Research Of Identification Technology Of Cyberspace Device

With the rapid development of big data and Io T(Internet of Things), more and more terminal devices have access into the cyberspace. The new Internet environment constituted by traditional servers, routers and digital video cameras, Vo IP phones, network printers, smart switches, and other type of terminal devices. By precisely identifying the cyberspace devices and associating the device information with vulnerabilities, can clearly locate the vulnerabilities of cyberspace, and can reflect the area of influence, and also can provide strong support for vulnerability fix. Therefore, the identification technology of cyberspace device has great significance on cyber security assessment and vulnerability warning.In this dissertation, the research work mainly includes the following:1.Since the traditional web service identification methods are unfavorable to expand to other terminal devices, a kind of proactive identification framework with double factors for cyberspace terminal device was proposed. The framework analyzed the network fingerprint characteristics of terminal device from perspective of banner and web fingerprint. Firstly, banner information of web service in terminal device was mined from “Server” field and “WWW-Authenticate” field in HTTP packet header and HTML source code; Secondly, web fingerprint of terminal device was extracted from image files and text files; Meanwhile, analyzed the effectiveness as well as advantages and disadvantages according to the specific cases. The results show that the framework solves the problems of ex tracting banner information simply and being limited by the differences of server software implementation in traditional identification methods.2.Since the traditional web fingerprinting methods are limited to identify mainstream web server software, a kind of cyberspace device identification model based on K-means with cosine distance measure was proposed. Firstly, identification model was designed and verification method was determined; Secondly, the header fields and the status code of HTTP response were selected as characteristics of terminal device, then the characteristics were transformed into 32-dimensional feature vector by feature extraction and vectorization; Thirdly, cosine distance function was selected as similarity measuring function in K-means. Finally, experiment algorithm process was designed according to the identification model, and the experiment for unlabeled samples and labeled samples was implemented. The result show that the identification model can identify many kinds of terminal device include web camera, intelligent switch, and so on, and has high accuracy rate and low omission rate.