Artificial intelligence-based intranet asset identification and honeypot generation method and system
Patent Information
- Application Number
- CN202611441675.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-09-17
- Publication Date
- 2026-10-27
AI Technical Summary
手动资产盘点指管理员通过人工方式登记包括IP、设备类型、用途等内网设备信息，此方案严重依赖人工经验，无法应对具有数千IP的大型网络的快速变化
[0026]1、本发明首先对目标内网网段进行扫描，获取各活跃设备的IP地址、MAC地址、开放端口列表、Banner服务信息及操作系统指纹，然后对于各活跃设备，均基于其开放端口列表进行多层递进式分类，得到设备类型和置信度，多层递进式分类采用优先级策略，依次执行规则引擎分类、机器学习模型分类和启发式兜底分类，如此保证在任意输入下都能输出有效分类结果，不会因规则/MISS而返回空值；接着将多层递进式分类得到的设备类型映射至知识图谱进行验证，获取与所得到的设备类型所对应的节点，基于活跃设备的开放端口列表与对应节点存储的端口签名集合计算端口特征相似度、根据活跃设备的Banner服务信息、操作系统指纹与对应节点存储的对应信息计算语义特征相似度，以判断对应的节点是否为活跃设备的匹配节点，若是，对匹配节点进行设备指纹合并并更新设备知识图谱，并将活跃设备及其设备类型、置信度录入资产库，否则，创建新的候选节点并根据置信度决定是否创建人工标注任务，通过多层递进式分类与知识图谱协同，在初始无训练数据时依赖规则和启发式即可达到40%+分类准确率，随着知识图谱积累和人工标注反馈，分类准确率能持续提升至99%+；为某一设备类型生成蜜罐时，以知识图谱中该设备类型对应的各节点为起点执行图遍历以获取相邻节点，聚合各节点以及相邻节点存储的端口签名集合、Banner服务信息、操作系统指纹，合并至蜜罐模板中以生成蜜罐，如此能够使蜜罐服务配置与真实网络环境的设备画像动态一致，端口聚合随扫描次数增加而更加完整，Banner随知识图谱积累而更加多样化；综上所述，本发明能够适用于大型企业内网（1000+ IP）的自动化资产盘点与威胁感知、适用于工业控制网络的被动资产发现与攻击检测以及适用于物联网环境的设备识别与异常行为告警。
Smart Images
Figure CN122994074A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of network security technology, and in particular to a method and system for identifying intranet assets and generating honeypots based on artificial intelligence. Background Technology
[0002] Currently, intranet asset identification mainly employs three methods: manual asset inventory, rule-based asset scanning, and machine learning-based asset classification. Manual asset inventory refers to administrators manually registering intranet device information, including IP address, device type, and purpose. This method heavily relies on human experience and cannot handle the rapid changes in large networks with thousands of IP addresses. Rule-based asset scanning uses tools like nmap for port scanning and classifies assets using predefined port-device mapping tables, such as "port 3306 → MySQL database." This method can only identify common port combinations and is ineffective for complex devices or non-standard port configurations. Furthermore, it cannot leverage historical scan data to improve accuracy, and each scan is performed independently without a knowledge accumulation mechanism, leading to unstable accuracy. Machine learning-based asset classification uses port openness as feature vectors and employs models like Random Forest or XGBoost for device type classification. This method relies on a large amount of labeled training data, and the model remains fixed after training. Training data is difficult to obtain in intranet environments, and it cannot adapt to changes in new device types or network topology. It also relies solely on port features, ignoring rich semantic information such as banners and OS fingerprints. Furthermore, existing honeypot deployments mainly use static templates, such as Cowrie SSH honeypot and Dionaea multi-protocol honeypot, which cannot dynamically adjust the simulation strategy based on historical scan data. This results in the honeypot being out of sync with the device profile of the real network environment, making it easy for experienced attackers to bypass it through fingerprint recognition. Summary of the Invention
[0003] The main objective of this invention is to propose an artificial intelligence-based method and system for intranet asset identification and honeypot generation, which can improve the accuracy of intranet asset identification and the realism of honeypot simulation.
[0004] This invention is achieved through the following technical solution:
[0005] The method for identifying intranet assets and generating honeypots based on artificial intelligence includes the following steps:
[0006] Step S1: Scan the target intranet segment to obtain the IP address, MAC address, open port list, banner service information and operating system fingerprint of each active device;
[0007] Step S2: For each active device, a multi-level progressive classification is performed based on its open port list to obtain the device type and confidence level. The multi-level progressive classification adopts a priority strategy, and the rule engine classification, machine learning model classification, and heuristic fallback classification are executed in sequence.
[0008] Step S3: Map the device types obtained from the multi-level progressive classification to the knowledge graph for verification. Each node in the knowledge graph stores the port signature set, banner service information, and operating system fingerprint of its corresponding device type. Obtain the node corresponding to the device type obtained in Step S2. Calculate the port feature similarity based on the open port list of active devices and the port signature set stored in the corresponding node. Calculate the semantic feature similarity based on the banner service information and operating system fingerprint of active devices and the corresponding information stored in the corresponding node to determine whether the corresponding node is a matching node for an active device. If so, merge the device fingerprints of the matching node and update the device knowledge graph. Record the active device, its device type, and confidence level into the asset database. Otherwise, create a new candidate node and decide whether to enter the manual annotation task based on the confidence level.
[0009] Step S4: When generating a honeypot for a certain device type, perform graph traversal starting from each node corresponding to that device type in the knowledge graph to obtain adjacent nodes, aggregate the port signature set, banner service information, and operating system fingerprint stored by each node and adjacent nodes, and merge them into the honeypot template to generate the honeypot.
[0010] Furthermore, step S1 specifically involves: performing an ARP scan on the target intranet segment to obtain a list of IP addresses and MAC addresses of active devices; performing a multi-port concurrent scan on each active device to obtain a list of open ports, banner service information for each open port, and operating system fingerprint.
[0011] Furthermore, in step S1, the operating system fingerprint is obtained by concatenating the Banner regular expression matching result, the TTL value estimation result, and the MAC OUI vendor matching result after deduplication; wherein: Banner regular expression matching specifically includes: using regular expressions in a preset rule base to perform text feature matching on the Banner service information, and taking the operating system description corresponding to the successfully matched regular expression as the Banner regular expression matching result, wherein the rule base contains the mapping relationship between regular expressions and operating system descriptions; TTL value estimation specifically includes: obtaining the data packet returned when an active device responds to a scan request, extracting the TTL field value in the data packet, and taking the operating system description corresponding to the TTL field value as the TTL value estimation result; MAC OUI vendor matching specifically includes: querying a preset vendor mapping library through the first 3 bytes of the MAC address, and taking the matched device manufacturer information as the MAC OUI vendor matching result.
[0012] Furthermore, in step S2, the multi-layer progressive classification specifically includes: First, performing rule engine classification: When the list of open ports of active devices simultaneously satisfies the positive existence constraint of the preset device fingerprint rule and does not trigger the reverse exclusion constraint, the active device matching rule is determined to be successful, and the device type and confidence level defined by the device fingerprint rule are used as the classification result. Then, step S3 is executed. If the active device matching rule fails, machine learning model classification is executed: The feature vector extracted based on the scanning results of active devices is input into the XGBoost machine learning model to obtain the probability distribution of each active device type. When the maximum probability exceeds the set threshold, the corresponding device type is used as the classification result. Then, step S3 is executed. Otherwise, heuristic fallback classification is executed: The list of open ports is matched based on the preset basic port combination rule to output the classification result. The feature vector includes the binary existence feature of each key port in the list of open ports, the total number of open ports, the proportion of Web ports, and the existence flag of database ports.
[0013] Furthermore, in step S3, the port feature similarity is based on Calculate, where, Let represent the predefined total number of critical ports, and let i represent the index of the i-th critical port. This represents the binary existence characteristic value of the i-th critical port in the list of open ports. This represents the binary existence characteristic value of the i-th key port in the port signature set of the corresponding node. This represents the weight of the pre-defined i-th key port. Key ports with high specificity are assigned high weights, while key ports with high versatility are assigned low weights. Further, in step S3, the calculation process of the semantic feature similarity includes: for active devices and corresponding nodes, combining their banner service information with the operating system fingerprint to form a semantic document; using the character-level n-gram TF-IDF algorithm to convert the semantic document into a 256-dimensional embedding vector; and using the cosine similarity between the two embedding vectors as the semantic feature similarity. .
[0014] Furthermore, in step S3, obtaining the 256-dimensional embedding vector specifically includes: using the character-level n-gram TF-IDF algorithm to segment the string of the semantic document, extracting single-character segments and double-character segments, selecting the 256 most frequent character segments to construct a feature space; calculating the TF-IDF weight of each character segment in the feature space to form a 256-dimensional embedding vector.
[0015] Furthermore, in step S3, according to Calculate weighted similarity If weighted similarity If the value is not less than the first preset threshold, the corresponding node is determined to be a matching node of an active device. The list of open ports of active devices is merged into the port signature set of the matching node, and the confidence and sample size of the matching node are updated. If the weighted similarity is... If the device type is less than the first preset threshold, a new candidate node is created, and nodes of the same type with the same device type as the candidate node in the knowledge graph are scanned. Semantic similarity edges are automatically created for nodes of the same type with a weighted similarity not less than the second preset threshold, and co-occurrence edges are automatically created for nodes of the same type with a sample number not less than the third preset threshold. and The first preset threshold is greater than the second preset threshold, which is the weighting coefficient.
[0016] Furthermore, in step S3, when it is determined that the corresponding node is not a matching node of an active device, and the confidence level obtained by the multi-level progressive classification of the active device is lower than the fourth preset threshold, a manual annotation task is created to obtain manually annotated samples. Then, the manually annotated samples are classified and managed according to the priority and status of the annotation task. When the number of manually annotated samples is greater than a set quantity threshold or the growth rate of nodes in the knowledge graph is greater than a growth threshold, incremental retraining of the machine learning model is triggered. The manual annotation task includes: the scanning results of active devices, the device type and confidence level obtained by the machine learning model classification, and other candidate device types and probability distributions output by the machine learning model. The status includes pending annotation, annotated, reviewed, and returned. Incremental retraining includes: mixing asset data with a confidence level not lower than the fifth preset threshold in the asset library with manually annotated samples to construct a new training set, and using the training set to incrementally train the current version of the machine learning model to generate a new version of the machine learning model.
[0017] This invention is also achieved through the following technical solutions:
[0018] The AI-based intranet asset identification and honeypot generation system is used to implement the AI-based intranet asset identification and honeypot generation method described above, including a scanning module, an asset classification module, a honeypot deployment module, a manual annotation module, and a self-learning pipeline module.
[0019] The scanning module is used to scan the target intranet segment and obtain the IP address, MAC address, open port list, banner service information and operating system fingerprint of each active device;
[0020] The asset classification module performs multi-level progressive classification based on the list of open ports of active devices to obtain device type and confidence level, and uses a knowledge graph engine for matching and verification to obtain asset classification results. The multi-level progressive classification adopts a priority strategy, and executes rule engine classification, machine learning model classification and heuristic fallback classification in sequence.
[0021] The knowledge graph engine is used to obtain nodes corresponding to the device types obtained by the asset classification module. It calculates port feature similarity based on the list of open ports of active devices and the port signature set stored in the corresponding nodes. It calculates semantic feature similarity based on the banner service information and operating system fingerprint of active devices and the corresponding information stored in the corresponding nodes to determine whether the corresponding node is a matching node of active devices. If so, it merges device fingerprints of matching nodes and updates the device knowledge graph. It also records active devices, their device types, and confidence scores into the asset database. Otherwise, it creates new candidate nodes and decides whether to create a manual annotation task based on the confidence score.
[0022] The honeypot deployment module is used to perform graph traversal starting from each node corresponding to the device type in the knowledge graph to obtain adjacent nodes, aggregate the port signature set, banner service information, and operating system fingerprint stored by each node and adjacent nodes, and merge them into the honeypot template to generate a honeypot.
[0023] The manual annotation module is used to perform manual annotation tasks. The manual annotation tasks include scanning results of active devices, device types and confidence levels obtained by machine learning model classification, and other candidate device types and probability distributions output by machine learning model. The status includes pending annotation, annotated, reviewed, and returned.
[0024] The self-learning pipeline module is used to mix asset data with a confidence level of not less than the fifth preset threshold with manually labeled samples in the asset library to construct a new training set when the number of manually labeled samples exceeds a set threshold or the growth rate of nodes in the knowledge graph exceeds a growth threshold. The training set is then used to incrementally train the current version of the machine learning model to generate a new version of the machine learning model.
[0025] As can be seen from the above description of the present invention, compared with the prior art, the present invention has the following beneficial effects:
[0026] 1. This invention first scans the target intranet segment to obtain the IP address, MAC address, open port list, banner service information, and operating system fingerprint of each active device. Then, for each active device, a multi-level progressive classification is performed based on its open port list to obtain the device type and confidence level. The multi-level progressive classification adopts a priority strategy, sequentially executing rule engine classification, machine learning model classification, and heuristic fallback classification. This ensures that a valid classification result is output under any input, and no null value is returned due to rule / MISS errors. Next, the device types obtained from the multi-level progressive classification are mapped to a knowledge graph for verification. The nodes corresponding to the obtained device types are obtained. Port feature similarity is calculated based on the open port list of active devices and the port signature set stored in the corresponding nodes. Semantic feature similarity is calculated based on the banner service information and operating system fingerprint of active devices and the corresponding information stored in the corresponding nodes to determine whether the corresponding node is a matching node of an active device. If so, the matching is performed. The nodes merge device fingerprints and update the device knowledge graph, recording active devices, their device types, and confidence levels into the asset database. Otherwise, new candidate nodes are created, and a manual annotation task is created based on the confidence level. Through multi-layered progressive classification and collaboration with the knowledge graph, a classification accuracy of 40%+ can be achieved initially without training data, relying on rules and heuristics. With the accumulation of the knowledge graph and feedback from manual annotation, the classification accuracy can continuously improve to 99%+. When generating a honeypot for a specific device type, a graph traversal is performed starting from the nodes corresponding to that device type in the knowledge graph to obtain adjacent nodes. The port signature sets, banner service information, and operating system fingerprints stored by each node and its adjacent nodes are aggregated and merged into the honeypot template to generate the honeypot. This ensures that the honeypot service configuration dynamically matches the device profile of the real network environment. Port aggregation becomes more complete with the number of scans, and banners become more diverse with the accumulation of the knowledge graph. In summary, this invention is applicable to large enterprise intranets (1000+). Automated asset inventory and threat awareness (IP), passive asset discovery and attack detection for industrial control networks, and device identification and abnormal behavior alerts for IoT environments.
[0027] 2. When the number of manually labeled samples exceeds a set threshold or the growth rate of nodes in the knowledge graph exceeds a growth threshold, the self-learning pipeline module of this invention mixes asset data with a confidence level not lower than the fifth preset threshold in the asset library with manually labeled samples to construct a new training set. The training set is then used to incrementally train the current version of the machine learning model to generate a new version of the machine learning model. This achieves automatic monitoring of the accumulation of labeled samples and the growth of the knowledge graph, and completes the incremental training and deployment of the machine learning model without manual intervention, realizing a positive flywheel effect where the more scans, the more labels, and the more accurate the model. Attached Figure Description
[0028] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.
[0029] Figure 1 This is a flowchart of the method of the present invention.
[0030] Figure 2 This is a detailed closed-loop flowchart of the intranet asset identification part of the method of the present invention.
[0031] Figure 3 This is a schematic diagram of the data structure for the annotation task in this invention.
[0032] Figure 4 This is a schematic diagram of the system architecture of the present invention. Detailed Implementation
[0033] The present invention will be further described below through specific embodiments.
[0034] like Figure 1 and Figure 2 As shown, the AI-based method for identifying intranet assets and generating honeypots includes the following steps:
[0035] Step S1: Scan the target intranet segment to obtain the IP address, MAC address, open port list, banner service information and operating system fingerprint of each active device;
[0036] Specifically, an ARP scan is performed on the target intranet segment 192.168.1.0 / 24 to obtain a list of active devices. This list includes the IP addresses and MAC addresses of the active devices. Multiple ports are scanned concurrently on each active device to obtain a list of open ports, banner service information for each open port, and the operating system fingerprint. For example, the scan result for device 192.168.1.100 might show an open port list of [102, 502], with the banner service information for port 102 being "SiemensS7-1200".
[0037] In this embodiment, three complementary methods are used to obtain the operating system fingerprint: Banner regular expression matching, TTL value estimation, and MACOUI vendor matching. The matching results obtained from the three methods are deduplicated and then concatenated to obtain the operating system fingerprint.
[0038] Banner regular expression matching specifically includes: using regular expressions from a pre-built rule base to perform text feature matching on banner service information, and taking the operating system description corresponding to the successfully matched regular expression as the banner regular expression matching result. The rule base contains a mapping relationship between regular expressions and operating system descriptions. In this embodiment, operating system information is extracted from banner service information text such as SSH, HTTP, MySQL, Redis, and Modbus using 46 regular expression rules. Each regular expression rule is a "regular expression-operating system description" pair. For example, the regular expression "Ubuntu\S*" matches the string "Ubuntu" in the banner service information, outputting the operating system description as UbuntuLinux; the regular expression "Microsoft-IIS" matches "Microsoft-IIS / 10.0", outputting the operating system description as WindowsServer (IIS); and the regular expression "Hikvision" matches "Hikvision-Webs / 3.0", outputting "EmbeddedLinux (Hikvision)". The regular expression rule base covers Linux distribution identifiers in SSH service banners, web server fingerprints in HTTP service banners, brand identifiers such as Siemens / Schneider / Rockwell in industrial control equipment banners, brand identifiers such as Hikvision / Dahua in security equipment banners, and type identifiers such as MySQL / PostgreSQL / MongoDB in database banners.
[0039] TTL value estimation specifically involves: obtaining the data packets returned by active devices when responding to scan requests, extracting the TTL field value from the data packets, and using the operating system description corresponding to the TTL field value as the TTL value estimation result. In this embodiment, the operating system type is inferred from the TTL field value in the IP header of the ARP return packet: TTL=64 corresponds to Linux / macOS / Android / EmbeddedLinux Unix-like systems, TTL=128 corresponds to Windows systems, and TTL=255 corresponds to network devices such as Cisco IOS. This method does not require sending additional probes to the target device; the TTL value can be obtained from the ARP scan return packets.
[0040] MACOUI vendor matching specifically involves querying a pre-built vendor mapping library using the first 3 bytes of the MAC address, and using the matched device manufacturer information as the MACOUI vendor matching result. In this embodiment, the first 3 bytes of the MAC address (OrganizationallyUniqueIdentifier, OUI) are used to query a library of 50+ vendors to infer the device manufacturer and device type. For example, OUI “00-1C-06” corresponds to Siemens (PLC / industrial control), “FC-A6-67” corresponds to Hikvision (camera), “00-17-61” corresponds to ZKTeco (time and attendance machine), and “00-50-56” corresponds to VMware (virtual machine).
[0041] The results from the three methods are deduplicated and concatenated to form the final operating system fingerprint description string. For example, if a device's banner contains "Ubuntu" and TTL=64 and macOS is Intel, the final output will be "UbuntuLinux(nginx)|TTL=64→Linux / macOS / Android". This fingerprint is stored in the asset's os_fingerprint field and the knowledge graph node's os_signature field.
[0042] Step S2: For each active device, a multi-level progressive classification is performed based on its open port list to obtain the device type and confidence level. The multi-level progressive classification adopts a priority strategy, and the rule engine classification, machine learning model classification, and heuristic fallback classification are executed in sequence.
[0043] Multi-level progressive classification specifically includes:
[0044] First, the rule engine classification is executed: when the list of open ports of active devices simultaneously satisfies the positive existence constraint of the preset device fingerprint rule and does not trigger the reverse exclusion constraint, the active device matching rule is determined to be successful. The device type and confidence level defined by the device fingerprint rule are used as the classification result, and then step S3 is executed. If the active device matching rule fails, the machine learning model classification is executed: the feature vector extracted based on the scanning results of active devices is input into the XGBoost machine learning model to obtain the probability distribution of each active device type. When the maximum probability exceeds the set threshold, the corresponding device type is used as the classification result, and then step S3 is executed. Otherwise, heuristic fallback classification is executed: the list of open ports is matched based on the preset basic port combination rule to ensure that a classification result can be given under any input. The feature vector includes the binary existence feature of each key port in the open port list, the total number of open ports, the proportion of web ports, and the existence flag of database ports; the preset basic port combination rule is specifically the existing technology. In this embodiment, the set threshold is set to 0.7.
[0045] Specifically, for rule engine classification, a predefined device fingerprint rule base is used. Each device fingerprint rule includes "a set of ports that must exist + a set of ports that must not exist + device type + confidence level (conf)". Each device fingerprint rule uses the principle of port protocol uniqueness: specific industrial protocols are bound to dedicated ports, such as the S7comm protocol appearing only on port 102 of Siemens PLCs, and the Modbus protocol appearing only on port 502 of industrial control equipment. When the scanned port set satisfies the "must exist" constraint of a rule and does not violate the "must not exist" constraint, a high-confidence classification result (0.85-0.95) is directly returned without further machine learning calculations.
[0046] When the rule engine cannot match, a 31-dimensional feature vector is extracted from the scan results and input into the XGBoost machine learning model. The feature vector includes binary existence features of 28 key ports, total number of open ports, percentage of web ports, and database port presence flags. The process of obtaining the binary existence features is as follows: for the 28 key ports, the open status of each key port of the active device is detected. If it is open, it is recorded as the first preset value (e.g., 1), and if it is closed, it is recorded as the second preset value (e.g., 0), thereby generating binary features that characterize the network exposure surface of the active device.
[0047] The 28 key ports and their classification weights in this embodiment are shown in Table 1:
[0048] Table 1
[0049]
[0050] Step S3: Map the device types obtained from the multi-level progressive classification to the knowledge graph for verification. Each node in the knowledge graph stores the port signature set, banner service information, and operating system fingerprint of its corresponding device type. Obtain the node corresponding to the device type obtained in Step S2. Calculate the port feature similarity based on the open port list of active devices and the port signature set stored in the corresponding node. Calculate the semantic feature similarity based on the banner service information and operating system fingerprint of active devices and the corresponding information stored in the corresponding node to determine whether the corresponding node is a matching node for the active device. If so, merge the device fingerprints of the matching node and update the device knowledge graph. Record the active device, its device type, and confidence level into the asset database. Otherwise, create a new candidate node and decide whether to enter the manual annotation task based on the confidence level.
[0051] Each node in the knowledge graph also stores the relationship edges with other nodes.
[0052] For the 28 key ports, a differentiated weight is assigned to each key port. Ports with high specificity are given high weights (e.g., the weight of industrial control protocol ports (102 / 502) is set to 10.0, the weight of database ports (3306 / 1433) is set to 8.0, and the weight of security ports (554 / 4370) is set to 7.0~8.0), while ports with high versatility are given low weights (e.g., the weight of HTTP ports (80 / 443) is set to 2.0), forming a port weight matrix W. In this way, the "lack of key ports" is amplified in the similarity, while the weight of versatile ports is low, avoiding interference from weak signals.
[0053] Port feature similarity based on Calculate, where, The total number of predefined critical ports is represented by i, which is the index (serial number) of the i-th critical port as shown in Table 1. This represents the binary existence characteristic value of the i-th critical port in the open port list. It is set to 1 if the i-th critical port is in the open port list, and 0 otherwise. This represents the binary existence characteristic value of the i-th key port in the port signature set of the corresponding node. If the i-th key port is in the port signature set, it is set to 1; otherwise, it is set to 0. This represents the weight of the pre-set i-th key port.
[0054] The semantic feature similarity calculation process includes: for each active device and its corresponding node, its banner service information is combined with the operating system fingerprint to form a semantic document, thus obtaining two semantic documents corresponding to the active device and its corresponding node, respectively. Since each banner typically consists of only one line, the character-level n-gram TF-IDF algorithm, suitable for processing short texts, is used to convert the semantic document into a 256-dimensional embedding vector. The cosine similarity between the two embedding vectors is then used as the semantic feature similarity. This can resolve the ambiguity of different banner service information on the same port. For example, on the same port 80, "nginx / 1.18.0 (Ubuntu)" points to the application server, while "Hikvision-Webs / 3.0" points to the camera.
[0055] Obtaining the 256-dimensional embedding vector specifically involves: using sklearn's TfidfVectorizer with parameters set to analyzer="char_wb" (character-level word boundary-aware n-gram), ngram_range=(1,2) (simultaneously extracting single-character and double-character segments), and max_features=256 (taking the 256 most frequent character segments as the feature dimension); using the character-level n-gram TF-IDF algorithm to segment the string of the semantic document, extracting single-character and double-character segments, and selecting the 256 most frequent character segments to construct the feature space. For example, "nginx" is segmented into 'n', 'ng', 'g', 'gi', 'i', 'in', 'n', 'nx', 'x', etc.; calculating the TF-IDF weights of each character segment in the feature space to form a 256-dimensional embedding vector. The specific calculation process of TF-IDF weights follows existing technology. Calculating TF-IDF weights can automatically reduce the influence of high-frequency common character segments (such as 'n', 'a', etc.) and increase the weight of specific character segments (such as 'ik' corresponding to 'Hikvision', 'si' corresponding to 'Siemens'). The 256-dimensional embedding vector can maintain computational efficiency while covering all key device fingerprint information.
[0056] according to Calculate weighted similarity If weighted similarity If the value is not less than the first preset threshold, the corresponding node is determined to be a matching node of an active device. The list of open ports of active devices is merged into the port signature set of the matching node, and the confidence and sample size of the matching node are updated. If the weighted similarity is... If the device type is less than the first preset threshold, a new candidate node is created, and nodes of the same type with the same device type as the candidate node are scanned in the knowledge graph. Semantic similarity edges are automatically created for nodes of the same type with a weighted similarity of not less than the second preset threshold, and co-occurrence edges are automatically created for nodes of the same type with a sample number of not less than the third preset threshold, so as to form a dynamically growing knowledge graph structure. and The first preset threshold is greater than the second preset threshold, which is the weighting coefficient. In this embodiment, the first preset threshold is set to 0.6, the second preset threshold is set to 0.5, and the third preset threshold is set to 3.
[0057] When a node is determined not to be a matching node for an active device, and the confidence level obtained from the multi-level progressive classification of active devices is lower than the fourth preset threshold, a manual annotation task is created to obtain manually annotated samples. Then, the manually annotated samples are classified and managed according to the priority and status of the annotation task. When the number of manually annotated samples exceeds a set threshold or the growth rate of nodes in the knowledge graph exceeds a growth threshold, incremental retraining of the machine learning model is triggered, retaining the learned knowledge. The manual annotation task includes: the scanning results of active devices, the device types and confidence levels obtained from the machine learning model classification, and other candidate device types and probability distributions output by the machine learning model; priority includes high and normal; status includes pending annotation, annotated, reviewed, and returned; incremental retraining includes: mixing asset data with a confidence level not lower than the fifth preset threshold in the asset library with the manually annotated samples to construct a new training set. The confidence level of the manually annotated samples is set to 1.0. The training set is used to incrementally train the current version of the machine learning model to generate a new version of the machine learning model, and the old version is automatically deactivated. In this embodiment, the fourth preset threshold is set to 0.7, and the fifth preset value is set to 0.7. A schematic diagram of the annotation task data structure is shown below. Figure 3 As shown.
[0058] Step S4: When generating a honeypot for a certain device type, a graph traversal is performed starting from each node corresponding to that device type in the knowledge graph to obtain adjacent nodes. The port signature set, banner service information, and operating system fingerprint stored by each node and adjacent nodes are aggregated and merged into the honeypot template to generate the honeypot. The honeypot is then used for attack type detection and sliding window alerts.
[0059] In this embodiment, the BFS algorithm is used to traverse the similar_to neighbor nodes of each node. This allows the honeypot to not only simulate the standard ports of the target device, but also the additional ports of its associated devices, making the honeypot more attractive to hackers than real devices, increasing the attack surface and thus improving threat detection sensitivity.
[0060] like Figure 4As shown, the AI-based intranet asset identification and honeypot generation system includes a scanning module, an asset classification module, a honeypot deployment module, a manual annotation module, and a self-learning pipeline module. The scanning module scans the target intranet segment to obtain the IP address, MAC address, open port list, banner service information, and operating system fingerprint of each active device. The asset classification module performs multi-level progressive classification based on the open port list of active devices to obtain device type and confidence level, and uses a knowledge graph engine for matching and verification to obtain the asset classification result. The multi-level progressive classification adopts a priority strategy, executing rule engine classification, machine learning model classification, and heuristic fallback classification in sequence. The knowledge graph engine obtains nodes corresponding to the device types obtained by the asset classification module. It calculates port feature similarity based on the open port list of active devices and the port signature set stored in the corresponding node, and calculates semantic feature similarity based on the banner service information and operating system fingerprint of the active device and the corresponding information stored in the corresponding node to determine whether the corresponding node is a matching node for an active device. If so, it merges the device fingerprints of the matching nodes. The system updates the device knowledge graph and records active devices, their device types, and confidence levels into the asset library. Otherwise, it creates new candidate nodes and decides whether to create a manual annotation task based on the confidence level. The honeypot deployment module performs graph traversal starting from each node corresponding to the device type in the knowledge graph to obtain adjacent nodes. It aggregates the port signature set, banner service information, and operating system fingerprint stored by each node and its adjacent nodes, and merges them into the honeypot template to generate a honeypot. The manual annotation module performs manual annotation tasks, which include scanning results of active devices, device types and confidence levels obtained by machine learning model classification, and other candidate device types and probability distributions output by the machine learning model. The status includes pending annotation, annotated, reviewed, and returned. The self-learning pipeline module mixes asset data with a confidence level not lower than the fifth preset threshold in the asset library with manually annotated samples to construct a new training set when the number of manually annotated samples exceeds a set threshold or the node growth rate in the knowledge graph exceeds a growth threshold. The training set is then used to incrementally train the current version of the machine learning model to generate a new version of the machine learning model.
[0061] The invention will be further described below using specific scenarios:
[0062] Scenario 1: PLC Device Identification and Honeypot Deployment
[0063] Scanning Phase: Perform an ARP broadcast scan on the target network segment 192.168.1.0 / 24 to obtain a list of active devices. Perform a multi-port concurrent scan (28 key ports, timeout 2 seconds) on each active IP, and simultaneously obtain banner service information. For example, the scan result for an active device 192.168.1.100 is: open ports [102, 502], and the banner for port 102 is "Siemens S7-1200";
[0064] Multi-level classification:
[0065] Rule Engine: Port set {102,502} satisfies rule "({102,502}, set(), "plc", 0.95)" → returns device type "plc", confidence level 0.95, classification method "rule", directly obtains the classification result, skips subsequent classification calculations;
[0066] Knowledge graph verification:
[0067] The classification results are compared with the weighted cosine similarity of the nodes with device type "plc" in the knowledge graph. A node A (port signature [102,502,80], 8 samples, confidence 0.88) was found to exist historically. The port feature similarity = weighted cosine([102,502],[102,502,80])≈0.86, the semantic feature similarity = TF-IDF cosine("S7-1200","S7-1200 WebServer")≈0.78, and the weighted similarity = 0.6×0.86+0.4×0.78≈0.83>0.6. Therefore, the match is successful, and node A is the matching node for the active device 192.168.1.100. Node A is enhanced: sample size = 9, confidence = 0.91, port signature merged to [80,102,502].
[0068] Honeypot deployment:
[0069] Query the knowledge graph to obtain the PLC-type aggregation template: aggregated_ports=[80,102,502,44818]. Use BFS to traverse the similar_to neighbors of node A: neighbor B has port
[47808] , add it to the template, then the final honeypot service is [80 / HTTP, 102 / S7comm, 502 / Modbus, 44818 / EtherNetIP, 47808 / BACnet], and the port mapping is [80→14200, 102→14201, 502→14202, 44818→14203, 47808→14204]. The banner for each service is randomly selected from the knowledge graph aggregation banner library or the REALISTIC_BANNERS library. Start 5 asynchronous TCP servers and start listening.
[0070] Attack Detection:
[0071] The hacker host 10.0.0.66 sends a Modbus read holdingregisters request to port 14202 (formerly 502 / Modbus). The `_detect_attack_type()` function analyzes the payload and finds the first byte to be 0x00 (control character), which is determined to be "ics_probe". This is written to the attack log and sent to ThreatDetector for sliding window analysis.
[0072] Scenario 2: Manual annotation and model evolution of unknown IoT devices:
[0073] Recognition failure triggers annotation:
[0074] Scan results for device 192.168.1.88: Open ports [80, 1883], rule engine matching failed, XGBoost output probability distribution [plc: 0.08, iot_device: 0.25, unknown: 0.45], the highest probability is below the set threshold of 0.7. Heuristic fallback has no obvious features, returning unknown (0.3). Knowledge graph matching similarity < 0.4. The system automatically creates a labeling task (priority=high).
[0075] Manual annotation:
[0076] The administrator can view the annotation tasks via API, confirm the device type as "iot_device" based on port 1883 (MQTT) and banner information, and then submit the annotation.
[0077] Feedback loop:
[0078] `process_labeling_feedback()` updates the labeling status to "labeled" and updates the device type and confidence level (1.0) of the corresponding asset. When the number of labeled samples reaches the threshold of 10, incremental retraining is automatically triggered: 37 high-confidence assets + 10 manually labeled data are mixed to perform incremental training on the XGBoost model, generating a new model version v3, and the old version is automatically deactivated.
[0079] Effect verification:
[0080] The next time a similar device is scanned, the XGBoost model can correctly identify it as "iot_device" (confidence > 0.8), and no further annotation task will be created.
[0081] In this invention, the terms "first," "second," and "third," etc., are used only to distinguish similar objects and are not necessarily used to describe a specific order or sequence, nor should they be construed as indicating or implying relative importance. The use of terms such as "upper," "lower," "left," "right," "front," and "rear" to indicate orientation or positional relationships is based on the orientation or positional relationships shown in the accompanying drawings and is only for the convenience of describing the invention, not to indicate or imply that the device referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, it should not be construed as a limitation on the scope of protection of this invention. Those skilled in the art can understand the specific meaning of the above terms in this application according to the specific circumstances.
[0082] Furthermore, in the description of this application, unless otherwise stated, "multiple" means two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone. The character " / " generally indicates that the preceding and following related objects have an "or" relationship.
[0083] The above are merely specific embodiments of the present invention, but the design concept of the present invention is not limited thereto. Any non-substantial modifications made to the present invention using this concept shall be considered as infringing upon the protection scope of the present invention.
Claims
1. An artificial intelligence-based method for intranet asset identification and honeypot generation, characterized by: Includes the following steps: Step S1: Scan the target intranet segment to obtain the IP address, MAC address, open port list, banner service information and operating system fingerprint of each active device; Step S2: For each active device, a multi-level progressive classification is performed based on its open port list to obtain the device type and confidence level. The multi-level progressive classification adopts a priority strategy, and the rule engine classification, machine learning model classification, and heuristic fallback classification are executed in sequence. Step S3: Map the device types obtained from the multi-level progressive classification to the knowledge graph for verification. Each node in the knowledge graph stores the port signature set, banner service information, and operating system fingerprint of its corresponding device type. Obtain the node corresponding to the device type obtained in Step S2. Calculate the port feature similarity based on the open port list of active devices and the port signature set stored in the corresponding node. Calculate the semantic feature similarity based on the banner service information and operating system fingerprint of active devices and the corresponding information stored in the corresponding node to determine whether the corresponding node is a matching node for an active device. If so, merge the device fingerprints of the matching node and update the device knowledge graph. Record the active device, its device type, and confidence level into the asset database. Otherwise, create a new candidate node and decide whether to enter the manual annotation task based on the confidence level. Step S4: When generating a honeypot for a certain device type, perform graph traversal starting from each node corresponding to that device type in the knowledge graph to obtain adjacent nodes, aggregate the port signature set, banner service information, and operating system fingerprint stored by each node and adjacent nodes, and merge them into the honeypot template to generate the honeypot.
2. The method for intranet asset identification and honeypot generation based on artificial intelligence according to claim 1, characterized in that: Step S1 specifically involves: performing an ARP scan on the target intranet segment to obtain a list of active device IP addresses and MAC addresses; performing a multi-port concurrent scan on each active device to obtain a list of open ports, banner service information for each open port, and operating system fingerprint.
3. The method for intranet asset identification and honeypot generation based on artificial intelligence according to claim 2, characterized in that: In step S1, the operating system fingerprint is obtained by concatenating the Banner regular expression matching result, the TTL value estimation result, and the MAC OUI vendor matching result after deduplication. Specifically, the Banner regular expression matching includes: performing text feature matching on the Banner service information using regular expressions in a preset rule base, and taking the operating system description corresponding to the successfully matched regular expression as the Banner regular expression matching result. The rule base contains the mapping relationship between regular expressions and operating system descriptions. The TTL value estimation includes: obtaining the data packet returned by the active device when responding to the scan request, extracting the TTL field value in the data packet, and taking the operating system description corresponding to the TTL field value as the TTL value estimation result. The MAC OUI vendor matching includes: querying a preset vendor mapping library through the first 3 bytes of the MAC address, and taking the matched device manufacturer information as the MAC OUI vendor matching result.
4. The method for intranet asset identification and honeypot generation based on artificial intelligence according to claim 3, characterized in that: In step S2, the multi-layer progressive classification specifically includes: First, performing rule engine classification: When the list of open ports of an active device simultaneously satisfies the positive existence constraint of the preset device fingerprint rule and does not trigger the reverse exclusion constraint, the active device matching rule is determined to be successful, and the device type and confidence level defined by the device fingerprint rule are used as the classification result. Then, step S3 is executed. If the active device matching rule fails, machine learning model classification is executed: The feature vector extracted based on the scanning results of the active device is input into the XGBoost machine learning model to obtain the probability distribution of each active device type. When the maximum probability exceeds the set threshold, the corresponding device type is used as the classification result. Then, step S3 is executed. Otherwise, heuristic fallback classification is executed: The list of open ports is matched based on the preset basic port combination rule to output the classification result. The feature vector includes the binary existence feature of each key port in the list of open ports, the total number of open ports, the proportion of Web ports, and the existence flag of database ports.
5. The method for intranet asset identification and honeypot generation based on artificial intelligence according to claim 4, characterized in that: In step S3, the port feature similarity is based on Calculate, where, Let represent the predefined total number of critical ports, and let i represent the index of the i-th critical port. This represents the binary existence characteristic value of the i-th critical port in the list of open ports. This represents the binary existence characteristic value of the i-th key port in the port signature set of the corresponding node. This represents the weight of the pre-defined i-th key port. Key ports with high specificity are assigned high weights, while key ports with high versatility are assigned low weights.
6. The method for intranet asset identification and honeypot generation based on artificial intelligence according to claim 5, characterized in that: In step S3, the calculation process of the semantic feature similarity includes: for active devices and corresponding nodes, combining their banner service information with the operating system fingerprint to form a semantic document; using the character-level n-gram TF-IDF algorithm to convert the semantic document into a 256-dimensional embedding vector; and using the cosine similarity between the two embedding vectors as the semantic feature similarity. .
7. The method for intranet asset identification and honeypot generation based on artificial intelligence according to claim 6, characterized in that: In step S3, obtaining the 256-dimensional embedding vector specifically includes: segmenting the string of the semantic document using the character-level n-gram TF-IDF algorithm, extracting single-character segments and double-character segments, selecting the 256 most frequent character segments to construct a feature space; calculating the TF-IDF weight of each character segment in the feature space to form a 256-dimensional embedding vector.
8. The method for intranet asset identification and honeypot generation based on artificial intelligence according to claim 7, characterized in that: In step S3, according to Calculate weighted similarity If weighted similarity If the value is not less than the first preset threshold, the corresponding node is determined to be a matching node of an active device. The list of open ports of active devices is merged into the port signature set of the matching node, and the confidence and sample size of the matching node are updated. If the weighted similarity is... If the device type is less than the first preset threshold, a new candidate node is created, and nodes of the same type with the same device type as the candidate node in the knowledge graph are scanned. Semantic similarity edges are automatically created for nodes of the same type with a weighted similarity not less than the second preset threshold, and co-occurrence edges are automatically created for nodes of the same type with a sample number not less than the third preset threshold. and The first preset threshold is greater than the second preset threshold, which is the weighting coefficient.
9. The method for intranet asset identification and honeypot generation based on artificial intelligence according to claim 8, characterized in that: In step S3, when it is determined that the corresponding node is not a matching node of an active device, and the confidence level obtained by the multi-level progressive classification of the active device is lower than the fourth preset threshold, a manual annotation task is created to obtain manually annotated samples. Then, the manually annotated samples are classified and managed according to the priority and status of the annotation task. When the number of manually annotated samples is greater than the set quantity threshold or the growth rate of nodes in the knowledge graph is greater than the growth threshold, incremental retraining of the machine learning model is triggered. The manual annotation task includes: the scanning results of active devices, the device type and confidence level obtained by the machine learning model classification, and other candidate device types and probability distributions output by the machine learning model. The status includes pending annotation, annotated, reviewed, and returned. Incremental retraining includes: mixing asset data with a confidence level not lower than the fifth preset threshold in the asset library with manually annotated samples to construct a new training set, and using the training set to incrementally train the current version of the machine learning model to generate a new version of the machine learning model.
10. An AI-based intranet asset identification and honeypot generation system, used to implement the AI-based intranet asset identification and honeypot generation method as described in any one of claims 1 to 9, characterized in that: It includes a scanning module, an asset classification module, a honeypot deployment module, a manual annotation module, and a self-learning pipeline module; The scanning module is used to scan the target intranet segment and obtain the IP address, MAC address, open port list, banner service information and operating system fingerprint of each active device; The asset classification module performs multi-level progressive classification based on the list of open ports of active devices to obtain device type and confidence level, and uses a knowledge graph engine for matching and verification to obtain asset classification results. The multi-level progressive classification adopts a priority strategy, and executes rule engine classification, machine learning model classification and heuristic fallback classification in sequence. The knowledge graph engine is used to obtain nodes corresponding to the device types obtained by the asset classification module. It calculates port feature similarity based on the list of open ports of active devices and the port signature set stored in the corresponding nodes. It calculates semantic feature similarity based on the banner service information and operating system fingerprint of active devices and the corresponding information stored in the corresponding nodes to determine whether the corresponding node is a matching node of active devices. If so, it merges device fingerprints of matching nodes and updates the device knowledge graph. It also records active devices, their device types, and confidence scores into the asset database. Otherwise, it creates new candidate nodes and decides whether to create a manual annotation task based on the confidence score. The honeypot deployment module is used to perform graph traversal starting from each node corresponding to the device type in the knowledge graph to obtain adjacent nodes, aggregate the port signature set, banner service information, and operating system fingerprint stored by each node and adjacent nodes, and merge them into the honeypot template to generate a honeypot. The manual annotation module is used to perform manual annotation tasks. The manual annotation tasks include scanning results of active devices, device types and confidence levels obtained by machine learning model classification, and other candidate device types and probability distributions output by machine learning model. The status includes pending annotation, annotated, reviewed, and returned. The self-learning pipeline module is used to mix asset data with a confidence level of not less than the fifth preset threshold with manually labeled samples in the asset library to construct a new training set when the number of manually labeled samples exceeds a set threshold or the growth rate of nodes in the knowledge graph exceeds a growth threshold. The training set is then used to incrementally train the current version of the machine learning model to generate a new version of the machine learning model.