Illegal MAC address clone detection method and system based on behavior fingerprints

Abstract

The invention discloses an illegal MAC address clone detection method and system based on behavior fingerprints. The method comprises the following steps: acquiring various characteristic data of historical data in a set long-term period; generating a clone sample by using a pre-trained auto-encoder, and screening the feature data through the clone sample; establishing a long-term behavior fingerprint according to the feature data screened out in a set long-term period in the historical data; obtaining the feature data screened out in a set short-term period in real time, and establishing a short-term behavior fingerprint; establishing a current behavior fingerprint; the MAC address of the equipment in a set short-term period is obtained in real time, the short-term behavior fingerprint, the long-term behavior fingerprint or the two behavior fingerprints are selected to be compared with the current behavior fingerprint according to the change rate of the MAC address and the entropy value of the MAC address set digit, and if the comparison fails, illegal MAC clone exists. The short-term behavior fingerprints and the long-term behavior fingerprints are used, and sensitivity, accuracy and reliability are balanced.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and more specifically, relates to a method and system for detecting illegal MAC address cloning based on behavioral fingerprints. Background Art

[0002] With the rapid development of information technology, network security has become a global concern. In highly interconnected networks, the increasing number of illegal MAC address cloning poses a serious challenge to network security. As the unique identifier of network devices, MAC addresses play a vital role in network communications. Illegal MAC address cloning can easily disguise a legitimate device, enabling malicious activities such as data theft and network attacks, seriously threatening network security and data confidentiality.

[0003] Traditional network security solutions rely heavily on rule-based detection systems and static security mechanisms. These approaches often struggle to cope with increasingly complex network environments and evolving security threats. Faced with massive amounts of network data, traditional approaches often lack effective data processing and analysis capabilities, making it difficult to accurately extract useful information from complex data. Furthermore, the multi-feature fusion algorithms used in existing technologies require large amounts of labeled data, resulting in high computational and maintenance costs. Summary of the Invention

[0004] In order to solve the deficiencies in the prior art, the present invention provides a method and system for detecting illegal MAC address cloning based on behavioral fingerprints.

[0005] The present invention adopts the following technical solutions.

[0006] A first aspect of the present invention provides a method for detecting illegal MAC address cloning based on behavioral fingerprints, which is characterized by comprising the following contents:

[0007] For each device, various network traffic feature data, MAC layer timing feature data, and interaction behavior feature data are obtained within a set long-term period, and all the obtained feature data are normalized;

[0008] Use the pre-trained autoencoder to generate clone samples, and use the clone samples to filter the above feature data;

[0009] Establish a long-term behavioral fingerprint based on the filtered feature data within a set long-term period in the historical data; when determining whether the long-term behavioral fingerprint has drifted, if so, obtain the filtered feature data within the set long-term period in real time and re-establish the long-term behavioral fingerprint;

[0010] Acquire the filtered feature data within a set short-term period in real time to establish a short-term behavioral fingerprint;

[0011] The filtered feature data obtained at the current moment is spliced ​​into a vector, which is the current behavioral fingerprint; the MAC address of the device within the set short-term period is obtained in real time, and based on the MAC address change rate and the entropy value of the set number of MAC address bits, the short-term behavioral fingerprint, the long-term behavioral fingerprint, or both behavioral fingerprints are selected for comparison with the current behavioral fingerprint. If the comparison fails, it indicates that an illegal MAC clone exists.

[0012] Preferably, various network traffic characteristic data include: traffic variance, packet length, number of ports, TCP, UDP and ICMP proportions, and DNS query interval;

[0013] The MAC layer timing characteristic data is the packet arrival time;

[0014] The interactive behavior characteristic data of various devices include: the number of interactions with other devices and the protocol type;

[0015] Preferably, for each type of feature data, the feature data at each sampling time point within a set long-term period is spliced ​​into a feature sample, and the autoencoder is used to reconstruct the data in the feature sample to generate clone feature data, and the clone feature data are spliced ​​into a clone sample; the objective function of the autoencoder is to minimize the reconstruction error, and the reconstruction error is the sum of the norms of the differences between each data in the feature sample and the clone feature data in the corresponding clone sample divided by the total number of data in the feature sample; the minimized reconstruction error of various feature data is multiplied by the set importance weight, and the various feature data are sorted from large to small according to the multiplication result, and the top M types of feature data are retained, where M is the set number.

[0016] Preferably, a long-term behavioral fingerprint is established based on the feature data screened out within a long-term period set in the historical data, specifically:

[0017] Calculate the average value of the feature samples corresponding to each type of filtered feature data in the long-term period set in the historical data, and multiply it by the corresponding time decay term Where e is the natural logarithm, λ i is the attenuation factor of the i-th type of filtered feature data, t is the time, and all multiplication results are concatenated into a vector, which is the long-term behavior fingerprint.

[0018] Preferably, whether the long-term behavioral fingerprint has drifted is determined by:

[0019] For each device, the current behavioral fingerprint is subtracted from the long-term behavioral fingerprint to obtain the device's current drift vector. This drift vector is then used to calculate the anomaly score. The drift vectors of all devices are used to determine whether global drift has occurred. If global drift has occurred and a device's anomaly score is less than the set anomaly threshold, the device's long-term behavioral fingerprint is considered to have drifted.

[0020] The anomaly score calculation formula is:

[0021]

[0022] Among them, φ j is the abnormal score of the jth device; M is the total number of feature data filtered out; F j (i) is the element corresponding to the drift vector of the jth device of the i-th filtered feature data; ω i is the importance weight of the i-th type of filtered feature data; μ i,j , σ i,j are the mean and standard deviation of the i-th type of feature data selected in the long-term period set in the historical data of the j-th device; p is the set coefficient, which is greater than 1.

[0023] Preferably, the determining whether global drift occurs based on the drift vectors of all devices is specifically as follows:

[0024] If all devices have two or more identical filtered feature data, the elements corresponding to these feature data are extracted from the drift vector of each device to form a drift subvector. The covariance vectors of all devices are concatenated into a set. The covariance matrix and corresponding eigenvalues ​​of this set are calculated. If the largest eigenvalue is greater than or equal to the set drift threshold, global drift is considered to have occurred.

[0025] If no two or more identical filtered feature data exist for all devices, all elements of the drift vector of each device are squared and weightedly summed, with the weight being the corresponding set importance weight. The summed result is divided by the total number of elements in the drift vector to obtain the drift statistic for each device. The drift statistics of all devices are clustered with a cluster number of 2. If the ratio of the number of devices in the category corresponding to the larger of the two cluster centers to the total number of devices is greater than or equal to the set ratio threshold, global drift is considered to have occurred.

[0026] Preferably, the filtered feature data within a set short-term period is acquired in real time to establish a short-term behavioral fingerprint, specifically:

[0027] All the filtered feature data at each sampling time point within the set short-term period are combined into a sampling point vector. The sampling point vectors of all sampling time points are clustered with the number of clusters being 1 to obtain the cluster center. Each element in the cluster center is binarized, and the binarized cluster center is the short-term behavior fingerprint.

[0028] Preferably, based on the change rate of the MAC address and the entropy value of the set number of bits of the MAC address, the short-term behavioral fingerprint, the long-term behavioral fingerprint, or both behavioral fingerprints are selected for comparison with the current behavioral fingerprint, specifically:

[0029] Calculate the entropy value H of the last L bits in the MAC address using the following formula:

[0030]

[0031] Where: L is the number of bits set, and the value of each of the last L bits of the MAC address at each sampling time point within the set short-term period is obtained, p l,b represents the probability that the value of the last lth bit in the MAC address is equal to b, b∈{0,1} means b is 0 or 1;

[0032] Calculate the rate of change of each remaining bit in the MAC address. The rate of change of each remaining bit is equal to the number of changes in the short-term period set by the bit divided by the total number of sampling time points. Obtain the maximum rate of change.

[0033] If the maximum rate of change is greater than or equal to the set rate of change threshold and the entropy value H of the last L bits is greater than or equal to the set entropy value threshold, the short-term behavioral fingerprint is selected for comparison; if the maximum rate of change is less than the set rate of change threshold and the entropy value H of the last L bits is less than the set entropy value threshold, the long-term behavioral fingerprint is selected for comparison; otherwise, both behavioral fingerprints are selected for comparison.

[0034] Preferably, a short-term behavioral fingerprint, a long-term behavioral fingerprint, or both behavioral fingerprints are used to compare with the current behavioral fingerprint, specifically:

[0035] When using short-term behavioral fingerprints for comparison: Each element in the current behavioral fingerprint is binarized and then compared one by one with each element in the short-term behavioral fingerprint. If there are elements that are different by a number greater than or equal to the set threshold, it indicates that an illegal MAC clone exists.

[0036] When using long-term behavioral fingerprints for comparison: Calculate the cosine similarity between the current behavioral fingerprint and the long-term behavioral fingerprint. If it is lower than the set clone threshold, it indicates that an illegal MAC clone exists.

[0037] When two behavioral fingerprints are used together for comparison, if any of the above conditions is met, it indicates that illegal MAC cloning exists.

[0038] A second aspect of the present invention provides an illegal MAC address clone detection system based on behavioral fingerprints using the method described in any one of claims 1 to 9 of the present invention, comprising a data collection module, a screening module, a behavioral fingerprint establishment module, and a clone detection module, characterized in that:

[0039] Data collection module: For each device, various network traffic feature data, MAC layer timing feature data, and interaction behavior feature data are obtained within a set long-term period, and all the acquired feature data are normalized;

[0040] Screening module: Use the pre-trained autoencoder to generate clone samples, and use the clone samples to screen the above feature data;

[0041] Behavioral fingerprint establishment module: establishes a long-term behavioral fingerprint based on the filtered feature data within the long-term period set in the historical data; determines whether the long-term behavioral fingerprint has drifted, and if so, obtains the filtered feature data within the set long-term period in real time to re-establish the long-term behavioral fingerprint; obtains the filtered feature data within the set short-term period in real time to establish the short-term behavioral fingerprint;

[0042] Clone detection module: The filtered feature data obtained at the current moment is spliced ​​into a vector, which is the current behavioral fingerprint; the MAC address of the device within a set short-term period is obtained in real time, and based on the MAC address change rate and the entropy value of the set number of MAC address bits, the module chooses to use short-term behavioral fingerprints, long-term behavioral fingerprints, or both behavioral fingerprints and the current behavioral fingerprint for comparison. If the comparison fails, it indicates that an illegal MAC clone exists.

[0043] The beneficial effect of the present invention is that, compared with the prior art,

[0044] The present invention uses a pre-trained autoencoder to generate clone samples, and uses the clone samples to screen the above-mentioned feature data, screening out features that are difficult to imitate by clone attacks, thereby improving detection accuracy and reducing the amount of calculation; the long-term behavioral fingerprint adopted can prevent attackers from gradually adjusting their behavior to evade short-term detection; when the present invention determines whether there is drift in the long-term behavioral fingerprint, the long-term behavioral fingerprint is re-established to eliminate error accumulation and reduce the false alarm rate; the short-term behavioral fingerprint adopted by the present invention can quickly identify sudden abnormal behaviors, and the short-term behavioral fingerprint calculated in real time is binarized and compared, which is simple and reduces the amount of calculation; the algorithms used in the present invention include autoencoders and clustering algorithms, both of which are simple algorithms and can be applied in real time on edge devices. The present invention selects to use short-term behavioral fingerprints, long-term behavioral fingerprints, or both behavioral fingerprints and current behavioral fingerprints for comparison based on the change rate of the MAC address and the entropy value of the set number of bits of the MAC address, thereby balancing sensitivity, accuracy and reliability. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 Flowchart of the present invention. DETAILED DESCRIPTION

[0046] To make the objectives, technical solutions, and advantages of the present invention more clear, the technical solutions of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. The embodiments described in this application are only part of the embodiments of the present invention, not all of them. Based on the spirit of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0047] like Figure 1 As shown, embodiment 1 of the present invention provides a method for detecting illegal MAC address cloning based on behavioral fingerprints, which is characterized by including the following contents:

[0048] For each device, various network traffic feature data, MAC layer timing feature data, and interaction behavior feature data are obtained within a set long-term period, and all the obtained feature data are normalized;

[0049] Use the pre-trained autoencoder to generate clone samples, and use the clone samples to filter the above feature data;

[0050] Establish a long-term behavioral fingerprint based on the filtered feature data within a set long-term period in the historical data; when determining whether the long-term behavioral fingerprint has drifted, if so, obtain the filtered feature data within the set long-term period in real time and re-establish the long-term behavioral fingerprint;

[0051] Acquire the filtered feature data within a set short-term period in real time to establish a short-term behavioral fingerprint;

[0052] The filtered feature data obtained at the current moment is spliced ​​into a vector, which is the current behavioral fingerprint; the MAC address of the device within the set short-term period is obtained in real time, and based on the MAC address change rate and the entropy value of the set number of MAC address bits, the short-term behavioral fingerprint, the long-term behavioral fingerprint, or both behavioral fingerprints are selected for comparison with the current behavioral fingerprint. If the comparison fails, it indicates that an illegal MAC clone exists.

[0053] Various network traffic characteristic data include: traffic variance, packet length, number of ports, TCP, UDP and ICMP ratios, and DNS query interval;

[0054] The MAC layer timing characteristic data is the packet arrival time;

[0055] The interactive behavior characteristic data of various devices include: the number of interactions with other devices and the protocol type;

[0056] For each type of feature data, the feature data of each sampling time point within a set long-term period is spliced ​​into a feature sample, and the data in the feature sample is reconstructed using an autoencoder to generate clone feature data, and the clone feature data is spliced ​​into a clone sample; the objective function of the autoencoder is to minimize the reconstruction error, and the reconstruction error is the sum of the norms of the differences between each data in the feature sample and the clone feature data in the corresponding clone sample divided by the total number of data in the feature sample; the minimized reconstruction error of various feature data is multiplied by the set importance weight, and the various feature data are sorted from large to small according to the multiplication results, and the top M types of feature data are retained, where M is the set number.

[0057] It should be noted that the importance weight is set based on feature independence, cloning behavior sensitivity, and actual attack and defense experience. Higher importance weights are set for features that are sudden or periodic, or that are easily overlooked during cloning. In this embodiment, the importance weights of traffic variance, packet length, number of ports, and DNS query interval are 0.7, 0.3, 0.5, and 0.9, respectively; the importance weights of TCP, UDP, and ICMP proportions are all 0.6.

[0058] The importance weight of packet arrival time is 0.85; the importance weights of the number of interactions with other devices and protocol type are 0.75 and 0.65, respectively.

[0059] Based on the characteristic data filtered out within the long-term period set in the historical data, a long-term behavioral fingerprint is established, specifically:

[0060] Calculate the average value of the feature samples corresponding to each type of filtered feature data in the long-term period set in the historical data, and multiply it by the corresponding time decay term Where e is the natural logarithm, λ i is the attenuation factor of the i-th type of filtered feature data, t is the time, and all multiplication results are concatenated into a vector, which is the long-term behavior fingerprint.

[0061] Determine whether long-term behavioral fingerprints have drifted, specifically:

[0062] For each device, the current behavioral fingerprint is subtracted from the long-term behavioral fingerprint to obtain the device's current drift vector. This drift vector is then used to calculate the anomaly score. The drift vectors of all devices are used to determine whether global drift has occurred. If global drift has occurred and a device's anomaly score is less than the set anomaly threshold, the device's long-term behavioral fingerprint is considered to have drifted.

[0063] It should be noted that when the anomaly score is greater than or equal to the set anomaly threshold, it may be due to a cloned MAC address, but it is still possible that the cloned MAC address is missed or the fluctuation of a single device is large at this time. This is not due to the inaccurate long-term behavioral fingerprint caused by long-term drift. Therefore, global drift verification was further performed.

[0064] The anomaly score calculation formula is:

[0065]

[0066] Among them, φ j is the abnormal score of the jth device; M is the total number of feature data filtered out; F j (i) is the element corresponding to the i-th type of filtered feature data in the drift vector of the j-th device, that is, the i-th element of the drift vector of the j-th device; ω i is the importance weight of the i-th type of filtered feature data; μ i,j , σ i,j are the mean and standard deviation of the i-th type of feature data selected in the long-term period set in the historical data of the j-th device; p is the set coefficient, which is greater than 1.

[0067] The determination of whether global drift has occurred based on the drift vectors of all devices is specifically as follows:

[0068] If all devices have two or more identical filtered feature data, the elements corresponding to these feature data are extracted from the drift vector of each device to form a drift subvector. The covariance vectors of all devices are concatenated into a set. The covariance matrix and corresponding eigenvalues ​​of this set are calculated. If the largest eigenvalue is greater than or equal to the set drift threshold, global drift is considered to have occurred.

[0069] If no two or more identical filtered feature data exist for all devices, all elements of the drift vector of each device are squared and weightedly summed, with the weight being the corresponding set importance weight. The summed result is divided by the total number of elements in the drift vector to obtain the drift statistic for each device. The drift statistics of all devices are clustered with a cluster number of 2. If the ratio of the number of devices in the category corresponding to the larger of the two cluster centers to the total number of devices is greater than or equal to the set ratio threshold, global drift is considered to have occurred.

[0070] It should be noted that since all acquired feature data are normalized, the influence of dimension is eliminated and they can be summed.

[0071] Acquire the filtered feature data within a set short-term period in real time and establish a short-term behavioral fingerprint, specifically:

[0072] All the filtered feature data at each sampling time point within the set short-term period are combined into a sampling point vector. The sampling point vectors of all sampling time points are clustered with the number of clusters being 1 to obtain the cluster center. Each element in the cluster center is binarized, and the binarized cluster center is the short-term behavior fingerprint.

[0073] The binarization is that when the element is greater than the set binarization threshold of the element, it becomes 1, otherwise it becomes 0.

[0074] Preferably, based on the change rate of the MAC address and the entropy value of the set number of bits of the MAC address, the short-term behavioral fingerprint, the long-term behavioral fingerprint, or both behavioral fingerprints are selected for comparison with the current behavioral fingerprint, specifically:

[0075] Calculate the entropy value H of the last L bits in the MAC address using the following formula:

[0076]

[0077] Where: L is the number of bits set, and the value of each of the last L bits of the MAC address at each sampling time point within the set short-term period is obtained, p l,b represents the probability that the value of the last lth bit in the MAC address is equal to b, b∈{0,1} means b is 0 or 1;

[0078] Calculate the rate of change of each remaining bit in the MAC address. The rate of change of each remaining bit is equal to the number of changes in the short-term period set by the bit divided by the total number of sampling time points. Obtain the maximum rate of change.

[0079] If the maximum rate of change is greater than or equal to the set rate of change threshold and the entropy value H of the last L bits is greater than or equal to the set entropy value threshold, the short-term behavioral fingerprint is selected for comparison; if the maximum rate of change is less than the set rate of change threshold and the entropy value H of the last L bits is less than the set entropy value threshold, the long-term behavioral fingerprint is selected for comparison; otherwise, both behavioral fingerprints are selected for comparison.

[0080] Use short-term behavioral fingerprints, long-term behavioral fingerprints, or both behavioral fingerprints and the current behavioral fingerprint for comparison, specifically:

[0081] When using short-term behavioral fingerprints for comparison: Each element in the current behavioral fingerprint is binarized and then compared one by one with each element in the short-term behavioral fingerprint. If there are elements that are different by a number greater than or equal to the set threshold, it indicates that an illegal MAC clone exists.

[0082] When using long-term behavioral fingerprints for comparison: Calculate the cosine similarity between the current behavioral fingerprint and the long-term behavioral fingerprint. If it is lower than the set clone threshold, it indicates that an illegal MAC clone exists.

[0083] When two behavioral fingerprints are used together for comparison, if any of the above conditions is met, it indicates that illegal MAC cloning exists.

[0084] It should be noted that the set quantity threshold is max indicates the maximum value, and M is the total number of feature data filtered out;

[0085] Embodiment 2 of the present invention provides a behavioral fingerprint-based illegal MAC address clone detection system using the method described in Embodiment 1 of the present invention, comprising a data collection module, a screening module, a behavioral fingerprint establishment module, and a clone detection module, and is characterized by:

[0086] Data collection module: For each device, various network traffic feature data, MAC layer timing feature data, and interaction behavior feature data are obtained within a set long-term period, and all the acquired feature data are normalized;

[0087] Screening module: Use the pre-trained autoencoder to generate clone samples, and use the clone samples to screen the above feature data;

[0088] Behavioral fingerprint establishment module: establishes a long-term behavioral fingerprint based on the filtered feature data within the long-term period set in the historical data; determines whether the long-term behavioral fingerprint has drifted, and if so, obtains the filtered feature data within the set long-term period in real time to re-establish the long-term behavioral fingerprint; obtains the filtered feature data within the set short-term period in real time to establish the short-term behavioral fingerprint;

[0089] Clone detection module: The filtered feature data obtained at the current moment is spliced ​​into a vector, which is the current behavioral fingerprint; the MAC address of the device within a set short-term period is obtained in real time, and based on the MAC address change rate and the entropy value of the set number of MAC address bits, the module chooses to use short-term behavioral fingerprints, long-term behavioral fingerprints, or both behavioral fingerprints and the current behavioral fingerprint for comparison. If the comparison fails, it indicates that an illegal MAC clone exists.

[0090] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents. Any modification or equivalent replacement that does not depart from the spirit and scope of the present invention should be covered by the scope of protection of the claims of the present invention.

Claims

1. A method for detecting illegal MAC address cloning based on behavioral fingerprint, characterized in that: Includes the following: For each device, various network traffic feature data, MAC layer timing feature data, and interaction behavior feature data are obtained within a set long-term period, and all the obtained feature data are normalized; Use the pre-trained autoencoder to generate clone samples, and use the clone samples to filter the above feature data; Establish a long-term behavioral fingerprint based on the filtered feature data within a set long-term period in the historical data; when determining whether the long-term behavioral fingerprint has drifted, if so, obtain the filtered feature data within the set long-term period in real time and re-establish the long-term behavioral fingerprint; Acquire the filtered feature data within a set short-term period in real time to establish a short-term behavioral fingerprint; The filtered feature data obtained at the current moment is spliced ​​into a vector, which is the current behavior fingerprint; The MAC address of the device within a set short-term period is obtained in real time. Based on the MAC address change rate and the entropy value of the set number of MAC address bits, the short-term behavioral fingerprint, the long-term behavioral fingerprint, or both behavioral fingerprints are selected for comparison with the current behavioral fingerprint. If the comparison fails, it indicates that an illegal MAC clone has occurred.

2. The method for detecting illegal MAC address cloning based on behavioral fingerprint according to claim 1, characterized in that: Various network traffic characteristic data include: traffic variance, packet length, number of ports, TCP, UDP and ICMP ratios, and DNS query interval; The MAC layer timing characteristic data is the packet arrival time; The interactive behavior characteristic data of various devices include: the number of interactions with other devices and the protocol type.

3. The method for detecting illegal MAC address cloning based on behavioral fingerprint according to claim 1, characterized in that: For each type of feature data, the feature data of each sampling time point within a set long-term period is spliced ​​into a feature sample, and the data in the feature sample is reconstructed using an autoencoder to generate clone feature data, and the clone feature data is spliced ​​into a clone sample; the objective function of the autoencoder is to minimize the reconstruction error, and the reconstruction error is the sum of the norms of the differences between each data in the feature sample and the clone feature data in the corresponding clone sample divided by the total number of data in the feature sample; the minimized reconstruction error of various feature data is multiplied by the set importance weight, and the various feature data are sorted from large to small according to the multiplication results, and the top M types of feature data are retained, where M is the set number.

4. The method for detecting illegal MAC address cloning based on behavioral fingerprint according to claim 3, characterized in that: Based on the characteristic data filtered out within the long-term period set in the historical data, a long-term behavioral fingerprint is established, specifically: Calculate the average value of the feature samples corresponding to each type of filtered feature data in the long-term period set in the historical data, and multiply it by the corresponding time decay term Where e is the natural logarithm, λ i is the attenuation factor of the i-th type of filtered feature data, t is the time, and all multiplication results are concatenated into a vector, which is the long-term behavior fingerprint.

5. The method for detecting illegal MAC address cloning based on behavioral fingerprint according to claim 4, characterized in that: Determine whether long-term behavioral fingerprints have drifted, specifically: For each device, the current behavioral fingerprint is subtracted from the long-term behavioral fingerprint to obtain the device's current drift vector. This drift vector is then used to calculate the anomaly score. The drift vectors of all devices are used to determine whether global drift has occurred. If global drift has occurred and a device's anomaly score is less than the set anomaly threshold, the device's long-term behavioral fingerprint is considered to have drifted. The anomaly score calculation formula is: Among them, φ j is the abnormal score of the jth device; M is the total number of feature data filtered out; F j (i) is the element corresponding to the drift vector of the jth device of the i-th filtered feature data; ω i is the importance weight of the i-th type of filtered feature data; μ i,j , σ i,j are the mean and standard deviation of the i-th type of feature data selected in the long-term period set in the historical data of the j-th device; p is the set coefficient, which is greater than 1.

6. The method for detecting illegal MAC address cloning based on behavioral fingerprint according to claim 5, characterized in that: The determination of whether global drift has occurred based on the drift vectors of all devices is specifically as follows: If all devices have two or more identical filtered feature data, the elements corresponding to these feature data are extracted from the drift vector of each device to form a drift subvector. The covariance vectors of all devices are concatenated into a set. The covariance matrix and corresponding eigenvalues ​​of this set are calculated. If the largest eigenvalue is greater than or equal to the set drift threshold, global drift is considered to have occurred. If no two or more identical filtered feature data exist for all devices, all elements of the drift vector of each device are squared and weightedly summed, with the weight being the corresponding set importance weight. The summed result is divided by the total number of elements in the drift vector to obtain the drift statistic for each device. The drift statistics of all devices are clustered with a cluster number of 2. If the ratio of the number of devices in the category corresponding to the larger of the two cluster centers to the total number of devices is greater than or equal to the set ratio threshold, global drift is considered to have occurred.

7. The method for detecting illegal MAC address cloning based on behavioral fingerprint according to claim 1, characterized in that: Acquire the filtered feature data within a set short-term period in real time and establish a short-term behavioral fingerprint, specifically: All the filtered feature data at each sampling time point within the set short-term period are combined into a sampling point vector. The sampling point vectors of all sampling time points are clustered with the number of clusters being 1 to obtain the cluster center. Each element in the cluster center is binarized, and the binarized cluster center is the short-term behavior fingerprint.

8. The method for detecting illegal MAC address cloning based on behavioral fingerprint according to claim 1, characterized in that: Based on the MAC address change rate and the entropy value of the MAC address setting bits, choose to use short-term behavioral fingerprints, long-term behavioral fingerprints, or both behavioral fingerprints and the current behavioral fingerprint for comparison. Specifically: Calculate the entropy value H of the last L bits in the MAC address using the following formula: Where: L is the number of bits set, and the value of each of the last L bits of the MAC address at each sampling time point within the set short-term period is obtained, p l,b represents the probability that the value of the last lth bit in the MAC address is equal to b, b∈{0,1} means b is 0 or 1; Calculate the rate of change of each remaining bit in the MAC address. The rate of change of each remaining bit is equal to the number of changes in the short-term period set by the bit divided by the total number of sampling time points. Obtain the maximum rate of change. If the maximum rate of change is greater than or equal to the set rate of change threshold and the entropy value H of the last L bits is greater than or equal to the set entropy value threshold, the short-term behavioral fingerprint is selected for comparison; if the maximum rate of change is less than the set rate of change threshold and the entropy value H of the last L bits is less than the set entropy value threshold, the long-term behavioral fingerprint is selected for comparison; otherwise, both behavioral fingerprints are selected for comparison.

9. The method for detecting illegal MAC address cloning based on behavioral fingerprint according to claim 1, characterized in that: Use short-term behavioral fingerprints, long-term behavioral fingerprints, or both behavioral fingerprints and the current behavioral fingerprint for comparison, specifically: When using short-term behavioral fingerprints for comparison: Each element in the current behavioral fingerprint is binarized and then compared one by one with each element in the short-term behavioral fingerprint. If there are elements that are different by a number greater than or equal to the set threshold, it indicates that an illegal MAC clone exists. When using long-term behavioral fingerprints for comparison: Calculate the cosine similarity between the current behavioral fingerprint and the long-term behavioral fingerprint. If it is lower than the set clone threshold, it indicates that an illegal MAC clone exists. When two behavioral fingerprints are used together for comparison, if any of the above conditions is met, it indicates that illegal MAC cloning exists.

10. A behavioral fingerprint-based illegal MAC address clone detection system using the method according to any one of claims 1 to 9, comprising a data collection module, a screening module, a behavioral fingerprint establishment module, and a clone detection module, characterized in that: Data collection module: For each device, various network traffic feature data, MAC layer timing feature data, and interaction behavior feature data are obtained within a set long-term period, and all the acquired feature data are normalized; Screening module: Use the pre-trained autoencoder to generate clone samples, and use the clone samples to screen the above feature data; Behavioral fingerprint establishment module: establishes a long-term behavioral fingerprint based on the filtered feature data within the long-term period set in the historical data; determines whether the long-term behavioral fingerprint has drifted, and if so, obtains the filtered feature data within the set long-term period in real time to re-establish the long-term behavioral fingerprint; obtains the filtered feature data within the set short-term period in real time to establish the short-term behavioral fingerprint; Clone detection module: This module combines the filtered feature data obtained at the current moment into a vector, which is the current behavior fingerprint. The MAC address of the device within a set short-term period is obtained in real time. Based on the MAC address change rate and the entropy value of the set number of MAC address bits, the short-term behavioral fingerprint, the long-term behavioral fingerprint, or both behavioral fingerprints are selected for comparison with the current behavioral fingerprint. If the comparison fails, it indicates that an illegal MAC clone has occurred.

Images