Cross-channel and environment-adaptive Internet of Things equipment identification method and system

Abstract

The invention discloses a cross-channel and environment-adaptive Internet of Things equipment identification method and system, and relates to the technical field of equipment identification, and the method comprises the steps: carrying out the multi-channel flow collection based on a dynamic channel optimization strategy, and obtaining the flow data of each piece of equipment; distributing the traffic data into independent data streams corresponding to each device according to the source MAC address, and performing feature extraction on each independent data stream to obtain an original device fingerprint; inputting the original device fingerprint into the trained fingerprint aligner for alignment, and outputting an aligned device fingerprint; inputting the fingerprint of the aligned equipment into a dichotomy model for identification, and outputting an identification result; and if the identification result is the Internet of Things equipment, inputting the fingerprint of the aligned equipment into a multi-classification model for identification, and outputting the specific type of the equipment. The method can overcome the influence of multi-channel and environment difference in an unknown wireless network environment, and can effectively recognize the hidden Internet of Things equipment.

Description

Technical Field

[0001] This invention relates to the field of device identification technology, and in particular to a cross-channel, environment-adaptive Internet of Things (IoT) device identification method and system. Background Technology

[0002] The statements in this section are merely background information relating to this disclosure and do not necessarily constitute prior art.

[0003] With the widespread application of IoT technology, the number of IoT devices worldwide has reached tens of billions. While providing convenient services, IoT devices also bring the risk of privacy leaks. Especially in unfamiliar environments involving personal privacy, such as hotels, guesthouses, and changing rooms, IoT devices that illegally collect personal privacy data may be hidden, such as concealed cameras and eavesdropping devices. These devices transmit the collected privacy data to attackers wirelessly, seriously infringing on users' personal privacy rights.

[0004] Existing IoT device detection technologies are mainly divided into two categories: physical characteristic-based detection methods and network traffic analysis-based detection methods. Physical characteristic-based detection methods rely on identifying specific physical features of devices for detection, and mainly include the following approaches: First, detecting abnormal transmission devices by detecting radio frequency signals in specific frequency bands; however, this method cannot distinguish between normal and malicious devices, resulting in a high false alarm rate. Second, detecting camera lens reflections using optical reflection principles; however, this is limited to optical equipment and requires specific lighting conditions. Third, identifying electronic devices through millimeter-wave scanning; however, this requires expensive dedicated hardware. These methods generally suffer from limitations such as limited detection range, susceptibility to environmental interference, and the need for dedicated hardware; they can only detect specific types of devices and cannot effectively identify a wide range of IoT devices.

[0005] Network traffic analysis-based detection methods identify devices by analyzing their network communication characteristics. Since IoT devices commonly use wireless communication methods such as Wi-Fi, this approach offers the advantage of non-intrusive detection. However, with the widespread adoption of encryption technologies such as WPA2 and WPA3, traditional payload-based deep packet inspection techniques have become ineffective. Current research largely shifts towards machine learning techniques, analyzing protocol field features, packet timing characteristics, and traffic statistics of 802.11 data frames to identify devices. While these methods avoid the need for decryption, they still have significant limitations: First, in encrypted network environments, the available feature dimensions are greatly reduced, making it difficult to extract highly discriminative traffic features. Second, in unknown network environments, it is impossible to determine the operating channel of hidden devices, and the multi-channel nature of Wi-Fi networks means that a single network interface card (NIC) cannot simultaneously monitor all channels; multi-NIC solutions also introduce problems such as high cost and synchronization difficulties. Finally, existing identification models heavily rely on the network environment conditions during training, exhibiting poor generalization ability under different network configurations, signal strengths, and network topologies, resulting in a significant decrease in identification accuracy.

[0006] In summary, existing IoT device detection technologies suffer from three main problems: difficulty in extracting effective features in encrypted environments, low detection efficiency in multi-channel environments, and insufficient model generalization ability across environments. These limitations severely restrict the application effectiveness of IoT device detection technologies in real-world scenarios. Summary of the Invention

[0007] To overcome the shortcomings of the prior art, the present invention provides a cross-channel, environment-adaptive IoT device identification method and system, which can effectively identify hidden IoT devices in unknown wireless network environments by overcoming the influence of multiple channels and environmental differences.

[0008] To achieve the above objectives, one or more embodiments of the present invention provide the following technical solutions: In a first aspect, the present invention provides a cross-channel, environment-adaptive method for identifying Internet of Things (IoT) devices, comprising: Multi-channel traffic acquisition is performed based on dynamic channel optimization strategies to obtain traffic data for each device. Traffic data is split into independent data streams corresponding to each device based on the source MAC address, and features are extracted from each independent data stream to obtain the original device fingerprint; The original device fingerprint is input into the trained fingerprint aligner for alignment, and the aligned device fingerprint is output. The aligned device fingerprint is input into a binary classification model for identification, and the identification result is output. If the identification result is an IoT device, the aligned device fingerprint is input into a multi-classification model for identification, and the specific device type is output.

[0009] A further technical solution involves multi-channel traffic acquisition based on a dynamic channel optimization strategy, specifically as follows: An improved greedy algorithm is used to make channel selection decisions and obtain the acquisition channel; Multi-channel traffic is collected based on a defined acquisition channel to obtain multi-channel traffic data; Based on multi-channel traffic data, the operating channel of the device is determined according to the data frame frequency, and data frames collected from other non-operating channels are filtered out to obtain traffic data. After each collection cycle ends, the reward value for each channel is updated, and the next collection cycle begins, until the end.

[0010] A further technical solution, wherein the channel selection decision using the improved greedy algorithm is specifically as follows: obtain a random number; when the random number is less than or equal to the exploration probability, randomly select a channel for collection; when the random number is greater than the exploration probability, select the channel with the highest reward value for collection.

[0011] A further technical solution is that the original device fingerprint includes packet length distribution characteristics, temporal dynamic characteristics, and basic frame number characteristics.

[0012] A further technical solution involves training the fingerprint aligner using a network environment simulator and a network environment discriminator, the process of which is as follows: Third-party traffic is input into the network environment simulator, and network environment parameters are preset. The network environment variation is simulated through the protocol stack to obtain simulated traffic data with network environment parameter labels. The network environment discriminator is trained based on simulated traffic data with network environment parameter labels to obtain a trained network environment discriminator. The original device fingerprint is extracted from the simulated traffic data with network environment parameter labels. The fingerprint aligner is trained by combining the standard network environment parameters and the predicted network environment parameters output by the trained network environment discriminator.

[0013] A further technical solution is that the loss function of the network environment discriminator is:

[0014] in, Represents the actual network environment parameters that drive traffic. This represents the predicted network environment parameters output by the network environment discriminator. , , , For the sub-loss weight, Indicates mean square error. Represents the binary cross-entropy. Denotes KL divergence, This indicates a normal distribution.

[0015] A further technical solution is that the loss function of the fingerprint aligner is:

[0016] in, Indicates the loss weight. Indicates the original device fingerprint. This indicates the reconstruction of the fingerprint. Indicates standard network environment parameters. This represents the predicted network environment parameters of the aligned device fingerprint output by the network environment discriminator.

[0017] Secondly, the present invention provides a cross-channel, environment-adaptive Internet of Things (IoT) device identification system, comprising: The data acquisition module is configured to: perform multi-channel traffic acquisition based on a dynamic channel optimization strategy to obtain traffic data from each device; The feature extraction module is configured to: split traffic data into independent data streams corresponding to each device based on the source MAC address, extract features from each independent data stream, and obtain the original device fingerprint; The network alignment module is configured to: input the original device fingerprint into a trained fingerprint aligner for alignment, and output the aligned device fingerprint; The type recognition module is configured to: input the aligned device fingerprint into a binary classification model for recognition and output the recognition result; if the recognition result is an IoT device, then input the aligned device fingerprint into a multi-classification model for recognition and output the specific type of the device.

[0018] Thirdly, the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of a cross-channel, environment-adaptive Internet of Things device identification method as described in the first aspect.

[0019] Fourthly, the present invention provides a computer device including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of a cross-channel, environment-adaptive Internet of Things device identification method as described in the first aspect.

[0020] The above one or more technical solutions have the following beneficial effects: This invention achieves efficient acquisition of network traffic in unknown wireless network environments through cross-channel high-efficiency acquisition and working channel authentication technology, improving the efficiency of multi-channel traffic acquisition. Furthermore, it uses only packet length distribution features, temporal dynamic features, and basic frame number features as device fingerprints to adapt to encrypted traffic environments. The fingerprint alignment operation maps traffic features from different network environments to a preset standard network environment, enabling the classification model to have adaptive capabilities in diverse heterogeneous network environments. The above steps together achieve efficient and accurate identification of hidden IoT devices in unknown wireless network environments. Attached Figure Description

[0021] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.

[0022] Figure 1 This is a flowchart of a cross-channel, environment-adaptive IoT device identification method according to an embodiment of the present invention; Figure 2 This is a flowchart of the device fingerprint aligner training process according to an embodiment of the present invention. Detailed Implementation

[0023] It should be noted that the following detailed descriptions are exemplary and intended to provide further illustration of the invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0024] It should be noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of exemplary embodiments according to the invention. As used herein, the singular form is intended to include the plural form as well, unless the context clearly indicates otherwise. Furthermore, it should be understood that when the terms "comprising" and / or "including" are used in this specification, they indicate the presence of features, steps, operations, devices, components, and / or combinations thereof.

[0025] Where there is no conflict, the embodiments and features in the embodiments of the present invention can be combined with each other.

[0026] Example 1 like Figure 1 As shown in the figure, this embodiment discloses a cross-channel, environment-adaptive IoT device identification method, which includes the following steps: S1: Multi-channel traffic acquisition is performed based on dynamic channel optimization strategy to obtain traffic data of each device; In this embodiment, an innovative dynamic channel optimization strategy is used to collect wireless traffic, and adaptive coverage of all 13 channels in the 2.4GHz band is achieved through a single wireless network card.

[0027] S101: Adopting an improved version - A greedy algorithm is used to make channel selection decisions and acquire the acquisition channel.

[0028] During the initialization phase, the data acquisition time window is set. Seconds (the experimentally verified optimal equilibrium value), and configure the initial value of the exploration probability. and decay function Where t is the current acquisition period. At the beginning of each acquisition period, the system performs a channel selection decision: obtaining a random number between 0 and 1. ,when At that time, to explore probability Randomly selecting channels for data acquisition (referred to as exploratory acquisition) aims to discover new devices. In this case, the channel with the highest reward value is selected for collection (this is called utilization collection).

[0029] The "utilization" in exploitative acquisition refers to using the reward value to select an optimal channel (which may have more devices and network traffic). However, the reward value is calculated based on previous acquisition data, which may lead to repeated acquisition of previously acquired channels. Therefore, it is necessary to explore and acquire other channels. Both methods are only for selecting an acquisition channel, and there is no difference in the subsequent acquisition process.

[0030] Channel Rewards Defined in the channel Device reward value for all devices in internal communication The maximum value, where This indicates the probability that the device will send data packets, specifically:

[0031] in, This indicates the cumulative number of times the device has recognized an object. Indicates the threshold. This indicates the frequency of data frames collected by the device, when the period... The number of data frames acquired from the device is ,but Its initial value . ( When the effective recognition threshold set for the experiment is reached, its reward value is reset to zero, with the aim of increasing the reward for other unrecognized items. The probability of data collection by the device.

[0032] S102: Perform multi-channel traffic acquisition based on the determined acquisition channel to obtain multi-channel traffic data.

[0033] During the data acquisition process, the system uses precise time control to achieve multi-channel round-robin monitoring. Whenever the wireless network card switches to the selected channel, a 5-second continuous listening window is activated to fully record the 802.11 data frames (traffic data) within that time period.

[0034] S103: Based on multi-channel traffic data, determine the device's working channel according to the data frame frequency, filter out data frames collected from other non-working channels, and obtain traffic data.

[0035] After data acquisition, the system proceeds to the working channel determination phase: For each detected device (identified by its source MAC address), the system statistically analyzes the frequency distribution of its data frames across 13 channels. The working channel is determined by the number of data frames (data frame frequency) collected by the device in each channel. The channel with the most data frames is identified as the device's working channel; in other words, the channel with the highest frequency is identified as the device's true working channel. For example, if a device's frame frequency on channel 6 reaches 0.85, channel 6 is determined to be its working channel. Simultaneously, data frames collected from other channels are filtered out, completely eliminating interference traffic caused by channel overlap (such as the spectral overlap between channels 5 and 7).

[0036] After each round of data collection, the system performs a statistical analysis. The statistical data frames include all data frames collected by each device during all the data collection processes that have been performed. For example, for a device... Its channel The number of all data frames collected is , Initially set to 0, after each round of data collection, if the channel selected for that round of data collection is... Furthermore, during this data collection, the equipment used for data collection... The number of data frames is ,but Otherwise, it remains unchanged.

[0037] The 802.11 protocol specifies that 14 wireless network communication channels are allocated in the 2.4 GHz band. In most countries and regions, 13 of these channels are used for communication. For example, China selects channels 1 to 13.

[0038] S104: After each collection cycle ends, the reward value of each channel is updated, and the next collection cycle begins, until the preset collection time ends or is manually stopped. This closed-loop optimization mechanism forms an adaptive collection-update cycle.

[0039] S2: Based on the source MAC address, traffic data is split into independent data streams corresponding to each device, and features are extracted from each independent data stream to obtain the original device fingerprint; In this embodiment, after completing multi-channel traffic acquisition, the system enters the device fingerprint extraction stage. This step constructs an environment-robust device feature vector from the preprocessed 802.11 data frames (traffic data), providing a basis for subsequent classification. Preprocessing involves determining the working channel and filtering out the device data frames collected from other non-working channels to obtain the traffic data.

[0040] S201: The traffic data is split according to the source MAC address to obtain an independent data stream corresponding to each device.

[0041] Traffic data is split according to the source MAC address, i.e., data stream aggregation, which combines all data frames from the same device within a single time window (set to 5 seconds in this embodiment) into an independent data stream.

[0042] S202: Extract features from the independent data stream corresponding to each device to obtain the original device fingerprint.

[0043] For each device's independent data stream, 15-dimensional statistical features are extracted to form the original device fingerprint. The 15-dimensional features include three core indicators: packet length distribution features, temporal dynamic features, and basic frame count features. Packet length distribution features include the sum, maximum value, minimum value, range, median, mean, and standard deviation, which are used to capture the device's inherent communication patterns. Temporal dynamic features include the total stream duration, maximum and minimum packet intervals, range, median, mean, and standard deviation, which are used to reflect the temporal regularity of the device's packet sending behavior. The basic frame count feature is the total number of data frames, which is used to quantify the device's activity level.

[0044] It is important to note that all features are generated solely based on the 802.11 data link layer frame header information, completely avoiding the parsing of the encrypted payload content. For example, packet length statistics are directly derived from the Length field of the 802.11 frame header, and timing features are calculated using the difference in frame timestamps. This design makes the invention compatible with fully encrypted environments such as WPA2 / WPA3, while preserving the essential characteristics of device behavior.

[0045] S3: Input the original device fingerprint and standard network environment parameters into the trained fingerprint aligner for alignment, and output the aligned device fingerprint; In this embodiment, the core of the fingerprint alignment step is to utilize a pre-trained fingerprint aligner to eliminate the impact of network heterogeneity through environment decoupling technology, which is a key innovation for improving the device's cross-environment recognition generalization ability. The training process of the fingerprint aligner requires the use of the network environment simulator and environment discriminator carefully designed in this invention. The training process is as follows: Figure 2 As shown.

[0046] S301: Input third-party TCP traffic into the network environment simulator, preset environment parameters, simulate network environment variations through the protocol stack, and obtain simulated traffic data with environment labels.

[0047] The network environment simulator is a simulation algorithm implemented in Python to simulate network communication processes based on the TCP / IP protocol stack. However, it simplifies many details of the real communication process, implementing only the core mechanisms of the TCP / IP protocol stack, including but not limited to: data transmission, acknowledgment, flow control, and retransmission mechanisms in the TCP protocol; packet loss and communication delays at the network layer.

[0048] The network environment simulator uses a configurable protocol stack to simulate variations in a real network environment. Its input source is third-party TCP traffic, and it controls network behavior through a preset network environment parameter tuple. In other words, as a simple simulation of the TCP / IP protocol stack, the network environment simulator can acquire a large amount of third-party traffic, replay this traffic under preset network environment parameters (i.e., a series of various network environment parameters), and obtain a simulated version of this traffic under the preset network environment parameters. This results in a large dataset of traffic labeled with network environment parameters, which is used to train a network environment discriminator.

[0049] Specifically, the maximum segment size (MSS) is set to 536 or 1460 bytes to simulate different MTU configurations; the Nagle algorithm enables a state-controlled small packet merging strategy; the packet loss rate (PLR) is uniformly distributed between 0.1% and 5% to simulate network stability differences; transmission delay distribution parameters include average one-way delay (AoD) and standard deviation (SoD), with values ​​of 10-100ms and 1-20 respectively to cover different network congestion scenarios. This simulator implements ordered transmission and congestion control mechanisms at the transport layer, randomly discards data packets according to the packet loss rate at the network layer, and injects normally distributed delays at the physical layer, ultimately generating an 802.11 simulated traffic dataset labeled with network environment parameters. Each sample in the traffic dataset contains a device fingerprint (i.e., the statistical characteristics of the simulated traffic) and a network environment parameter label.

[0050] like Figure 2 As shown, the network environment simulator is used to generate a dataset, which is used to train the network environment discriminator and the device fingerprint aligner. The network environment discriminator is used to train the fingerprint aligner. The simulated traffic dataset with network environment parameter labels generated by the network environment simulator is divided into two parts: one part is used to train the network environment discriminator, and the other part is used to train the fingerprint alignment.

[0051] S302: Input simulated traffic data with environmental labels into the network environment discriminator, and train the device fingerprint aligner based on the loss function of predicted environmental parameters and network environment parameters.

[0052] The network environment discriminator is a deep neural network model, implemented using Python and PyTorch, and adopts an existing network structure, which will not be elaborated further here.

[0053] The network environment discriminator is specifically designed to identify the environmental parameters of traffic. The original device fingerprint is input into the discriminator (a deep neural network), which outputs predicted network environment parameters. The discriminator is trained under supervision using a simulated traffic dataset labeled with these network environment parameters, resulting in a well-trained discriminator. The innovation lies in its multi-task loss function, which compares the predicted network environment parameters with the network environment parameter labels.

[0054] Specifically: mean squared error loss is used for continuous parameters MSS and PLR; cross-entropy loss is used for the binary parameter Nagle; and KL divergence is used to measure the difference between the predicted and actual distributions for transmission delay. In particular, the loss function of the environment discriminator... Defined as:

[0055] in, These are real network environment parameters for traffic. ; The predicted network environment parameters output by the network environment discriminator. , , , , For the sub-loss weight, Indicates mean square error. Indicates the maximum segment length. Indicates the predicted maximum segment length. Represents the binary cross-entropy. Indicates the Nagle algorithm is enabled. Indicates the predicted Nagle algorithm activation status. Indicates packet loss rate. This represents the predicted packet loss rate. Indicates the KL divergence. Indicates the average one-way delay. Indicates standard deviation, Indicates a normal distribution. This represents the predicted average one-way delay. This represents the standard deviation of the forecast.

[0056] S303: Based on the original device fingerprint and standard network environment parameters, combined with the network environment discriminator, the fingerprint aligner is trained to obtain a trained fingerprint aligner. The trained fingerprint aligner receives the original device fingerprint and outputs the aligned device fingerprint, that is, it aligns device fingerprints from various unknown heterogeneous networks to a preset standard network. The aligned device fingerprint is used as the input of the device classifier.

[0057] The fingerprint aligner is based on an encoder-decoder architecture to remove environmental noise. It is trained using a simulated traffic dataset with network environment parameter labels and a network environment discriminator to obtain a trained fingerprint aligner.

[0058] Input the original device fingerprint into the fingerprint aligner, and the encoder will input the original device fingerprint. Encoding as aligned device fingerprint The device fingerprint is input into the network environment discriminator to predict network environment parameters, enabling the network environment discriminator to accurately determine the network environment parameters. The network environment parameter discrimination result is and ensure ,in The standard network environment parameters are manually set to align the original device fingerprint to the standard network environment; the decoder then reconstructs the aligned device fingerprint into a reconstructed fingerprint. and ensure To preserve the essential attributes of the device, specifically, the loss function of the fingerprint aligner. For definition:

[0059] in, Indicates the loss weight. Indicates the original device fingerprint. This indicates the reconstruction of the fingerprint. This represents the predicted network environment parameters output by the network environment discriminator, aligned with the device fingerprint. This represents standard network environment parameters.

[0060] The core innovation of the fingerprint aligner lies in the design of a dual-objective joint loss function. The reconstruction loss term constrains the decoder output to approximate the original input, that is, the reconstructed fingerprint approximates the original device fingerprint, ensuring feature integrity, so that the subsequent classifier can still classify the device type through the aligned fingerprint. The environment alignment loss term forces the encoder output to be judged by the discriminator as the target standard environment, that is, the predicted network environment parameters of the aligned device fingerprint output by the network environment discriminator approximate the standard network environment parameters, so that the subsequent classifier is not affected by the heterogeneous network environment.

[0061] S4: Input the aligned device fingerprint into the binary classification model for identification and output the identification result; if the identification result is an IoT device, input it into the multi-classification model for identification and output the specific type of the device.

[0062] In this embodiment, both the binary classification model and the multi-class classification model are deep neural network models, which contain multiple blocks. Each block consists of a Linear layer, a BatchNorm layer, a ReLU layer, and a Dropout layer.

[0063] The device classification process employs a cascaded classification architecture to address the data imbalance problem in IoT device identification. First, a binary classification model performs initial screening of device types. The output layer of the binary classification model uses the Sigmoid activation function, combined with a binary cross-entropy loss function for training, dividing devices into two main categories: "IoT" and "non-IoT".

[0064] The binary cross-entropy loss is expressed as:

[0065] in, For sample labels, The model predicts the structure. A binary classification model is trained using this loss function.

[0066] The device fingerprint is aligned and input into a binary classification model to determine if a device is an IoT device. Once identified as an IoT device, the aligned device fingerprint is input into a multi-classification model to determine the specific type of IoT device. For traffic identified as an IoT device, the multi-classification model further identifies the specific device type. The output layer of the multi-classification model uses the Softmax activation function and optimizes the cross-entropy loss. An innovative majority voting decision mechanism is introduced: the same device is identified M=10 times independently (M has been experimentally verified as the optimal balance value), the frequency of each type is counted, and the highest frequency result is used as the final classification. For example, a smart camera is classified as such if it appears 8 times in 10 identifications, significantly improving the stability of the results.

[0067] Cross-entropy loss is used to train multi-class classification models and is expressed as:

[0068] in, The first of the sample labels One portion, The sample predicted by the model may be the first The probability of each type.

[0069] Experimental Example: This embodiment establishes a physical testing platform containing seven types of IoT devices to test the method proposed in this invention. The physical testing platform includes two smart speakers, two network cameras, two smart lights, and one smart socket, and is also equipped with twelve background interference devices (including home routers, smartphones, and personal computers).

[0070] Using dedicated terminal equipment equipped with an AMD Ryzen 7940H processor and an AC1200-level wireless network card, data collection was performed in three types of environments. Specifically, data was continuously collected for 34 hours in a controlled laboratory, yielding 6.90GB of basic 802.11 encrypted traffic; data was collected for 2 hours in an office environment, yielding 0.26GB of encrypted traffic (including 6 background devices); and data was collected for 2 hours in a residential environment, yielding 1.72GB of encrypted traffic (including 12 background devices). All data collection processes maintained the original encrypted state, recording only device MAC addresses, timestamps, and channel information, completely simulating real-world application scenarios.

[0071] By configuring the aforementioned network devices to operate on multiple different channels and using a single AC1200 wireless network card, the efficiency of multi-channel traffic acquisition was tested by comparing the proposed multi-channel acquisition steps with two benchmark acquisition steps (cyclic acquisition and random acquisition). Experimental results show that the proposed method can acquire network traffic for 10 time windows of 85% of the devices within 122 seconds and network traffic for 10 time windows of all devices within 232 seconds, thus improving the efficiency of multi-channel traffic acquisition. In contrast, the cyclic acquisition and random acquisition schemes require at least 306 seconds to acquire network traffic for 10 time windows of all devices. Furthermore, the proposed method can effectively identify the actual operating channel of a device (with an accuracy rate of 85.6%), thereby avoiding interference traffic caused by channel overlap.

[0072] This study investigated the impact of device fingerprint aligners on the adaptive capability of classification models in heterogeneous network environments through ablation experiments. Specifically, when using raw fingerprints collected from a laboratory environment without fingerprint aligners to train the device classification model, the recognition accuracy of the binary classification model (distinguishing whether a device is an IoT device) and the multi-class classification model (classifying specific IoT devices) on the training set were 98.6% and 97.3%, respectively. The recognition accuracy decreased to 87.2% and 83.7% on the test set collected in an office environment, and to 85.2% and 79.4% on the test set collected in a residential area, respectively. When using aligned fingerprints collected from a laboratory environment with fingerprint aligners to train the device classification model, the recognition accuracy of the two models on the training set were 95.6% and 96.1%, respectively. The recognition accuracy decreased to 92.8% and 92.7% on the test set collected in an office environment, and to 93.5% and 92.6% on the test set collected in a residential area, respectively. It can be seen that although the fingerprint aligner will slightly reduce the classification effect on the test set in the same environment as the training set, it can significantly improve the recognition effect in other network environments, improve the generalization effect of the classification model, enable the classification model to adapt to diverse heterogeneous network environments, and improve the adaptability of the network environment.

[0073] Example 2 This embodiment discloses a cross-channel, environment-adaptive IoT device identification system, including: The data acquisition module is configured to: perform multi-channel traffic acquisition based on a dynamic channel optimization strategy to obtain traffic data from each device; The feature extraction module is configured to: split traffic data into independent data streams corresponding to each device based on the source MAC address, extract features from each independent data stream, and obtain the original device fingerprint; The network alignment module is configured to: input the original device fingerprint into a trained fingerprint aligner for alignment, and output the aligned device fingerprint; The type recognition module is configured to: input the aligned device fingerprint into a binary classification model for recognition and output the recognition result; if the recognition result is an IoT device, then input the aligned device fingerprint into a multi-classification model for recognition and output the specific type of the device.

[0074] Example 3 The purpose of this embodiment is to provide a computing device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of the method of Embodiment 1.

[0075] Example 4 The purpose of this embodiment is to provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, performs the steps of the method of Embodiment 1.

[0076] The steps and methods involved in the apparatuses of Embodiments 3 and 4 above correspond to those in Embodiment 1. For specific implementation details, please refer to the relevant description section of Embodiment 1. The term "computer-readable storage medium" should be understood as a single medium or multiple media including one or more instruction sets; it should also be understood as including any medium capable of storing, encoding, or carrying an instruction set for execution by a processor and enabling the processor to perform any of the methods in this invention.

[0077] Those skilled in the art will understand that the modules or steps of the present invention described above can be implemented using general-purpose computer devices. Optionally, they can be implemented using computer-executable program code, thereby allowing them to be stored in a storage device for execution by a computer device, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. The present invention is not limited to any particular combination of hardware and software.

[0078] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

[0079] While the specific embodiments of the present invention have been described above in conjunction with the accompanying drawings, this is not intended to limit the scope of protection of the present invention. Those skilled in the art should understand that various modifications or variations that can be made by those skilled in the art without creative effort based on the technical solutions of the present invention are still within the scope of protection of the present invention.

Claims

1. A cross-channel, environment-adaptive IoT device identification method, characterized in that, include: Multi-channel traffic acquisition is performed based on dynamic channel optimization strategies to obtain traffic data for each device. Traffic data is split into independent data streams corresponding to each device based on the source MAC address, and features are extracted from each independent data stream to obtain the original device fingerprint; The original device fingerprint is input into the trained fingerprint aligner for alignment, and the aligned device fingerprint is output. The device fingerprint is input into a binary classification model for recognition, and the recognition result is output. If the identification result is an IoT device, the device fingerprint will be aligned with the multi-classification model for identification, and the specific type of the device will be output.

2. The cross-channel, environment-adaptive IoT device identification method as described in claim 1, characterized in that, Multi-channel traffic acquisition is based on a dynamic channel optimization strategy, specifically as follows: Adopting improved - A greedy algorithm is used to make channel selection decisions and acquire the acquisition channel; Multi-channel traffic is collected based on a defined acquisition channel to obtain multi-channel traffic data; Based on multi-channel traffic data, the operating channel of the device is determined according to the data frame frequency, and data frames collected from other non-operating channels are filtered out to obtain traffic data. After each collection cycle ends, the reward value for each channel is updated, and the next collection cycle begins, until the end.

3. The cross-channel, environment-adaptive IoT device identification method as described in claim 2, characterized in that, The improved The greedy algorithm for channel selection decision-making is as follows: obtain a random number; when the random number is less than or equal to the exploration probability, randomly select a channel for collection; when the random number is greater than the exploration probability, select the channel with the highest reward value for collection.

4. The cross-channel, environment-adaptive IoT device identification method as described in claim 1, characterized in that, The original device fingerprint includes packet length distribution features, temporal dynamic features, and basic frame count features.

5. The cross-channel, environment-adaptive IoT device identification method as described in claim 1, characterized in that, The fingerprint aligner is trained using a network environment simulator and a network environment discriminator, as follows: Third-party traffic is input into the network environment simulator, and network environment parameters are preset. The network environment variation is simulated through the protocol stack to obtain simulated traffic data with network environment parameter labels. The network environment discriminator is trained based on simulated traffic data with network environment parameter labels to obtain a trained network environment discriminator. The original device fingerprint is extracted from the simulated traffic data with network environment parameter labels. The fingerprint aligner is trained by combining the standard network environment parameters and the predicted network environment parameters output by the trained network environment discriminator.

6. The cross-channel, environment-adaptive IoT device identification method as described in claim 5, characterized in that, The loss function of the network environment discriminator is: in, Represents the actual network environment parameters that drive traffic. This represents the predicted network environment parameters output by the network environment discriminator. , , , For the sub-loss weight, This represents the mean square error. Represents the binary cross-entropy. Indicates the KL divergence. This indicates a normal distribution.

7. The cross-channel, environment-adaptive IoT device identification method as described in claim 5, characterized in that, The loss function of the fingerprint aligner is: in, Indicates the loss weight. Indicates the original device fingerprint. This indicates the reconstruction of the fingerprint. Indicates standard network environment parameters. This represents the predicted network environment parameters output by the network environment discriminator based on the aligned device fingerprint.

8. A cross-channel, environment-adaptive Internet of Things (IoT) device identification system, characterized in that, include: The data acquisition module is configured to: perform multi-channel traffic acquisition based on a dynamic channel optimization strategy to obtain traffic data from each device; The feature extraction module is configured to: split traffic data into independent data streams corresponding to each device based on the source MAC address, extract features from each independent data stream, and obtain the original device fingerprint; The network alignment module is configured to: input the original device fingerprint into a trained fingerprint aligner for alignment, and output the aligned device fingerprint; The type recognition module is configured to: input the aligned device fingerprint into a binary classification model for recognition and output the recognition result; if the recognition result is an IoT device, then input the aligned device fingerprint into a multi-classification model for recognition and output the specific type of the device.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the steps of the cross-channel, environment-adaptive IoT device identification method as described in any one of claims 1-7.

10. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps in the cross-channel, environment-adaptive IoT device identification method as described in any one of claims 1-7.

Images