CN117375845B - Network asset certificate identification method and device - Google Patents

Abstract

The invention discloses a network asset certificate identification method and a device, wherein the method comprises the following steps: acquiring certificate information of a network asset, wherein the certificate information of the network asset forms an asset certificate library; processing the certificate information of the network asset to obtain the characteristic information of the network asset, wherein the characteristic information of the network asset forms a characteristic library; training a preset network asset certificate identification model by utilizing the characteristic information of the network asset to obtain a training network asset certificate identification model; and acquiring the certificate information of the network asset to be identified, and processing the certificate information of the network asset to be identified by utilizing the training network asset certificate identification model to obtain a network asset certificate identification result. The invention combines two similarity measurement methods, and performs similarity comparison from the two aspects of the content and the structure of the certificate; meanwhile, by combining an autonomous learning feedback mechanism, a certificate similarity measurement and recognition query method with high automation degree and higher accuracy are explored.

Description

A network asset certificate identification method and device

Technical Field

The present invention relates to the technical field of network asset identity recognition, and in particular to a network asset certificate recognition method and device.

Background Art

A digital certificate is a digital certificate that marks the identity information of the communicating parties in Internet communication, and can be used to identify and verify the identities of the communicating parties. Certificate information usually includes the following information items: version number, serial number, signature algorithm, issuer, validity period, subject, subject public key, subject public key algorithm, signature value, etc. The version number is the version information of the certificate, each certificate has a unique certificate serial number, the signature algorithm is the signature algorithm used in the authentication process, the issuer is the name of the issuing organization of the certificate, the validity period marks the validity period of the certificate, the subject is the name of the certificate owner, the subject public key is the public key of the certificate owner, and the signature value is the signature of the certificate issuer on the certificate.

Digital certificates are used to prove the identity of the subject of network asset behavior in Internet information activities, and are also electronic data that can be used to verify the confidentiality and integrity of information sent by network assets. Reasonably and accurately implementing similarity measurement on network asset certificates can effectively classify, identify, query and retrieve network assets.

At present, there is no direct research on certificate similarity measurement and identification. Considering that the structure of a certificate includes several information items (version number, serial number, signature algorithm, issuer, etc.) and the corresponding value content of each information item, you can refer to the method of measuring text similarity in text classification. Most algorithms in text classification, such as KNN method, support vector machine method, K-means method, etc., need to calculate similarity to achieve the purpose of classification. Commonly used traditional text similarity measurement methods include cosine similarity, Jaccard similarity coefficient, Euclidean distance, Manhattan distance, Chebyshev distance, Mahalanobis distance, etc.

The existing text similarity measurement methods have a single function and cannot be directly applied to the similarity measurement of certificates. Given that the structure of a certificate includes several information items (version number, serial number, signature algorithm, issuer, etc.) and the corresponding value content of each information item, it is possible to consider combining the two similarity measurement methods to perform similarity comparison from the two aspects of the content and structure of the certificate; at the same time, combined with the autonomous learning feedback mechanism, explore certificate similarity measurement and identification query methods with high automation and higher accuracy.

Summary of the invention

The technical problem to be solved by the present invention is to provide a network asset certificate identification method and device, which can achieve the purpose of identifying the network asset by measuring the similarity of certificates of different network assets, so as to make up for the low degree of automation and low accuracy of network asset identification in the prior art. In order to solve the above technical problem, the first aspect of the embodiment of the present invention discloses a network asset certificate identification method, the method comprising:

S1, obtaining certificate information of network assets, wherein the certificate information of the network assets constitutes an asset certificate library;

S2, processing the certificate information of the network asset to obtain feature information of the network asset, wherein the feature information of the network asset constitutes a feature library;

S3, using the characteristic information of the network asset, training a preset network asset certificate identification model to obtain a trained network asset certificate identification model;

S4, obtaining the certificate information of the network asset to be identified, and using the trained network asset certificate identification model to process the certificate information of the network asset to be identified to obtain a network asset certificate identification result.

As an optional implementation manner, in the first aspect of the embodiment of the present invention, the processing of the certificate information of the network asset to obtain the characteristic information of the network asset includes:

S21, performing structural similarity calculation on the certificate information of the network asset to obtain structural similarity information;

S22, performing content similarity calculation on the certificate information of the network asset to obtain content similarity information;

S23, fusing the structure similarity information and the content similarity information to obtain feature information of the network asset.

As an optional implementation manner, in the first aspect of the embodiment of the present invention, the performing structural similarity calculation on the certificate information of the network asset to obtain the structural similarity information includes:

S211, obtaining certificate information of network asset A, wherein the number of information items of network asset A to be obtained is m;

S212, obtaining certificate information of network asset B, the number of information items of network asset B is n;

S213, processing the certificate information of the network asset A and the certificate information of the network asset B to obtain the number x of information items contained in both the network asset A and the network asset B;

S214, using a structural similarity calculation model, processing the number of information items of the network asset A, which is m, the number of information items of the network asset B, which is n, and the number of information items, which is x, to obtain structural similarity information;

The structural similarity calculation model is:

Where str(A,B) is the structural similarity information.

As an optional implementation manner, in the first aspect of the embodiment of the present invention, the performing content similarity calculation on the certificate information of the network asset to obtain content similarity information includes:

S221, process the certificate information of the network asset A to obtain a formalized representation of the certificate information item of the network asset A: content _A = (a ₁ , a ₂ , ..., a _x );

S222, process the certificate information of the network asset B to obtain a formalized representation of the certificate information item of the network asset B: content _B = (b ₁ , b ₂ , ..., b _x );

S223, using a content similarity information calculation model, processing the formalized representation of the certificate information item of the network asset A, content _A = (a ₁ , a ₂ , ..., a _x ) and the formalized representation of the certificate information item of the network asset B to obtain content similarity information;

The content similarity calculation model is:

Among them, con(A,B) is the content similarity information,

As an optional implementation manner, in the first aspect of the embodiment of the present invention, the fusing of the structural similarity information and the content similarity information to obtain the characteristic information of the network asset includes:

Using a similarity information fusion model, the structural similarity information and the content similarity information are fused to obtain feature information of network assets;

The similarity information fusion model is:

Among them, total(A,B) is the characteristic information of network assets, str(A,B) is the structural similarity information, and con(A,B) is the content similarity information.

As an optional implementation, in the first aspect of the embodiment of the present invention, the use of the characteristic information of the network asset to train a preset network asset certificate identification model to obtain a trained network asset certificate identification model includes:

S31, dividing the characteristic information of the network asset to obtain a marked certificate sample and an unmarked certificate sample;

S32, using the unlabeled certificate samples as training samples to train a preset network asset certificate recognition model to obtain a trained network asset certificate recognition model.

As an optional implementation, in the first aspect of the embodiment of the present invention, the obtaining of the certificate information of the network asset to be identified, using the trained network asset certificate identification model, processing the certificate information of the network asset to be identified, and obtaining the network asset certificate identification result, includes:

S41, obtaining certificate information of the network asset to be identified;

S42, processing the certificate information of the network asset to be identified to obtain feature information of the network asset to be identified;

S43, obtaining a first identification result according to the characteristic information of the network asset to be identified;

S44, based on the first identification result, the trained network asset certificate identification model is used to process the feature information of the network asset to be identified to obtain a network asset certificate identification result.

As an optional implementation manner, in the first aspect of the embodiment of the present invention, the method further includes:

Obtain the certificate information of the network asset to be identified;

Identify the certificate information of the network asset to be identified to obtain a first identification result;

According to the first identification result, the network asset certificates different from the first identification result are marked to obtain positive certificate and negative certificate;

Adding the counter-example certificate to the unlabeled certificate sample to form an optimal training sample set;

The preset network asset certificate recognition model is trained using the optimal training sample set to obtain an optimized network asset certificate recognition model.

A second aspect of an embodiment of the present invention discloses a network asset certificate identification device, the device comprising:

A data acquisition module, used to acquire certificate information of network assets, wherein the certificate information of the network assets constitutes an asset certificate library;

A feature extraction module, used for processing the certificate information of the network asset to obtain feature information of the network asset, wherein the feature information of the network asset constitutes a feature library;

A model training module, used to train a preset network asset certificate identification model using the characteristic information of the network asset to obtain a trained network asset certificate identification model;

The certificate identification module is used to obtain the certificate information of the network asset to be identified, and use the trained network asset certificate identification model to process the certificate information of the network asset to be identified to obtain a network asset certificate identification result.

As an optional implementation manner, in the second aspect of the embodiment of the present invention, the processing of the certificate information of the network asset to obtain the characteristic information of the network asset includes:

S21, performing structural similarity calculation on the certificate information of the network asset to obtain structural similarity information;

S22, performing content similarity calculation on the certificate information of the network asset to obtain content similarity information;

S23, fusing the structure similarity information and the content similarity information to obtain feature information of the network asset.

As an optional implementation manner, in the second aspect of the embodiment of the present invention, the performing structural similarity calculation on the certificate information of the network asset to obtain the structural similarity information includes:

S211, obtaining certificate information of network asset A, wherein the number of information items of network asset A to be obtained is m;

S212, obtaining certificate information of network asset B, the number of information items of network asset B is n;

S213, processing the certificate information of the network asset A and the certificate information of the network asset B to obtain the number x of information items contained in both the network asset A and the network asset B;

S214, using a structural similarity calculation model, processing the number of information items of the network asset A, which is m, the number of information items of the network asset B, which is n, and the number of information items, which is x, to obtain structural similarity information;

The structural similarity calculation model is:

Where str(A,B) is the structural similarity information.

As an optional implementation manner, in the second aspect of the embodiment of the present invention, the performing content similarity calculation on the certificate information of the network asset to obtain content similarity information includes:

S221, process the certificate information of the network asset A to obtain a formalized representation of the certificate information item of the network asset A: content _A = (a ₁ , a ₂ , ..., a _x );

S222, process the certificate information of the network asset B to obtain a formalized representation of the certificate information item of the network asset B: content _B = (b ₁ , b ₂ , ..., b _x );

S223, using a content similarity information calculation model, processing the formalized representation of the certificate information item of the network asset A, content _A = (a ₁ , a ₂ , ..., a _x ) and the formalized representation of the certificate information item of the network asset B to obtain content similarity information;

The content similarity calculation model is:

Among them, con(A,B) is the content similarity information,

As an optional implementation manner, in the second aspect of the embodiment of the present invention, the fusing of the structural similarity information and the content similarity information to obtain the characteristic information of the network asset includes:

Using a similarity information fusion model, the structural similarity information and the content similarity information are fused to obtain feature information of network assets;

The similarity information fusion model is:

Among them, total(A,B) is the characteristic information of network assets, str(A,B) is the structural similarity information, and con(A,B) is the content similarity information.

As an optional implementation, in the second aspect of the embodiment of the present invention, the use of the characteristic information of the network asset to train a preset network asset certificate identification model to obtain a trained network asset certificate identification model includes:

S31, dividing the characteristic information of the network asset to obtain a marked certificate sample and an unmarked certificate sample;

S32, using the unlabeled certificate samples as training samples to train a preset network asset certificate recognition model to obtain a trained network asset certificate recognition model.

As an optional implementation, in the second aspect of the embodiment of the present invention, the obtaining of the certificate information of the network asset to be identified, using the trained network asset certificate identification model, processing the certificate information of the network asset to be identified, and obtaining the network asset certificate identification result includes:

S41, obtaining certificate information of the network asset to be identified;

S42, processing the certificate information of the network asset to be identified to obtain feature information of the network asset to be identified;

S43, obtaining a first identification result according to the characteristic information of the network asset to be identified;

S44, based on the first identification result, the trained network asset certificate identification model is used to process the feature information of the network asset to be identified to obtain a network asset certificate identification result.

As an optional implementation manner, in the second aspect of the embodiment of the present invention, the method further includes:

Obtain the certificate information of the network asset to be identified;

Identify the certificate information of the network asset to be identified to obtain a first identification result;

According to the first identification result, the network asset certificates different from the first identification result are marked to obtain positive certificate and negative certificate;

Adding the counter-example certificate to the unlabeled certificate sample to form an optimal training sample set;

The preset network asset certificate recognition model is trained using the optimal training sample set to obtain an optimized network asset certificate recognition model.

The third aspect of the present invention discloses another network asset certificate identification device, the device comprising:

A memory storing executable program code;

a processor coupled to the memory;

The processor calls the executable program code stored in the memory to execute part or all of the steps in the network asset certificate identification method disclosed in the first aspect of the embodiment of the present invention.

Compared with the prior art, the embodiments of the present invention have the following beneficial effects:

The present invention provides a network asset certificate identification method and device, which measures the similarity of certificate samples in terms of structural similarity and content similarity, thereby obtaining the structural features, content features and comprehensive features of the certificate; adopts a support vector machine model, and introduces the idea of autonomous learning from how to select the most appropriate certificate as a training sample of the support vector machine, constructs a support vector machine based on active learning feedback, and uses unlabeled certificate samples as training samples and inputs them into the support vector machine classifier for learning; in the process of continuously identifying and querying the user's unlabeled samples, for a large-scale certificate library, it is possible to avoid the impact of the limited number of user-labeled samples on the classification effect of the support vector machine classifier, or the increase in the classifier calculation amount due to the processing time spent on a large amount of labeling work; at the same time, it is possible to label the most ambiguous certificates, and combine them with the user-labeled samples to form an optimal training sample set, thereby reducing the calculation time, improving the classification query efficiency, and improving the quality of the identification query results.

BRIEF DESCRIPTION OF THE DRAWINGS

In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

FIG1 is a flow chart of a method for identifying a network asset certificate disclosed in an embodiment of the present invention;

FIG2 is a flow chart of another network asset certificate identification method disclosed in an embodiment of the present invention;

3 is a schematic diagram of the structure of a network asset certificate identification query system based on autonomous learning feedback disclosed in an embodiment of the present invention;

FIG4 is a schematic diagram of sample annotation disclosed in an embodiment of the present invention;

FIG5 is a schematic diagram of an active learning model disclosed in an embodiment of the present invention;

FIG6 is a schematic diagram of the structure of a network asset certificate identification device disclosed in an embodiment of the present invention;

FIG. 7 is a schematic diagram of the structure of another network asset certificate identification device disclosed in an embodiment of the present invention.

DETAILED DESCRIPTION

In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

The terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish different objects, rather than to describe a specific order. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, device, product or equipment that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units that are not listed, or may optionally include other steps or units that are inherent to these processes, methods, products or equipment.

Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present invention. The appearance of the phrase in various places in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive of other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

The present invention discloses a network asset certificate identification method and device, which can obtain the certificate information of the network asset, and the certificate information of the network asset constitutes an asset certificate library; the certificate information of the network asset is processed to obtain the characteristic information of the network asset, and the characteristic information of the network asset constitutes a characteristic library; the characteristic information of the network asset is used to train a preset network asset certificate identification model to obtain a trained network asset certificate identification model; the certificate information of the network asset to be identified is obtained, and the certificate information of the network asset to be identified is processed using the trained network asset certificate identification model to obtain a network asset certificate identification result. The present invention combines two similarity measurement methods to perform similarity comparison from the two aspects of the content and structure of the certificate; at the same time, combined with the autonomous learning feedback mechanism, it explores a certificate similarity measurement and identification query method with a high degree of automation and higher accuracy. The following are detailed descriptions.

Embodiment 1

Please refer to FIG. 1, which is a flow chart of a network asset certificate identification method disclosed in an embodiment of the present invention. The network asset certificate identification method described in FIG. 1 is applied to a network asset certificate identification system, which is not limited in the embodiment of the present invention. As shown in FIG. 1, the network asset certificate identification method may include the following operations:

S1, obtaining certificate information of network assets, wherein the certificate information of the network assets constitutes an asset certificate library;

S2, processing the certificate information of the network asset to obtain feature information of the network asset, wherein the feature information of the network asset constitutes a feature library;

S3, using the characteristic information of the network asset, training a preset network asset certificate identification model to obtain a trained network asset certificate identification model;

S4, obtaining the certificate information of the network asset to be identified, and using the trained network asset certificate identification model to process the certificate information of the network asset to be identified to obtain a network asset certificate identification result.

The asset certificate library consists of the certificate information of network assets, including the following information items: version number, serial number, signature algorithm, issuer, validity period, subject, subject public key, subject public key algorithm, signature value, etc.

Optionally, the processing of the certificate information of the network asset to obtain characteristic information of the network asset includes:

S21, performing structural similarity calculation on the certificate information of the network asset to obtain structural similarity information;

S22, performing content similarity calculation on the certificate information of the network asset to obtain content similarity information;

S23, fusing the structure similarity information and the content similarity information to obtain feature information of the network asset.

Optionally, the performing structural similarity calculation on the certificate information of the network asset to obtain structural similarity information includes:

S211, obtaining certificate information of network asset A, wherein the number of information items of network asset A to be obtained is m;

S212, obtaining certificate information of network asset B, the number of information items of network asset B is n;

S213, processing the certificate information of the network asset A and the certificate information of the network asset B to obtain the number x of information items contained in both the network asset A and the network asset B;

S214, using a structural similarity calculation model, processing the number of information items of the network asset A, which is m, the number of information items of the network asset B, which is n, and the number of information items, which is x, to obtain structural similarity information;

The structural similarity calculation model is:

Where str(A,B) is the structural similarity information.

Optionally, the performing content similarity calculation on the certificate information of the network asset to obtain content similarity information includes:

S221, process the certificate information of the network asset A to obtain a formalized representation of the certificate information item of the network asset A: content _A = (a ₁ , a ₂ , ..., a _x );

S222, process the certificate information of the network asset B to obtain a formalized representation of the certificate information item of the network asset B: content _B = (b ₁ , b ₂ , ..., b _x );

S223, using a content similarity information calculation model, processing the formalized representation of the certificate information item of the network asset A, content _A = (a ₁ , a ₂ , ..., a _x ) and the formalized representation of the certificate information item of the network asset B to obtain content similarity information;

The content similarity calculation model is:

Among them, con(A,B) is the content similarity information,

Optionally, the fusing the structural similarity information and the content similarity information to obtain feature information of the network asset includes:

Using a similarity information fusion model, the structural similarity information and the content similarity information are fused to obtain feature information of network assets;

The similarity information fusion model is:

Among them, total(A,B) is the characteristic information of network assets, str(A,B) is the structural similarity information, and con(A,B) is the content similarity information.

Optionally, the using the characteristic information of the network asset to train a preset network asset certificate identification model to obtain a trained network asset certificate identification model includes:

S31, dividing the characteristic information of the network asset to obtain a marked certificate sample and an unmarked certificate sample;

The division method may be performed in a ratio of 3:7, which is not limited in the present invention.

S32, using the unlabeled certificate samples as training samples to train a preset network asset certificate recognition model to obtain a trained network asset certificate recognition model.

Optionally, the acquiring certificate information of the network asset to be identified, and using the trained network asset certificate identification model to process the certificate information of the network asset to be identified to obtain a network asset certificate identification result, includes:

S41, obtaining certificate information of the network asset to be identified;

S42, processing the certificate information of the network asset to be identified to obtain feature information of the network asset to be identified;

S43, obtaining a first identification result according to the characteristic information of the network asset to be identified;

S44, based on the first identification result, the trained network asset certificate identification model is used to process the feature information of the network asset to be identified to obtain a network asset certificate identification result.

Optionally, the method further includes:

Obtain the certificate information of the network asset to be identified;

Identify the certificate information of the network asset to be identified to obtain a first identification result;

According to the first identification result, the network asset certificates different from the first identification result are marked to obtain positive certificate and negative certificate;

The user sets a threshold based on the first recognition result, annotates the positive and negative examples, and customizes the number of them, and can perform a secondary query to obtain the result.

Adding the counter-example certificate to the unlabeled certificate sample to form an optimal training sample set;

The preset network asset certificate recognition model is trained using the optimal training sample set to obtain an optimized network asset certificate recognition model.

Optionally, after obtaining the structural similarity information and the content similarity information, the following method can be used for feature fusion:

The structural similarity information X and the content similarity information Y are projected into one dimension for linear representation, corresponding to the projection vectors a and b respectively, and the feature matrix after projection becomes:

X'＝a ^T X,Y'＝b ^T Y

Maximize the correlation coefficient between X' and Y' to obtain the projection vectors a and b when the correlation coefficient is maximum. That is:

Before projection, the data is standardized. The purpose of standardization is to make the mean of the data 0 and the variance 1. Under this condition, we can get:

cov(X',Y')＝cov ⁽ a ^T X,b ^T Y)＝E( ^{＜a T X,b T Y＞} )＝E ^{( (} a ^T E(XY ^T )b

D(X')＝D(a ^T X)＝a ^T E(XX ^T )a

D(Y')＝D(b ^T Y)＝b ^T E(YY ^T )b

Since X and Y have a mean of 0 after standardization,

D(X)＝cov(X,X)＝E(XX ^T )

D(Y)＝cov(Y,Y)＝E(YY ^T )

cov(X,Y)＝E(XY ^T ),cov(Y,X)＝E(YX ^T )

Assume S _XX = cov(X,X), then the solution objective is transformed into:

The solution process of the above function is:

Step 3: Solve the singular values of M and obtain the largest singular value and its left and right singular vectors u, v.

Step 4: The projection vectors a and b of X and Y are:

Optionally, the preset network asset certificate identification model uses discrete wavelet decomposition to process the characteristic information of network assets. The characteristic information of network assets is decomposed into different frequency bands and then its energy proportion is calculated. After normalization, the characteristic dimension is reduced by principal component analysis, and the characteristic vector set is used as the input of the least squares support vector machine. The hybrid particle swarm algorithm is then used to optimize the initial parameters of the least squares support vector machine, thereby building a preset network asset certificate identification model. The hybrid particle swarm algorithm combines FSA (fast simulated annealing) and PSO (particle swarm algorithm). The PSO algorithm is used to explore the global search area. When PSO searches for the optimal solution of the current number of iterations, the FSA algorithm is used to adjust the best position found by PSO to obtain a new solution. The new solution is compared with the optimal solution obtained by the PSO algorithm. If the new solution is better than the optimal solution, the new solution is used as the current optimal solution, otherwise the new solution is accepted with a certain probability. Through this combination, it is avoided to fall into the local optimal solution too early, further balances the relationship between global search and local search, and optimizes the efficiency and accuracy of the algorithm.

FSA algorithm process:

1) Starting from the initial solution, define the initial temperature T, the end temperature T _min , and the cooling rate r;

2) At each temperature, the current solution is perturbed using the Cauchy distribution to obtain a new solution;

3) For each new solution, calculate its objective function value or cost function value. If the new solution is better, accept it as the current solution; otherwise, accept it according to the Metropolis criterion probability.

4) Repeat steps 2) and 3) until the temperature drops to T _min . During the temperature drop, the probability of accepting an inferior solution gradually decreases, and eventually only the better solution is accepted.

5) When the temperature drops to T _min , the algorithm ends and returns the optimal solution found.

Embodiment 2

Please refer to FIG. 2, which is a flowchart of another network asset certificate identification method disclosed in an embodiment of the present invention. The network asset certificate identification method described in FIG. 2 is applied to a network asset certificate identification system, which is not limited in the embodiment of the present invention. As shown in FIG. 2, the network asset certificate identification method may include the following operations:

(1) Obtain the certificate information of the network asset to be identified

(2) Using the certificate similarity measurement method, the structural similarity and content similarity of the certificates are calculated by quantifying the structure and content, thereby obtaining the structural features, content features and comprehensive features of the certificates;

(3) Construct a support vector machine based on active learning feedback to optimize the training sample set;

(4) The similarity of the asset certificates to be identified is measured through the above-mentioned classifier model, the network assets are identified, and then a similar network asset library is established.

The network asset certificate identification and query system based on autonomous learning feedback has the following specific ideas:

1) Overall structure

Retrieval feedback interface: including certificate query and result feedback. Mainly based on self-learning training and certification feedback, it realizes the feature comparison between the network asset certificate to be identified and the network asset certificate library through asset certificate similarity calculation, and identifies different types of certificates; and then provides users with the function of re-querying the selected sample certificate.

Asset certificate library: known original asset certificates;

Feature library: a comprehensive feature library formed by structural features and content features;

2) Working principle

The user selects the certificate to be queried and identified through the certificate query module, and the system displays the first identification query result;

Based on the results, users can mark positive and negative certificates, with a custom number, and can perform secondary query identification to obtain the results. Among them, certificates with large ambiguity are divided through the active learning feedback mechanism, and users can mark them as negative certificates and feedback the certificate marking results again;

Depending on whether the relevant feedback results of the result feedback module meet the expectations of the certificate identification query, the decision system will execute the number of times until the identification result has a certain degree of accuracy and the operation is terminated.

The schematic diagram of the principle of the network asset certificate identification and query system based on autonomous learning feedback is shown in Figure 3.

3) Implementation design

Certificate feature extraction

(1) extracting the information items of each network asset certificate sample and the value content of each information item;

The certificate information includes the following information items: version number, serial number, signature algorithm, issuer, validity period, subject, subject public key, subject public key algorithm, signature value, etc. The version number is the version information of the certificate, each certificate has a unique certificate serial number, the signature algorithm is the signature algorithm used in the authentication process, the issuer is the name of the issuing organization of the certificate, the validity period marks the validity period of the certificate, the subject is the name of the certificate owner, the subject public key is the public key of the certificate owner, and the signature value is the signature of the certificate issuer on the certificate.

The information items of the certificate information can be expressed in the form of a vector. The certificate information of subject A can be formally expressed as

cert _A =(A ₁ ,A ₂ ,…,A _n ),

For i=1 to n, _Ai represents the certificate version number, serial number, signature algorithm, issuer, validity period, subject, subject public key, subject public key algorithm, signature value, etc. Each certificate information item will have a corresponding value, which is called the content of the information item. For example, the version number can be V3, which is formally expressed as _A1 =V3.

(2) Calculate the structural similarity between each network asset certificate sample and the known network asset certificate as the structural feature of the certificate;

Structural similarity refers to calculating the structural similarity between two certificate information, listing all certificate information items of the two certificates, and using the Jaccard similarity coefficient to calculate the structural similarity between the two certificate information. Assuming that certificate A has m certificate information items and certificate B has n certificate information items, and both A and B contain x information items, then the structural similarity between certificate A and certificate B is expressed as

If two certificates contain the same name and number of information items, ie, m=n, and x=m=n, then the structural similarity of the two certificates is 1.

Calculate the content similarity between each network asset certificate sample and the known network asset certificate as the content feature of the certificate;

(3) Content similarity refers to calculating the similarity of the values of the same information items in two certificates. The certificate information items that exist in both certificates are listed, and the similarity of the values of the information items is measured. The Euclidean distance is used to calculate the similarity of the values of the same information items in the two certificates. Assume that the certificate information items contained in both certificates A and B include x information items such as version number, serial number, signature algorithm, issuer, validity period, subject, subject public key, subject public key algorithm, signature value, etc. The values of the same information items in certificates A and B can be formally expressed as content _A = (a ₁ , a ₂ ,…, a _x ) and content _B = (b ₁ , b ₂ ,…, b _x ). The Euclidean distance between the values of the same information items in the two certificates is calculated as

The smaller the Euclidean distance, the greater the similarity between the two certificates; the larger the Euclidean distance, the smaller the similarity between the two certificates. Then the content similarity between certificate A and certificate B is

(4) Calculate the comprehensive characteristics of the certificate sample based on the structural characteristics and content characteristics of the certificate;

According to the structural similarity and content similarity of the certificates A and B, the overall similarity between the certificates A and B is calculated as follows:

Active learning feedback certificate recognition model construction:

(1) Certificate Query

The identification and result display of network asset certificates are mainly based on similarity measurement methods and comprehensive features of certificates. Considering the certificates in the certificate library that are highly similar to the asset certificates to be tested, the system interface will plan the display area based on country, region, application, etc.

(2) Sample labeling

The labeled sample set is mainly composed of positive and negative samples marked by users, which is used as the input of the support vector machine for training to ensure the accuracy of the recognition query results.

Sample labeling is the process operation of realizing the result feedback certificate identification query. The user considers the number of labels and labels the relevant positive and negative certificate samples as needed. At the same time, combined with active learning, for certificates with large ambiguity in the identification query results, users can also label the positive and negative examples of the identification results at this stage. As shown in Figure 3, it is a structural diagram of the network asset certificate identification query system based on autonomous learning feedback disclosed in an embodiment of the present invention.

(3) Result feedback based on active learning

By adopting the active learning feedback mode, a large number of unlabeled certificates of users are used as training samples and input into the support vector machine classifier for learning, which can obtain certificate results with greater ambiguity; the user can decide whether to mark it as a positive certificate or a negative certificate, update the labeled sample set, and then gradually form the optimal training sample set to improve the accuracy of recognition query. Figure 4 is a schematic diagram of sample annotation disclosed in an embodiment of the present invention. Figure 5 is a schematic diagram of the active learning model disclosed in an embodiment of the present invention.

The support vector machine model based on active learning has a cyclic execution characteristic, and the model is described as S = (A, H, U, M, D), where A represents the support vector machine classifier, H is the query function, U is the user terminal, M is the labeled sample set, and D is the unlabeled sample set.

Model execution includes:

(1) Combine the similarity measurement method to obtain the certificate structure features, content features and comprehensive features, and output the first certificate identification query result;

(2) Based on the first output results, the user selects and labels positive and negative samples to obtain training samples;

(3) Construct a training sample set and learn the training samples, and then perform recognition query again based on the classifier;

(4) In the above learning feedback results, the certificate set with large ambiguity with the sample identification query result selected by the user is automatically calculated and output, and the user selects and annotates the positive certificate or the negative certificate in the ambiguous certificate and adds it to the annotated sample set;

(5) By repeating this process, the optimal classification and recognition result can be obtained by calculating a small number of sample sets;

(6) Calculate the similarity distance between the certificate to be identified and each certificate in the certificate library, sort them according to similarity, and obtain the certificate identification result.

Embodiment 3

Please refer to FIG6 , which is a schematic diagram of the structure of a network asset certificate identification device disclosed in an embodiment of the present invention. The network asset certificate identification device described in FIG6 is applied to a network asset certificate identification system, which is not limited in the embodiment of the present invention. As shown in FIG6 , the network asset certificate identification device may include the following operations:

S301, a data acquisition module, used to acquire certificate information of network assets, where the certificate information of the network assets constitutes an asset certificate library;

S302, a feature extraction module, used to process the certificate information of the network asset to obtain feature information of the network asset, and the feature information of the network asset constitutes a feature library;

S303, a model training module, used to train a preset network asset certificate identification model using the characteristic information of the network asset to obtain a trained network asset certificate identification model;

S304, a certificate identification module is used to obtain the certificate information of the network asset to be identified, and use the trained network asset certificate identification model to process the certificate information of the network asset to be identified to obtain a network asset certificate identification result.

Embodiment 4

Please refer to FIG. 7, which is a schematic diagram of the structure of another network asset certificate identification device disclosed in an embodiment of the present invention. The network asset certificate identification device described in FIG. 7 is applied to a network asset certificate identification system, which is not limited in the embodiment of the present invention. As shown in FIG. 6, the network asset certificate identification device may include the following operations:

A memory 401 storing executable program codes;

a processor 402 coupled to the memory 401;

The processor 402 calls the executable program code stored in the memory 401 to execute the steps in the network asset certificate identification method described in the first or second embodiment.

The device embodiments described above are only illustrative, wherein the modules described as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical modules, i.e., they may be located in one place, or they may be distributed on multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Those of ordinary skill in the art may understand and implement it without paying creative labor.

Through the specific description of the above embodiments, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on such an understanding, the above technical solution can be essentially or partly contributed to the prior art in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, and the storage medium includes a read-only memory (ROM), a random access memory (RAM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), a one-time programmable read-only memory (OTPROM), an electronically erasable rewritable read-only memory (EEPROM), a compact disc (CD-ROM) or other optical disc storage, magnetic disk storage, magnetic tape storage, or any other computer-readable medium that can be used to carry or store data.

Finally, it should be noted that the network asset certificate identification method and device disclosed in the embodiments of the present invention disclose only the preferred embodiments of the present invention, which are only used to illustrate the technical solution of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments can still be modified, or some of the technical features can be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims (4)

1. A network asset certificate identification method, characterized in that the method comprises: S1, obtaining certificate information of network assets, wherein the certificate information of the network assets constitutes an asset certificate library; S2, processing the certificate information of the network assets in the asset certificate library to obtain feature information of the network assets, wherein the feature information of the network assets constitutes a feature library, including: S21, performing structural similarity calculation on the certificate information of the network asset to obtain structural similarity information, including: S211, obtaining certificate information of network asset A, the number of information items of network asset A is m; S212, obtaining certificate information of network asset B, the number of information items of network asset B is n; S213, processing the certificate information of the network asset A and the certificate information of the network asset B to obtain the number x of information items contained in both the network asset A and the network asset B; S214, using a structural similarity calculation model, processing the number of information items of the network asset A (m), the number of information items of the network asset B (n), and the number of information items (x) to obtain structural similarity information; The structural similarity calculation model is: Among them, str(A,B) is the structural similarity information; S22, performing content similarity calculation on the certificate information of the network asset to obtain content similarity information, including: S221, process the certificate information of the network asset A to obtain a formalized representation of the certificate information item of the network asset A: content _A = (a ₁ , a ₂ , ..., a _x ); S222, process the certificate information of the network asset B to obtain a formalized representation of the certificate information item of the network asset B: content _B = (b ₁ , b ₂ , ..., b _x ); S223, using a content similarity information calculation model, processing the formalized representation of the certificate information item of the network asset A, content _A = (a ₁ , a ₂ , ..., a _x ) and the formalized representation of the certificate information item of the network asset B to obtain content similarity information; The content similarity calculation model is: Among them, con(A,B) is the content similarity information, S23, fusing the structural similarity information and the content similarity information to obtain characteristic information of the network asset, including: Using a similarity information fusion model, the structural similarity information and the content similarity information are fused to obtain feature information of network assets; The similarity information fusion model is: Among them, total(A,B) is the characteristic information of network assets, str(A,B) is the structural similarity information, and con(A,B) is the content similarity information; S3, using the characteristic information of the network assets in the characteristic library, training a preset network asset certificate identification model to obtain a trained network asset certificate identification model; The method for obtaining the preset network asset certificate identification model is: Discrete wavelet decomposition is used to process the characteristic information of network assets; The characteristic information of network assets is decomposed into different frequency bands and their energy proportions are calculated. After normalization, the characteristic dimension is reduced using principal component analysis, and the constructed characteristic vector set is used as the input of the least squares support vector machine. The hybrid particle swarm algorithm is used to optimize the initial parameters of the least squares support vector machine, so as to build a preset network asset certificate recognition model; The hybrid particle swarm algorithm combines the fast simulated annealing method with the particle swarm algorithm. The particle swarm algorithm is used to explore the global search area. When the particle swarm algorithm searches for the optimal solution of the current number of iterations, the fast simulated annealing method is used to adjust the best position found by the particle swarm algorithm to obtain a new solution. The new solution is compared with the optimal solution obtained by the particle swarm algorithm. If the new solution is better than the optimal solution, the new solution is used as the current optimal solution, otherwise the new solution is accepted with a certain probability. S4, obtaining the certificate information of the network asset to be identified, and using the trained network asset certificate identification model to process the certificate information of the network asset to be identified to obtain a network asset certificate identification result, including: S41, obtaining certificate information of the network asset to be identified; S42, processing the certificate information of the network asset to be identified to obtain feature information of the network asset to be identified; S43, obtaining a first identification result according to the characteristic information of the network asset to be identified; According to the first identification result, the network asset certificates different from the first identification result are marked to obtain positive certificate and negative certificate; Adding the counter-example certificate to the unlabeled certificate sample to form an optimal training sample set; Using the optimal training sample set, training the preset network asset certificate recognition model to obtain an optimized network asset certificate recognition model; S44, according to the first identification result, using the optimized network asset certificate identification model, processing the feature information of the network asset to be identified to obtain a network asset certificate identification result. 2. The network asset certificate identification method according to claim 1, characterized in that the use of the characteristic information of the network asset to train a preset network asset certificate identification model to obtain a trained network asset certificate identification model comprises: S31, dividing the characteristic information of the network asset to obtain a marked certificate sample and an unmarked certificate sample; S32, using the unlabeled certificate samples as training samples to train a preset network asset certificate recognition model to obtain a trained network asset certificate recognition model. 3. A network asset certificate identification device, characterized in that the device comprises: A data acquisition module, used to acquire certificate information of network assets, wherein the certificate information of the network assets constitutes an asset certificate library; The feature extraction module is used to process the certificate information of the network assets in the asset certificate library to obtain feature information of the network assets. The feature information of the network assets constitutes a feature library, including: S21, performing structural similarity calculation on the certificate information of the network asset to obtain structural similarity information, including: S211, obtaining certificate information of network asset A, the number of information items of network asset A is m; S212, obtaining certificate information of network asset B, the number of information items of network asset B is n; S213, processing the certificate information of the network asset A and the certificate information of the network asset B to obtain the number x of information items contained in both the network asset A and the network asset B; S214, using a structural similarity calculation model, processing the number of information items of the network asset A (m), the number of information items of the network asset B (n), and the number of information items (x) to obtain structural similarity information; The structural similarity calculation model is: Among them, str(A,B) is the structural similarity information; S22, performing content similarity calculation on the certificate information of the network asset to obtain content similarity information, including: S221, process the certificate information of the network asset A to obtain a formalized representation of the certificate information item of the network asset A: content _A = (a ₁ , a ₂ , ..., a _x ); S222, process the certificate information of the network asset B to obtain a formalized representation of the certificate information item of the network asset B: content _B = (b ₁ , b ₂ , ..., b _x ); S223, using a content similarity information calculation model, processing the formalized representation of the certificate information item of the network asset A, content _A = (a ₁ , a ₂ , ..., a _x ) and the formalized representation of the certificate information item of the network asset B to obtain content similarity information; The content similarity calculation model is: Product characteristics information, including: Using a similarity information fusion model, the structural similarity information and the content similarity information are fused to obtain feature information of network assets; The similarity information fusion model is: Among them, total(A,B) is the characteristic information of network assets, str(A,B) is the structural similarity information, and con(A,B) is the content similarity information; A model training module, used to train a preset network asset certificate identification model using the feature information of the network assets in the feature library to obtain a trained network asset certificate identification model; The method for obtaining the preset network asset certificate identification model is: Discrete wavelet decomposition is used to process the characteristic information of network assets; The characteristic information of network assets is decomposed into different frequency bands and their energy proportions are calculated. After normalization, the feature dimension is reduced using principal component analysis, and the resulting feature vector set is used as the input of the least squares support vector machine. The hybrid particle swarm algorithm is used to optimize the initial parameters of the least squares support vector machine, so as to build a preset network asset certificate recognition model; The hybrid particle swarm algorithm combines the fast simulated annealing method with the particle swarm algorithm. The particle swarm algorithm is used to explore the global search area. When the particle swarm algorithm searches for the optimal solution of the current number of iterations, the fast simulated annealing method is used to adjust the best position found by the particle swarm algorithm to obtain a new solution. The new solution is compared with the optimal solution obtained by the particle swarm algorithm. If the new solution is better than the optimal solution, the new solution is used as the current optimal solution, otherwise the new solution is accepted with a certain probability. The certificate identification module is used to obtain the certificate information of the network asset to be identified, and use the trained network asset certificate identification model to process the certificate information of the network asset to be identified to obtain the network asset certificate identification result, including: S41, obtaining certificate information of the network asset to be identified; S42, processing the certificate information of the network asset to be identified to obtain feature information of the network asset to be identified; S43, obtaining a first identification result according to the characteristic information of the network asset to be identified; According to the first identification result, the network asset certificates different from the first identification result are marked to obtain positive certificate and negative certificate; Adding the counter-example certificate to the unlabeled certificate sample to form an optimal training sample set; Using the optimal training sample set, training the preset network asset certificate recognition model to obtain an optimized network asset certificate recognition model; S44, based on the first identification result, the optimized network asset certificate identification model is used to process the feature information of the network asset to be identified to obtain a network asset certificate identification result. 4. A network asset certificate identification device, characterized in that the device comprises: A memory storing executable program code; a processor coupled to the memory; The processor calls the executable program code stored in the memory to execute the network asset certificate identification method as described in any one of claims 1-2.