A method and system for detecting illicit MAC address cloning based on behavioral fingerprinting

Abstract

A method and system for detecting illegitimate MAC address cloning based on behavioral fingerprints includes: acquiring various feature data within a set long-term period of historical data; generating clone samples using a pre-trained autoencoder, and filtering the aforementioned feature data using the clone samples; establishing a long-term behavioral fingerprint based on the filtered feature data within the set long-term period of historical data; acquiring filtered feature data within a set short-term period in real time, and establishing a short-term behavioral fingerprint; and establishing a current behavioral fingerprint; acquiring the MAC address of the device within the set short-term period in real time, and comparing it with the current behavioral fingerprint using the short-term behavioral fingerprint, long-term behavioral fingerprint, or a combination of both behavioral fingerprints, based on the MAC address change rate and the entropy value of a set number of bits in the MAC address; if the comparison fails, it indicates the existence of an illegitimate MAC address cloning. This invention uses both short-term and long-term behavioral fingerprints, balancing sensitivity, accuracy, and reliability.

Description

Technical Field

[0001] This invention belongs to the field of network security technology, and more specifically, relates to a method and system for detecting illegal MAC address cloning based on behavioral fingerprints. Background Technology

[0002] With the rapid development of information technology, cybersecurity has become a global focus. Especially in highly interconnected network environments, the increasing prevalence of illegal MAC address cloning poses a serious challenge to network security. As a unique identifier for network devices, the MAC address plays a crucial role in network communication. Illegal MAC address cloning can easily impersonate legitimate devices, enabling malicious activities such as data theft and cyberattacks, severely threatening network security and data confidentiality.

[0003] In existing technologies, traditional network security solutions mostly rely on rule-based detection systems and static security mechanisms. These methods often prove inadequate when facing increasingly complex network environments and constantly evolving security threats. Faced with massive amounts of network data, traditional methods often lack effective data processing and analysis capabilities, failing to accurately extract useful information from complex data. Furthermore, the multi-feature fusion algorithms used in existing technologies require large amounts of labeled data, resulting in high computational and maintenance costs. Summary of the Invention

[0004] To address the shortcomings of existing technologies, this invention provides a method and system for detecting illegal MAC address cloning based on behavioral fingerprints.

[0005] The present invention adopts the following technical solution.

[0006] The first aspect of the present invention provides a method for detecting illegitimate MAC address cloning based on behavioral fingerprints, characterized in that it includes the following:

[0007] For each device, various network traffic characteristic data, MAC layer time sequence characteristic data and interaction behavior characteristic data are acquired within a set long-term period, and all acquired characteristic data are normalized.

[0008] The pre-trained autoencoder is used to generate clone samples, and the above feature data is then filtered using the clone samples.

[0009] Based on the feature data selected within a set long-term period in historical data, a long-term behavioral fingerprint is established; when it is determined whether the long-term behavioral fingerprint has drifted, if so, the feature data selected within the set long-term period is obtained in real time, and the long-term behavioral fingerprint is re-established.

[0010] Real-time acquisition of selected feature data within a set short-term period to establish short-term behavioral fingerprints;

[0011] The selected feature data at the current moment are concatenated into a vector, which is the current behavior fingerprint. The MAC address of the device within the set short period is obtained in real time. Based on the change rate of the MAC address and the entropy value of the set number of bits of the MAC address, the short-term behavior fingerprint, long-term behavior fingerprint, or a combination of both behavior fingerprints are selected for comparison with the current behavior fingerprint. If the comparison fails, it indicates that there is an illegal MAC clone.

[0012] Preferably, the various network traffic characteristic data include: traffic variance, packet length, number of ports, TCP, UDP and ICMP ratios, and DNS query interval;

[0013] The MAC layer timing feature data is the packet arrival time;

[0014] Various device interaction behavior characteristic data include: the number of interactions with other devices and the protocol type;

[0015] Preferably, for each type of feature data, the feature data at each sampling time point within a set long-term period is spliced ​​into a feature sample. An autoencoder is used to reconstruct each data in the feature sample to generate clone feature data, and the clone feature data is spliced ​​into a clone sample. The objective function of the autoencoder is to minimize the reconstruction error, which is the sum of the norms of the differences between each data in the feature sample and the corresponding clone feature data in the clone sample, divided by the total number of data in the feature sample. The reconstruction error minimized for each type of feature data is multiplied by a set importance weight, and the feature data are sorted from largest to smallest according to the result of the multiplication. The top M types of feature data are retained, where M is a set number.

[0016] Preferably, a long-term behavioral fingerprint is established based on feature data selected from a set long-term period in historical data, specifically as follows:

[0017] Calculate the average value of the feature samples corresponding to each selected feature data within the set long-term period in the historical data, and multiply it by the corresponding time decay term. Where e is the natural logarithm, λ i Let t be the decay factor of the i-th selected feature data, and t be the time. Then, concatenate all the multiplication results into a vector, which is the long-term behavioral fingerprint.

[0018] Preferably, determining whether long-term behavioral fingerprints exhibit drift specifically involves:

[0019] For each device, the current behavior fingerprint is subtracted from the long-term behavior fingerprint to obtain the device's current drift vector. The anomaly score is calculated using this drift vector. Based on the drift vectors of all devices, it is determined whether a global drift has occurred. If a global drift has occurred and the anomaly score of a certain device is less than the set anomaly threshold, then the long-term behavior fingerprint of that device is considered to have drifted.

[0020] The formula for calculating abnormal scores is:

[0021]

[0022] Where, φ j Let F be the anomaly score of the j-th device; M be the total number of selected feature data; F j (i) represents the element corresponding to the drift vector of the j-th device in the feature data selected by the i-th method; ω i μ represents the importance weight of the i-th selected feature data. i,j σ i,j , respectively, are the average value and standard deviation of the i-th selected feature data within a long-term period set in the historical data of the j-th device; p is a set coefficient, which is greater than 1.

[0023] Preferably, the step of determining whether a global drift has occurred based on the drift vectors of all devices specifically involves:

[0024] If all devices have two or more identical selected feature data, then extract the elements corresponding to these feature data from the drift vector of each device to form a drift sub-vector. Concatenate the covariance vectors of all devices into a set, calculate the covariance matrix and corresponding eigenvalues ​​of the set, and if the largest eigenvalue is greater than or equal to the set drift threshold, then global drift is considered to have occurred.

[0025] If no two or more of the same filtered feature data exist for any of the devices, the squares of all elements of the drift vector for each device are squared and then summed with weights equal to the corresponding importance weights. The sum is then divided by the total number of elements in the drift vector to obtain the drift statistics for each device. The drift statistics for all devices are then clustered with a cluster size of 2. If the ratio of the number of devices in the category corresponding to the larger cluster center to the total number of devices is greater than or equal to a set threshold, then a global drift is considered to have occurred.

[0026] Preferably, the selected feature data within a set short-term period is acquired in real time to establish a short-term behavioral fingerprint, specifically as follows:

[0027] All selected feature data at each sampling time point within the set short-term period are combined into a sampling point vector. The sampling point vectors at all sampling time points are clustered with a cluster number of 1 to obtain the cluster center. Each element in the cluster center is binarized, and the binarized cluster center is the short-term behavioral fingerprint.

[0028] Preferably, based on the MAC address change rate and the entropy value of the MAC address bit set, a comparison is made between a short-term behavioral fingerprint, a long-term behavioral fingerprint, or a combination of both behavioral fingerprints and the current behavioral fingerprint. Specifically:

[0029] The formula for calculating the entropy value H of the last L bits of a MAC address is:

[0030]

[0031] Where: L is the set number of bits, and the value of each of the last L bits of the MAC address at each sampling time point is obtained within the set short period, p l,b This represents the probability that the value of the l-th bit from the end of the MAC address is equal to b, where b∈{0,1} means b is 0 or 1;

[0032] Calculate the rate of change of each remaining bit in the MAC address. The rate of change of each remaining bit is equal to the number of changes in that bit within a set short period divided by the total number of sampling time points, and obtain the largest rate of change.

[0033] If the maximum rate of change is greater than or equal to the set rate of change threshold and the entropy value H of the following L bits is greater than or equal to the set entropy value threshold, then the short-term behavioral fingerprint is selected for comparison; if the maximum rate of change is less than the set rate of change threshold and the entropy value H of the following L bits is less than the set entropy value threshold, then the long-term behavioral fingerprint is selected for comparison; otherwise, both behavioral fingerprints are used for comparison.

[0034] Preferably, a comparison is made using short-term behavioral fingerprints, long-term behavioral fingerprints, or a combination of both behavioral fingerprints, and the current behavioral fingerprint. Specifically:

[0035] When using short-term behavioral fingerprints for comparison: after binarizing each element in the current behavioral fingerprint, compare each element in the short-term behavioral fingerprint one by one. If there are elements that are different with a number greater than or equal to the set threshold, it indicates that there is an illegal MAC clone.

[0036] When using long-term behavioral fingerprints for comparison: calculate the cosine similarity between the current behavioral fingerprint and the long-term behavioral fingerprint. If it is lower than the set cloning threshold, it indicates that there is an illegal MAC clone.

[0037] When comparing two behavioral fingerprints, if any of the above conditions are met, it indicates the existence of an illegal MAC clone.

[0038] A second aspect of the present invention provides an illegal MAC address cloning detection system based on behavioral fingerprints using the method described in any one of claims 1-9, comprising a data acquisition module, a filtering module, a behavioral fingerprint establishment module, and a cloning detection module, characterized in that:

[0039] Data acquisition module: For each device, it acquires various network traffic characteristic data, MAC layer time sequence characteristic data and interaction behavior characteristic data within a set long period. All acquired characteristic data are normalized.

[0040] Filtering module: Generates cloned samples using a pre-trained autoencoder, and filters the above feature data using the cloned samples;

[0041] Behavioral fingerprinting module: Based on the feature data selected within a set long-term period in historical data, establish a long-term behavioral fingerprint; if it is determined whether there is drift in the long-term behavioral fingerprint, if so, obtain the feature data selected within the set long-term period in real time and re-establish the long-term behavioral fingerprint; obtain the feature data selected within the set short-term period in real time and establish a short-term behavioral fingerprint.

[0042] Cloning detection module: It concatenates the selected feature data at the current moment into a vector, which is the current behavior fingerprint; it acquires the MAC address of the device within a set short period in real time, and selects to compare the current behavior fingerprint with the short-term behavior fingerprint, long-term behavior fingerprint, or a combination of both behavior fingerprints based on the MAC address change rate and the entropy value of the set number of bits in the MAC address. If the comparison fails, it indicates that there is an illegal MAC clone.

[0043] The beneficial effects of this invention are that, compared with the prior art,

[0044] This invention employs a pre-trained autoencoder to generate cloned samples. These cloned samples are used to filter the aforementioned feature data, identifying features difficult for cloning attacks to imitate, thus improving detection accuracy while reducing computational load. The long-term behavioral fingerprint used prevents attackers from gradually adjusting their behavior to evade short-term detection. When determining if long-term behavioral fingerprints are drifting, this invention re-establishes them to eliminate error accumulation and reduce false alarm rates. The short-term behavioral fingerprint used in this invention can quickly identify sudden abnormal behaviors, and the real-time calculated short-term behavioral fingerprints undergo simple binarization and comparison, reducing computational load. The algorithms used in this invention include autoencoders and clustering algorithms, both computationally simple and applicable in real-time on edge devices. Based on the MAC address change rate and the entropy value of the MAC address's set bits, this invention selects to compare short-term, long-term, or both behavioral fingerprints with the current behavioral fingerprint, balancing sensitivity, accuracy, and reliability. Attached Figure Description

[0045] Figure 1 This is a flowchart of the present invention. Detailed Implementation

[0046] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of this invention. The embodiments described in this application are merely some embodiments of this invention, and not all embodiments. Based on the spirit of this invention, all other embodiments obtained by those skilled in the art without creative effort are within the protection scope of this invention.

[0047] like Figure 1 As shown, Embodiment 1 of the present invention provides a method for detecting illegal MAC address cloning based on behavioral fingerprints, characterized by including the following:

[0048] For each device, various network traffic characteristic data, MAC layer time sequence characteristic data and interaction behavior characteristic data are acquired within a set long-term period, and all acquired characteristic data are normalized.

[0049] The pre-trained autoencoder is used to generate clone samples, and the above feature data is then filtered using the clone samples.

[0050] Based on the feature data selected within a set long-term period in historical data, a long-term behavioral fingerprint is established; when it is determined whether the long-term behavioral fingerprint has drifted, if so, the feature data selected within the set long-term period is obtained in real time, and the long-term behavioral fingerprint is re-established.

[0051] Real-time acquisition of selected feature data within a set short-term period to establish short-term behavioral fingerprints;

[0052] The selected feature data at the current moment are concatenated into a vector, which is the current behavior fingerprint. The MAC address of the device within the set short period is obtained in real time. Based on the change rate of the MAC address and the entropy value of the set number of bits of the MAC address, the short-term behavior fingerprint, long-term behavior fingerprint, or a combination of both behavior fingerprints are selected for comparison with the current behavior fingerprint. If the comparison fails, it indicates that there is an illegal MAC clone.

[0053] Various network traffic characteristic data include: traffic variance, packet length, number of ports, TCP, UDP and ICMP ratios, and DNS query intervals;

[0054] The MAC layer's timing feature data is the packet arrival time;

[0055] Various device interaction behavior characteristic data include: the number of interactions with other devices and the protocol type;

[0056] For each type of feature data, the feature data at each sampling time point within a set long-term period is concatenated into a feature sample. An autoencoder is used to reconstruct each data in the feature sample to generate clone feature data, and the clone feature data is concatenated into a clone sample. The objective function of the autoencoder is to minimize the reconstruction error, which is the sum of the norms of the differences between each data in the feature sample and the corresponding clone feature data in the clone sample, divided by the total number of data in the feature sample. The reconstruction error minimized for each type of feature data is multiplied by a set importance weight, and the feature data are sorted from largest to smallest according to the result of the multiplication. The top M types of feature data are retained, where M is the set number.

[0057] It should be noted that the importance weights are set by combining feature independence, sensitivity to cloning behavior, and actual attack and defense experience. Higher importance weights are assigned to features that are sudden or periodic, or that are easily overlooked during cloning. In this embodiment, the importance weights for traffic variance, packet length, number of ports, and DNS query interval are 0.7, 0.3, 0.5, and 0.9, respectively; the importance weights for TCP, UDP, and ICMP percentages are all 0.6.

[0058] The importance weight of packet arrival time is 0.85; the importance weights of the number of interactions with other devices and the protocol type are 0.75 and 0.65, respectively.

[0059] Based on the feature data selected from the long-term period of historical data, a long-term behavioral fingerprint is established, specifically as follows:

[0060] Calculate the average value of the feature samples corresponding to each selected feature data within the set long-term period in the historical data, and multiply it by the corresponding time decay term. Where e is the natural logarithm, λ i Let t be the decay factor of the i-th selected feature data, and t be the time. Then, concatenate all the multiplication results into a vector, which is the long-term behavioral fingerprint.

[0061] To determine whether long-term behavioral fingerprints exhibit drift, the specific steps are as follows:

[0062] For each device, the current behavior fingerprint is subtracted from the long-term behavior fingerprint to obtain the device's current drift vector. The anomaly score is calculated using this drift vector. Based on the drift vectors of all devices, it is determined whether a global drift has occurred. If a global drift has occurred and the anomaly score of a certain device is less than the set anomaly threshold, then the long-term behavior fingerprint of that device is considered to have drifted.

[0063] It should be noted that when the abnormal score is greater than or equal to the set abnormal threshold, it may be because the MAC address is cloned at this time. However, it is still possible to miss cloned MAC addresses or large fluctuations in individual devices at this time, rather than due to inaccurate long-term behavioral fingerprints caused by long-term drift. Therefore, global drift verification was further performed.

[0064] The formula for calculating abnormal scores is:

[0065]

[0066] Where, φ j Let F be the anomaly score of the j-th device; M be the total number of selected feature data; F j (i) represents the element corresponding to the feature data selected by the i-th method in the drift vector of the j-th device, i.e., the i-th element of the drift vector of the j-th device; ω i μ represents the importance weight of the i-th selected feature data. i,j σ i,j , respectively, are the average value and standard deviation of the i-th selected feature data within a long-term period set in the historical data of the j-th device; p is a set coefficient, which is greater than 1.

[0067] The step of determining whether a global drift has occurred based on the drift vectors of all devices is as follows:

[0068] If all devices have two or more identical selected feature data, then extract the elements corresponding to these feature data from the drift vector of each device to form a drift sub-vector. Concatenate the covariance vectors of all devices into a set, calculate the covariance matrix and corresponding eigenvalues ​​of the set, and if the largest eigenvalue is greater than or equal to the set drift threshold, then global drift is considered to have occurred.

[0069] If no two or more of the same filtered feature data exist for any of the devices, the squares of all elements of the drift vector for each device are squared and then summed with weights equal to the corresponding importance weights. The sum is then divided by the total number of elements in the drift vector to obtain the drift statistics for each device. The drift statistics for all devices are then clustered with a cluster size of 2. If the ratio of the number of devices in the category corresponding to the larger cluster center to the total number of devices is greater than or equal to a set threshold, then a global drift is considered to have occurred.

[0070] It should be noted that since all acquired feature data are normalized, the influence of dimensions is eliminated, and they can be summed.

[0071] Real-time acquisition of selected feature data within a set short-term period to establish short-term behavioral fingerprints, specifically:

[0072] All selected feature data at each sampling time point within the set short-term period are combined into a sampling point vector. The sampling point vectors at all sampling time points are clustered with a cluster number of 1 to obtain the cluster center. Each element in the cluster center is binarized, and the binarized cluster center is the short-term behavioral fingerprint.

[0073] The binarization is defined as follows: if the element is greater than the set binarization threshold for the element, it becomes 1; otherwise, it becomes 0.

[0074] Preferably, based on the MAC address change rate and the entropy value of the MAC address bit set, a comparison is made between a short-term behavioral fingerprint, a long-term behavioral fingerprint, or a combination of both behavioral fingerprints and the current behavioral fingerprint. Specifically:

[0075] The formula for calculating the entropy value H of the last L bits of a MAC address is:

[0076]

[0077] Where: L is the set number of bits, and the value of each of the last L bits of the MAC address at each sampling time point is obtained within the set short period, p l,b This represents the probability that the value of the l-th bit from the end of the MAC address is equal to b, where b∈{0,1} means b is 0 or 1;

[0078] Calculate the rate of change of each remaining bit in the MAC address. The rate of change of each remaining bit is equal to the number of changes in that bit within a set short period divided by the total number of sampling time points, and obtain the largest rate of change.

[0079] If the maximum rate of change is greater than or equal to the set rate of change threshold and the entropy value H of the following L bits is greater than or equal to the set entropy value threshold, then the short-term behavioral fingerprint is selected for comparison; if the maximum rate of change is less than the set rate of change threshold and the entropy value H of the following L bits is less than the set entropy value threshold, then the long-term behavioral fingerprint is selected for comparison; otherwise, both behavioral fingerprints are used for comparison.

[0080] The comparison is performed using short-term behavioral fingerprints, long-term behavioral fingerprints, or a combination of both behavioral fingerprints, and the current behavioral fingerprint. Specifically:

[0081] When using short-term behavioral fingerprints for comparison: after binarizing each element in the current behavioral fingerprint, compare each element in the short-term behavioral fingerprint one by one. If there are elements that are different with a number greater than or equal to the set threshold, it indicates that there is an illegal MAC clone.

[0082] When using long-term behavioral fingerprints for comparison: calculate the cosine similarity between the current behavioral fingerprint and the long-term behavioral fingerprint. If it is lower than the set cloning threshold, it indicates that there is an illegal MAC clone.

[0083] When comparing two behavioral fingerprints, if any of the above conditions are met, it indicates the existence of an illegal MAC clone.

[0084] It should be noted that the set quantity threshold is... max indicates the maximum value among them, and M is the total number of feature data that were selected;

[0085] Embodiment 2 of the present invention proposes an illegal MAC address cloning detection system based on behavioral fingerprints using the method described in Embodiment 1 of the present invention, comprising a data acquisition module, a filtering module, a behavioral fingerprint establishment module, and a cloning detection module, characterized in that:

[0086] Data acquisition module: For each device, it acquires various network traffic characteristic data, MAC layer time sequence characteristic data and interaction behavior characteristic data within a set long period. All acquired characteristic data are normalized.

[0087] Filtering module: Generates cloned samples using a pre-trained autoencoder, and filters the above feature data using the cloned samples;

[0088] Behavioral fingerprinting module: Based on the feature data selected within a set long-term period in historical data, establish a long-term behavioral fingerprint; if it is determined whether there is drift in the long-term behavioral fingerprint, if so, obtain the feature data selected within the set long-term period in real time and re-establish the long-term behavioral fingerprint; obtain the feature data selected within the set short-term period in real time and establish a short-term behavioral fingerprint.

[0089] Cloning detection module: It concatenates the selected feature data at the current moment into a vector, which is the current behavior fingerprint; it acquires the MAC address of the device within a set short period in real time, and selects to compare the current behavior fingerprint with the short-term behavior fingerprint, long-term behavior fingerprint, or a combination of both behavior fingerprints based on the MAC address change rate and the entropy value of the set number of bits in the MAC address. If the comparison fails, it indicates that there is an illegal MAC clone.

[0090] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the specific implementation of the present invention. Any modifications or equivalent substitutions that do not depart from the spirit and scope of the present invention should be covered within the protection scope of the claims of the present invention.

Claims

1. A method for detecting illegitimate MAC address cloning based on behavioral fingerprinting, characterized in that, Includes the following: For each device, various network traffic characteristic data, MAC layer time sequence characteristic data and interaction behavior characteristic data are acquired within a set long-term period, and all acquired characteristic data are normalized. The pre-trained autoencoder is used to generate clone samples, and the above feature data is then filtered using the clone samples. Based on the feature data selected within a set long-term period in historical data, a long-term behavioral fingerprint is established; when it is determined whether the long-term behavioral fingerprint has drifted, if so, the feature data selected within the set long-term period is obtained in real time, and the long-term behavioral fingerprint is re-established. Real-time acquisition of selected feature data within a set short-term period to establish short-term behavioral fingerprints; The selected feature data at the current moment are concatenated into a vector, which is the fingerprint of the current behavior; The system acquires the device's MAC address within a set short-term period in real time. Based on the MAC address change rate and the entropy value of a set number of bits in the MAC address, it selects to compare the current behavior fingerprint with a short-term behavior fingerprint, a long-term behavior fingerprint, or a combination of both. If the comparison fails, it indicates the existence of an illegal MAC clone, including: calculating the MAC address... bit entropy value , For the set number of digits, the formula is: in: For a given number of bits, retrieve the MAC address within a specified short-term period. The value of each bit at each sampling time point Indicates the last one in the MAC address The value of the bit is equal to b The probability, express b The value is 0 or 1; calculate the rate of change for each remaining bit in the MAC address. The rate of change for each remaining bit is equal to the number of changes within a set short period for that bit divided by the total number of sampling time points, and obtain the largest rate of change. If the largest rate of change is greater than or equal to the set rate of change threshold and then... bit entropy value If the entropy value is greater than or equal to the set threshold, then short-term behavioral fingerprints are selected for comparison; if the maximum rate of change is less than the set rate of change threshold and then... bit entropy value If the entropy value is less than the set threshold, then the long-term behavioral fingerprint is selected for comparison; otherwise, both behavioral fingerprints are used for comparison. When using short-term behavioral fingerprints for comparison: each element in the current behavioral fingerprint is binarized and then compared one by one in the short-term behavioral fingerprint. If there are elements that are different from each other with a number greater than or equal to the set threshold, it indicates that there is an illegal MAC clone. When using long-term behavioral fingerprints for comparison: the cosine similarity between the current behavioral fingerprint and the long-term behavioral fingerprint is calculated. If it is lower than the set cloning threshold, it indicates that there is an illegal MAC clone. When using both behavioral fingerprints for comparison, if any of the above conditions are met, it indicates that there is an illegal MAC clone.

2. The illegal MAC address cloning detection method based on behavioral fingerprinting according to claim 1, characterized in that: Various network traffic characteristic data include: traffic variance, packet length, number of ports, TCP, UDP and ICMP ratios, and DNS query intervals; The MAC layer timing feature data is the packet arrival time; Various device interaction behavior characteristics data include: the number of interactions with other devices and the protocol type.

3. The illegal MAC address cloning detection method based on behavioral fingerprinting according to claim 1, characterized in that: For each type of feature data, the feature data at each sampling time point within a set long-term period is concatenated into a feature sample. An autoencoder is used to reconstruct each data in the feature sample to generate clone feature data, and the clone feature data is concatenated into a clone sample. The objective function of the autoencoder is to minimize the reconstruction error, which is the sum of the norms of the differences between each data in the feature sample and the corresponding clone feature data in the clone sample, divided by the total number of data in the feature sample. The reconstruction error minimized for each type of feature data is multiplied by a set importance weight, and the feature data are sorted from largest to smallest according to the result of the multiplication. The top M types of feature data are retained, where M is the set number.

4. The illegal MAC address cloning detection method based on behavioral fingerprinting according to claim 3, characterized in that: Based on the feature data selected from the long-term period of historical data, a long-term behavioral fingerprint is established, specifically as follows: Calculate the average value of the feature samples corresponding to each selected feature data within the set long-term period in the historical data, and multiply it by the corresponding time decay term. ,in It is the natural logarithm. For the set number i The attenuation factor of the selected feature data At time t, the results of all multiplications are concatenated into a vector, which is the long-term behavioral fingerprint.

5. The illegal MAC address cloning detection method based on behavioral fingerprinting according to claim 4, characterized in that: To determine whether long-term behavioral fingerprints exhibit drift, the specific steps are as follows: For each device, the current behavior fingerprint is subtracted from the long-term behavior fingerprint to obtain the device's current drift vector. The anomaly score is calculated using this drift vector. Based on the drift vectors of all devices, it is determined whether a global drift has occurred. If a global drift has occurred and the anomaly score of a certain device is less than the set anomaly threshold, then the long-term behavior fingerprint of that device is considered to have drifted. The formula for calculating abnormal scores is: in, For the first j The abnormal score of each device; The total number of feature data points that were selected. For the first i The selected feature data in the first j The corresponding elements in the drift vector of each device; For the set number i The importance weights of the selected feature data; , The first j Within a long-term period set in the historical data of each device, the [number]th [device / device] i The mean and standard deviation of the selected feature data; The set coefficient is greater than 1.

6. The illegal MAC address cloning detection method based on behavioral fingerprinting according to claim 5, characterized in that: The step of determining whether a global drift has occurred based on the drift vectors of all devices is as follows: If all devices have two or more identical selected feature data, then extract the elements corresponding to these feature data from the drift vector of each device to form a drift sub-vector. Concatenate the covariance vectors of all devices into a set, calculate the covariance matrix and corresponding eigenvalues ​​of the set, and if the largest eigenvalue is greater than or equal to the set drift threshold, then global drift is considered to have occurred. If no two or more of the same filtered feature data exist for any of the devices, the squares of all elements of the drift vector for each device are squared and then summed with weights equal to the corresponding importance weights. The sum is then divided by the total number of elements in the drift vector to obtain the drift statistics for each device. The drift statistics for all devices are then clustered with a cluster size of 2. If the ratio of the number of devices in the category corresponding to the larger cluster center to the total number of devices is greater than or equal to a set threshold, then a global drift is considered to have occurred.

7. The illegal MAC address cloning detection method based on behavioral fingerprinting according to claim 1, characterized in that: Real-time acquisition of selected feature data within a set short-term period to establish short-term behavioral fingerprints, specifically: All selected feature data at each sampling time point within the set short-term period are combined into a sampling point vector. The sampling point vectors at all sampling time points are clustered with a cluster number of 1 to obtain the cluster center. Each element in the cluster center is binarized, and the binarized cluster center is the short-term behavioral fingerprint.

8. A behavioral fingerprint-based illegal MAC address cloning detection system using the method of any one of claims 1-7, comprising a data acquisition module, a filtering module, a behavioral fingerprint establishment module, and a cloning detection module, characterized in that: Data acquisition module: For each device, it acquires various network traffic characteristic data, MAC layer time sequence characteristic data and interaction behavior characteristic data within a set long period. All acquired characteristic data are normalized. Filtering module: Generates cloned samples using a pre-trained autoencoder, and filters the above feature data using the cloned samples; Behavioral fingerprinting module: Based on the feature data selected within a set long-term period in historical data, establish a long-term behavioral fingerprint; if it is determined whether there is drift in the long-term behavioral fingerprint, if so, obtain the feature data selected within the set long-term period in real time and re-establish the long-term behavioral fingerprint; obtain the feature data selected within the set short-term period in real time and establish a short-term behavioral fingerprint. Clone detection module: Concatenates the selected feature data at the current time into a vector, which is the fingerprint of the current behavior; The system acquires the device's MAC address within a set short-term period in real time. Based on the MAC address change rate and the entropy value of the set number of bits in the MAC address, it selects to use a short-term behavioral fingerprint, a long-term behavioral fingerprint, or a combination of both behavioral fingerprints and the current behavioral fingerprint for comparison. If the comparison fails, it indicates that an illegal MAC clone exists.

Images