Multifunctional network access detection system supporting unified smart terminal operating system protocol

Abstract

This invention discloses a multi-functional network access detection system supporting unified smart terminal operating system protocols, relating to the field of network access detection. The system includes: retrieving historical application record data for operating system protocol types; statistically analyzing multiple historical application operating system protocol types and their frequencies; selecting a set of selected operating system protocol types whose historical application frequencies are greater than or equal to an application frequency threshold; traversing a set of traffic feature attributes, performing traffic feature discrete analysis to obtain a set of traffic feature attribute discrete coefficients; sorting the traffic feature attribute set from largest to smallest; and further sorting the selected operating system protocol type set until only one selected operating system protocol type remains, which is the operating system protocol identification result, and then performing a network access test. This system solves the problems of low network access detection efficiency, insufficient accuracy, and high risk of false positives and false negatives.

Description

Technical Field

[0001] This invention relates to the field of network access detection, and more specifically to a multifunctional network access detection system that supports a unified smart terminal operating system protocol. Background Technology

[0002] Smart terminal network access detection can effectively improve system security, protect information from threats, and ensure network stability and reliability.

[0003] Currently, compatibility detection is mainly achieved by matching the smart terminal operating system protocol with the network access detection strategy. However, due to the diverse traffic characteristics, the computing power requirement is high when analyzing the operating system protocol type, resulting in low identification efficiency.

[0004] In summary, existing technologies suffer from low identification efficiency due to the diverse characteristics of traffic flow attributes and the high computational demands required for operating system protocol type analysis. Summary of the Invention

[0005] This application provides a multi-functional network access detection system that supports the unified smart terminal operating system protocol. The purpose is to solve the technical problems in the prior art, such as the diversification of traffic characteristic attributes, which leads to low identification efficiency when analyzing operating system protocol types, and the large computing power requirements, which lead to low identification efficiency.

[0006] In view of the above problems, this application provides a multi-functional network access detection system that supports the unified smart terminal operating system protocol.

[0007] This application provides a multi-functional network access detection system that supports the unified smart terminal operating system protocol, including:

[0008] The historical data acquisition module is used to retrieve historical application record data of operating system protocol type for smart terminal models, and to count the operating system protocol type and frequency of multiple historical applications.

[0009] The operating system protocol type selection module is used to select a set of operating system protocol types whose historical application frequency is greater than or equal to the application frequency threshold from the multiple historical application operating system protocol types based on the multiple historical application frequencies;

[0010] The traffic feature attribute dispersion analysis module is used to traverse the traffic feature attribute set, perform traffic feature dispersion analysis on the selected operating system protocol type set, and obtain the traffic feature attribute dispersion coefficient set.

[0011] The traffic feature attribute sorting module is used to sort the traffic feature attribute set from largest to smallest according to the traffic feature attribute discrete coefficient set to obtain a traffic feature attribute sequence.

[0012] The operating system protocol type identification module is used to sequentially load the traffic detection features of the smart terminal model according to the traffic feature attribute sequence, sort the selected operating system protocol type set until only one selected operating system protocol type remains, output the operating system protocol identification result, and then perform network access test.

[0013] One or more technical solutions provided in this application have at least the following technical effects or advantages:

[0014] This application provides a multi-functional network access detection system that supports the unified smart terminal operating system protocol. By filtering historical data frequency and analyzing the dispersion coefficient of traffic characteristics, it quantitatively evaluates the degree of difference between each traffic characteristic attribute and different protocol types, identifies the most distinguishable traffic characteristic attributes, and can effectively distinguish different protocols. Then, based on the dispersion coefficient, the traffic characteristic attributes are sorted, and the traffic characteristic attributes with stronger separation ability are selected first for operating system protocol identification, avoiding parallel processing of multiple attribute traffic characteristics. Furthermore, through serialization intelligent sorting, the amount of data processed is gradually reduced, improving the efficiency of operating system protocol identification, and further achieving the technical effect of improving network access detection efficiency. Attached Figure Description

[0015] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0016] Figure 1 A schematic diagram of the structure of a multi-functional network access detection system that supports the unified smart terminal operating system protocol;

[0017] Figure 2 A flowchart illustrating the process of obtaining the discrete coefficient set of traffic characteristic attributes in a multi-functional network access detection system that supports the unified smart terminal operating system protocol.

[0018] In the attached diagram, the labels represent the following modules: historical data acquisition module; operating system protocol type selection module; traffic characteristic attribute dispersion analysis module; traffic characteristic attribute sorting module; and operating system protocol type identification module. Detailed Implementation

[0019] This application provides a multi-functional network access detection system that supports the unified smart terminal operating system protocol, which is used to address the problem of low identification efficiency in the prior art.

[0020] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0021] It should be noted that the terms "comprising" and "having" are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or server that includes a series of steps or units is not necessarily limited to those steps or units that are explicitly listed, but may include other steps or modules that are not explicitly listed or that are inherent to these processes, methods, products, or devices.

[0022] like Figure 1 As shown, this application provides a multi-functional network access detection system supporting the unified smart terminal operating system protocol, the system comprising:

[0023] Historical data acquisition module 11 is used to retrieve historical application record data of operating system protocol type of smart terminal model, and to count the operating system protocol type of multiple historical applications and the frequency of multiple historical applications.

[0024] This application discloses a preferred implementation method, which involves retrieving historical operation records of a specific smart terminal model from a database or log, including the operating system protocol types previously used by that model. The frequency of multiple historical applications for each protocol type is then counted. Here, historical application frequency refers to the number of times a quantifiable historical application has been used. The operating protocol type of the smart terminal model refers to a series of rules and standards followed by the smart terminal when exchanging data on a network.

[0025] This application's embodiments group historical application record data using a clustering algorithm. Clustering refers to an unsupervised machine learning process that automatically groups records with similar protocol characteristics into the same cluster. Clustering avoids the subjectivity and incompleteness of manual classification, providing a cleaned and well-organized high-quality data foundation for subsequent analysis.

[0026] In this embodiment, clustering is preferably used to count the frequency of historical applications, as detailed below:

[0027] In one embodiment, the historical data acquisition module 11 includes:

[0028] The historical application record data of the operating system protocol type is clustered by protocol type to obtain multi-cluster historical application operating system protocol type clustering results;

[0029] Traverse the clustering results of the multi-cluster historical application operating system protocol types, extract the protocol types, and set them as the multi-cluster historical application operating system protocol types;

[0030] Traverse the clustering results of the operating system protocol types of the multi-cluster historical applications, count the number of records within each cluster, and set this as the frequency of the multiple historical applications.

[0031] In this embodiment, the historical application record data of operating system protocol types is first clustered by protocol type to obtain multi-cluster historical application operating system protocol type clustering results. Protocol type clustering involves grouping the historical application record data using a clustering algorithm, with each cluster representing an operating system protocol type. The corresponding clusters, i.e., the application operating system protocol type clustering results, are obtained through protocol type clustering. Furthermore, the historical application record data count in this embodiment is at least 500. For example, 500 historical application record data are extracted from a smart terminal Bluetooth speaker and clustered by protocol type, resulting in 3 clusters.

[0032] Secondly, all clusters are traversed, and protocol type identifiers are extracted from each cluster. Protocol type extraction is then performed, and the extracted types are stored as multiple historical application operating system protocol types. These historical application operating system protocol types represent the types of historical application operating system protocols used by the smart terminal, such as HTTP / 2 and CoAP. For example, the historical application operating system protocol types HTTP / 2, CoAP, and adaptive protocols are obtained.

[0033] Finally, for each cluster, the number of records within the cluster is counted as the historical application frequency for the corresponding protocol type. The historical application frequency refers to the number of times a quantifiable historical application has been used.

[0034] For example, by counting the number of records in three clusters, we can obtain multiple historical application frequencies of 200 times, 270 times, 30 times, etc.

[0035] In this embodiment, clustering is used to group objects in the dataset based on application frequency statistics. This results in high similarity among objects within the same group and low similarity among objects in different groups. Similar groups are automatically discovered based on features in the records, avoiding manual classification and enabling rapid and accurate identification of operating system protocol types. This ensures compatibility and security while improving statistical accuracy. Compared to existing technologies, this application uses protocol type clustering of historical application record data based on operating system protocol types to provide a high-quality data foundation for subsequent analysis, ensuring the reliability of the starting point of the entire identification process.

[0036] The operating system protocol type selection module 12 is used to select a set of operating system protocol types whose historical application frequency is greater than or equal to the application frequency threshold from the multiple historical application operating system protocol types based on the multiple historical application frequencies.

[0037] In this embodiment, the application frequency threshold is used to determine whether the selected operating system protocol is used occasionally. If the historical application frequency is greater than or equal to the application frequency threshold, the operating system protocol type can be identified as not used occasionally, and then it is added to the selected operating system protocol type set; otherwise, the selected operating system protocol is identified as used occasionally, and then it is refused to be added to the selected operating system protocol type set.

[0038] Preferably, to avoid missing operating system protocol types, the application frequency threshold should not be too large. It should be configured independently according to the actual business scenario. If the user does not configure it, the default value is 100 times.

[0039] By selecting a set of operating system protocol types and excluding occasionally used types, unnecessary calculations can be avoided, thus improving the efficiency of operating system protocol type identification. This ensures that subsequent operating system protocol type identification excludes occasionally used or unrepresentative types, improving subsequent processing efficiency and guaranteeing the relevance and practicality of the identified targets.

[0040] The traffic feature attribute dispersion analysis module 13 is used to traverse the traffic feature attribute set, perform traffic feature dispersion analysis on the selected operating system protocol type set, and obtain the traffic feature attribute dispersion coefficient set.

[0041] like Figure 2 As shown in this embodiment, traffic feature discrete analysis is performed on a selected set of operating system protocol types to obtain a set of traffic feature attribute discrete coefficients. These traffic features include, but are not limited to, protocol features, deep packet inspection, and behavioral pattern analysis. Protocol features include IP header protocol type, port number, deep packet inspection includes URL and command format, and behavioral pattern analysis includes connection duration, frequency, and packet size distribution. Discrete analysis refers to a statistical analysis method that evaluates feature discrimination power through similarity calculation. By using the traffic feature attribute discrete coefficients, the traffic features that best distinguish operating system protocols are found. Using the traffic feature attribute discrete coefficients can improve the speed of selecting operating system protocol identification features, achieving efficient operating system protocol identification.

[0042] In one embodiment, the traffic characteristic attribute dispersion analysis module 13 obtains a set of traffic characteristic attribute dispersion coefficients through traffic characteristic dispersion analysis, as detailed below:

[0043] Extract the first traffic feature attribute from the traffic feature attribute set;

[0044] For the selected set of operating system protocol types, perform pairwise similarity evaluation of the first traffic feature attributes to obtain several first traffic feature attribute similarities;

[0045] The percentage of the number of first traffic feature attribute similarities less than or equal to the traffic feature attribute similarity threshold is calculated and set as the first traffic feature attribute discrete coefficient, and added to the traffic feature attribute discrete coefficient set.

[0046] Specifically, for the selected set of operating system protocol types, pairwise similarity evaluation of the first traffic feature attributes is performed to obtain several first traffic feature attribute similarities, including:

[0047] Extract the first selected operating system protocol type and the second selected operating system protocol type from the selected set of operating system protocol types;

[0048] Extract the first traffic feature value of the first traffic feature attribute of the first selected operating system protocol type;

[0049] Extract the second traffic feature value of the first traffic feature attribute of the second selected operating system protocol type;

[0050] The first traffic feature value and the second traffic feature value are compared to obtain the first traffic feature attribute similarity, and then added to the plurality of first traffic feature attribute similarities.

[0051] Specifically, the first traffic feature attribute is an exemplary traffic feature attribute extracted from the traffic feature attribute set. Taking it as an example, the process of determining the discrete coefficient of each traffic feature attribute in the traffic feature attribute set is explained in detail below:

[0052] First, it is necessary to analyze the similarity of the first traffic feature attributes between each pair of selected operating system protocol types in the selected operating system protocol type set, and store them as several first traffic feature attribute similarities. The detailed process of pairwise similarity evaluation is as follows:

[0053] Taking the first and second selected operating system protocol types randomly extracted from the selected set of operating system protocol types as an example, the similarity evaluation process is illustrated.

[0054] The first traffic characteristic value refers to the recorded characteristic value of the first traffic characteristic attribute in the first selected operating system protocol type; the second traffic characteristic value refers to the recorded characteristic value of the first traffic characteristic attribute in the second selected operating system protocol type.

[0055] Then, the first traffic feature value and the second traffic feature value are compared, and their similarity is calculated. This similarity is set as the similarity between the first selected operating system protocol type, the second selected operating system protocol type and the first traffic feature attribute.

[0056] Following the same algorithm, the similarity of the first traffic feature attributes of other selected operating system protocol type combinations is analyzed. When all pairwise combinations are analyzed, the output is a number of first traffic feature attribute similarities.

[0057] Furthermore, the proportion of traffic feature attribute similarities less than or equal to a traffic feature attribute similarity threshold among several first traffic feature attribute similarities is statistically analyzed and set as the first traffic feature attribute dispersion coefficient, which is then added to the traffic feature attribute dispersion coefficient set. The traffic feature attribute similarity threshold is a preset standard value that can be compared with the calculated traffic feature attribute similarities; the similarity value is typically between 0 and 1.

[0058] For example, with a traffic feature attribute similarity threshold of 0.75, a total of 100 traffic feature attribute similarities were obtained in the first traffic feature attribute similarity test. The number of traffic feature attribute similarities for selected operating system protocol A was found to be less than or equal to the traffic feature attribute similarity threshold, with 55 of them being less than or equal to the threshold. Similarly, the number of traffic feature attribute similarities for selected operating system protocol B was found to be less than or equal to the threshold, with the first traffic feature attribute dispersion coefficients being 55 / 100 = 0.55 and 60 / 100 = 0.6, respectively. A traffic feature attribute similarity greater than the threshold indicates that the distinction between selected operating system protocol types within the selected operating system protocol type set is not accurate enough. Using this traffic feature attribute to determine the selected operating system protocol type may not be clear or accurate enough. If this traffic feature attribute is used for classification, it can cause detection difficulties during network access detection, easily leading to misidentification and potentially abnormal results. Therefore, when identifying the selected operating system protocol type, it is necessary to distinguish the traffic feature attribute with higher similarity and the first traffic feature attribute dispersion coefficient that is less than the similarity threshold of the traffic feature attribute to ensure the identification effect of the selected operating system protocol type and improve the identification efficiency.

[0059] Wherein, the first traffic feature value and the second traffic feature value are compared for similarity to obtain the first traffic feature attribute similarity, including:

[0060] When the first traffic feature attribute is a type attribute, if the first traffic feature value is the same as the second traffic feature value, the similarity of the first traffic feature attribute is equal to 1; otherwise, the similarity of the first traffic feature attribute is equal to 0.

[0061] Specifically, if the first traffic feature attribute is a type attribute, then the similarity is calculated as a binary value: if the values ​​are the same, the similarity is 1; otherwise, it is 0. If the first traffic feature value is the same as the second traffic feature value, the similarity of the first traffic feature attribute is equal to 1; otherwise, the similarity of the first traffic feature attribute is equal to 0.

[0062] For example, the first traffic characteristic attribute is a type attribute, such as the IP header protocol type. If the IP header protocol type of operating system protocol A is different from the IP header protocol type of operating system protocol B, then the similarity is 0.

[0063] Wherein, the first traffic feature value and the second traffic feature value are compared for similarity to obtain the first traffic feature attribute similarity, including:

[0064] When the first flow feature attribute is a quantitative attribute, calculate twice the product of the first flow feature value and the second flow feature value, and then add it to a preset small constant to set as the first similarity evaluation parameter;

[0065] Calculate the sum of the squares of the first flow characteristic value and the second flow characteristic value, and then add it to a preset small constant to set as the second similarity evaluation parameter;

[0066] Calculate the ratio of the first similarity evaluation parameter to the second similarity evaluation parameter, and set it as the first traffic feature attribute similarity.

[0067] To address the aforementioned issues, this application performs a similarity comparison between the first traffic feature value and the second traffic feature value to obtain the similarity of the first traffic feature attributes.

[0068] The traffic feature attribute is an exemplary quantitative attribute. Taking it as an example, the similarity comparison between the first traffic feature value and the second traffic feature value is explained to obtain the similarity of the first traffic feature attribute, as detailed below:

[0069] When the quantified attribute of the first traffic feature is connection duration, calculate twice the product of the first traffic feature value and the second traffic feature value, and then add it to a preset small constant as the first similarity evaluation parameter. Similarity = [2 × (first traffic feature value × second traffic feature value) + preset small constant], where the preset small constant can be 0.000001.

[0070] The first and second traffic features of operating system protocol A are selected as 7s and 6s, respectively. Their similarity is [2×(7×6)+0.001]=84.000001, and the first similarity evaluation parameter is 84.000001.

[0071] Furthermore, the sum of the squares of the first flow characteristic value and the second flow characteristic value is calculated, and then added to a preset small constant, which is set as the second similarity evaluation parameter.

[0072] For example, the second similarity evaluation parameter of the operating system protocol is selected as (7) 2 +6 2 +0.001) = 85.000001.

[0073] Furthermore, the ratio of the first similarity evaluation parameter to the second similarity evaluation parameter is calculated and set as the first traffic feature attribute similarity. The similarity obtained by quantifying the first similarity evaluation parameter can be widely used for network traffic feature comparison. Specifically, the first traffic feature attribute similarity = first similarity evaluation parameter / second similarity evaluation parameter. The larger the first traffic feature attribute similarity, the more likely the operating system protocols are of the same type, making network access detection easier and more efficient.

[0074] For example, the similarity of the first traffic feature attribute of the operating system protocol is selected as 84.000001 / 85.000001≈0.99, which indicates a high similarity.

[0075] In this embodiment, a first set of traffic feature attributes is constructed. For each attribute in the first set of traffic feature attributes, a coefficient of variation in a selected protocol type set is calculated. The coefficient of variation is then used to measure the degree of variation of attribute values ​​across different protocol types. The higher the coefficient of variation of a traffic feature attribute, the better that attribute can distinguish different protocol types. Through adaptive traffic feature discrete analysis, the coefficient of variation of traffic feature attributes is obtained to distinguish different protocol types. By using the coefficient of variation of traffic feature attributes, the traffic feature that best distinguishes protocols is found, realizing intelligent detection capabilities and facilitating subsequent network access detection.

[0076] The traffic feature attribute sorting module 14 is used to sort the traffic feature attribute set from largest to smallest according to the traffic feature attribute discrete coefficient set to obtain a traffic feature attribute sequence.

[0077] In this embodiment, the magnitudes of the discrete coefficients of traffic feature attributes are arranged to obtain a sequence of traffic feature attributes, so that traffic feature attributes with strong distinguishing ability are used first, thereby achieving efficient identification of protocol types, improving network access detection efficiency, and reducing false identification.

[0078] The operating system protocol type identification module 15 is used to sequentially load the traffic detection features of the smart terminal model according to the traffic feature attribute sequence, sort the selected operating system protocol type set until only one selected operating system protocol type remains, output the operating system protocol identification result, and then perform network access test.

[0079] Specifically, the larger the dispersion coefficient of the traffic characteristic attribute, the easier it is to distinguish the operating protocol type through that attribute. Therefore, the classification is performed layer by layer from largest to smallest. According to the traffic characteristic attribute sequence, the traffic detection features of the smart terminal model are loaded sequentially until a selected operating system protocol type is obtained, and the output is the operating system protocol identification result. Among these, network access testing refers to customized security testing performed based on the identification result.

[0080] The network access tests performed may include: protocol compliance testing, security vulnerability and threat detection, stability testing, and network management compliance testing. Protocol compliance testing verifies the terminal device's adherence to the protocol standard, preventing network compatibility issues caused by non-compliance; security vulnerability and threat detection identifies potential security risks arising from protocol implementation; stability testing ensures the network stability of the terminal device; and network management compliance testing ensures that malicious data is not transmitted. By deploying corresponding network access testing methods for different protocol types, when the protocol type is accurately identified, network access testing strategies can be directly configured for the smart terminal. Based on the aforementioned highly efficient protocol type identification methods, the overall efficiency of network access testing is improved.

[0081] In one embodiment, the operating system protocol type identification module 15 outputs the operating system protocol identification result and performs the network access test, including:

[0082] Extract the k-th sequence of traffic feature attributes from the traffic feature attribute sequence. The initial value of k is equal to 1, and k is an integer.

[0083] Based on the kth sequence number of the traffic feature attribute, extract the kth attribute traffic detection feature from the traffic detection feature;

[0084] From the selected set of operating system protocol types, extract the k-level sorted set of operating system protocol types with the k-th attribute traffic detection feature;

[0085] When the number of operating system protocol type sets in the k-level sorting is equal to 1, the output is the operating system protocol identification result;

[0086] When the number of operating system protocol type sets in the k-level sorting is greater than 1, k+1 executes the sorting loop.

[0087] To address the aforementioned issues, this application sequentially loads the traffic detection features of the smart terminal model according to the traffic feature attribute sequence, sorts the selected operating system protocol type set until only one selected operating system protocol type remains, outputs the operating system protocol identification result, and then performs network access testing.

[0088] Specifically, from the sequence of traffic feature attributes, the k-th traffic feature attribute is extracted, with k initially set to 1 (where k is an integer). Extraction of the sequence's traffic feature attributes begins from k=1, thus quickly narrowing down the scope through priority attributes and reducing computational load.

[0089] For example, k=3, extract the third sequence of traffic feature attributes from the traffic feature attribute sequence.

[0090] Furthermore, based on the k-th sequence traffic feature attribute, the k-th attribute traffic detection feature is extracted from the traffic detection features. The traffic detection feature of this attribute, i.e., the actual data, is obtained from the traffic feature attribute and used for selected operating system protocol type detection.

[0091] For example, by extracting the third attribute traffic detection feature, the IP header protocol type is found to be DSCP.

[0092] Furthermore, from the selected set of operating system protocol types, a k-level sorted set of operating system protocol types with the k-th attribute traffic detection feature is extracted. From the selected set of operating system protocol types, a k-level sorted set of operating system protocol types with the IP header protocol type traffic detection feature is extracted, and protocol type set filtering is performed, retaining only protocol types that match the k-th attribute traffic detection feature. If a selected operating protocol within the selected set of operating system protocol types meets the traffic detection feature value range of the k-th attribute traffic detection feature, it is considered a match and can be filtered out. If it does not belong to this set, it is considered a mismatch and will not be filtered out.

[0093] For example, the IP header protocol types of the selected operating system protocol type set include [DSCP, ECN, ECN], and the IP header protocol type DSCP is retained based on the traffic detection feature of the third attribute.

[0094] Furthermore, when the number of operating system protocol type sets in the k-level sorting is equal to 1, the output is the operating system protocol identification result.

[0095] For example, the number of obtained 3-level sorting operating system protocol type sets is 1, and the output operating system protocol type identification result is CoAP.

[0096] Furthermore, when the number of operating system protocol type sets in k-level sorting is greater than 1, a sorting loop is executed according to k+1 to continue sorting until the number of operating system protocol type sets in sorting is equal to 1, and the recognition result is output.

[0097] For example, if the IP header protocol types of the selected operating system protocol type set include [DSCP, DSCP, ECN, ECN], then a 4-level sorting process is performed, repeating the previous sorting process. Finally, the number of operating system protocol type sets is 1, and the output operating system protocol type identification result is CoAP.

[0098] In one embodiment, the operating system protocol type identification module 15 further includes:

[0099] When the number of operating system protocol type sets in the k-level sorting system is equal to 0, an identification anomaly prompt message is generated.

[0100] Specifically, when the number of operating system protocol type sets in the k-level sorting is equal to 0, it means that no system protocol type exists and there is an anomaly in the identification of system protocol type. In this case, an identification anomaly prompt message, log warning or user notification will be generated to prompt the operation and maintenance personnel to perform equipment maintenance.

[0101] For example, when the number of operating system protocol type sets in the 3-level sorting is equal to 0, the system generates the prompt "Unable to recognize operating system protocol type, please check the device or update the protocol library".

[0102] In this embodiment, accurate protocol identification is achieved through serialization sorting. Sorting is performed according to traffic characteristic attribute sequences, and network access testing is executed. By constructing a sorting loop, accurate protocol identification is ensured with minimal detection steps, while providing accurate input for subsequent targeted security testing. Additionally, abnormal identification alerts can be generated, facilitating rapid manual intervention, analysis of unknown protocols, or troubleshooting of equipment malfunctions, ensuring system security and maintaining stable operation. While achieving the ultimate goal of protocol identification, this provides crucial support for the network access testing process.

[0103] The embodiments of this application, through the specific implementation methods described above, achieve the following technical effects:

[0104] In this embodiment, the historical data acquisition module 11 first acquires historical operation records for a specific smart terminal model. The historical application record data based on operating system protocol types are then clustered by protocol type to obtain multi-cluster historical application operating system protocol type clustering results. The multi-cluster historical application operating system protocol type clustering results are then iterated through to extract the protocol type. Finally, the number of records within each cluster is counted to determine the frequency of multiple historical applications. This rapid and accurate identification of operating system protocol types ensures compatibility and security while improving statistical accuracy.

[0105] Secondly, the operating system protocol type selection module 12 selects operating system protocols whose historical application frequency is greater than or equal to an application frequency threshold from multiple historical application operating system protocol types based on multiple historical application frequencies, and integrates them to obtain a set of selected operating system protocol types. If the historical application frequency is greater than or equal to the application frequency threshold, the selected operating system protocol can be identified as frequently used, which helps to reduce the amount of computation in subsequent processing.

[0106] Next, the traffic feature attribute dispersion analysis module 13 constructs a first traffic feature attribute set. For each attribute in the first traffic feature attribute set, the dispersion coefficient in the selected protocol type set is calculated. The dispersion coefficient is then used to measure the degree of variation of attribute values ​​among different protocol types. The higher the dispersion coefficient of a traffic feature attribute, the better that attribute can distinguish different protocol types. Through adaptive traffic feature dispersion analysis, the traffic feature attribute dispersion coefficient is obtained and used to distinguish different protocol types. By using the traffic feature attribute dispersion coefficient, the traffic feature that can best distinguish protocols is found, realizing intelligent detection capabilities and facilitating subsequent network access detection. In addition, the traffic feature attribute sorting module 14 sorts the traffic feature attribute dispersion coefficients in the traffic feature attribute dispersion coefficient set to obtain a traffic feature attribute sequence, giving priority to traffic feature attributes with strong distinguishing capabilities, achieving efficient identification of protocol types, improving network access detection efficiency, and reducing false identification.

[0107] Finally, the operating system protocol type identification module 15 sorts the selected set of operating system protocol types according to the traffic characteristic attribute sequence. When only one operating system protocol type is selected, the operating system protocol identification result is output, and then the network access test is performed. If the candidate set is empty during the sorting process, an identification anomaly prompt can be generated proactively, facilitating quick manual intervention, analysis of unknown protocols, or troubleshooting of equipment faults, maintaining stable operation, avoiding attacks from unknown protocols or causing equipment failures, ensuring security, and improving the detection effect of network access testing.

[0108] It should be noted that the order of the embodiments described above is merely for descriptive purposes and does not represent the superiority or inferiority of the embodiments. Furthermore, the above description focuses on specific embodiments of this specification. Additionally, the processes depicted in the accompanying drawings do not necessarily require a specific or sequential order to achieve the desired results. In some implementations, multitasking and parallel processing are possible or may be advantageous.

[0109] The above description is only a preferred embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A multi-functional network access detection system supporting a unified smart terminal operating system protocol, characterized in that: include: The historical data acquisition module is used to retrieve historical application record data of operating system protocol type for smart terminal models, and to count the operating system protocol type and frequency of multiple historical applications. The operating system protocol type selection module is used to select a set of operating system protocol types whose historical application frequency is greater than or equal to the application frequency threshold from the multiple historical application operating system protocol types based on the multiple historical application frequencies; The traffic feature attribute dispersion analysis module is used to traverse the traffic feature attribute set, perform traffic feature dispersion analysis on the selected operating system protocol type set, and obtain the traffic feature attribute dispersion coefficient set. The traffic feature attribute sorting module is used to sort the traffic feature attribute set from largest to smallest according to the traffic feature attribute discrete coefficient set to obtain a traffic feature attribute sequence. The operating system protocol type identification module is used to sequentially load the traffic detection features of the smart terminal model according to the traffic feature attribute sequence, sort the selected operating system protocol type set until only one selected operating system protocol type remains, output the operating system protocol identification result, and then perform network access test.

2. The multi-functional network access detection system supporting the unified smart terminal operating system protocol as described in claim 1, characterized in that, Retrieve historical application records for operating system protocol types of smart terminal models, and statistically analyze the operating system protocol types and frequencies of multiple historical applications, including: The historical application record data of the operating system protocol type is clustered by protocol type to obtain multi-cluster historical application operating system protocol type clustering results; Traverse the clustering results of the multi-cluster historical application operating system protocol types, extract the protocol types, and set them as the multi-cluster historical application operating system protocol types; Traverse the clustering results of the operating system protocol types of the multi-cluster historical applications, count the number of records within each cluster, and set this as the frequency of the multiple historical applications.

3. The multi-functional network access detection system supporting the unified smart terminal operating system protocol as described in claim 1, characterized in that, Traverse the traffic feature attribute set, perform traffic feature discretization analysis on the selected operating system protocol type set, and obtain the traffic feature attribute discretization coefficient set, including: Extract the first traffic feature attribute from the traffic feature attribute set; For the selected set of operating system protocol types, perform pairwise similarity evaluation of the first traffic feature attributes to obtain several first traffic feature attribute similarities; The percentage of the number of first traffic feature attribute similarities less than or equal to the traffic feature attribute similarity threshold is calculated and set as the first traffic feature attribute discrete coefficient, and added to the traffic feature attribute discrete coefficient set.

4. The multi-functional network access detection system supporting the unified smart terminal operating system protocol as described in claim 3, characterized in that, For the selected set of operating system protocol types, perform pairwise similarity evaluation of the first traffic feature attributes to obtain several first traffic feature attribute similarities, including: Extract the first selected operating system protocol type and the second selected operating system protocol type from the selected set of operating system protocol types; Extract the first traffic feature value of the first traffic feature attribute of the first selected operating system protocol type; Extract the second traffic feature value of the first traffic feature attribute of the second selected operating system protocol type; The first traffic feature value and the second traffic feature value are compared to obtain the first traffic feature attribute similarity, and then added to the plurality of first traffic feature attribute similarities.

5. The multi-functional network access detection system supporting the unified smart terminal operating system protocol as described in claim 4, characterized in that, A similarity comparison is performed between the first traffic feature value and the second traffic feature value to obtain the similarity of the first traffic feature attribute, including: When the first traffic feature attribute is a type attribute, if the first traffic feature value is the same as the second traffic feature value, the similarity of the first traffic feature attribute is equal to 1; otherwise, the similarity of the first traffic feature attribute is equal to 0.

6. The multi-functional network access detection system supporting the unified smart terminal operating system protocol as described in claim 4, characterized in that, A similarity comparison is performed between the first traffic feature value and the second traffic feature value to obtain the similarity of the first traffic feature attribute, including: When the first flow feature attribute is a quantitative attribute, calculate twice the product of the first flow feature value and the second flow feature value, and then add it to a preset small constant to set as the first similarity evaluation parameter; Calculate the sum of the squares of the first flow characteristic value and the second flow characteristic value, and then add it to a preset small constant to set as the second similarity evaluation parameter; Calculate the ratio of the first similarity evaluation parameter to the second similarity evaluation parameter, and set it as the first traffic feature attribute similarity.

7. The multi-functional network access detection system supporting the unified smart terminal operating system protocol as described in claim 1, characterized in that, According to the traffic characteristic attribute sequence, the traffic detection features of the smart terminal model are loaded sequentially, and the selected operating system protocol type set is sorted until only one selected operating system protocol type remains. The output is the operating system protocol identification result, including: From the traffic feature attribute sequence, extract the k-th sequence traffic feature attribute, where k is initially equal to 1 and is an integer; based on the k-th sequence traffic feature attribute, extract the k-th attribute traffic detection feature from the traffic detection features; From the selected set of operating system protocol types, extract the k-level sorted set of operating system protocol types with the k-th attribute traffic detection feature; When the number of operating system protocol type sets in the k-level sorting is equal to 1, the output is the operating system protocol identification result; When the number of operating system protocol type sets in the k-level sorting is greater than 1, k+1 executes the sorting loop.

8. The multi-functional network access detection system supporting the unified smart terminal operating system protocol as described in claim 7, characterized in that, Also includes: When the number of operating system protocol type sets in the k-level sorting system is equal to 0, an identification anomaly prompt message is generated.

Images