Journal of Information Security Reserach ›› 2021, Vol. 7 ›› Issue (6): 543-549.

Previous Articles     Next Articles

Real-time automatic detection and recognition of Internet of Things equipment based on flow fingerprint

  

  • Online:2021-06-10 Published:2021-06-10

一种基于流量指纹的物联网设备实时自动检测及识别

徐超* 王纪军 吴小虎 张明远    

  1. (江苏电力信息技术有限公司,南京,江苏,210009)
  • 通讯作者: 徐超 本科, 高级工程师, 主要研究方向为网络空间安全 dayangxx@163.com
  • 作者简介:徐超 本科, 高级工程师, 主要研究方向为网络空间安全 dayangxx@163.com 王纪军 研究生, 高级工程师, 主要研究方向为信息架构和安全 wjjdlxx@163.com 吴小虎 本科, 高级工程师, 主要研究方向为网络空间安全wxhdlxx@163.com 张明远 本科, 工程师, 主要研究方向为网络空间安全zmydlxx@163.com

Abstract: In recent years, with the rapid development of Internet of Things (IoT) technology, a large number of Internet of Things devices have emerged in the cyberspace, such as network printers, network cameras and routers. However, the network security situation is getting worse.  Large-scale network attacks initiated by terminal devices connected to the Internet frequently occur, causing a series of adverse effects, such as information leakage and personnel property damage.  Establishing a fingerprint generation system for IoT devices to accurately identify device types is of great significance to the unified security control of the IoT. We propose a real-time automatic detection and recognition solution for IoT devices based on traffic fingerprints. This solution contains two main modules, including automatic detection and fingerprint recognition.  First, passive listening is used to collect messages sent by different IoT devices. Based on the differences in the header fields of different devices, a series of multi-classification algorithms are used to identify the device type. Simulation experiments show that the scheme can achieve an average prediction accuracy of 93.75%.

Key words: Internet of Things, Device Type Identification, Device Fingerprinting, Network Security, Security , Control

摘要: 近年来,随着物联网(IoT)技术的飞速发展,网络空间中涌现了大量的物联网设备,例如网络打印机,网络摄像头和路由器。但是,网络安全状况越来越严重。由连接到Internet的终端设备发起的大规模网络攻击频繁发生,造成一系列不利影响,例如信息泄漏和人员财产损失。建立一套用于物联网设备的指纹生成系统,以准确识别设备类型,对于物联网的统一安全控制具有重要意义。我们提出了一种基于流量指纹的物联网设备实时自动检测及识别方案,该方案包含两个主要模块,包括自动检测和指纹识别。首先通过被动侦听来收集由不同的物联网设备发送的消息。基于不同设备的标头字段的差异,使用一系列多分类算法来识别设备类型。仿真实验表明,该方案可以达到93.75%的平均预测精度。

关键词: 物联网, 设备类型标识, 设备指纹, 网络安全, 安全控制