A method and apparatus for identifying IoT devices in active detection scenarios

Abstract

This invention discloses a method and apparatus for identifying IoT devices in an active detection scenario. The method includes: acquiring first network text data, wherein the first network text data includes network text data based on network devices; extracting network image features from the first network text data to output a first image feature vector, and extracting a first statistical feature vector from the first network text data; fusing and concatenating the first image feature vector and the first statistical feature vector to obtain a network device feature vector; and inputting the network device feature vector into a pre-trained neural network classification model to obtain a probability vector, thereby using the probability vector to identify IoT devices. This invention, by converting HTML text into images, not only preserves the features of the HTML text but also utilizes an advanced image feature extraction model to extract more effective features, significantly improving the accuracy of device identification; furthermore, it avoids such problems by utilizing image features, expanding the scope of device identification.

Description

Technical Field

[0001] This invention relates to the field of IoT device identification technology, and in particular to a method and apparatus for identifying IoT devices in active detection scenarios. Background Technology

[0002] The basic idea for identifying IoT devices in active probing scenarios is to actively send probe packets to the target network segment and target port, collect the application layer protocol data returned by the peer, and identify the IoT device based on the returned data. Depending on the identification method, existing technologies can be divided into rule-based matching methods and machine learning-based methods. Representative methods from these two categories are introduced below.

[0003] Existing technologies have proposed an Acquisitional Rule-based Engine (ARE) for IoT device identification in active probing scenarios. This method is based on rule matching, therefore its core technology is the generation of device identification rules.

[0004] Specifically, for the detected raw application-layer data, this method first cleans the data, then extracts data keywords from the raw data, and uses a search engine to search for these keywords, obtaining a series of web pages containing search results. Next, a device entity recognition method is used to extract IoT device information keywords from the web pages, resulting in a mapping from data keywords to IoT device information keywords. Then, the Apriori algorithm is used to filter out reliable mappings, yielding the mapping rules from data keywords to device information, which are the IoT device identification rules. These rules can be used for subsequent IoT device identification.

[0005] Existing technology proposes a method for identifying IoT devices based on web page features, which is based on machine learning. This method focuses on identifying IoT devices with web pages. Specifically, for detected HTML text, the method extracts certain statistical features from the HTML text and uses these statistical features as device features to construct feature vectors. Then, using traditional machine learning methods, a classifier is trained using these feature vectors and corresponding IoT device information tags. This classifier can then be used to identify IoT devices from HTML text.

[0006] In existing technologies, the difficulty in generating recognition rules is mainly due to limitations imposed by the frequency of search engine API usage and search engine results. Furthermore, as the number of recognition rules increases, the accuracy of device recognition decreases because many easily confused rules may emerge. Additionally, existing technologies only consider some statistical features of HTML text, while HTML text actually contains rich image features, which often contain abundant features suitable for device recognition. Therefore, the device recognition performance of this method needs further improvement. Summary of the Invention

[0007] The present invention aims to at least partially solve one of the technical problems in the related art.

[0008] Therefore, the purpose of this invention is to propose a method and apparatus for identifying IoT devices in active detection scenarios, focusing on the identification of IoT devices containing web pages, with the aim of further improving the identification performance of such IoT devices.

[0009] To achieve the above objectives, the present invention proposes a method for identifying IoT devices in an active detection scenario, comprising:

[0010] Acquire first network text data, wherein the first network text data includes network text data based on network devices;

[0011] Extract the network image features of the first network text data and output the first image feature vector, and extract the first statistical feature vector of the first network text data;

[0012] The first image feature vector and the first statistical feature vector are fused and concatenated to obtain the network device feature vector;

[0013] The feature vector of the network device is input into a pre-trained neural network classification model to obtain a probability vector, which is then used to identify IoT devices.

[0014] The IoT device identification method in an active detection scenario according to embodiments of the present invention may also have the following additional technical features:

[0015] Furthermore, in one embodiment of the present invention, the step of extracting network image features from the first network text data and outputting an image feature vector includes: rendering the first network text data using a preset network rendering tool to obtain a network image; and using a pre-trained neural network model to extract features from the network image and output the multi-dimensional image feature vector.

[0016] Furthermore, in one embodiment of the present invention, before inputting the network device feature vector into a pre-trained neural network classification model to obtain a probability vector belonging to the device category, the method further includes: acquiring second network text data, wherein the second network text data includes network text data based on IoT devices containing tag information; extracting network image features from the second network text data to output a second image feature vector, and extracting a second statistical feature vector from the second network text data; fusing and concatenating the second image feature vector and the second statistical feature vector to obtain an IoT device feature vector; and inputting the IoT device feature vector and the tag information into the neural network classification model for training to obtain the pre-trained neural network classification model.

[0017] Furthermore, in one embodiment of the present invention, the step of inputting the network device feature vector into a pre-trained neural network classification model to obtain a probability vector, and using the probability vector to identify IoT devices, includes: inputting the network device feature vector into a pre-trained neural network classification model, and outputting a probability vector of the category being a network device; wherein, each value in the probability vector represents the probability that the current network device feature vector belongs to the corresponding category; comparing the maximum value in the probability vector with a preset confidence threshold, and identifying the IoT device based on the comparison result.

[0018] Furthermore, in one embodiment of the present invention, the neural network classification model includes multiple fully connected layers. The step of inputting the network device feature vector into the pre-trained neural network classification model and outputting a probability vector of the category being a network device includes: extracting associated features from the network device feature vector using a first number of fully connected layers in the neural network classification model; and performing feature dimensionality reduction on the associated features using a second number of fully connected layers, and outputting the probability vector of the category being a network device based on the feature dimensionality reduction result.

[0019] To achieve the above objectives, another aspect of the present invention proposes an IoT device identification device for active detection scenarios, comprising:

[0020] A network text acquisition module is used to acquire first network text data, wherein the first network text data includes network text data based on a network device;

[0021] The feature vector extraction module is used to extract network image features of the first network text data and output a first image feature vector, and to extract a first statistical feature vector of the first network text data;

[0022] The feature vector fusion module is used to fuse and splice the first image feature vector and the first statistical feature vector to obtain the network device feature vector;

[0023] The device feature recognition module is used to input the feature vector of the network device into a pre-trained neural network classification model to obtain a probability vector, so as to use the probability vector to identify the Internet of Things device.

[0024] The IoT device identification method and apparatus in the active detection scenario of this invention can further improve the identification performance of such IoT devices.

[0025] The beneficial effects of this invention are as follows:

[0026] 1) It can significantly improve the ability to identify IoT devices containing web pages in active detection scenarios. Furthermore, the feature engineering method based on web pages proposed in this invention is universal and can be used for feature extraction from general web pages. Therefore, its application scope is not limited to IoT device identification; in the future, it may also be applicable to other classification problems based on web pages.

[0027] 2) This invention innovatively introduces image features, which has the following advantages compared to existing technologies: Existing technologies are all based on text analysis, which is ineffective when processing complex HTML text. This invention converts HTML text into images, which not only preserves the features of HTML text, but also uses advanced image feature extraction models to extract more effective features, greatly improving the accuracy of device recognition; Existing technologies are all based on the analysis of English text, which is almost unable to process raw data of non-English text. This invention uses image features to avoid such problems and expands the scope of device recognition.

[0028] Additional aspects and advantages of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description

[0029] The above and / or additional aspects and advantages of the present invention will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, wherein:

[0030] Figure 1 This is a flowchart of an IoT device identification method in an active detection scenario according to an embodiment of the present invention;

[0031] Figure 2 This is a diagram of a web-based IoT device identification architecture according to an embodiment of the present invention.

[0032] Figure 3 This is a flowchart of web page image feature extraction according to an embodiment of the present invention;

[0033] Figure 4 This is a structural diagram of a neural network classification model according to an embodiment of the present invention;

[0034] Figure 5 This is a schematic diagram of the structure of an IoT device identification device in an active detection scenario according to an embodiment of the present invention. Detailed Implementation

[0035] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0036] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0037] The following description, with reference to the accompanying drawings, illustrates the method and apparatus for identifying IoT devices in an active detection scenario according to embodiments of the present invention.

[0038] An overview of the methods of this invention is as follows Figure 2 As shown, for a detected HTML text, its statistical features are first extracted, followed by its image features. These two sets of features are then fused into the final device feature. This device feature is input into a neural network classifier to obtain a probability vector for the device type. This probability vector can then be used for IoT device identification.

[0039] Figure 1 This is a flowchart of an IoT device identification method in an active detection scenario according to an embodiment of the present invention.

[0040] like Figure 1 As shown, the method includes, but is not limited to, the following steps:

[0041] S1, acquire first network text data, wherein the first network text data includes network text data based on network devices.

[0042] Understandably, this involves retrieving HTML text, which includes web text data from web devices based on web pages.

[0043] S2, extract the network image features of the first network text data and output the first image feature vector, and extract the first statistical feature vector of the first network text data.

[0044] It is understood that the feature extraction of this invention is divided into two parts: statistical feature extraction and image feature extraction. For statistical feature extraction, the main feature fields extracted are shown in Table 1.

[0045] Table 1

[0046]

[0047] As an example, the process for image feature extraction is as follows: Figure 3 As shown. For a raw HTML text, it is first necessary to use the wkhtmltoimg tool to render it into an image, and then use a pre-trained neural network model, in this embodiment of the invention, the EfficientNet model, to extract features from the image and output a 1000-dimensional image feature vector.

[0048] S3, fuse and splice the first image feature vector and the first statistical feature vector to obtain the network device feature vector.

[0049] As an example, in order to obtain the final device feature vector, it is necessary to fuse the statistical feature vector and the image feature vector obtained above. The fusion method is to directly concatenate the two vectors to obtain a high-dimensional feature vector.

[0050] S4. Input the feature vector of the network device into the pre-trained neural network classification model to obtain the probability vector, and use the probability vector to identify IoT devices.

[0051] Understandably, based on the characteristics of the aforementioned feature vectors, this invention designs, as follows: Figure 4 The neural network shown serves as a classifier. The entire classification model consists of five fully connected layers, where n in Ln represents the number of neurons in that layer. First, the model utilizes two high-dimensional L-2048 fully connected layers to mine deep connections in the feature vectors. Then, it uses three consecutive fully connected layers to perform progressive feature dimensionality reduction and achieve classification.

[0052] Specifically, before being used for IoT device identification, this model needs to be trained. Therefore, it first requires obtaining a labeled IoT device dataset. Then, the feature extraction method described above is used to extract device features for each sample in the dataset. Finally, the device features and device labels are input into the classification model for training. The number of training epochs depends on the number of device label categories and the size of the training set.

[0053] When using this model for IoT device identification, the device's feature vector is first input into the model. The classification model then outputs a probability vector, where each value represents the probability that the current feature vector belongs to the corresponding category. The maximum value p in the probability vector is selected. max Then compare it with a pre-set confidence threshold p. thre Compare, if there is pmax ≥p thre If so, then the device corresponding to the feature vector is considered to be an IoT device, and its category is p. max The value corresponds to the category; otherwise, the device is considered not an IoT device.

[0054] The IoT device identification method in active detection scenarios according to embodiments of the present invention converts HTML text into images, which not only preserves the characteristics of HTML text, but also extracts more effective features using advanced image feature extraction models, thus greatly improving the accuracy of device identification; and by using image features, it avoids such problems and expands the scope of device identification.

[0055] To achieve the above embodiments, such as Figure 5 As shown, this embodiment also provides an IoT device identification device 10 for active detection scenarios. The device 10 includes: a network text acquisition module 100, a feature vector extraction module 200, a feature vector fusion module 300, and a device feature recognition module 400.

[0056] The network text acquisition module 100 is used to acquire first network text data, wherein the first network text data includes network text data based on network devices;

[0057] The feature vector extraction module 200 is used to extract network image features of the first network text data, output the first image feature vector, and extract the first statistical feature vector of the first network text data.

[0058] The feature vector fusion module 300 is used to fuse and splice the first image feature vector and the first statistical feature vector to obtain the network device feature vector;

[0059] The device feature recognition module 400 is used to input the feature vector of the network device into a pre-trained neural network classification model to obtain a probability vector, so as to identify the Internet of Things device using the probability vector.

[0060] Furthermore, the aforementioned feature vector extraction module 200 is also used for:

[0061] The first network text data is rendered using a preset network rendering tool to obtain a network image;

[0062] The network image is used to extract features using a pre-trained neural network model, and a multi-dimensional first image feature vector is output.

[0063] Furthermore, prior to the device feature recognition module 400, a model training module is also included. The model training module is used for:

[0064] Acquire second network text data, wherein the second network text data includes network text data based on IoT devices containing tag information;

[0065] Extracting network image features from the second network text data to output a second image feature vector, and extracting a second statistical feature vector from the second network text data; and fusing and concatenating the second image feature vector and the second statistical feature vector to obtain an IoT device feature vector;

[0066] The feature vectors and tag information of IoT devices are input into the neural network classification model for training, resulting in a pre-trained neural network classification model.

[0067] Furthermore, the aforementioned device feature recognition module 400 includes:

[0068] The probability classification subunit is used to input the feature vector of the network device into the pre-trained neural network classification model and output a probability vector of the network device category; where each value in the probability vector represents the probability that the current network device feature vector belongs to the corresponding category;

[0069] The probability comparison subunit is used to compare the maximum value in the probability vector with a preset confidence threshold, and identify IoT devices based on the comparison result.

[0070] Furthermore, the neural network classification model includes multiple fully connected layers, and the aforementioned probabilistic classification subunit is also used for:

[0071] By utilizing the first number of fully connected layers in the neural network classification model, correlation features are extracted from the feature vectors of network devices; and,

[0072] The second number of fully connected layers is used to perform feature dimensionality reduction on the associated features, and the probability vector of the category of network device is output based on the feature dimensionality reduction result.

[0073] The IoT device identification device in the active detection scenario according to the present invention converts HTML text into images, which not only preserves the characteristics of HTML text, but also extracts more effective features using an advanced image feature extraction model, thus greatly improving the accuracy of device identification; and by using image features, it avoids such problems and expands the scope of device identification.

[0074] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this invention, "a plurality of" means at least two, such as two, three, etc., unless otherwise explicitly specified.

[0075] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0076] Although embodiments of the present invention have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of the present invention.

Claims

1. A method for active probing IoT device identification in a scene, the method comprising: The method comprises the following steps: obtaining first network text data, wherein the first network text data comprises network text data based on a network device; extracting network image features of the first network text data to output a first image feature vector, and extracting first statistical feature vectors of the first network text data; fusing and splicing the first image feature vector and the first statistical feature vector to obtain a network device feature vector; inputting the network device feature vector into a pre-trained neural network classification model to obtain a probability vector, so as to identify an Internet of Things device by using the probability vector; the step of extracting network image features of the first network text data to output an image feature vector comprises: rendering the first network text data by using a preset network rendering tool to obtain a network image; extracting features of the network image by using a pre-trained neural network model to output a multi-dimensional image feature vector.

2. The method of claim 1, wherein, Before the network device feature vector is inputted into the pre-trained neural network classification model to obtain a probability vector of a device category, the method further comprises the following steps: obtaining second network text data, wherein the second network text data comprises network text data based on an Internet of Things device and containing label information; extracting network image features of the second network text data to output a second image feature vector, and extracting second statistical feature vectors of the second network text data; and fusing and splicing the second image feature vector and the second statistical feature vector to obtain an Internet of Things device feature vector; inputting the Internet of Things device feature vector and the label information into a neural network classification model for training to obtain the pre-trained neural network classification model.

3. The method of claim 1, wherein, the step of inputting the network device feature vector into the pre-trained neural network classification model to obtain a probability vector, so as to identify an Internet of Things device by using the probability vector, comprises the following steps: inputting the network device feature vector into the pre-trained neural network classification model to output a probability vector of a network device category; wherein each value in the probability vector represents a probability that the current network device feature vector belongs to a corresponding category; comparing a maximum value in the probability vector with a preset confidence threshold, and identifying the Internet of Things device according to a comparison result.

4. The method of claim 3, wherein, the neural network classification model comprises a plurality of fully connected layers, and the step of inputting the network device feature vector into the pre-trained neural network classification model to output a probability vector of a network device category comprises the following steps: extracting associated features in the network device feature vector by using a first number of fully connected layers in the neural network classification model; and performing feature dimension reduction on the associated features by using a second number of fully connected layers, and outputting the probability vector of the network device category according to a feature dimension reduction result.

5. An active probing device identification apparatus in a scene, characterized in that, The method comprises the following steps: a network text acquisition module is configured to obtain first network text data, wherein the first network text data comprises network text data based on a network device; a feature vector extraction module is configured to extract network image features of the first network text data to output a first image feature vector, and extract first statistical feature vectors of the first network text data; The feature vector fusion module is configured to fuse and splice the first image feature vector and the first statistical feature vector to obtain a network device feature vector. The device feature recognition module is configured to input the network device feature vector into a pre-trained neural network classification model to obtain a probability vector, and to identify the Internet of Things device by using the probability vector. The feature vector extraction module is further configured to: render the first network text data by using a pre-set network rendering tool to obtain a network image; extract features of the network image by using a pre-trained neural network model, and output a multi-dimensional first image feature vector.

6. The apparatus of claim 5, wherein, Before the device feature recognition module, a model training module is further included, and the model training module is configured to: obtain second network text data, wherein the second network text data includes network text data based on an Internet of Things device and containing label information; extract network image features of the second network text data to output a second image feature vector, and extract a second statistical feature vector of the second network text data; and fuse and splice the second image feature vector and the second statistical feature vector to obtain an Internet of Things device feature vector; input the Internet of Things device feature vector and the label information into a neural network classification model for training to obtain the pre-trained neural network classification model.

7. The apparatus of claim 5, wherein, The device feature recognition module includes: a probability classification subunit configured to input a network device feature vector into a pre-trained neural network classification model to output a probability vector of a network device category; wherein each value in the probability vector represents a probability that the current network device feature vector belongs to a corresponding category; a probability comparison subunit configured to compare a maximum value in the probability vector with a pre-set confidence threshold, and to identify the Internet of Things device according to a comparison result.

8. The apparatus of claim 7, wherein, The neural network classification model includes a plurality of fully connected layers, and the probability classification subunit is further configured to: extract associated features in the network device feature vector by using a first number of fully connected layers in the neural network classification model; and perform feature dimension reduction processing on the associated features by using a second number of fully connected layers, and output the probability vector of the network device category according to a feature dimension reduction result.

Images