The embodiment of the invention discloses a cyberspace asset
fingerprint identification method and
system. The method comprises the following steps of: forming an original
fingerprint fragment according to four types of
metadata including a
time sequence, a protocol, a load length and a direction of captured network traffic
record; extracting a device communication
feature vector from the original
fingerprint fragment; carrying out dimension reduction
processing on the
feature vector to obtain a micro signature with a
fixed length; performing unsupervised
dynamic clustering by taking the micro signatures as input, and establishing equipment type identifiers; grouping the micro-signatures according to the equipment type identifiers, arranging the micro-signatures according to a
time sequence, and splicing the micro-signatures into a behavior chain; and encrypting the device identifier and the
device type identifier to generate an anonymized device ID, performing security coding on the micro signature, performing abstract
processing on the behavior chain, and constructing a triple
data structure containing the device ID, the security micro signature and the behavior abstract. The method can solve the technical problems that a large number of pre-marked training samples are relied on, unknown equipment types are difficult to identify, and a safe output mechanism is lacked.