Abnormal network access detection of power Internet of Things terminal layer equipment based on equipment portrait

Abstract

Abstract In the environment of the power Internet of Things, equipment network security is mainly analyzed through the physical signal characteristics of the equipment or a single flow characteristic, so as to realize the equipment network abnormality detection. Therefore, a method for detecting network abnormalities of power Internet of Things terminal equipment based on device fingerprints is proposed. Aiming at the problem of incomplete detection methods, a multi-dimensional matching device fingerprint model is established. Firstly, the basic information of the device is collected, such as IP, MAC, etc.; then the network traffic information of the device is analyzed to extract the characteristics of network traffic; then, the frequency of keyword and keyword group of service protocol is counted. The device fingerprint model is established by using the traffic and service characteristics. When the network anomaly occurs, the device fingerprint model can be found effectively. The experimental results show that the device fingerprint model can detect the abnormal behavior of the device.