A Novel Device Identification Method Based on Passive Measurement

Nowadays, with the continuous integration of production network and business network, more and more Industrial Internet of Things and Internal Office Network have been interconnected and evolved into a large-scale enterprise-level intraindustry network. Terminal devices are the basic units of intern...

Full description

Saved in:
Bibliographic Details
Published in:Security and communication networks 2019-01, Vol.2019 (2019), p.1-11
Main Authors: Shi, Jin-qiao, Yu, Ai-min, Cai, Li-jun, Zhang, Hao, Sun, Wei, Jiang, Jianguo
Format: Article
Language:English
Subjects:
Access control
Accuracy
Algorithms
Cluster analysis
Communication
Computer networks
Electronic devices
Firewalls
Gateways
Identification methods
Industrial applications
Internet of Things
Intranets
IP (Internet Protocol)
Measurement methods
Methods
Qualitative analysis
Risk assessment
Servers
Traffic congestion
Traffic information
Virtual private networks
Citations: Items that this one cites
Online Access:Get full text
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:Nowadays, with the continuous integration of production network and business network, more and more Industrial Internet of Things and Internal Office Network have been interconnected and evolved into a large-scale enterprise-level intraindustry network. Terminal devices are the basic units of internal network. Accurate identification of the type of device corresponding to the IP address and detailed description of the communication behavior of the device are of great significance for conducting network security risk assessment, hidden danger investigation, and threat warning. Traditional cyberspace surveying and mapping techniques take the form of active measurement, but they cannot be transplanted to large-scale intranet. Resources or specific targets in internal networks are often protected by firewalls, VPNs, gateways, and other technologies, so they are difficult to analyze and determine by active measurement. In this paper, a passive measurement method is proposed to identify and characterize devices in the network through real traffic data. Firstly, a new graph structure mining method is used to determine the server-like devices and host-like devices; then, the NAT-like devices are determined by quantitative analysis of traffic; finally, by qualitative analysis of the NAT-like device traffic, it is determined whether there are server-like devices behind the NAT-like device. This method will prove to be useful in identifying all kinds of devices in network data traffic, detecting unauthorized NAT-like devices and whether there are server-like devices behind the NAT-like devices.
ISSN:1939-0114
1939-0122
DOI:10.1155/2019/6045251