CN117375845A - Network asset certificate identification method and device - Google Patents

Abstract

The invention discloses a network asset certificate identification method and a device, wherein the method comprises the following steps: acquiring certificate information of a network asset, wherein the certificate information of the network asset forms an asset certificate library; processing the certificate information of the network asset to obtain the characteristic information of the network asset, wherein the characteristic information of the network asset forms a characteristic library; training a preset network asset certificate identification model by utilizing the characteristic information of the network asset to obtain a training network asset certificate identification model; and acquiring the certificate information of the network asset to be identified, and processing the certificate information of the network asset to be identified by utilizing the training network asset certificate identification model to obtain a network asset certificate identification result. The invention combines two similarity measurement methods, and performs similarity comparison from the two aspects of the content and the structure of the certificate; meanwhile, by combining an autonomous learning feedback mechanism, a certificate similarity measurement and recognition query method with high automation degree and higher accuracy are explored.

Description

A method and device for identifying network asset certificates

Technical field

The present invention is in the technical field of network asset identification, and in particular relates to a method and device for identifying network asset certificates.

Background technique

A digital certificate refers to a digital certification that marks the identity information of communicating parties in Internet communications. It can be used to identify and verify the identities of communicating parties. Certificate information usually includes the following information items: version number, serial number, signature algorithm, issuer, validity period, subject, subject public key, subject public key algorithm, signature value, etc. The version number is the version information of the certificate. Each certificate has a unique certificate serial number. The signature algorithm is the signature algorithm used in the certification process. The issuer is the name of the issuing authority of the certificate. The validity period marks the validity time of the certificate. The subject is The name of the certificate owner, the subject public key is the public key of the certificate owner, and the signature value is the signature of the certificate issuer.

Digital certificates are used to prove the identity of network asset actors in Internet information activities. They are also electronic data that can be used to verify the confidentiality and integrity of information sent by network assets. Implementing similarity measurement on certificates of network assets reasonably and accurately can effectively classify, identify and query network assets.

There is currently no relevant research directly on certificate similarity measurement and identification. Considering that the structure of a certificate includes several information items (version number, serial number, signature algorithm, issuer, etc.) and the value content corresponding to each information item, it can be Refer to methods for measuring text similarity in text classification. Most algorithms in text classification, such as KNN method, support vector machine method, K-means method, etc., need to calculate similarity to achieve the purpose of classification. Commonly used traditional text similarity measurement methods include cosine similarity, Jaccard similarity coefficient, Euclidean distance, Manhattan distance, Chebyshev distance, Mahalanobis distance, etc.

Existing text similarity measurement methods have single functions and cannot be directly applied to certificate similarity measurement. Given that the structure of a certificate includes several information items (version number, serial number, signature algorithm, issuer, etc.) and the value content corresponding to each information item, it is possible to consider combining the two similarity measurement methods to calculate the content of the certificate from the content of the certificate. Conduct similarity comparisons in both aspects and structure; at the same time, combined with the autonomous learning feedback mechanism, explore certificate similarity measurement and identification query methods with a high degree of automation and higher accuracy.

Contents of the invention

The technical problem to be solved by the present invention is to provide a method and device for identifying network asset certificates, which can achieve the purpose of identifying network assets by measuring the similarity of certificates of different network assets, so as to make up for the existing technology's impact on the network. The problem of low automation and low accuracy in asset identification. In order to solve the above technical problems, the first aspect of the embodiment of the present invention discloses a method for identifying network asset certificates. The method includes:

S1. Obtain the certificate information of the network assets. The certificate information of the network assets constitutes the asset certificate library;

S2, process the certificate information of the network asset to obtain the characteristic information of the network asset, and the characteristic information of the network asset constitutes a feature library;

S3, use the characteristic information of the network asset to train the preset network asset certificate recognition model to obtain a trained network asset certificate recognition model;

S4: Obtain the certificate information of the network asset to be identified, use the trained network asset certificate recognition model to process the certificate information of the network asset to be identified, and obtain the network asset certificate recognition result.

As an optional implementation manner, in the first aspect of the embodiment of the present invention, processing the certificate information of the network asset to obtain characteristic information of the network asset includes:

S21, perform structural similarity calculation on the certificate information of the network asset to obtain structural similarity information;

S22, perform content similarity calculation on the certificate information of the network asset to obtain content similarity information;

S23: Fusion of the structural similarity information and the content similarity information to obtain characteristic information of the network asset.

As an optional implementation manner, in the first aspect of the embodiment of the present invention, the structural similarity calculation is performed on the certificate information of the network asset to obtain the structural similarity information, including:

S211. Obtain the certificate information of network asset A. The number of information items of network asset A to be processed is m;

S212. Obtain the certificate information of network asset B. The number of information items of network asset B is n;

S213. Process the certificate information of the network asset A and the certificate information of the network asset B to obtain the number x of information items contained in both the network asset A and the network asset B;

S214, use the structural similarity calculation model to process the number of information items of the network asset A to be m, the number of information items of the network asset B to be n, and the number of information items x, to obtain structural similarity information;

The structural similarity calculation model is:

Among them, str(A,B) is the structural similarity information.

As an optional implementation manner, in the first aspect of the embodiment of the present invention, the content similarity calculation is performed on the certificate information of the network asset to obtain the content similarity information, including:

S221, process the certificate information of network asset A, and obtain the formal representation of the certificate information item of network asset A, content _A = (a ₁ , a ₂ ,..., a _x );

S222, process the certificate information of network asset B, and obtain the formal representation of the certificate information item of network asset B, content _B = (b ₁ , b ₂ ,..., b _x );

S223. Use the content similarity information calculation model to formalize the certificate information items of the network asset A as content _A = (a ₁ , a ₂ ,..., a _x ) and the certificate information items of the network asset B. Indicates processing to obtain content similarity information;

The content similarity calculation model is:

Among them, con(A,B) is content similarity information,

As an optional implementation manner, in the first aspect of the embodiment of the present invention, the fusion of the structural similarity information and the content similarity information to obtain characteristic information of network assets includes:

Using a similarity information fusion model, the structural similarity information and the content similarity information are fused to obtain characteristic information of network assets;

The similarity information fusion model is:

Among them, total(A,B) is the characteristic information of network assets, str(A,B) is the structural similarity information, and con(A,B) is the content similarity information.

As an optional implementation manner, in the first aspect of the embodiment of the present invention, the characteristic information of the network asset is used to train a preset network asset certificate identification model to obtain a trained network asset certificate identification model, including :

S31. Divide the characteristic information of the network assets to obtain labeled certificate samples and unlabeled certificate samples;

S32. Use the unlabeled certificate sample as a training sample to train a preset network asset certificate recognition model to obtain a trained network asset certificate recognition model.

As an optional implementation manner, in the first aspect of the embodiment of the present invention, the certificate information of the network asset to be identified is obtained, and the certificate information of the network asset to be identified is used to train the network asset certificate identification model. Process and obtain the network asset certificate identification results, including:

S41, obtain the certificate information of the network asset to be identified;

S42: Process the certificate information of the network asset to be identified to obtain the characteristic information of the network asset to be identified;

S43: Obtain the first identification result based on the characteristic information of the network asset to be identified;

S44: According to the first identification result, use the trained network asset certificate identification model to process the characteristic information of the network asset to be identified to obtain a network asset certificate identification result.

As an optional implementation, in the first aspect of the embodiment of the present invention, the method further includes:

Obtain the certificate information of the network asset to be identified;

Identify the certificate information of the network asset to be identified and obtain the first identification result;

According to the first identification result, mark network asset certificates that are different from the first identification result to obtain a positive example certificate and a counterexample certificate;

Add the counterexample certificate to the unlabeled certificate sample to form the optimal training sample set;

The optimal training sample set is used to train the preset network asset certificate recognition model to obtain an optimized network asset certificate recognition model.

The second aspect of the embodiment of the present invention discloses a network asset certificate identification device. The device includes:

A data acquisition module, used to obtain certificate information of network assets. The certificate information of network assets constitutes an asset certificate library;

A feature extraction module, used to process the certificate information of the network asset to obtain the characteristic information of the network asset, and the characteristic information of the network asset constitutes a feature library;

A model training module, configured to use the characteristic information of the network asset to train a preset network asset certificate recognition model to obtain a trained network asset certificate recognition model;

The certificate identification module is used to obtain the certificate information of the network asset to be identified, and use the training network asset certificate identification model to process the certificate information of the network asset to be identified to obtain the network asset certificate identification result.

As an optional implementation manner, in the second aspect of the embodiment of the present invention, processing the certificate information of the network asset to obtain characteristic information of the network asset includes:

S21, perform structural similarity calculation on the certificate information of the network asset to obtain structural similarity information;

S22, perform content similarity calculation on the certificate information of the network asset to obtain content similarity information;

S23: Fusion of the structural similarity information and the content similarity information to obtain characteristic information of the network asset.

As an optional implementation manner, in the second aspect of the embodiment of the present invention, the structural similarity calculation is performed on the certificate information of the network asset to obtain the structural similarity information, including:

S211. Obtain the certificate information of network asset A. The number of information items of network asset A to be processed is m;

S212. Obtain the certificate information of network asset B. The number of information items of network asset B is n;

S213. Process the certificate information of the network asset A and the certificate information of the network asset B to obtain the number x of information items contained in both the network asset A and the network asset B;

S214, use the structural similarity calculation model to process the number of information items of the network asset A to be m, the number of information items of the network asset B to be n, and the number of information items x, to obtain structural similarity information;

The structural similarity calculation model is:

Among them, str(A,B) is the structural similarity information.

As an optional implementation manner, in the second aspect of the embodiment of the present invention, the content similarity calculation is performed on the certificate information of the network asset to obtain the content similarity information, including:

S221, process the certificate information of network asset A, and obtain the formal representation of the certificate information item of network asset A, content _A = (a ₁ , a ₂ ,..., a _x );

S222, process the certificate information of network asset B, and obtain the formal representation of the certificate information item of network asset B, content _B = (b ₁ , b ₂ ,..., b _x );

S223. Use the content similarity information calculation model to formalize the certificate information items of the network asset A as content _A = (a ₁ , a ₂ ,..., a _x ) and the certificate information items of the network asset B. Indicates processing to obtain content similarity information;

The content similarity calculation model is:

Among them, con(A,B) is content similarity information,

As an optional implementation manner, in the second aspect of the embodiment of the present invention, the fusion of the structural similarity information and the content similarity information to obtain characteristic information of network assets includes:

Using a similarity information fusion model, the structural similarity information and the content similarity information are fused to obtain characteristic information of network assets;

The similarity information fusion model is:

Among them, total(A,B) is the characteristic information of the network asset, str(A,B) is the structural similarity information, and con(A,B) is the content similarity information.

As an optional implementation manner, in the second aspect of the embodiment of the present invention, the characteristic information of the network asset is used to train a preset network asset certificate identification model to obtain a trained network asset certificate identification model, including :

S31. Divide the characteristic information of the network assets to obtain labeled certificate samples and unlabeled certificate samples;

S32. Use the unlabeled certificate sample as a training sample to train a preset network asset certificate recognition model to obtain a trained network asset certificate recognition model.

As an optional implementation manner, in the second aspect of the embodiment of the present invention, the certificate information of the network asset to be identified is obtained, and the certificate information of the network asset to be identified is used to train the network asset certificate recognition model. Process and obtain the network asset certificate identification results, including:

S41, obtain the certificate information of the network asset to be identified;

S42: Process the certificate information of the network asset to be identified to obtain the characteristic information of the network asset to be identified;

S43: Obtain the first identification result based on the characteristic information of the network asset to be identified;

S44: According to the first identification result, use the trained network asset certificate identification model to process the characteristic information of the network asset to be identified to obtain a network asset certificate identification result.

As an optional implementation, in the second aspect of the embodiment of the present invention, the method further includes:

Obtain the certificate information of the network asset to be identified;

Identify the certificate information of the network asset to be identified and obtain the first identification result;

According to the first identification result, mark network asset certificates that are different from the first identification result to obtain a positive example certificate and a counterexample certificate;

Add the counterexample certificate to the unlabeled certificate sample to form the optimal training sample set;

The optimal training sample set is used to train the preset network asset certificate recognition model to obtain an optimized network asset certificate recognition model.

The third aspect of the present invention discloses another network asset certificate identification device. The device includes:

Memory that stores executable program code;

a processor coupled to said memory;

The processor calls the executable program code stored in the memory to execute some or all of the steps in the network asset certificate identification method disclosed in the first aspect of the embodiment of the present invention.

Compared with the prior art, the embodiments of the present invention have the following beneficial effects:

The present invention provides a method and device for identifying network asset certificates. By measuring the similarity of certificate samples in terms of structural similarity and content similarity, the structural features, content features and comprehensive features of the certificate are then obtained; a support vector machine is used model, and starting from how to select the most appropriate certificate as a training sample for the support vector machine, introduce the idea of autonomous learning, build a support vector machine based on active learning feedback, and use unlabeled certificate samples as training samples to input into the support vector machine classifier For learning; in the process of continuous identification and query of user-unlabeled samples, for a large certificate database, it can avoid the limited number of user-labeled samples from affecting the classification effect of the support vector machine classifier, or the cost of a large amount of labeling work The processing time increases the calculation amount of the classifier; at the same time, it can mark the certificates with the greatest ambiguity and combine them with user-marked samples to form the optimal training sample set, thus reducing the calculation time, improving the classification query efficiency, and improving the quality of the recognition query results.

Description of the drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings needed to be used in the description of the embodiments will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present invention. For those of ordinary skill in the art, other drawings can also be obtained based on these drawings without exerting creative efforts.

Figure 1 is a schematic flow chart of a network asset certificate identification method disclosed in an embodiment of the present invention;

Figure 2 is a schematic flow chart of another network asset certificate identification method disclosed in an embodiment of the present invention;

Figure 3 is a schematic structural diagram of a network asset certificate identification and query system based on autonomous learning feedback disclosed in an embodiment of the present invention;

Figure 4 is a schematic diagram of sample labeling disclosed in the embodiment of the present invention;

Figure 5 is a schematic diagram of the active learning model disclosed in the embodiment of the present invention;

Figure 6 is a schematic structural diagram of a network asset certificate identification device disclosed in an embodiment of the present invention;

Figure 7 is a schematic structural diagram of another network asset certificate identification device disclosed in an embodiment of the present invention.

Detailed ways

In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only These are some embodiments of the present invention, rather than all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without making creative efforts fall within the scope of protection of the present invention.

The terms "first", "second", etc. in the description and claims of the present invention and the above-mentioned drawings are used to distinguish different objects, rather than describing a specific sequence. Furthermore, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusion. For example, a process, method, device, product or equipment that includes a series of steps or units is not limited to the listed steps or units, but optionally also includes unlisted steps or units, or optionally also includes Other steps or units inherent to such processes, methods, products or devices.

Reference herein to "an embodiment" means that a particular feature, structure or characteristic described in connection with the embodiment can be included in at least one embodiment of the invention. The appearances of this phrase in various places in the specification are not necessarily all referring to the same embodiment, nor are separate or alternative embodiments mutually exclusive of other embodiments. Those skilled in the art understand, both explicitly and implicitly, that the embodiments described herein may be combined with other embodiments.

The invention discloses a method and device for identifying network asset certificates, which can obtain certificate information of network assets. The certificate information of the network assets constitutes an asset certificate library; and the certificate information of the network assets is processed to obtain the characteristic information of the network assets. , the characteristic information of the network asset constitutes a feature library; use the characteristic information of the network asset to train the preset network asset certificate recognition model to obtain a trained network asset certificate recognition model; obtain the certificate information of the network asset to be identified, and use The training network asset certificate recognition model processes the certificate information of the network asset to be identified to obtain a network asset certificate recognition result. This invention combines two similarity measurement methods to conduct similarity comparisons from both the content and structure of the certificate; at the same time, it combines the independent learning feedback mechanism to explore certificate similarity measurement and identification with high automation and higher accuracy. Query method. Each is explained in detail below.

Embodiment 1

Please refer to Figure 1. Figure 1 is a schematic flow chart of a network asset certificate identification method disclosed in an embodiment of the present invention. Among them, the network asset certificate identification method described in Figure 1 is applied to the network asset certificate identification system, and is not limited in this embodiment of the present invention. As shown in Figure 1, the network asset certificate identification method can include the following operations:

S1. Obtain the certificate information of the network assets. The certificate information of the network assets constitutes the asset certificate library;

S2, process the certificate information of the network asset to obtain the characteristic information of the network asset, and the characteristic information of the network asset constitutes a feature library;

S3, use the characteristic information of the network asset to train the preset network asset certificate recognition model to obtain a trained network asset certificate recognition model;

S4: Obtain the certificate information of the network asset to be identified, use the trained network asset certificate recognition model to process the certificate information of the network asset to be identified, and obtain the network asset certificate recognition result.

The asset certificate library consists of the certificate information of network assets, including the following information items: version number, serial number, signature algorithm, issuer, validity period, subject, subject public key, subject public key algorithm, signature value, etc.;

Optionally, the certificate information of the network asset is processed to obtain the characteristic information of the network asset, including:

S21, perform structural similarity calculation on the certificate information of the network asset to obtain structural similarity information;

S22, perform content similarity calculation on the certificate information of the network asset to obtain content similarity information;

S23: Fusion of the structural similarity information and the content similarity information to obtain characteristic information of the network asset.

Optionally, perform structural similarity calculation on the certificate information of the network asset to obtain structural similarity information, including:

S211. Obtain the certificate information of network asset A. The number of information items of network asset A to be processed is m;

S212. Obtain the certificate information of network asset B. The number of information items of network asset B is n;

S213. Process the certificate information of the network asset A and the certificate information of the network asset B to obtain the number x of information items contained in both the network asset A and the network asset B;

S214, use the structural similarity calculation model to process the number of information items of the network asset A to be m, the number of information items of the network asset B to be n, and the number of information items x, to obtain structural similarity information;

The structural similarity calculation model is:

Among them, str(A,B) is the structural similarity information.

Optionally, the content similarity calculation is performed on the certificate information of the network asset to obtain the content similarity information, including:

S221, process the certificate information of network asset A, and obtain the formal representation of the certificate information item of network asset A, content _A = (a ₁ , a ₂ ,..., a _x );

S222, process the certificate information of network asset B, and obtain the formal representation of the certificate information item of network asset B, content _B = (b ₁ , b ₂ ,..., b _x );

S223. Use the content similarity information calculation model to formalize the certificate information items of the network asset A as content _A = (a ₁ , a ₂ ,..., a _x ) and the certificate information items of the network asset B. Indicates processing to obtain content similarity information;

The content similarity calculation model is:

Among them, con(A,B) is content similarity information,

Optionally, the structural similarity information and the content similarity information are fused to obtain characteristic information of the network asset, including:

Using a similarity information fusion model, the structural similarity information and the content similarity information are fused to obtain characteristic information of network assets;

The similarity information fusion model is:

Among them, total(A,B) is the characteristic information of the network asset, str(A,B) is the structural similarity information, and con(A,B) is the content similarity information.

Optionally, the characteristic information of the network asset is used to train a preset network asset certificate recognition model to obtain a trained network asset certificate recognition model, including:

S31. Divide the characteristic information of the network assets to obtain labeled certificate samples and unlabeled certificate samples;

The dividing method can be carried out according to the ratio of 3:7, which is not limited by the present invention.

S32. Use the unlabeled certificate sample as a training sample to train a preset network asset certificate recognition model to obtain a trained network asset certificate recognition model.

Optionally, obtaining the certificate information of the network asset to be identified, using the trained network asset certificate recognition model to process the certificate information of the network asset to be identified, and obtaining the network asset certificate recognition result, including:

S41, obtain the certificate information of the network asset to be identified;

S42: Process the certificate information of the network asset to be identified to obtain the characteristic information of the network asset to be identified;

S43: Obtain the first identification result based on the characteristic information of the network asset to be identified;

S44: According to the first identification result, use the trained network asset certificate identification model to process the characteristic information of the network asset to be identified to obtain a network asset certificate identification result.

Optionally, the method also includes:

Obtain the certificate information of the network asset to be identified;

Identify the certificate information of the network asset to be identified and obtain the first identification result;

According to the first identification result, mark network asset certificates that are different from the first identification result to obtain a positive example certificate and a counterexample certificate;

The user sets a threshold based on the first identification result, marks the positive and negative examples, and customizes the number. The user can perform a second query and identification to obtain the results.

Add the counterexample certificate to the unlabeled certificate sample to form the optimal training sample set;

The optimal training sample set is used to train the preset network asset certificate recognition model to obtain an optimized network asset certificate recognition model.

Optionally, after obtaining the structural similarity information and content similarity information, the following method can be used for feature fusion:

Project the structural similarity information X and content similarity information Y to one dimension for linear representation, corresponding to the projection vectors a and b respectively, then the projected feature matrix becomes:

X'＝a ^T X,Y'＝b ^T Y

Maximize the correlation coefficient between X' and Y', thereby obtaining the projection vectors a and b when the correlation coefficient is the largest. Right now:

The data is standardized before projection. The purpose of standardization is to make the mean of the data 0 and the variance 1. Under this condition, we can get:

cov( ^X ',Y')＝cov(a ^T X,b ^T Y ⁾ ＝E( ^{＜a T X,b T Y＞} )＝E(( ^{a T} E(XY ^T )b

D(X')＝D(a ^T X)＝a ^T E(XX ^T )a

D(Y')＝D(b ^T Y)＝b ^T E(YY ^T )b

Since X and Y have a standardized mean of 0, so

D(X)＝cov(X,X)＝E(XX ^T )

D(Y)＝cov(Y,Y)＝E(YY ^T )

cov(X,Y)＝E(XY ^T ),cov(Y,X)＝E(YX ^T )

Assume S _XX =cov(X,X), then the solution objective is transformed into:

The process of solving the above function is as follows:

Step3: Solve the singular values of M and obtain the largest singular value and its left and right singular vectors u, v.

Step4: The projection vectors a and b of X and Y are respectively:

Optionally, the preset network asset certificate identification model uses discrete wavelet decomposition to process the characteristic information of network assets. The characteristic information of network assets is decomposed into different frequency bands and its energy proportion is calculated. After normalization, principal component analysis is used to reduce the dimensionality of the features. The resulting feature vector set is used as the input of the least squares support vector machine. Then use the hybrid particle swarm algorithm to optimize the initial parameters of the least squares support vector machine to build a preset network asset certificate identification model. The hybrid particle swarm algorithm combines FSA (Fast Simulated Annealing) and PSO (Particle Swarm Optimization). The PSO algorithm is used to explore the global search area. When PSO searches for the overall optimal solution for the current iteration number, the FSA algorithm is used to find the PSO. Adjust the optimal position to obtain a new solution. Compare the new solution with the optimal solution obtained by the PSO algorithm. If the new solution is better than the optimal solution, the new solution will be regarded as the current optimal solution. Otherwise, the new solution will be accepted with a certain probability. untie. Through this combination, it avoids falling into the local optimal solution prematurely, further balances the relationship between global search and local search, and optimizes the efficiency and accuracy of the algorithm.

FSA algorithm process:

1) Starting from the initial solution, define the initial temperature T, the end temperature T _min and the cooling rate r;

2) At each temperature, use the Cauchy distribution to perturb the current solution and obtain a new solution;

3) For each new solution, calculate its objective function value or cost function value. If the new solution is better, accept the solution as the current solution; otherwise accept the solution with probability according to the Metropolis criterion.

4) Repeat steps 2) and 3) until the temperature drops to T _min . As the temperature decreases, the probability of accepting inferior solutions gradually decreases, and eventually only better solutions are accepted.

5) When the temperature drops to T _min , the algorithm ends and the optimal solution found is returned.

Embodiment 2

Please refer to Figure 2. Figure 2 is a schematic flow chart of another network asset certificate identification method disclosed in an embodiment of the present invention. Among them, the network asset certificate identification method described in Figure 2 is applied to the network asset certificate identification system, and is not limited in this embodiment of the present invention. As shown in Figure 2, the network asset certificate identification method may include the following operations:

(1) Obtain the certificate information of the network asset to be identified

(2) Use the certificate similarity measurement method to calculate the structural similarity and content similarity of the certificate through two aspects of structure and content quantification, and then obtain the structural characteristics, content characteristics and comprehensive characteristics of the certificate;

(3) Construct a support vector machine based on active learning feedback and optimize the training sample set;

(4) Use the above classifier model to measure the similarity of the asset certificates to be identified, identify network assets, and then establish a similar network asset library.

A network asset certificate identification and query system based on independent learning feedback. The specific ideas are as follows:

1) Overall structure

Retrieval feedback interface: including certificate query and result feedback. Mainly based on the method of independent learning training and certification feedback, through asset certificate similarity calculation, the characteristics of the network asset certificate to be identified and the network asset certificate library are compared, and different types of certificates are identified; and then the user is provided to query the selected sample certificate again. function.

Asset certificate library: known original asset certificate;

Feature database: a comprehensive feature database formed by structural features and content features;

2) Working principle

Through the certificate query module, the user selects the certificate that needs to be queried and identified, and the first identification query result is displayed through the system;

Users can mark positive and negative examples based on the results, and customize the number. They can perform secondary query and identification to obtain the results. Among them, the active learning feedback mechanism is used to classify certificates with greater ambiguity. Users can mark them as counterexample certificates and feedback the certificate marking results again;

Based on whether the relevant feedback results from the result feedback module meet the certificate recognition query expectations, the system execution times are decided until the recognition results have a certain accuracy and the operation is completed.

The schematic diagram of the network asset certificate identification and query system based on independent learning feedback is shown in Figure 3.

3) Implement the design

Certificate feature extraction

(1) Extract the information items of each network asset certificate sample and the value content of each information item;

Certificate information includes the following information items: version number, serial number, signature algorithm, issuer, validity period, subject, subject public key, subject public key algorithm, signature value, etc. The version number is the version information of the certificate. Each certificate has a unique certificate serial number. The signature algorithm is the signature algorithm used in the certification process. The issuer is the name of the issuing authority of the certificate. The validity period marks the validity time of the certificate. The subject is The name of the certificate owner, the subject public key is the public key of the certificate owner, and the signature value is the signature of the certificate issuer.

The information items of certificate information can be expressed in the form of vectors, and the certificate information of subject A can be formally expressed as

cert _A =(A ₁ ,A ₂ ,…,A _n ),

Among them, for i=1 to n, A _i respectively represents the version number, serial number, signature algorithm, issuer, validity period, subject, subject public key, subject public key algorithm, signature value, etc. of the certificate. Each certificate information item will have a corresponding value, which is called the content of the information item. For example, the version number can be V3, which is formally expressed as A ₁ =V3.

(2) Calculate the structural similarity between each network asset certificate sample and the known network asset certificate as the structural feature of the certificate;

Structural similarity refers to calculating the structural similarity between two certificate information, listing all certificate information items of the two certificates, and using the Jaccard similarity coefficient to calculate the structural similarity between the two certificate information. Assume that certificate A has m certificate information items, certificate B has n certificate information items, and both A and B contain x information items, then the structural similarity between certificate A and certificate B is expressed as

If two certificates contain the same name and number of information items, that is, m=n, and x=m=n, then the structural similarity of the two certificates is 1.

Calculate the content similarity between each network asset certificate sample and the known network asset certificate as the content feature of the certificate;

(3) Content similarity refers to calculating the similarity of the value contents of the same information items in two certificates, listing the certificate information items that exist in both certificates, measuring the similarity of the values of the information items, and using Euclidean distance Calculate the similarity of the value content of the same information item in two certificates. Assume that certificate A and certificate B both contain x information items such as version number, serial number, signature algorithm, issuer, validity period, subject, subject public key, subject public key algorithm, and signature value. Certificate A and certificate The value content of the same information item B can be formally expressed as content _A = (a ₁ , a ₂ ,..., a _x ), content _B = (b ₁ , b ₂ ,..., b _x ), and the calculation of the two certificates is the same The Euclidean distance between the value contents of information items is

The smaller the Euclidean distance, the greater the similarity between the two certificates; the larger the Euclidean distance, the smaller the similarity between the two certificates. Then the content similarity between certificate A and certificate B is

(4) Based on the structural characteristics and content characteristics of the certificate, calculate the comprehensive characteristics of the certificate sample;

According to the structural similarity and content similarity of certificate A and certificate B, the overall similarity between certificate A and certificate B is calculated as

Active learning feedback certificate recognition model construction:

(1)Certificate query

Network asset certificate identification and result display are mainly based on similarity measurement methods and certificate comprehensive features. Taking into account the certificates in the certificate library that are highly similar to the asset certificates to be detected, the system interface will plan the display area based on country, region, application, etc.

(2)Sample labeling

The labeled sample set is mainly formed based on the positive and negative example samples marked by the user, and is used as the input of the support vector machine for training, thereby ensuring the accuracy of the recognition query results.

Sample labeling is a process operation to realize the result feedback certificate identification query. The user considers the number of labels and labels relevant positive and negative certificate samples as needed. At the same time, combined with active learning, users can also label positive and negative examples of the recognition results at this stage to identify certificates with large ambiguities in query results. Figure 3 shows a schematic structural diagram of a network asset certificate identification and query system based on autonomous learning feedback disclosed in an embodiment of the present invention.

(3) Result feedback based on active learning

By adopting the active learning feedback mode, a large number of unlabeled user certificates are used as training samples and input into the support vector machine classifier for learning, and certificate results with greater ambiguity can be obtained; users can determine whether to mark them as positive certificates by themselves. Or counterexample certificate, update the labeled sample set, and then gradually form the optimal training sample set to improve the accuracy of recognition query. Figure 4 is a schematic diagram of sample labeling disclosed in the embodiment of the present invention. Figure 5 is a schematic diagram of an active learning model disclosed in an embodiment of the present invention.

The support vector machine model based on active learning has loop execution characteristics. The model is described as S = (A, H, U, M, D), where A represents the support vector machine classifier, H is the query function, and U is the user terminal. M is the labeled sample set, and D is the unlabeled sample set.

Model execution includes:

(1) Combined with the similarity measurement method, obtain the certificate structural features, content features and comprehensive features, and output the first certificate identification query results;

(2) Based on the first output result, the user selects and labels positive samples and negative samples to obtain training samples;

(3) Construct a training sample set and learn the training samples, and perform identification query again based on the classifier;

(4) In the above learning feedback results, automatically calculate and output a certificate set that has a large ambiguity with the user-selected sample recognition query results. The user can select and label the positive or negative example certificates among the ambiguous certificates, and add the labeled sample set;

(5) By looping this process, the optimal classification and recognition results can be obtained through calculations with a smaller sample set;

(6) Calculate the similarity distance between the certificate to be recognized and each certificate in the certificate database, sort according to similarity, and obtain the certificate recognition results.

Embodiment 3

Please refer to FIG. 6 , which is a schematic structural diagram of a network asset certificate identification device disclosed in an embodiment of the present invention. Among them, the network asset certificate identification device described in Figure 6 is used in a network asset certificate identification system, which is not limited by the embodiment of the present invention. As shown in Figure 6, the network asset certificate identification device may include the following operations:

S301, the data acquisition module is used to obtain the certificate information of network assets. The certificate information of the network assets constitutes the asset certificate library;

S302. The feature extraction module is used to process the certificate information of the network asset to obtain the characteristic information of the network asset. The characteristic information of the network asset constitutes a feature library;

S303, the model training module is used to use the characteristic information of the network asset to train the preset network asset certificate recognition model to obtain a trained network asset certificate recognition model;

S304. The certificate identification module is used to obtain the certificate information of the network asset to be identified, and use the training network asset certificate identification model to process the certificate information of the network asset to be identified to obtain the network asset certificate identification result.

Embodiment 4

Please refer to FIG. 7 , which is a schematic structural diagram of another network asset certificate identification device disclosed in an embodiment of the present invention. Among them, the network asset certificate identification device described in Figure 7 is used in a network asset certificate identification system, which is not limited by the embodiment of the present invention. As shown in Figure 6, the network asset certificate identification device may include the following operations:

Memory 401 storing executable program code;

processor 402 coupled to memory 401;

The processor 402 calls the executable program code stored in the memory 401 to execute the steps in the network asset certificate identification method described in Embodiment 1 or Embodiment 2.

The device embodiments described above are only illustrative. The modules described as separate components may or may not be physically separated. The components shown as modules may or may not be physical modules, that is, they may be located in one place. , or it can be distributed to multiple network modules. Some or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment. Persons of ordinary skill in the art can understand and implement the method without any creative effort.

Through the detailed description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions can be embodied in the form of software products in essence or in part that contribute to the existing technology. The computer software products can be stored in computer-readable storage media, and the storage media includes read-only memories. (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), programmable read-only memory (Programmable Read-only Memory, PROM), erasable programmable read-only memory (ErasableProgrammable Read Only Memory, EPROM) , One-time Programmable Read-Only Memory (OTPROM), Electronically Erasable Programmable Read-Only Memory (EEPROM), CompactDisc Read-Only Memory , CD-ROM) or other optical disk storage, magnetic disk storage, magnetic tape storage, or any other computer-readable medium that can be used to carry or store data.

Finally, it should be noted that: the network asset certificate identification method and device disclosed in the embodiment of the present invention are only the preferred embodiments of the present invention, and are only used to illustrate the technical solution of the present invention, but not to limit it; Although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art will understand that they can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent substitutions for some of the technical features; and These modifications or substitutions do not deviate from the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims (10)

1. A method for identifying network asset certificates, characterized in that the method includes: S1. Obtain the certificate information of the network assets. The certificate information of the network assets constitutes the asset certificate library; S2, process the certificate information of the network assets in the asset certificate library to obtain the characteristic information of the network assets, and the characteristic information of the network assets constitutes a characteristic library; S3, use the characteristic information of network assets in the feature library to train the preset network asset certificate recognition model to obtain a trained network asset certificate recognition model; S4: Obtain the certificate information of the network asset to be identified, use the trained network asset certificate recognition model to process the certificate information of the network asset to be identified, and obtain the network asset certificate recognition result. 2. The network asset certificate identification method according to claim 1, characterized in that said processing the certificate information of the network asset to obtain the characteristic information of the network asset includes: S21, perform structural similarity calculation on the certificate information of the network asset to obtain structural similarity information; S22, perform content similarity calculation on the certificate information of the network asset to obtain content similarity information; S23: Fusion of the structural similarity information and the content similarity information to obtain characteristic information of the network asset. 3. The network asset certificate identification method according to claim 2, characterized in that the structural similarity calculation is performed on the certificate information of the network asset to obtain the structural similarity information, including: S211. Obtain the certificate information of network asset A. The number of information items of network asset A is m; S212. Obtain the certificate information of network asset B. The number of information items of network asset B is n; S213. Process the certificate information of the network asset A and the certificate information of the network asset B to obtain the number x of information items contained in both the network asset A and the network asset B; S214, use the structural similarity calculation model to process the number of information items of the network asset A, which is m, the number of information items of the network asset B, which is n, and the number of information items, x, to obtain structural similarity information; The structural similarity calculation model is: Among them, str(A,B) is the structural similarity information. 4. The network asset certificate identification method according to claim 2, characterized in that the content similarity calculation is performed on the certificate information of the network asset to obtain the content similarity information, including: S221, process the certificate information of network asset A, and obtain the formal representation of the certificate information item of network asset A, content _A = (a ₁ , a ₂ ,..., a _x ); S222, process the certificate information of network asset B, and obtain the formal representation of the certificate information item of network asset B, content _B = (b ₁ , b ₂ ,..., b _x ); S223. Use the content similarity information calculation model to formalize the certificate information items of the network asset A as content _A = (a ₁ , a ₂ ,..., a _x ) and the certificate information items of the network asset B. Indicates processing to obtain content similarity information; The content similarity calculation model is: Among them, con(A,B) is content similarity information, 5. The network asset certificate identification method according to claim 2, characterized in that said fusing the structural similarity information and the content similarity information to obtain the characteristic information of the network asset includes: Using a similarity information fusion model, the structural similarity information and the content similarity information are fused to obtain characteristic information of network assets; The similarity information fusion model is: Among them, total(A,B) is the characteristic information of the network asset, str(A,B) is the structural similarity information, and con(A,B) is the content similarity information. 6. The network asset certificate identification method according to claim 1, characterized in that the characteristic information of the network asset is used to train a preset network asset certificate identification model to obtain a trained network asset certificate identification model, include: S31. Divide the characteristic information of the network assets to obtain labeled certificate samples and unlabeled certificate samples; S32. Use the unlabeled certificate sample as a training sample to train a preset network asset certificate recognition model to obtain a trained network asset certificate recognition model. 7. The network asset certificate identification method according to claim 1, characterized in that: obtaining the certificate information of the network asset to be identified, and using the training network asset certificate identification model to obtain the certificate information of the network asset to be identified. Process and obtain the network asset certificate identification results, including: S41, obtain the certificate information of the network asset to be identified; S42: Process the certificate information of the network asset to be identified to obtain the characteristic information of the network asset to be identified; S43: Obtain the first identification result based on the characteristic information of the network asset to be identified; S44: According to the first identification result, use the trained network asset certificate identification model to process the characteristic information of the network asset to be identified to obtain a network asset certificate identification result. 8. The network asset certificate identification method according to claim 1, characterized in that the method further includes: Obtain the certificate information of the network asset to be identified; Identify the certificate information of the network asset to be identified and obtain the first identification result; According to the first identification result, mark network asset certificates that are different from the first identification result to obtain a positive example certificate and a counterexample certificate; Add the counterexample certificate to the unlabeled certificate sample to form the optimal training sample set; The optimal training sample set is used to train the preset network asset certificate recognition model to obtain an optimized network asset certificate recognition model. 9. A network asset certificate identification device, characterized in that the device includes: A data acquisition module, used to obtain certificate information of network assets. The certificate information of network assets constitutes an asset certificate library; A feature extraction module, used to process the certificate information of the network asset to obtain the characteristic information of the network asset, and the characteristic information of the network asset constitutes a feature library; A model training module, configured to use the characteristic information of the network asset to train a preset network asset certificate recognition model to obtain a trained network asset certificate recognition model; The certificate identification module is used to obtain the certificate information of the network asset to be identified, and use the training network asset certificate identification model to process the certificate information of the network asset to be identified to obtain the network asset certificate identification result. 10. A network asset certificate identification device, characterized in that the device includes: Memory that stores executable program code; a processor coupled to said memory; The processor calls the executable program code stored in the memory to execute the network asset certificate identification method according to any one of claims 1-8.