A method and system for identifying IoT devices based on time-series load flow fingerprint

Abstract

The present invention discloses a method and system for identifying Internet of Things device traffic based on time-series load traffic fingerprints. The specific work flow of the method can be divided into a training stage and a classification stage. In the training stage, the learnable parameters in the neural network are trained according to the message length sequence information and message byte sequence information of the Internet of Things device traffic of the marked category, so as to realize automatic Internet of Things device traffic fingerprint extraction and Internet of Things device identification. In the classification stage, based on the trained neural network model, the Internet of Things device traffic fingerprint is constructed for the Internet of Things device traffic to be identified, and the traffic identification of different Internet of Things devices is completed. The present invention accurately characterizes the network traffic generated by any Internet of Things device from different feature dimensions, thereby forming a more expressive Internet of Things device traffic fingerprint, which has high accuracy, high generalization ability and robustness in the process of Internet of Things device traffic identification.

Description

Technical Field

[0001] The present invention belongs to the field of Internet of Things and Internet of Things security, relates to Internet of Things device identification technology, and in particular to an Internet of Things device identification method and system based on time-series load flow fingerprint. Background Art

[0002] In recent years, the vigorous development of IoT technology has led to the continuous expansion of the types and number of IoT devices in the real world. IoT devices have now been integrated into every corner of society. However, with the continuous development of IoT technology and the continuous surge in the number of devices in the IoT, the IoT field is also facing important issues and challenges. One of the hot and difficult issues in the current IoT field is the accurate classification of traffic generated by different IoT devices. The accurate classification of IoT devices helps to provide better network management and network security for network service providers. First, for network management, due to the high heterogeneity of IoT devices, different IoT devices have different actual requirements for quality of service (QoS). Therefore, network service providers need to provide differentiated services for network traffic generated by different IoT devices. Second, for network security, the identification and classification of IoT devices is the first step in activities such as anomaly detection, network firewalls, and filtering of unwanted traffic. For network operation service providers, timely acquisition of relevant information about IoT devices can help them to promptly and actively process or shield and isolate the network traffic generated by IoT devices that are not working properly or have been attacked. Therefore, in practice, accurate IoT device identification methods will help improve the reliability and security of IoT networks.

[0003] Identification methods for IoT devices can be divided into two categories: identification methods based on unique identification of IoT devices and identification methods based on traffic fingerprints of IoT devices. The identification method based on unique identification of IoT devices mainly uses: (1) MAC address information and (2) DHCP information, two types of information as device identification. Among them, the method based on MAC address information, due to the characteristics of MAC address, the MAC address may be valid only when the device and the operator are in the same broadcast domain. However, when the device and the operator span multiple network segments, the operator cannot detect the device MAC address, which is difficult to use as a basis for IoT device classification. The method based on DHCP information is difficult to use as a basis for accurate classification because many IoT devices in recent years do not set host names in DHCP requests, and many host names are meaningless. The current identification method based on traffic fingerprints of IoT devices obtains IoT device traffic fingerprints by performing feature engineering on IoT device traffic, and combines artificial intelligence methods such as machine learning for classification, and obtains a good classification accuracy. The present invention discusses the work of IoT device traffic fingerprint identification.

[0004] At present, although the existing identification methods based on traffic fingerprints of IoT devices have achieved good experimental results in certain scenarios, such methods require researchers to have a certain degree of prior knowledge of the analyzed network traffic data when designing and extracting network traffic fingerprint information. Specifically, the current fingerprint extraction work is too sensitive to factors such as whether the network traffic is encrypted, whether the transport layer protocol is a reliable transport protocol (TCP) or an unreliable transport protocol (UDP), and which application layer traffic is used by the network flow. This leads to the need for staff to have a more specific understanding of network traffic and design more targeted fingerprint information when facing diverse IoT device traffic during the fingerprint extraction process. However, for IoT service providers, this is undoubtedly a very tedious task that requires a lot of human resources. At the same time, in the context of the continuous increase of IoT devices today, each update of IoT devices may increase the workload of fingerprint extraction work by geometric times. Therefore, in the field of IoT device identification, how to design a network traffic fingerprint of IoT devices with high generalization and robustness and perform accurate IoT device identification is a research hotspot today. Summary of the invention

[0005] The purpose of the present invention is to design and implement an IoT device identification method and system based on time-series load traffic fingerprint, thereby effectively reducing the prior knowledge required in the process of constructing IoT device traffic fingerprint, and then being able to identify various IoT devices in complex and diverse IoT environments.

[0006] To achieve the above purpose, the technical solution adopted by the present invention is as follows:

[0007] A method for identifying IoT device traffic based on time-series load traffic fingerprint. The specific workflow of this method is as follows: Figure 1 As shown, it can be divided into a training phase and a classification phase.

[0008] The training phase includes the following steps:

[0009] 1) Assemble IP data packets into TCP / UDP unidirectional flows, extract the payload length of each payload data packet in each unidirectional flow, and combine them into a payload length sequence, thereby obtaining the message length sequence information of a unidirectional flow; extract the payload data of the first payload data packet in each unidirectional flow, and obtain the message byte sequence information of each unidirectional flow. Respectively limit the message length sequence information and the message byte sequence information to fixed lengths.

[0010] 2) Using the message length sequence information and message byte sequence information obtained in step 1) as input, an offline training data set is formed, and a device traffic identification model is constructed using a supervised learning method;

[0011] The classification stage includes the following steps:

[0012] 3) Taking the IoT device traffic data as input, obtaining the unidirectional flow of the IoT device traffic to be identified, and converting the unidirectional flow to be tested into the same fixed-length message length sequence information and message byte sequence information as step 1);

[0013] 4) Determine whether there is a trained device flow identification model at this time. If there is no trained model, return to the training stage to train the device flow identification model. If there is a trained device flow identification model, use the model for device identification.

[0014] 5) According to the device traffic identification model obtained in step 2) in the training phase, the IoT device traffic category of the target traffic data is identified and the identification result is output.

[0015] An IoT device identification system based on time-series load flow fingerprint includes an IoT device flow collection and processing module and a device flow identification model building module for the training phase, and an IoT device flow collection and processing module and an IoT device flow identification module for the classification phase; wherein,

[0016] The IoT device traffic collection and processing module is responsible for extracting the message length sequence information and message byte sequence information from the input raw network traffic data, and processing these two parts into sequence information of equal length respectively;

[0017] The device traffic identification model construction module in the training phase is responsible for building the neural network used by the device traffic identification model, and uses the message length sequence information and message byte sequence information set of the marked categories containing different IoT device traffic to adjust the network parameters in the neural network so that the device traffic identification model meets the training termination conditions for use in the classification phase;

[0018] The IoT device traffic identification module in the classification stage is responsible for distinguishing the IoT device traffic category attributes of the IoT device message length sequence information and message byte sequence information to be identified obtained by the IoT device traffic collection and processing module based on the device traffic identification model generated in the training stage, and outputting the distinction result.

[0019] The key technical points of the present invention are:

[0020] 1. The message length sequence information is processed by a self-attention mechanism to obtain the time series features that can characterize the state transition relationship of the IoT device traffic message; the message byte sequence information is processed by a method based on a combination of one-hot encoding and convolution to obtain the traffic load characteristics that can characterize the IoT device traffic application protocol format information.

[0021] 2. A convolutional neural network structure with two branches, time convolution and load convolution, is designed to construct category-sensitive fingerprints. This structure can construct timing features and traffic load features into timing fingerprints and load fingerprints respectively, thereby forming a traffic fingerprint that can accurately characterize IoT devices from two aspects.

[0022] 3. A fingerprint fusion structure based on global average pooling is designed, which can fuse the timing fingerprint and load fingerprint to form an IoT device traffic fingerprint containing both timing and load information, thereby forming a robust representation of IoT device traffic.

[0023] The present invention discloses a method and system for identifying IoT devices based on time-series load flow fingerprints. Compared with the related technologies disclosed, the method and system have the following advantages:

[0024] 1) The IoT device traffic identification method has high generalization capability and robustness. The present invention does not presume that the network traffic generated by IoT devices is plaintext traffic or ciphertext traffic. The present invention is applicable to IoT device traffic whose transport layer protocol uses TCP or UDP, and is insensitive to the specific protocol type used by the application layer;

[0025] 2) The present invention uses a self-attention mechanism to extract traffic time series fingerprints, and uses one-hot encoding and a branched convolutional neural network to extract traffic load fingerprints. The two fingerprints are fused to obtain the traffic fingerprint of the IoT device, so that the network traffic generated by any IoT device can be accurately characterized from different feature dimensions. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 It is an overall flow chart of the IoT device identification method based on timing load traffic fingerprint.

[0027] Figure 2 It is a flow chart of the training phase of the IoT device identification method based on timing load traffic fingerprint.

[0028] Figure 3 It is a diagram of the neural network structure constructed by the IoT device traffic classification model.

[0029] Figure 4 It is a schematic diagram of multi-branch structure convolution.

[0030] Figure 5 It is a flow chart of the identification phase of the IoT device identification method based on timing load traffic fingerprint.

[0031] Figure 6 This is the architecture diagram of the IoT device identification system based on timing load traffic fingerprint.

[0032] Figure 7 This is a graph of the classification experiment results of IoT device traffic on the validation set.

[0033] Figure 8 This is a graph of the classification experiment results of IoT device traffic on the test set. DETAILED DESCRIPTION

[0034] The specific workflow of this method can be divided into a training phase and a classification phase. In the training phase, the learnable parameters in the neural network are trained according to the message length sequence information and message byte sequence information of the IoT device traffic of the marked category, so as to realize the automatic extraction of IoT device traffic fingerprint and IoT device identification. In the classification phase, based on the trained neural network model, the IoT device traffic fingerprint is constructed for the IoT device traffic to be identified, and the traffic identification of different IoT devices is completed.

[0035] In the training phase, the key technical part of this method is to build a traffic recognition model for IoT devices. The overall process is as follows: Figure 2 As shown in Figure 1, the input of the training phase is the message length sequence information and message byte sequence information mentioned in the overall process. The neural network structure constructed by the IoT device traffic classification model is shown in Figure 1. Figure 3 As shown, the end condition of the training phase is E. The output of the IoT device traffic identification model construction process is the IoT device traffic fingerprint extraction model and the IoT device traffic identification model that meet the IoT device traffic classification requirements.

[0036] The device traffic identification model of this method is constructed based on the training method of the deep neural network model, and its specific implementation steps are as follows:

[0037] 1. Assemble IP data packets into TCP / UDP unidirectional flows. The data packet assembly unidirectional flow operation uses the network quintuple as the unique identifier of a TCP / UDP flow, and the data packets that meet the quintuple identifier form a network unidirectional flow.

[0038] The five-tuple described in the present invention refers to the source IP address (ip.src), destination IP address (ip.dst), source port (port.src), destination port (port.dst), and fourth-layer communication protocol (protocol) of the data packet, namely (ip.src, ip.dst, port.src, port.dst, protocol).

[0039] Extract the payload length of all packets with payload in each TCP / UDP unidirectional flow and combine them into a payload length sequence to obtain the message length sequence information of a unidirectional flow (The training set contains N unidirectional flows of IoT device traffic, l i Represents the message length sequence information of each unidirectional flow). Extract the payload data of the first payload data packet in each unidirectional flow to obtain the message byte sequence information of the unidirectional flow (The collection contains N unidirectional flows of IoT device traffic, p i The two parts of information extracted from the unidirectional flow are combined to obtain the unidirectional flow information set of the IoT device.

[0040] Perform length consistency operations on the message length sequence information and message byte sequence information in the IoT device traffic information. Perform a "0" padding operation on the information whose length is less than the length benchmark, and perform a truncation operation on the information whose length is greater than the benchmark. Process the message length sequence information L into a fixed-length message length sequence information. The length sequence information of each stream's message i The length is set to N L . Process the message byte sequence information P into fixed-length message byte sequence information The message byte sequence information p' of each flow i The length is set to N P , where N L 、N P The two parameters can be adjusted and set according to the needs of the IoT device traffic fingerprint generation model.

[0041] 2. Before starting the training of the neural network structure, the trainable parameters in the neural network need to be initialized according to the hyperparameter settings. The neural network parameters can be initialized by loading existing model parameters, random initialization, custom initialization, etc. In this method, the random initialization method is used to assign initial values ​​to all trainable parameters in the neural network. If you need to fine-tune the learnable parameters of the neural network in this method after use, you can also skip this step and not initialize the parameters. Instead, directly load the original parameters and adjust the model effect based on the original parameters.

[0042] 3. The fixed-length message sequence information L' is processed by the time series feature extractor to obtain the time series features that can characterize the state transition relationship of the traffic message of the IoT device. Based on the time series features, the time convolution module is used to obtain the time series fingerprint, Ft. Next, for the sake of convenience, the message length sequence information l' of one of the flows will be taken as an example. The specific steps are as follows:

[0043] 3.1. This step is embedding. Embedding contains a trainable parameter matrix w E , whose dimension is (N L ×de ). The embedding encoding operation with l' as input can be viewed as a search operation. For any element l in l', j '(j∈[1,N L ]), can be found in w E Find the corresponding d in e Dimensional embedding vector So l' can be converted into an embedding matrix The dimension of the embedding vector is d e It can be changed according to the needs of the model. In the example experiment of the present invention, d e =1024.

[0044] 3.2. This step is the positional encoding operation. Perform the positional encoding operation to combine the positional encoding tensor PE with the tensor X obtained after the embedded encoding calculation to obtain the position-sensitive tensor X'. The PE dimension is (N L ×d e ) is the same as the tensor X obtained by embedding coding. The specific steps are as follows:

[0045] X'=X+PE

[0046] The dimension of the positionally encoded tensor X' is (N L ×d e ). The construction method of the position encoding used in this step is based on the calculation of sine and cosine functions of different frequencies. The specific calculation formula of the position encoding matrix PE is as follows:

[0047]

[0048] In the above formula, pos represents the position of the embedded vector in the message length sequence; d e represents the dimension of the embedding vector; j represents a dimension of the embedding vector.

[0049] 3.3. This step is the self-attention mechanism model. This part inputs X' calculated in the previous step into the self-attention mechanism model in the time series feature extractor to form time series features. The self-attention mechanism model is composed of N D It is composed of stacked layers of the same D It can be set according to the needs. D=1. Each layer is composed of two sub-layers. The first sub-layer is a multi-head self-attention mechanism model; the second sub-layer is a fully connected feed-forward network. Each sub-layer is followed by a residual connection and layer normalization operation. The specific steps of traffic time series feature extraction are as follows:

[0050] 3.3.1. This step performs the first sub-layer operation of the multi-head self-attention mechanism. The multi-head attention mechanism is h parallel different self-attention mechanism structures. The number of parallels can be set by yourself. In this method, h = 8. The multi-head self-attention mechanism can be divided into 3 sub-steps:

[0051] 1) First, input the data X' into h self-attention mechanism structures respectively, and obtain the feature matrix Z after h self-attention mechanism operations. i ,i∈{1,2,...,h}. Here, the present invention takes a self-attention mechanism as an example to introduce the calculation method of the self-attention mechanism. The specific steps are as follows: Take X' as input, first perform three different linear transformation operations (Linear) on X' (note that the linear transformation in this part does not share the weight parameters used in each head in the multi-head self-attention mechanism), that is, respectively with the three weight matrices W Q ,W K ,W V Perform matrix multiplication operations, the matrix dimensions are (d e ×d q ), (d e ×d k ), (d e ×d v ), thereby converting X' into three different tensors, the Query tensor (Q) dimension is (N L ×d q ), the Key tensor (K) dimension is (N L ×d k ) and the Value tensor (V) dimension is (N L ×d v ), which is specifically expressed as follows: In the example verification experiment of the present invention, d q =d k =d v =64. Next, we perform matrix multiplication on Q and K to obtain the score tensor S, the dimension of S is (N L ×N L), in order to stabilize the gradient, S is normalized, that is, divided by Get S', then use the normalized exponential function (softmax) on S' to get S", and then multiply V by the S" matrix to get the output tensor Z of the self-attention mechanism i , the dimension is (N L ×d h ). The specific calculation process of a single self-attention mechanism is shown in the following formula.

[0052]

[0053] 2) Secondly, the obtained h Z i The concatenation operation is performed to form a feature matrix with stronger expressive power. The specific operation steps are in the second dimension (i.e., d v The dimension) is spliced ​​to obtain a (N L ×(h×d v ))-dimensional tensor.

[0054] 3) Finally, the feature matrix is ​​input into a fully connected layer for linear transformation, that is, with the weight matrix W O Perform matrix multiplication, W O The dimension is ((h×d v )×d e ), after linear transformation, the final output Z dimension is (N L ×d e ), and the calculation formula is as follows.

[0055] Z=MultiHead(Q,K,V)=Concat(Z1,...,Z i )W O ,i∈{1,2,...,h}

[0056] The obtained output is subjected to residual connection operation and layer standardization operation to obtain the final output Z', whose dimension is (N L ×d e ).

[0057] Z'=LayerNorm(X'+Z)

[0058] 3.3.2. This step is the fully connected feedforward network part. The specific operation is as follows. First, the first linear transformation operation (Linear) is performed, that is, matrix multiplication with a weight matrix W1 and adding a bias value b1. The dimension of W1 is (d e ×d hh); then, a linear rectification function (ReLU) operation is performed; then a second linear transformation operation (Linear) is performed, that is, a matrix multiplication operation is performed with a weight matrix W2 and a bias value b2 is added. The dimension of W2 is (d hh ×d e ), where the hidden layer dimension can be modified as needed, and the calculation formula is as follows.

[0059] y=FFN(Z')=max(0,Z'W1+b1)W2+b2

[0060] The obtained result is subjected to residual connection and layer normalization to obtain the final encoder layer output result y, with a dimension of (N L ×d e ):

[0061] y'=LayerNorm(X'+y)

[0062] 3.3.3. Starting from the second self-attention mechanism layer, the input of each layer is the output y' of the previous layer. Repeat steps 3.3.1 and 3.3.2 for N D times, and the final result Y is obtained. At this time, the dimension of the final result Y is (N L ×d e ).

[0063] 3.3.4. Since the feature dimension of the output result Y obtained by the self-attention mechanism is too high, the present invention reduces the dimension of the output result Y through two-step 2D convolution operations to make the output easier to process. First, the obtained Y is increased by one channel dimension, and the dimension is transformed into (1×N L ×d e ). Then, the first step of 2D convolution operation is performed on Y. The dimension transformation calculation method of convolution is as follows:

[0064] f(d)=(d-kernel size+2×padding) / 2+1

[0065] The number of convolution kernels is C1, the convolution kernel size is (3,3), the step size is 2, and the number of convolution kernels can be set by yourself. In this method, C1=32, and the dimension is (C1×N L '×d e ') tensor Y', where N L '=f(N L ),d e '=f(d e ). Perform the second 2D convolution operation on Y', with 1 convolution kernel, (3,3) kernel size, and 2 steps, and the final dimension is (1×N L ”×d e”) tensor Y”, where N L ”=f(N L '),d e ”=f(d e '). The parameters of the two-step convolution in this step can be set as needed.

[0066] 3.4 This step is time convolution. First, the first dimension of Y' is compressed, and then the second dimension is increased, so that Y' becomes ((N L ”×d e ”)×1), a 1D convolution operation is used in this part, and the number of convolution kernels is d class , the convolution kernel size is 1, the step size is 1, and the dimension is (d class ×1), and then perform dimension compression to obtain an output dimension of d class In this method, d class is the number of IoT device categories. Each dimension of the output of this step corresponds to an IoT category one by one, and finally a dimension d is obtained. class Class-sensitive traffic timing fingerprint i represents the i-th unidirectional flow, and j represents the dimension of the j-th class in the output fingerprint.

[0067] 4. Take the processed fixed-length message byte sequence information P' as input, process the message load information through the neural network model based on one-hot encoding and convolutional neural network, and use the load convolution module based on the load characteristics to obtain the load fingerprint, Fp. In the following part, for the sake of convenience, the message sequence information p' of one flow will be taken as an example, and the specific operation steps are as follows:

[0068] 4.1. First, one-hot encoding is performed on p'. The specific operation process of one-hot encoding is as follows. The present invention converts each byte in p' into a one-hot vector w with a dimension of 256. g For the g-th byte p′ in the set p′ g , assuming that its byte value is u, u∈[0,255], and u∈N (because the decimal value range of the byte in the original message payload information of the data packet is between 0 and 255), then its corresponding 256-dimensional one-hot vector w g It is represented as a vector whose u-dimensional elements are 1 and whose other elements except the u-th are 0, in the form of w g ={0,0,…,1,…,0}, where element 1 is in the vector w g The coordinates in are w (g,u) After the one-hot encoding transformation, the dimension is (N P ×1) is converted to a tensor p' of dimension (NP ×256) tensor W.

[0069] 4.2. For the obtained two-dimensional matrix vector W, first add dimension operation to obtain the dimension (1×N P ×256) tensor, and perform 2D convolution operation, the number of convolution kernels is H1, the convolution kernel size is (1×256), the step size is 1, and H1=32 is set in the verification experiment of the present invention. The output result obtained after 2D convolution is R1, and the dimension of R1 is (H1×N P ×1).

[0070] 4.3. Perform branch convolution on the output result of the 2D convolution in the previous step. Figure 4 The following diagram shows the branch convolution operation. First, the last dimension of R1 is compressed to obtain a dimension of (H1×N P ) tensor, and use it as input to three parallel 1D convolutions, the number of convolution kernels is H2, the convolution kernel sizes are 1, 3, and 5, the step size is 1, and the padding size is 0, 1, and 2, respectively, so that the length of the feature map after each branch convolution remains unchanged. After three parallel 1D convolution operations, three dimensions of (H2×N P ), in the verification experiment of the present invention, H2=150. The tensors obtained by the three parallel convolutions are respectively input into the same 1D convolution layer, with the number of convolution kernels being H3, the convolution kernel size being 1, and the step length being 1, to obtain three dimensions (H3×N P ) are represented by R 1.1 ,R 1.2 ,R 1.3 In this method, H3 = 32. The number and size of convolution kernels of each branch convolution in the branch convolution structure can be adjusted according to the needs. 1.1 ,R 1.2 ,R 1.3 Perform matrix addition operation to obtain the final parallel convolution output result R2, the dimension of R2 is (H3×N P ).

[0071] 4.4.R2 and R1 are residually fused and batch normalized to obtain R3.

[0072] R3=BatchNorm(R1+R2)

[0073] 4.5. This step will use two linear transformation operations (Linear) to perform dimension compression operations on feature R3. The first step is to flatten R3 using dimension transformation operations; the second step is to enter the dropout layer for random feature selection operations; the third step is to enter a fully connected layer with an output dimension of H4, H4 = 256 in this method, and obtain a tensor of dimension H4; the fourth step is to perform a linear rectification function (ReLU) on H4; the fifth step is to enter the second fully connected layer with an output dimension of H5, H5 = 128 in this method. The final one-dimensional tensor R4 with a dimension of H5 is obtained.

[0074] 4.6. This step is load convolution. First, add dimension to the tensor R4 obtained in the previous step to obtain a tensor with dimension (H5×1). Then perform a 1D convolution operation on the tensor with the number of convolution kernels d. class , the convolution kernel size is 1, the convolution step is 1, and the convolution dimension is (d class ×1). Then, the dimension compression operation is performed to obtain a tensor of dimension d class Class-sensitive traffic load fingerprinting Where i represents the i-th unidirectional flow, and j represents the dimension of the j-th class in the output fingerprint.

[0075] 5. The obtained traffic timing fingerprint Ft i and traffic load fingerprint Fp i Perform fingerprint fusion operation, that is, Ft i and Fp i Perform concatenation at the corresponding dimension j to obtain a dimension (d class ×2) Category-sensitive IoT device traffic fingerprint In this way, the traffic fingerprint of the IoT device including the traffic timing fingerprint information and traffic load fingerprint information is obtained.

[0076] 6. This step is to fingerprint the traffic of IoT devices F i To fuse different types of features. Specifically, in each dimension j (j∈[1,λ]), a global average pooling operation is used to fuse the traffic timing fingerprint and the traffic load fingerprint, thereby obtaining a dimension d class The tensor is a tensor of , and the confidence of each category is given using the normalized exponential function (softmax). The dimension with the largest confidence value is taken as the inference of the traffic category of the IoT device in this operation. The loss function is calculated using the inferred category of the IoT device traffic obtained from the network to evaluate the degree of fit between the current calculation result and the actual data. The loss function used in this method is the cross entropy function.

[0077] 7. Determine whether the training status at this time meets the termination condition E. If the termination condition is met, stop the neural network training process, and output the IoT device traffic fingerprint extraction model and IoT device traffic identification model containing the trained neural network parameter values ​​as the final result of the training phase for IoT device traffic identification in the classification phase; if the condition is not met, use back propagation to update the neural network parameters according to the loss function value calculated by the network, and repeat steps 3-6. The setting of the end condition E may include but is not limited to the following conditions: reaching the maximum iteration cycle, reaching the expected loss function value, reaching the expected statistical evaluation index, etc.

[0078] The workflow of the classification stage is as follows: Figure 5 As shown, this stage is based on the IoT device traffic fingerprint extraction model and IoT device traffic identification model parameters obtained in the training stage, and uses the IoT device traffic as input to identify the category of the IoT device to be identified.

[0079] 1. This method first obtains the fixed-length message length sequence information and message byte sequence information of the traffic of the IoT device to be identified according to the method described in step 1 of the above training phase.

[0080] 2. The IoT device identification module extracts the IoT device traffic fingerprint based on the IoT device traffic identification model generated in the training phase and takes the preprocessed formatted data as input, and finally obtains the IoT device category represented by the input IoT device traffic.

[0081] In the actual application process of this method, the training phase can be restarted to adjust and retrain the neural network according to the recognition effect of the method on different data sets, the change of the type of IoT device to be recognized, and other factors. Through multiple iterations of the training phase and the classification phase, the neural network parameters used in this method are updated to ensure that the performance of this method meets the requirements of application protocol classification.

[0082] Combined with the above-mentioned IoT device identification method based on time series load flow fingerprint, this patent also discloses an IoT device identification system based on time series load flow fingerprint. This system mainly consists of two stages: training stage and classification stage. The system diagram architecture is as follows Figure 6 shown.

[0083] 1. Training phase. First, with the known IoT device traffic as input, the (1) combined unidirectional flow data preprocessing module forms two parts of unidirectional flow information, namely, message length sequence information and message byte sequence information; the (1) combined unidirectional flow data preprocessing module performs truncation or zero padding operations on all message length sequence information and message byte sequence information to make the length of the same information the same, embeds the message sequence information, and performs one-hot encoding operations on the message load information as the target IoT device traffic data set. The IoT device traffic identification model designed by this method needs to be trained in advance before the target IoT device identification work can be performed. The (2) IoT device traffic identification model construction training module uses the target IoT device traffic data set to train the IoT device traffic identification model designed by this method so that the performance of the IoT device traffic identification model meets the classification requirements. The output result of the (2) IoT device traffic identification model construction module is the completed device identification model.

[0084] 2. Classification stage. The classification stage takes the traffic data of the IoT device to be identified as input. The (1) combined unidirectional flow data preprocessing module processes the traffic data of the IoT device to be identified to form two parts of unidirectional flow information, including message length sequence information and message byte sequence information. The lengths of the sequences are unified and converted into embedded tensors and one-hot encoding forms as the test data set. (3) The IoT device traffic identification module takes the test data set as input and uses the device identification model generated by the (2) IoT device traffic identification model construction module to identify the IoT device type to which each sample in the test data set belongs. The output result of the classification stage is the specific judgment result of the IoT device type corresponding to the traffic of the IoT device to be identified.

[0085] In the verification experiment, the present invention carried out example verification on the network traffic generated by 18 different types of IoT devices. The specific information of the network traffic generated by each IoT device used in the experiment is shown in Table 1. Among them, for each device category, the present invention randomly selected 3,000 network flows. If the number of flows in a certain category is less than 3,000, all the data are selected. In addition, a 5-fold cross-validation was carried out on the experimental data set, in which the division ratio of the training set, the validation set, and the test set was 3:1:1.

[0086] Table 1: IoT device names and network traffic information of each device in the public dataset used in the verification experiment, where M represents 10 6 ,K represents 10 3 , G stands for 10 6 .

[0087]

[0088] After the classification model of IoT device traffic is designed, in order to evaluate its classification performance, appropriate classification evaluation indicators must be defined. For the specific application r being analyzed, the following indicators are defined to evaluate the classification performance of the classifier:

[0089] (1) True Positive Rate (TPR) of IoT device r:

[0090]

[0091] (2) False Positive Rate (FPR) of IoT device r:

[0092]

[0093] (3)TPR r and FPR r Respectively reflects the classification performance of the two aspects of the whole system, FTF r The indicator is TPR r With FPR r The trade-off between indicators is defined as follows:

[0094]

[0095] (4) The present invention is aimed at multi-category classification of mixed IoT device traffic. The overall classification performance of the system of multiple IoT devices is evaluated by the accuracy index (Accuracy). The specific definition of the ACC index is as follows:

[0096]

[0097] Among them, λ represents the number of IoT device categories that need to be classified.

[0098] In the verification experiment, there are three important parameters: (1) N L , represents the number of the first data packets of the network data flow used for classification; (2) d e , represents the embedding vector dimension of the embedding coding layer; (3) N P , represents different values ​​of the message length used for classification in the first message of the network flow. In the following evaluation experiment of the present invention, the specific parameter selection range is N L ∈{8,16,32},d e =1024, N P ∈{16,32,64}. Next, we introduce the experimental results of specific IoT device traffic classification.

[0099] Figure 7 The plot shows that when the parameter N Pand N L The changes in the Accuracy values ​​of 18 IoT device traffic on the validation set of the experimental data set for different values. For different parameter settings, the ACC value varies in the range of 97.505%–98.423%. The best parameter value on the validation data set is N L =32, d=1024 and N P =64, and the corresponding ACC value is 98.423%. Figure 7 It can be clearly noted that for lower N P In addition, it can be noted that for lower N L value, the Accuracy value of the present invention usually decreases slightly.

[0100] Figure 8 The plot shows that when the parameter N P and N L The changes in the Accuracy values ​​of 18 IoT device traffic on the test set of the experimental dataset when different values ​​are taken. It is worth noting that the parameter setting (N L =32, d=1024 and N P =64), and its classification accuracy on the test set is 98.320%.

[0101] Table 2: Experimental results compared with existing traffic classification methods

[0102]

[0103]

[0104] Table 2 shows the experimental comparison results of the present invention and the most advanced existing traffic classification methods (BSNN method is a load-oriented traffic classification method, FS-Net is a message length sequence-oriented traffic classification method). Table 2 shows in detail the experimental results of each device under several evaluation indicators, including TPR, FPR, average TPR, average FPR, and FTF. From Table 2, it can be clearly observed that the FTF value of the present invention on the experimental data set is 98.23; the FTF values ​​of the existing traffic classification methods BSNN and FS-Net are 94.203 and 82.264, respectively. Therefore, the experimental effect of the present invention is better than that of the BSNN and FS-Net methods.

Claims

1. A method for identifying IoT devices based on time-series load flow fingerprints, characterized in that: It includes training phase and classification phase; The training phase includes the following steps: 1) Taking a set of network data packets of known IoT device traffic types as input, reorganize IP data packets into TCP / UDP unidirectional flows, extract the load length of each payload data packet in each unidirectional flow, and combine them into a load length sequence, thereby obtaining the message length sequence information of a unidirectional flow; extract the load data of the first payload data packet in each unidirectional flow, and obtain the message byte sequence information of each unidirectional flow; respectively convert the message length sequence information and the message byte sequence information into fixed lengths; 2) Using the fixed-length message length sequence information and the fixed-length message byte sequence information obtained in step 1) as input, an offline training data set is formed, and a device traffic identification model is constructed based on the training method of the deep neural network model; The classification stage includes the following steps: 3) Taking the IoT device traffic data as input, obtain the unidirectional network flow of the IoT device traffic to be identified, and convert the unidirectional flow to be tested into the same fixed-length message length sequence information and message byte sequence information as step 1); 4) According to the device traffic identification model obtained in step 2) in the training phase, the IoT device traffic category of the target traffic data is identified and the identification result is output; Step 1) The specific operation method for byte stream sequence conversion is: 1-1) Using the network quintuple to combine data packets into a network unidirectional flow, extracting the load length of each data packet with a load in each unidirectional flow, and combining them into a load length sequence, thereby obtaining the message length sequence information of a unidirectional flow; extracting the load data of the first load data packet in each unidirectional flow, and obtaining the message byte sequence information of each unidirectional flow; 1-2) Performing length-consistency operations on the message length sequence information and the message byte sequence information in the IoT device traffic information respectively; performing a "0" padding operation on the information whose length is less than the length reference, and performing a truncation operation on the information whose length is greater than the reference; Step 2) The method of building a device traffic identification model is: 2-1) Using the fixed-length message length sequence information obtained in step 1) as input, a timing feature extractor is used to perform a timing feature extraction operation on the fixed-length message sequence information to obtain a timing feature that describes the state transition relationship of the traffic message of the IoT device, and a traffic timing fingerprint is obtained using a time convolution module based on the timing feature; 2-2) Taking the fixed-length message byte sequence information obtained in step 1) as input, the message byte sequence information is processed by a neural network model based on one-hot encoding and convolutional neural network to perform a traffic load feature extraction operation, and a load feature that describes the traffic application protocol format information of the IoT device is obtained. Based on the load feature, a load convolution module is used to obtain a traffic load fingerprint; 2-3) Taking the traffic timing fingerprint obtained in step 2-1) and the traffic load fingerprint obtained in step 2-2) as input, a fingerprint fusion operation is performed to obtain the traffic fingerprint of the IoT device including the traffic timing fingerprint information and the traffic load fingerprint information; A normalized exponential function is used to perform an IoT device traffic identification operation to obtain the IoT device traffic category to which the IoT device traffic belongs; 2-4) Taking the IoT device traffic category obtained in step 2-3) and the actual IoT device type of the IoT device traffic in step 1) as input, calculate the model classification accuracy and loss function value indicators. If the indicators meet the termination condition E, stop the neural network model training process, and output the IoT device traffic identification model containing the trained neural network parameter values ​​as the final result of the training phase for IoT device traffic identification in the classification phase; if the indicators do not meet the termination condition, use back propagation to update the neural network parameters according to the calculated loss function value, and repeat steps 2-1) to 2-3).

2. The method for identifying IoT devices based on time-series load flow fingerprints according to claim 1, characterized in that: The specific operation method of the time series feature extraction operation described in step 2-1) is: 2-1-1) Embedded coding layer, using the fixed-length message length sequence information obtained in 1-2) as input to perform embedded coding operation; The embedding operation is to search for each element in the input vector in a trained parameter matrix and obtain the embedded coding tensor after the search; 2-1-2) Position coding layer, adding position coding operation to the embedded coding tensor, performing tensor addition operation on the embedded coding tensor and the position coding to obtain the embedded coding tensor with position information; The construction method of the position code is based on the calculation of sine and cosine functions of different frequencies; 2-1-3) The embedded coding tensor with position information is used as the input of the self-attention mechanism model in the temporal feature extractor to perform self-attention temporal feature extraction operation, thereby forming a high-dimensional temporal feature tensor; 2-1-4) Taking the high-dimensional time series feature tensor as input, two 2D convolutions are used to perform feature dimensionality reduction operations to obtain time series features; The number of convolution kernels of the first convolution is C1, the convolution kernel size is b, and the step length is s; the number of convolution kernels of the second convolution is 1, the convolution kernel size is b, and the step length is s; 2-1-5) Take the time series features as input and use 1D convolution to perform time convolution operation to obtain category-sensitive traffic time series fingerprints; the number of convolution kernels of 1D convolution is the total number of known IoT device types λ, the convolution kernel size is 1, and the step size is 1.

3. The method for identifying IoT devices based on time-series load flow fingerprints according to claim 2, characterized in that: The specific operation method of the traffic load feature extraction operation described in step 2-2) is: 2-2-1) Perform a one-hot encoding operation on the fixed-length message byte sequence information obtained in 1-2) to obtain a one-hot encoding tensor; specifically, convert each byte in the fixed-length message byte sequence information into an integer in the decimal range [0,255]; convert all bytes into a 256-dimensional one-hot vector, except for the one bit representing the actual value of the byte is 1, and the rest of the bits in the vector are 0; 2-2-2) Taking the one-hot encoded tensor as input, a 2D convolutional layer with a convolution kernel number of H1 and a convolution kernel size of (1×k) is used to perform a convolution operation to obtain the initial feature representation tensor of the fixed-length message byte sequence information; 2-2-3) Taking the initial feature representation tensor of the fixed-length message byte sequence information as input, three parallel convolutional neural network branches are used to process the initial feature representation tensor of the fixed-length message byte sequence information to obtain the feature tensors of each convolutional neural network branch; wherein each convolutional neural network branch includes two 1D convolutional neural network layers, assuming that the number of convolution kernels of the first 1D convolutional layer of the convolutional neural network branch is H2, the convolution kernel sizes are 1, 3, and 5, respectively, the step sizes are 1, and the padding sizes are 0, 1, and 2, respectively; the number of convolution kernels of the second 1D convolutional layer is H3, the convolution kernel size is 1, and the step size is 1. Each convolutional neural network branch shares the parameters of the two 1D convolutional neural network layers, transforms the features obtained by the previous 1D convolutional layer, and generates a branch feature tensor; performing an addition operation on the branch feature tensors obtained by each convolutional neural network branch to obtain a branch fusion feature tensor; 2-2-4) Add the initial feature representation tensor to the branch fusion feature tensor, perform a residual fusion operation, and perform a batch normalization operation to obtain a standardized branch fusion feature tensor; 2-2-5) Using the standardized branch fusion feature tensor as input, use at least one fully connected layer to reduce the dimension layer by layer to obtain the load feature; a linear rectification function is used between the fully connected layers; 2-2-6) Take the load feature as input and use 1D convolution to perform load convolution operation to obtain category-sensitive traffic load fingerprint; the number of convolution kernels of 1D convolution is the total number of known IoT device types λ, the convolution kernel size is 1, and the step size is 1.

4. The method for identifying IoT devices based on time-series load flow fingerprints according to claim 1, characterized in that: The specific operation method of the fingerprint fusion operation described in step 2-3) is: 2-3-1) The traffic timing fingerprint obtained in step 2-1) and the traffic load fingerprint obtained in step 2-2) are concatenated according to the feature dimension to obtain a concatenated tensor; the concatenated tensor is used as input and a global average pooling operation is used to calculate the traffic fingerprint of the IoT device; 2-3-2) Take the traffic fingerprint of the IoT device as input, use the normalized exponential function to get the confidence of each category, and take the category with the largest confidence value as the inference of the traffic category of the IoT device for this operation.

5. The method for identifying IoT devices based on time-series load flow fingerprints according to claim 2, characterized in that: The specific operation method of the self-attention temporal feature extraction operation described in step 2-1-3) is: 2-1-3-1) Using the embedded coding tensor with position information in step 2-1-2) as input, use at least one parallel self-attention mechanism to perform multi-head self-attention mechanism operation sub-layer operations to obtain multiple weighted feature matrices; 2-1-3-2) Perform a fully connected feedforward network operation; the fully connected feedforward network is composed of two fully connected layers, and a linear rectification function is referenced in the two fully connected layers; multiple weighted feature matrices are used as input to obtain the output tensor of the fully connected feedforward network; and the weighted feature matrices of the output tensor are added, residual fusion is performed, and layer normalization is performed to obtain a high-dimensional time series feature tensor.

6. An IoT device identification system based on time-series load flow fingerprint using the method described in any one of claims 1-2, comprising an IoT device flow collection and processing module and a device flow identification model building module for a training phase, and an IoT device flow collection and processing module and an IoT device flow identification module for a classification phase; wherein, The IoT device traffic collection and processing module is responsible for extracting the message length sequence information and message byte sequence information from the input raw network traffic data, and processing the two parts into fixed-length sequence information respectively; The device traffic identification model construction module in the training phase is responsible for constructing the neural network used by the device traffic identification model, and uses the labeled message length sequence information and message byte sequence information set containing different IoT device traffic to adjust the network parameters in the neural network so that the device traffic identification model meets the training termination conditions for use in the classification phase; The IoT device traffic identification module in the classification stage is responsible for identifying the IoT device traffic category attributes of the IoT device message length sequence information and message byte sequence information to be identified obtained by the IoT device traffic collection and processing module based on the device traffic identification model generated in the training stage, and outputting the judgment result.

Images