Network security monitoring method based on hardware information analysis

Abstract

The invention discloses a network security monitoring method based on hardware information analysis, which belongs to the technical field of network security, and comprises the following steps: step S101, collecting hardware information and behavior characteristics of target equipment; step S102, calculating a user behavior similarity V according to the collected current behavior characteristics and stored historical behavior characteristics; s103, dynamically determining the number of features randomly selected from the hardware information and the behavior feature set according to the numerical range of the user behavior similarity V, and generating a high-dimensional composite fingerprint; step S104, sending a customized calculation challenge task to the target device; s105, when the target equipment is judged to be in the virtual simulation environment, network security early warning is triggered immediately; and step S106, regularly evaluating the credibility of each feature. According to the method, multiple hardware information and behavior characteristics can be comprehensively utilized, the camouflage attack can be identified more accurately, and the network security is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and particularly relates to a network security monitoring method based on hardware information analysis. BACKGROUND

[0002] With the rapid development of network technology, network security problems are increasingly prominent. Traditional network security monitoring methods mainly rely on software-level information such as IP addresses, port numbers, and traffic characteristics. However, these software information is easy to be tampered with, forged, or imitated, which limits the accuracy and reliability of security monitoring.

[0003] Existing hardware fingerprinting technology mostly relies on single hardware features such as MAC addresses and CPU serial numbers. Attackers can bypass security detection by virtualization technology or hardware simulation means to forge these features. In addition, existing behavior analysis methods often only focus on single behavior features of users, lack comprehensive analysis of multi-dimensional behavior features, and are difficult to accurately identify disguised attacks.

[0004] Therefore, the present application provides a network security monitoring method based on hardware information analysis to solve the problems raised in the background. SUMMARY

[0005] The present application aims to provide a network security monitoring method based on hardware information analysis, which can comprehensively utilize various hardware information and behavior features, more accurately identify disguised attacks, and improve network security to solve the problems raised in the background.

[0006] To achieve the above-mentioned purpose, the present application provides the following technical solutions: A network security monitoring method based on hardware information analysis, comprising the following steps: In step S101, the hardware information and behavior characteristics of the target device are collected by a probe deployed on the network side and an agent installed on the target device; the hardware information includes a unique device identifier, a physical characteristic identifier and a runtime behavior identifier, and the behavior characteristics include user login time period characteristics, operation habit characteristics and keyboard input habit characteristics; the unique device identifier is selected from at least five of a MAC address, a hard disk serial number, a CPU serial number, a motherboard serial number, a BIOS UUID and a TPM endorsement key; the physical characteristic identifier is selected from at least five of a clock bias value, a CPU power consumption fluctuation curve, a sensor noise fingerprint, an electromagnetic radiation characteristic and a heat power consumption characteristic; the runtime behavior identifier is selected from at least five of a CPU instruction execution timing, a memory access delay pattern, a cache hit rate statistic, a bus arbitration pattern and an interrupt response timing; the user login time period characteristics include a historical login time distribution curve and a current login time bias value; the operation habit characteristics include an application program startup sequence, a file access pattern and a mouse movement trajectory; and the keyboard input habit characteristics include a key duration distribution, a key interval time sequence and a shorthand typing pattern. In step S102, the user behavior similarity V is calculated according to the collected current behavior characteristics and the stored historical behavior characteristics. In step S103, the number of randomly selected features from the set of hardware information and behavior characteristics is dynamically determined according to the numerical range of the user behavior similarity V, and a high-dimensional composite fingerprint is generated. In step S104, a customized computing challenge task is sent to the target device, which requires specific hardware resources to cooperate to complete, including a floating point operation intensive task, a memory bandwidth test task and a parallel processing capability test task; at the same time, the response time, CPU occupancy rate, memory usage and power consumption change curve of the target device executing the challenge task are monitored, and these parameters are compared with the preset benchmark threshold value; if the response time exceeds 20% of the benchmark threshold value, the CPU occupancy rate abnormally fluctuates by more than 15%, the memory usage deviates from the benchmark value by 25% or the power consumption curve does not match the standard mode, the target device is determined to be a virtual simulation environment. In step S105, when the target device is determined to be a virtual simulation environment, a network security warning is triggered immediately, and all network traffic of the target device is redirected to a pre-constructed virtual operation environment; the virtual operation environment simulates the network service, file system and user interface of the real system, records the operation behavior of the attacker and traces the network source of the attacker. In step S106, the credibility of each feature is evaluated regularly, and when a feature is identified as fake, its weight is adjusted according to a weight update formula.

[0007] As a further scheme of the present application, the calculation formula of the similarity V is: ; wherein, S t represents a time similarity, obtained by calculating the Pearson correlation coefficient of the current login time and the historical login time distribution curve; S o represents an operation habit similarity, obtained by calculating the cosine similarity of the current operation sequence and the historical operation sequence; S k represents a keyboard input similarity, obtained by calculating the reciprocal of the dynamic time warping distance of the current typing interval time sequence and the historical sequence; w1, w2 and w3 are weight coefficients, and satisfy w1+w2+w3=1, wherein w1 takes a value of 0.3 to 0.5, w2 takes a value of 0.2 to 0.4, and w3 takes a value of 0.2 to 0.4; If V is greater than or equal to 90%, three features are randomly selected from all features to form a high-dimensional composite fingerprint; if 60%≤V<90%, five features are randomly selected from all features to form a high-dimensional composite fingerprint; if 30%≤V<60%, nine features are randomly selected from all features to form a high-dimensional composite fingerprint; if V is less than 30%, all features are fused to form a high-dimensional composite fingerprint; the generation of the high-dimensional composite fingerprint adopts a combination of feature vector splicing and hash mapping, the selected features are first converted into numerical vectors, then normalized, and finally a fixed-length fingerprint identifier is generated through the SHA-256 algorithm; The weight updating formula is specifically: ; wherein, W old represents the current weight of the feature, W new represents the updated weight, λ represents a decay factor, taking a value of 0.1 to 0.5, and C represents the number of times that the feature is marked as fake; for features with a weight lower than 0.1, the features are automatically removed from the feature set, and a new feature is randomly selected from the candidate feature library and added, the candidate feature library including GPU core frequency, sound card hardware identification and network interface card buffer size.

[0008] As a further scheme of the application: the specific process of collecting hardware information and behavior characteristics in the step S101 includes: Step S201, passively capturing network traffic of the target device in an agentless manner through a network detector, and parsing MAC address, IP address and device type information therefrom; Step S202, actively collecting hardware specific information of the target device in an agent-based manner through an agent program, including executing a bottom system command to obtain a hard disk serial number, a CPU serial number and a motherboard serial number, reading an endorsement key through a TPM interface, and obtaining noise data of an accelerometer and a gyroscope through a sensor driver; Step S203, monitoring the runtime behavior of the target device, recording the CPU instruction execution timing, memory access delay pattern and cache hit rate, and generating time series data; Step S204, capturing user login time, application usage sequence, file operation record and keyboard input event through user behavior monitoring tool, and transmitting these data to central analysis server in encrypted form; Step S205, data cleaning and formatting processing is performed on all collected hardware information and behavior characteristics, abnormal values and repeated data are removed, and numerical or categorical feature vectors are uniformly converted.

[0009] As a further scheme of the application: the specific steps of calculating the user behavior similarity V in step S102 include: Step S301, calculating time similarity S t : Extract the historical login time distribution curve, which is represented by the probability density function of the daily login time point in the past 30 days; map the current login time to the distribution curve, calculate the probability value of the current time point on the distribution curve, and normalize the probability value to a value between 0 and 1 as S t ; Step S302, calculating operation habit similarity S o : The current operation sequence is represented in vector form, where each dimension corresponds to the frequency of an application or system operation; similarly, the historical operation sequence is represented as a vector; the cosine similarity of the two vectors is calculated, and the result is taken as S o ; Step S303, calculating keyboard input similarity S k : Extract the key interval time sequence from the current keyboard input data, and calculate the dynamic time warping with the historical key interval time sequence to get the minimum path distance; take the reciprocal of the distance value and scale it to the range of 0 to 1 as S k ; Step S304, dynamically adjusting the weight coefficients w1, w2, w3 according to the user type and environment security level; for high security level environment, increase the weight of w1 to 0.5; for ordinary user environment, increase the weights of w2 and w3 to 0.4; Step S305, substituting the calculated S t , S o , S k and weight coefficients into the formula to get the user behavior similarity V, and store the calculation result for subsequent model training.

[0010] As a further scheme of the application: the specific process of generating high-dimensional composite fingerprint in step S103 includes: Step S401: After determining the number of randomly selected features based on the user behavior similarity V, features are selected from the hardware information and behavioral feature set using a weighted random sampling method, wherein the selection probability of each feature is proportional to its current weight. Step S402: Convert each selected feature into a numerical vector: For categorical features, such as device identifiers, use one-hot encoding for conversion; for numerical features, such as time series data, use Fourier transform to extract the main frequency components and generate a vector. Step S403: Normalize all feature vectors by scaling each vector to the [0,1] interval using the min-max normalization method. Step S404: The normalized feature vectors are concatenated into a high-dimensional vector in a predetermined order, and principal component analysis is performed on the high-dimensional vector to reduce its dimensionality, retaining the principal components with a variance contribution rate of more than 95%. Step S405: Input the dimensionality-reduced vector into the SHA-256 hash function to generate a high-dimensional composite fingerprint with a fixed length of 256 bits, and store the fingerprint in the fingerprint database in association with the device identifier.

[0011] As a further aspect of the present invention, the specific content and execution method of the authentication challenge task in step S104 include: Step S501: Based on the hardware type and historical performance data of the target device, dynamically generate customized computing tasks; for CPU-intensive devices, generate large-scale matrix multiplication tasks; for memory-intensive devices, generate random memory access test tasks; for GPU devices, generate parallel computing tasks. Step S502: Send the challenge task to the target device through a secure encrypted channel and start a high-performance timer to record the task start time; Step S503: After receiving the challenge task, the target device executes the task in an isolated environment and outputs the execution result; Step S504: Simultaneously monitor the system parameters of the target device when it is executing the task, including reading the number of CPU cycles, cache misses and branch prediction error rate through the performance counter, reading real-time power consumption data through the power management unit built into the target device, and reading memory allocation statistics through the operating system kernel. Step S505: The collected response time and resource consumption pattern are compared with the baseline threshold. The baseline threshold is obtained based on historical data statistics of similar real devices and the normal range is set using the 3σ principle. Any parameter exceeding the normal range will trigger a virtual environment suspicion flag.

[0012] As a further aspect of the present invention: the virtual operating environment construction and boot process in step S105 includes: Step S601: Create a completely isolated virtualization environment on the security server. This environment simulates the kernel, file system, network services, and user interface of a real operating system and is filled with fake business data and log information. Step S602: Deploy a honeypot system in a virtual operating environment to simulate network services such as HTTP, FTP and database services, and set up trap files to attract attackers; Step S603: When the target device is determined to be a virtual simulation environment, modify the routing table rules to redirect all IP packets of the target device to the network interface of the virtual operating environment. Step S604: Run the behavior analysis tool in the virtual operating environment to record all the attacker's operation commands, file access attempts and network scanning behavior, and extract the attack fingerprint; Step S605: Simultaneously initiate attack tracing by analyzing the TTL value, source IP address, and routing path of network packets to determine the geographical origin and network topology location of the attacker.

[0013] As a further aspect of the present invention: the periodic evaluation of the confidence level of each feature in step S106 specifically includes: Step S701: Regularly (every 24 hours) scan the feature database to check the latest usage records and validity flags for each feature; Step S702: When a feature is identified as forged in three consecutive authentication challenges, the forgery count C of the feature is increased by 1, and its weight is recalculated according to the weight update formula. Step S703: For features with a weight lower than 0.1, mark their status as "eliminated" and remove them from the current feature set; Step S704: Randomly select a new feature from the candidate feature library and add it to the feature set. Set the initial weight of the new feature to 0.5 and record the introduction time. Step S705: Conduct a comprehensive evaluation of the feature set every month, calculate the discrimination and stability index of each feature, eliminate features with index values ​​below the threshold, and introduce new alternative features.

[0014] As a further aspect of the present invention, it also includes a verification and update mechanism for high-dimensional composite fingerprints. Step S801: When the high-dimensional composite fingerprint is used for device authentication, the newly generated fingerprint is compared with the stored reference fingerprint, and the Hamming distance between the two is calculated. Step S802: If the Hamming distance is less than the threshold, the authentication is successful; if the Hamming distance is greater than or equal to the threshold, the secondary authentication process is triggered. Step S803, the secondary authentication process includes requiring the user to enter a dynamic verification code and re-collecting hardware information to generate a new fingerprint; Step S804: If authentication is successful, update the baseline fingerprint based on the newly generated fingerprint and smooth the fingerprint changes using the sliding window averaging method. Step S805: Clean up the fingerprint database regularly (weekly), remove fingerprint records that have not been used for a long time, and optimize the fingerprint index structure.

[0015] As a further aspect of this invention, it also includes an upgraded and response mechanism for network security early warning: Step S901: When a network security alert is triggered, different response measures are taken according to the alert level; Level 1 alerts only log and notify the administrator; Level 2 alerts automatically block suspicious network connections; Level 3 alerts activate the emergency response plan and isolate the affected network segments. Step S902: The warning level is dynamically adjusted according to the severity of the attack behavior, and the factors include the attack frequency, the credibility rating of the attack source, and the criticality of the attack target. Step S903: Simulate system failures and delayed responses in a virtual operating environment to extend the attacker's stay time and collect more evidence; Step S904: Record all warning events and response actions to the security incident management system and generate a detailed security report; Step S905: Review and optimize the early warning mechanism monthly, and adjust the early warning threshold and response strategy.

[0016] Compared with the prior art, the beneficial effects of the present invention are: This invention establishes a dynamic composite fingerprint system based on multi-source hardware information and behavioral characteristics, combined with proactive challenge authentication and intelligent feature management mechanisms, thereby transforming network security monitoring from passive defense to proactive awareness. Specifically, this application constructs a difficult-to-forge device identity authentication foundation, optimizes system performance while ensuring security through a behavioral similarity-adaptive feature selection mechanism, enhances threat countermeasure capabilities using virtual environment decoy technology, and ensures persistent protection effectiveness through a continuous feature optimization mechanism, ultimately forming a multi-layered, adaptive, and sustainably evolving comprehensive network security protection solution. Attached Figure Description

[0017] Figure 1 This is a flowchart of a network security monitoring method based on hardware information analysis. Detailed Implementation

[0018] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0019] As mentioned in the background section of this application, research has found that most existing hardware fingerprinting technologies rely on single hardware features, such as MAC addresses and CPU serial numbers. Attackers can forge these features using virtualization technology or hardware emulation to bypass security detection. Furthermore, existing behavioral analysis methods often focus only on single user behavioral characteristics, lacking comprehensive analysis of multi-dimensional behavioral features, making it difficult to accurately identify spoofing attacks, thus exhibiting certain shortcomings.

[0020] To address the aforementioned shortcomings, this application discloses a network security monitoring method based on hardware information analysis, which can comprehensively utilize various hardware information and behavioral characteristics to more accurately identify spoofing attacks and improve network security.

[0021] The following will describe in detail, with reference to the accompanying drawings, how the solution of this application solves the above-mentioned technical problems.

[0022] Please see Figure 1In this embodiment of the invention, a network security monitoring method based on hardware information analysis includes the following steps: Step S101, collecting hardware information and behavioral characteristics of the target device through a detector deployed on the network side and an agent program installed on the target device; the hardware information includes a unique device identifier, a physical characteristic identifier, and a runtime behavior identifier, and the behavioral characteristics include user login time period characteristics, operation habit characteristics, and keyboard input habit characteristics; wherein, the unique device identifier is selected from MAC address, hard disk serial number, CPU serial number, motherboard serial number, BIOS... At least five of the following are selected: UUID and TPM endorsement key; physical characteristic identifiers are selected from at least five of the following: clock skew value, CPU power consumption fluctuation curve, sensor noise fingerprint, electromagnetic radiation characteristics, and thermal power consumption characteristics; runtime behavior identifiers are selected from at least five of the following: CPU instruction execution timing, memory access latency pattern, cache hit rate statistics, bus arbitration mode, and interrupt response timing; user login time period characteristics include historical login time distribution curve and current login time skew value; operation habit characteristics include application startup sequence, file access pattern, and mouse movement trajectory; keyboard input habit characteristics include key duration distribution, key interval time sequence, and abbreviation typing pattern; step S102, calculate user behavior similarity V based on the collected current behavior characteristics and stored historical behavior characteristics; step S103, dynamically determine the number of features randomly selected from the hardware information and behavior feature set based on the numerical range of user behavior similarity V, and generate a high-dimensional composite fingerprint; step S104, send a customized fingerprint to the target device. The computational challenge task requires specific hardware resources to complete, including floating-point intensive tasks, memory bandwidth testing tasks, and parallel processing capability testing tasks. Simultaneously, the response time, CPU utilization, memory usage, and power consumption curves of the target device executing the challenge task are monitored, and these parameters are compared with preset benchmark thresholds. If the response time exceeds 20% of the benchmark threshold, the CPU utilization fluctuates abnormally by more than 15%, the memory usage deviates from the benchmark value by 25%, or the power consumption curve does not match the standard mode, the target device is determined to be a virtual simulation environment. In step S105, when the target device is determined to be a virtual simulation environment, a network security alert is immediately triggered, and all network traffic of the target device is redirected to a pre-built virtual operating environment. The virtual operating environment simulates the network services, file system, and user interface of a real system, while recording the attacker's operational behavior and tracing its network origin. In step S106, the credibility of each feature is periodically evaluated, and when a feature is identified as forged, its weight is adjusted according to a weight update formula. This application constructs a complete hardware information analysis network security monitoring system. Through the synergistic effect of multi-source information collection, behavior similarity calculation, dynamic fingerprint generation, proactive challenge authentication, and intelligent feature management, it achieves closed-loop security protection throughout the entire process from device identification and behavior analysis to threat response.This setup establishes an intelligent monitoring framework that can adaptively adjust security policies, ensuring the reliability of basic device authentication while enhancing the ability to respond to advanced threats through proactive defense mechanisms.

[0023] In this embodiment, the formula for calculating the similarity V is: Among them, S t The time similarity is represented by the Pearson correlation coefficient calculated from the distribution curves of the current login time and historical login times; S o The similarity of operational habits is represented by the cosine similarity between the current operation sequence and historical operation sequences; S k The similarity of keyboard input is represented by the reciprocal of the dynamic time-normalized distance between the current typing interval time series and the historical sequence. w1, w2, and w3 are weight coefficients, satisfying w1 + w2 + w3 = 1, where w1 ranges from 0.3 to 0.5, w2 from 0.2 to 0.4, and w3 from 0.2 to 0.4. If V ≥ 90%, three features are randomly selected from all features to form a high-dimensional composite fingerprint; if 60% ≤ V < 90%, five features are randomly selected from all features to form a high-dimensional composite fingerprint; if 30% ≤ V < 60%, nine features are randomly selected from all features to form a high-dimensional composite fingerprint; if V < 30%, all features are merged to form a high-dimensional composite fingerprint. The generation of the high-dimensional composite fingerprint uses a combination of feature vector concatenation and hash mapping. First, the selected features are converted into numerical vectors, then normalized, and finally, a fixed-length fingerprint identifier is generated using the SHA-256 algorithm. The specific weight update formula is as follows: Among them, W old W represents the current weight of the feature. new The updated weights are represented by λ, the decay factor ranging from 0.1 to 0.5, and C, which indicates the number of times the feature was flagged as forgery. Features with weights below 0.1 are automatically removed from the feature set, and new features are randomly selected from a candidate feature library, including GPU core frequency, sound card hardware identifier, and network interface card buffer size. A quantitative relationship between behavioral similarity and the number of selected features is established through mathematical modeling, and a dynamic update mechanism for feature weights is provided. This setup enables fine-grained control of security policies, optimizing system performance in high-confidence environments and enhancing security strength in low-confidence scenarios. Furthermore, the adaptive weight adjustment mechanism ensures continuous effectiveness against feature forgery attacks.

[0024] In this embodiment, the specific process of collecting hardware information and behavioral characteristics in step S101 includes: Step S201, passively capturing the network traffic of the target device in an agentless manner using a network detector, and parsing out the MAC address, IP address, and device type information; Step S202, actively collecting specific hardware information of the target device in an agent-assisted manner using an agent program, including executing low-level system commands to obtain the hard disk serial number, CPU serial number, and motherboard serial number, reading the endorsement key through the TPM interface, and obtaining noise data from the accelerometer and gyroscope through sensor drivers; Step S203, monitoring the runtime behavior of the target device, recording the CPU instruction execution timing, memory access latency pattern, and cache hit rate, and generating time series data; Step S204, capturing user login time, application usage sequence, file operation records, and keyboard input events through a user behavior monitoring tool, and encrypting and transmitting this data to the central analysis server; Step S205, performing data cleaning and formatting on all collected hardware information and behavioral characteristics, removing outliers and duplicate data, and uniformly converting them into numerical or categorical feature vectors. This setup establishes a hierarchical, multi-modal data acquisition system, achieving comprehensive capture of hardware information and behavioral characteristics through an organic combination of agentless and agent-based methods. It constructs a complete and reliable data foundation, ensuring both the diversity of feature sources and the accuracy and consistency of subsequent analysis through data cleaning and formatting.

[0025] In this embodiment, the specific steps for calculating the user behavior similarity V in step S102 include: step S301, calculating the time similarity S t Extract the historical login time distribution curve, which is represented by the probability density function of the daily login time points over the past 30 days; map the current login time onto this distribution curve, calculate the probability value of the current time point on the distribution curve, and normalize this probability value to a value between 0 and 1 as S. t Step S302: Calculate the similarity S of operating habits. o Represent the current operation sequence as a vector, where each dimension corresponds to the frequency of an application or system operation; similarly, represent the historical operation sequence as a vector; calculate the cosine similarity between the two vectors, and use the result as S. o Step S303: Calculate the keyboard input similarity S. k Extract the key press interval time series from the current keyboard input data, and perform dynamic time warping calculations with the historical key press interval time series to obtain the minimum path distance; take the reciprocal of the distance value and scale it to the range of 0 to 1, as S. kStep S304: Dynamically adjust the weight coefficients w1, w2, and w3 according to the user type and environmental security level; for high-security environments, increase the weight of w1 to 0.5; for ordinary user environments, increase the weights of w2 and w3 to 0.4; Step S305: Apply the calculated S... t S o S k Substituting the weight coefficients into the formula yields the user behavior similarity V, and the result is stored for subsequent model training. This setting provides a quantitative analysis method for multi-dimensional behavioral features, achieving accurate characterization of user behavior patterns through comprehensive evaluation of three dimensions: time, operating habits, and keyboard input. A reliable foundation for behavioral authentication is established, considering the differences in characteristics of various behavioral features while adapting to the needs of different security environments through a dynamic weight adjustment mechanism.

[0026] In this embodiment, the specific process of generating a high-dimensional composite fingerprint in step S103 includes: Step S401, after determining the number of randomly selected features based on the user behavior similarity V, selecting features from the hardware information and behavioral feature set using a weighted random sampling method, wherein the selection probability of each feature is proportional to its current weight; Step S402, converting each selected feature into a numerical vector: for categorical features, such as device identifiers, a one-hot encoding method is used for conversion; for numerical features, such as time-series data, Fourier transform is used to extract the main frequency components. The process involves generating a vector; step S403, normalizing all feature vectors by scaling each vector to the [0,1] interval using a min-max normalization method; step S404, concatenating the normalized feature vectors into a high-dimensional vector in a predetermined order, and performing principal component analysis to reduce the dimensionality of this high-dimensional vector, retaining principal components with a variance contribution rate exceeding 95%; step S405, inputting the dimensionality-reduced vector into the SHA-256 hash function to generate a high-dimensional composite fingerprint of fixed length 256 bits, and storing this fingerprint in a fingerprint database in association with the device identifier. This setup constructs an intelligent fingerprint generation pipeline, achieving efficient conversion from raw features to stable fingerprints through steps such as weighted sampling, vector transformation, normalization, and hash mapping. It ensures the uniqueness and stability of fingerprints, optimizing storage and computation efficiency through dimensionality reduction and ensuring fingerprint security and consistency through hash mapping.

[0027] In this embodiment, the specific content and execution method of the authentication challenge task in step S104 include: Step S501, dynamically generating customized computing tasks based on the hardware type and historical performance data of the target device; for CPU-intensive devices, generating large-scale matrix multiplication tasks; for memory-intensive devices, generating random memory access test tasks; for GPU devices, generating parallel computing tasks; Step S502, sending the challenge task to the target device through a secure encrypted channel and starting a high-performance timer to record the task start time; Step S503, after receiving the challenge task, the target device executes the task in an isolated environment and outputs the execution result; Step S504, simultaneously monitoring the system parameters of the target device when executing the task, including reading the number of CPU cycles, cache misses, and branch prediction error rate through performance counters, reading real-time power consumption data through the power management unit built into the target device, and reading memory allocation statistics through the operating system kernel; Step S505, comparing the collected response time and resource consumption patterns with a benchmark threshold, which is obtained based on historical data statistics of similar real devices and uses the 3σ principle to set the normal range; any parameter exceeding the normal range triggers a virtual environment suspicion flag. This setup incorporates a targeted hardware capability verification mechanism, achieving effective identification of the virtual environment through customized computational tasks and comprehensive performance monitoring. It provides in-depth hardware authenticity verification, considering the differences in characteristics between different hardware types and enhancing the accuracy and reliability of the detection through multi-parameter joint analysis.

[0028] In this embodiment, the construction and bootstrapping process of the virtual operating environment in step S105 includes: Step S601, creating a completely isolated virtualized environment on the security server. This environment simulates the kernel, file system, network services, and user interface of a real operating system and is filled with fake business data and log information; Step S602, deploying a honeypot system in the virtual operating environment to simulate network services such as HTTP, FTP, and database services, and setting trap files to attract attackers; Step S603, when the target device is determined to be a virtual simulation environment, modifying the routing table rules to redirect all IP packets of the target device to the network interface of the virtual operating environment; Step S604, running a behavioral analysis tool in the virtual operating environment to record all attacker operation commands, file access attempts, and network scanning behaviors, and extracting attack fingerprints; Step S605, simultaneously initiating attack tracing, determining the geographical origin and network topology location of the attacker by analyzing the TTL value, source IP address, and routing path of network packets. This setup establishes a complete proactive defense system, achieving effective trapping and analysis of attackers through virtual environment simulation, traffic redirection, and attack behavior recording. It provides a proactive threat response capability, protecting the security of real systems while creating favorable conditions for attack attribution and evidence collection.

[0029] In this embodiment, the periodic evaluation of the credibility of each feature in step S106 specifically includes: Step S701, periodically (every 24 hours) scanning the feature database to check the latest usage records and validity flags of each feature; Step S702, when a feature is identified as forged in three consecutive authentication challenges, the forgery count C of that feature is increased by 1, and its weight is recalculated according to the weight update formula; Step S703, for features with a weight lower than 0.1, their status is marked as "eliminated" and removed from the current feature set; Step S704, new features are randomly selected from the candidate feature library and added to the feature set, with the initial weight of the new features set to 0.5, and the introduction time is recorded; Step S705, a comprehensive evaluation of the feature set is conducted monthly, calculating the discriminative and stability indicators of each feature, eliminating features with indicator values ​​lower than the threshold, and introducing new candidate features. This setup constructs a continuously optimized feature management mechanism, achieving self-improvement of the feature set through periodic evaluation, weight adjustment, and feature updates. It ensures the long-term effectiveness of the evaluation, enabling both timely elimination of ineffective features and continuous introduction of new effective features to maintain protection capabilities.

[0030] This embodiment also includes a verification and update mechanism for high-dimensional composite fingerprints: Step S801, when the high-dimensional composite fingerprint is used for device authentication, the newly generated fingerprint is compared with the stored baseline fingerprint, and the Hamming distance between the two is calculated; Step S802, if the Hamming distance is less than a threshold, authentication is successful; if the Hamming distance is greater than or equal to the threshold, a secondary authentication process is triggered; Step S803, the secondary authentication process includes requiring the user to input a dynamic verification code and re-collecting hardware information to generate a new fingerprint; Step S804, if authentication is successful, the baseline fingerprint is updated according to the newly generated fingerprint, and the fingerprint change is smoothed using a sliding window averaging method; Step S805, the fingerprint database is cleaned periodically (weekly), removing long-term unused fingerprint records and optimizing the fingerprint index structure. This setting establishes a dual authentication guarantee mechanism, realizing closed-loop management of the authentication process through fingerprint comparison, secondary authentication, and baseline update. It provides a flexible and reliable authentication scheme, ensuring smooth access for normal devices while enhancing the review strength of suspicious devices through progressive authentication.

[0031] This embodiment also includes an upgrade and response mechanism for network security early warnings: Step S901, when a network security early warning is triggered, different response measures are taken according to the warning level; Level 1 warnings only log and notify the administrator; Level 2 warnings automatically block suspicious network connections; Level 3 warnings activate the emergency response plan and isolate the affected network segments; Step S902, the warning level is dynamically adjusted according to the severity of the attack behavior, factors including attack frequency, credibility rating of the attack source, and criticality of the attack target; Step S903, system failures and delayed responses are simulated in a virtual operating environment to extend the attacker's stay time and collect more evidence; Step S904, all early warning events and response actions are recorded in the security event management system, and a detailed security report is generated; Step S905, the early warning mechanism is reviewed and optimized monthly, and the early warning thresholds and response strategies are adjusted. This setup constructs a graded response early warning handling system, achieving precise handling of security events through level division, strategy adjustment, and effect evaluation. It provides a scientific and effective emergency response plan, avoiding resource waste caused by over-response while ensuring timely containment of serious threats.

[0032] This invention establishes a dynamic composite fingerprint system based on multi-source hardware information and behavioral characteristics, combined with proactive challenge authentication and intelligent feature management mechanisms, thereby transforming network security monitoring from passive defense to proactive awareness. Specifically, this application constructs a difficult-to-forge device identity authentication foundation, optimizes system performance while ensuring security through a behavioral similarity-adaptive feature selection mechanism, enhances threat countermeasure capabilities using virtual environment decoy technology, and ensures persistent protection effectiveness through a continuous feature optimization mechanism, ultimately forming a multi-layered, adaptive, and sustainably evolving comprehensive network security protection solution.

[0033] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

[0034] The above description is merely a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A network security monitoring method based on hardware information analysis, characterized by, The method comprises the following steps: Step S101, collecting hardware information and behavior characteristics of the target device through a probe deployed on the network side and an agent installed on the target device; The hardware information comprises a unique device identifier, a physical characteristic identifier and a runtime behavior identifier, and the behavior characteristics comprise user login time period characteristics, operation habit characteristics and keyboard input habit characteristics; Step S102, calculating a user behavior similarity V according to the collected current behavior characteristics and stored historical behavior characteristics; Step S103, dynamically determining the number of randomly selected features from the set of hardware information and behavior characteristics according to the numerical range of the user behavior similarity V, and generating a high-dimensional composite fingerprint; Step S104, sending a customized computing challenge task to the target device; at the same time, monitoring the response time, CPU occupancy rate, memory usage and power consumption change curve of the target device in executing the challenge task, and comparing these parameters with preset benchmark thresholds; if the response time exceeds 20% of the benchmark threshold, the CPU occupancy rate abnormally fluctuates by more than 15%, the memory usage deviates from the benchmark value by 25% or the power consumption curve does not match the standard mode, the target device is determined to be a virtual simulation environment; Step S105, when the target device is determined to be a virtual simulation environment, triggering a network security warning immediately, and redirecting all network traffic of the target device to a pre-constructed virtual operation environment; the virtual operation environment simulates the network service, file system and user interface of the real system, records the operation behavior of the attacker and traces the network source of the attacker; Step S106, periodically evaluating the credibility of each feature, and adjusting the weight of the feature according to a weight updating formula when the feature is identified as fake. 2.The network security monitoring method based on hardware information analysis of claim 1, wherein, The calculation formula of the similarity V is: ； wherein S t represents a time similarity, obtained by calculating a Pearson correlation coefficient of a current login time and a historical login time distribution curve; S o represents an operation habit similarity, obtained by calculating a cosine similarity of a current operation sequence and a historical operation sequence; S k represents a keyboard input similarity, obtained by calculating a reciprocal of a dynamic time warping distance of a current typing interval time sequence and a historical sequence; w1, w2, and w3 are weight coefficients, and satisfy w1+w2+w3=1, wherein w1 takes a value of 0.3 to 0.5, w2 takes a value of 0.2 to 0.4, and w3 takes a value of 0.2 to 0.

4. If V is greater than or equal to 90%, three features are randomly selected from all features to form a high-dimensional composite fingerprint; if 60%≤V<90%, five features are randomly selected from all features to form a high-dimensional composite fingerprint; if 30%≤V<60%, nine features are randomly selected from all features to form a high-dimensional composite fingerprint; if V is less than 30%, all features are fused to form a high-dimensional composite fingerprint; the generation of the high-dimensional composite fingerprint adopts a combination of feature vector splicing and hash mapping, the selected features are first converted into numerical vectors, then normalized, and finally a fixed-length fingerprint identifier is generated through the SHA-256 algorithm; The weight updating formula is specifically: ； wherein, W old represents the current weight of the feature, W new represents the updated weight, λ represents the decay factor, the value is 0.1 to 0.5, C represents the number of times the feature is marked as fake; for the feature whose weight is lower than 0.1, it is automatically removed from the feature set, and at the same time, a new feature is selected from the alternative feature library to join, the alternative feature library includes GPU core frequency, sound card hardware identification and network interface card buffer size.

3. The network security monitoring method based on hardware information analysis according to claim 2, characterized in that, The specific process of collecting hardware information and behavior characteristics in step S101 comprises: Step S201, passively capturing network traffic of the target device in a proxy-free manner through the network probe, and analyzing the MAC address, IP address and device type information therefrom; Step S202, actively collecting hardware specific information of the target device in a proxy manner through the agent, including executing a bottom system command to obtain a hard disk serial number, a CPU serial number and a motherboard serial number, reading an endorsement key through a TPM interface, and obtaining noise data of an accelerometer and a gyroscope through a sensor driver; Step S203, monitoring the runtime behavior of the target device, recording the CPU instruction execution timing, memory access delay pattern and cache hit rate, and generating time series data; Step S204, capturing user login time, application usage sequence, file operation record and keyboard input event through user behavior monitoring tool, and transmitting these data to central analysis server through encryption; Step S205, data cleaning and formatting processing is performed on all collected hardware information and behavior characteristics, abnormal values and repeated data are removed, and numerical or categorical feature vectors are uniformly converted.

4. The network security monitoring method based on hardware information analysis according to claim 3, characterized in that, The specific steps of calculating the user behavior similarity V in step S102 include: Step S301, calculate time similarity S t : extract the historical login time distribution curve, which is represented by the probability density function of the daily login time point in the past 30 days; map the current login time to the distribution curve, calculate the probability value of the current time point on the distribution curve, and normalize the probability value to a value between 0 and 1 as S t ; Step S302, calculate the operation habit similarity S o : represent the current operation sequence as a vector form, where each dimension corresponds to the frequency of an application or system operation; similarly, represent the historical operation sequence as a vector; calculate the cosine similarity of the two vectors, and take the result as S o ; Step S303, calculate the keyboard input similarity S k : Extract the key interval time sequence from the current keyboard input data, and calculate the dynamic time warping with the historical key interval time sequence to get the minimum path distance; take the reciprocal of the distance value and scale it to the range of 0 to 1 as S k ; Step S304, dynamically adjusting the weight coefficients w1, w2 and w3 according to the user type and environmental security level; for high security level environment, increase the weight of w1 to 0.5; for ordinary user environment, increase the weights of w2 and w3 to 0.4; Step S305, the calculated S t , S o , S k and the weight coefficient are substituted into the formula to obtain the user behavior similarity V, and the calculation result of this time is stored for subsequent model training.

5. The network security monitoring method based on hardware information analysis according to claim 4, characterized in that, The specific process of generating high-dimensional composite fingerprint in step S103 includes: Step S401, after determining the number of randomly selected features according to the user behavior similarity V, the weighted random sampling method is used to select features from the hardware information and behavior feature set, wherein the selection probability of each feature is proportional to its current weight; Step S402, convert each selected feature into a numerical vector; Step S403, normalize all feature vectors, and use the min-max normalization method to scale each vector to the [0, 1] interval; Step S404, concatenate the normalized feature vectors into a high-dimensional vector in a predetermined order, and perform principal component analysis dimension reduction on the high-dimensional vector, retaining principal components with a variance contribution rate of more than 95%; Step S405, input the reduced vector into the SHA-256 hash function to generate a high-dimensional composite fingerprint with a fixed length of 256 bits, and store the fingerprint in association with the device identifier in the fingerprint database.

6. The network security monitoring method based on hardware information analysis according to claim 5, characterized in that, The specific content and execution mode of the authentication challenge task in step S104 include: Step S501, dynamically generate customized computing tasks according to the hardware type and historical performance data of the target device; for CPU-intensive devices, generate large-scale matrix multiplication tasks; for memory-intensive devices, generate random memory access test tasks; for GPU devices, generate parallel computing tasks; Step S502, send the challenge task to the target device through a secure encryption channel, and start a high-performance timer to record the task start time; Step S503, after receiving the challenge task, the target device executes the task in an isolated environment and outputs the execution result; Step S504, monitor the system parameters of the target device while executing the task, including reading the CPU cycle number, cache miss number and branch prediction error rate through the performance counter, reading the real-time power consumption data through the power management unit built-in the target device, and reading the memory allocation statistics through the operating system kernel; Step S505, compare the collected response time and resource consumption pattern with the baseline threshold, which is based on the historical data statistics of similar real devices, and set the normal range using the 3σ principle; any parameter exceeding the normal range triggers the virtual environment suspicion flag.

7. The network security monitoring method based on hardware information analysis according to claim 6, characterized in that, The construction and booting process of the virtual operating environment in step S105 includes: Step S601, create a completely isolated virtualized environment on the security server, which simulates the kernel, file system, network service and user interface of the real operating system, and fills in false business data and log information; Step S602, deploy a honeypot system in the virtual operating environment, simulate network services and database services, and set up trap files to attract attackers; Step S603, when the target device is determined to be a virtual simulation environment, modify the routing table rules to redirect all IP packets of the target device to the network interface of the virtual operating environment; Step S604, run a behavior analysis tool in the virtual operating environment, record all operation commands, file access attempts and network scanning behaviors of the attacker, and extract attack fingerprints; Step S605, at the same time, start attack tracing, determine the geographical source and network topology location of the attacker by analyzing the TTL value, source IP address and routing path of the network packet.

8. The network security monitoring method based on hardware information analysis according to claim 7, characterized in that, The periodic evaluation of the credibility of each feature in step S106 specifically includes: Step S701, periodically scan the feature database to check the latest usage record and validity flag of each feature; Step S702, when a feature is identified as fake in three consecutive authentication challenges, increase the fake number C of the feature by 1, and recalculate its weight according to the weight update formula; Step S703, for features with a weight less than 0.1, mark their state as "eliminated" and remove them from the current feature set; Step S704, randomly select new features from the alternative feature library to join the feature set, set the initial weight of the new feature to 0.5, and record the introduction time; Step S705, perform a comprehensive evaluation of the feature set every month, calculate the discriminability and stability indicators of each feature, eliminate features with indicator values below the threshold, and introduce new alternative features.

9. The network security monitoring method based on hardware information analysis according to claim 8, characterized in that, It also includes verification and update mechanism of high-dimensional composite fingerprint: Step S801, when the high-dimensional composite fingerprint is used for device authentication, compare the newly generated fingerprint with the stored baseline fingerprint, and calculate the Hamming distance between them; Step S802, if the Hamming distance is less than the threshold, the authentication is passed; If the Hamming distance is greater than or equal to the threshold, trigger the secondary authentication process; Step S803, the secondary authentication process includes requiring the user to input a dynamic verification code and re-collect hardware information to generate a new fingerprint; Step S804, if the authentication is passed, update the baseline fingerprint according to the newly generated fingerprint, and use the sliding window average method to smooth the fingerprint changes; Step S805, periodically clean up the fingerprint database, remove long-term unused fingerprint records, and optimize the fingerprint index structure.

10. The network security monitoring method based on hardware information analysis according to claim 9, wherein, It also includes the escalation and response mechanism of network security warning: Step S901, when a network security alert is triggered, take different response measures according to the alert level; level one alert only records logs and notifies administrators; Level two alert automatically blocks suspicious network connections; Level three alert starts emergency response plan and isolates affected network segments; Step S902, the alert level is dynamically adjusted according to the severity of the attack behavior, including attack frequency, credibility rating of attack source and criticality of attack target; Step S903, simulate system failure and delayed response in virtual operating environment to prolong attacker's stay time and collect more evidence; Step S904, record all alert events and response actions to the security event management system and generate detailed security reports; Step S905, review and optimize the alert mechanism every month, adjust the alert threshold and response strategy.

Images