character determines the brightness of that pixel, ranging from 0 to 255. To effectively utilize pixel resources, this application only encodes the first p characters of the string field, typically with p being less than 50.

[0084] For fields containing only a single integer (such as those in a DNS service probe packet), the integer value will be converted to a fixed-width binary representation. Each bit corresponds to a pixel in the image; a binary value of 1 sets the brightness of that pixel to 255, and a binary value of 0 sets the brightness to 0.

[0085] Regarding image size settings, each image is defined as an r×c pixel rectangle, and all encoded field values ​​are filled into the image in a preset order. The field values ​​are filled row by row from left to right, as shown in Figure 3(a). To accommodate the IOMatch model's requirement for color image input, the filled rectangular image is copied across all three RGB channels.

[0086] Furthermore, since the number of options in the options field can be very large, this application designs a strategy to ensure that the image size remains within the range of r×c pixels. The specific steps are as follows:

[0087] First, remove option values ​​that appear less than m times in the current dataset to avoid including too many uncommon option values ​​in the image. If the total number of remaining options in the option field, plus the total number of pixels occupied by the string and integer fields, exceeds r × c pixels, then sort the option values ​​in descending order of frequency and select the top u option values ​​for image construction. Here, the value of u is determined by the number of remaining pixels (i.e., r × c - the number of pixels occupied by the string and integer fields), ensuring that the final image size is suitable for the input requirements of the IOMatch model.

[0088] Through this semantic encoding method, the embodiments of this application can effectively convert field values ​​into image format, thereby providing strong support for subsequent feature extraction and organization attribution determination. This encoding method not only improves the efficiency of information representation but also adapts to dynamically changing field features and the need for incremental updates. By employing reasonable pixel allocation and option filtering strategies, it ensures that the generated feature image is of appropriate size while containing information from all key fields.

[0089] Step 104: Use the IOMatch model to classify the feature images and identify the organization to which the mapping node belongs.

[0090] In this embodiment of the application, step 104 is achieved through... Figure 2 The organization identification module shown uses the IOMatch model to classify generated feature images, thereby identifying the organization to which the mapping node belongs. For each service, a dedicated IOMatch model is trained, specifically designed to learn the payload features of the initial service probe packet and classify the given feature image.

[0091] The core advantage of the IOMatch model lies in its ability to handle open set recognition problems. Specifically, during training, the IOMatch model learns from image samples of known and unknown categories, enabling it to not only identify known organization categories but also detect mapping nodes of unknown organizations. The classification result consists of K+1 categories, where the first K categories correspond to known organization categories, and the K+1th category represents the unknown organization category.

[0092] In this embodiment of the application, the training and classification process of the IOMatch model is as follows:

[0093] Training Process: Each IOMatch model is specifically designed for learning from initial service probe data for a particular service. The model is trained based on the features of this data. During training, the model receives labeled feature image samples containing mapping node information for known organizations. Additionally, the model receives samples from unknown categories, originating from undisclosed cyberspace mapping nodes. To enhance the model's generalization ability, all organization samples associated with disclosed mapping node IPs are treated as unknown samples during training and evaluation.

[0094] Classification process: The trained IOMatch model classifies each feature image to determine its organizational category. For mapping nodes with known categories, the model identifies the specific organizational affiliation; for mapping nodes with unknown organizations, the model classifies them as unknown categories.

[0095] Step 105: Aggregate the identification results of multiple service probe packets from the same mapping node, and use a voting mechanism and ensemble learning method to determine the final organizational affiliation of the mapping node.

[0096] In this embodiment of the application, step 105 is achieved through... Figure 2 The results shown are implemented using the aggregation module.

[0097] It should be noted that a mapping node may perform multiple service probes within a certain period of time, and may even initiate multiple service sessions for the same service, thereby sending multiple initial service probe packets. Therefore, in order to obtain accurate mapping node-level identification results, a result aggregation method is needed that can aggregate the probe results of multiple services and multiple data packets initiated from the same mapping node within a certain time period.

[0098] The IOMatch model outputs packet-level identification results, meaning it outputs the organization affiliation for each packet. For a given time period W... t In this embodiment of the application, the identification results of multiple service probe packets from the same mapping node are sorted by the IP address of the mapping node. i Service type S j The data packets are grouped to obtain several sets of data packet-level recognition results. A single mapping node can send multiple probe packets for the same service. In this embodiment, a simple voting mechanism is applied to the identification results of multiple probe packets for the same service sent by each mapping node within a certain period. The organization with the highest voting percentage is selected as the final identification result for the service corresponding to that mapping node. The formula is expressed as:

[0099]

[0100] Then, an ensemble learning method is needed to aggregate the identification results of various service levels for the same mapping node to obtain accurate mapping node-level identification results. Indicates W t The mapping node-level identification results in the aggregation are... We obtain J, where J is the total number of service types.

[0101] This application designs an ensemble learning method based on multiple logistic regression models, which can achieve approximate weighted decision-making for the service level identification results of the same mapping node. Logistic regression is a generalized linear model that estimates the probability P of an event occurring based on a set of given independent variables X, where the value of P is between 0 and 1. The probability calculation is implemented using the logistic function (Sigmoid function). This application extends this method to the multi-classification task by constructing multiple logistic regression models to aggregate the service level identification results. For each known organization category, this application constructs a logistic regression model, resulting in a total of K models. For the k-th model, its output is the probability P of identifying the corresponding organization. k Represented as:

[0102]

[0103] Where σ is the sigmoid function, w k and b k Let X represent the weight vector and bias term of the k-th model, respectively, and let X be the weight vector and bias term of the model in W. t The feature vector of service-level identification results for the same IP address within a given time period. The independent variable X represents a set of features related to W. t Service level identification results for the same IP address within a given time period. Elements x of X. i Defined as Each element Each model uses K+1 binary values ​​(K+1 representing K known categories and 1 unknown category) for one-hot encoding, with only one value set to 1. The position of this bit indicates the sequence number of the identified organization. Therefore, the weight vector of each model has a dimension of J*(K+1), and the weights reflect the confidence level of the model in identifying the organization for each service.

[0104] Since samples of unknown categories lack organizational labels, it is difficult to train an accurate logistic regression model specifically for these categories. Therefore, this application proposes a threshold-based classification rule that classifies samples solely based on logistic regression models of K known categories. Specifically, if the probabilities output by all K models are below a threshold θ, the sample is classified as unknown. Otherwise, the model with the highest probability exceeding θ is selected, and its corresponding organization is used as the identification result. The formalized classification rule is as follows:

[0105]

[0106] The model training and threshold θ selection rules are as follows: The logistic regression model is trained using the "One-Versus-Rest" (OVR) method. For each model, mapping nodes belonging to the organization represented by the current model are considered positive samples, while mapping nodes not belonging to that organization are considered negative samples. The service-level identification results of positive and negative samples are used as independent variables X to input into the model for weight learning. The weight learning process uses cross-entropy as the loss function. The threshold θ is selected by performing an isometric search on the training set, with the search objective being to optimize the best F1 score to balance the recognition performance of known and unknown categories.

[0107] It should be noted that this application also supports periodic incremental updates, a process that is achieved through... Figure 2 The system update module implementation is shown. This application updates on a weekly basis by default. During the initial training phase, the service field selection is initialized using the dataset and labels from the first week to determine the fields to be used as features. Once these fields are selected, they remain unchanged. Subsequent updates will only expand the image encoding based on these fields and update the IOMatch and logistic regression models.

[0108] At the end of each cycle, this embodiment of the application processes the newly collected honeypot data X. t and update dataset X t The tag L of the organization to which the surveying and mapping node belongs t Then, image encoding expansion, IOMatch model update, and logistic regression model update are performed sequentially.

[0109] Specifically, the image encoding extension process is as follows: to account for new options that may appear in the option type field, encoding extensions are performed for HTTP and TLS. Figure 3(a) shows an example of image encoding for an HTTP service probe packet, starting with the first six key fields selected from the first week's dataset, encoding each field and filling it into the specified position. The image format may need to be updated in subsequent weeks. Figure 3(b) provides an illustrative example of an update where, after encoding the first six fields from the first week, any newly observed option values ​​from the second week's data are appended to the end of the image. Similarly, for subsequent datasets, newly observed option values ​​are identified and added to the updated image encoding.

[0110] The IOMatch model update process is as follows: at the end of each period, the model parameters are saved to a checkpoint file, and incremental training is performed using new data in the next period. For example, when entering a new time period t, this embodiment loads the parameters trained in the previous time period from the checkpoint file, and then uses the data X of the current time period. t and label L t Continue training the IOMatch model and update the model parameters.

[0111] The logistic regression model update process is similar to the IOMatch model update method. At the end of each period, this embodiment loads the logistic regression model parameters from the previous period; it combines the service-level identification result set of the current period with the label data of the current period to update the parameters of the logistic regression model.

[0112] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this application can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this application can be achieved, and this is not limited herein.

[0113] The specific embodiments described above do not constitute a limitation on the scope of protection of this application. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A method for determining the affiliation of mapping nodes in a cyberspace mapping organization, characterized in that, include: Payload data from the first service probe packet from the client is collected via a low-interaction honeypot; Based on the payload data of the first service probe packet, a feature selection algorithm is run to select several key payload fields as features for mapping node organization identification. Semantic encoding maps the values ​​of the selected payload fields to pixels in the image, and encodes them according to the field type to generate feature images, including: For the option field, each possible option value is mapped to a pixel in the image, and the brightness of the corresponding pixel is set according to the presence or absence of the option value. If the load field contains a specific option value, the brightness of the corresponding pixel is set to 255; otherwise, it is 0. For the string field, its ASCII value is used for encoding, and each character is mapped to a pixel position in the image. The ASCII value of the character is used as the brightness value of that pixel. If the number of characters exceeds a preset value, only the first character is selected. Each character is encoded; for integer fields, the integer value is converted into a fixed-width binary representation, each binary bit corresponds to a pixel, and the brightness of the corresponding pixel is set according to the binary value, with a brightness of 255 representing 1 and a brightness of 0 representing 0. Define each image as A rectangle of 1 pixel is created, and all encoded field values ​​are filled into the image in a preset order to generate a feature image containing option fields, string fields, and integer fields. If the number of options in the option field exceeds a preset number, options with a frequency less than 1 in the current dataset are deleted. If the number of remaining options plus the pixel usage of string and integer fields exceeds [a certain threshold], then [the following is a separate, unrelated sentence:] the next option [is affected]. Sort all option values ​​by frequency in descending order, and select the top [number of pixels]. Several options are involved in image construction; The feature images are classified using the IOMatch model to identify the organization to which the mapping node belongs; The identification results of multiple service probe packets from the same mapping node are aggregated, and a voting mechanism and ensemble learning method are used to determine the final organizational affiliation of the mapping node.

2. The method according to claim 1, characterized in that, The payload data collected from the first service probe packet from the client via the low-interaction honeypot includes: Configure multiple low-interaction honeypots in a protected network environment. The low-interaction honeypots are deployed on a cloud computing platform or local network and configured with multiple commonly used services, including HTTP, TLS and DNS. The low-interaction honeypot captures the first service probe packet sent by the client when establishing a connection, records and stores its payload data; The payload data of each initial service probe package is labeled, along with the organization to which its mapping node belongs.

3. The method according to claim 2, characterized in that, The annotation of payload data for each initial service probe package, including the organization to which its mapping node belongs, includes: Based on the mapping node data published on the official website of the mapping organization, the mapping nodes were labeled using the IP addresses of the mapping nodes published by the Cyberspace Mapping Organization. Alternatively, use publicly available reverse DNS resolution data from the internet to resolve the domain names associated with each probe source IP address; and by extracting the organization names from the domain names, assign the corresponding organization labels to the mapping nodes; Among them, survey nodes that cannot be labeled using the above two methods are classified as unknown.

4. The method according to claim 3, characterized in that, Based on the payload data from the initial service probe packet, a feature selection algorithm is run to select several key payload fields as features for mapping node organization identification, including: Each field is encoded using label encoding, and the mutual information value between it and the mapping organization labeled by the mapping node is calculated. Sort the fields according to the mutual information values ​​and select the top ones. The most recognizable field is used as a feature for subsequent mapping node organization identification.

5. The method according to claim 1, characterized in that, The training process of the IOMatch model includes: For each service, a dedicated IOMatch model is trained to learn the payload features of the initial service probe and classify a given feature image. The IOMatch model can learn using image samples of known and unknown categories, where the classification result is determined by... It consists of several categories, among which the first The first category corresponds to a known organizational category, the second... Each category represents an unknown organization category; During training, organization samples associated with all disclosed mapping node IPs are treated as unknown samples and used for model training and evaluation.

6. The method according to claim 5, characterized in that, The aggregation of identification results from multiple service probe packets from the same mapping node, and the determination of the final organizational affiliation of the mapping node using a voting mechanism and ensemble learning method, includes: For a certain period of time The identification results within the mapping node are sorted by the IP address of the mapping node from the identification results of multiple service probe packets from the same mapping node. Service type The data packets are grouped to obtain several sets of data packet-level recognition results. ; For multiple probe packets for the same service sent by the same mapping node, a voting mechanism is applied to select the organization with the highest voting percentage as the final identification result for the service corresponding to that mapping node. The formula is expressed as: Based on the identification results of various service levels of the same mapping node, an ensemble learning method is used to aggregate them, resulting in accurate mapping node-level identification results. , By aggregation get, This represents the total number of service types.

7. The method according to claim 6, characterized in that, The process involves aggregating the identification results of various service levels for the same mapping node using an ensemble learning method to obtain accurate mapping node-level identification results. ,include: An ensemble learning approach based on multiple logistic regression models is employed for weighted decision-making of service-level identification results. A logistic regression model is constructed for each known organizational category, resulting in a total of [number missing]. The model; for the model... Each model outputs the probability of identifying the corresponding organization. Represented as: in, It is the sigmoid function. and These represent the weight vector and bias term of the k-th model, respectively. In order to be in Feature vector of service-level identification results for the same IP within a time period; A threshold-based classification rule is used to determine the final organization affiliation. If the probabilities output by all K logistic regression models are lower than a set threshold... If the sample is positive, it is classified as the unknown class; otherwise, the sample with the highest probability and exceeding the specified value is selected. The model determines the organization to which the mapping node belongs, and the formulaic classification rules are as follows: The logistic regression model is trained using the OVR method, and weights are learned through the cross-entropy loss function, with a threshold... The F1 score is optimized by using equidistant search to balance the recognition performance of known and unknown categories.

8. The method according to claim 7, characterized in that, The method supports periodic incremental updates, with weekly updates by default, including: During the initial training phase, the dataset and labels from the first week are used for initialization to determine the fields used for features. Once these fields are selected, they remain unchanged, and subsequent updates will only expand the image encoding based on these fields and update the IOMatch and logistic regression models. At the end of each cycle, process the newly collected honeypot data. and update the dataset. Tags of the organizations to which the China Surveying and Mapping Nodes belong Then, image encoding expansion, IOMatch model update, and logistic regression model update are performed sequentially.

9. The method according to claim 8, characterized in that, The image encoding extension process includes: extending the encoding of HTTP and TLS service types and adding newly observed option values; in the first week's dataset, encoding each field starting with the first six key fields and filling them into designated positions; in subsequent time periods, any newly observed option values ​​are appended to the end of the image, updating the image encoding; The IOMatch model update process includes: at the end of each cycle, saving the currently trained IOMatch model parameters to the checkpoint file, and performing incremental training in the next cycle; The logistic regression model update process includes: at the end of each period, loading the logistic regression model parameters from the previous period; and combining the service-level identification result set of the current period with the label data of the current period to update the parameters of the logistic regression model.

Images