A network security monitoring method based on hardware information analysis

Abstract

The application discloses a network security monitoring method based on hardware information analysis and belongs to the technical field of network security, and comprises the following steps: in step S101, hardware information and behavior characteristics of a target device are collected; in step S102, a user behavior similarity V is calculated according to the current behavior characteristics collected and the historical behavior characteristics stored; in step S103, the number of randomly selected characteristics from the hardware information and behavior characteristic set is dynamically determined according to the numerical range of the user behavior similarity V, and a high-dimensional composite fingerprint is generated; in step S104, a customized calculation challenge task is sent to the target device; in step S105, when the target device is determined to be a virtual simulation environment, a network security early warning is immediately triggered; and in step S106, the credibility of each characteristic is regularly evaluated. According to the application, various hardware information and behavior characteristics can be comprehensively utilized, pseudo attack can be more accurately identified, and network security is improved.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically a network security monitoring method based on hardware information analysis. Background Technology

[0002] With the rapid development of network technology, network security issues are becoming increasingly prominent. Traditional network security monitoring methods mainly rely on software-level information, such as IP addresses, port numbers, and traffic characteristics. However, this software information is easily tampered with, forged, or imitated, which limits the accuracy and reliability of security monitoring.

[0003] Most existing hardware fingerprinting technologies rely on single hardware features, such as MAC addresses and CPU serial numbers. Attackers can forge these features using virtualization or hardware emulation to bypass security detection. Furthermore, existing behavioral analysis methods often focus only on single user behavioral characteristics, lacking comprehensive analysis of multi-dimensional behavioral features, making it difficult to accurately identify spoofing attacks.

[0004] Therefore, those skilled in the art have provided a network security monitoring method based on hardware information analysis to address the problems mentioned in the background section. Summary of the Invention

[0005] The purpose of this invention is to provide a network security monitoring method based on hardware information analysis, which can comprehensively utilize various hardware information and behavioral characteristics to more accurately identify spoofing attacks, improve network security, and solve the problems mentioned in the background art.

[0006] To achieve the above objectives, the present invention provides the following technical solution: A network security monitoring method based on hardware information analysis includes the following steps: Step S101: Hardware information and behavioral characteristics of the target device are collected through a detector deployed on the network side and an agent program installed on the target device. The hardware information includes a unique device identifier, a physical characteristic identifier, and a runtime behavior identifier. The behavioral characteristics include user login time period characteristics, operation habit characteristics, and keyboard input habit characteristics. Specifically, the unique device identifier is selected from at least five of the following: MAC address, hard drive serial number, CPU serial number, motherboard serial number, BIOS UUID, and TPM endorsement key. The physical characteristic identifier is selected from at least five of the following: clock deviation value, CPU power consumption fluctuation curve, sensor noise fingerprint, electromagnetic radiation characteristics, and thermal power consumption characteristics. The runtime behavior identifier is selected from at least five of the following: CPU instruction execution timing, memory access latency mode, cache hit rate statistics, bus arbitration mode, and interrupt response timing. The user login time period characteristics include historical login time distribution curves and current login time deviation values. The operation habit characteristics include application startup sequences, file access patterns, and mouse movement trajectories. The keyboard input habit characteristics include key duration distribution, key interval time sequence, and abbreviation typing patterns. Step S102: Calculate the user behavior similarity V based on the collected current behavior features and the stored historical behavior features; Step S103: Based on the numerical range of user behavior similarity V, dynamically determine the number of features randomly selected from the hardware information and behavioral feature set, and generate a high-dimensional composite fingerprint. Step S104: Send a customized computing challenge task to the target device. This task requires specific hardware resources to complete, including floating-point intensive tasks, memory bandwidth testing tasks, and parallel processing capability testing tasks. At the same time, monitor the response time, CPU utilization, memory usage, and power consumption curves of the target device when executing the challenge task, and compare these parameters with preset benchmark thresholds. If the response time exceeds 20% of the benchmark threshold, the abnormal fluctuation of CPU utilization exceeds 15%, the memory usage deviates from the benchmark value by 25%, or the power consumption curve does not match the standard mode, then the target device is determined to be a virtual simulation environment. Step S105: When the target device is determined to be a virtual simulation environment, a network security warning is immediately triggered, and all network traffic of the target device is redirected to the pre-built virtual operating environment; the virtual operating environment simulates the network services, file system and user interface of the real system, while recording the attacker's operation behavior and tracing its network source. Step S106: Periodically evaluate the credibility of each feature. When a feature is identified as fake, adjust its weight according to the weight update formula.

[0007] As a further aspect of the present invention: the formula for calculating the similarity V is: ; Among them, S t The time similarity is represented by the Pearson correlation coefficient calculated from the distribution curves of the current login time and historical login times; S o The similarity of operational habits is represented by the cosine similarity between the current operation sequence and historical operation sequences; S k The similarity of keyboard input is represented by the reciprocal of the dynamic time regularization distance between the current typing interval time series and the historical sequence; w1, w2, and w3 are weight coefficients, and they satisfy w1 + w2 + w3 = 1, where w1 takes values ​​from 0.3 to 0.5, w2 takes values ​​from 0.2 to 0.4, and w3 takes values ​​from 0.2 to 0.4. If V ≥ 90%, three features are randomly selected from all features to form a high-dimensional composite fingerprint; if 60% ≤ V < 90%, five features are randomly selected from all features to form a high-dimensional composite fingerprint; if 30% ≤ V < 60%, nine features are randomly selected from all features to form a high-dimensional composite fingerprint; if V < 30%, all features are merged to form a high-dimensional composite fingerprint. The generation of high-dimensional composite fingerprints adopts a combination of feature vector concatenation and hash mapping. First, the selected features are converted into numerical vectors, then normalized, and finally a fixed-length fingerprint identifier is generated through the SHA-256 algorithm. The specific weight update formula is as follows: ; Among them, W old W represents the current weight of the feature. new The updated weight is represented by λ, which is the decay factor, ranging from 0.1 to 0.5, and C represents the number of times the feature is marked as fake. For features with a weight lower than 0.1, they are automatically removed from the feature set, and new features are randomly selected from the candidate feature library and added. The candidate feature library includes GPU core frequency, sound card hardware identifier, and network interface card buffer size.

[0008] As a further aspect of the present invention, the specific process of collecting hardware information and behavioral characteristics in step S101 includes: Step S201: Passively capture the network traffic of the target device in an agentless manner using a network detector, and parse out the MAC address, IP address and device type information from it; Step S202: Actively collect specific hardware information of the target device through the agent program in an agent-assisted manner, including executing low-level system commands to obtain hard disk serial number, CPU serial number and motherboard serial number, reading the endorsement key through the TPM interface, and obtaining noise data of accelerometer and gyroscope through sensor driver; Step S203: Monitor the runtime behavior of the target device, record the CPU instruction execution timing, memory access latency pattern and cache hit rate, and generate time series data; Step S204: Capture user login time, application usage sequence, file operation records and keyboard input events through user behavior monitoring tools, and encrypt and transmit this data to the central analysis server; Step S205: Perform data cleaning and formatting on all collected hardware information and behavioral features, remove outliers and duplicate data, and uniformly convert them into numerical or categorical feature vectors.

[0009] As a further aspect of the present invention: the specific steps for calculating the user behavior similarity V in step S102 include: Step S301, calculate the time similarity S t Extract the historical login time distribution curve, which is represented by the probability density function of the daily login time points over the past 30 days; map the current login time onto this distribution curve, calculate the probability value of the current time point on the distribution curve, and normalize this probability value to a value between 0 and 1 as S. t ; Step S302, calculate the similarity S of operating habits. o Represent the current operation sequence as a vector, where each dimension corresponds to the frequency of an application or system operation; similarly, represent the historical operation sequence as a vector; calculate the cosine similarity between the two vectors, and use the result as S. o ; Step S303: Calculate the keyboard input similarity S k Extract the key press interval time series from the current keyboard input data, and perform dynamic time warping calculations with the historical key press interval time series to obtain the minimum path distance; take the reciprocal of the distance value and scale it to the range of 0 to 1, as S. k ; Step S304: Dynamically adjust the weight coefficients w1, w2, and w3 according to the user type and the security level of the environment; for high-security environments, increase the weight of w1 to 0.5; for ordinary user environments, increase the weights of w2 and w3 to 0.4. Step S305, calculate S t S o S k Substitute the weight coefficients into the formula to obtain the user behavior similarity V, and store the calculation result for subsequent model training.

[0010] As a further aspect of the present invention, the specific process of generating high-dimensional composite fingerprints in step S103 includes: Step S401: After determining the number of randomly selected features based on the user behavior similarity V, features are selected from the hardware information and behavioral feature set using a weighted random sampling method, wherein the selection probability of each feature is proportional to its current weight. Step S402: Convert each selected feature into a numerical vector: For categorical features, such as device identifiers, use one-hot encoding for conversion; for numerical features, such as time series data, use Fourier transform to extract the main frequency components and generate a vector. Step S403: Normalize all feature vectors by scaling each vector to the [0,1] interval using the min-max normalization method. Step S404: The normalized feature vectors are concatenated into a high-dimensional vector in a predetermined order, and principal component analysis is performed on the high-dimensional vector to reduce its dimensionality, retaining the principal components with a variance contribution rate of more than 95%. Step S405: Input the dimensionality-reduced vector into the SHA-256 hash function to generate a high-dimensional composite fingerprint with a fixed length of 256 bits, and store the fingerprint in the fingerprint database in association with the device identifier.

[0011] As a further aspect of the present invention, the specific content and execution method of the authentication challenge task in step S104 include: Step S501: Based on the hardware type and historical performance data of the target device, dynamically generate customized computing tasks; for CPU-intensive devices, generate large-scale matrix multiplication tasks; for memory-intensive devices, generate random memory access test tasks; for GPU devices, generate parallel computing tasks. Step S502: Send the challenge task to the target device through a secure encrypted channel and start a high-performance timer to record the task start time; Step S503: After receiving the challenge task, the target device executes the task in an isolated environment and outputs the execution result; Step S504: Simultaneously monitor the system parameters of the target device when it is executing the task, including reading the number of CPU cycles, cache misses and branch prediction error rate through the performance counter, reading real-time power consumption data through the power management unit built into the target device, and reading memory allocation statistics through the operating system kernel. Step S505: The collected response time and resource consumption pattern are compared with the baseline threshold. The baseline threshold is obtained based on historical data statistics of similar real devices and the normal range is set using the 3σ principle. Any parameter exceeding the normal range will trigger a virtual environment suspicion flag.

[0012] As a further aspect of the present invention: the virtual operating environment construction and boot process in step S105 includes: Step S601: Create a completely isolated virtualization environment on the security server. This environment simulates the kernel, file system, network services, and user interface of a real operating system and is filled with fake business data and log information. Step S602: Deploy a honeypot system in a virtual operating environment to simulate network services such as HTTP, FTP and database services, and set up trap files to attract attackers; Step S603: When the target device is determined to be a virtual simulation environment, modify the routing table rules to redirect all IP packets of the target device to the network interface of the virtual operating environment. Step S604: Run the behavior analysis tool in the virtual operating environment to record all the attacker's operation commands, file access attempts and network scanning behavior, and extract the attack fingerprint; Step S605: Simultaneously initiate attack tracing by analyzing the TTL value, source IP address, and routing path of network packets to determine the geographical origin and network topology location of the attacker.

[0013] As a further aspect of the present invention: the periodic evaluation of the confidence level of each feature in step S106 specifically includes: Step S701: Regularly (every 24 hours) scan the feature database to check the latest usage records and validity flags for each feature; Step S702: When a feature is identified as forged in three consecutive authentication challenges, the forgery count C of the feature is increased by 1, and its weight is recalculated according to the weight update formula. Step S703: For features with a weight lower than 0.1, mark their status as "eliminated" and remove them from the current feature set; Step S704: Randomly select a new feature from the candidate feature library and add it to the feature set. Set the initial weight of the new feature to 0.5 and record the introduction time. Step S705: Conduct a comprehensive evaluation of the feature set every month, calculate the discrimination and stability index of each feature, eliminate features with index values ​​below the threshold, and introduce new alternative features.

[0014] As a further aspect of the present invention, it also includes a verification and update mechanism for high-dimensional composite fingerprints. Step S801: When the high-dimensional composite fingerprint is used for device authentication, the newly generated fingerprint is compared with the stored reference fingerprint, and the Hamming distance between the two is calculated. Step S802: If the Hamming distance is less than the threshold, the authentication is successful; if the Hamming distance is greater than or equal to the threshold, the secondary authentication process is triggered. Step S803, the secondary authentication process includes requiring the user to enter a dynamic verification code and re-collecting hardware information to generate a new fingerprint; Step S804: If authentication is successful, update the baseline fingerprint based on the newly generated fingerprint and smooth the fingerprint changes using the sliding window averaging method. Step S805: Clean up the fingerprint database regularly (weekly), remove fingerprint records that have not been used for a long time, and optimize the fingerprint index structure.

[0015] As a further aspect of this invention, it also includes an upgraded and response mechanism for network security early warning: Step S901: When a network security alert is triggered, different response measures are taken according to the alert level; Level 1 alerts only log and notify the administrator; Level 2 alerts automatically block suspicious network connections; Level 3 alerts activate the emergency response plan and isolate the affected network segments. Step S902: The warning level is dynamically adjusted according to the severity of the attack behavior, and the factors include the attack frequency, the credibility rating of the attack source, and the criticality of the attack target. Step S903: Simulate system failures and delayed responses in a virtual operating environment to extend the attacker's stay time and collect more evidence; Step S904: Record all warning events and response actions to the security incident management system and generate a detailed security report; Step S905: Review and optimize the early warning mechanism monthly, and adjust the early warning threshold and response strategy.

[0016] Compared with the prior art, the beneficial effects of the present invention are: This invention establishes a dynamic composite fingerprint system based on multi-source hardware information and behavioral characteristics, combined with proactive challenge authentication and intelligent feature management mechanisms, thereby transforming network security monitoring from passive defense to proactive awareness. Specifically, this application constructs a difficult-to-forge device identity authentication foundation, optimizes system performance while ensuring security through a behavioral similarity-adaptive feature selection mechanism, enhances threat countermeasure capabilities using virtual environment decoy technology, and ensures persistent protection effectiveness through a continuous feature optimization mechanism, ultimately forming a multi-layered, adaptive, and sustainably evolving comprehensive network security protection solution. Attached Figure Description

[0017] Figure 1 This is a flowchart of a network security monitoring method based on hardware information analysis. Detailed Implementation

[0018] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0019] As mentioned in the background section of this application, research has found that most existing hardware fingerprinting technologies rely on single hardware features, such as MAC addresses and CPU serial numbers. Attackers can forge these features using virtualization technology or hardware emulation to bypass security detection. Furthermore, existing behavioral analysis methods often focus only on single user behavioral characteristics, lacking comprehensive analysis of multi-dimensional behavioral features, making it difficult to accurately identify spoofing attacks, thus exhibiting certain shortcomings.

[0020] To address the aforementioned shortcomings, this application discloses a network security monitoring method based on hardware information analysis, which can comprehensively utilize various hardware information and behavioral characteristics to more accurately identify spoofing attacks and improve network security.

[0021] The following will describe in detail, with reference to the accompanying drawings, how the solution of this application solves the above-mentioned technical problems.

[0022] Please see Figure 1In this embodiment of the invention, a network security monitoring method based on hardware information analysis includes the following steps: Step S101, collecting hardware information and behavioral characteristics of the target device through a detector deployed on the network side and an agent program installed on the target device; the hardware information includes a unique device identifier, a physical characteristic identifier, and a runtime behavior identifier, and the behavioral characteristics include user login time period characteristics, operation habit characteristics, and keyboard input habit characteristics; wherein, the unique device identifier is selected from MAC address, hard disk serial number, CPU serial number, motherboard serial number, BIOS... At least five of the following are selected: UUID and TPM endorsement key; physical characteristic identifiers are selected from at least five of the following: clock skew value, CPU power consumption fluctuation curve, sensor noise fingerprint, electromagnetic radiation characteristics, and thermal power consumption characteristics; runtime behavior identifiers are selected from at least five of the following: CPU instruction execution timing, memory access latency pattern, cache hit rate statistics, bus arbitration mode, and interrupt response timing; user login time period characteristics include historical login time distribution curve and current login time skew value; operation habit characteristics include application startup sequence, file access pattern, and mouse movement trajectory; keyboard input habit characteristics include key duration distribution, key interval time sequence, and abbreviation typing pattern; step S102, calculate user behavior similarity V based on the collected current behavior characteristics and stored historical behavior characteristics; step S103, dynamically determine the number of features randomly selected from the hardware information and behavior feature set based on the numerical range of user behavior similarity V, and generate a high-dimensional composite fingerprint; step S104, send a customized fingerprint to the target device. The computational challenge task requires specific hardware resources to complete, including floating-point intensive tasks, memory bandwidth testing tasks, and parallel processing capability testing tasks. Simultaneously, the response time, CPU utilization, memory usage, and power consumption curves of the target device executing the challenge task are monitored, and these parameters are compared with preset benchmark thresholds. If the response time exceeds 20% of the benchmark threshold, the CPU utilization fluctuates abnormally by more than 15%, the memory usage deviates from the benchmark value by 25%, or the power consumption curve does not match the standard mode, the target device is determined to be a virtual simulation environment. In step S105, when the target device is determined to be a virtual simulation environment, a network security alert is immediately triggered, and all network traffic of the target device is redirected to a pre-built virtual operating environment. The virtual operating environment simulates the network services, file system, and user interface of a real system, while recording the attacker's operational behavior and tracing its network origin. In step S106, the credibility of each feature is periodically evaluated, and when a feature is identified as forged, its weight is adjusted according to a weight update formula. This application constructs a complete hardware information analysis network security monitoring system. Through the synergistic effect of multi-source information collection, behavior similarity calculation, dynamic fingerprint generation, proactive challenge authentication, and intelligent feature management, it achieves closed-loop security protection throughout the entire process from device identification and behavior analysis to threat response.This setup establishes an intelligent monitoring framework that can adaptively adjust security policies, ensuring the reliability of basic device authentication while enhancing the ability to respond to advanced threats through proactive defense mechanisms.

[0023] In this embodiment, the formula for calculating the similarity V is: Among them, S t The time similarity is represented by the Pearson correlation coefficient calculated from the distribution curves of the current login time and historical login times; S o The similarity of operational habits is represented by the cosine similarity between the current operation sequence and historical operation sequences; S k The similarity of keyboard input is represented by the reciprocal of the dynamic time-normalized distance between the current typing interval time series and the historical sequence. w1, w2, and w3 are weight coefficients, satisfying w1 + w2 + w3 = 1, where w1 ranges from 0.3 to 0.5, w2 from 0.2 to 0.4, and w3 from 0.2 to 0.4. If V ≥ 90%, three features are randomly selected from all features to form a high-dimensional composite fingerprint; if 60% ≤ V < 90%, five features are randomly selected from all features to form a high-dimensional composite fingerprint; if 30% ≤ V < 60%, nine features are randomly selected from all features to form a high-dimensional composite fingerprint; if V < 30%, all features are merged to form a high-dimensional composite fingerprint. The generation of the high-dimensional composite fingerprint uses a combination of feature vector concatenation and hash mapping. First, the selected features are converted into numerical vectors, then normalized, and finally, a fixed-length fingerprint identifier is generated using the SHA-256 algorithm. The specific weight update formula is as follows: Among them, W old W represents the current weight of the feature. new The updated weights are represented by λ, the decay factor ranging from 0.1 to 0.5, and C, which indicates the number of times the feature was flagged as forgery. Features with weights below 0.1 are automatically removed from the feature set, and new features are randomly selected from a candidate feature library, including GPU core frequency, sound card hardware identifier, and network interface card buffer size. A quantitative relationship between behavioral similarity and the number of selected features is established through mathematical modeling, and a dynamic update mechanism for feature weights is provided. This setup enables fine-grained control of security policies, optimizing system performance in high-confidence environments and enhancing security strength in low-confidence scenarios. Furthermore, the adaptive weight adjustment mechanism ensures continuous effectiveness against feature forgery attacks.

[0024] In this embodiment, the specific process of collecting hardware information and behavioral characteristics in step S101 includes: Step S201, passively capturing the network traffic of the target device in an agentless manner using a network detector, and parsing out the MAC address, IP address, and device type information; Step S202, actively collecting specific hardware information of the target device in an agent-assisted manner using an agent program, including executing low-level system commands to obtain the hard disk serial number, CPU serial number, and motherboard serial number, reading the endorsement key through the TPM interface, and obtaining noise data from the accelerometer and gyroscope through sensor drivers; Step S203, monitoring the runtime behavior of the target device, recording the CPU instruction execution timing, memory access latency pattern, and cache hit rate, and generating time series data; Step S204, capturing user login time, application usage sequence, file operation records, and keyboard input events through a user behavior monitoring tool, and encrypting and transmitting this data to the central analysis server; Step S205, performing data cleaning and formatting on all collected hardware information and behavioral characteristics, removing outliers and duplicate data, and uniformly converting them into numerical or categorical feature vectors. This setup establishes a hierarchical, multi-modal data acquisition system, achieving comprehensive capture of hardware information and behavioral characteristics through an organic combination of agentless and agent-based methods. It constructs a complete and reliable data foundation, ensuring both the diversity of feature sources and the accuracy and consistency of subsequent analysis through data cleaning and formatting.

[0025] In this embodiment, the specific steps for calculating the user behavior similarity V in step S102 include: step S301, calculating the time similarity S t Extract the historical login time distribution curve, which is represented by the probability density function of the daily login time points over the past 30 days; map the current login time onto this distribution curve, calculate the probability value of the current time point on the distribution curve, and normalize this probability value to a value between 0 and 1 as S. t Step S302: Calculate the similarity S of operating habits. o Represent the current operation sequence as a vector, where each dimension corresponds to the frequency of an application or system operation; similarly, represent the historical operation sequence as a vector; calculate the cosine similarity between the two vectors, and use the result as S. o Step S303: Calculate the keyboard input similarity S. k Extract the key press interval time series from the current keyboard input data, and perform dynamic time warping calculations with the historical key press interval time series to obtain the minimum path distance; take the reciprocal of the distance value and scale it to the range of 0 to 1, as S. kStep S304: Dynamically adjust the weight coefficients w1, w2, and w3 according to the user type and environmental security level; for high-security environments, increase the weight of w1 to 0.5; for ordinary user environments, increase the weights of w2 and w3 to 0.4; Step S305: Apply the calculated S... t S o S k Substituting the weight coefficients into the formula yields the user behavior similarity V, and the result is stored for subsequent model training. This setting provides a quantitative analysis method for multi-dimensional behavioral features, achieving accurate characterization of user behavior patterns through comprehensive evaluation of three dimensions: time, operating habits, and keyboard input. A reliable foundation for behavioral authentication is established, considering the differences in characteristics of various behavioral features while adapting to the needs of different security environments through a dynamic weight adjustment mechanism.

[0026] In this embodiment, the specific process of generating a high-dimensional composite fingerprint in step S103 includes: Step S401, after determining the number of randomly selected features based on the user behavior similarity V, selecting features from the hardware information and behavioral feature set using a weighted random sampling method, wherein the selection probability of each feature is proportional to its current weight; Step S402, converting each selected feature into a numerical vector: for categorical features, such as device identifiers, a one-hot encoding method is used for conversion; for numerical features, such as time-series data, Fourier transform is used to extract the main frequency components. The process involves generating a vector; step S403, normalizing all feature vectors by scaling each vector to the [0,1] interval using a min-max normalization method; step S404, concatenating the normalized feature vectors into a high-dimensional vector in a predetermined order, and performing principal component analysis to reduce the dimensionality of this high-dimensional vector, retaining principal components with a variance contribution rate exceeding 95%; step S405, inputting the dimensionality-reduced vector into the SHA-256 hash function to generate a high-dimensional composite fingerprint of fixed length 256 bits, and storing this fingerprint in a fingerprint database in association with the device identifier. This setup constructs an intelligent fingerprint generation pipeline, achieving efficient conversion from raw features to stable fingerprints through steps such as weighted sampling, vector transformation, normalization, and hash mapping. It ensures the uniqueness and stability of fingerprints, optimizing storage and computation efficiency through dimensionality reduction and ensuring fingerprint security and consistency through hash mapping.

[0027] In this embodiment, the specific content and execution method of the authentication challenge task in step S104 include: Step S501, dynamically generating customized computing tasks based on the hardware type and historical performance data of the target device; for CPU-intensive devices, generating large-scale matrix multiplication tasks; for memory-intensive devices, generating random memory access test tasks; for GPU devices, generating parallel computing tasks; Step S502, sending the challenge task to the target device through a secure encrypted channel and starting a high-performance timer to record the task start time; Step S503, after receiving the challenge task, the target device executes the task in an isolated environment and outputs the execution result; Step S504, simultaneously monitoring the system parameters of the target device when executing the task, including reading the number of CPU cycles, cache misses, and branch prediction error rate through performance counters, reading real-time power consumption data through the power management unit built into the target device, and reading memory allocation statistics through the operating system kernel; Step S505, comparing the collected response time and resource consumption patterns with a benchmark threshold, which is obtained based on historical data statistics of similar real devices and uses the 3σ principle to set the normal range; any parameter exceeding the normal range triggers a virtual environment suspicion flag. This setup incorporates a targeted hardware capability verification mechanism, achieving effective identification of the virtual environment through customized computational tasks and comprehensive performance monitoring. It provides in-depth hardware authenticity verification, considering the differences in characteristics between different hardware types and enhancing the accuracy and reliability of the detection through multi-parameter joint analysis.

[0028] In this embodiment, the construction and bootstrapping process of the virtual operating environment in step S105 includes: Step S601, creating a completely isolated virtualized environment on the security server. This environment simulates the kernel, file system, network services, and user interface of a real operating system and is filled with fake business data and log information; Step S602, deploying a honeypot system in the virtual operating environment to simulate network services such as HTTP, FTP, and database services, and setting trap files to attract attackers; Step S603, when the target device is determined to be a virtual simulation environment, modifying the routing table rules to redirect all IP packets of the target device to the network interface of the virtual operating environment; Step S604, running a behavioral analysis tool in the virtual operating environment to record all attacker operation commands, file access attempts, and network scanning behaviors, and extracting attack fingerprints; Step S605, simultaneously initiating attack tracing, determining the geographical origin and network topology location of the attacker by analyzing the TTL value, source IP address, and routing path of network packets. This setup establishes a complete proactive defense system, achieving effective trapping and analysis of attackers through virtual environment simulation, traffic redirection, and attack behavior recording. It provides a proactive threat response capability, protecting the security of real systems while creating favorable conditions for attack attribution and evidence collection.

[0029] In this embodiment, the periodic evaluation of the credibility of each feature in step S106 specifically includes: Step S701, periodically (every 24 hours) scanning the feature database to check the latest usage records and validity flags of each feature; Step S702, when a feature is identified as forged in three consecutive authentication challenges, the forgery count C of that feature is increased by 1, and its weight is recalculated according to the weight update formula; Step S703, for features with a weight lower than 0.1, their status is marked as "eliminated" and removed from the current feature set; Step S704, new features are randomly selected from the candidate feature library and added to the feature set, with the initial weight of the new features set to 0.5, and the introduction time is recorded; Step S705, a comprehensive evaluation of the feature set is conducted monthly, calculating the discriminative and stability indicators of each feature, eliminating features with indicator values ​​lower than the threshold, and introducing new candidate features. This setup constructs a continuously optimized feature management mechanism, achieving self-improvement of the feature set through periodic evaluation, weight adjustment, and feature updates. It ensures the long-term effectiveness of the evaluation, enabling both timely elimination of ineffective features and continuous introduction of new effective features to maintain protection capabilities.

[0030] This embodiment also includes a verification and update mechanism for high-dimensional composite fingerprints: Step S801, when the high-dimensional composite fingerprint is used for device authentication, the newly generated fingerprint is compared with the stored baseline fingerprint, and the Hamming distance between the two is calculated; Step S802, if the Hamming distance is less than a threshold, authentication is successful; if the Hamming distance is greater than or equal to the threshold, a secondary authentication process is triggered; Step S803, the secondary authentication process includes requiring the user to input a dynamic verification code and re-collecting hardware information to generate a new fingerprint; Step S804, if authentication is successful, the baseline fingerprint is updated according to the newly generated fingerprint, and the fingerprint change is smoothed using a sliding window averaging method; Step S805, the fingerprint database is cleaned periodically (weekly), removing long-term unused fingerprint records and optimizing the fingerprint index structure. This setting establishes a dual authentication guarantee mechanism, realizing closed-loop management of the authentication process through fingerprint comparison, secondary authentication, and baseline update. It provides a flexible and reliable authentication scheme, ensuring smooth access for normal devices while enhancing the review strength of suspicious devices through progressive authentication.

[0031] This embodiment also includes an upgrade and response mechanism for network security early warnings: Step S901, when a network security early warning is triggered, different response measures are taken according to the warning level; Level 1 warnings only log and notify the administrator; Level 2 warnings automatically block suspicious network connections; Level 3 warnings activate the emergency response plan and isolate the affected network segments; Step S902, the warning level is dynamically adjusted according to the severity of the attack behavior, factors including attack frequency, credibility rating of the attack source, and criticality of the attack target; Step S903, system failures and delayed responses are simulated in a virtual operating environment to extend the attacker's stay time and collect more evidence; Step S904, all early warning events and response actions are recorded in the security event management system, and a detailed security report is generated; Step S905, the early warning mechanism is reviewed and optimized monthly, and the early warning thresholds and response strategies are adjusted. This setup constructs a graded response early warning handling system, achieving precise handling of security events through level division, strategy adjustment, and effect evaluation. It provides a scientific and effective emergency response plan, avoiding resource waste caused by over-response while ensuring timely containment of serious threats.

[0032] This invention establishes a dynamic composite fingerprint system based on multi-source hardware information and behavioral characteristics, combined with proactive challenge authentication and intelligent feature management mechanisms, thereby transforming network security monitoring from passive defense to proactive awareness. Specifically, this application constructs a difficult-to-forge device identity authentication foundation, optimizes system performance while ensuring security through a behavioral similarity-adaptive feature selection mechanism, enhances threat countermeasure capabilities using virtual environment decoy technology, and ensures persistent protection effectiveness through a continuous feature optimization mechanism, ultimately forming a multi-layered, adaptive, and sustainably evolving comprehensive network security protection solution.

[0033] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

[0034] The above description is merely a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A network security monitoring method based on hardware information analysis, characterized in that, Includes the following steps: Step S101: Collect hardware information and behavioral characteristics of the target device through detectors deployed on the network side and agent programs installed on the target device; The hardware information includes a unique device identifier, a physical characteristic identifier, and a runtime behavior identifier. The behavioral characteristics include user login time period characteristics, operation habit characteristics, and keyboard input habit characteristics. Step S102: Calculate the user behavior similarity V based on the collected current behavior features and the stored historical behavior features; Step S103: Based on the numerical range of user behavior similarity V, dynamically determine the number of features randomly selected from the hardware information and behavioral feature set, and generate a high-dimensional composite fingerprint, which is used for device authentication. Step S104: Send a customized computing challenge task to the target device; at the same time, monitor the response time, CPU utilization, memory usage, and power consumption change curves of the target device in executing the challenge task, and compare these parameters with preset benchmark thresholds; if the response time exceeds 20% of the benchmark threshold, the abnormal fluctuation of CPU utilization exceeds 15%, the memory usage deviates from the benchmark value by 25%, or the power consumption curve does not match the standard mode, then the target device is determined to be a virtual simulation environment; Step S105: When the target device is determined to be a virtual simulation environment, a network security warning is immediately triggered, and all network traffic of the target device is redirected to the pre-built virtual operating environment; the virtual operating environment simulates the network services, file system and user interface of the real system, while recording the attacker's operation behavior and tracing its network source. Step S106: Periodically evaluate the credibility of each feature. When a feature is identified as forged, adjust its weight according to the weight update formula. The formula for calculating the similarity V is: ； Among them, S t The time similarity is represented by the Pearson correlation coefficient calculated from the distribution curves of the current login time and historical login times; S o The similarity of operational habits is represented by the cosine similarity between the current operation sequence and historical operation sequences; S k The similarity of keyboard input is represented by the reciprocal of the dynamic time regularization distance between the current typing interval time series and the historical sequence; w1, w2, and w3 are weight coefficients, and they satisfy w1 + w2 + w3 = 1, where w1 takes values ​​from 0.3 to 0.5, w2 takes values ​​from 0.2 to 0.4, and w3 takes values ​​from 0.2 to 0.

4. If V ≥ 90%, three features are randomly selected from all features to form a high-dimensional composite fingerprint; if 60% ≤ V < 90%, five features are randomly selected from all features to form a high-dimensional composite fingerprint; if 30% ≤ V < 60%, nine features are randomly selected from all features to form a high-dimensional composite fingerprint; if V < 30%, all features are merged to form a high-dimensional composite fingerprint. The generation of high-dimensional composite fingerprints adopts a combination of feature vector concatenation and hash mapping. First, the selected features are converted into numerical vectors, then normalized, and finally a fixed-length fingerprint identifier is generated through the SHA-256 algorithm. The specific weight update formula is as follows: ； Among them, W old W represents the current weight of the feature. new The updated weight is represented by λ, which is the decay factor, ranging from 0.1 to 0.5, and C represents the number of times the feature is marked as fake. For features with a weight lower than 0.1, they are automatically removed from the feature set, and new features are randomly selected from the candidate feature library and added. The candidate feature library includes GPU core frequency, sound card hardware identifier, and network interface card buffer size. The periodic evaluation of the credibility of each feature in step S106 specifically includes: Step S701: Periodically scan the feature database to check the latest usage records and validity flags for each feature; Step S702: When a feature is identified as forged in three consecutive authentication challenges, the forgery count C of the feature is increased by 1, and its weight is recalculated according to the weight update formula. Step S703: For features with a weight lower than 0.1, mark their status as "eliminated" and remove them from the current feature set; Step S704: Randomly select a new feature from the candidate feature library and add it to the feature set. Set the initial weight of the new feature to 0.5 and record the introduction time. Step S705: Conduct a comprehensive evaluation of the feature set every month, calculate the discrimination and stability index of each feature, eliminate features with index values ​​below the threshold, and introduce new alternative features.

2. The network security monitoring method based on hardware information analysis according to claim 1, characterized in that, The specific process of collecting hardware information and behavioral characteristics in step S101 includes: Step S201: Passively capture the network traffic of the target device in an agentless manner using a network detector, and parse out the MAC address, IP address and device type information from it; Step S202: Actively collect specific hardware information of the target device through the agent program in an agent-assisted manner, including executing low-level system commands to obtain hard disk serial number, CPU serial number and motherboard serial number, reading the endorsement key through the TPM interface, and obtaining noise data of accelerometer and gyroscope through sensor driver; Step S203: Monitor the runtime behavior of the target device, record the CPU instruction execution timing, memory access latency pattern and cache hit rate, and generate time series data; Step S204: Capture user login time, application usage sequence, file operation records and keyboard input events through user behavior monitoring tools, and encrypt and transmit this data to the central analysis server; Step S205: Perform data cleaning and formatting on all collected hardware information and behavioral features, remove outliers and duplicate data, and uniformly convert them into numerical or categorical feature vectors.

3. The network security monitoring method based on hardware information analysis according to claim 2, characterized in that, The specific steps for calculating the user behavior similarity V in step S102 include: Step S301, calculate the time similarity S t Extract the historical login time distribution curve, which is represented by the probability density function of the daily login time points over the past 30 days; map the current login time onto this distribution curve, calculate the probability value of the current time point on the distribution curve, and normalize this probability value to a value between 0 and 1 as S. t ; Step S302, calculate the similarity S of operating habits. o Represent the current operation sequence as a vector, where each dimension corresponds to the frequency of an application or system operation; similarly, represent the historical operation sequence as a vector; calculate the cosine similarity between the two vectors, and use the result as S. o ; Step S303: Calculate the keyboard input similarity S k Extract the key press interval time series from the current keyboard input data, and perform dynamic time warping calculations with the historical key press interval time series to obtain the minimum path distance; take the reciprocal of the distance value and scale it to the range of 0 to 1, as S. k ; Step S304: Dynamically adjust the weight coefficients w1, w2, and w3 according to the user type and the security level of the environment; for high-security environments, increase the weight of w1 to 0.5; for ordinary user environments, increase the weights of w2 and w3 to 0.

4. Step S305, calculate S t S o S k Substitute the weight coefficients into the formula to obtain the user behavior similarity V, and store the calculation result for subsequent model training.

4. The network security monitoring method based on hardware information analysis according to claim 3, characterized in that, The specific process of generating high-dimensional composite fingerprints in step S103 includes: Step S401: After determining the number of randomly selected features based on the user behavior similarity V, features are selected from the hardware information and behavioral feature set using a weighted random sampling method, wherein the selection probability of each feature is proportional to its current weight. Step S402: Convert each selected feature into a numerical vector; Step S403: Normalize all feature vectors by scaling each vector to the [0,1] interval using the min-max normalization method. Step S404: The normalized feature vectors are concatenated into a high-dimensional vector in a predetermined order, and principal component analysis is performed on the high-dimensional vector to reduce its dimensionality, retaining the principal components with a variance contribution rate of more than 95%. Step S405: Input the dimensionality-reduced vector into the SHA-256 hash function to generate a high-dimensional composite fingerprint with a fixed length of 256 bits, and store the fingerprint in the fingerprint database in association with the device identifier.

5. The network security monitoring method based on hardware information analysis according to claim 4, characterized in that, The specific content and execution method of the authentication challenge task in step S104 include: Step S501: Based on the hardware type and historical performance data of the target device, dynamically generate customized computing tasks; for CPU-intensive devices, generate large-scale matrix multiplication tasks; for memory-intensive devices, generate random memory access test tasks; for GPU devices, generate parallel computing tasks. Step S502: Send the challenge task to the target device through a secure encrypted channel and start a high-performance timer to record the task start time; Step S503: After receiving the challenge task, the target device executes the task in an isolated environment and outputs the execution result; Step S504: Simultaneously monitor the system parameters of the target device when it is executing the task, including reading the number of CPU cycles, cache misses and branch prediction error rate through the performance counter, reading real-time power consumption data through the power management unit built into the target device, and reading memory allocation statistics through the operating system kernel. Step S505: The collected response time and resource consumption pattern are compared with the baseline threshold. The baseline threshold is obtained based on historical data statistics of similar real devices and the normal range is set using the 3σ principle. Any parameter exceeding the normal range will trigger a virtual environment suspicion flag.

6. The network security monitoring method based on hardware information analysis according to claim 5, characterized in that, The virtual operating environment construction and boot process in step S105 includes: Step S601: Create a completely isolated virtualization environment on the security server. This environment simulates the kernel, file system, network services, and user interface of a real operating system and is filled with fake business data and log information. Step S602: Deploy the honeypot system in the virtual operating environment to simulate network services and database services, and set up trap files to attract attackers; Step S603: When the target device is determined to be a virtual simulation environment, modify the routing table rules to redirect all IP packets of the target device to the network interface of the virtual operating environment. Step S604: Run the behavior analysis tool in the virtual operating environment to record all the attacker's operation commands, file access attempts and network scanning behavior, and extract the attack fingerprint; Step S605: Simultaneously initiate attack tracing by analyzing the TTL value, source IP address, and routing path of network packets to determine the geographical origin and network topology location of the attacker.

7. The network security monitoring method based on hardware information analysis according to claim 6, characterized in that, It also includes a verification and update mechanism for high-dimensional composite fingerprints: Step S801: When the high-dimensional composite fingerprint is used for device authentication, the newly generated fingerprint is compared with the stored reference fingerprint, and the Hamming distance between the two is calculated. Step S802: If the Hamming distance is less than the threshold, the authentication is successful. If the Hamming distance is greater than or equal to the threshold, the secondary authentication process is triggered; Step S803, the secondary authentication process includes requiring the user to enter a dynamic verification code and re-collecting hardware information to generate a new fingerprint; Step S804: If authentication is successful, update the baseline fingerprint based on the newly generated fingerprint and smooth the fingerprint changes using the sliding window averaging method. Step S805: Regularly clean the fingerprint database, remove fingerprint records that have not been used for a long time, and optimize the fingerprint index structure.

8. The network security monitoring method based on hardware information analysis according to claim 7, characterized in that, It also includes upgrades and response mechanisms for cybersecurity alerts: Step S901: When a network security alert is triggered, different response measures are taken according to the alert level; a level 1 alert only logs the information and notifies the administrator. Level 2 alert automatically blocks suspicious network connections; A Level 3 alert triggers an emergency response plan, isolating affected network segments. Step S902: The warning level is dynamically adjusted according to the severity of the attack behavior, and the factors include the attack frequency, the credibility rating of the attack source, and the criticality of the attack target. Step S903: Simulate system failures and delayed responses in a virtual operating environment to extend the attacker's stay time and collect more evidence; Step S904: Record all warning events and response actions to the security incident management system and generate a detailed security report; Step S905: Review and optimize the early warning mechanism monthly, and adjust the early warning threshold and response strategy.

Images