WO2024065185A1 - Device classification method and apparatus, electronic device, and computer-readable storage medium - Google Patents

Abstract

Embodiments of the present invention disclose a device classification method and apparatus, an electronic device, and a computer-readable storage medium. The method comprises: acquiring network traffic between devices; extracting a first feature set, a second feature set, and a third feature set of the network traffic, the first feature set comprising a network address of a device and a common flag in the network traffic associated with the network address, the second feature set comprising a network address of a destination device of the network traffic and a transmission control protocol (TCP) port state of the destination device, and the third feature set comprising the network address of the destination device of the network traffic and a user datagram protocol (UDP) port state of the destination device; determining a union feature set on the basis of respective weights of the first feature set, the second feature set, and the third feature set; and determining a classification result of the device on the basis of a clustering result of the union feature set. Accurate device classification can be implemented by combining common attributes and specific attributes of the network traffic; in addition, weighting can be adjusted, improving classification accuracy.

Description

Device classification method, device, electronic device and computer readable storage medium Technical Field

The present invention relates to the field of data processing technology, and in particular to a device classification method, an apparatus, an electronic device and a computer-readable storage medium.

Background technique

Information technology (IT) and operational technology (OT) can be used to handle different aspects of an enterprise's technology infrastructure. The convergence of IT and OT is a key technology for the successful implementation of industrial IoT systems. However, this convergence is challenging: both sides have significantly different priorities, system models, and terminology.

As information and communication technologies are increasingly integrated into OT systems, the need for automatic classification of equipment (or assets) is growing.

Summary of the invention

The embodiments of the present invention provide a device classification method, an apparatus, an electronic device, and a computer-readable storage medium.

A device classification method, comprising:

Get network traffic between devices;

Extracting a first feature group, a second feature group and a third feature group of the network traffic, wherein the first feature group includes a network address of a device and a common flag (Common Flag) in the network traffic associated with the network address; the second feature group includes a network address of a destination device of the network traffic and a Transmission Control Protocol (TCP) port status of the destination device; the third feature group includes a network address of a destination device of the network traffic and a User Datagram Protocol (UDP) port status of the destination device;

Based on the respective weights of the first feature group, the second feature group and the third feature group, determining a feature group which is a union of the first feature group, the second feature group and the third feature group;

Based on the clustering result of the union feature group, a classification result of the device is determined.

Therefore, the first feature group characterizing the common attributes of the network traffic and the second feature group and the third feature group characterizing the specific attributes of the network traffic are comprehensively considered in a weighted manner to achieve accurate device classification.

In one embodiment, the device includes OT equipment and/or IT equipment;

The obtaining of network traffic between devices comprises: obtaining, via a monitoring port on a switch connected to the device, mirror traffic of network traffic flowing through the switch within a predetermined time;

The public sign includes at least one of the following:

Time to Live (TTL); Window Size (WinSize); Do not Fragment (DF) bit; Maximum Message Length (Max Segment Size, MSS); Window Scaling Factor (WinSacle).

Therefore, capturing mirrored traffic on the switch does not interfere with inter-device communications, and public flags have multiple implementations.

In one embodiment, the weight of the second feature group is greater than the weight of the third feature group, and the weight of the third feature group is greater than the weight of the first feature group, wherein the respective weights of the first feature group, the second feature group and the third feature group are adjustable.

Therefore, considering the significant importance of TCP port status to device classification, a higher weight is set for it, which improves the classification accuracy.

In one embodiment, it also includes:

When the degree of coincidence between the classification result and the predetermined target classification result is less than a predetermined threshold, iteration is performed until the degree of coincidence between the classification result and the target classification result is greater than or equal to the threshold, wherein the iteration includes:

adjusting at least one of the respective weights of the first feature group, the second feature group, and the third feature group;

Determine an adjusted union feature group of the first feature group, the second feature group, and the third feature group based on the respective adjusted weights of the first feature group, the second feature group, and the third feature group;

Determining an adjusted classification result based on the clustering result of the adjusted union feature group;

Compare the adjusted classification results with the target classification results.

Therefore, reasonable adjustment of weights is achieved through iteration.

In one embodiment, the status information of the TCP port represents the switch status of each TCP port of the destination device, and the status information of the UDP port represents the switch status of each UDP port of the destination device.

A device classification apparatus, comprising:

An acquisition module is configured to acquire network traffic between devices;

The extraction module is configured to extract a first feature group, a second feature group and a third feature group of the network traffic, wherein the first feature group includes a network address of a device and a public flag in the network traffic associated with the network address; the second feature group includes a network address of a destination device of the network traffic and a TCP port status of the destination device; the third feature group includes a network address of a destination device of the network traffic and a UDP status of the destination device;

A first determining module is configured to determine a union feature group of the first feature group, the second feature group and the third feature group based on respective weights of the first feature group, the second feature group and the third feature group;

The second determination module is configured to determine the classification result of the device based on the clustering result of the union feature group.

Therefore, the first feature group characterizing the common attributes of the network traffic and the second feature group and the third feature group characterizing the specific attributes of the network traffic are comprehensively considered in a weighted manner to achieve accurate device classification.

In one embodiment, the device includes OT equipment and/or IT equipment;

The acquisition module is configured to acquire the mirrored traffic of the network traffic within a predetermined time via a monitoring port of a switch connected to the device;

The public sign includes at least one of the following:

TTL; WinSize; DF bit; MSS; WinScale.

Therefore, capturing mirrored traffic on the switch does not interfere with inter-device communications, and public flags have multiple implementations.

In one embodiment, the weight of the second feature group is greater than the weight of the third feature group, and the weight of the third feature group is greater than the weight of the first feature group, wherein the respective weights of the first feature group, the second feature group and the third feature group are adjustable.

Therefore, considering the significant importance of TCP port status to device classification, a higher weight is set for it, which improves the classification accuracy.

In one embodiment, it also includes:

The adjustment module is configured to perform iteration when the overlap between the classification result and the predetermined target classification result is less than a predetermined threshold value, until the overlap between the classification result and the target classification result is greater than or equal to the threshold value, wherein the iteration includes: adjusting at least one of the respective weights of the first feature group, the second feature group and the third feature group; determining an adjusted union feature group of the first feature group, the second feature group and the third feature group based on the respective adjusted weights of the first feature group, the second feature group and the third feature group; determining an adjusted classification result based on a clustering result of the adjusted union feature group; and comparing the overlap between the adjusted classification result and the target classification result.

Therefore, reasonable adjustment of weights is achieved through iteration.

In one embodiment, the TCP port status information represents the switch status of each TCP port of the destination device, and the UDP port status information represents the switch status of each UDP port of the destination device.

An electronic device, comprising:

processor;

A memory, configured to store executable instructions of the processor;

The processor is used to read the executable instructions from the memory and execute the executable instructions to implement the device classification method as described in any one of the above items.

A computer-readable storage medium stores computer instructions, wherein the computer instructions, when executed by a processor, implement any of the above device classification methods.

A computer program product comprises a computer program, wherein when the computer program is executed by a processor, the device classification method as described in any one of the above items is implemented.

BRIEF DESCRIPTION OF THE DRAWINGS

The preferred embodiments of the present invention will be described in detail below with reference to the accompanying drawings, so that those skilled in the art can better understand the above and other features and advantages of the present invention. In the accompanying drawings:

FIG. 1 is a flow chart of a device classification method according to an embodiment of the present invention.

FIG. 2 is a schematic diagram of obtaining network traffic according to an embodiment of the present invention.

FIG. 3 is a schematic diagram of parsing network traffic according to an embodiment of the present invention.

FIG. 4 is an exemplary flow chart of a device classification method according to an embodiment of the present invention.

FIG. 5 is a block diagram of a device classification apparatus according to an embodiment of the present invention.

FIG. 6 is an exemplary structural diagram of an electronic device according to an embodiment of the present invention.

The reference numerals are as follows:

Label	meaning
101～104	step
10	internet
11	switch
12	router
13	Firewall
14	First OT system
15	Second OT system
16	IT Systems
20	switch
twenty one	Sniffer Service
twenty two	DFA Services
twenty three	Attribute data
twenty four	Network traffic analysis and processing
401～405	step
500	Equipment classification device
501	Get Module
502	Extraction module
503	The first determination module
504	The second determination module
505	Adjustment module
600	Electronic equipment
601	processor

602

Memory

Detailed ways

In order to make the purpose, technical solutions and advantages of the present invention more clear, the present invention is further described in detail with reference to the following embodiments.

For the sake of brevity and intuitiveness in description, the scheme of the present invention is explained below by describing several representative implementations. A large number of details in the implementations are only used to help understand the scheme of the present invention. However, it is obvious that the technical scheme of the present invention may not be limited to these details when implemented. In order to avoid unnecessarily obscuring the scheme of the present invention, some implementations are not described in detail, but only a framework is given. Hereinafter, "including" means "including but not limited to", and "according to..." means "at least according to..., but not limited to only according to...". Due to the language habits of Chinese, when the number of a component is not specifically specified below, it means that the component can be one or more, or can be understood as at least one.

As IT technology is increasingly integrated into OT systems, the demand for automatic equipment classification is growing. It should be noted that whether it is an IT system, an OT system, or an IT/OT fusion system, there is a demand for automatic equipment classification. In particular: in OT systems or IT/OT fusion systems, since many important attributes of OT devices cannot be directly obtained, the demand for automatic equipment classification is particularly strong and difficult to achieve.

FIG1 is a flow chart of a device classification method according to an embodiment of the present invention. The method of FIG1 is applicable to both IT systems that only include IT devices and OT systems that only include OT devices. Considering the number and complexity of devices in an IT/OT fusion system, the method of FIG1 is particularly suitable for OT systems and IT/OT fusion systems.

As shown in FIG1 , the method includes:

Step 101: Obtain network traffic between devices.

Here, the device may be an IT device in an IT system, an OT device in an OT system, an IT device in an IT/OT fusion system, or an OT device in an IT/OT fusion system.

The protocols for transmitting network traffic between devices can include: transmission protocols and communication protocols. Among them: transmission protocols are generally responsible for networking and communication between devices in a subnet; communication protocols are mainly device communication protocols running on TCP/IP protocols, responsible for data exchange and communication between devices through the Internet.

For example, protocols for transmitting network traffic may include: Representational State Transfer (REST)/Hyper Text Transfer Protocol (Hyper Text Transfer Protocol), Constrained Application Protocol (CoAP), Message Queuing Telemetry Transport (MQTT) protocol, Data Distribution Service for Real-Time Systems (DDS) protocol, Advanced Message Queuing Protocol (AMQP), Extensible Messaging and Presence Protocol (XMPP), JAVA Message Service (JMS) protocol, and so on.

The above exemplary descriptions are specific examples of protocols for transmitting network traffic. Those skilled in the art will appreciate that such descriptions are merely exemplary and are not intended to limit the scope of protection of the embodiments of the present invention.

FIG2 is a schematic diagram of obtaining network traffic according to an embodiment of the present invention. In FIG2 , the IT system 16 includes multiple IT devices, and the first OT system 14 and the second OT system 15 each include multiple OT devices. The IT system 16, the first OT system 14, and the second OT system 15 are each connected to the Internet 10 via a switch 11. The switch 11 is also connected to a router 12 and a firewall 13, respectively. There is network traffic between the IT system 16 and the first OT system 14 and the second OT system 15. By setting a mirrored traffic port on the switch 11, the network traffic between all devices in the IT system 16, the first OT system 14, and the second OT system 15 can be obtained.

In one embodiment, the device includes IT equipment and/or OT equipment; step 101 specifically includes: obtaining, via a monitoring port on a switch connected to the device, mirror traffic of network traffic flowing through the switch within a predetermined time (preferably, the predetermined time is long enough to ensure that the devices have achieved complete communication). Therefore, obtaining the mirror traffic on the switch will not interfere with the communication between the devices, and the public flag has multiple implementation methods.

Step 102: Extract the first feature group, the second feature group and the third feature group of the network traffic, wherein the first feature group includes the network address of the device and the common flag in the network traffic associated with the network address; the second feature group includes the network address of the destination device of the network traffic, and the TCP port status of the destination device; the third feature group includes the network address of the destination device of the network traffic, and the UDP port status of the destination device.

FIG3 is a schematic diagram of parsing network traffic according to an embodiment of the present invention. In the network traffic parsing process 24: first, the network traffic is obtained from the switch 20 using the sniffer service 21; then, a deterministic finite automaton (DFA) service 22, such as a tshark service, is executed on the traffic to extract header attributes and payload attributes from the network traffic message, thereby obtaining attribute data 23.

For example, public flags representing common attributes of a device's network traffic (e.g., with the device as the source device and/or destination device), and the TCP port status and UDP port status of the message's destination device can be extracted from the network traffic header.

Here, the public flag includes at least one of the following:

(1) Time To Live (TTL):

TTL specifies the maximum number of network segments that an IP packet is allowed to pass through before it is discarded by a router. For example, in the IPv4 packet header, TTL is an 8-bit field located in the 9th byte of the IPv4 packet.

(2) Window size: (WinSize):

The TCP header contains a window size field, which actually refers to the window of the receiving end, that is, the receiving window, which is used to inform the sending end of the amount of data it can receive, thereby achieving the purpose of flow control.

(3) Do not fragment (DF) bit:

DF bit: 1 means no fragmentation, 0 means fragmentation

(4) Maximum message length (MSS):

MMS is an option of the TCP protocol. It is used by the sender and receiver to negotiate the maximum data length that each segment can carry during communication (excluding the segment header) when the TCP connection is established.

(5) Window scaling factor (WinScale):

WinScale is located in the Options field of the TCP packet header and represents the multiple by which the window can be enlarged.

Table 1 is a typical schematic table of the first feature group.

Table 1

In Table 1, for the device with IP address 192.168.0.1, various public flags contained in the network traffic (e.g., extracted from the header of the traffic) can be extracted from the network traffic sent by the device. Correspondingly, for devices with other IP addresses, various public flags can also be extracted from the network traffic sent by the devices, thereby forming Table 1. Similarly, for the device corresponding to each IP address, the network traffic with the device as the destination device can be extracted, thereby forming Table 1.

It can be seen that Table 1 contains the corresponding relationship between the public flags of the public attributes of the network traffic of the device and the network address of the device.

In one embodiment, the state information of the TCP port represents the switch state of each TCP port of the destination device (that is, the port is open or disconnected and closed), and the state information of the UDP port represents the switch state of each UDP port of the destination device (that is, the port is open or disconnected and closed). For example, when the port is open, the corresponding state value is 1; when the port is closed, the corresponding state value is 0.

Table 2 is a typical schematic table of the second feature group.

IP address	TCP#1	TCP#2	...	TCP#65534	TCP#65535
192.168.0.1	1	0	...	1	1
192.168.0.2	1	1	...	0	1
192.168.0.3	0	0	...	1	0
...	...	...	...	...	...

Table 2

In Table 2, for the device whose destination IP address of the network traffic is 192.168.0.1 (i.e., the destination device), the status of each TCP port in the destination device can be combined based on all network traffic sent to the destination device. For example, when there is traffic with a destination address of 192.168.0.1 and a destination port of TCP#1 in all network traffic, the status value of the TCP#1 port of the device with IP address: 192.168.0.1 is 1; when there is no traffic with a destination address of 192.168.0.2 and a destination port of TCP#2 in all network traffic, the status value of the TCP#2 port of the device with IP address: 192.168.0.1 is 0. Similarly, for the corresponding destination devices corresponding to the remaining IP addresses, the status values of all TCP ports in the respective destination devices can be parsed respectively, thereby forming Table 2.

Table 3 is a typical schematic table of the third feature group.

IP address	UDP#1	UDP#2	...	UDP#65534	UDP#65535
192.168.0.1	1	0	...	1	1
192.168.0.2	1	1	...	0	1
192.168.0.3	0	0	...	1	0
...	...	...	...	...	...

table 3

In Table 3, for the device whose destination IP address of the network traffic is 192.168.0.1 (i.e., the destination device), the status of each UDP port in the destination device can be combined based on all network traffic sent to the destination device. For example, when there is traffic with a destination address of 192.168.0.1 and a destination port of UDP#1 in all network traffic, the status value of the UDP#1 port of the device with IP address: 192.168.0.1 is 1; when there is no traffic with a destination address of 192.168.0.2 and a destination port of UDP#2 in all network traffic, the status value of the UDP#2 port of the device with IP address: 192.168.0.1 is 0. Similarly, for the corresponding destination devices corresponding to the remaining IP addresses, the status values of all UDP ports in the respective destination devices can be parsed separately, thereby forming Table 3.

It can be seen that Table 2 and Table 3 respectively include the switch status of the TCP port and UDP port of the device, that is, they include the specific attributes of the destination device to which the network traffic is directed.

Step 103: Determine a union feature group of the first feature group, the second feature group and the third feature group based on respective weights of the first feature group, the second feature group and the third feature group.

Here, the union feature group means merging the first feature group, the second feature group and the third feature group.

For example, the first feature group, the second feature group, and the third feature group can be represented in matrix form respectively, and then the three matrices are merged to obtain the matrix of the union feature group. In the merging process, each coefficient is multiplied by its own weight. Considering that the port switch status of the device has an important reference significance for the type of device, it is of great significance to take the specific attributes of network traffic as a consideration factor in the device classification process.

For example, suppose the matrix of the first feature group is:

The matrix of the second feature group is:

The matrix of the second feature group is:

Weight ₀ is the weight of the first feature group, weight ₁ is the weight of the second feature group, and weight ₂ is the weight of the third feature group. The union feature group has the following expression:

The applicant found that: compared with the impact of common attributes of network traffic on device classification results, specific attributes of network traffic have a greater impact on device classification results, and the TCP port status has a significant impact on the classification results of the device.

In one embodiment, the weight of the second feature group is greater than the weight of the third feature group, and the weight of the third feature group is greater than the weight of the first feature group, wherein the weights of the first feature group, the second feature group, and the third feature group are all adjustable. It can be seen that by adjusting the weights of the first feature group, the second feature group, and the third feature group, the accuracy of grouping can be improved.

Step 104: Determine the classification result of the device based on the clustering result of the union feature group.

Here, a clustering algorithm is performed on the union feature set to determine the classification result of the device. Cluster analysis is based on similarity, and there are more similarities between patterns in a cluster than between patterns that are not in the same cluster. There are many types of clustering algorithms that can be used to achieve classification.

For example, the K-means clustering algorithm can be used. In the K-means clustering algorithm, firstly, k data objects are randomly selected as the initial cluster centers from the n data objects contained in the union feature group; and for the remaining data objects, they are respectively assigned to the clusters (represented by the cluster centers) that are most similar to them according to their similarity (distance) with these cluster centers; and then the cluster center of each new cluster obtained is calculated (the mean of all objects in the cluster); and this process is repeated until the standard measurement function begins to converge.

In one embodiment, it also includes: when the overlap between the classification result and the predetermined target classification result is less than a predetermined threshold, iterate until the overlap between the classification result and the target classification result is greater than or equal to the threshold, wherein the iteration includes: adjusting at least one of the respective weights of the first feature group, the second feature group and the third feature group; determining the adjusted union feature group of the first feature group, the second feature group and the third feature group based on the respective adjusted weights of the first feature group, the second feature group and the third feature group; determining the adjusted classification result based on the clustering result of the adjusted union feature group; comparing the overlap between the adjusted classification result and the target classification result. For example, the network traffic of a known type of device can be obtained, and then the network traffic of the known type of device can be classified based on the above method to obtain the calculated classification result, and the calculated classification result can be compared with the actual classification result of the device (that is, the predetermined target classification result). When it is found that the overlap is less than the threshold, it is determined that the respective coefficients of the first feature group, the second feature group and the third feature group need to be adjusted, wherein when adjusting, the weight of the second feature group is increased first.

When the weights are determined, the classification of unknown devices can be performed, and the classification results can be mapped to actual device type definitions.

for example:

in

is the device number matrix;

The device classification matrix is shown in Figure 1, where PLC represents that the device is classified as a programmable logic controller and HMI represents that the device is classified as a human-machine interface device.

FIG4 is an exemplary flow chart of a device classification method according to an embodiment of the present invention. In FIG4, an OI network is taken as an example for exemplary description. As shown in FIG4, the method includes:

Step 401: Perform data preparation. Here, traffic attributes can be extracted from OT network traffic. Typically, passive monitoring is performed to sniff network traffic, and then attribute data is extracted from the network traffic as data to be used later.

Step 402: Perform feature identification and weight setting. Here, features (including public flags, TCP port status, and UDP port status) are identified from the attribute data, and then the features are grouped to form three feature groups, and each feature group is assigned a respective weight.

Step 403: Perform clustering processing. Here, a clustering algorithm is used to cluster the feature matrix after the three feature groups are combined.

Step 404: Determine the device category based on the clustering result.

FIG5 is a structural diagram of a device classification device according to an embodiment of the present invention. As shown in FIG5 , the device classification device 500 includes:

The acquisition module 501 is configured to acquire network traffic between devices;

The extraction module 502 is configured to extract a first feature group, a second feature group, and a third feature group of the network traffic, wherein the first feature group includes a network address of a device and a common flag in the network traffic associated with the network address; the second feature group includes a network address of a destination device of the network traffic and a transmission control protocol port state of the destination device; the third feature group includes a network address of a destination device of the network traffic and a user datagram protocol port state of the destination device;

A first determining module 503 is configured to determine a union feature group of the first feature group, the second feature group and the third feature group based on respective weights of the first feature group, the second feature group and the third feature group;

The second determination module 504 is configured to determine a classification result of the device based on the clustering result of the union feature group.

In one embodiment, the device includes an OT device and/or an IT device; the acquisition module 501 is configured to obtain the mirror traffic of the network traffic within a predetermined time via the monitoring port of the switch connected to the device; wherein the public flag includes at least one of the following: lifetime; window size; non-fragmentation bit; maximum message length; window scaling factor.

In one embodiment, the weight of the second feature group is greater than the weight of the third feature group, and the weight of the third feature group is greater than the weight of the first feature group, wherein the respective weights of the first feature group, the second feature group, and the third feature group are all adjustable.

In one embodiment, an adjustment module 505 is further included, which is configured to perform iterations when the overlap between the classification result and the predetermined target classification result is less than a predetermined threshold value, until the overlap between the classification result and the target classification result is greater than or equal to the threshold value, wherein the iterations include: adjusting at least one of the respective weights of the first feature group, the second feature group and the third feature group; determining an adjusted union feature group of the first feature group, the second feature group and the third feature group based on the respective adjusted weights of the first feature group, the second feature group and the third feature group; determining an adjusted classification result based on the clustering result of the adjusted union feature group; and comparing the overlap between the adjusted classification result and the target classification result.

In one embodiment, the TCP port status information represents the switch status of each TCP port of the destination device, and the UDP port status information represents the switch status of each UDP port of the destination device.

The embodiment of the present invention further provides an electronic device with a processor-memory architecture. Fig. 6 is an exemplary structural diagram of an electronic device according to an embodiment of the present invention.

As shown in FIG6 , the electronic device 600 includes a processor 601, a memory 602, and a computer program stored in the memory 602 and executable on the processor 601. When the computer program is executed by the processor 601, any of the above device classification methods is implemented. Among them, the memory 602 can be specifically implemented as a variety of storage media such as an electrically erasable programmable read-only memory (EEPROM), a flash memory (Flash memory), and a programmable program read-only memory (PROM). The processor 601 can be implemented as including one or more central processing units or one or more field programmable gate arrays, wherein the field programmable gate array integrates one or more central processing unit cores. Specifically, the central processing unit or the central processing unit core can be implemented as a CPU or an MCU or a DSP, and so on.

It should be noted that not all steps and modules in the above processes and structure diagrams are necessary, and some steps or modules can be ignored according to actual needs. The execution order of each step is not fixed and can be adjusted as needed. The division of each module is only for the convenience of describing the functional division adopted. In actual implementation, a module can be implemented by multiple modules, and the functions of multiple modules can also be implemented by the same module. These modules can be located in the same device or in different devices.

The hardware modules in each embodiment can be implemented mechanically or electronically. For example, a hardware module may include a specially designed permanent circuit or logic device (such as a dedicated processor, such as an FPGA or ASIC) to perform a specific operation. The hardware module may also include a programmable logic device or circuit (such as a general-purpose processor or other programmable processor) temporarily configured by software to perform a specific operation. As for whether to implement the hardware module mechanically, or using a dedicated permanent circuit, or using a temporarily configured circuit (such as configured by software), it can be decided based on cost and time considerations.

The above description is only a preferred embodiment of the present invention and is not intended to limit the protection scope of the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims (13)

1. A device classification method, characterized by comprising:

   Get network traffic between devices (101);

   Extracting a first feature group, a second feature group, and a third feature group of the network traffic, wherein the first feature group includes a network address of a device and a common flag in the network traffic associated with the network address; the second feature group includes a network address of a destination device of the network traffic and a transmission control protocol port status of the destination device; the third feature group includes a network address of a destination device of the network traffic and a user datagram protocol port status of the destination device (102);

   Determine a union feature group of the first feature group, the second feature group and the third feature group based on their respective weights (103);

   Based on the clustering result of the union feature group, a classification result of the device is determined (104).
2. The method according to claim 1, characterized in that the equipment includes operational technology equipment and/or information technology equipment;

   The obtaining of network traffic between devices (101) comprises: obtaining, via a monitoring port on a switch connected to the device, mirror traffic of network traffic flowing through the switch within a predetermined time;

   The public sign includes at least one of the following:

   Lifetime; window size; non-fragmentation bit; maximum message length; window scaling factor.
3. The method according to claim 1 is characterized in that the weight of the second feature group is greater than the weight of the third feature group, the weight of the third feature group is greater than the weight of the first feature group, and the respective weights of the first feature group, the second feature group and the third feature group are all adjustable.
4. The method according to claim 1, further comprising:

   When the degree of coincidence between the classification result and the predetermined target classification result is less than a predetermined threshold, iteration is performed until the degree of coincidence between the classification result and the target classification result is greater than or equal to the threshold, wherein the iteration includes:

   adjusting at least one of the respective weights of the first feature group, the second feature group, and the third feature group;

   Determine an adjusted union feature group of the first feature group, the second feature group, and the third feature group based on the respective adjusted weights of the first feature group, the second feature group, and the third feature group;

   Determining an adjusted classification result based on the clustering result of the adjusted union feature group;

   Compare the adjusted classification results with the target classification results.
5. The method according to any one of claims 1-4 is characterized in that the status information of the transmission control protocol port represents the switch status of each transmission control protocol port of the destination device, and the status information of the user datagram protocol port represents the switch status of each user datagram protocol port of the destination device.
6. A device classification device, characterized by comprising:

   An acquisition module (501) is configured to acquire network traffic between devices;

   The extraction module (502) is configured to extract a first feature group, a second feature group and a third feature group of the network traffic, wherein the first feature group includes a network address of a device and a common flag in the network traffic associated with the network address; the second feature group includes a network address of a destination device of the network traffic and a transmission control protocol port status of the destination device; the third feature group includes a network address of a destination device of the network traffic and a user datagram protocol port status of the destination device;

   A first determination module (503) is configured to determine a feature group that is a union of the first feature group, the second feature group and the third feature group based on respective weights of the first feature group, the second feature group and the third feature group;

   The second determination module (504) is configured to determine a classification result of the device based on the clustering result of the union feature group.
7. The apparatus according to claim 6, characterized in that the equipment comprises operational technology equipment and/or information technology equipment;

   The acquisition module (501) is configured to acquire the mirrored traffic of the network traffic within a predetermined time via a monitoring port of a switch connected to the device;

   The public sign includes at least one of the following:

   Lifetime; window size; non-fragmentation bit; maximum message length; window scaling factor.
8. The device according to claim 6 is characterized in that the weight of the second feature group is greater than the weight of the third feature group, the weight of the third feature group is greater than the weight of the first feature group, and the respective weights of the first feature group, the second feature group and the third feature group are adjustable.
9. The device according to claim 6, further comprising:

   The adjustment module (505) is configured to, when the overlap between the classification result and the predetermined target classification result is less than a predetermined threshold, perform iteration until the overlap between the classification result and the target classification result is greater than or equal to the threshold, wherein the iteration includes: adjusting at least one of the respective weights of the first feature group, the second feature group and the third feature group; determining an adjusted union feature group of the first feature group, the second feature group and the third feature group based on the respective adjusted weights of the first feature group, the second feature group and the third feature group; determining an adjusted classification result based on a clustering result of the adjusted union feature group; and comparing the overlap between the adjusted classification result and the target classification result.
10. The device according to any one of claims 6-9 is characterized in that the status information of the transmission control protocol port represents the switch status of each transmission control protocol port of the destination device, and the status information of the user datagram protocol port represents the switch status of each user datagram protocol port of the destination device.
11. An electronic device, comprising:

    Processor (601);

    A memory (602) for storing executable instructions of the processor (601);

    The processor (601) is used to read the executable instructions from the memory (602) and execute the executable instructions to implement the device classification method according to any one of claims 1 to 6.
12. A computer-readable storage medium having computer instructions stored thereon, wherein the computer instructions, when executed by a processor, implement the device classification method according to any one of claims 1 to 6.
13. A computer program product, characterized in that it comprises a computer program, and when the computer program is executed by a processor, it implements the device classification method according to any one of claims 1 to 6.

Images