A real-time host identification method based on distributed analysis of application traffic

Abstract

The invention provides a host real-time identification method based on distributed analysis of application traffic. The method of the invention comprises the following steps: step S1, analyzing and processing a distributed traffic message; step S2, generating an equipment fingerprint; and step S3, performing real-time identification of a host. The host real-time identification method based on the distributed analysis of the application traffic provided by the invention uses a distributed computing platform to identify and extract a host operating system and software information for high-speed network environment by analyzing the host traffic, generates the equipment fingerprint, and ultimately realizes the real-time identification of the host by using a machine learning algorithm.

Description

Technical field: [0001] The invention relates to a real-time identification method of a host based on distributed analysis of application flow, and belongs to the technical field of host identification. Background technique: [0002] With the rapid development of network technology, the Internet is rapidly integrated into every aspect of people's lives. However, while the Internet facilitates people's lives, it has also become a hotbed of cybercrime, and various cybercrime incidents occur frequently. As a line of defense for maintaining network security, network supervision undertakes the task of monitoring and controlling various cybercrime incidents, and maintains network security by punishing cybercriminal subjects. As a key link in network supervision, host identification plays a vital role in it. This patent defines the continuous network access of the host for a period of time as a network session of the host. The change of the IP address of the host or the interrupt...

AI Technical Summary

Problems solved by technology

However, the host identification technology based on physical signals is weak and cannot achieve a good recognition rate in large-scale networks, while the host identification technology based on protocol stack parameters has insufficient recognition granularity and cannot directly identify hosts.

At the same time, in the face of a high-speed network environment, traditional centralized programs cannot provide real-time computing capabilities, nor can they guarantee system reliability

Images