放大镜：通过基于轻量级流量的指纹检测网络接入
Magnifier: Detecting Network Access via Lightweight Traffic-based Fingerprints
AI总结：
提出Magnifier，利用域名森林指纹和两阶段蒸馏算法，从网关骨干流量被动推断移动设备网络接入，实现高效检测，并在真实场景中验证了通用性和覆盖范围。
摘要：
网络接入检测在全球网络管理中扮演着关键角色，通过识别未授权的网络接入并收集移动设备的详细信息，实现高效的网络监控和拓扑测量。现有的基于端点的检测方法主要依赖于部署监控软件来识别网络连接。然而，开发和维护此类系统所面临的挑战限制了其在实际部署中的通用性和覆盖范围，尤其是在覆盖具有异构操作系统的多种设备时，成本问题尤为突出。为解决这些问题，我们提出了Magnifier，用于移动设备网络接入检测，该方法首次在网关层面从骨干流量中被动推断接入模式。Magnifier的基础是利用创新的域名森林（dnForest）指纹创建设备特定的接入模式。随后，我们采用两阶段蒸馏算法来微调每个dnForest中各个域名树（dnTree）的权重，以突出独特的设备指纹。凭借这些精心制作的指纹，Magnifier通过轻量级指纹匹配算法，高效地从骨干流量中推断网络接入。我们在真实场景中进行的实验结果表明，Magnifier在实时初始和重复网络接入检测中均展现出卓越的通用性和覆盖范围。为促进进一步研究，我们精心整理了NetCess2023数据集，包含来自7个品牌26种不同型号的网络接入数据，覆盖了大多数主流移动设备。我们还公开了Magnifier原型和NetCess2023数据集（https://github.com/SecTeamPolaris/Magnifier）。
英文摘要：
Network access detection plays a crucial role in global network management, enabling efficient network monitoring and topology measurement by identifying unauthorized network access and gathering detailed information about mobile devices. Existing methods for endpoint-based detection primarily rely on deploying monitoring software to recognize network connections. However, the challenges associated with developing and maintaining such systems have limited their universality and coverage in practical deployments, especially given the cost implications of covering a wide array of devices with heterogeneous operating systems. To tackle the issues, we propose Magnifier for mobile device network access detection that, for the first time, passively infers access patterns from backbone traffic at the gateway level. Magnifier's foundation is the creation of device-specific access patterns using the innovative Domain Name Forest (dnForest) fingerprints. We then employ a two-stage distillation algorithm to fine-tune the weights of individual Domain Name Trees (dnTree) within each dnForest, emphasizing the unique device fingerprints. With these meticulously crafted fingerprints, Magnifier efficiently infers network access from backbone traffic using a lightweight fingerprint matching algorithm. Our experimental results, conducted in real-world scenarios, demonstrate that Magnifier exhibits exceptional universality and coverage in both initial and repetitive network access detection in real-time. To facilitate further research, we have thoughtfully curated the NetCess2023 dataset, comprising network access data from 26 different models across 7 brands, covering the majority of mainstream mobile devices. We have also made both the Magnifier prototype and the NetCess2023 dataset publicly available\footnote{https://github.com/SecTeamPolaris/Magnifier}.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
