IoT Device Identification Method Based on Packet Length Probability Distribution and K-Nearest Neighbor Algorithm

Abstract

The invention belongs to the technical field of computer network management, and in particular relates to an Internet of Things device identification method based on packet length probability distribution and k-nearest neighbor algorithm. In this method, on the basis of fully mining the traffic characteristics of different Internet of Things devices, the length probability distribution of network data packets generated by communication devices within a certain period of time is used as a single feature, and a classifier based on the k-nearest neighbor algorithm is further designed. Nearest Neighbor Algorithm A system for classifying and identifying the type of source device generating traffic, especially specific IoT device types. This method can effectively distinguish whether the source device generating traffic is an IoT device and which known specific device type it is. Compared with existing methods for similar tasks, the present invention not only achieves higher recognition accuracy, but also achieves performance indicators such as operating efficiency, robustness, scalability, and adaptability to special scenarios. uplifted.

Description

technical field [0001] The invention belongs to the technical field of computer network management, and in particular relates to a device identification method for the Internet of Things based on a packet length probability distribution and a k-nearest neighbor algorithm. Background technique [0002] With the rapid development of IoT technology, various types of IoT devices have been deployed in various fields of human production and life, such as smart homes, smart cities, and industrial control systems. While bringing great convenience, the use of IoT devices also brings new challenges to network management. Unlike general-purpose Internet-connected devices such as smartphones and laptops, IoT devices usually have only limited computing and communication capabilities, so they require customized network management policies such as resource allocation and reservation, quality of service management, access control and Anomaly detection, etc. Taking a specific scenario as a...

AI Technical Summary

Problems solved by technology

However, existing methods tend to extract various types of features from traffic, and many features rely on in-depth inspection and matching of packet loads, making the system less efficient and consuming more computing resources

[0005] 2. Robustness: Many existing methods are evaluated in a relatively pure network environment. In the actual network environment, various types of equipment that are easily confused are like different types of equipment produced by manufacturers and equipment produced by different manufacturers. Devices of the same type, as well as the scanning traffic generally present in the network, etc., may rigidly identify the performance of the system

[0006] 3. Scalability: The Internet of Things technology is still in rapid development, which means that new types of devices will continue to appear. In addition, the types of devices that have been deployed may also be misunderstood as security risks

However, many current device identification methods use supervised machine learning methods, which need to be retrained and replace the original system every time they are updated.

Another type of method adopts the way of training a binary classifier for each device, however, this method still requires an additional training process, and requires additional processing when different classifiers give contradictory results

Images