Method and system for detecting identity spoofing of knx devices based on physical layer fingerprints

Abstract

The application relates to the field of communication network security, and discloses a KNX device identity impersonation detection method and system based on a physical layer fingerprint, S1 performs analog-digital conversion and filter correction on an analog electric signal transmitted by a KNX device to be tested on a KNX bus, and intercepts a single-frame KNX message waveform signal when a frame header synchronization characteristic level is identified, S2 measures voltage variation values and clock characteristic parameters according to the single-frame KNX message waveform signal to construct a physical layer original characteristic vector, and synchronously obtains environmental parameters to construct an environmental state vector. By extracting the physical layer characteristics of the message waveform signal and combining environmental parameters such as environmental temperature and cable length, the message waveform signal is synchronously input into a variational autoencoder network for characteristic decoupling, and an intrinsic fingerprint distribution space and an environmental noise distribution space are separated in a hidden space, so that the influence of external environmental interference on the signal is stripped, and the accuracy and stability of the hardware fingerprint characteristics extracted under a complex bus environment are improved.

Description

Technical Field

[0001] This invention relates to the field of communication network security technology, specifically to a method and system for detecting KNX device identity spoofing based on physical layer fingerprinting. Background Technology

[0002] Intelligent building and industrial control networks widely employ KNX bus technology to connect various control devices. With the expansion of network scale, bus systems face security threats from device spoofing. To prevent unauthorized device access, physical layer spoofing detection devices are currently widely used to identify the hardware attributes of devices. These systems typically connect to the bus via a dedicated signal acquisition adapter, capturing the electrical signals generated by the device during communication and then sending them to a computing device for feature analysis to verify the legitimate identity of the accessing device.

[0003] Existing identity verification devices primarily sample the message signals sent by the device through analog-to-digital conversion circuits. After reading the raw waveform data, the computing device directly measures and extracts transient parameters such as the rising edge, amplitude, and clock frequency. These parameters are then combined into a physical layer feature vector, which is compared with pre-stored features of legitimate devices. This approach leverages the minute physical tolerances introduced during the manufacturing process of hardware components to identify abnormal devices even if the protocol layer address is forged.

[0004] In real-world applications, the physical environment within the KNX bus deployment space is not constant. Fluctuations in ambient temperature and multipath reflections caused by cable topology can interfere with the bus transmission channel, distorting the electrical signals transmitted by devices. Existing devices struggle to separate the inherent hardware fingerprint of a device from signal disturbances caused by environmental parameters when extracting features. This results in environmental noise being mixed into the feature vectors extracted by the system, making hardware fingerprint feature extraction in complex bus environments unstable and reducing the accuracy of device identification results. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this invention provides a KNX device identity spoofing detection method based on physical layer fingerprints. This method solves the problem that existing devices struggle to separate the inherent hardware fingerprint of KNX devices from environmental interference such as temperature fluctuations and multipath reflections, leading to unstable feature extraction and decreased accuracy in device identity determination.

[0006] To achieve the above objectives, the present invention provides the following technical solution: a KNX device identity spoofing detection method based on physical layer fingerprinting, comprising the following steps: S1. Perform analog-to-digital conversion and filtering correction on the analog electrical signals sent by the KNX device under test on the KNX bus, and extract and form a single-frame KNX message waveform signal when the frame header synchronization characteristic level is detected. S2. Measure the voltage change value and clock characteristic parameters based on the single-frame KNX message waveform signal to construct the physical layer original feature vector, and synchronously acquire environmental parameters to construct the environmental state vector. S3. Using a variational autoencoder model, the original feature vector of the physical layer and the environmental state vector are decoupled synchronously. The intrinsic fingerprint distribution space reflecting hardware attributes and the environmental noise distribution space reflecting external interference are separated in the latent space. The influence of the environmental noise distribution space is removed and the intrinsic hardware fingerprint feature vector is output. S4. Extract the logical address data contained in the single-frame KNX message waveform signal, retrieve the corresponding legal fingerprint template in the pre-built fingerprint database, calculate the Mahalanobis distance and Pearson correlation coefficient between the intrinsic hardware fingerprint feature vector and the legal fingerprint template, and output the comprehensive confidence score. S5. Compare the comprehensive confidence score with the set threshold, determine the legitimacy of the KNX device under test based on the comparison result, and perform the corresponding security response operation.

[0007] Preferably, step S1 specifically includes: performing analog-to-digital conversion on the analog electrical signal at a base sampling rate not lower than a set value to output original discrete waveform data; performing bandpass filtering on the original discrete waveform data to filter out out-of-band high-frequency noise, and performing DC offset correction operation on the filtered data to eliminate the bus DC bias component; when the first falling edge of a specific start domain is detected in the corrected data stream as the frame header synchronization characteristic level, generating a waveform truncation command to extract the corresponding message waveform data segment, forming the single-frame KNX message waveform signal.

[0008] Preferably, in step S2, the step of measuring the voltage change value and clock characteristic parameters based on the single-frame KNX message waveform signal specifically includes: locating the start edge of the single-frame KNX message waveform signal, measuring the rise time required for the rise from a set low level amplitude to a set high level amplitude, calculating the maximum rise slope of the start edge interval, recording the peak voltage of the single-frame KNX message waveform signal after reaching the steady state value to calculate the overshoot amplitude, and measuring the ringing frequency of the voltage oscillation interval after the overshoot. Within the data domain of the single-frame KNX message waveform signal, a series of consecutive bits are extracted, the actual average bit period of the series of consecutive bits is measured, and the deviation between the actual average bit period and the preset standard bit period is calculated to generate crystal oscillator frequency drift parameters.

[0009] Preferably, the process of constructing the original feature vector of the physical layer specifically includes: decomposing the single-frame KNX message waveform signal based on the time-domain reflectometry principle to separate the incident wave component and the reflected wave component; The reflection coefficient is calculated using the amplitude relationship between the incident wave component and the reflected wave component. Combined with the set KNX bus reference characteristic impedance, the output impedance phase angle of the KNX device under test is calculated. The measured and calculated rise time, maximum rise slope, overshoot amplitude, ringing frequency, crystal frequency drift parameter and output impedance phase angle are spliced ​​together in a preset dimension order to generate the physical layer original feature vector.

[0010] Preferably, in step S2, the step of acquiring environmental parameters to construct an environmental state vector specifically includes: acquiring ambient temperature data, the current number of node loads and idle power supply voltage data of the KNX bus, recording the arrival time difference between the incident wave component and the reflected wave component, calculating the cable length of the KNX bus using a preset cable signal propagation speed and the arrival time difference, and concatenating the ambient temperature data, the number of node loads, the idle power supply voltage data, and the cable length according to a set format to generate the environmental state vector.

[0011] Preferably, step S3 specifically includes: dividing the latent space where the continuous latent variables are located into mutually orthogonal intrinsic fingerprint distribution spaces and environmental noise distribution spaces; setting a loss function based on the principle of maximizing the lower bound of evidence; the loss function sets the prior distribution of the latent variables as an isotropic standard Gaussian distribution; and combining a divergence algorithm for measuring distribution differences with a set decoupling control weight coefficient to force the features of each dimension to be independent of each other in order to complete the feature distribution separation of the latent space.

[0012] Preferably, step S4 specifically includes: obtaining the mean vector and covariance matrix contained in the legitimate fingerprint template, calculating the Mahalanobis distance between the intrinsic hardware fingerprint feature vector and the mean vector, and using the covariance matrix to eliminate the correlation interference between different physical feature dimensions; Calculate the Pearson correlation coefficient between the intrinsic hardware fingerprint feature vector and the mean vector, and normalize the calculated Mahalanobis distance according to the set historical maximum distance threshold to output the normalized Mahalanobis distance. Extract the set first weight coefficient and second weight coefficient, and calculate the normalized Mahalanobis distance and Pearson correlation coefficient through a weighted fusion algorithm to output the comprehensive confidence score.

[0013] Preferably, step S5 specifically includes: when the comprehensive confidence score is greater than or equal to the set high confidence threshold, determining that the KNX device under test is a legitimate device, generating a release control command to maintain its communication status and allow the routing and forwarding of the corresponding message data, pushing the current intrinsic hardware fingerprint feature vector into the feature sliding window corresponding to the logical address data, and simultaneously removing the historical feature vector with the oldest timestamp in the feature sliding window, recalculating the mean vector and covariance matrix using the dataset in the feature sliding window, and updating the legitimate fingerprint template in the fingerprint database.

[0014] Preferably, the step of determining the legitimacy of the KNX device under test based on the comparison result and performing the corresponding security response operation further includes: when the comprehensive confidence score is less than or equal to the set low confidence threshold, determining that the KNX device under test is a counterfeit device, generating a security blocking command and performing a network packet filtering operation, discarding the control frame sent by the counterfeit device to block the transmission of the corresponding packet data on the KNX bus; When the overall confidence score is between the low confidence threshold and the high confidence threshold, the anomaly counting logic is activated to accumulate the number of times the critical score state appears in multiple consecutive frames of messages. When the accumulated number of occurrences reaches the set frequency judgment threshold, it is determined that the KNX device under test has experienced a physical characteristic mutation event, the permission of the KNX device under test to execute key control commands is suspended, and a review request is issued.

[0015] A KNX device spoofing detection system based on physical layer fingerprinting includes: The signal acquisition module is used to perform analog-to-digital conversion and filtering correction on the analog electrical signals sent by the KNX device under test on the KNX bus, and to extract and form a single-frame KNX message waveform signal when the frame header synchronization characteristic level is detected. The feature extraction module is used to measure voltage change values ​​and clock characteristic parameters based on the single-frame KNX message waveform signal to construct the physical layer original feature vector, and simultaneously acquire environmental parameters to construct the environmental state vector. The latent space feature decoupling module is used to synchronously decouple the original feature vector of the physical layer and the environmental state vector using a variational autoencoder model. It separates the intrinsic fingerprint distribution space reflecting hardware attributes and the environmental noise distribution space reflecting external interference in the latent space, and outputs the intrinsic hardware fingerprint feature vector by removing the influence of the environmental noise distribution space. The fingerprint matching module is used to extract the logical address data contained in the single-frame KNX message waveform signal, retrieve the corresponding legal fingerprint template in the pre-built fingerprint database, calculate the Mahalanobis distance and Pearson correlation coefficient between the intrinsic hardware fingerprint feature vector and the legal fingerprint template, and output a comprehensive confidence score. The security response module is used to compare the comprehensive confidence score with a set threshold, determine the legitimacy of the KNX device under test based on the comparison result, and perform corresponding control message blocking or feature sliding window update operations.

[0016] This invention provides a KNX device spoofing detection method based on physical layer fingerprinting. It has the following advantages: 1. This invention extracts the physical layer features of the message waveform signal and combines them with environmental parameters such as ambient temperature and cable length. The original physical layer features and environmental parameters are synchronously input into a variational autoencoder network for feature decoupling. In the latent space, the intrinsic fingerprint distribution space and the environmental noise distribution space are separated, thereby removing the influence of external environmental interference such as temperature drift and multipath reflection on the physical signal and improving the accuracy and stability of hardware fingerprint features extracted in complex bus environments.

[0017] 2. This invention retrieves the valid mean vector and covariance matrix from the fingerprint database, calculates the Mahalanobis distance and Pearson correlation coefficient between the intrinsic hardware fingerprint feature vector and the valid fingerprint template, and performs weighted fusion calculation. The covariance matrix reduces the dimensional differences and correlation interference between different physical feature dimensions. At the same time, the linear consistency measure can more objectively reflect the matching degree between the features of the device under test and the valid features, effectively reducing the false alarm rate in the identity determination process.

[0018] 3. This invention performs corresponding security response operations by comparing the comprehensive confidence score with a set threshold. When determining that the device is legitimate, the current intrinsic hardware fingerprint feature vector is pushed into the feature sliding window and the oldest historical feature vector is removed. In this way, the mean vector and covariance matrix are recalculated to update the legitimate fingerprint template, so that the system can dynamically adapt to the aging of physical components and characteristic shifts caused by long-term operation of the device, thereby improving the adaptability of the detection system under long-term operating conditions. Attached Figure Description

[0019] Figure 1 This is a diagram of the overall system architecture of the present invention; Figure 2 This is a flowchart of the method of the present invention; Figure 3 This is a schematic diagram of KNX message waveform feature extraction according to the present invention. Detailed Implementation

[0020] The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0021] Example: See attached document Figure 1 - Appendix Figure 3 This invention provides an identity spoofing detection system, which may include: a KNX bus, a KNX device under test, an environmental sensor node, a signal acquisition adapter, and a control and computing device. The KNX device under test is connected to the KNX bus for communication. The input end of the signal acquisition adapter is physically connected to the KNX bus through a coupling circuit. The environmental sensor node is deployed in the cable routing space where the KNX bus is located. The output end of the signal acquisition adapter establishes a data connection with the communication interface of the control and computing device. Based on this hardware connection, the aforementioned coupling circuit specifically includes a series high-pass filter unit and an impedance matching network, which are used to maintain the impedance balance of the KNX bus while physically isolating power frequency interference. The control and computing device is equipped with a logic module that executes an identity spoofing detection algorithm. The identity spoofing detection algorithm obtains waveform data and environmental parameters by calling the underlying hardware interface and then performs calculations to make judgments.

[0022] To address the aforementioned system, this invention further provides a corresponding identity spoofing detection method, the overall workflow of which is as follows: Through the signal acquisition module, the signal acquisition adapter performs analog-to-digital conversion on the analog electrical signals sent by the KNX device under test on the KNX bus at a set sampling rate, and outputs raw discrete waveform data. The signal acquisition module performs bandpass filtering and DC offset correction on the raw discrete waveform data. When the frame header synchronization mode set by the KNX protocol is detected, the signal acquisition module extracts and forms a single frame KNX message waveform signal. After completing the waveform capture operation, the feature extraction module controls and calculates the rise time, maximum rise slope, overshoot amplitude, ringing frequency, output impedance phase angle, and crystal frequency drift parameters based on the single-frame KNX message waveform signal. These parameters are then used to construct the physical layer's original feature vector. Simultaneously, the feature extraction module reads ambient temperature data from the environmental sensor nodes and combines it with the calculated cable length, node load quantity, and idle power supply voltage data to construct an environmental state vector.

[0023] After successfully acquiring physical features and environmental parameters, the control and computing devices synchronously input the original physical layer feature vector and environmental state vector into the set variational autoencoder network through the latent space feature decoupling module. The encoding network of the latent space feature decoupling module maps the input data into the latent space, separating the intrinsic fingerprint distribution space reflecting inherent hardware attributes and the environmental noise distribution space reflecting external interference in the latent space. The decoding network of the latent space feature decoupling module removes the influence of the environmental noise distribution space and outputs the intrinsic hardware fingerprint feature vector to be tested.

[0024] The fingerprint data comparison stage then begins. Through the fingerprint matching module, the control and computing device extracts the logical address data contained in the waveform signal of a single frame of KNX message, retrieves the legal fingerprint template corresponding to the extracted logical address data from the fingerprint database. The legal fingerprint template contains a mean vector and a covariance matrix. The fingerprint matching module calculates the Pearson correlation coefficient between the intrinsic hardware fingerprint feature vector and the mean vector, and calculates the Mahalanobis distance between the intrinsic hardware fingerprint feature vector and the legal fingerprint template based on the covariance matrix. The fingerprint matching module calculates and outputs a comprehensive confidence score based on the Pearson correlation coefficient and the Mahalanobis distance.

[0025] Finally, based on the comprehensive scoring results, the security response module and the control and computing device compare the comprehensive confidence score with the set threshold. When the comprehensive confidence score is greater than or equal to the high confidence threshold, the security response module determines that the KNX device under test is a legitimate device. When the comprehensive confidence score is less than or equal to the low confidence threshold, the security response module determines that the KNX device under test is a counterfeit device and issues a control command to block the routing and forwarding of the corresponding message in the bus network.

[0026] In practical implementation, the data acquisition and feature extraction method involved in this invention includes the following workflow: The analog-to-digital converter circuit in the signal acquisition adapter discretizes the analog electrical signal sent by the KNX device under test. The signal acquisition module controls the aforementioned analog-to-digital converter circuit to perform sampling actions according to the preset basic sampling rate and outputs the original discrete waveform data. To ensure the accuracy of waveform feature reconstruction, the preset basic sampling rate is set to no less than 100ksps.

[0027] After initial sampling, the signal acquisition module receives the original discrete waveform data and inputs it into the bandpass filter calculation unit. The bandpass filter calculation unit filters out out-of-band high-frequency noise in the original discrete waveform data. In specific implementation, the passband frequency of the bandpass filter calculation unit is set to cover the standard baud rate range of the KNX protocol. After filtering, the signal acquisition module performs DC offset correction on the filtered data to eliminate the bus DC bias component contained in the data.

[0028] After the above filtering and correction processing, the signal acquisition module monitors the level status in the corrected data stream. When the signal acquisition module detects the frame header synchronization characteristic level that conforms to the KNX protocol, specifically when it detects the first falling edge of the 0xFE start field, it generates a waveform truncation command. The signal acquisition module extracts the corresponding message waveform data segment according to the waveform truncation command to form a single frame KNX message waveform signal.

[0029] After the message interception is completed, the feature extraction module receives the single-frame KNX message waveform signal, measures the voltage change values ​​during the rising edge stage and steady state stage of the single-frame KNX message waveform signal, calculates the rising edge time, maximum rising slope, overshoot amplitude and ringing frequency of the single-frame KNX message waveform signal, and reads the actual bit period of multiple consecutive bits in the single-frame KNX message waveform signal. Combined with the standard bit period set by the system, the crystal oscillator frequency drift parameters are calculated.

[0030] Based on the aforementioned transient parameters, the feature extraction module decomposes the single-frame KNX message waveform signal according to the time-domain reflection measurement principle, separating the incident wave component and the reflected wave component. Based on the incident wave component, the reflected wave component, and the reference characteristic impedance of the KNX bus, the feature extraction module calculates the output impedance phase angle of the KNX device under test. The feature extraction module then concatenates the rise time, maximum rise slope, overshoot amplitude, ringing frequency, crystal frequency drift parameter, and output impedance phase angle to construct the original feature vector of the physical layer.

[0031] Simultaneously with waveform feature extraction, the feature extraction module acquires environmental parameters that affect the transmission of physical signals. The feature extraction module reads the ambient temperature collected by the environmental sensor node. The feature extraction module calculates the cable length of the KNX bus based on the time difference between the incident wave component and the reflected wave component. The feature extraction module acquires the current number of node loads and the idle state power supply voltage of the KNX bus. The feature extraction module splices the cable length, ambient temperature, number of node loads, and idle state power supply voltage to construct an environmental state vector.

[0032] The detailed workflow of the aforementioned method for extracting physical features and environmental parameters is as follows: The feature extraction module receives the single-frame KNX message waveform signal output by the signal acquisition module. After receiving the waveform signal, the feature extraction module locates the start edge of the single-frame KNX message waveform signal. The feature extraction module measures the rise time required for the single-frame KNX message waveform signal to rise from a set low level amplitude to a set high level amplitude. Subsequently, the feature extraction module calculates the maximum rise slope of the start edge interval.

[0033] After extracting the rising edge parameters, the feature extraction module records the peak voltage of the single-frame KNX message waveform signal after it reaches the steady-state value. The feature extraction module calculates the overshoot amplitude based on the peak voltage and the steady-state value. Based on this, the feature extraction module measures the ringing frequency of the voltage oscillation interval after the overshoot.

[0034] Based on the clock characteristics of the waveform, the feature extraction module extracts multiple consecutive bits in the data field of a single frame KNX message waveform signal, measures the actual average bit period of the multiple consecutive bits, calculates the deviation between the actual average bit period and the system standard bit period, and generates crystal oscillator frequency drift parameters.

[0035] In addition to the aforementioned transient waveform parameters, the feature extraction module decomposes the single-frame KNX message waveform signal based on the time-domain reflectometry principle. The feature extraction module extracts the incident wave component and the reflected wave component from the single-frame KNX message waveform signal. After extraction, the feature extraction module calculates the reflection coefficient using the amplitude relationship between the incident wave component and the reflected wave component. Furthermore, this is combined with the set KNX bus reference characteristic impedance. Calculate the output impedance phase angle of the KNX device under test. .

[0036] After calculating various independent parameters, the feature extraction module concatenates the rise time, maximum rise slope, overshoot amplitude, ringing frequency, crystal frequency drift parameter, and output impedance phase angle according to a preset dimensional order to generate the original physical layer feature vector. While extracting physical features, the feature extraction module reads the ambient temperature data collected by the environmental sensor nodes through the communication interface. The feature extraction module also obtains the number of node loads and idle power supply voltage data on the KNX bus through the control and computing devices.

[0037] For the physical link status, the feature extraction module records the arrival time difference between the aforementioned incident wave component and the reflected wave component. The feature extraction module utilizes the preset cable signal propagation speed Time difference with arrival Calculate the cable length of the KNX bus Finally, the feature extraction module combines ambient temperature data, the number of node loads, idle power supply voltage data, and cable length. The vector is generated by concatenating elements according to a set format.

[0038] The implicit space nonlinear decoupling method designed in this invention has the following specific workflow: The latent space feature decoupling module receives the physical layer original feature vector and the environment state vector output by the feature extraction module. After obtaining the physical layer original feature vector and the environment state vector, the latent space feature decoupling module performs a synchronous splicing operation and inputs the spliced ​​multidimensional data into the internally deployed variational autoencoder network. After the data splicing input is completed, the encoding network of the latent space feature decoupling module performs spatial mapping calculation of high-dimensional features and outputs continuous comprehensive latent variables. In order to achieve the separation of signal perturbation factors, the latent space feature decoupling module divides the latent space constraints where the comprehensive latent variables are located into two mutually orthogonal sub-distribution spaces.

[0039] The specific spatial division method is as follows: the sub-distribution space includes the intrinsic fingerprint distribution space and the environmental noise distribution space. The intrinsic fingerprint distribution space records the inherent hardware attribute characteristics of the KNX device under test, while the environmental noise distribution space characterizes the multipath reflection disturbances and temperature drift characteristics caused by the cable topology in the bus channel.

[0040] During the operation of the variational autoencoder network, the latent space feature decoupling module sets the loss function based on the principle of maximizing the lower bound of evidence. To achieve the aforementioned orthogonal constraint, the loss function sets the prior distribution of the latent variables to an isotropic standard Gaussian distribution, thereby forcibly constraining the independence of features in each dimension. The calculation logic conforms to the following relationship:

[0041] In the formula, Represents the loss function. Represents mathematical expectation, Represents the original feature vector of the physical layer. Represents the environment state vector. Represents a comprehensive set of latent variables. Represents the encoding network parameters. Represents the decoding network parameters. This represents the posterior probability distribution. Represents the likelihood distribution. Represents the prior distribution, This represents the Kullback-Leibler divergence, used to measure the difference in distributions. This represents the set decoupling control weight coefficient.

[0042] After separating the feature distribution in the latent space based on the above loss function, the decoding network of the latent space feature decoupling module only extracts the data of the intrinsic fingerprint distribution space as the basic parameters for network reconstruction. At this decoding reconstruction node, the decoding network discards the data transmission path of the environmental noise distribution space.

[0043] Through the aforementioned one-way extraction and decoding reconstruction process, the latent space feature decoupling module eliminates nonlinear signal distortion caused by environmental parameters, and finally outputs a pure intrinsic hardware fingerprint feature vector, which is then transmitted to the subsequent matching unit.

[0044] To achieve accurate comparison, the high-dimensional fingerprint statistical matching method provided by this invention mainly covers the following workflow: The fingerprint matching module receives the intrinsic hardware fingerprint feature vector output by the feature decoupling module. After receiving the aforementioned vector data, the fingerprint matching module sets the received intrinsic hardware fingerprint feature vector as the feature vector to be tested. Simultaneously, the fingerprint matching module extracts the logical address data carried in the single-frame KNX message waveform signal.

[0045] For the extracted logical address data, the fingerprint matching module accesses the fingerprint database configured inside the system. The fingerprint matching module retrieves the corresponding valid fingerprint template based on the aforementioned logical address data. The valid fingerprint template includes the mean vector and covariance matrix generated from historical verification of the aforementioned logical address data.

[0046] After successfully obtaining a valid fingerprint template, the fingerprint matching module calculates the Mahalanobis distance between the feature vector to be tested and the mean vector. The fingerprint matching module uses the covariance matrix to eliminate the dimensional differences and correlation interference between different physical feature dimensions.

[0047] After completing the distance parameter calculation, the fingerprint matching module calculates the Pearson correlation coefficient between the feature vector to be tested and the mean vector. The fingerprint matching module uses the Pearson correlation coefficient to measure the degree of linear consistency between the feature vector to be tested and the legitimate fingerprint template in terms of the trend of physical feature changes.

[0048] After obtaining the aforementioned two sets of judgment parameters, the fingerprint matching module performs a normalization operation on the calculated Mahalanobis distance and outputs the normalized Mahalanobis distance. In specific implementation, the fingerprint matching module performs a ratio operation based on the historical maximum distance threshold set by the system to complete the aforementioned normalization process.

[0049] Subsequently, the fingerprint matching module extracts the system's preset first and second weighting coefficients. The fingerprint matching module then performs a weighted fusion of the normalized Mahalanobis distance, Pearson correlation coefficient, and the corresponding weighting coefficients. Finally, the fingerprint matching module calculates and outputs a comprehensive confidence score. The calculation logic for the comprehensive confidence score conforms to the following formula:

[0050] In the formula, This represents the overall confidence score. Represents the first weighting coefficient. Represents the second weighting coefficient, where, + =1, Represents the normalized Markov distance. This represents a minimal constant parameter to prevent the denominator from being zero during calculation. This represents the Pearson correlation coefficient.

[0051] After outputting the scoring results, the fingerprint matching module stores the calculated comprehensive confidence score, establishes a mapping relationship between the comprehensive confidence score and the feature vector to be tested and the logical address data, and transmits the aforementioned mapping relationship to the security response module to perform subsequent operations.

[0052] Finally, the security determination and response method provided by this invention has the following workflow: The security response module receives the comprehensive confidence score, the feature vector to be tested, and the logical address data transmitted by the fingerprint matching module. After receiving the aforementioned judgment parameters, the security response module extracts the pre-configured high confidence threshold and low confidence threshold in the system. The security response module executes a numerical comparison program to compare the comprehensive confidence score with the high confidence threshold and the low confidence threshold, respectively.

[0053] Based on the output of the aforementioned numerical comparison program, when the overall confidence score is greater than or equal to the high confidence threshold, the security response module determines that the KNX device under test is a legitimate device. Subsequently, the security response module generates a release control command. The security response module maintains the communication status of the KNX device under test on the KNX bus according to the release control command, and allows the routing and forwarding of the corresponding message data.

[0054] After determining that the KNX device under test is a legitimate device, the security response module performs fingerprint template maintenance. Specifically, the security response module pushes the current feature vector under test into the feature sliding window of the corresponding logical address data, and simultaneously removes the historical feature vector with the oldest timestamp in the feature sliding window. After completing the data queue update, the security response module recalculates the mean vector and covariance matrix using the dataset in the feature sliding window, and updates the legitimate fingerprint template in the fingerprint database.

[0055] If the numerical comparison program outputs a different result, i.e., when the overall confidence score is less than or equal to the low confidence threshold, the security response module determines that the KNX device under test is a counterfeit device. At this time, the security response module generates a security blocking command. In this step, the control and computing device calls the underlying network packet filtering interface according to the security blocking command to discard the control frames sent by the counterfeit device in order to intercept and block the transmission of the corresponding packet data on the KNX bus. After the interception operation is completed, the security response module generates a security alarm log based on the logical address data and the feature vector under test for storage. For situations where the overall confidence score falls between the low and high confidence thresholds, the security response module activates an anomaly counter. The security response module accumulates the number of occurrences of the aforementioned critical score state in multiple consecutive frames of messages. When the accumulated number of occurrences reaches the set frequency threshold, the security response module determines that the KNX device under test has experienced a physical characteristic mutation event. In response to the aforementioned mutation event, the security response module suspends the permission of the KNX device under test to execute critical control commands and sends a review request to the external management platform.

[0056] From a system architecture perspective, the identity spoofing detection device designed in this invention mainly consists of multiple virtual functional modules that are program code embedded in a non-volatile storage medium and loaded and executed by a processor, specifically including: The signal acquisition module is used to perform analog-to-digital conversion and filtering correction on the analog electrical signals sent by the KNX device under test, and to capture the waveform signal of a single frame KNX message when the frame header synchronization characteristic level is detected.

[0057] After the signal acquisition module completes the waveform capture operation, the feature extraction module is triggered. It is used to measure multiple voltage change values ​​and clock characteristic parameters based on the single frame KNX message waveform signal to construct the physical layer original feature vector, and simultaneously acquire ambient temperature, cable length, number of node loads and idle power supply voltage to construct the environmental state vector.

[0058] After the feature extraction module generates various data vectors, the latent space feature decoupling module is called to input the original physical layer feature vector and the environmental state vector into the latent space of the variational autoencoder network. Based on the prior constraints of the standard Gaussian distribution, the intrinsic fingerprint distribution space and the environmental noise distribution space are separated, and the intrinsic hardware fingerprint feature vector is output.

[0059] After the latent space feature decoupling module outputs the separated features, the fingerprint matching module is started to retrieve the legitimate fingerprint template based on the logical address data carried in the single frame KNX message waveform signal. The mean vector and covariance matrix of the legitimate fingerprint template are combined to calculate the Mahalanobis distance and Pearson correlation coefficient, and output the comprehensive confidence score.

[0060] Based on the scoring results output by the fingerprint matching module, the security response module compares the comprehensive confidence score with the high confidence threshold and low confidence threshold configured by the system. Based on the comparison results, it determines the access legitimacy of the KNX device under test and performs control message blocking or feature sliding window update operations.

[0061] Furthermore, the present invention also provides a computer device whose hardware architecture includes a processor, a memory, and a network communication interface connected via a system bus.

[0062] Regarding the specific configuration of the physical hardware, the memory provides storage space for data reading and instruction resident. The memory contains non-volatile storage media and running memory. The non-volatile storage media is partitioned to store the basic operating system and computer programs. The running memory provides a computing environment for calling and executing the basic operating system and computer programs. The network communication interface is used to establish instruction transmission and reception links with the underlying signal acquisition adapter and external management platform.

[0063] Based on the aforementioned hardware environment, the processor calls the computer program stored in the memory. When the processor executes the aforementioned computer program, it implements all the steps and logic of the identity spoofing detection method described in the previous embodiments.

[0064] In addition to physical computing devices, the present invention also covers a computer-readable storage medium, which internally stores computer-executable instructions. When a processor reads and runs the aforementioned computer-executable instructions, it executes the identity spoofing detection method described in the preceding embodiments.

[0065] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A method for detecting spoofing of KNX devices based on physical layer fingerprinting, characterized in that, Includes the following steps: S1. Perform analog-to-digital conversion and filtering correction on the analog electrical signals sent by the KNX device under test on the KNX bus, and extract and form a single-frame KNX message waveform signal when the frame header synchronization characteristic level is detected. S2. Measure the voltage change value and clock characteristic parameters based on the single-frame KNX message waveform signal to construct the physical layer original feature vector, and synchronously acquire environmental parameters to construct the environmental state vector. S3. Using a variational autoencoder model, the original feature vector of the physical layer and the environmental state vector are decoupled synchronously. The intrinsic fingerprint distribution space reflecting hardware attributes and the environmental noise distribution space reflecting external interference are separated in the latent space. The influence of the environmental noise distribution space is removed and the intrinsic hardware fingerprint feature vector is output. S4. Extract the logical address data contained in the single-frame KNX message waveform signal, retrieve the corresponding legal fingerprint template in the pre-built fingerprint database, calculate the Mahalanobis distance and Pearson correlation coefficient between the intrinsic hardware fingerprint feature vector and the legal fingerprint template, and output the comprehensive confidence score. S5. Compare the comprehensive confidence score with the set threshold, determine the legitimacy of the KNX device under test based on the comparison result, and perform the corresponding security response operation.

2. The KNX device identity spoofing detection method based on physical layer fingerprinting according to claim 1, characterized in that, Step S1 specifically includes: The analog electrical signal is converted from analog to digital at a base sampling rate not lower than a set value to output the original discrete waveform data; bandpass filtering is performed on the original discrete waveform data to filter out out-of-band high-frequency noise, and DC offset correction is performed on the filtered data to eliminate the bus DC bias component. When the first falling edge of a specific start domain is detected in the corrected data stream as the frame header synchronization characteristic level, a waveform truncation instruction is generated to extract the corresponding message waveform data segment and form the single-frame KNX message waveform signal.

3. The KNX device identity spoofing detection method based on physical layer fingerprinting according to claim 1, characterized in that, In step S2, measuring the voltage change value and clock characteristic parameters based on the single-frame KNX message waveform signal specifically includes: Locate the start edge of the single-frame KNX message waveform signal, measure the rise time required for the rise from a set low level amplitude to a set high level amplitude, calculate the maximum rise slope of the start edge interval, record the peak voltage of the single-frame KNX message waveform signal after reaching the steady state value to calculate the overshoot amplitude, and measure the ringing frequency of the voltage oscillation interval after the overshoot. Within the data domain of the single-frame KNX message waveform signal, a series of consecutive bits are extracted, the actual average bit period of the series of consecutive bits is measured, and the deviation between the actual average bit period and the preset standard bit period is calculated to generate crystal oscillator frequency drift parameters.

4. The KNX device identity spoofing detection method based on physical layer fingerprinting according to claim 3, characterized in that, The process of constructing the original feature vector of the physical layer specifically includes: Based on the time-domain reflectometry principle, the single-frame KNX message waveform signal is decomposed to separate the incident wave component and the reflected wave component. The reflection coefficient is calculated using the amplitude relationship between the incident wave component and the reflected wave component. Combined with the set KNX bus reference characteristic impedance, the output impedance phase angle of the KNX device under test is calculated. The measured and calculated rise time, maximum rise slope, overshoot amplitude, ringing frequency, crystal frequency drift parameter and output impedance phase angle are spliced ​​together in a preset dimension order to generate the physical layer original feature vector.

5. The KNX device identity spoofing detection method based on physical layer fingerprinting according to claim 4, characterized in that, In step S2, obtaining environmental parameters to construct an environmental state vector specifically includes: Acquire ambient temperature data, as well as the current node load count and idle power supply voltage data of the KNX bus. Record the arrival time difference between the incident wave component and the reflected wave component. Calculate the cable length of the KNX bus using a preset cable signal propagation speed and the arrival time difference. Then, concatenate the ambient temperature data, node load count, idle power supply voltage data, and cable length according to a set format to generate the environmental state vector.

6. The KNX device identity spoofing detection method based on physical layer fingerprinting according to claim 1, characterized in that, Step S3 specifically includes: The latent space containing continuous latent variables is constrained into mutually orthogonal intrinsic fingerprint distribution space and environmental noise distribution space. A loss function is set according to the principle of maximizing the lower bound of evidence. The loss function sets the prior distribution of latent variables as an isotropic standard Gaussian distribution and combines it with a divergence algorithm to measure the distribution difference and a set decoupling control weight coefficient to force the features of each dimension to be independent of each other in order to complete the feature distribution separation of the latent space.

7. The KNX device identity spoofing detection method based on physical layer fingerprinting according to claim 1, characterized in that, Step S4 specifically includes: Obtain the mean vector and covariance matrix contained in the legitimate fingerprint template, calculate the Mahalanobis distance between the intrinsic hardware fingerprint feature vector and the mean vector, and use the covariance matrix to eliminate the correlation interference between different physical feature dimensions; Calculate the Pearson correlation coefficient between the intrinsic hardware fingerprint feature vector and the mean vector, and normalize the calculated Mahalanobis distance according to the set historical maximum distance threshold to output the normalized Mahalanobis distance. Extract the set first weight coefficient and second weight coefficient, and calculate the normalized Mahalanobis distance and Pearson correlation coefficient through a weighted fusion algorithm to output the comprehensive confidence score.

8. The KNX device identity spoofing detection method based on physical layer fingerprinting according to claim 1, characterized in that, Step S5 specifically includes: When the overall confidence score is greater than or equal to the set high confidence threshold, the KNX device under test is determined to be a legitimate device. A release control command is generated to maintain its communication status and allow the routing and forwarding of the corresponding message data. The current intrinsic hardware fingerprint feature vector is pushed into the feature sliding window corresponding to the logical address data, and the historical feature vector with the oldest timestamp in the feature sliding window is removed simultaneously. The mean vector and covariance matrix are recalculated using the dataset in the feature sliding window, and the legitimate fingerprint template in the fingerprint database is updated.

9. The KNX device identity spoofing detection method based on physical layer fingerprinting according to claim 8, characterized in that, The step of determining the legitimacy of the KNX device under test based on the comparison results and performing corresponding security response operations also includes: When the overall confidence score is less than or equal to the set low confidence threshold, the KNX device under test is determined to be a counterfeit device, a security blocking command is generated and a network packet filtering operation is performed, and the control frame sent by the counterfeit device is discarded to block the transmission of the corresponding packet data on the KNX bus. When the overall confidence score is between the low confidence threshold and the high confidence threshold, the anomaly counting logic is activated to accumulate the number of times the critical score state appears in multiple consecutive frames of messages. When the accumulated number of occurrences reaches the set frequency judgment threshold, it is determined that the KNX device under test has experienced a physical characteristic mutation event, the permission of the KNX device under test to execute key control commands is suspended, and a review request is issued.

10. A KNX device spoofing detection system based on physical layer fingerprinting, characterized in that, include: The signal acquisition module is used to perform analog-to-digital conversion and filtering correction on the analog electrical signals sent by the KNX device under test on the KNX bus, and to extract and form a single-frame KNX message waveform signal when the frame header synchronization characteristic level is detected. The feature extraction module is used to measure voltage change values ​​and clock characteristic parameters based on the single-frame KNX message waveform signal to construct the physical layer original feature vector, and simultaneously acquire environmental parameters to construct the environmental state vector. The latent space feature decoupling module is used to synchronously decouple the original feature vector of the physical layer and the environmental state vector using a variational autoencoder model. It separates the intrinsic fingerprint distribution space reflecting hardware attributes and the environmental noise distribution space reflecting external interference in the latent space, and outputs the intrinsic hardware fingerprint feature vector by removing the influence of the environmental noise distribution space. The fingerprint matching module is used to extract the logical address data contained in the single-frame KNX message waveform signal, retrieve the corresponding legal fingerprint template in the pre-built fingerprint database, calculate the Mahalanobis distance and Pearson correlation coefficient between the intrinsic hardware fingerprint feature vector and the legal fingerprint template, and output a comprehensive confidence score. The security response module is used to compare the comprehensive confidence score with a set threshold, determine the legitimacy of the KNX device under test based on the comparison result, and perform corresponding control message blocking or feature sliding window update operations.

Images