Cyberspace asset fingerprinting method and system

Abstract

The embodiment of the present disclosure discloses a network space asset fingerprint identification method and system. The method comprises the following steps: forming original fingerprint fragments according to four types of metadata of captured network traffic record time sequence, protocol, payload length and direction; extracting equipment communication feature vectors from the original fingerprint fragments; performing dimension reduction processing on the feature vectors to obtain micro-signatures with fixed length; performing unsupervised dynamic clustering on the micro-signatures as input to establish equipment type identification; grouping the micro-signatures according to the equipment type identification, arranging the micro-signatures in time sequence, and splicing the micro-signatures into behavior chains; encrypting the equipment identification and the equipment type identification to generate anonymized equipment ID, securely encoding the micro-signatures, abstracting the behavior chains, and constructing a three-tuple data structure containing equipment ID, secure micro-signature and behavior abstract. The method can solve the technical problems of relying on a large number of pre-labeled training samples, being difficult to identify unknown equipment types, and lacking a secure output mechanism.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to a method and system for fingerprinting cyberspace assets. Background Technology

[0002] Cybersecurity asset fingerprinting technology is a crucial component of network security protection systems. It analyzes the communication characteristics of network devices to achieve device identification and behavior monitoring. With the rapid development of emerging network architectures such as the Internet of Things (IoT) and the Industrial Internet, the types of devices in networks are becoming increasingly complex and diverse, placing higher demands on asset fingerprinting technology.

[0003] Existing network asset fingerprinting technologies mainly include protocol-based identification methods and traffic-pattern-based identification methods. Protocol-based methods identify devices by analyzing static features such as the header information and service ports of the protocol messages sent by the device, offering the advantage of fast identification speed. Traffic-pattern-based methods, on the other hand, identify devices by statistically analyzing dynamic features such as the communication behavior patterns of the device, including data packet size distribution and communication frequency.

[0004] The most relevant existing technology uses deep packet inspection combined with machine learning for device fingerprinting. This technology first performs deep analysis of network traffic to extract multi-dimensional features such as protocol fields and payload content. Then, it uses supervised learning algorithms to train a classification model, ultimately achieving the identification of known device types. Its working principle involves constructing a training set containing a large number of labeled device samples, using algorithms such as support vector machines or neural networks to learn feature patterns of different device types, and then matching the features of the device to be identified with the trained model in practical applications.

[0005] However, existing technologies have the following key problems: First, they rely on supervised learning, which requires a large number of pre-labeled training samples, making it difficult to identify unknown device types; second, they lack analysis of the continuity of device behavior, making it impossible to effectively detect security threats such as device identity tampering or replacement; and third, they lack a secure output mechanism, which may leak details of the original traffic during the output process, increasing the risk of secondary attacks. Summary of the Invention

[0006] The purpose of this invention is to provide a method and system for identifying cyberspace assets fingerprints, aiming to solve the technical problems existing in current cyberspace asset fingerprinting technologies, such as reliance on a large number of pre-labeled training samples, difficulty in identifying unknown device types, and lack of secure output mechanisms.

[0007] To achieve the above objectives, the present invention provides a method for fingerprinting cyberspace assets, comprising the following steps:

[0008] Capture network traffic in the target network, and record four types of metadata based on the network traffic: timing, protocol, payload length, and direction, to form an original fingerprint fragment.

[0009] The original fingerprint fragment is subjected to frequency-time domain joint compression processing, and wavelet transform is used to perform time-frequency domain joint analysis to extract device communication feature vectors containing transient and steady-state features of device communication;

[0010] The feature vectors are reduced in dimensionality to obtain microsignatures of fixed length;

[0011] Unsupervised dynamic clustering is performed on the micro-signature as input to establish a device type identifier;

[0012] The microsignatures are grouped according to the device type identifier, and the microsignatures belonging to the same device at different time periods are arranged in chronological order. The microsignatures are then concatenated into a behavior chain based on the communication context information.

[0013] The device identifier and device type identifier are encrypted to generate an anonymous device ID, the microsignature is securely encoded, and the behavior chain is digested to construct a triplet data structure containing the device ID, secure microsignature, and behavior digest.

[0014] Optionally, the target network includes critical network nodes and network edge nodes, and capturing network traffic in the target network includes:

[0015] Deploy traffic collectors at the key nodes of the network and deploy lightweight traffic collectors at the edge nodes of the network;

[0016] Network traffic data packets of the network key nodes are collected using a traffic collector, and network traffic data packets of the network edge nodes are collected using a lightweight traffic collector.

[0017] Optionally, based on four types of metadata—network traffic recording time sequence, protocol, payload length, and direction—an original fingerprint fragment is formed, including:

[0018] The network traffic data packets are parsed in real time to extract the arrival timestamp as a time sequence feature, the protocol type identifier as a protocol feature, the number of bytes of the data packet payload as a payload length feature, and the communication direction identifier as a direction feature, forming four types of metadata;

[0019] The four types of metadata from multiple network traffic data packets within a continuous time window are combined in chronological order to form an original fingerprint fragment containing the device communication pattern.

[0020] The original fingerprint fragment is stored in a buffer to provide data input for subsequent processing.

[0021] Optionally, the original fingerprint fragment is subjected to joint frequency-time domain compression processing, and wavelet transform is used for joint time-frequency domain analysis to extract a device communication feature vector containing transient and steady-state features of device communication, including:

[0022] The original fingerprint fragment is subjected to a Fast Fourier Transform to convert the time-domain signal into a frequency-domain representation signal;

[0023] An adaptive bandpass filter is applied to the frequency domain representation signal to preserve the device-specific frequency components and filter out network noise.

[0024] By performing time-frequency joint analysis on the filtered frequency domain representation signal using wavelet transform, and using multi-scale wavelet basis functions to extract frequency change patterns at different time scales, a device communication feature vector containing transient and steady-state features of device communication is obtained.

[0025] Optionally, the device communication feature vector is reduced in dimensionality to obtain a fixed-length micro-signature, including:

[0026] Calculate the covariance matrix of the device communication eigenvectors, and solve for its eigenvectors and eigenvalues;

[0027] The eigenvectors are sorted according to the magnitude of their eigenvalues, and the cumulative contribution rate is calculated.

[0028] Based on the preset cumulative contribution rate threshold, determine the number of principal components k to be retained and their corresponding feature vectors;

[0029] Construct the projection matrix W(e) based on the selected k eigenvectors;

[0030] The device communication feature vector is projected according to the projection matrix W(e) to obtain the k-dimensional micro-signature.

[0031] Optionally, unsupervised dynamic clustering is performed on the micro-signature as input to establish a device type identifier, including:

[0032] Calculate the local density of each sample point in the space where the microsignature is located, and use the Gaussian kernel function to measure the similarity between samples;

[0033] Calculate the minimum distance from each sample point to higher-density sample points, and construct a density-distance decision graph;

[0034] Automatically identify density peaks in the density-distance decision map as cluster centers;

[0035] Non-cluster center sample points are assigned to the nearest cluster center to form equipment type clusters;

[0036] When the density-distance feature of a new sample point exceeds the boundary of an existing cluster, the creation of a new cluster is triggered.

[0037] Assign a unique device type identifier to each cluster and establish a mapping relationship between microsignature and device type.

[0038] Optionally, the microsignatures are concatenated into a chain of actions based on communication context information, including:

[0039] Based on communication context information including communication object, session state, protocol type, and port information, the association between microsignatures is determined;

[0040] Microsignatures with continuous communication context associations are concatenated in chronological order to form a behavior chain that reflects the complete communication behavior pattern of the device.

[0041] The integrity of the behavioral chain is verified to ensure the continuity of the time series and the validity of the contextual association.

[0042] Optionally, the cyberspace asset fingerprinting method further includes:

[0043] Calculate the Hamming distance between adjacent time-period behavior chains to quantify the degree of change in device behavior patterns;

[0044] Set a dynamic threshold; when the Hamming distance changes abruptly and exceeds the threshold, it is judged as an abnormal event.

[0045] Finally, based on the anomaly type and severity of the abnormal event, anomaly detection results are generated.

[0046] Optionally, the cyberspace asset fingerprinting method further includes:

[0047] Based on the anomaly detection results, analyze the anomaly frequency and threat level of different device types to identify suspicious devices and normal devices;

[0048] In the next round of traffic capture, a high-frequency sampling strategy will be used for identified suspicious devices, while a low-frequency sampling strategy will be used for normal devices.

[0049] The present invention also provides a cyberspace asset fingerprinting system, comprising:

[0050] The traffic capture module is used to capture network traffic in the target network and record four types of metadata based on the network traffic: timing, protocol, payload length and direction, to form an original fingerprint fragment.

[0051] The feature processing module is used to perform frequency-time domain joint compression processing on the original fingerprint fragment, and to use wavelet transform to perform time-frequency domain joint analysis to extract device communication feature vectors containing transient and steady-state features of device communication;

[0052] The dimensionality reduction module is used to reduce the dimensionality of the feature vector to obtain a fixed-length micro-signature;

[0053] The clustering and identification module is used to perform unsupervised dynamic clustering on the micro-signature as input to establish a device type identifier;

[0054] The behavior chain construction module is used to group the micro-signatures according to the device type identifier, arrange the micro-signatures belonging to the same device at different time periods in chronological order, and concatenate the micro-signatures into a behavior chain based on communication context information.

[0055] The secure output module is used to encrypt the device identifier and device type identifier to generate an anonymous device ID, securely encode the microsignature, perform digest processing on the behavior chain, and construct a triplet data structure containing the device ID, secure microsignature, and behavior digest.

[0056] The beneficial effects of this invention are: converting the original fingerprint fragment into a fixed-length micro-signature through frequency-time domain joint compression processing, while preserving the unique jitter characteristics of the device; using unsupervised dynamic clustering to achieve automatic identification of unknown device types; constructing behavior chains to analyze the continuity of device behavior, which can effectively detect security threats such as device identity tampering or replacement; and adopting a secure information output strategy to avoid leaking original traffic details and reduce the secondary attack surface.

[0057] The above description is merely an overview of the technical solution disclosed herein. In order to better understand the technical means of this disclosure and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of this disclosure more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0058] To more clearly illustrate the technical solutions of the embodiments of this disclosure, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this disclosure. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0059] Figure 1 This is a flowchart of the cyberspace asset fingerprinting method of the present invention;

[0060] Figure 2 This is a structural block diagram of the cyberspace asset fingerprinting system of the present invention. Detailed Implementation

[0061] The embodiments of this disclosure will now be described in detail with reference to the accompanying drawings.

[0062] It should be understood that the following specific examples illustrate the implementation of this disclosure, and those skilled in the art can easily understand other advantages and effects of this disclosure from the content disclosed in this specification. Obviously, the described embodiments are only a part of the embodiments of this disclosure, and not all of them. This disclosure can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of this disclosure. It should be noted that, in the absence of conflict, the following embodiments and features in the embodiments can be combined with each other. Based on the embodiments in this disclosure, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this disclosure.

[0063] It should be noted that various aspects of embodiments within the scope of the appended claims are described below. It will be apparent that the aspects described herein can be embodied in a wide variety of forms, and any particular structure and / or function described herein is merely illustrative. Based on this disclosure, those skilled in the art will understand that one aspect described herein can be implemented independently of any other aspect, and two or more of these aspects can be combined in various ways. For example, any number of aspects set forth herein can be used to implement the device and / or practice the method. Additionally, this device and / or method can be implemented using structures and / or functionalities other than one or more of the aspects set forth herein.

[0064] like Figure 1 As shown, the present invention provides a method for fingerprinting cyberspace assets, comprising the following steps:

[0065] S1: Capture network traffic in the target network, and record four types of metadata based on the network traffic: timing, protocol, payload length, and direction, to form the original fingerprint fragment.

[0066] In this step, traffic collectors can be deployed on network nodes of the target network and configured in mirror mode to achieve passive listening and capture network traffic in an interference-free manner. For example, traffic collectors are deployed on the key network nodes and lightweight traffic collectors are deployed on the network edge nodes. The traffic collectors collect network traffic data packets of the key network nodes and the lightweight traffic collectors collect network traffic data packets of the network edge nodes.

[0067] The captured data packets are then parsed in real time, extracting arrival timestamps as time features, protocol type identifiers as protocol features, data packet payload byte counts as length features, and communication direction identifiers as direction features. Next, multiple data packet features within a continuous time window are combined in chronological order to form an original fingerprint fragment containing the device's communication mode. Finally, the fingerprint fragment is stored in a buffer to provide data input for subsequent processing.

[0068] For example, the specific implementation steps are as follows:

[0069] High-performance traffic collectors are deployed at critical network nodes, employing dedicated network processing chips to support traffic mirroring capabilities exceeding 10Gbps. Lightweight traffic collectors are deployed at network edge nodes, featuring an embedded design that can be directly deployed on various network edge devices. The collectors are configured in mirroring mode to obtain copies of network traffic through port mirroring or network traffic splitting technology, without interfering with normal network operation. For critical network nodes, traffic copies are received from the mirror ports of network switching devices, and zero-copy technology is used to transmit data packets directly from the network card buffer to the application layer, avoiding intermediate data copying operations and improving collection efficiency. For network edge nodes, a sampling collection strategy is adopted, capturing a portion of network traffic according to a preset sampling rate, performing preliminary local aggregation, and then transmitting it to the central processing node.

[0070] For each captured data packet, an arrival timestamp accurate to the microsecond level is extracted as a timing feature. To ensure the accuracy of the timestamps, Network Time Protocol (NTP) or Precision Time Protocol (PTP) is used for clock synchronization. The protocol header of the data packet is parsed to extract the protocol type identifier as a protocol feature. The protocol type identifier includes, but is not limited to: link layer protocols (such as ARP, VLAN), network layer protocols (such as IPv4, IPv6, ICMP), transport layer protocols (such as TCP, UDP), and application layer protocols (such as HTTP, HTTPS, DNS, MQTT, etc.). The number of bytes in the data packet payload is calculated as the payload length feature. The original payload length is recorded without any payload content parsing to protect data privacy. The communication direction is marked according to the source and destination addresses of the data packets as a direction feature. The communication direction is divided into two categories: inbound and outbound.

[0071] The extracted metadata is grouped based on the device's IP or MAC address, and an independent data stream is maintained for each device. A sliding time window is set, with a configurable window size (default 30 seconds). The metadata sequence within the window constitutes an original fingerprint fragment. The time window slides every 10 seconds (configurable) to generate a new original fingerprint fragment, enabling continuous monitoring of device behavior.

[0072] The generated raw fingerprint fragments are stored in a high-speed buffer, and different retention priorities are set according to the importance of the device to ensure that fingerprint fragments of important devices are not discarded due to buffer overflow.

[0073] S2: Perform frequency-time domain joint compression processing on the original fingerprint fragment, and use wavelet transform to perform time-frequency domain joint analysis to extract the device communication feature vector containing transient and steady-state features of device communication.

[0074] In practice, a fast Fourier transform is performed on the original fingerprint fragment to convert the time-domain signal into a frequency-domain representation signal. An adaptive bandpass filter is applied to the frequency-domain representation signal to retain the device-specific frequency components and filter out network noise. Wavelet transform is used to perform joint time-frequency domain analysis on the filtered frequency-domain representation signal, and multi-scale wavelet basis functions are used to extract frequency change patterns at different time scales to obtain a device communication feature vector containing transient and steady-state features of device communication.

[0075] For example, performing a Fast Fourier Transform on the original fingerprint fragment to convert the time-domain signal into a frequency-domain representation signal includes:

[0076] S2.1: Construct a time series from the three types of metadata in the original fingerprint fragment: time sequence, payload length, and direction. The time sequence metadata is converted into a time interval sequence of adjacent data packets; the payload length is directly used as a numerical sequence; and the direction is converted into a binary sequence of +1 (outbound) and -1 (inbound).

[0077] S2.2: Apply the Fast Fourier Transform (FFT) algorithm to each constructed time series to convert the time-domain signal into a frequency-domain representation. For a sequence of length N, calculate its N-point FFT to obtain the spectrum with a frequency resolution of sampling rate / N.

[0078] S2.3: Calculate the amplitude and phase information of the spectrum to form preliminary frequency domain characteristics.

[0079] Applying an adaptive bandpass filter to the frequency domain representation signal to preserve device-specific frequency components and filter out network noise includes:

[0080] S2.4: Based on historical data analysis, establish a spectral model of network background noise. This model describes common frequency distribution patterns in normal network communication.

[0081] S2.5: Design an adaptive bandpass filter whose center frequency and bandwidth are dynamically adjusted according to the device type. For industrial control equipment, the filter focuses more on low-frequency periodic characteristics; for network servers, it focuses more on mid-to-high frequency burst characteristics.

[0082] S2.6: Apply an adaptive bandpass filter to filter the frequency domain representation, retaining the frequency components unique to the device behavior and filtering out the frequency components that match the network background noise spectrum model.

[0083] The time-frequency joint analysis unit is responsible for extracting the transient and steady-state characteristics of device communication through wavelet transform, including:

[0084] S2.7: Apply Discrete Wavelet Transform (DWT) to the filtered frequency domain representation signal, using multi-scale wavelet basis functions to decompose the signal. It supports various wavelet basis functions, including Daubechies wavelet, Symlet wavelet, and Meyer wavelet, allowing selection of the most suitable wavelet basis function based on the characteristics of different device types.

[0085] S2.8: Through multi-scale analysis, the signal is decomposed into sub-signals of different frequency bands, and frequency variation patterns at different time scales are extracted. The low-frequency sub-band captures the steady-state characteristics of device communication, such as periodic behavior; the high-frequency sub-band captures transient characteristics, such as sudden communication events.

[0086] S2.9: Calculate the statistical characteristics of each subband, including energy distribution, entropy value, statistical moments, etc., as a component of the device communication feature vector.

[0087] S2.10: Combining frequency domain features and wavelet domain features, construct a complete device communication feature vector, which includes the transient and steady-state features of device communication.

[0088] S3: Perform dimensionality reduction on the feature vectors to obtain microsignatures of fixed length.

[0089] In practice, the device communication feature vectors are dimensionality reduced to obtain fixed-length micro-signatures. This includes: calculating the covariance matrix of the device communication feature vectors and solving for their eigenvectors and eigenvalues; sorting the feature vectors according to the size of their eigenvalues ​​and calculating the cumulative contribution rate; determining the number of principal components k to be retained and their corresponding eigenvectors based on a preset cumulative contribution rate threshold; constructing a projection matrix W(e) based on the selected k eigenvectors; and projecting the device communication feature vectors onto the projection matrix W(e) to obtain the k-dimensional micro-signature.

[0090] For example, the specific implementation steps are as follows:

[0091] S3.1: Calculate the covariance matrix of the device communication feature vectors. Assume there are m samples, each a eigenvector of size n. First, calculate the mean vector of the features. Then, calculate the difference between the feature vectors and the mean vector. Finally, calculate the covariance matrix. , where X is an m×n matrix, and each row represents the centered feature vector of a sample.

[0092] S3.2: Solve for the eigenvectors and eigenvalues ​​of the covariance matrix. Using numerical methods such as the QR algorithm or the power iteration method, solve for the eigenvalues ​​λ1, λ2, ..., λ of the covariance matrix C. n and the corresponding feature vectors v1, v2, ..., v n .

[0093] S3.3: Sort the eigenvectors according to the magnitude of their eigenvalues ​​and calculate the cumulative contribution rate. The eigenvalues ​​are sorted from largest to smallest: λ1 ≥ λ2 ≥ ... ≥λ n Calculate the cumulative contribution rate of the first k eigenvalues: sum(λ1, ..., λ k ) / sum(λ1, ..., λ n ).

[0094] S3.4: Based on the preset cumulative contribution rate threshold (default 95%), determine the number of principal components k to be retained and their corresponding eigenvectors. Select the k value that will cause the cumulative contribution rate to exceed the threshold for the first time.

[0095] S3.5: Construct the projection matrix W(e) based on the selected k eigenvectors. Each column of the projection matrix is ​​an eigenvector with dimensions n×k.

[0096] S3.6: Project the device communication feature vector according to the projection matrix W(e) to obtain a k-dimensional micro-signature. For feature vector x, its micro-signature is calculated as follows: .

[0097] S3.7: Normalize the obtained microsignature to ensure that all dimensions are within the range [0,1]. Use the MinMax normalization method: y norm = (yy min ) / (y max -y min ).

[0098] Through the above processing, the original high-dimensional feature vector is compressed into a fixed-length (k-dimensional) micro-signature, which retains the main information of the original features while significantly reducing the computational complexity of subsequent processing.

[0099] S4: Perform unsupervised dynamic clustering on the micro-signature as input to establish a device type identifier.

[0100] In specific implementation, the microsignature is used as input for unsupervised dynamic clustering to establish device type identifiers. This includes: calculating the local density of each sample point in the space where the microsignature is located, and using a Gaussian kernel function to measure the similarity between samples; calculating the minimum distance from each sample point to higher density sample points to construct a density-distance decision graph; automatically identifying density peak points in the density-distance decision graph as cluster centers; assigning non-cluster center sample points to the nearest cluster center to form device type clusters; triggering the creation of a new cluster when the density-distance feature of a new sample point exceeds the existing cluster boundary; and assigning a unique device type identifier to each cluster to establish a mapping relationship between the microsignature and the device type.

[0101] For example, when using the Density Peak Clustering algorithm for unsupervised dynamic clustering, the specific implementation steps are as follows:

[0102] S4.1: Calculate the local density of each sample point in the space containing the microsignature. For sample point i, its local density ρ i The calculation is as follows: , where d ij d is the Euclidean distance between samples i and j. c It is the cutoff distance parameter, which is determined by an adaptive method to ensure that each point has approximately 2% of its neighboring points on average.

[0103] S4.2: Calculate the minimum distance from each sample point to higher-density sample points. For sample point i, its distance δ i The calculation is as follows: For the point with the highest local density, set δ i =max j (d ij ).

[0104] S4.3: Construct a density-distance decision graph, with the horizontal axis representing local density ρ and the vertical axis representing distance δ. On this decision graph, cluster centers typically have high ρ values ​​and large δ values, forming a distinct "peak point" in the upper right corner of the graph.

[0105] S4.4: Automatically identify density peaks in the decision graph as cluster centers. Calculate γ. i = ρ i ·δ i As a centrality indicator for sample point i, several points with the highest γ values ​​are selected as cluster centers. The number of cluster centers is automatically determined by a peak point detection algorithm and does not need to be specified in advance.

[0106] S4.5: Assign non-cluster center sample points to the nearest cluster center to form device type clusters. Sample point i is assigned to the cluster containing the cluster center with which it has the shortest path. The shortest path is the path connecting two points through a high-density region.

[0107] S4.6: Monitor the density-distance characteristics of new sample points. When their γ value is significantly higher than the average γ value of existing cluster centers and the distance to the nearest cluster center exceeds a preset threshold, trigger the creation of a new cluster, thereby automatically identifying new device types appearing in the network.

[0108] S4.7: Assign a unique device type identifier to each cluster and establish a mapping relationship between microsignatures and device types. The device type identifier uses a 32-bit hash value to ensure global uniqueness.

[0109] S4.8: Maintain a device type database, recording identified device types and their characteristic patterns. The device type database is updated regularly to reflect changes in the device composition of the network environment.

[0110] Unsupervised dynamic clustering can automatically discover various devices in the network without the need for pre-labeled training samples, and can also adapt to dynamic changes in the network environment and identify newly emerging device types.

[0111] S5: Group the microsignatures according to the device type identifier, arrange the microsignatures belonging to the same device at different time periods in chronological order, and concatenate the microsignatures into a behavior chain based on the communication context information.

[0112] In specific implementation, microsignatures are concatenated into a behavior chain based on communication context information, including: determining the association between microsignatures based on communication context information including communication object, session state, protocol type and port information; concatenating microsignatures with continuous communication context association in chronological order to form a behavior chain reflecting the complete communication behavior pattern of the device; and verifying the integrity of the behavior chain to ensure the continuity of the time sequence and the validity of the context association.

[0113] For example, the specific implementation steps are as follows:

[0114] S5.1: Group microsignatures based on device type identifiers. Each device is assigned to a corresponding group based on its unique identifiers such as IP address and MAC address.

[0115] S5.2: Arrange microsignatures belonging to the same device from different time periods in chronological order. Maintain a time window (default 24 hours) and collect all microsignatures from devices within that time range.

[0116] S5.3: Determine the association between microsignatures based on communication context information. Communication context information includes: a) Communication object: Identifiers of other devices interacting with the device; b) Session state: such as TCP connection state, application layer session state, etc.; c) Protocol type: Protocol stack information used for communication; d) Port information: Source port and destination port used for communication.

[0117] S5.4: Analyze the semantic continuity between adjacent microsignatures to identify microsignature sequences belonging to the same communication session or functional operation. Employ a state transition probability model to calculate the transition probability of microsignature sequences and identify high-probability behavioral patterns.

[0118] S5.5: Microsignatures with continuous communication context associations are concatenated in chronological order to form a behavior chain that reflects the complete communication behavior pattern of the device. Each behavior chain represents a series of consecutive operations of the device in a specific context.

[0119] S5.6: Perform integrity verification on the behavior chain to ensure the continuity of the time series and the validity of the context association. Check whether the time interval between adjacent micro-signatures in the behavior chain is reasonable and whether the communication context is consistent. If an anomaly is found, mark the behavior chain as suspicious.

[0120] S6: Encrypt the device identifier and device type identifier to generate an anonymous device ID, securely encode the microsignature, digest the behavior chain, and construct a triplet data structure containing the device ID, secure microsignature, and behavior digest.

[0121] In this step, the device identifier is first hashed and encrypted to generate an anonymized device ID; then the microsignature is securely encoded to remove feature dimensions that may leak sensitive information; next, the behavior chain is digested to retain only the key behavior patterns required for anomaly detection; then a standardized triple data structure is constructed, containing the device ID, secure microsignature, and behavior digest; finally, services are provided externally through a secure API interface to achieve complete isolation between the raw traffic data and the output results.

[0122] For example, summarizing the behavior chain includes calculating a feature summary of the behavior chain, including the behavior chain length, communication pattern complexity, periodicity features, etc., as a high-level representation of the device's behavior pattern. Furthermore, a historical database of the device's behavior chains can be established to record the device's behavior patterns at different times and in different scenarios, providing benchmark data for subsequent anomaly detection.

[0123] For example, the specific implementation steps are as follows:

[0124] S6.1: Hash-encrypt the device identifier and device type identifier to generate an anonymous device ID. The SHA-256 hash algorithm, combined with salting technology, ensures that the device ID is irreversible and unique.

[0125] S6.2: Securely encode the microsignature, removing feature dimensions that may leak sensitive information. Analyze the sensitivity of each dimension of the microsignature, and obfuscate or encrypt highly sensitive dimensions.

[0126] S6.3: Perform a summary processing on the behavior chain, retaining only the key behavioral patterns required for anomaly detection. The behavior chain summary includes behavioral statistical features and anomaly markers, but does not contain specific communication content.

[0127] S6.4: Construct a standardized triple data structure containing a device ID, a secure micro-signature, and a behavior digest. The triples are serialized using JSON format for easy cross-platform transmission and parsing.

[0128] S6.5: Implements a data access control mechanism, providing different granularities of information access based on user permission levels. Administrator users can obtain complete triplet information, while ordinary users can only access device type statistics and abnormal alarm information.

[0129] S6.6: Provides a secure API interface to provide services externally, achieving complete isolation between raw traffic data and output results. The API interface uses the HTTPS protocol and supports TLS 1.3 encryption to ensure secure data transmission.

[0130] S6.7: Implement a data anonymization audit mechanism to record all data access operations, regularly audit the effectiveness of data anonymization, and ensure that sensitive information is not leaked.

[0131] By using secure output processing, only the securely processed triplet information is exposed to the outside world, effectively protecting the original network traffic data and preventing the leakage of sensitive information and the risk of secondary attacks.

[0132] The cyberspace asset fingerprinting method of this invention further includes an anomaly detection step. Specifically, the anomaly detection step includes: calculating the Hamming distance between behavioral chains in adjacent time periods to quantify the degree of change in device behavior patterns; setting a dynamic threshold, and determining an anomaly event when the Hamming distance suddenly changes and exceeds the threshold; and finally generating an anomaly detection result based on the anomaly type and severity of the anomaly event.

[0133] For example, the specific implementation steps are as follows:

[0134] S7.1: Calculate the Hamming distance between behavioral chains of adjacent time periods to quantify the degree of change in device behavior patterns. The Hamming distance calculation formula is: Li and L i+1 It is a chain of behaviors between adjacent time periods, and len() represents the length of the behavior chain.

[0135] S7.2: Establish a baseline for the normal behavior of the device, recording typical behavior patterns and their range of variation under different time periods and scenarios. The baseline data is stored in a time-series database, supporting efficient time-series data querying and analysis.

[0136] S7.3: Set a dynamic threshold that adaptively adjusts the threshold value based on device type, time factors, and historical behavior patterns. The dynamic threshold calculation formula is: , where μ is the average historical Hamming distance, σ is the standard deviation, α is the adjustment factor (default is 3), and t represents the current time point.

[0137] S7.4: Monitor the real-time calculated Hamming distance. When it suddenly changes and exceeds the dynamic threshold, it is judged as an abnormal event. Define multiple levels of abnormal states: a) Minor abnormality: Hamming distance exceeds the threshold but the magnitude is not large; b) Moderate abnormality: Hamming distance significantly exceeds the threshold and lasts for multiple time windows; c) Severe abnormality: Hamming distance fluctuates drastically or is continuously higher than the threshold for more than a predetermined duration.

[0138] S7.5: Classify detected abnormal events and identify possible anomaly types, including but not limited to: a) Device configuration change: functional behavior patterns change but communication objects remain stable; b) Device replacement: behavior patterns and communication characteristics change significantly at the same time; c) Device intrusion: the original communication pattern is maintained but abnormal communication behavior is added; d) Network environment change: multiple devices exhibit similar abnormal patterns at the same time.

[0139] S7.6: Generate structured anomaly detection results based on the anomaly type and severity of the anomaly event, including the following information: a) Anomaly Device ID: An anonymous identifier of the device that experienced the anomaly; b) Anomaly Type: The anomaly type determined based on the classification results; c) Severity: Risk level assessment of the anomaly event; d) Time Information: Timestamp and duration of the anomaly; e) Evidence Data: Key indicators and threshold information supporting the anomaly judgment; f) Recommended Actions: Handling recommendations for this type of anomaly.

[0140] The cyberspace asset fingerprinting method in this invention also includes an adaptive feedback optimization step. Specifically, the adaptive feedback optimization step includes: based on the anomaly detection results, analyzing the anomaly frequency and threat level of different device types to identify suspicious devices and normal devices; in the next round of traffic capture, a high-frequency sampling strategy is adopted for the identified suspicious devices, and a low-frequency sampling strategy is adopted for normal devices.

[0141] In practice, the priority rules of the traffic collector are first configured according to the list of suspicious devices. A high-frequency sampling strategy is set for the IP addresses or MAC addresses of the identified suspicious devices to increase their packet capture rate to 100%. Then, a low-frequency sampling strategy is adopted for normal devices, and different sampling intervals are set according to the risk level. Next, in the traffic parsing stage, the packets of suspicious devices are processed first to shorten the processing delay of their metadata extraction. At the same time, the time window length of suspicious devices is increased to capture communication behavior over a longer period of time to improve the accuracy of anomaly detection. Finally, more storage space is allocated for suspicious devices in the buffer management to ensure the integrity and continuity of their fingerprint fragments.

[0142] For example, the specific implementation steps are as follows:

[0143] S8.1: Analyze anomaly detection results, statistically analyze the anomaly frequency and threat level of different equipment types, and identify high-risk and low-risk equipment groups. Maintain an equipment risk scoring mechanism that comprehensively considers historical anomaly frequency, recent anomaly severity, and equipment importance to calculate a risk score for each device.

[0144] S8.2: Based on the risk score of the device, dynamically adjust the traffic sampling strategy of the corresponding device: a) High-risk device (risk score > 80): Set to full sampling (100%), capture all data packets; b) Medium-risk device (50 ≤ risk score ≤ 80): Set to high-frequency sampling (50%), capture half of the data packets; c) Low-risk device (risk score < 50): Set to low-frequency sampling (10-20%), capture only a small number of data packets.

[0145] S8.3: Adjust the time window parameters to set different monitoring granularities for devices with different risk levels: a) High-risk devices: Set a shorter time window (e.g., 10 seconds) to increase monitoring frequency; b) Medium- and low-risk devices: Set a longer time window (e.g., 30-60 seconds) to reduce resource consumption.

[0146] S8.4: Based on detection accuracy feedback, optimize the parameter settings of the frequency domain-time domain filter: a) Analyze false alarm and missed alarm cases and adjust the frequency range of the bandpass filter; b) Select the optimal wavelet basis function and decomposition level according to the detection effect of different equipment types; c) Adaptively adjust the signal-to-noise ratio threshold to balance the accuracy and efficiency of feature extraction.

[0147] S8.5: Update the sensitivity parameters of the clustering algorithm to balance the ability to detect new devices with the false alarm rate: a) Adjust the γ threshold for density peak detection based on the new device detection rate and cluster stability; b) Adaptively adjust the cutoff distance parameter d for local density calculation based on cluster quality assessment. cc) Dynamically adjust the triggering conditions for new clusters to adapt to the changing speed of the network environment.

[0148] Through adaptive optimization, the parameters of each module can be continuously adjusted and optimized based on actual operating results, improving the accuracy of device identification and the efficiency of anomaly detection, while optimizing resource utilization and achieving efficient cyberspace asset fingerprint identification.

[0149] like Figure 2 As shown, the present invention also provides a cyberspace asset fingerprinting system, comprising:

[0150] The traffic capture module 10 is used to capture network traffic in the target network and record four types of metadata, namely timing, protocol, payload length and direction, based on the network traffic to form an original fingerprint fragment.

[0151] Feature processing module 20 is used to perform frequency domain-time domain joint compression processing on the original fingerprint fragment, and use wavelet transform to perform time-frequency domain joint analysis to extract device communication feature vectors containing transient and steady-state features of device communication;

[0152] Dimensionality reduction module 30 is used to reduce the dimensionality of the feature vector to obtain a micro-signature of fixed length;

[0153] Clustering identification module 40 is used to perform unsupervised dynamic clustering on the micro-signature as input to establish device type identifier;

[0154] The behavior chain construction module 50 is used to group the micro-signatures according to the device type identifier, arrange the micro-signatures belonging to the same device at different time periods in chronological order, and splice the micro-signatures into a behavior chain based on the communication context information.

[0155] The secure output module 60 is used to encrypt the device identifier and the device type identifier to generate an anonymous device ID, securely encode the microsignature, perform digest processing on the behavior chain, and construct a triplet data structure containing the device ID, secure microsignature and behavior digest.

[0156] The system may also include an anomaly detection module and an adaptive optimization module. The anomaly detection module calculates the Hamming distance between behavioral chains in adjacent time periods to quantify the degree of change in device behavior patterns; it sets a dynamic threshold, and when the Hamming distance suddenly changes and exceeds the threshold, it is determined to be an anomaly event; finally, it generates anomaly detection results based on the anomaly type and severity of the anomaly event. The adaptive optimization module analyzes the anomaly frequency and threat level of different device types based on the anomaly detection results, identifies suspicious devices and normal devices; in the next round of traffic capture, it adopts a high-frequency sampling strategy for the identified suspicious devices and a low-frequency sampling strategy for normal devices.

[0157] This invention converts the original fingerprint fragment into a fixed-length micro-signature through joint frequency-time domain compression processing, preserving the unique jitter characteristics of the device; it utilizes unsupervised dynamic clustering to achieve automatic identification of unknown device types; it constructs behavior chains to analyze the continuity of device behavior, effectively detecting security threats such as device identity tampering or replacement; and it adopts a secure information output strategy to avoid leaking original traffic details and reduce the secondary attack surface.

[0158] This invention is applicable to device identification and security monitoring in various complex network environments, and has significant advantages, especially in heterogeneous network environments such as the Internet of Things and the Industrial Internet. It can effectively solve the problems of strong dependence on pre-labeled samples, difficulty in identifying unknown devices, and lack of behavioral continuity analysis in existing technologies.

[0159] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for fingerprinting cyberspace assets, characterized in that, Includes the following steps: Capture network traffic in the target network, and record four types of metadata based on the network traffic: timing, protocol, payload length, and direction, to form an original fingerprint fragment. The three types of metadata—time sequence, payload length, and direction—from the original fingerprint fragment are respectively constructed into time series. A Fast Fourier Transform is performed on each constructed time series to convert the time-domain signal into a frequency-domain representation. An adaptive bandpass filter is applied to the frequency-domain representation to retain the device-specific frequency components and filter out network noise. Wavelet transform is used to perform joint time-frequency domain analysis on the filtered frequency-domain representation. Multi-scale wavelet basis functions are used to extract frequency change patterns at different time scales, resulting in a device communication feature vector containing both transient and steady-state characteristics of device communication. The device communication feature vectors are dimensionality reduced to obtain fixed-length micro-signatures. This process includes: calculating the covariance matrix of the device communication feature vectors and solving for their eigenvectors and eigenvalues; sorting the feature vectors according to their eigenvalues ​​and calculating their cumulative contribution rate; determining the number of principal components k to be retained and their corresponding eigenvectors based on a preset cumulative contribution rate threshold; constructing a projection matrix W(e) based on the selected k eigenvectors; and projecting the device communication feature vectors onto the projection matrix W(e) to obtain the k-dimensional micro-signature. The microsignature is used as input for unsupervised dynamic clustering to establish a device type identifier; The microsignatures are grouped according to the device type identifier, and the microsignatures belonging to the same device at different time periods are arranged in chronological order. The microsignatures are then concatenated into a behavior chain based on the communication context information, which includes the communication object, session state, protocol type, and port information. The device identifier and device type identifier are encrypted to generate an anonymous device ID. The microsignature is securely encoded to obtain a secure microsignature. The behavior chain is digested to obtain a behavior digest. A triple data structure containing device ID, secure microsignature and behavior digest is constructed.

2. The cyberspace asset fingerprinting method according to claim 1, characterized in that, The target network includes critical network nodes and network edge nodes. Capturing network traffic within the target network includes: Deploy traffic collectors at the key nodes of the network and deploy lightweight traffic collectors at the edge nodes of the network; Network traffic data packets of the network key nodes are collected using a traffic collector, and network traffic data packets of the network edge nodes are collected using a lightweight traffic collector.

3. The cyberspace asset fingerprinting method according to claim 2, characterized in that, Based on four types of metadata—time sequence, protocol, payload length, and direction—network traffic records, an original fingerprint fragment is formed, including: The network traffic data packets are parsed in real time to extract the arrival timestamp as a time sequence feature, the protocol type identifier as a protocol feature, the number of bytes of the data packet payload as a payload length feature, and the communication direction identifier as a direction feature, forming four types of metadata; The four types of metadata from multiple network traffic data packets within a continuous time window are combined in chronological order to form an original fingerprint fragment containing the device communication pattern. The original fingerprint fragment is stored in a buffer to provide data input for subsequent processing.

4. The cyberspace asset fingerprinting method according to claim 1, characterized in that, The micro-signature is used as input for unsupervised dynamic clustering to establish a device type identifier, including: Calculate the local density of each sample point in the space where the microsignature is located, and use the Gaussian kernel function to measure the similarity between samples; Calculate the minimum distance from each sample point to higher-density sample points, and construct a density-distance decision graph; Automatically identify density peaks in the density-distance decision map as cluster centers; Non-cluster center sample points are assigned to the nearest cluster center to form equipment type clusters; When the density-distance feature of a new sample point exceeds the boundary of an existing cluster, the creation of a new cluster is triggered. Assign a unique device type identifier to each cluster and establish a mapping relationship between microsignature and device type.

5. The cyberspace asset fingerprinting method according to claim 1, characterized in that, Microsignatures are concatenated into a chain of actions based on communication context information, including: Based on communication context information including communication object, session state, protocol type, and port information, the association between microsignatures is determined; Microsignatures with continuous communication context associations are concatenated in chronological order to form a behavior chain that reflects the complete communication behavior pattern of the device. The integrity of the behavioral chain is verified to ensure the continuity of the time series and the validity of the contextual association.

6. A fingerprint identification system for cyberspace assets, characterized in that, include: The traffic capture module is used to capture network traffic in the target network and record four types of metadata based on the network traffic: timing, protocol, payload length and direction, to form an original fingerprint fragment. The feature processing module is used to construct time series from the three types of metadata in the original fingerprint fragment: time sequence, payload length, and direction. It then performs a Fast Fourier Transform on each constructed time series to convert the time-domain signal into a frequency-domain representation signal. An adaptive bandpass filter is applied to the frequency-domain representation signal to retain the device-specific frequency components and filter out network noise. Finally, a joint time-frequency domain analysis is performed on the filtered frequency-domain representation signal using wavelet transform. Multi-scale wavelet basis functions are used to extract frequency change patterns at different time scales, resulting in a device communication feature vector containing both transient and steady-state characteristics of the device communication. The dimensionality reduction module is used to reduce the dimensionality of device communication feature vectors to obtain fixed-length micro-signatures. This process includes: calculating the covariance matrix of the device communication feature vectors and solving for their eigenvectors and eigenvalues; sorting the feature vectors according to their eigenvalues ​​and calculating the cumulative contribution rate; determining the number of principal components k to be retained and their corresponding eigenvectors based on a preset cumulative contribution rate threshold; constructing a projection matrix W(e) based on the selected k eigenvectors; and projecting the device communication feature vectors onto the projection matrix W(e) to obtain the k-dimensional micro-signature. The clustering identification module is used to perform unsupervised dynamic clustering with the micro-signature as input to establish a device type identifier. The behavior chain construction module is used to group the micro-signatures according to the device type identifier, arrange the micro-signatures belonging to the same device at different time periods in chronological order, and concatenate the micro-signatures into a behavior chain based on communication context information, which includes communication object, session state, protocol type and port information. The secure output module is used to encrypt the device identifier and device type identifier to generate an anonymous device ID, securely encode the microsignature to obtain a secure microsignature, digest the behavior chain to obtain a behavior digest, and construct a triplet data structure containing the device ID, secure microsignature and behavior digest.

Images