Abstract:

Current network device identification methods based on hardware fingerprints are not efficient in collecting and extracting features, and device classification methods based on traffic characteristics only consider existing device types and cannot detect abnormal devices. To address these problems, this study proposes a method that extracts the processing time-delay feature of network device based on Global Navigation Satellite System (GNSS) high-precision timing technology. A Bayesian convolutional autoencoder model, called BCNN-AE, is constructed to efficiently identify known types and detect unknown types: the model includes feature extraction, feature reconstruction, and composite prediction modules. First, the proposed method uses GNSS high-precision timing technology to achieve nanosecond-level measurement of network traffic processing time-delays and constructs a device time-delay distribution feature vector. Next, the feature extraction module uses Bayesian convolution to extract time-delay distribution features, and the feature reconstruction module uses an Autoencoder (AE) to learn a compressed reconstruction representation of the time-delay vector. Finally, the composite prediction module makes a comprehensive judgment based on uncertainty and reconstruction error thresholds to identify known types and detect unknown/abnormal device types. Experiments conducted on a dataset collected in a laboratory simulation environment and a public dataset Aalto show that the use of device time-delays can accurately represent different network device types. The results show that the proposed method achieves higher recognition accuracy than that of the baseline model and can effectively detect unknown/abnormal device types.

Key words: device identification and detection, device time-delay, Bayesian convolutional network, Autoencoder (AE), Global Navigation Satellite System (GNSS) timing technology

摘要：

针对目前基于硬件指纹的网络设备识别方法采集和提取特征效率低下以及基于流量特征的设备分类方法仅考虑已有类型而不能对异常设备进行检测的问题, 提出基于设备时延和混合深度学习模型的网络设备检测方法。该方法基于全球导航卫星系统(GNSS)高精度授时技术提取纳秒级精度网络设备处理时延特征, 构建贝叶斯卷积自动编码器模型BCNN-AE, 包含特征提取模块、特征重构模块和复合预测模块, 实现了对于已知网络设备类型的识别和未知网络设备类型的检测, 具体为: 首先采用GNSS高精度授时技术实现对于网络流量处理时延的纳秒级精度测量, 并构建设备时延分布特征向量; 接着特征提取模块使用贝叶斯卷积提取时延分布特征信息, 特征重构模块使用自动编码器(AE)学习时延特征向量的压缩重构表示; 最后复合预测模块基于不确定性阈值和重构误差阈值进行综合判断, 实现已知类型识别和未知/异常设备类型检测。在实验室仿真环境下采集的数据集和公开数据集Aalto上的实验结果表明, 采用设备时延能够实现不同网络设备类型的准确表示, 并且BCNN-AE模型除了能取得比基线模型更高的识别准确率之外, 还能够实现对于未知/异常设备类型的检测。

关键词: 设备识别与检测, 设备时延, 贝叶斯卷积网络, 自动编码器, 全球导航卫星系统授时技术