Network flow fingerprint feature two-stage multi-classification Internet of Things device identification method

Abstract

The invention discloses a network flow fingerprint feature two-stage multi-classification Internet of Things device identification method, belongs to the technical field of Internet of Things device access control, and the algorithm extracts network flow features from network flow and matches and identifies accessed Internet of Things devices. The algorithm mainly comprises the following steps: firstly, acquiring N pieces of network message data when an Internet of Things device starts an access stage, and extracting features from three dimensions of sequence field contents, sequence protocolinformation and sequence statistical values to serve as device fingerprint features; using a one-to-many multi-classification machine learning architecture to perform preliminary identification on theto-be-detected Internet of Things device; and if a plurality of identification results appear in the preliminary identification, inputting the results into a maximum similarity comparison module forsecondary classification identification, and selecting the type with the highest similarity as a final identification result. According to the method, the problem that identification overlapping is easy to occur when the existing identification algorithm is used for identifying the Internet of Things device is solved, and the identification accuracy and uniqueness are improved.

Description

technical field [0001] The invention belongs to the technical field of Internet of Things device access control, and in particular relates to a method for identifying Internet of Things devices with two-stage multi-classification of network traffic fingerprint features. Background technique [0002] Fingerprint identification based on network traffic characteristics refers to the technology of identifying devices by extracting the values ​​related to individual devices in the network traffic of IoT devices as device characteristics. According to whether the acquisition method of traffic data is active detection or passive monitoring, device fingerprint technology can be divided into active and passive methods. Compared with traditional device authentication methods that rely on strong encryption protocols or complex authentication mechanisms, device fingerprint technology is simple and reliable, and is more suitable for IoT devices with limited physical and computing resourc...

AI Technical Summary

Problems solved by technology

[0005] Purpose of the invention: In order to overcome the problem that the existing equipment identification technology has low identification accuracy for the same series of equipment from the same manufacturer, the present invention provides a two-stage multi-classification IoT device identification method for network traffic fingerprint characteristics, which is used to solve the problem of IoT equipment in computing resources. Restricted, the problem of device authentication access when the authentication program cannot be installed

Images