593 results about "Network behavior" patented technology

The invention provides a network security penetration detection method and system based on artificial intelligence, and the method comprises the steps: firstly obtaining real-time network flow data containing multi-dimensional communication behavior records and protocol metadata of a target network system, and then extracting network behavior sequence features capable of describing communication behavior time relevance and a protocol interaction mode from the network flow data; inputting the network behavior sequence features into a pre-trained multi-modal threat prediction model, generating a potential attack vector prediction result containing an attack intention label, penetration path probability distribution and a threat level score, and dynamically verifying the potential attack vector prediction result based on a threat knowledge base, and finally, generating a self-adaptive defense strategy according to the penetration threat detection result, triggering defense interface deployment of a target network system, updating attack mode characteristics and a defense rule set of a threat knowledge base, and realizing intelligent and efficient network security penetration detection and defense.

The invention discloses an information security management method based on data processing, and particularly relates to the field of information security management, comprising multi-source heterogeneous data acquisition, multi-dimensional feature index calculation, comprehensive threat detection calculation and adaptive threat decision. According to the method, the covert communication channel is accurately identified by constructing the encrypted traffic multi-mode detection model and combining protocol fingerprint entropy and traffic self-similarity analysis; an improved entropy weight fusion algorithm is adopted, collaborative analysis of system process abnormity, network behavior offset and hardware degradation is achieved, and a cross-dimension attack chain is reconstructed; a storage medium physical feature-cryptographic module runtime joint monitoring mechanism is created for the first time, hardware layer physical attacks and cryptographic side channel vulnerabilities are synchronously defended through temperature-delay correlation evaluation and key derivation density analysis, a complete attack surface from a physical layer to an application layer is covered, and the security is improved. And the detection precision and the response real-time performance of the complex threats are obviously improved.

The invention relates to the technical field of network security, in particular to a network security dynamic early warning method and system based on a knowledge graph, and the method comprises the following steps: collecting real-time traffic data of a network, analyzing a data sequence by recognizing the characteristics of a state sequence and using a long and short-term memory network, and recognizing a behavior mode; and constructing a state time sequence model. According to the method, structured analysis of network behaviors is realized through time dependence analysis, refined mining of incidence relations between events, determination of a trigger chain and time relation of potential threats and reasoning process of a knowledge graph, abnormal behaviors and attack behaviors can be identified more accurately, global analysis capability of network threats is enhanced, and the network threats can be analyzed more accurately. The network environment change can be adapted in real time by dynamically adjusting the early warning threshold value and the early warning parameter, a more flexible and efficient threat response mechanism is realized, the combination of the early warning signal and the security event response is updated in real time, and the response speed and the processing efficiency of the security problem are optimized.

The invention relates to the technical field of network attacks, in particular to a network attack dynamic detection and security protection method and system based on artificial intelligence, and the method comprises the following steps: S1, data collection: collecting a multi-protocol communication data flow of network equipment, and generating a multi-dimensional feature vector; s2, constructing a cross-protocol behavior graph: generating a dynamically updated network behavior graph; s3, anomaly detection: identifying an abnormal behavior mode through the deep residual sequential network, and outputting threat evaluation parameters; s4, protection strategy generation: generating a dynamic protection instruction set through a reinforcement learning decision algorithm; and S5, protection execution: executing the dynamic protection instruction set to complete safety protection operation. According to the method, the multi-protocol fusion behavior graph is constructed, and an abnormal detection mechanism of graph nerve and differential modeling and a dynamic response strategy driven by reinforcement learning are introduced, so that high-precision identification and efficient protection of network attacks are realized.

The invention relates to the technical field of network security, in particular to a network security situation awareness method and system, and the method comprises the following steps: extracting a source IP address and a target IP address based on a network behavior record, carrying out the statistics of the number of used ports, the transmission direction and the time interval value, analyzing the direction change times and the time interval difference, and screening abnormal communication pairs. And generating an abnormal communication pair set. According to the invention, through analyzing port usage, transmission direction and time interval value, deeply mining communication features, screening abnormal communication pairs and improving identification accuracy, dividing a time sequence window, analyzing rate fluctuation and frequency distribution, locking an unstable time window, combining with a multi-dimensional data classification behavior mode, and extracting a switching path and priority, a multi-dimensional data classification behavior mode is combined. Potential threat paths are identified independently, global threat situations are identified through node interaction relation statistics and correlation analysis and an expansion range, threat assessment precision and efficiency are enhanced, and comprehensive and reliable risk protection capability is provided for network managers.

The invention provides an abnormal behavior detection method and device of a networked device and a computer program product. The abnormal behavior detection method for the networked device comprises the steps of constructing a causal graph generation model, and constructing a weighted graph neural network prediction model; inputting the multivariable time series data of the networking equipment into a causal graph generation model to obtain a causal graph and an adjacent matrix of the causal graph; wherein the multivariable time series data is related to the network behavior of the networking device; inputting the adjacency matrix and the multivariable time sequence data into a weighted graph neural network prediction model to obtain an abnormal behavior prediction value; and calculating an abnormal score according to the abnormal behavior predicted value. According to the invention, the accuracy of abnormal behavior detection of the networking device can be improved.

The invention discloses a network traceability data processing method, system and device and a medium, and the method comprises the steps: collecting network data, carrying out the preprocessing of the network data, and generating the preprocessed network data; extracting behavior characteristics from the preprocessed network data to obtain network behavior characteristics; constructing an attack graph according to the obtained network behavior characteristics, and forming a dynamic graph representing an attack path; and carrying out traceability decision on the dynamic atlas, and positioning an attack source and an attack path through the traceability decision. Through the technical means of six-dimensional feature vector construction, quantum derivation genetic algorithm optimization detection and attack atlas construction through the tense graph convolutional network, the problems of data dimension missing, correlation analysis lagging and insufficient traceability precision are effectively solved.

The invention discloses a network security active defense method and system for detecting abnormal network behaviors. The method comprises the following steps: S1, constructing a virtualized isolation network environment through a software defined network technology; s2, deploying intelligent dynamic camouflage nodes in the virtualized isolation environment; s3, acquiring a disguised node attack behavior, and identifying a network abnormal behavior through a deep learning technology; s4, extracting network abnormal behavior features, and identifying potential threats through a deep learning technology; s5, a defense mechanism is automatically triggered, a honeynet is started, and abnormal behaviors and potential threats are isolated; and S6, tracing an attack path, and carrying out source positioning. The network security active defense system comprises a network construction module, a deployment module, an identification module, a honeynet, an isolation module and a tracing module. The disguised nodes are deployed through the deployment module to detect abnormal network behaviors, active defense of network security is realized through the honeynet, the isolation module and the tracing module, and the network security is improved.

The invention relates to the technical field of computer security, in particular to a network security monitoring system based on big data analysis, which comprises a historical behavior analysis module, a risk assessment module, an attack path analysis module and an emergency response module. According to the method, through real-time monitoring and comparison with historical data, abnormal fluctuation of network behaviors can be accurately identified, specific risks of the abnormal fluctuation of the network behaviors on network security are rapidly evaluated, the accuracy of threat detection is improved, false alarms can be effectively reduced, and through analysis of network topology and behavior data, the network security is improved. The method can effectively track the flow direction of abnormal data, identify potential attack sources and attack paths, improve the timeliness of risk early warning, enhance the identification capability of complex attack modes, and rapidly cut off potential attack links without affecting normal business operation by implementing isolation and service closing measures, thereby improving the risk early warning efficiency. And the security protection efficiency of the computer network and the stability of the system are optimized.

The invention relates to the technical field of data processing, in particular to a backtracking analysis model construction method based on an attack chain, which comprises the following steps that: a kernel layer security agent acquires process, file and network behavior characteristics in a hardware isolation environment, and generates an event tuple; the tensor network pipeline performs three-dimensional decoupling mapping on the tuple into a behavior fingerprint vector, an orthogonalization noise feature and an asymmetric adjacent tensor, and compresses the behavior fingerprint vector, the orthogonalization noise feature and the asymmetric adjacent tensor into a space-time topology tensor block; the reinforcement learning controller constructs a directed acyclic graph based on the tensor blocks, calculates connectivity loss and outputs an event risk score; the dynamic routing engine constructs a decision tree model according to the risk mark, the burst frequency and the correlation entropy, and implements three-level shunting and a multiple simulation system to generate an anti-interference index; and when the deviation between the physical trajectory and the digital model exceeds the tolerance, the closed-loop feedback weight coefficient updates the loss function parameter and adjusts the channel resource weight. And the problem of threat discovery delay caused by attack chain breakage under massive events is solved.

The invention provides a risk behavior perception method and device based on deep learning, and the method comprises the steps: firstly collecting multi-source behavior data containing a network access record, a terminal operation log and an application program interface calling sequence in a preset time window of a target user, carrying out the spatial-temporal feature extraction of the multi-source behavior data, generating a behavior track feature vector, and carrying out the feature extraction of the behavior track feature vector; the method comprises the following steps: acquiring a network access record, analyzing the network access record through a protocol to obtain a network behavior feature vector, inputting the network behavior feature vector and the network behavior feature vector into a pre-trained risk assessment neural network for joint coding to obtain behavior risk probability distribution, determining a risk level according to a risk category exceeding a preset threshold, generating an early warning signal, and finally triggering a real-time alarm module according to the early warning signal. The risk description text and the risk relief strategy are sent to the safety management terminal, multi-source data comprehensive analysis is achieved, the risk is accurately evaluated, early warning is timely and effective, and the risk perception ability is improved.

The invention relates to the field of industrial internet intrusion prevention, in particular to a computer network big data security protection method and system, and the method comprises the following steps: monitoring network flow, collecting user identity, equipment security state, access time and network behavior data, and generating a network behavior record. In the invention, a dynamic security assessment system is constructed through network flow monitoring, identity verification and behavior analysis, and compared with static strategy or fixed rule matching, the dynamic security assessment system can adapt to a continuously changing network attack environment. Authority dynamic adjustment is performed based on the user identity verification state, flexible management and control of the access authority are ensured, and the problem of long-term high authority abuse is avoided. Threat detection not only depends on historical mode matching, but also is combined with real-time behavior analysis, and accurate isolation is executed for potential threats, so that protection measures are changed from passive response to active intervention, and the delay of manual intervention is reduced.

The invention discloses a CVOCA feature extraction method and system based on a multi-modal large model, and belongs to the technical field of multi-modal feature extraction. Data preprocessing: processing the input data to generate standardized input; feature unified representation: utilizing a cross-modal unified encoder to map visual, text and time series data to a unified feature space; feature optimization: dynamically adjusting modal weight based on a dynamic feature optimizer to realize efficient feature fusion; carrying out context sensing modeling, and capturing long-range time sequence dependence; carrying out adversarial optimization, and improving the robustness of the model through adversarial training; the feature storage and updating system adopts an expert network and a gating mechanism to realize dynamic updating of a feature library; according to the method, the defects of an existing network behavior analysis technology in the aspects of multi-modal data fusion, calculation efficiency, anti-robustness and dynamic adaptability are overcome, and the technical performance and the application value are improved.

A computer system for adaptive operation of deep learning networks through hierarchical supervision, meta-level pattern tracking, cross-network signal coordination, and selective activation prioritization. The system operates a layered neural network monitored by a hierarchical supervisory system that collects activation data, identifies operational patterns, implements architectural modifications, detects network sparsity, coordinates pruning decisions, and manages resource redistribution. A meta-supervisory system tracks supervisory behavior, stores successful pruning and modification patterns, and extracts generalizable optimization principles. The system manages signal transmission pathways that enable direct communication between non-adjacent network regions, with signal modification and temporal coordination. A greedy neural system selectively processes activation patterns based on utility metrics and includes a competitive bidding manager to allocate limited computational resources to high-value signals. This architecture enables real-time optimization of network behavior and resource usage while maintaining operational stability and responsiveness across diverse applications.

The invention provides a network security threat intelligent identification method based on a generative large model, and belongs to the technical field of network security. Comprising the steps of obtaining system demand information, and determining a threat identification target and a system coverage range; collecting network system data, wherein the network system data comprises equipment log information, network flow information and terminal behavior information; preprocessing the network system data to obtain standardized data; selecting and training a machine learning model based on the standardized data to obtain a threat identification model; network behaviors are analyzed, abnormal behaviors are identified, and threat classification is carried out; executing corresponding safety protection measures according to the threat classification result; performing manual auditing on the abnormal behavior, and formulating a protection strategy in a targeted manner; and periodically evaluating the system operation state to generate a safety report. According to the invention, automatic response type intelligent identification of network security threats is realized, and the threats can be effectively detected under the condition of attack escape detection.

The invention discloses a network information security verification management system and method based on artificial intelligence, and relates to the technical field of artificial intelligence data management, and the method comprises the following steps: collecting network flow data and user behavior data, constructing a user behavior mode model through employing a machine learning algorithm, and calculating the abnormal degree of a user network behavior; calculating a safety coefficient through the abnormal degree quantized value of the user network behavior, comparing the safety coefficient with a preset threshold range, and judging a risk level of the user network behavior; marking user information with security threats, and counting network traffic fluctuation amplitude and user abnormal operation frequency; by means of the network information security verification management method and system, network information security verification management is achieved.

The invention relates to the technical field of Internet of Things, and discloses a multi-factor dynamic authentication Internet of Things network security access platform, which adopts a multi-factor authentication mechanism, combines biological characteristics, behavior characteristics and environment characteristics of equipment, performs identity verification through biological recognition, equipment fingerprints and behavior analysis, and utilizes a dynamic authentication strategy. Detecting an abnormal IP behavior and triggering a security policy by adopting a dynamic IP binding technology, combining with equipment fingerprint identification and learning and analyzing an equipment network behavior mode; a dynamic key management mechanism is adopted, and keys are automatically generated, distributed and updated according to different devices, application scenes and communication requirements; machine learning and artificial intelligence technologies are utilized to comprehensively analyze historical access data, abnormal behavior modes, environment security states and the like of equipment, and the security risk of equipment access is automatically evaluated if suspicious equipment is detected. The method has the advantage of improving the security of the Internet of Things.

The invention discloses a network space security risk intelligent identification method and system. The method comprises the following steps: deploying traffic collection equipment at key network nodes and boundary equipment, and collecting network traffic data and log data; extracting network behavior features and log key fields, and constructing a data feature model; performing vectorization processing based on the data feature model, performing traffic classification by using a deep neural network, and identifying a device type and a device identifier; carrying out noise reduction, redundant information removal and standardization processing on flow data in the data feature model to generate standardized data and storing the standardized data in a vector database; entity extraction is carried out on the standardized data, a knowledge graph is constructed, data distribution is analyzed through a Gaussian mixture model, the probability of abnormal behaviors is calculated in combination with historical data, and attack risks are calculated based on Bayesian decision; and generating an alarm according to the calculated attack risk, tracing the historical record of the attack risk in the knowledge graph, sending a blocking instruction, and identifying the security risk of the cyberspace.

The invention relates to the technical field of network security, and discloses a network security threat intelligent detection method based on big data analysis, and the method comprises the steps: collecting network equipment flow log data, constructing a network behavior space-time fusion matrix, calling an optimal threat detection algorithm, and carrying out the dynamic feature dimension alignment through an innovatively designed dynamic feature dimension alignment mechanism. The problem of tensor structure mismatching caused by sampling frequency difference of asset static data and network flow data in a traditional scheme is solved, a self-adaptive tensor interpolation technology is adopted, mapping of dynamic and static logs in the space-time dimension is achieved, systematic deviation during feature fusion is reduced, the accuracy of subsequent threat analysis is improved, and the risk of threat analysis is reduced. Through the established network behavior time-space fusion matrix, the asset service topology, the vulnerability fingerprint and the real-time traffic behavior are subjected to three-dimensional association modeling for the first time, the behavior chain characteristics of an attacker in the transverse movement and permission improvement process are described, and the attack path reduction capability of advanced sustainable threats is improved.

The invention provides a network traffic data security assessment method and system based on deep learning. The method comprises the following steps: converting original network traffic data into a graph structure data set comprising a topological structure, node attributes and time sequence behaviors; in the process, the time-space fusion input tensor is formed through the association strength between adjacent matrix and Laplacian matrix coding network entities and the fusion of time sequence characteristics extracted by time window slices. Compared with traditional flow analysis which only pays attention to a single protocol or a rate threshold value, the method achieves global relevance expression of network behaviors through graph structure modeling. Through graph structure modeling, multi-dimensional feature fusion and probabilistic risk assessment, the method can adapt to dynamic change of network topology and continuous evolution of an attack mode, so that a final assessment result is more accurate.

The invention discloses a network intrusion prevention method, apparatus and device, and a storage medium. The method comprises the steps of extracting feature information representing network behaviors from collected network flow data; inputting the feature information into a reinforcement learning model, and performing reinforcement learning on the feature information through the reinforcement learning model to obtain an intrusion prevention strategy; and acquiring environment feedback corresponding to execution of the intrusion prevention strategy, and adjusting the reinforcement learning model according to the environment feedback. Through the reinforcement learning model, automatic learning is carried out from a large amount of network flow data and adjustment is carried out to cope with continuously changing network threats, so that the accuracy and efficiency of network intrusion prevention are improved, and through automatic optimization of the model, the requirement of manual intervention is reduced, and the operation cost is reduced.

The invention relates to a network security vulnerability intelligent detection method based on artificial intelligence and big data, and the method comprises the steps: carrying out the dynamic time synchronization processing of multi-modal network security data, and generating a multi-source data flow with aligned time sequences through cross-modal correlation analysis; extracting cross-modal features from the data stream, and performing semantic fusion on the cross-modal features in combination with a vulnerability knowledge graph to generate a multi-dimensional feature vector; training the multi-dimensional feature vector through a hybrid model to obtain a vulnerability detection model, detecting real-time network behavior data by using the model, and outputting a vulnerability probability and an abnormal risk score; and performing automatic vulnerability verification according to the vulnerability probability and the abnormal risk score to obtain a verification result, and updating the vulnerability detection model according to the result. The system can effectively improve the accuracy, timeliness and stability of network security vulnerability detection and reduce the false report and missing report rate through multi-modal data collaboration, hybrid model dual detection and closed-loop optimization mechanisms.

The invention discloses a digital twinning-based thermal heat supply system defense cooperative protection method and system, particularly relates to the technical field of industrial control system safety, and is used for solving the problems of hidden attack missing detection and response delay caused by splitting of energy flow and data flow in an existing protection mechanism. Physical-network behavior collaborative verification is realized by constructing a digital twinborn model, and precise protection is realized by quantifying coupling failure characteristics of energy flow and instruction flow. The method specifically comprises the following steps: collecting production data, industrial control logs and network traffic; constructing a digital twin model to simulate expected behaviors of equipment, communication and physical states; comparing and detecting abnormal data in real time; extracting a thermodynamic potential gradient characteristic quantity and a path integral characteristic quantity from the abnormal data; calculating a covariant difference value of the two characteristic quantities, and judging an external attack when the covariant difference value exceeds a threshold value; when an attack is triggered, a micro-isolation gateway is deployed, dynamic access control is implemented based on an equipment fingerprint, a user behavior sequence and an environment fingerprint, and an attack chain is blocked.

The invention relates to the technical field of data processing, and provides a social network privacy data protection method and system, and the method comprises the steps: obtaining to-be-encrypted privacy data, and obtaining a keyword popularity coefficient and a sensitivity weight coefficient according to the privacy data; acquiring behavior characteristics and basic information of a user group, and acquiring a group portrait index according to the behavior characteristics and the basic information; acquiring network behavior activeness, equipment characteristics and historical behavior information of the target user, and acquiring personal characteristics of the target user according to the network behavior activeness, the equipment characteristics and the historical behavior information; according to the keyword popularity coefficient, the sensitivity weight coefficient, the group portrait index and the personal characteristics of the target user, obtaining the encryption level of the privacy data; and calling different encryption algorithms to encrypt the privacy data according to the encryption level. According to the method, different encryption algorithms are called for encryption for the privacy data of different encryption levels, and the dynamic adaptability of encryption protection of the privacy data of the social network is improved.

The invention provides an industrial control and infrastructure defense cooperation method and system based on digital twinning, and relates to the technical field of defense cooperation. The method comprises the following steps: based on a digital twinning technology, collecting sensor data in an industrial control system, and identifying abnormal fluctuation of equipment operation to obtain abnormal activity information; the occurrence frequency and intensity of the deviation data are analyzed, and the network data transmission security of the industrial entity is optimized to obtain security protocol optimization configuration; reconfiguring the network access authority, and monitoring the new access mode and the data flow in real time to obtain an access control optimization state; monitoring network behaviors by using an isolated forest algorithm, and quantitatively evaluating potential internal and external threats to obtain a threat evaluation update log; and adjusting the data acquisition frequency and the processing process based on the update log, and obtaining a dynamic cooperative defense mechanism by updating network defense and response rules. According to the invention, the early warning and response capability of the industrial control system can be optimized.

The invention discloses a network intrusion detection method and device for a gating multilayer perceptron based on spatio-temporal feature fusion, and the method comprises the steps: carrying out the preprocessing of the network flow of an Internet of Things system, capturing the time features of network behaviors through a bidirectional LSTM network through designing a new spatio-temporal feature extraction and learning method, and carrying out the detection of the network intrusion of the gating multilayer perceptron. And capturing a network behavior spatial relationship through a full connection layer network with a gating unit, and finally obtaining a space-time fusion feature association relationship through a gMLP network of a feature fusion module. And finally, based on a classification sub-network of a full connection layer, accurately classifying network attack behaviors according to the space-time fusion feature vector. The gMLP is used for mining the space-time relation between network behaviors, so that the network intrusion detection capability is improved. A simple full connection layer is adopted as a classifier, so that malicious behaviors can be effectively detected according to the spatial-temporal correlation of the acquired data.

The invention provides a network abnormal behavior feature detection method and device, and a computer readable storage medium. The network abnormal behavior feature detection method comprises the following steps: constructing an attention-based trajectory group anomaly detection model, constructing an abnormal behavior detection model, and constructing a normal and anomaly modeling model based on unsupervised learning; inputting the network behavior data of the networking device into the trajectory group anomaly detection model to obtain group trajectory preliminary anomaly detection data; inputting the group trajectory preliminary abnormal detection data into an abnormal behavior detection model to obtain non-abnormal behavior data in a data transmission process between the networked devices; and inputting the non-abnormal behavior data into the normal and abnormal modeling models to obtain network abnormal behavior feature data. According to the invention, the accuracy of network abnormal behavior detection between networked devices can be improved.

The invention provides an automatic perception model method and system for illegal access in a network security isolation area, and belongs to the technical field of computer systems based on specific calculation models.The method comprises the steps that firstly, a network topological graph matrix of the security isolation area is constructed, an equipment asset list is established, and then distributed flow collection nodes are deployed to obtain real-time network data; a deep packet detection technology is used for extracting features to establish an equipment behavior baseline library, a multi-target risk assessment function is used for carrying out risk grade division on equipment, a multi-layer perceptron and a time sequence anomaly detection algorithm are used for identifying abnormal communication, and an equipment fingerprint identification mechanism based on physical layer characteristics is established to verify the legality of the identity of the equipment. A security isolation intelligent sensing network model is utilized to analyze network behaviors, a multi-dimensional abnormal scoring system is constructed to calculate risk scores, a response mechanism based on a rule engine is realized, a federal learning technology can be selectively adopted to optimize the model, and an all-dimensional and multi-level illegal access automatic sensing protection system is formed.

The invention discloses a private network dynamic access control method and system, and relates to the technical field of network security and access control. The method comprises the following steps: acquiring equipment behavior data and network flow data in a private network, performing feature construction, and generating equipment trust features and network behavior features; and carrying out multi-dimensional risk assessment model training based on the equipment trust features and the network behavior features, carrying out real-time risk assessment on access requests or entities in the private network through the trained multi-dimensional risk assessment model, and generating a real-time risk score through a weighted aggregation function. According to the invention, through the multi-modal feature fusion model based on an attention mechanism, deep association of static attributes and dynamic behavior features of equipment is realized, and a real-time risk score is generated in combination with a multi-dimensional risk assessment model and a weighted aggregation algorithm. The limitation that in traditional access control, the evaluation dimension is single, the static strategy lags behind, and dynamic threats cannot be reflected is effectively overcome, and the accuracy and interpretability of private network access risk perception are remarkably improved.

The invention discloses an X86 industrial control mainboard identity authentication system based on multi-mode fusion, which relates to the technical field of mainboard identity authentication, and comprises the following steps: acquiring a secret key, generating a dynamic hardware fingerprint by combining cache topology and instruction delay, collecting physical unclonable function characteristics of power supply noise and clock jitter, and generating a circuit fingerprint; generating a firmware execution track, recording dynamic behaviors of a call chain and interrupt processing delay, and constructing a firmware runtime feature library; collecting spatio-temporal characteristics, generating environment fingerprints in combination with a geo-fencing technology, capturing time sequence characteristics, and generating a network behavior portrait in combination with a device topological relation; timestamp synchronization is carried out; simulating a fingerprint data tampering attack; and carrying out weighted fusion on the static features and the dynamic features. The hardware feature acquisition module, the firmware behavior acquisition module and the environment feature acquisition module are arranged, and physical unclonability of circuit fingerprints and time sequence features of firmware behaviors are combined, so that attacks are effectively resisted.