399 results about "Device fingerprint" patented technology

The invention provides a remote office network security protection method and system based on big data, and the method comprises the steps: firstly obtaining network activity data, including traffic, equipment states and user behavior data, of a plurality of terminal equipment in a remote office scene, and then carrying out the multi-dimensional security feature analysis of the network activity data, after a dynamic security feature set containing traffic, device fingerprints and behavior pattern features is generated, abnormal behaviors are identified through a multi-layer anomaly detection model, a detection result with an anomaly type and confidence is output, a target protection strategy is matched from a preset library according to the result, the weight is dynamically adjusted in combination with the anomaly confidence, and a real-time protection strategy instruction is generated. And finally, executing a protection strategy instruction to synchronously regulate and control network connection, equipment permission and a user access path, and feeding back regulated and controlled network state data to optimize abnormal identification logic, thereby realizing comprehensive and intelligent remote office network security protection.

The invention discloses a power grid abnormal flow detection method based on multi-modal data fusion, and the method comprises the steps: collecting the multi-source heterogeneous data of a power grid through an edge calculation node, including the current waveform of an intelligent electric meter, the state variable of an SCADA system, network protocol metadata and an equipment log event; performing space-time alignment preprocessing on the original data, converting an unstructured log into a time sequence by adopting a sliding window mechanism, and eliminating sensor noise through an LSTM auto-encoder; constructing a multi-dimensional feature space which comprises a frequency domain feature, a spatial-temporal feature and a protocol feature, and obtaining a feature vector; the feature vectors are input into a hybrid detection model, the model is composed of an isolated forest algorithm, an improved CNN-LSTM classifier and an information entropy-based rule engine which are connected in parallel, and a dynamic weight fusion strategy is adopted to output an abnormal probability; and when the abnormal probability exceeds a dynamic threshold, triggering a multi-level response mechanism: sending a traffic shaping instruction to the edge device, generating a device fingerprint portrait on the cloud platform, and storing abnormal event features through a block chain.

The invention discloses an Internet of Things data integration method and system based on dynamic semantic atlas and edge collaboration, and the method comprises the steps: carrying out the equipment access and protocol conversion, capturing the original data of equipment through an edge node, analyzing the average communication interval of 100ms + / -20ms through an LSTM model, generating an equipment fingerprint hash value, analyzing a message structure through a TinyBERT model, and extracting a key field, a temperature value and a timestamp. The method comprises the following steps: establishing a dynamic semantic graph, converting the dynamic semantic graph into a standard JSON format, uploading the standard JSON format to a cloud end through a service grid, constructing a dynamic semantic graph, collecting multi-source metadata by the cloud end, generating an entity relationship by utilizing a Transform model, dynamically optimizing a mapping rule based on reinforcement learning, automatically associating a Pressures field to a database column PSI, and carrying out collaborative optimization by an edge cloud; according to the method, the knowledge graph and the Transform model are combined, the data entity relation is updated in real time, the semantic drift problem of a traditional static graph is solved, the cross-domain data association accuracy is improved by 35%, the unique device fingerprint is generated through the message frequency and load distribution, and dynamic tracking of the mobile device is supported.

A distributed intelligent authentication method based on dynamic multi-modal fusion relates to the field of network security, and adopts an alliance chain + DAG hybrid block chain architecture, combines a threshold signature to realize secret key fragment management, and switches among PBFT, Raft and probabilistic algorithms through a dynamic consensus mechanism to improve authentication efficiency. The multi-mode authentication module is based on a dynamic weight distribution algorithm, integrates biological characteristics, behavior analysis, equipment fingerprints and environmental factors, and combines an LSTM-GAN model and a quantum random number driven challenge-response mechanism to realize zero-trust verification under environmental perception. The session management module generates a session key by using a chaotic mapping algorithm. In the aspect of privacy protection, CKKS homomorphic encryption, zero-knowledge proof and attribute-based encryption are fused. According to the method, the block chain technology, the secure multi-party computing technology, the machine learning technology and the quantum cryptography technology are fused, and a high-performance, high-security and strong-privacy-protection distributed authentication solution is provided.

The invention relates to the technical field of data access security, and discloses a container mirror image security management method and system, and the method comprises the steps: constructing a container mirror image, generating a differential encryption key through a strategy center, carrying out the encryption strategy of a kernel dependence layer, a runtime environment layer, an application code layer and a sensitive configuration layer, and forming a hierarchical protection basis. If an access request is triggered, firstly collecting equipment fingerprints and geofence information and evaluating an environmental risk score, verifying access authority and an access scene matching degree through attribute-based encryption, analyzing operation track characteristics in real time, identifying an abnormal mode, and if the three-layer verification is passed, generating a temporary access token; according to the method, access request authority is verified, a temporary access token is matched, key fragments are synthesized, a master key is only temporarily generated in a memory and encrypted and stored, and through combination of a double-layer encryption channel and inner-layer and outer-layer defense, the anti-attack ability of container mirror image transmission is improved, and man-in-the-middle attack and data tampering are effectively coped with.

The embodiment of the invention provides a multi-platform e-commerce order management method and system based on cloud data analysis, and the method comprises the steps: carrying out the analysis and standardization processing of order data through employing a dynamic format conversion channel, constructing a dynamic priority evaluation matrix in combination with real-time logistics load and historical aging data, and carrying out the analysis and standardization of the order data. A geographic position weight model is constructed based on equipment fingerprint identification and address similarity calculation, an order topology aggregation scheme is generated through a spatial incidence matrix, a distributed decision tree is constructed according to inventory fluctuation prediction and supplier response rate, a picking path is optimized, and finally logistics node data is integrated to construct a visual tracking interface. According to the technical scheme, abnormal order real-time early warning and compensation path planning are achieved through a self-repairing mechanism, logistics state holographic projection is generated, the flexibility and efficiency of the multi-platform e-commerce order management system are improved, and the problems of high complexity, poor expansibility, performance bottleneck and the like existing in a traditional system are effectively solved.

The invention relates to the technical field of computer network security, in particular to a security guarantee system for cross-domain communication and data sharing of network platform software, which comprises a data security transmission module, an identity authentication and access control module, an encryption module, a security audit and anomaly detection module and an anti-interference disaster recovery module. According to the invention, through linkage of equipment fingerprint end-to-end encryption, threat adaptive dynamic key updating and a timestamp-random number anti-replay mechanism and AI risk pre-judgment, reinforcement learning path planning, digital twinning pre-verification and fault automatic switching technologies, collaborative guarantee of key security and transmission continuity in cross-domain audio transmission is realized; encryption intensity is dynamically upgraded along with threats, a transmission path is optimized in advance, and it is ensured that the audio stream resists various network attacks and interferences in low-delay transmission.

The invention relates to the technical field of short video encryption, and discloses a short video active defense encryption system based on a device fingerprint and a dynamic confusion field, and the key point of the technical scheme is that the system comprises a device fingerprint generation module, a mother video encryption module, a slice encryption module, a behavior recognition and defense module and an encryption logic update regulation and control module. The system generates a unique device fingerprint hash value through a multi-modal feature, generates a dynamic confusion field in combination with a chaotic system and a quantum random number, realizes differential encryption of a mother video and slices, and is embedded with zero-knowledge consanguinity proof to support traceability verification. The behavior recognition and defense module monitors user behaviors in real time and dynamically adjusts a confusion strategy or triggers an active defense mechanism, and the encryption logic updating regulation and control module optimizes the updating frequency according to playing data and reduces the batch crawling risk. According to the invention, the security and anti-attack capability of the short video content can be effectively improved.

The invention relates to the technical field of data processing, and provides a network device discovery method, which can perform iterative retrieval under a target network according to an ARP table, provides a more comprehensive view, and is beneficial to monitoring the health condition and the network load condition of the target network. Legality detection of an IP address is carried out based on a rule base; legality detection of an MAC address is carried out based on a multi-level detection mechanism; uniqueness detection is carried out based on a device fingerprint; subnet suitability detection is carried out based on a subnet mask matching algorithm; a self-adaptive network equipment discovery algorithm combined with multi-dimensional data analysis can reduce redundant data, eliminate invalid information and improve the accuracy and management efficiency of equipment discovery; information generation is carried out based on the initial network equipment data to obtain the network equipment view, so that more accurate network equipment discovery is carried out.

The embodiment of the invention provides a security authentication method, device and system for a test platform, and a storage medium, and relates to the technical field of network security. The method comprises the following steps: performing fingerprint acquisition on virtual and real equipment to generate a unique identifier, dynamically slicing based on a software defined network to form an isolated test environment, and injecting a zero-trust access strategy associated with the fingerprint; and based on the zero-trust access policy and the device fingerprint, allocating a minimum permission through an attribute-based access control model, continuously evaluating device behaviors to calculate a dynamic trust score, and adaptively updating the permission according to the trust score. By constructing a full-process security certification system and through multi-dimensional mechanism cooperation, dynamic risk perception and timely strategy adjustment, fine-grained control of virtual and real equipment access in an industrial control scene is realized, the dynamic adaptability and risk resistance of a test platform in a complex network environment are improved, and the test efficiency is improved. Equipment access safety, authority distribution minimization and behavior monitoring continuity are ensured, and the safety risk of the industrial control system is reduced.

The invention discloses a digital twinning-based thermal heat supply system defense cooperative protection method and system, particularly relates to the technical field of industrial control system safety, and is used for solving the problems of hidden attack missing detection and response delay caused by splitting of energy flow and data flow in an existing protection mechanism. Physical-network behavior collaborative verification is realized by constructing a digital twinborn model, and precise protection is realized by quantifying coupling failure characteristics of energy flow and instruction flow. The method specifically comprises the following steps: collecting production data, industrial control logs and network traffic; constructing a digital twin model to simulate expected behaviors of equipment, communication and physical states; comparing and detecting abnormal data in real time; extracting a thermodynamic potential gradient characteristic quantity and a path integral characteristic quantity from the abnormal data; calculating a covariant difference value of the two characteristic quantities, and judging an external attack when the covariant difference value exceeds a threshold value; when an attack is triggered, a micro-isolation gateway is deployed, dynamic access control is implemented based on an equipment fingerprint, a user behavior sequence and an environment fingerprint, and an attack chain is blocked.

The invention discloses an industrial database protection method based on multi-modal authentication and encryption, which belongs to the technical field of data processing and comprises the following steps: acquiring input data to be input into an industrial database; a multi-mode authentication gateway is adopted to verify user identity information, and a biological feature, a dynamic device fingerprint and a quantum random number token are fused to generate a third-level identity verification identifier; after the three-level identity verification is passed, determining an encryption algorithm according to the sensitive level of the industrial data transmitted in real time and the system load state, and encrypting the industrial data through the encryption algorithm; and for the encrypted industrial data, analyzing the function code of the Modbus message of the industrial data transmitted in real time, establishing a white list instruction set, and intercepting the industrial data of the function code which is not in the white list instruction set. According to the industrial database protection method based on multi-modal authentication and encryption, the problem of how to improve the real-time response capability of a system on the premise of ensuring the security of industrial data is solved.

The invention provides an Internet of Vehicles broadcast frame radio frequency fingerprint identification method based on LMMSE channel estimation. The method comprises the following steps: obtaining subcarrier data in a resource grid based on an obtained signal of a physical side link broadcast channel; performing root-mean-square delay expansion and channel autocorrelation matrix construction based on the subcarrier data, and combining priori signal-to-noise ratio regularization and time domain windowing operation to obtain a channel estimation value; initial radio frequency fingerprint features are obtained through the channel equalization and the channel estimation value, and the improved neural network and the initial radio frequency fingerprint features are utilized to carry out classification identification on the Internet of Vehicles equipment. Influences of noise and channels on fingerprints are effectively considered, and the purpose of extracting fingerprints of different devices in a complex environment more accurately is achieved.

The embodiment of the invention discloses a dynamic metadata sensing and self-adaptive mapping method and system, and the method comprises the following steps: deploying a lightweight probe to be agented to a plurality of heterogeneous source database systems, and building a trusted communication channel between the probe and a coordination center through equipment fingerprint generation and security authentication; a database log event is captured in real time, log analysis is carried out through an FPGA module, the change of a field structure or a semantic level is identified, and structured event data is generated; performing context embedding representation on the captured event based on a semantic understanding model, performing strategy reasoning in combination with a historical strategy and a knowledge graph, and generating a matched mapping strategy; loading and executing the mapping strategy in a trusted execution environment (TEE) to realize data conversion, cleaning and complementation, and performing desensitization processing on sensitive data through a differential privacy mechanism; and collecting performance indexes and abnormal logs of a strategy execution result, continuously training the model through a closed-loop optimization mechanism, and correcting an unreasonable strategy or updating a rule base.

The invention discloses a computer remote login identification system based on artificial intelligence, and the system comprises a remote login request receiving and processing module which is responsible for receiving a remote login request of a user, and carrying out the preliminary processing and verification; the multi-mode identity authentication module adopts a three-factor verification matrix of biological characteristics, behavior characteristics and equipment fingerprints, and adjusts weights of different authentication dimensions according to security requirements and user requirements; the lock screen state sensing module is responsible for sensing a lock screen state; the dynamic behavior analysis engine is used for monitoring behavior characteristics of the user in real time and comparing the behavior characteristics with a preset abnormal behavior mode so as to find abnormal login behaviors in time; the intelligent unlocking decision tree is used for making an intelligent unlocking decision according to the authentication score, the equipment environment and the behavior abnormality; and the security execution module is responsible for automatically filling a password and executing an unlocking operation after the user identity authentication is passed, and monitoring an abnormal condition in the unlocking process in real time in combination with equipment environment monitoring and an abnormal detection model.

The invention discloses a stable transmission method for server data encryption and rapid authentication, and belongs to the technical field of data security. The method comprises the following steps: dividing data into three levels of core sensitive data, important data and common data by utilizing a semantic analysis model; performing encryption protection on different levels of data by adopting a hierarchical encryption strategy; a master key is generated based on a chaotic system, a session key is generated in combination with a timestamp and a device fingerprint and is regularly alternated, and secure distribution is performed through a trusted execution environment and a block chain; multi-modal features are fused, the identity is verified through zero-knowledge proof, and the authentication strength is adjusted through dynamic risk assessment. The method is suitable for cloud computing, the Internet of Things and a distributed storage system, through deep fusion of a multi-level hybrid encryption algorithm, a dynamic key management mechanism and a self-adaptive authentication strategy, data security encryption, rapid authentication and stable transmission are achieved, and security, efficiency and adaptability are improved.

The invention discloses an industrial internet encryption method and system based on block chain evidence storage, and relates to the technical field of information security and block chains, and the method comprises the following steps: when an industrial internet system generates to-be-encrypted industrial data, synchronously generating identification information strongly bound with content for the industrial data; according to the method, the dynamic device fingerprints and the multi-dimensional feature information are embedded into the encrypted data, and a strong binding relationship between the encrypted data and the block chain evidence is established in combination with double encryption and a joint hash mechanism, so that the tamper-proof and anti-counterfeiting capabilities of the data are remarkably improved. According to the method, a block weighting and bidirectional reconstruction verification strategy is adopted, so that the sensitivity and the detection capability of the system to tiny tampering and local counterfeiting are enhanced, the integrity, the authenticity and the high credibility of data in the industrial internet can be effectively guaranteed in a complex industrial environment, and the potential safety hazard of evidence storage and data unhooking in the prior art is solved.

The invention provides a store distribution system and a customer portrait generation method. The method comprises the following steps: generating basic attribute representation of a customer through equipment fingerprint data of the customer in the store distribution system; extracting interactive behavior characteristics of the clients in the full-link behavior log of the store distribution system, and performing preference mapping on historical behaviors of the clients through the interactive behavior characteristics and the basic attribute representation to obtain behavior preference labels of the clients in the store distribution system; extracting behavior semantic features of the customer from the current search behavior of the customer, and performing feature splicing on the interaction behavior of the customer through the current operation path of the customer and the behavior semantic features to obtain an intention representation vector of the current interaction intention of the customer; and determining an interaction conflict relationship between the behavior preference tag and the intention representation vector, and performing conflict resolution on the basic attribute representation through the interaction conflict relationship so as to obtain a tag portrait of the customer. Based on the scheme, conflict resolution between customer attributes and customer behaviors in a store distribution system can be realized.

Methods, systems, and apparatuses are described herein for protecting sensitive data even when Transport Layer Security (TLS) communication sessions are compromised. A computing device may send, via a web browser plugin of a web browser application executing on the computing device and to one or more remote servers, a request for a server secret that comprises a device fingerprint, an identification of the web browser application, and an identification of the web browser plugin. The computing device may receive the server secret and a public certificate associated with the remote server. The computing device may establish, via the web browser application, a TLS session with the one or more remote servers. The computing device may generate a session key. The computing device may receive data comprising unencrypted data and encrypted data. The computing device may decrypt the encrypted data based on the session key.

The invention discloses an enhanced equipment fingerprint identification system and method based on time-frequency domain feature fusion. The system is composed of a signal processing module, a feature extraction module, a feature fusion module and an equipment identification module. The method comprises the following steps: firstly, splitting IQ into three time domain features, converting the IQ into a frequency domain and a time-frequency domain by using corresponding FFT and STFT formulas, and extracting corresponding features; respectively inputting the features of the time domain, the frequency domain and the time-frequency domain into a feature extraction module for feature extraction; the extracted features are sent to a feature fusion module, and final fusion features are generated; and finally, the fusion features are transmitted to a classification model, and fingerprint matching and identification of the equipment are completed. By adopting the enhanced equipment fingerprint identification system and method based on time-frequency domain feature fusion, the security, accuracy and robustness of the Internet of Things equipment are improved, the sensitivity of the system to noise interference is reduced, the equipment fingerprint extraction cost is reduced, and the higher identification accuracy is realized.

An access point of a wireless communication network may be configured to receive a solicited wireless communication from an electronic device in response to a request, the solicited wireless communication being transmitted by the electronic device over a channel of the wireless communication network. The access point may extract channel characteristics from the solicited wireless communication, the channel characteristics being timing-dependent effects on the channel associated with the solicited wireless communication. The access point may generate a device fingerprint based at least in part on the channel characteristics, the device fingerprint being specific to hardware of the electronic device. Using the device fingerprint, the access point or another device may determine an identification, indicative of at least one of an identity or a device type, of the electronic device based on a stored device profile representative of at least one authenticated electronic device.

The invention discloses an intelligent detection method and system for security vulnerabilities of a terminal layer of an electric power internet of things, and relates to the technical field of security protection of the electric power internet of things, and the method comprises the steps: collecting multi-dimensional information and network traffic characteristics of terminal equipment of the electric power internet of things, constructing an equipment fingerprint database, carrying out the comparison verification of the equipment, and obtaining a security vulnerability of the terminal layer of the electric power internet of things according to a verification result; the method comprises the following steps: classifying network traffic, identifying an abnormal traffic sequence, extracting behavior parameters of network traffic abnormity and network access abnormity, carrying out association analysis on the abnormal parameters, labeling equipment, and generating a security vulnerability detection report. The technical problem that potential security vulnerabilities are difficult to find and repair in time due to the fact that complex abnormal behaviors in a device layer and network traffic cannot be effectively recognized and handled in the prior art is solved, real-time and accurate security vulnerability detection is achieved by constructing a device fingerprint database and carrying out traffic classification and abnormal behavior analysis, and the security vulnerability detection efficiency is improved. Therefore, the technical effect of improving the security of the terminal layer of the power Internet of Things is achieved.

The invention discloses a cloud mobile phone equipment fingerprint disguising method and related equipment, and relates to the technical field of cloud mobile phone security, and the method comprises the steps: obtaining hardware entropy source data which comprises current timestamp data, a hardware unique identifier hash value and an environment noise sampling value; non-linear transformation is carried out on the hardware entropy source data based on a preset chaotic mapping algorithm, a virtual parameter set is generated, and the virtual parameter set meets a preset equipment parameter rule; covering the virtual parameter set to a multi-level system interface of the real equipment fingerprint through kernel-level injection operation; monitoring the use state of the virtual parameter set based on a preset life cycle model, and determining a parameter updating trigger condition; and when a parameter updating triggering condition is met, the nonlinear transformation is executed again to generate an updated virtual parameter set, and the updated virtual parameter set covers the multi-level system interface.

The invention discloses a Teensy virus identification and protection method for a mobile hard disk, and relates to the technical field of virus identification and protection.The method effectively identifies high-simulation attack equipment through composite equipment fingerprint construction and combination of hardware ripple features and dynamic protocol response, and breaks through the limitation of traditional single feature detection; meanwhile, the protocol state transition probability model adopts hidden Markov chain real-time analysis, microsecond-level protocol switching abnormity is accurately captured, and the problem of missing detection caused by rough time granularity of an existing scheme is solved; in addition, a window context instruction association mechanism binds a system focus state with an HID operation, and blocks a hidden attack chain formed by legal instruction combination; the hierarchical fusing strategy fuses protocol endpoint control and physical layer isolation, so that the availability of a storage function is ensured, meanwhile, attack blocking is realized, and the situation that normal use is influenced due to full-port forbidding in a traditional scheme is avoided.

A network monitoring device is connected to a communications network and monitors traffic transmitted to and from a server. The system stores a device fingerprint of devices identified as involved in attacks across the communications network, generates attack patterns for attacks across the communications network based on data packets transmitted or received by the devices during an attack based on the data packets corresponding to the device fingerprint, monitors data packet exchanges between the server and network devices, determines a set of transmission parameters for each of the data packet exchanges, compares the set of transmission parameters for the plurality of data packet exchanges to the attack patterns, and, responsive to determining a match between a first set of transmission parameters and an attack pattern, applies a tag to a network device communicating with the server via the data packet exchange indicating the network device is involved in an attack.

An authorization and authentication method can comprise receiving, by a server from a user device, a request to generate an access token. The request includes a demonstration of proof of possession (DPoP) Java web token (JWT) that can include a public key, a payload, and a signature. The payload can include fingerprint data of the user device and a unique identifier of a contactless card associated with a user of the user device. The method can further comprise extracting, by the server, the DPoP JWT from the request to generate an access token and verifying, by the server, the signature using the public key included in the DPoP JWT. The method can further comprise authenticating, by the server, the payload, generating, by the server, the access token, binding, by the server, the public key to the access token, and transmitting, by the server, the access token to the user device.

The invention provides a load control terminal program trusted loading method and electronic equipment, and the method comprises the steps: transmitting an operation instruction to a hardware security module through a central processing unit, negotiating a first session key with the hardware security module, and generating an equipment fingerprint through the hardware security module; intercepting a to-be-loaded program by utilizing a linux system kernel interception program calling entry, transmitting a signature original text of the to-be-loaded program to a hardware security module, and checking the signature original text by utilizing the hardware security module; if the signature original text is successfully verified, a random number generated by a true random number generator of the hardware security module is combined with the device fingerprint to generate a second session key; calling a communication interface between the kernel and the hardware security module, sending the sensitive data of the program to the hardware security module, encrypting the sensitive data by using a second session key, and mapping the encrypted sensitive data to an independent address space; and when the operation of the program is finished or interrupted, erasing the second session key and the random number by using the hardware security module.

A computer-implemented method and system for managing an authentication between user devices and authentication servers, is disclosed. The computer-implemented method includes: obtaining user credentials associated with users; retrieving information associated with device fingerprints corresponding to the user devices; generating cipher messages by at least one of: creating random numbers and encrypting the random numbers with keys derived from at least one of: the first and second index; transmitting the one or more user identities, the first index, the second index, and the cipher messages, to authentication servers; dynamically generating the private keys from private key variables; generating authentication responses by decoding authentication based questions obtained from the authentication servers, using cipher messages and the private keys; and transmitting the authentication responses to the authentication servers for adapting the authentication servers to authenticate the user devices.

The invention discloses a robust radio frequency fingerprint identification method based on Barlow Twins domain adaptation. Aiming at the problems of training and deployment environment distribution offset and cross-domain identification performance reduction caused by wireless channel multipath and time-varying characteristics in the prior art, the invention provides a domain adaptation framework combined with feature decoupling. The method comprises the following steps: firstly, converting a received time domain signal into a short-time Fourier transform spectrogram to reserve a time-frequency structure; then, a double-end convolutional encoder is constructed, bottom layer features are extracted through a shared backbone network, and device fingerprints and channel features are obtained in an identity branch and a channel branch respectively; in order to realize thorough decoupling of the two types of features, Barlow Twins-based independence regularization is introduced, and the identity features and the channel features are statistically orthogonal by minimizing a cross-correlation matrix of the identity features and the channel features, so that purer fingerprint features are obtained, channel interference is effectively eliminated, and generalization and recognition precision of the model under an unknown channel are remarkably improved.

A network monitoring device is connected to a communications network and monitors traffic transmitted to and from a server. The system stores a device fingerprint of devices identified as involved in attacks across the communications network, generates attack patterns for attacks across the communications network based on data packets transmitted or received by the devices during an attack based on the data packets corresponding to the device fingerprint, monitors data packet exchanges between the server and network devices, determines a set of transmission parameters for each of the data packet exchanges, compares the set of transmission parameters for the plurality of data packet exchanges to the attack patterns, and, responsive to determining a match between a first set of transmission parameters and an attack pattern, applies a tag to a network device communicating with the server via the data packet exchange indicating the network device is involved in an attack.