CN115396157B - Automatic detection scheme generation method and system for Internet of things equipment based on feedback - Google Patents
Automatic detection scheme generation method and system for Internet of things equipment based on feedback Download PDFInfo
- Publication number
- CN115396157B CN115396157B CN202210910770.4A CN202210910770A CN115396157B CN 115396157 B CN115396157 B CN 115396157B CN 202210910770 A CN202210910770 A CN 202210910770A CN 115396157 B CN115396157 B CN 115396157B
- Authority
- CN
- China
- Prior art keywords
- equipment
- action
- detection
- identification
- internet
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000001514 detection method Methods 0.000 title claims abstract description 104
- 238000000034 method Methods 0.000 title claims abstract description 51
- 230000009471 action Effects 0.000 claims abstract description 42
- 230000004044 response Effects 0.000 claims abstract description 37
- 230000008569 process Effects 0.000 claims abstract description 22
- 239000000523 sample Substances 0.000 claims abstract description 19
- 238000012545 processing Methods 0.000 claims abstract description 11
- 238000013507 mapping Methods 0.000 claims abstract description 5
- 238000012544 monitoring process Methods 0.000 claims abstract description 5
- 230000008859 change Effects 0.000 claims description 4
- 238000004891 communication Methods 0.000 claims description 3
- 230000005540 biological transmission Effects 0.000 claims description 2
- 230000000644 propagated effect Effects 0.000 claims 1
- 230000006872 improvement Effects 0.000 abstract description 9
- 230000033001 locomotion Effects 0.000 description 3
- 238000013527 convolutional neural network Methods 0.000 description 2
- 238000005516 engineering process Methods 0.000 description 2
- 238000010801 machine learning Methods 0.000 description 2
- 230000006978 adaptation Effects 0.000 description 1
- 238000004458 analytical method Methods 0.000 description 1
- 230000006399 behavior Effects 0.000 description 1
- 238000012512 characterization method Methods 0.000 description 1
- 230000001186 cumulative effect Effects 0.000 description 1
- 238000007405 data analysis Methods 0.000 description 1
- 238000013480 data collection Methods 0.000 description 1
- 238000013135 deep learning Methods 0.000 description 1
- 230000001419 dependent effect Effects 0.000 description 1
- 238000010586 diagram Methods 0.000 description 1
- 238000000605 extraction Methods 0.000 description 1
- 230000007787 long-term memory Effects 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 238000005457 optimization Methods 0.000 description 1
- 230000002787 reinforcement Effects 0.000 description 1
- 230000008439 repair process Effects 0.000 description 1
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/01—Protocols
- H04L67/12—Protocols specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
Landscapes
- Engineering & Computer Science (AREA)
- Computing Systems (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Power Engineering (AREA)
- Computer Hardware Design (AREA)
- Computer Security & Cryptography (AREA)
- General Engineering & Computer Science (AREA)
- Health & Medical Sciences (AREA)
- General Health & Medical Sciences (AREA)
- Medical Informatics (AREA)
- Computer And Data Communications (AREA)
Abstract
A method and a system for generating an automatic detection scheme of an Internet of things device based on feedback, wherein the method comprises the following steps: step S101: scanning the characteristic ports by using a layering method, detecting an equipment open port list, providing an initial state identified by equipment, outputting the open port list, and generating an available detection action set and an initial detection state; step S102: mapping the state to an action of sending the detection packet, and selecting one detection action to execute according to the current state; step S103: processing the target response data and updating the identification state to obtain the rewarding value of the action, and carrying out back propagation on the rewarding value to update the scheduling strategy; step S104: judging whether the identification target is reached; if yes, ending the identification process; step S105: circularly detecting, monitoring and judging until the identification target is reached or the available detection means are used up; an optimal probe sequence is formed. The system is used for implementing the method. The invention has the advantages of simple principle, capability of realizing accurate identification, improvement of identification efficiency and the like.
Description
Technical Field
The invention mainly relates to the technical field of the Internet of things, in particular to a method and a system for generating an automatic detection scheme of equipment of the Internet of things based on feedback.
Background
The detection of the equipment of the Internet of things is a precondition for carrying out safety management on network assets, and can support the discovery of the assets of the Internet of things, the repair of vulnerability permission and even assist in grasping network situations. Currently, the main solutions for identifying devices include three types: detection methods based on artificial fingerprints, traffic and protocol responses. Wherein:
The detection method based on the artificial fingerprint is mainly characterized in that a fingerprint library is manually constructed through analysis equipment TCP/IP protocol characteristics, and the fingerprint of an operating system is identified. The detection data packet is sent to the target device, for example, by Nmap means, and the device fingerprint data packet is constructed from the field characteristics of the response. Recent studies have shifted traffic data collection and analysis to the network, transport and application layers for device behavior modeling and characterization. Part of the work uses machine learning to distinguish between smart device types. The fingerprint is composed of data packets and features, so that higher accuracy can be achieved. And part of work utilizes Convolutional Neural Network (CNN) and long-term memory network (LSTM) to extract and construct characteristic fingerprints of HTTP and TCP cross-layer data packets, so as to realize the recognition of the Internet of things equipment.
The detection technology based on protocol response is a novel device fingerprint accurate detection method. The main device search engine (Shodan, censys, zoomeye, fofa and the like) in the current process also adopts a detection method based on protocol response to perform device identification, and the identification accuracy of Shodan can reach 95%. Although Shodan and the like can identify the equipment of the internet of things, the recall rate of the equipment attribute information is low, so that the identification granularity is thicker, and accurate management and protection of the equipment cannot be assisted.
In the prior art, existing work detects online equipment on the internet by constructing rules and fingerprint libraries, and the disadvantage of the existing work is that the existing work is excessively dependent on manual experience and knowledge. The manual fingerprint extraction can help to solve part of recognition, but the manual fingerprint is easy to degrade, and the recognition capability of newer and similar type equipment is insufficient, so that the recognition efficiency is low. The manual detection is long in time consumption and low in precision, and because the focused fingerprint features are single, fingerprints at different levels and associated detection methods are mutually independent, and comprehensive information detection from a physical layer to an application layer in multiple dimensions is difficult to establish.
The method of introducing machine learning or deep learning analyzes network traffic, and improves the automation degree of equipment identification, but only the equipment type or equipment brand can be identified currently, and the identification granularity is thicker. And the page, the slogan and even the flow characteristic information of the equipment with different types are very similar, and the types of the equipment can not be well distinguished. For newly emerging devices, the classifier needs to be retrained and the features that may be extracted for different types of devices may be different, making the detection method difficult to automate and meeting the requirements of extensibility.
Disclosure of Invention
The technical problem to be solved by the invention is as follows: aiming at the technical problems existing in the prior art, the invention provides the automatic detection scheme generation method and the system for the equipment of the Internet of things based on feedback, which have the advantages of simple principle, capability of realizing accurate identification and improving the identification efficiency.
In order to solve the technical problems, the invention adopts the following technical scheme:
A method for generating an automatic detection scheme of an Internet of things device based on feedback comprises the following steps:
Step S101: scanning the characteristic ports by using a layering method, detecting an equipment open port list, providing an initial state of equipment identification, outputting the open port list, and generating an available detection action set A valid and an initial detection state;
Step S102: mapping the state s to an action of sending the detection packet, and selecting one detection action a to execute according to the current state;
step S103: processing target response data and updating the identification state s to obtain an action rewarding value r, carrying out back propagation on the rewarding value, and updating a scheduling strategy pi;
Step S104: judging whether the identification target is reached; if yes, ending the identification process, otherwise returning to the step S103 to continue selecting the next detection action;
Step S105: detecting, monitoring and judging are performed circularly until the identification target is reached or the available detection means A valid is used up; an optimal probe sequence is formed.
As a further improvement of the process of the invention: pre-establishing a multi-dimensional equipment fingerprint library; the multi-dimensional device fingerprint library at least comprises device manufacturer information, device model information and device firmware version information.
As a further improvement of the process of the invention: establishing a recognition state set S comprising Wherein/>The step S brand、Smodel、Sversion indicates that only the equipment manufacturer, the equipment model and the equipment firmware version are identified, the step S b&u,Sb&u,Sm&v indicates that the equipment manufacturer and the model, the equipment manufacturer and the firmware version, the equipment model and the firmware version are identified, and the step S all indicates that all the information of the equipment manufacturer, the model and the firmware version is identified.
As a further improvement of the process of the invention: an action set A is established, wherein the action set A comprises various detection means s.
As a further improvement of the process of the invention: the use of an invalid action mask avoids repeated generation of invalid actions in a large discrete action space.
As a further improvement of the process of the invention: a prize set is established and a prize R (s, a) =e [ R t+1 |s, a ] represents the instantaneous prize value provided by the device identification status change after transmission of the protocol probe packet, as determined by the amount of device information acquired by the probe action.
As a further improvement of the process of the invention: the scheduling strategy pi θ (a|s) is a strategy for selecting the optimal action according to the current state, and the parameter theta of the optimal strategy can be obtained by performing iterative computation on the strategy pi until the expected maximum accumulated return is reached.
As a further improvement of the process of the invention: dividing the equipment detection surface into three layers: a port layer, a protocol response layer and a Web feature layer; the port layer refers to an open port of an operating system of the Internet of things device, and is associated with a communication protocol of a host and a specific type of service; the protocol response layer refers to the protocol response characteristics of a system or an application component, the different protocol responses contain different amounts of information, and most of the protocol responses do not contain complete information about equipment fingerprints; the Web feature layer refers to URL and page content features of Web application.
The invention further provides an automatic detection scheme generation system of the Internet of things equipment based on feedback, which comprises the following steps:
the detection knowledge base module is used for detecting multidimensional fingerprints and comprises a detection open port list, detection of different protocol responses and detection of Web end characteristics;
The data processing module is used for processing response data of the target equipment, wherein the processed data comprises port data, protocol response data and Web characteristic data;
and the detection scheduling module is used for mapping the state to the action of sending the detection packet and searching for the optimal detection strategy so as to maximize the jackpot.
As a further improvement of the system of the invention: the method comprises the step of pre-establishing a multi-dimensional equipment fingerprint library, wherein the multi-dimensional equipment fingerprint library at least comprises equipment manufacturer information, equipment model information and equipment firmware version information.
Compared with the prior art, the invention has the advantages that:
1. According to the method and the system for generating the automatic detection scheme of the Internet of things equipment based on feedback, the current detection state is automatically and dynamically analyzed by means of multi-level fingerprint information and in consideration of balanced detection precision and detection cost, and the detection strategy of the next step is determined, so that the recognition efficiency of the large-scale Internet of things equipment is improved.
2. The invention provides a feedback-based automatic detection scheme generation method and system for equipment of the Internet of things, which are based on deep reinforcement learning, and provide an automatic detection scheme generation method oriented to the whole process from the perspective of the whole process of the detection process by quantitatively representing and measuring the existing detection technology.
3. According to the method and the system for generating the automatic detection scheme of the Internet of things equipment based on feedback, the automatic detection is realized through modeling of the detection process aiming at the problems that the fingerprint level and the detection means are single and the detection processes are independent, the efficient detection process optimization scheme is used, a small amount of detection and accurate identification are realized, and the identification efficiency of the Internet of things equipment is improved.
4. According to the method and the system for generating the automatic detection scheme of the Internet of things equipment based on feedback, multi-level fingerprints are used, and the next detection means is dynamically planned through dynamic changes of the fingerprint information quantity of the equipment, dependency relations among different detection surfaces and detection sequence relations under the constraint of fingerprint granularity and detection time.
Drawings
FIG. 1 is a schematic flow chart of the method of the present invention in a specific application example.
Fig. 2 is a schematic diagram of the system of the present invention in a specific application example.
Detailed Description
The invention will be described in further detail with reference to the drawings and the specific examples.
The invention aims at the identification scene of large-scale Internet of things equipment, and realizes the fine-granularity, efficient and automatic equipment fingerprint identification according to the constructed fingerprint library and detection method set. In the detection process, based on the current detection state, the next optimal detection method is automatically selected for the detection target, so that the efficiency and the automation degree of equipment fingerprint identification are improved.
As shown in fig. 1, the method for generating the automatic detection scheme of the internet of things equipment based on feedback comprises the following steps:
Step S101: scanning the characteristic ports by using a layering method, detecting an equipment open port list, providing an initial state of equipment identification, outputting the open port list, and generating an available detection action set A valid and an initial detection state;
Step S102: mapping the state s to an action of sending the detection packet, and selecting one detection action a to execute according to the current state;
step S103: processing target response data and updating the identification state s to obtain an action rewarding value r, carrying out back propagation on the rewarding value, and updating a scheduling strategy pi;
Step S104: judging whether the identification target is reached; if yes, ending the identification process, otherwise returning to the step S103 to continue selecting the next detection action;
Step S105: detecting, monitoring and judging are performed circularly until the identification target is reached or the available detection means A valid is used up; an optimal probe sequence is formed.
In a specific application example, a multi-dimensional device fingerprint library is further established in advance; the multi-dimensional device fingerprint library at least comprises device manufacturer information, device model information and device firmware version information.
In a specific application example, a recognition state set S is further established, wherein the recognition state set S comprises Wherein/>The step S brand、Smodel、Sversion indicates that only the equipment manufacturer, the equipment model and the equipment firmware version are identified, the step S b&m,Sb&v,Sm&v indicates that the equipment manufacturer and the model, the equipment manufacturer and the firmware version, the equipment model and the firmware version are identified, and the step S all indicates that all the information of the equipment manufacturer, the model and the firmware version is identified.
In a specific application example, an action set a is further established, wherein the action set a comprises various detection means a.
In a specific application, the set of available probe actions a valid e a of the device is different due to the different open ports and operating protocols. Invalid motion masks may be employed to avoid repeated generation of invalid motions in large discrete motion spaces.
In a specific application example, a reward set is further established, and the reward R (s, a) =e [ R t+1 |s, a ] represents an instant reward value provided by a device identification status change after transmitting a protocol probe packet, and is determined by the amount of device information acquired by the probe action.
In a specific application example, the scheduling policy pi θ (a|s) is a policy for selecting an optimal action according to the current state, and the parameter θ of the optimal policy can be obtained by performing iterative computation on the policy pi until the expected maximum cumulative return is obtained.
The method of the invention divides the equipment detection surface into three layers: a port layer, a protocol response layer and a Web feature layer. Wherein:
The port layer refers to an open port of an operating system of the internet of things device, and is associated with a communication protocol of a host and a specific type of service. Since most internet of things devices are manufactured for a specific task, the open information of the port may reflect fingerprint information of the device.
The protocol response layer refers to a system or application component protocol response feature, different protocol responses contain different amounts of information, and most protocol responses do not contain complete information about the device fingerprint.
The Web feature layer refers to features of URLs, page contents, and the like of Web applications.
Further, the three layers of detection surfaces have a hierarchical dependency relationship and a sequential relationship in detection. The personalized port or combination of ports can be used to determine the device vendor, but not the device model, firmware version. The protocol response layer is above the port layer, and requires to judge whether the port is open or not, and then a detection mode of protocol response is adopted, so that the model can be generally identified, and part of detection means can detect the firmware version. The Web feature layer is above the protocol response layer, and is required to judge whether ports such as 80, 8080, 443, 8000 and the like are open or not first, then judge whether to run Web services or not, and detect features such as feature URL, page content, SSL certificate and the like on the basis.
In the automatic detection process, the invention can change the selection of the next detection scheme along with the increase of the detected information to improve the recognition precision and efficiency, and can carry out fine-granularity, high-efficiency and automatic device fingerprint recognition on the device by combining the characteristics of three detection surfaces.
As shown in fig. 2, the present invention further provides a feedback-based system for generating an automatic detection scheme of an internet of things device, which includes:
the detection knowledge base module 201 is configured to detect a multidimensional fingerprint, and includes detecting an open port list, detecting responses of different protocols, and detecting characteristics of a Web terminal;
A data processing module 202, configured to process response data of the target device, where the processed data includes port data, protocol response data, and Web feature data;
The probe scheduling module 203 is configured to map the status to the action of sending the probe packet, and find an optimal probe policy, so as to maximize the jackpot.
In a specific application example, the invention further comprises a pre-established multi-dimensional equipment fingerprint library, wherein the multi-dimensional equipment fingerprint library at least comprises equipment manufacturer information, equipment model information and equipment firmware version information.
The following example is given as an example of a 3Com-Switch 4210G-Release 2202P18 model of internet of things device:
As shown in fig. 1, S101 first determines vendor information of a device by detecting whether a port layer part feature port of the device is open, where the open ports are ssh_22, https_443, http_80, TELENT _23, and snmp_161, and generates an available action set a valid = { SSH, HTTPS, HTTP, TELNET, SNMP } as a detection basis of two subsequent layers, and updates S brand in a state set in the identification process, and if a device vendor cannot be identified, the state is not changed.
S102, inputting the initial state of the port layer detection and the open port information into a scheduling engine, and selecting a next detection means according to the priorities of the open port and the protocol detection. According to the scheduling policy pi θ (a|s), the protocol port with the highest priority, snmp_161, is selected.
S103, processing the response data to obtain the type information of Switch 4210G and the firmware version information of Release 2202P18, updating the identification state to S m&v, and calculating the immediate rewards value for taking the detection action to be 150.
And S104, judging that the fingerprint granularity requirement is not met, and feeding back the updated state to the scheduling engine. And circularly detecting, monitoring and judging, selecting a protocol port with highest priority, namely TELNET_23, according to a scheduling strategy pi θ (a|s) and a current identification state S m&v, processing response data to obtain '3 Com' manufacturer information, updating the identification state as S all, and ending the detection process.
The above is only a preferred embodiment of the present invention, and the protection scope of the present invention is not limited to the above examples, and all technical solutions belonging to the concept of the present invention belong to the protection scope of the present invention. It should be noted that modifications and adaptations to the invention without departing from the principles thereof are intended to be within the scope of the invention as set forth in the following claims.
Claims (8)
1. The automatic detection scheme generation method for the Internet of things equipment based on feedback is characterized by comprising the following steps of:
Step S101: dividing the equipment detection surface into three layers: a port layer, a protocol response layer and a Web feature layer; the port layer refers to an open port of an operating system of the Internet of things device, and is associated with a communication protocol of a host and a specific type of service; the protocol response layer refers to the protocol response characteristics of a system or an application component, the different protocol responses contain different amounts of information, and most of the protocol responses do not contain complete information about equipment fingerprints; the Web feature layer refers to URL and page content features of Web application, scans feature ports by using a layering method, detects an open port list of equipment, provides an initial state of equipment identification, outputs the open port list, and generates an available detection action set And an initial detection state;
Step S102: state of the state Action mapped to sending probe packet, one probe action/>, is selected according to the current stateExecuting;
Step S103: processing target response data and updating recognition state Obtain the reward value/>, of the actionThe reward value is back propagated, and the scheduling strategy/>, is updated; Wherein, scheduling policy/>Is a strategy for selecting optimal actions according to the current state by selecting the strategy/>Iterative calculation is carried out until the expected maximum accumulated return is obtained, and the parameters of the optimal strategy can be obtained；
Step S104: judging whether the identification target is reached; if yes, ending the identification process, otherwise returning to the step S103 to continue selecting the next detection action;
step S105: the detection, monitoring and judgment are carried out circularly until the identification target is reached or the available detection means are available Exhausting; an optimal probe sequence is formed.
2. The method for generating the automatic detection scheme of the internet of things equipment based on feedback according to claim 1, wherein a multi-dimensional equipment fingerprint library is established in advance; the multi-dimensional device fingerprint library at least comprises device manufacturer information, device model information and device firmware version information.
3. The method for generating the automatic detection scheme of the internet of things equipment based on feedback according to claim 2, wherein the identification state set is establishedThe identification state set/>Includes/>{/>,/>,/>,/>,/>,/>,,/>-A }; wherein/>Indicating that no device information is recognized,/>、/>、/>Respectively represent information indicating only the manufacturer of the device, the model of the device and the version of the firmware of the device,/>,/>,/>Respectively represent and identify two kinds of information of equipment manufacturer and model, equipment manufacturer and firmware version, equipment model and firmware version,/>Indicating that all information of equipment manufacturer, model and firmware version is identified.
4. The method for generating the automatic detection scheme of the internet of things equipment based on feedback according to claim 2, wherein an action set is establishedThe action set/>Including various detection means/>。
5. The method for generating the automatic detection scheme of the internet of things equipment based on feedback according to claim 2, wherein the invalid action is prevented from being repeatedly generated in a large discrete action space by adopting an invalid action mask.
6. The method for generating the automatic detection scheme of the internet of things equipment based on feedback according to claim 2, wherein a reward set is established, and rewards are generatedRepresenting the instantaneous prize value provided by the device identification status change after transmission of the protocol probe packet, determined by the amount of device information acquired by the probe action.
7. A feedback-based system for generating an automatic detection scheme for an internet of things device, configured to perform the method of any one of claims 1 to 6, comprising:
The detection knowledge base module (201) is used for detecting multidimensional fingerprints, and comprises detecting an open port list, detecting different protocol responses and detecting Web end characteristics;
a data processing module (202) for processing response data of the target device, the processed data including port data, protocol response data, and Web feature data;
A probe scheduling module (203) for mapping the status to the action of sending probe packets, finding an optimal probe strategy, thereby maximizing the jackpot.
8. The system for generating the automatic detection scheme of the internet of things equipment based on feedback according to claim 7, wherein the system comprises a pre-established multi-dimensional equipment fingerprint library, and the multi-dimensional equipment fingerprint library at least comprises equipment manufacturer information, equipment model information and equipment firmware version information.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210910770.4A CN115396157B (en) | 2022-07-29 | 2022-07-29 | Automatic detection scheme generation method and system for Internet of things equipment based on feedback |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210910770.4A CN115396157B (en) | 2022-07-29 | 2022-07-29 | Automatic detection scheme generation method and system for Internet of things equipment based on feedback |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN115396157A CN115396157A (en) | 2022-11-25 |
| CN115396157B true CN115396157B (en) | 2024-06-04 |
Family
ID=84119401
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202210910770.4A Active CN115396157B (en) | 2022-07-29 | 2022-07-29 | Automatic detection scheme generation method and system for Internet of things equipment based on feedback |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN115396157B (en) |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109547294A (en) * | 2018-12-27 | 2019-03-29 | 中国人民解放军国防科技大学 | Networking equipment model detection method and device based on firmware analysis |
| CN111695690A (en) * | 2020-07-30 | 2020-09-22 | 航天欧华信息技术有限公司 | Multi-agent confrontation decision-making method based on cooperative reinforcement learning and transfer learning |
| CN112348285A (en) * | 2020-11-27 | 2021-02-09 | 中国科学院空天信息创新研究院 | Crowd evacuation simulation method in dynamic environment based on deep reinforcement learning |
| CN112702405A (en) * | 2020-12-18 | 2021-04-23 | 太原理工大学 | Internet of things equipment identification method based on multi-protocol detection |
Family Cites Families (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US10862756B2 (en) * | 2018-03-22 | 2020-12-08 | Citrix Systems, Inc. | Systems and methods for inventory discovery in a network |
-
2022
- 2022-07-29 CN CN202210910770.4A patent/CN115396157B/en active Active
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109547294A (en) * | 2018-12-27 | 2019-03-29 | 中国人民解放军国防科技大学 | Networking equipment model detection method and device based on firmware analysis |
| CN111695690A (en) * | 2020-07-30 | 2020-09-22 | 航天欧华信息技术有限公司 | Multi-agent confrontation decision-making method based on cooperative reinforcement learning and transfer learning |
| CN112348285A (en) * | 2020-11-27 | 2021-02-09 | 中国科学院空天信息创新研究院 | Crowd evacuation simulation method in dynamic environment based on deep reinforcement learning |
| CN112702405A (en) * | 2020-12-18 | 2021-04-23 | 太原理工大学 | Internet of things equipment identification method based on multi-protocol detection |
Non-Patent Citations (3)
| Title |
|---|
| Vulnerability Detection in IoT Firmware: A Survey;Wei Xie;《2017 IEEE 23rd International Conference on Parallel and Distributed Systems (ICPADS)》;20180531;全文 * |
| 一种基于二分搜索的网络拓扑探测方法;彭伟;《计算机应用研究》;20111115;全文 * |
| 非授权局域网拓扑探测系统的设计与实现;胡华平;吕曾望;刘波;王璞;;计算机工程与科学;20061128(第11期);全文 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN115396157A (en) | 2022-11-25 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| WO2021258348A1 (en) | Abnormal flow detection method and system and computer storage medium | |
| CN107181724B (en) | Identification method and system of cooperative flow and server using method | |
| CN111191767B (en) | Vectorization-based malicious traffic attack type judging method | |
| CN112702405A (en) | Internet of things equipment identification method based on multi-protocol detection | |
| CN112597477A (en) | Information processing method combining cloud computing and intelligent device interaction and cloud server | |
| CN109783459A (en) | The method, apparatus and computer readable storage medium of data are extracted from log | |
| WO2023207013A1 (en) | Graph embedding-based relational graph key personnel analysis method and system | |
| CN117041019A (en) | Log analysis method, device and storage medium of content delivery network CDN | |
| CN113726545A (en) | Network traffic generation method and device for generating countermeasure network based on knowledge enhancement | |
| CN112860676A (en) | Data cleaning method applied to big data mining and business analysis and cloud server | |
| CN110428836A (en) | Internet of things equipment control method, information forwarding device and Internet of Things server | |
| CN115396157B (en) | Automatic detection scheme generation method and system for Internet of things equipment based on feedback | |
| Lu et al. | Federated learning with non-iid data: A survey | |
| CN112291226A (en) | Method and device for detecting abnormality of network traffic | |
| CN116956130A (en) | Intelligent data processing method and system based on associated feature carding model | |
| CN116545871A (en) | Multi-mode network traffic prediction method, device and medium | |
| CN113391992A (en) | Test data generation method and device, storage medium and electronic equipment | |
| CN114611587A (en) | Knowledge and data hybrid driven industrial data alignment method | |
| CN114900835A (en) | Malicious traffic intelligent detection method and device and storage medium | |
| CN113726809B (en) | Internet of things equipment identification method based on flow data | |
| CN117493821B (en) | Method and system for monitoring environment of micro-module machine room | |
| CN102088358B (en) | Method and system for acquiring performance data object | |
| CN117221131B (en) | Internet of things communication method, system, computer equipment and storage medium | |
| CN117478685B (en) | Group control device identification method, device, equipment and readable storage medium | |
| CN117666448B (en) | Energy saving method, device, equipment and medium based on Internet of things energy consumption prediction |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |