A method for counting system terminal devices in NATed network based on optical network

Abstract

A method for counting system terminal devices in a NATed network based on an optical network belongs to the field of data communication. The method utilizes the high-speed transmission capability and low-latency characteristics of the optical network to monitor and count Windows system terminal devices in a home network in real time; the number of terminal devices is counted based on the rate of change of the IP‑ID sequence with the packet arrival time, and different terminal devices are accurately distinguished by analyzing the monotonicity of the IP‑ID field in the DNS request packet and the difference in the growth rate of the IP‑ID sequence between different devices. The present invention can effectively identify the number of terminal devices, enhance the operator's insight into user needs, and thus provide more personalized services and resource allocation solutions. At the same time, the present invention adopts a fixed pattern algorithm, which reduces the consumption of computing resources and speeds up the recognition speed. It is very suitable for the scenario of real-time terminal device number recognition, and further enhances the stability and reliability of the system.

Description

Technical Field

[0001] The invention belongs to the field of data communication, and in particular relates to a method for counting system terminal devices in a NATed network based on an optical network. Background Art

[0002] With the rapid development of smart home technology, the number of devices in home networks has shown explosive growth. These devices include but are not limited to smart TVs, smart speakers, smart cameras, smart home control systems, etc. The popularity of these devices not only improves the convenience of family life, but also puts higher requirements on home network bandwidth. Due to the large number of devices in home networks, home network operators usually adopt a more economical broadband allocation method, that is, network address translation (NAT) through routers. NAT technology can effectively alleviate the shortage of IPv4 address space while providing a certain degree of network security. However, while NAT technology provides convenience for home networks, it also brings an important problem: how to accurately identify and count terminal devices that access the Internet through NAT devices.

[0003] In traditional home broadband networks, operators usually assign a public IP address to each household and perform NAT operations through routers to map multiple devices in the home network to this public IP address. In this way, when receiving data, the server in the external network can only see a public IP address and cannot distinguish the specific device. In this case, it is difficult for operators to accurately count and profile the terminal devices in the home, which limits the operator's understanding of user behavior and the provision of personalized services. Summary of the invention

[0004] In order to solve this problem, the present invention proposes a method for counting Windows system terminal devices in a NATed (Network Address Translated) network based on an optical network. The method utilizes the high-speed transmission capability and low-latency characteristics of the optical network, and embeds a specific software module in the optical modem to achieve real-time monitoring and counting of home internal network devices. The software module can identify Windows system terminal devices that access the Internet through a NAT device and count the number of devices.

[0005] Through the method of the present invention, operators can achieve accurate counting of network devices within the home and provide accurate data support for user portraits. This not only helps operators better manage network resources and improve network efficiency, but also provides users with more personalized services, such as recommending corresponding service packages based on user usage habits, or providing more accurate advertising push.

[0006] The purpose of the present invention is:

[0007] Improve the granularity of home network portraits to help with precision marketing and user perception: In view of the widespread use of NAT due to the shortage of IPv4 addresses, the present invention invents a new method for calculating the number of terminal devices from the original multi-terminal mixed traffic, which can perform a more refined preference analysis on the terminal dimension, recommend corresponding packages, and help with precision marketing and existing customer management; in addition, it can also perform a more refined perception analysis of the network quality of the terminal, and the user's usage perception can be more refined to the terminal dimension.

[0008] In order to solve the above technical problems, the specific technical solution of the present invention is a method for counting system terminal devices in a NATed network under an optical network as follows:

[0009] A method for counting system terminal devices in a NATed network based on an optical network is provided for multiple Windows system devices connected to a single router and meets the following rules:

[0010] Rule 1: The IP-ID value of the DNS request packet of the device with the same Windows 7 system and earlier versions increases monotonically with the packet arrival time;

[0011] Rule 2: The IP-ID value of the DNS request packet of different Windows system devices has different rates of change with the packet arrival time;

[0012] Rule 3: Different devices have different initial IP-ID values.

[0013] The specific steps include:

[0014] Step 1: Preparation before sequence division: packet filtering;

[0015] Filter out the IP-ID sequence that meets the division rules from the original traffic mixed with multiple terminals; specifically, obtain the DNS request packets, each packet contains an IP-ID value, and combine the IP-ID value set into an original IP-ID sequence containing N values ​​according to the packet arrival time ;

[0016] Step 2: Initialization: Add the first point of the first sequence; take the first IP-ID value in the original IP-ID sequence S as the first partitioned IP-ID sequence The first value of , let k represent the number of subsequences divided by the original IP-ID sequence, then there is only k=1 divided IP-ID sequence at present, and the sequence Contains only 1 point;

[0017] Step 3: Divide the sequence set according to the number of sequence points; suppose there are k currently divided sequences: , the corresponding sequence points are ,in, represents the kth IP-ID sequence, and the corresponding sequence points are ; Each sequence is represented as a sequence pair consisting of packet arrival time and IP-ID value, formalized as follows:

[0018] ;

[0019] in, S i represents the i-th IP-ID sequence, Respectively represent the arrival time and IP-ID value of the i-th DNS request packet; Indicates the arrival time and IP-ID value of the DNS request packet corresponding to the last sequence point of the i-th IP-ID subsequence that has been divided; if all points of the original sequence have been classified at this time, that is, ,in, represents the sum of all sequence points of all k IP-ID subsequences that have been divided, is the number of sequence points of the ith IP-ID subsequence that has been divided (1<=i<=k), then the output value k and the corresponding k IP-ID distance sequence , the division process ends and the IP-ID sequence number is output;

[0020] Otherwise, split the k divided IP-ID sequences into two sets of sequences according to whether the sequence points are equal to 1. : ;

[0021] like If it is not an empty set, go to step 4;

[0022] Step 4: Multi-point sequences are divided by comparing the change rates;

[0023] The non-empty set with a sequence number greater than 1 extracted in step 3 , take out the latest IP-ID point (t m , v m ), where m is the serial number value of the first point in the original IP-ID sequence that has not been used for division, , t m , v m Indicates the arrival time and IP-ID value of the DNS request packet corresponding to the first point in the original IP-ID sequence that has not been used for classification, and calculates the current IP-ID point to be classified (t m , v m )and The slope of the last pair of time-series values ​​in each series :

[0024]

[0025] in, for middle The arrival time and IP-ID value of the DNS request packet corresponding to the last sequence point of each sequence;

[0026] Pick The current slope of each series is calculated from the last two pairs of time-series values ​​of each series in :

[0027] ;

[0028] for middle The arrival time and IP-ID value of the DNS request packet corresponding to the second-to-last sequence point of each sequence; Calculate Each sequence in and The slope ratio ; Set the slope threshold , if all slope ratios Neither within the slope threshold range If yes, go to step 5;

[0029] Otherwise, the current IP-ID point to be classified (t m , v m ) Add the sequence with the smallest slope change, and the subsequence number j of the new IP-ID point is determined by the following formula:

[0030]

[0031] Among them, argmin i Represents the argmin function;

[0032] Then go to step 3;

[0033] Step 5: The single point sequence is divided by distance comparison;

[0034] For the sequence points extracted in step 3 equal to 1 ,like If it is an empty set, go to step 6; otherwise, v of the current IP-ID point to be classified m and The difference between the IP-ID values ​​of each point in , set the distance threshold , if all Neither within the difference threshold range If it is within, go to step 6; otherwise, the current IP-ID point to be classified (t m , v m ) Add the closest sequence, go to step 3, and the added sequence number j is determined by the following formula:

[0035]

[0036] Step 6: Add the first point of the k+1th sequence;

[0037] The current IP-ID point to be classified (t m , v m ) is directly used as the k+1th sequence 1st point of ; go to step 3.

[0038] The division rules described in step 1 are as follows: the source IP address starts with 192.168.1, filtering the devices connected to the router; the TTL value is equal to 127, filtering the Windows system devices connected to the router; the target port is 53, filtering the DNS request packets; each DNS request packet corresponds to an IP-ID value.

[0039] The series with the smallest change in slope is determined by comparing the slope ratios The absolute difference between the two values ​​and 1, the sequence corresponding to the smallest difference is the sequence with the smallest slope change.

[0040] The beneficial effects of the method of the present invention are as follows:

[0041] 1. The present invention proposes an innovative terminal device identification method, which can construct a multi-dimensional feature vector by calculating the change rate of each device's IP-ID sequence and combining it with monotonicity judgment. Subsequently, these feature vectors are used for partitioning and analysis to achieve effective identification and classification of terminal devices. This method not only utilizes the law that the IP-ID value in the DNS request packet of the Windows system device increases monotonically with the packet arrival time (i.e., law 1), but also deeply considers the differences in the growth change rate of the IP-ID sequence between different devices. By simultaneously analyzing the monotonicity and change rate of the IP-ID sequence, the present invention can more finely distinguish different terminal devices, significantly improving the accuracy and effect of terminal device number recognition.

[0042] 2. Different from the traditional recognition method based on machine learning model, the present invention adopts a fixed mode algorithm to process IP-ID sequence data. This algorithm is simple in design and low in computational complexity. It can significantly reduce the consumption of computing resources and speed up the recognition speed. It is very suitable for the scene of real-time terminal device number recognition. The fixed mode algorithm can judge the characteristics of IP-ID sequence, such as monotonicity and rate of change, by preset rules and logic, without complex model training and parameter adjustment. At the same time, by optimizing the algorithm flow and data structure, the execution efficiency of the algorithm can be further improved to ensure that it can work stably and accurately in scenes with high real-time requirements.

[0043] 3. Applicable to enterprises, can be implemented and deployed in batches; the method of the present invention further enhances the compatibility and stability of the system. By optimizing the algorithm design and considering the IP-ID sequence characteristics of Windows system devices, it can easily adapt to terminal devices of other operating systems (such as Linux, macOS, etc.), thereby realizing the cross-platform terminal device number recognition capability. This design enables the application to be widely deployed in a variety of network environments, effectively improving the compatibility and adaptability of the overall system. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 The figure is a flow chart of a method according to an embodiment of the present invention.

[0045] Figure 2 The original IP-ID sequences of the three laptop devices.

[0046] Figure 3 This is the IP-ID sequence division diagram of 3 laptop devices.

[0047] Figure 4 Divide the subgraphs into the IP-ID sequences of the three laptop devices, where Figure 4 (a) in the equation is the slope of device 1, Figure 4 (b) in the figure is the slope of device 2, Figure 4 (c) in FIG. 3 is the slope of device 3. DETAILED DESCRIPTION

[0048] In order to better understand the purpose, structure and function of the present invention, the following is a further detailed description of a method for counting terminal devices of a Windows system in a NATed network under an optical network in conjunction with the accompanying drawings.

[0049] The present invention is based on the existence of a certain relationship between certain specific fields and specific terminals, and analyzes and sequence-divides the IP identification (IP-ID) field in the IPv4 protocol of the network layer in the original data traffic. The IP-ID field is mainly used to identify each IP datagram and its fragment. This field is a 16-bit counter. Whenever the IP software generates a new datagram, the counter will increase and assign this value to the ID field. This mechanism ensures the uniqueness of the datagram during network transmission. When a large IP datagram needs to be divided into multiple small data fragments (fragments) for transmission, these fragments will copy the Identification (IP identification) field value of the original datagram so that they can be reassembled into the original datagram on the destination host according to this field value. In addition, this field also helps to identify and track specific datagrams in network monitoring and analysis, as well as detect and prevent packet duplication and replay attacks. The IP-ID field plays an important role in datagram transmission, reassembly and network security.

[0050] A method for counting terminal devices of Windows system in NATed network under optical network, the method flow is as follows Figure 1 As shown, the specific steps include:

[0051] First, for the scenario of multiple Windows system devices connected to a single router, based on a large number of experimental observations, the following three rules are obtained as the prerequisites for the sequence division method:

[0052] Rule 1: The IP-ID value of the DNS (Domain Name Server) request packet of the same Windows 7 system (and earlier versions) device increases monotonically with the packet arrival time.

[0053] Rule 2: The IP-ID value of the DNS request packet of different Windows system devices changes at different rates with the packet arrival time.

[0054] Rule 3: Different devices have different startup times. The startup times of different devices in the same home will not be exactly the same at the same time, so different devices have different initial IP-ID values.

[0055] The existing terminal identification method based on IP-ID sequence division method mainly divides the Windows system by using Rule 1 "the IP-ID value of the DNS request packet of the Windows system device increases monotonically with the packet arrival time", without considering that the IP-ID sequences of different devices also have different rates of change with packet time, resulting in poor division effect.

[0056] By extracting the IP-ID field of the DNS request packet in the original multi-terminal mixed traffic and dividing it according to the different change rates of the IP-ID with the packet arrival time, each merged IP-ID sequence after division corresponds to a terminal device, and the number of different Windows system devices can be distinguished and calculated. The specific calculation process is as follows:

[0057] Step 1: Preparation before sequence division: packet filtering;

[0058] Filter out the IP-ID sequences that meet the division rules from the original traffic mixed with multiple terminals. The specific rules are as follows:

[0059] (1) The source IP address starts with 192.168.1, filtering the devices connected to the router;

[0060] (2) The TTL value is equal to 127, filtering Windows system devices connected to the router;

[0061] (3) Target port 53, filtering DNS request packets.

[0062] Each data packet (including DNS request packets) corresponds to an IP-ID value. The IP-ID value set is combined into an original IP-ID sequence containing N values ​​according to the packet arrival time. .

[0063] Step 2: Initialization: add the first point of the first sequence;

[0064] Filter out all DSN request packets from step 1 to form the original IP-ID sequence S (the original IP-ID sequence is represented by S, and S plus a numerical subscript represents a subsequence divided from the original IP-ID sequence). Take the first (corresponding to the minimum timestamp) IP-ID value as the first subsequence of the IP-ID sequence. Let k represent the number of subsequences divided by the original IP-ID sequence. Currently, there are only k=1 subsequences divided. Contains only 1 point.

[0065] Step 3: Divide the sequence set according to the number of sequence points;

[0066] Assume that there are k currently divided sequences: , the corresponding sequence points are ,in, represents the kth IP-ID sequence, and the corresponding sequence points are ; Each sequence can be represented as a sequence pair consisting of packet arrival time and IP-ID value, where S i represents the i-th IP-ID sequence, Respectively represent the arrival time and IP-ID value of the i-th DNS request packet, Indicates the arrival time and IP-ID value of the DNS request packet corresponding to the last sequence point of the i-th IP-ID subsequence:

[0067]

[0068] If all points in the original sequence have been classified at this time, that is, ,in, represents the sum of all sequence points of all k IP-ID subsequences that have been divided, is the number of sequence points of the ith IP-ID subsequence that has been divided (1<=i<=k), then the output value k and the corresponding k IP-ID distance sequence , the division process ends and the IP-ID sequence number is output. Otherwise, the k divided IP-ID sequences are split into two sets of sequence sets according to whether the sequence points are equal to 1. : .like If it is not an empty set, go to step 4.

[0069] Step 4: The multi-point sequence is divided by comparing the change rate; in this embodiment, the change rate is the slope;

[0070] The non-empty set with a sequence number greater than 1 extracted in step 3 , take out the latest IP-ID point from the original sequence S ( t m , v m ) (the mth point, m is the sequence number value of the first point remaining in the original IP-ID sequence (not yet used for division), ) points, among which, t m , v m Indicates the arrival time and IP-ID value of the DNS request packet corresponding to the first point remaining in the original IP-ID sequence (not yet used for classification), and calculates the current IP-ID point to be classified ( t m , v m )and The slope of the last pair of time-series values ​​in each series :

[0071]

[0072] in, for middle The arrival time and IP-ID value of the DNS request packet corresponding to the last sequence point of each sequence.

[0073] Pick The current slope of each series is calculated from the last two pairs of time-series values ​​of each series in :

[0074]

[0075] for middle The arrival time and IP-ID value of the DNS request packet corresponding to the second-to-last sequence point of each sequence; Calculate Each sequence in and The slope ratio . Set the slope threshold , if all slope ratios Neither within the slope threshold range [h 1 , h 2 ] If it is within, go to step 5; otherwise, the current IP-ID point to be classified ( t m , v m ) Add the sequence corresponding to the smallest slope change by comparing The absolute difference with 1, the sequence corresponding to the smallest difference is the sequence with the smallest slope change, so that the slope of each IP-ID sequence can be kept as fixed as possible. The sequence added to the current IP-ID point to be classified is determined by the following formula, where j is the subsequence number of the new IP-ID point, and then go to step 3:

[0076]

[0077] Among them, argmin i Represents the argmin function;

[0078] Step 5: The single point sequence is divided by distance comparison;

[0079] Set the number of sequence points extracted in step 3 to 1 ,like If it is an empty set, go to step 6, otherwise the current IP-ID point to be classified v m and The difference between the IP-ID values ​​of each point in , set the distance threshold , if all Neither within the difference threshold range [0, h 3 ] If it is within, go to step 6; otherwise, the current IP-ID point to be classified ( t m , v m ) to join the closest sequence. Go to step 3.

[0080] The sequence j to be added to the current IP-ID point to be classified is determined by the following formula:

[0081]

[0082] Step 6: Add the first point of the k+1th sequence;

[0083] The IP-ID point to be classified ( t m , v m ) is directly used as the k+1th sequence 1st point of ; go to step 3.

[0084] Experimental verification:

[0085] Scenario: An optical modem is connected to a router, and the router is connected to 3 laptops. The router mirror is used to collect data for 15 minutes, about 1 million data packets, and a total of 54 original IP-ID values ​​are obtained through data packet filtering rules. The original IP-ID sequence value-packet arrival time trend is as follows Figure 2 As shown, Figure 2 The original IP-ID sequence consisting of all DSN request packets filtered out in step 1 is shown, where the horizontal axis represents the packet arrival time, the vertical axis represents the IP-ID value, and the circles in the figure represent the IP-ID points;

[0086] Setting the Threshold , through the IP-ID sequence division, 3 different device numbers are obtained, which is the same as the actual number of devices. The IP-ID sequence corresponding to the 3 devices is as follows Figure 3 and Figure 4 As shown, Figure 4 (a), (b), and (c) represent the rate of change (i.e., slope) of the IP-ID value of device 1, device 2, and device 3 over time, respectively.

[0087] Figure 3The three colors represent three different terminal devices (laptop computers). The devices represented by green and blue have obvious differences in IP-ID values ​​and the rate of change over time (slope), while the devices represented by orange and blue have numerical differences. Therefore, it can be seen from the figure that the IP-ID sequence partitioning algorithm invented by the present invention can better distinguish the IP-ID sequences of different devices, thereby obtaining the accurate number of terminal devices attached to the router.

[0088] It is to be understood that the present invention is described by some embodiments, and it is known to those skilled in the art that various changes or equivalent substitutions may be made to these features and embodiments without departing from the spirit and scope of the present invention. In addition, under the teachings of the present invention, these features and embodiments may be modified to adapt to specific circumstances and materials without departing from the spirit and scope of the present invention. Therefore, the present invention is not limited by the specific embodiments disclosed herein, and all embodiments falling within the scope of the claims of this application are within the scope of protection of the present invention.

Claims

1. A method for counting system terminal devices in a NATed network based on an optical network, characterized in that: The following steps are involved: Step 1: Preparation before sequence division: packet filtering; Filter out IP-ID sequences that meet the division rules from the original traffic mixed by multiple terminals; specifically, obtain DNS request packets, each packet contains an IP-ID value, and combine the IP-ID value set into an original IP-ID sequence S containing N values ​​according to the packet arrival time; Step 2: Initialization: add the first point of the first sequence; take the first IP-ID value in the original IP-ID sequence S as the first value of the first divided IP-ID sequence S1, let k represent the number of subsequences divided by the original IP-ID sequence, then there are only k=1 divided IP-ID sequences at present, and the sequence S1 contains only 1 point; Step 3: Divide the sequence set according to the number of sequence points; suppose there are k sequences currently divided: S1, ..., S k , the corresponding sequence points are N1,...,N k , where S k Represents the kth IP-ID sequence, and the corresponding sequence point number is N k ; Each sequence is represented as a sequence pair consisting of packet arrival time and IP-ID value, formalized as follows: Among them, S i represents the ith IP-ID sequence, t i，1 , v i，1 Respectively represent the arrival time and IP-ID value of the i-th DNS request packet; Indicates the arrival time and IP-ID value of the DNS request packet corresponding to the last sequence point of the i-th IP-ID subsequence that has been divided; if all points of the original sequence have been classified at this time, that is, Where N represents the total number of sequence points of all k IP-ID subsequences that have been divided, N i is the number of sequence points of the ith IP-ID subsequence that has been divided, 1<=i<=k, then the output value k and the corresponding k IP-ID distance sequences S1,...,S k , the division process ends and the IP-ID sequence number is output; Otherwise, the k divided IP-ID sequences are split into two sequence sets A1 and A2 according to whether the sequence points are equal to 1: A1 = {S l |N l >1, l=1,...,k}, A2={S l |N l =1, l=1, ..., k}; If A1 is not an empty set, go to step 4; Step 4: Multi-point sequences are divided by comparing the change rates; Take the non-empty set A1 with a sequence number greater than 1 extracted in step 3, and take the latest IP-ID point (t m , v m ), where m is the sequence number value of the first point in the original IP-ID sequence that has not been used for division, t m , v m Indicates the arrival time and IP-ID value of the DNS request packet corresponding to the first point in the original IP-ID sequence that has not been used for classification, and calculates the current IP-ID point to be classified (t m , v m ) and the slope a′ of the last pair of time-series values ​​of each series in A1 i : in, is the arrival time and IP-ID value of the DNS request packet corresponding to the last sequence point of each sequence i=1,...,|A1| in A1; Take the last two pairs of time-series values ​​for each series in A1 and calculate the current slope ai of each series: is the arrival time and IP-ID value of the DNS request packet corresponding to the second to last sequence point of each sequence in A1 i=1,...,|A1|; calculate a′ corresponding to each sequence in A1 i with a i The slope ratio Set the slope thresholds h1, h2, 0≤h1<h2, if all slope ratios b i , i=1, ..., |A1| is not within the slope threshold range [h1, h2], then go to step 5; Otherwise, the current IP-ID point to be classified (t m , v m ) adds the sequence with the smallest slope change, and the subsequence number j newly assigned to the IP-ID point is determined by the following formula: Among them, argmin i Represents the argmin function; Then go to step 3; Step 5: The single point sequence is divided by distance comparison; For A2 with the number of sequence points equal to 1 extracted in step 3, if A2 is an empty set, go to step 6; otherwise, the v of the current IP-ID point to be classified m The difference between the IP-ID values ​​of each point in A2 Set the distance threshold h3, h3>0, if all d i , i=1, ..., |A1| is not within the difference threshold range [0, h3], then go to step 6; otherwise, the current IP-ID point to be classified (t m , v m ) Add the closest sequence, go to step 3, and the added sequence number j is determined by the following formula: Step 6: Add the first point of the k+1th sequence; The IP-ID point (t m , v m ) is directly used as the k+1th sequence S k+1 1st point of ; go to step 3.

2. According to claim 1, a method for counting system terminal devices in a NATed network based on an optical network is characterized in that: The classification rules described in step 1 are as follows: if the source IP address starts with 192.168.1, the devices connected to the router are filtered; if the TTL value is equal to 127, the Windows system devices connected to the router are filtered; Target port 53, filtering DNS request packets; each DNS request packet corresponds to an IP-ID value.

3. A method for counting system terminal devices in a NATed network based on an optical network according to claim 2, characterized in that: The series with the smallest change in slope is determined by comparing the slope ratios b i The absolute difference between the two values ​​and 1, the sequence corresponding to the smallest difference is the sequence with the smallest slope change.

4. A method for counting system terminal devices in a NATed network based on an optical network according to claim 3, characterized in that: The method is targeted at scenarios where multiple Windows system devices are connected to a single router and meet the following rules: Rule 1: The IP-ID value of the DNS request packet of the device with the same Windows 7 system and earlier versions increases monotonically with the packet arrival time; Rule 2: The IP-ID value of the DNS request packet of different Windows system devices changes at different rates with the packet arrival time; Rule 3: Different devices have different initial IP-ID values.

5. A method for counting system terminal devices in a NATed network based on an optical network according to claim 4, characterized in that: The thresholds h1=0.12, h2=10, and h3=1000.

Images