Student online monitoring system and method based on real-time analysis of data packets and behavior profiling

Abstract

The present application belongs to the technical field of campus network monitoring, and provides a student online monitoring system and method based on real-time data packet analysis and behavior profiling, comprising: real-time capture of TCP data packet messages of a target account, extraction of a header timestamp option field TSval and a system absolute time, calculation of terminal hardware clock offset slope alpha through linear regression, generation of a legal hardware fingerprint reference library, storage of the reference library and a legal terminal quantity reference value into a behavior profile, formation of a judgment reference feature library, clustering of alpha within a preset observation period, identification of the actual physical hardware fingerprint quantity, comparison with the legal quantity, judgment of whether there is a violation of hotspot or private device behavior. The present application is based on physical layer characteristics, has strong anti-camouflage capability, only processes message headers, has low computing power consumption, is suitable for high concurrency scenarios of campus networks, is accurate in judgment, complies with privacy, and improves the reliability and efficiency of campus network violation access monitoring.

Description

Technical Field

[0001] This invention belongs to the field of campus network monitoring technology, specifically a student internet monitoring system and method based on real-time data packet analysis and behavioral profiling. Background Technology

[0002] Collaborative management based on real-time data packet analysis and behavioral profiling has become the mainstream approach for monitoring student internet access on campus networks. The core is to extract real-time behavioral characteristics by parsing data packets and combine them with student behavioral profiles to make accurate judgments. Among these, preventing students from setting up their own portable WiFi, routers, or hotspots (NAT forwarding) is a key requirement of the system.

[0003] Current monitoring methods for this violation have significant flaws and are ill-suited to the aforementioned control logic: TTL value detection relies on easily tampered software-layer fields, which students can bypass through technical means, leading to distorted data packet analysis features and failing to provide a reliable basis for behavioral profiling; User-Agent analysis is limited by HTTPS encryption, and full traffic decryption requires enormous computing power, causing performance bottlenecks in high-concurrency scenarios on campus networks, and UA is easily spoofed, rendering the terminal identification dimension of behavioral profiling ineffective; Application-layer feature statistics rely solely on connection counts and traffic modeling, which are prone to false alarms in legitimate multi-terminal usage scenarios, failing to provide features that distinguish compliance from violation for behavioral profiling and undermining the accuracy of profiling judgment benchmarks.

[0004] In summary, existing methods have weak anti-circumvention capabilities, high resource consumption, and high false alarm rates. They cannot support the performance requirements of real-time analysis of campus network data packets and result in a lack of reliable feature dimensions for behavioral profiling. Consequently, monitoring systems based on real-time data packet analysis and behavioral profiling lack accuracy in preventing and controlling unauthorized hotspot access and urgently need improvement.

[0005] To this end, the present invention provides a student internet monitoring system and method based on real-time data packet analysis and behavioral profiling. Summary of the Invention

[0006] In order to overcome the shortcomings of the prior art, at least one technical problem raised in the background art is solved.

[0007] The technical solution adopted by this invention to solve its technical problem is: One of the objectives of this invention is to provide a method for monitoring student internet use based on real-time data packet analysis and behavioral profiling, including: Step S10: In real time, obtain TCP data packets generated by the target account in the campus network, extract only the timestamp option field TSval in the TCP data packet header, and record the system absolute time when each TCP data packet is received; Step S20: Associate the timestamp option field TSval of the same target account with the system absolute time, use the linear regression algorithm to calculate the terminal hardware clock offset slope α of the target account, and generate a legitimate hardware fingerprint benchmark library for the target account. Step S30: Store the legitimate hardware fingerprint baseline library of each target account and the baseline value of the number of legitimate terminals allowed for each target account into the behavioral profile of the corresponding target account to form the judgment baseline feature library of each target account. Step S40: Within the preset observation period, perform cluster analysis on the terminal hardware clock offset slope α value corresponding to different network connection flows under the same target account, identify the actual number of physical hardware fingerprints under the target account, and compare the actual number of physical hardware fingerprints with the benchmark value of the number of legitimate terminals corresponding to the target account in the behavior profile. If the actual number of physical hardware fingerprints is greater than the benchmark value of the number of legitimate terminals, it is determined that the target account has abnormal behavior of illegally setting up proxy hotspots or privately connecting network devices.

[0008] As a further improvement of the present invention, the specific process of obtaining TCP data packets generated by the target account in the campus network in real time is as follows: Deploy data packet acquisition units on the mirror ports of campus network switches, aggregation switches, and access layer switches, as well as on the mirror channels of campus network wireless AC / APs. Using a bypass monitoring mode, a packet capture engine is employed to capture all Transmission Control Protocol (TCP) data packets flowing through the corresponding links in real time.

[0009] As a further improvement of the present invention, the specific process of extracting only the timestamp option field TSval from the TCP packet header is as follows: Connect to the campus network authentication system to obtain each target account, establish a target account-campus network authentication account-terminal IP-MAC address mapping table, obtain TCP data packets, extract the source IP address and source MAC address of each TCP data packet frame, filter out the TCP data packets of the terminal associated with the target account through the target account-campus network authentication account-terminal IP-MAC address mapping table, discard UDP, ICMP, DNS non-TCP protocol packets, and only retain the timestamp option field TSval carried in the TCP data packet header.

[0010] As a further improvement of the present invention, the specific process of recording the system absolute time when each TCP data packet is received is as follows: Only the TCP packet header data is parsed, not the TCP packet payload. The timestamp option field TSval in the header is extracted, and the system absolute time when the packet acquisition unit receives the TCP packet is recorded to form a target account-timestamp option field TSval-system absolute time T association data pair.

[0011] As a further improvement of the present invention, the specific process of generating the legitimate hardware fingerprint benchmark library for the target account is as follows: The target account-timestamp option field TSval-system absolute time T is associated with a data pair. The terminal hardware clock offset slope α is calculated, and the terminal hardware clock offset slope α is bound to the target account and stored in the behavior profile storage module to form a legitimate hardware fingerprint baseline library for the corresponding target account.

[0012] As a further improvement of the present invention, the specific process of calculating the terminal hardware clock offset slope α is as follows: From the associated data pair of target account - timestamp option field TSval - system absolute time T, obtain all timestamp option field TSval and system absolute time under the same target account. Then, use a linear regression algorithm to calculate the terminal hardware clock offset slope α corresponding to the target account. The formula is: ; The timestamp option field TSval generated for the terminal. Let T be the absolute time of the system. The slope of the terminal hardware clock offset. This is the initial offset of the terminal hardware clock; The slope α of the linear regression algorithm is solved using the least squares method, and only the slope α with a determination coefficient greater than 0.95 is retained as the terminal hardware clock offset slope α.

[0013] As a further improvement of the present invention, the specific process of forming the judgment benchmark feature library for each target account is as follows: The terminal hardware clock offset slope α value in the legitimate hardware fingerprint benchmark library of each target account, as well as the benchmark value of the number of legitimate terminals allowed for each target account, are stored in the behavioral profile of the corresponding target account to form the judgment benchmark feature library of each target account.

[0014] As a further improvement of the present invention, the specific process of identifying the actual number of physical hardware fingerprints under the target account is as follows: Within a preset observation period, the terminal hardware clock offset slope α value corresponding to all network connection flows under the same target account is obtained to form an α value set. From the judgment benchmark feature library, the benchmark value of the number of legal terminals corresponding to the target account is obtained. The K-means clustering algorithm is used to perform similarity clustering on the α value set. When the deviation of the two terminal hardware clock offset slope α values ​​is ≤0.001, they are judged as the physical hardware fingerprint of the same physical terminal. The set of α values ​​is input into the K-means clustering algorithm model. The number of clusters is automatically divided with the similarity threshold as the upper limit of the intra-cluster distance. The final number of clusters obtained by clustering is the number of actual physical hardware fingerprints under the target account.

[0015] As a further improvement of the present invention, the specific process for determining whether the target account has engaged in abnormal behavior such as illegally setting up a proxy hotspot or privately connecting network devices is as follows: Obtain the baseline value of the number of legitimate terminals for the target account in the behavioral profile, and compare the baseline value of the number of legitimate terminals with the actual number of physical hardware fingerprints. If the actual number of physical hardware fingerprints is greater than the baseline value of the number of legitimate terminals, it is determined that the target account has abnormal behavior of illegally setting up proxy hotspots or privately connecting network devices.

[0016] The second objective of this invention is to provide a student internet monitoring system based on real-time data packet analysis and behavioral profiling, comprising the following modules: The data packet acquisition and extraction module: acquires TCP data packets generated by the target account in the campus network in real time, extracts only the timestamp option field TSval in the TCP data packet header, and records the absolute system time when each TCP data packet is received; Hardware fingerprint calculation module: Associates the timestamp option field TSval of the same target account with the system absolute time, uses a linear regression algorithm to calculate the terminal hardware clock offset slope α of the target account, and generates a legitimate hardware fingerprint benchmark library for the target account. Behavioral profile storage module: Stores the legal hardware fingerprint baseline library of each target account and the baseline value of the number of legal terminals allowed for each target account into the behavioral profile of the corresponding target account, forming the judgment baseline feature library of each target account; Violation Detection Module: Within a preset observation period, cluster analysis is performed on the terminal hardware clock offset slope α value corresponding to different network connection flows under the same target account to identify the actual number of physical hardware fingerprints under the target account. The actual number of physical hardware fingerprints is compared with the benchmark value of the number of legitimate terminals corresponding to the target account in the behavior profile. If the actual number of physical hardware fingerprints is greater than the benchmark value of the number of legitimate terminals, it is determined that the target account has abnormal behavior of illegally setting up proxy hotspots or privately connecting network devices.

[0017] The beneficial effects of this invention are as follows: 1. This invention generates a clock offset slope α based on the inherent frequency deviation of the terminal hardware crystal oscillator. This slope is a physical layer feature that cannot be modified, disguised, or bypassed by software. It completely solves the technical pain point that existing software layer features such as TTL values ​​and User-Agent are easily tampered with, and fundamentally improves the reliability of monitoring unauthorized access.

[0018] 2. The entire process only extracts the timestamp option field TSval from the TCP packet header, without parsing the packet payload, which greatly reduces the amount of data processing. The least squares method and K-means clustering algorithm used have low computational complexity and short processing time for single account determination. It is perfectly adapted to the real-time monitoring needs of massive concurrency on campus networks and avoids the performance bottleneck caused by traditional full-traffic decryption.

[0019] 3. By using cluster analysis to identify the actual number of physical hardware fingerprints under the same account, the system can accurately distinguish between legitimate multi-terminal access and unauthorized hotspot / privately connected devices, completely solving the false alarm problem of existing application-layer feature statistics (such as concurrent connection count and traffic modeling) in legitimate multi-terminal scenarios, and significantly improving the accuracy of judgment.

[0020] 4. Store the terminal hardware fingerprint (α value) and the baseline value of the number of legitimate terminals into the behavior profile to form a unique judgment baseline feature library, and support dynamic updates of the baseline (such as terminal replacement, management rule adjustment), so that monitoring can be upgraded from a one-size-fits-all approach to personalized and accurate judgment, giving full play to the baseline support role of the behavior profile. Attached Figure Description

[0021] The invention will now be further described with reference to the accompanying drawings.

[0022] Figure 1 This is a flowchart illustrating the steps of the student internet monitoring method based on real-time data packet analysis and behavioral profiling according to the present invention. Figure 2 This is a system module diagram of the student internet monitoring system based on real-time data packet analysis and behavioral profiling, as described in this invention. Detailed Implementation

[0023] To make the technical means, creative features, objectives and effects of this invention easier to understand, the invention will be further described below in conjunction with specific embodiments.

[0024] Example 1 like Figure 1 As shown in the embodiment of the present invention, the student internet monitoring system and method based on real-time data packet analysis and behavioral profiling includes: Step S10: In real time, acquire TCP data packets generated by the target account in the campus network, extract only the timestamp option field TSval in the TCP data packet header, and record the system absolute time T when each TCP data packet is received; In step S10, the specific process of acquiring TCP data packets generated by the target account in the campus network in real time is as follows: Deploy data packet acquisition units on the mirror ports of campus network switches, aggregation switches, and access layer switches (covering classrooms, computer rooms, and dormitories), and connect them to the mirror channels of the campus network wireless AC / AP to achieve full-link coverage of wired and wireless campus networks; The packet acquisition unit captures all Transmission Control Protocol (TCP) packets flowing through the corresponding link in real time through bypass monitoring mode. It uses a packet capture engine (such as tcpdump, PF_RING) to capture TCP packets, ensuring real-time performance and without causing forwarding delays or packet loss to the original network traffic.

[0025] In step S10, the specific process of extracting only the timestamp option field TSval from the TCP packet header is as follows: The data packet acquisition unit is pre-connected to the campus network authentication system (such as 802.1X authentication, campus card authentication system), synchronously obtains the identity association information of each target account (the campus network account corresponding to the student's student ID), and establishes a unique mapping table of target account-campus network authentication account-terminal IP-MAC address; After capturing TCP data packets, the source IP address and source MAC address of each TCP data packet are extracted. By querying the target account-campus network authentication account-terminal IP-MAC address mapping table, TCP data packets belonging only to the terminal associated with the target account are filtered out, so as to achieve accurate association between the target account and the corresponding TCP data packet and eliminate interference from non-target accounts, guest accounts and packets generated by the campus network devices themselves. Perform tiered filtering on messages associated with the target account, retaining only valid TCP data packets: Protocol layer filtering: Only TCP packets are retained, while non-TCP packets such as UDP, ICMP, and DNS are discarded; Integrity filtering: The integrity of the TCP packet header format is verified, and abnormal packets with incomplete headers, verification errors, out-of-order delivery, and retransmission redundancy are filtered to avoid invalid data affecting subsequent analysis; Field existence filtering: Only TCP packets with the TSval (TCP Timestamp Option) field in the TCP packet header are retained (i.e., packets containing the TSval field), and TCP packets without the timestamp option enabled are filtered to ensure the validity of subsequent field extraction; In step S10, the specific process of recording the system absolute time T when each TCP data packet is received is as follows: For the filtered valid TCP packets, only the TCP packet header data is parsed (the TCP packet payload is not parsed). The timestamp option field TSval (timestamp value) in the header is accurately extracted. At the same time, the system absolute time T when the packet acquisition unit receives the TCP packet is recorded by the high-precision clock module built into the packet acquisition unit. The time accuracy reaches the microsecond level (μs), ensuring the accuracy of the time sequence correspondence between the timestamp option field TSval and the system absolute time T. After extraction, the remaining fields of the TCP packet header and all payloads are immediately discarded. Only the associated data pair of target account - timestamp option field TSval - system absolute time T is retained to reduce the amount of data processing. Step S20: Associate the timestamp option field TSval under the same target account with the corresponding system absolute time T, use a linear regression algorithm to calculate the terminal hardware clock offset slope α corresponding to the target account, and generate a legitimate hardware fingerprint benchmark library for the target account. In step S20, the specific process of calculating the terminal hardware clock offset slope α corresponding to the target account using a linear regression algorithm and generating a legitimate hardware fingerprint benchmark library for the corresponding target account is as follows: From the data pair of target account - timestamp option field TSval - system absolute time T, obtain all timestamp option field TSval and system absolute time T under the same target account. Use the 3σ principle to remove timestamp option field TSval and system absolute time T that deviate from the overall trend to avoid noise interference with regression accuracy. A slight frequency deviation exists in the crystal oscillator clock of the terminal hardware, causing a linear relationship between the timestamp option field TSval generated by the terminal and the system absolute time T. The slope α of the terminal hardware clock offset corresponding to the target account is calculated using a linear regression algorithm, with the following model formula: ; in, The timestamp option field TSval generated for the terminal. Let T be the absolute time of the system. The slope of the terminal hardware clock offset. This is the initial offset of the terminal hardware clock; The slope α of the linear regression algorithm is solved using the least squares method, and only the slope α with a determination coefficient greater than 0.95 is retained as the terminal hardware clock offset slope α. The terminal hardware clock offset slope α reflects the inherent frequency deviation of the terminal hardware crystal oscillator (unit: ppm, parts per million), which is a physical layer feature that cannot be modified or disguised by software, and therefore becomes the unique physical hardware fingerprint of the target account terminal. The terminal hardware clock offset slope α is bound to the target account and stored in the behavior profile storage module to form a legitimate hardware fingerprint benchmark library for the corresponding target account; the terminal hardware clock offset slope α value analyzed in real time will be compared with the legitimate hardware fingerprint benchmark library to provide core basis for violation judgment. Step S30: Store the legitimate hardware fingerprint baseline library of each target account and the baseline value of the number of legitimate terminals allowed for each target account into the behavioral profile of the corresponding target account to form the judgment baseline feature library of each target account. In step S30, the specific process of forming the judgment benchmark feature library for each target account is as follows: The terminal hardware clock offset slope α value in the legitimate hardware fingerprint benchmark library of each target account, and the benchmark value of the number of legitimate terminals allowed for each target account, are stored in the behavioral profile of the corresponding target account to form the judgment benchmark feature library of each target account. It should be noted that the baseline value for the number of legal terminals allowed for each target account refers to the upper limit of the number of legal terminals allowed to access the campus network simultaneously for each target account (the campus network authentication account corresponding to the student's student ID) set by the campus network administrator based on its own network security management rules and bandwidth resource allocation strategy. It is one of the core parameters of the behavioral profile judgment baseline feature library. Step S40: Within a preset observation period, perform cluster analysis on the terminal hardware clock offset slope α values ​​corresponding to different network connection flows under the same target account to identify the actual number of physical hardware fingerprints under the target account. Compare the actual number of physical hardware fingerprints with the benchmark value of the number of legitimate terminals corresponding to the target account in the behavior profile. If the actual number of physical hardware fingerprints is greater than the benchmark value of the number of legitimate terminals, it is determined that the target account has abnormal behavior of illegally setting up proxy hotspots or privately connecting network devices.

[0026] In step S40, within a preset observation period, cluster analysis is performed on the terminal hardware clock offset slope α values ​​corresponding to different network connection flows under the same target account to identify the actual number of physical hardware fingerprints existing under the target account. The specific process is as follows: Within a preset observation period (e.g., 1 minute, taking into account both real-time performance and data volume requirements), collect the terminal hardware clock offset slope α values ​​(from the real-time calculation results of step S20) corresponding to all network connection streams under the same target account, forming a set of α values; From the judgment benchmark feature library, obtain the benchmark value M of the number of legitimate terminals corresponding to the target account (e.g., M=1 in the scenario of one account and one terminal), and the legitimate hardware fingerprint benchmark library (used to assist in verifying the legitimacy of the clustering results); use the 3σ principle to remove extreme outliers that deviate from the overall distribution and preprocess the real-time collected α value set (e.g., erroneous α values ​​caused by packet loss or out-of-order delivery) to ensure the accuracy of the clustering analysis: Since the clock offset slope α values ​​of different physical terminals have stable microsecond-level differences, the K-means clustering algorithm is used to perform similarity clustering on the set of α values ​​to accurately identify the number of actual physical hardware fingerprints: Based on the physical characteristics of hardware clock offset, the slope similarity threshold is set to Δα≤0.001, that is, when the difference between the slope α values ​​of the hardware clock offset of two terminals is ≤0.001, they are determined to be fingerprints of the same physical terminal. Input the set of α values ​​into the K-means clustering algorithm model, and automatically divide the number of clusters by using the similarity threshold as the upper limit of the intra-cluster distance; The number of clusters obtained by the final clustering is the number N of physical hardware fingerprints that actually exist under the target account (each cluster corresponds to one physical terminal). In step S40, the actual number of physical hardware fingerprints is compared with the baseline value of the number of legitimate terminals corresponding to the target account in the behavior profile. If the actual number of physical hardware fingerprints is greater than the baseline value of the number of legitimate terminals, the specific process of determining that the target account has abnormal behavior of illegally setting up proxy hotspots or privately connecting network devices is as follows: Obtain the baseline value of the number of legitimate terminals corresponding to the target account in the behavioral profile, and compare the baseline value of the number of legitimate terminals with the actual number of physical hardware fingerprints; If the actual number of physical hardware fingerprints is greater than the baseline value for the number of legitimate terminals, the target account is determined to have engaged in abnormal behavior such as illegally setting up proxy hotspots or privately connecting network devices. If the actual number of physical hardware fingerprints is less than or equal to the baseline value of the number of legitimate terminals, it is determined that the target account does not have any abnormal behavior of illegally setting up proxy hotspots or privately connecting network devices. Example 2 like Figure 2 As shown, based on the specific implementation process of Embodiment 1, the present invention provides a student internet monitoring system based on real-time data packet analysis and behavioral profiling, including the following modules: The data packet acquisition and extraction module: acquires TCP data packets generated by the target account in the campus network in real time, extracts only the timestamp option field TSval in the TCP data packet header, and records the absolute system time when each TCP data packet is received; Hardware fingerprint calculation module: Associates the timestamp option field TSval of the same target account with the system absolute time, uses a linear regression algorithm to calculate the terminal hardware clock offset slope α of the target account, and generates a legitimate hardware fingerprint benchmark library for the target account. Behavioral profile storage module: Stores the legal hardware fingerprint baseline library of each target account, as well as the baseline value of the number of legal terminals allowed for each target account, into the behavioral profile of the corresponding target account to form the judgment baseline feature library of each target account. Violation Detection Module: Within a preset observation period, cluster analysis is performed on the terminal hardware clock offset slope α value corresponding to different network connection flows under the same target account to identify the actual number of physical hardware fingerprints under the target account. The actual number of physical hardware fingerprints is compared with the benchmark value of the number of legitimate terminals corresponding to the target account in the behavior profile. If the actual number of physical hardware fingerprints is greater than the benchmark value of the number of legitimate terminals, it is determined that the target account has abnormal behavior of illegally setting up proxy hotspots or privately connecting network devices.

[0027] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely illustrative of the principles of the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the present invention as claimed. The scope of protection of the present invention is defined by the appended claims and their equivalents.

Claims

1. A student internet monitoring method based on real-time data packet analysis and behavioral profiling, characterized by: include: Step S10: In real time, obtain TCP data packets generated by the target account in the campus network, extract only the timestamp option field TSval in the TCP data packet header, and record the system absolute time when each TCP data packet is received; Step S20: Associate the timestamp option field TSval of the same target account with the system absolute time, use the linear regression algorithm to calculate the terminal hardware clock offset slope α of the target account, and generate a legitimate hardware fingerprint benchmark library for the target account. Step S30: Store the legitimate hardware fingerprint baseline library of each target account and the baseline value of the number of legitimate terminals allowed for each target account into the behavioral profile of the corresponding target account to form the judgment baseline feature library of each target account. Step S40: Within the preset observation period, perform cluster analysis on the terminal hardware clock offset slope α value corresponding to different network connection flows under the same target account, identify the actual number of physical hardware fingerprints under the target account, and compare the actual number of physical hardware fingerprints with the benchmark value of the number of legitimate terminals corresponding to the target account in the behavior profile. If the actual number of physical hardware fingerprints is greater than the benchmark value of the number of legitimate terminals, it is determined that the target account has abnormal behavior of illegally setting up proxy hotspots or privately connecting network devices.

2. The student internet monitoring method based on real-time data packet analysis and behavioral profiling according to claim 1, characterized in that: The specific process of acquiring TCP data packets generated by the target account in the campus network in real time is as follows: Deploy data packet acquisition units on the mirror ports of campus network switches, aggregation switches, and access layer switches, as well as on the mirror channels of campus network wireless AC / APs. Using a bypass monitoring mode, a packet capture engine is employed to capture all Transmission Control Protocol (TCP) data packets flowing through the corresponding links in real time.

3. The student internet monitoring method based on real-time data packet analysis and behavioral profiling according to claim 1, characterized in that: The specific process of extracting only the timestamp option field TSval from the TCP packet header is as follows: Connect to the campus network authentication system to obtain each target account, establish a target account-campus network authentication account-terminal IP-MAC address mapping table, obtain TCP data packets, extract the source IP address and source MAC address of each TCP data packet frame, filter out the TCP data packets of the terminal associated with the target account through the target account-campus network authentication account-terminal IP-MAC address mapping table, discard UDP, ICMP, DNS non-TCP protocol packets, and only retain the timestamp option field TSval carried in the TCP data packet header.

4. The student internet monitoring method based on real-time data packet analysis and behavioral profiling according to claim 1, characterized in that: The specific process of recording the system absolute time when each TCP data packet is received is as follows: Only the TCP packet header data is parsed, not the TCP packet payload. The timestamp option field TSval in the header is extracted, and the system absolute time when the packet acquisition unit receives the TCP packet is recorded to form a target account-timestamp option field TSval-system absolute time T association data pair.

5. The student internet monitoring method based on real-time data packet analysis and behavioral profiling according to claim 1, characterized in that: The specific process for generating the legitimate hardware fingerprint baseline database for the target account is as follows: The target account-timestamp option field TSval-system absolute time T is associated with a data pair. The terminal hardware clock offset slope α is calculated, and the terminal hardware clock offset slope α is bound to the target account and stored in the behavior profile storage module to form a legitimate hardware fingerprint baseline library for the corresponding target account.

6. The student internet monitoring method based on real-time data packet analysis and behavioral profiling according to claim 5, characterized in that: The specific process for calculating the terminal hardware clock offset slope α is as follows: From the associated data pair of target account - timestamp option field TSval - system absolute time T, obtain all timestamp option field TSval and system absolute time under the same target account. Then, use a linear regression algorithm to calculate the terminal hardware clock offset slope α corresponding to the target account. The formula is: ; The timestamp option field TSval generated for the terminal. Let T be the absolute time of the system. The slope of the terminal hardware clock offset. This is the initial offset of the terminal hardware clock; The slope α of the linear regression algorithm is solved using the least squares method, and only the slope α with a determination coefficient greater than 0.95 is retained as the terminal hardware clock offset slope α.

7. The student internet monitoring method based on real-time data packet analysis and behavioral profiling according to claim 1, characterized in that: The specific process for forming the judgment benchmark feature library for each target account is as follows: The terminal hardware clock offset slope α value in the legitimate hardware fingerprint benchmark library of each target account, as well as the benchmark value of the number of legitimate terminals allowed for each target account, are stored in the behavioral profile of the corresponding target account to form the judgment benchmark feature library of each target account.

8. The student internet monitoring method based on real-time data packet analysis and behavioral profiling according to claim 1, characterized in that: The specific process for identifying the actual number of physical hardware fingerprints under the target account is as follows: Within a preset observation period, the terminal hardware clock offset slope α value corresponding to all network connection flows under the same target account is obtained to form an α value set. From the judgment benchmark feature library, the benchmark value of the number of legal terminals corresponding to the target account is obtained. The K-means clustering algorithm is used to perform similarity clustering on the α value set. When the deviation of the two terminal hardware clock offset slope α values ​​is ≤0.001, they are judged as the physical hardware fingerprint of the same physical terminal. The set of α values ​​is input into the K-means clustering algorithm model. The number of clusters is automatically divided with the similarity threshold as the upper limit of the intra-cluster distance. The final number of clusters obtained by clustering is the number of actual physical hardware fingerprints under the target account.

9. The student internet monitoring method based on real-time data packet analysis and behavioral profiling according to claim 1, characterized in that: The specific process for determining whether a target account has engaged in abnormal behavior such as illegally setting up proxy hotspots or privately connecting network devices is as follows: Obtain the baseline value of the number of legitimate terminals for the target account in the behavioral profile, and compare the baseline value of the number of legitimate terminals with the actual number of physical hardware fingerprints. If the actual number of physical hardware fingerprints is greater than the baseline value of the number of legitimate terminals, it is determined that the target account has abnormal behavior of illegally setting up proxy hotspots or privately connecting network devices.

10. A student internet monitoring system based on real-time data packet analysis and behavioral profiling, used to execute the method described in any one of claims 1-9, characterized in that: Includes the following modules: The data packet acquisition and extraction module: acquires TCP data packets generated by the target account in the campus network in real time, extracts only the timestamp option field TSval in the TCP data packet header, and records the absolute system time when each TCP data packet is received; Hardware fingerprint calculation module: Associates the timestamp option field TSval of the same target account with the system absolute time, uses a linear regression algorithm to calculate the terminal hardware clock offset slope α of the target account, and generates a legitimate hardware fingerprint benchmark library for the target account. Behavioral profile storage module: Stores the legal hardware fingerprint baseline library of each target account, as well as the baseline value of the number of legal terminals allowed for each target account, into the behavioral profile of the corresponding target account to form the judgment baseline feature library of each target account. Violation Detection Module: Within a preset observation period, cluster analysis is performed on the terminal hardware clock offset slope α value corresponding to different network connection flows under the same target account to identify the actual number of physical hardware fingerprints under the target account. The actual number of physical hardware fingerprints is compared with the benchmark value of the number of legitimate terminals corresponding to the target account in the behavior profile. If the actual number of physical hardware fingerprints is greater than the benchmark value of the number of legitimate terminals, it is determined that the target account has abnormal behavior of illegally setting up proxy hotspots or privately connecting network devices.

Images