# Development of Fingerprint Identification Based on Device Flow in Industrial Control System
## 3 Device Traffic Fingerprint Extraction and Identification
### Fuzzy Matching to Identify Unknown Devices
#### 3.3.1 Sequence Sharding
If there is a group of consecutive units of equal value, they can be stored in a skip chain, and the calculation of these units can be skipped at one time, thereby improving the efficiency of the algorithm. Two sharding algorithms, the uniform sharding strategy and the optimal sharding strategy, have been discussed above. Fragmentation using both algorithms is divided into three processes. The first step is sharding, the second step is query, and the last step is verification. The time complexity is shown in the Table 3.  
From the above table, it can be calculated that the cost difference between the two sharding algorithms is \(a*(|q|^{2}\tau-\tau)+b*\tau|q|(W_{B}-W_{E})\). \(a\) and \(b\) are the unit costs of the sharding phase and the verification phase, respectively, and \(W_{E}\) and \(W_{B}\) represent the weights of the uniform sharding strategy and the optimal sharding strategy, \(W_{E}\leq W_{B}\). When the cost difference is less than 0, that is, \(W_{B}<W_{E}-a/b(|q|-1/(|q|))\), the optimal sharding strategy is better than the uniform distribution strategy. However, \(W_{B}\) can only be calculated after determining the optimal sharding strategy. It is very inaccurate to determine which sharding strategy to choose by setting a threshold, and setting a fixed threshold in advance cannot adapt to the identification of different query sequences, which has poor flexibility. This paper introduces a machine learning method to predict and select a segmentation strategy. After the device fingerprint is constructed in Section 3.1, a large number of query sequences with different lengths will be randomly generated, and then the cost of the two sharding strategies will be compared and labeled. The uniform sharding strategy has a small cost and is marked as 0, otherwise it is marked as 1. The problem is transformed into a binary classification problem. Four features are collected in this chapter, namely the length of the query sequence \(|q|\), the number of shards \(\tau+1\), the weight of the uniform division method \(W_{E}\), and the weight difference of adjacent shards \(\sum_{j=1}^{\tau}|w_{s}(p_{j+1})-w_{s}(p_{j})|\). The first two features are the basic information of the query sequence. \(W_{E}\) is the baseline value of overhead. \(\sum_{j=1}^{\tau}|w_{s}(p_{j+1})-w_{s}(p_{j})|\) measures the probability of changing sharding to reduce overhead. When the value is small, it will favor the uniform sharding strategy. The training model adopts the support vector machine model (SVM). The main idea is to find a hyperplane that accurately distinguishes different sample data, and to make the Euclidean distance from the point closest to the hyperplane to the hyperplane as large as possible. The radial basis function kernel function (RBF) is used in the model training process, and the penalty factor C and the RBF kernel function coefficient g are obtained by grid optimization method to obtain the optimal value. After the model training is completed, the sharding strategy can be predicted and selected to improve the overall efficiency of the recognition algorithm.