An iot terminal identification system based on cross-layer combined features

Abstract

The application relates to the field of Internet of Things security, and discloses an Internet of Things terminal identification system based on cross-layer combined features, which comprises a data collection module, a phase 0 module, a phase 1 module, a DHCP feature database and a DNS feature database. The phase 0 module receives a DHCP data packet from the data collection module, extracts an option list and an option sequence of a request message in the DHCP data packet, generates a corresponding DHCP feature vector, and classifies devices with the same DHCP feature vector into a group. The phase 1 module receives a DNS data packet from the data collection module, utilizes the mapping characteristics of domain names, uses a text classification model, combines the classification labels given by the phase 0 module, and classifies and identifies the devices in the corresponding group of sub-sample sets. The application considers the identification accuracy and the identification speed under the condition of less resource consumption, and greatly improves the identification efficiency.

Description

Technical Field

[0001] This invention relates to the field of Internet of Things (IoT) security, and more specifically to an IoT terminal identification system based on cross-layer combined features. Background Technology

[0002] The introduction of massive numbers of IoT devices has made access control and asset management more difficult. Furthermore, due to the significant differences in the functions, behavior patterns, and communication modes of IoT devices, the heterogeneity between devices means that general security policies cannot cover all devices. Even if customized security management policies can be manually configured, it is difficult to achieve customized configurations manually in large-scale networks with frequent device changes. To achieve automatic adjustment of customized security management policies, it is necessary to obtain relevant information about the connected devices. Therefore, the key to solving this problem is how to quickly and accurately identify networked devices and obtain their basic information.

[0003] Using device identification technology to solve the above problems is currently widely accepted. Based on the different feature acquisition methods, device identification technology can be divided into two categories: active detection and passive monitoring. Active detection obtains the device's response by injecting signals or probe messages, and uses some fields in the response to complete the identification. The advantage of the active method is high identification accuracy and the ability to obtain additional information, but its stealth is poor, it requires additional bandwidth resources, and it is easily detected by the device. More importantly, active detection relies on the device's response, but many IoT devices are single-function, only receiving commands and lacking the ability to respond. Active detection fails against such devices. In contrast to the active method, the passive method selects to monitor the target device's communication, extracting the required features from the transmitted signals or data packets / frames for identification. Therefore, it does not consume device resources and is not affected by existing defense mechanisms. Similarly, passive monitoring has limitations in acquiring features and difficulty in handling features of encrypted data. In summary, both active detection and passive monitoring have their own advantages and disadvantages, but when the identification accuracy requirements are met, passive monitoring has a wider range of applications and lower costs, and is therefore the mainstream direction of current identification technology.

[0004] Based on feature selection, identification technologies can be divided into two categories. One category utilizes unavoidable defects in the device hardware during manufacturing to identify the device. The other category searches for undefined fields in various communication protocol standards, which are then defined by the manufacturer according to their own device requirements. The former is specific to a single device, with fine-grained identification and high accuracy. Because these features are inherent to the hardware, they are not easily tampered with. However, in the context of massive IoT devices, maintaining a huge device fingerprint database is very costly. Furthermore, over time, device hardware changes due to aging and wear, and although these changes may be very subtle, they can have a significant impact on fingerprint features. The latter, in contrast, has a coarser classification granularity. Since the number of undefined fields in the protocol is limited, and setting different fields for each device is impractical, manufacturers often set fields according to device type. That is, devices of the same type share the same protocol fields. This means that identification technologies using these fields as features can only identify devices at the device type level. However, its advantages are also obvious: rich communication protocols provide a wide range of feature selections, and the identification speed using these features is fast. The recognition accuracy of a single feature may not be very high, but the combination of multiple features can greatly improve the recognition accuracy.

[0005] Device identification technology has been researched for a long time, with different studies focusing on different aspects depending on their identification objectives. Device identification methods used for customized security management strategies need to meet the requirements of fast identification speed, high identification accuracy, and low network consumption. At the same time, because similar devices from the same brand usually have similar QoS and security requirements, the classification granularity needs to reach the level of identifying the device manufacturer and type. However, existing domestic and international technologies cannot adequately meet these requirements.

[0006] Therefore, those skilled in the art are dedicated to developing a device identification system that balances recognition speed, recognition accuracy, and resource consumption. Summary of the Invention

[0007] In view of the above-mentioned deficiencies of the prior art, the purpose of this invention is to propose an IoT terminal identification system based on cross-layer combined features, so as to meet the requirements of fast identification speed, high identification accuracy and low network consumption of device identification methods used for customized security management strategies.

[0008] To achieve the above objectives, this invention provides an IoT terminal identification system based on cross-layer combined features, including a data collection module, a phase 0 module, a phase 1 module, and a DHCP feature database and a DNS feature database; wherein,

[0009] The data collection module collects the communication traffic of devices connected to the network and filters and preprocesses the collected data packets.

[0010] The phase 0 module receives DHCP data packets from the data collection module, extracts the option list and request message option sequence from the DHCP data packets, generates corresponding DHCP feature vectors, and groups devices with the same DHCP feature vectors into a group. If the model gives a classification label of "group X", it means that the device belongs to a known group, and this classification label will be sent to the phase 1 module along with other communication data packets for further identification. If the model gives an unknown classification label, it means that the device belongs to a new group, which is then labeled, and the new label and new features are sent to the model for relearning.

[0011] The Phase 1 module receives DNS data packets from the data collection module, processes DNS domain name features using the mapping characteristics of domain names and the one-hot encoding approach, applies a text classification model suitable for text classification problems, and classifies and identifies devices in the corresponding subsample set using the classification labels provided by the Phase 0 module.

[0012] Preferably, the phase 0 module selects a random forest model that performs well in handling high-dimensional features to classify the devices.

[0013] Preferably, the phase 1 module classifies and identifies devices in the subsample set of the corresponding group, including: if the final classification label given by the model is: manufacturer-type-model, then the entire identification process has been completed; if the given label is: unknown, then similar to the phase 0 module, the new label and features are sent into the model for retraining.

[0014] Preferably, the DHCP feature database stores DHCP features of known device types and their corresponding group tags, as well as DHCP features of new device types obtained through relearning and their corresponding new group tags.

[0015] Preferably, the DNS feature database includes: storing DNS features of known device types and corresponding classification labels, as well as DNS features of new device types obtained through relearning and corresponding new classification labels.

[0016] The present invention also provides an IoT terminal identification method, which utilizes the above-mentioned IoT terminal identification system and includes the following steps:

[0017] Step 101: The data collection module deployed at the gateway continuously monitors the communication traffic of devices connected to the network. If a new device is found to have joined the network, then step 102 is executed.

[0018] Step 102: The data collection module filters out the acquired DHCP data packets and immediately sends them to the phase0 module. At the same time, it continues to monitor the communication traffic of the device. After a predetermined time, it pauses the monitoring of the device and sends the collected DNS data packets to the phase1 module.

[0019] Step 103: After receiving the DHCP data packet from the data collection module, the phase 0 module extracts the first 9 option numbers from the option list in the DHCP data packet and the first 10 option numbers from the request message, and fills them into the DHCP feature vector in sequence to obtain a DHCP feature vector containing 19 features: {δ o1 δ o2 , ..., δ o9 δ r1 δ r2 , ..., δ r10}, where δ oi δ represents the i-th option in the DHCP request. rj This represents the j-th option in the request message. If there are not enough options, the corresponding positions in the feature vector are padded with "0".

[0020] Step 104: Input the generated DHCP feature vector into the trained random forest model to obtain the group label of the device. If the group label is: group X, skip step 105 and proceed to step 106; if the group label is: unknown, proceed to step 105.

[0021] Step 105: Manually set corresponding group labels for the device samples, and send the new labels and new features into the random forest model for relearning. After the relearning is completed, proceed to step 106.

[0022] Step 106: The phase 1 module receives DNS data packets from the data collection module and device group tags from the phase 0 module, extracts a predetermined number m different domain names accessed by the device, and fills the space with zero vectors if the number of domain names is insufficient. The one-to-one algorithm is used to process the features of the predetermined number of DNS domain names to obtain a two-dimensional feature vector of m×66.

[0023] Step 107: Input the generated DNS feature vector into the trained text classification model to give the final classification label of the device. If the classification label is: manufacturer + type + model, then the entire recognition process ends; if the classification label is: unknown, then proceed to step 108.

[0024] Step 108: Add corresponding classification labels to the device, and feed the classification labels and corresponding DNS feature vectors into the text classification model for relearning.

[0025] Preferably, the text classification model is a textCNN model, which is trained using a subset of samples from the group.

[0026] Preferably, the one2one algorithm in step 106 includes the following steps:

[0027] Step 106-1: List all the independent elements that make up the text;

[0028] Step 106-2: Generate a 1×n binary vector for each element, where n is the total number of elements;

[0029] Step 106-3: Divide the text to be processed into individual elements, and superimpose the vectors corresponding to each element. The final vector obtained is the feature vector that can represent the text to be processed.

[0030] The present invention also provides an electronic device, the electronic device comprising:

[0031] At least one processor; and,

[0032] A memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 6-8.

[0033] The present invention also provides a non-transitory computer-readable storage medium storing computer instructions for causing the computer to perform the method described in any one of claims 6-8.

[0034] The IoT terminal identification system based on cross-layer combined features provided by this invention can balance identification accuracy and speed with low resource consumption, greatly improving identification efficiency. Simultaneously, the features used by the system are easy to obtain and difficult to tamper with, possessing universality. Furthermore, this system demonstrates good identification accuracy for both known and unknown devices, and can incorporate the features and labels of unknown devices into the training set for relearning, thereby improving the system's generalization ability. The IoT terminal identification system provided by this invention organically combines the advantages of high identification accuracy, fast identification speed, and low resource consumption, meeting the device identification needs for customized security management strategies.

[0035] The following will further explain the concept, specific structure, and technical effects of the present invention in conjunction with the accompanying drawings, so as to fully understand the purpose, features, and effects of the present invention. Attached Figure Description

[0036] Figure 1 This is a schematic diagram of the overall architecture of an IoT terminal identification system according to a preferred embodiment of the present invention;

[0037] Figure 2 This is a flowchart illustrating the implementation of the phase 0 module of the IoT terminal identification system according to a preferred embodiment of the present invention.

[0038] Figure 3 This is a flowchart illustrating the implementation of the phase 1 module of the IoT terminal identification system according to a preferred embodiment of the present invention. Detailed Implementation

[0039] The following description, with reference to the accompanying drawings, illustrates several preferred embodiments of the present invention to make its technical content clearer and easier to understand. The present invention can be embodied in many different forms, and the scope of protection of the present invention is not limited to the embodiments mentioned herein.

[0040] First, let's introduce the variables used in this invention and their meanings: One-hot encoding, also known as one-hot coding, is a commonly used method for extracting text features. It essentially uses an N-bit state register to encode N states, with each state having an independent register bit, and only one of these register bits being valid; textCNN, a text classification model, has no changes in network structure compared to traditional image CNN networks. Typically, textCNN actually has only one convolutional layer, one max-pooling layer, and finally, the output is externally appended with a softmax function for n classifications.

[0041] like Figures 1-3 As shown, this embodiment of the invention provides an IoT terminal identification system based on cross-layer combined features, including a data collection module, a phase 0 module, a phase 1 module, and a DHCP (Dynamic Host Configuration Protocol) feature database and a DNS (Domain Name System) feature database; wherein,

[0042] The data collection module collects the communication traffic of devices connected to the network and filters and preprocesses the collected data packets.

[0043] The phase 0 module receives DHCP data packets from the data collection module, extracts the option list and request message option sequence from the DHCP data packets, generates corresponding DHCP feature vectors, and groups devices with the same DHCP feature vectors into a group. If the model provides a classification label of "group X", it means that the device belongs to a known group, and this classification label will be sent to the phase 1 module along with other communication data packets for further identification. If the model provides an unknown classification label, it means that the device belongs to a new group, which is then labeled, and the new label and new features are sent to the model for relearning.

[0044] The phase 1 module receives DNS data packets from the data collection module, processes DNS domain name features using the mapping characteristics of domain names and the one-hot encoding approach, applies a text classification model suitable for text classification problems, and classifies and identifies devices in the corresponding subsample set using the classification labels provided by the phase 0 module.

[0045] The IoT terminal identification system based on cross-layer combined features in this embodiment of the invention monitors device traffic accessing the network by being deployed at the gateway. It generates DHCP and DNS feature vectors by filtering and preprocessing the collected data packets. Using certain fields from the DHCP and DNS protocols as features, and combined with a machine learning model, a two-level identification module in a cascaded configuration identifies the types of devices accessing the network. Phase 0 uses DHCP features to classify devices into several coarse-grained groups. Phase 1, building on Phase 0, uses DNS features for further fine-grained classification and provides the final classification label: Manufacturer-Type-Model.

[0046] In one specific embodiment of the present invention, an IoT terminal identification method is provided using the above-described IoT terminal identification system, and includes the following steps:

[0047] Step 101: The data collection module deployed at the gateway continuously monitors the communication traffic of devices connected to the network. If a new device is found to have joined the network, then step 102 is executed.

[0048] Step 102: The data collection module filters out the acquired DHCP data packets and immediately sends them to the phase0 module. At the same time, it continues to monitor the communication traffic of the device. After a predetermined time, it pauses the monitoring of the device and sends the collected DNS data packets to the phase1 module.

[0049] Step 103: After receiving the DHCP data packet from the data collection module, the phase 0 module extracts the first 9 option numbers from the option list in the DHCP data packet and the first 10 option numbers from the request message, and fills them into the DHCP feature vector in sequence to obtain a DHCP feature vector containing 19 features: {δ o1 δ o2 , ..., δ o9 δ r1 δ r2 , ..., δ r10}, where δ oi δ represents the i-th option in the DHCP request. rj This represents the j-th option in the request message. If there are not enough options, the corresponding positions in the feature vector are padded with "0".

[0050] Step 104: Input the generated DHCP feature vector into the trained random forest model to obtain the group label of the device. If the group label is: group X, skip step 105 and proceed to step 106; if the group label is: unknown, proceed to step 105.

[0051] Step 105: Manually set corresponding group labels for the device samples, and send the new labels and new features into the random forest model for relearning. After the relearning is completed, proceed to step 106.

[0052] Step 106: The phase 1 module receives DNS data packets from the data collection module and device group tags from the phase 0 module, and extracts a predetermined number m of different domain names accessed by the device. In a preferred embodiment of the present invention, the predetermined number m is preferably 50. If the number of domain names is less than 50, it is filled with zero vectors. The one2one algorithm is used to process the features of the predetermined number of DNS domain names to obtain a two-dimensional feature vector of m×66.

[0053] In a preferred embodiment of the present invention, the one2one algorithm includes the following steps:

[0054] Step 106-1: List all the independent elements that make up the text;

[0055] Step 106-2: Generate a 1×n binary vector for each element, where n is the total number of elements;

[0056] Step 106-3: Divide the text to be processed into individual elements, and superimpose the vectors corresponding to each element. The final vector obtained is the feature vector that can represent the text to be processed.

[0057] Step 107: Input the generated DNS feature vector into the trained text classification model to give the final classification label of the device. If the classification label is: Manufacturer-Type-Model, then the entire recognition process ends; if the classification label is: Unknown, then proceed to step 108.

[0058] Step 108: Add corresponding classification labels to the device, and feed the classification labels and corresponding DNS feature vectors into the text classification model for relearning.

[0059] Figure 2 The flowchart of the phase 0 module implementation is shown. The recognition process of phase 0 is described below.

[0060] First, DHCP packets from the data collection module are received. The first nine option numbers from the optionlist field and the first ten option numbers from the option 55 field of the request message are extracted as features. If the number of options is insufficient, zeros are padded in the corresponding positions to generate a 1×19 feature vector. Then, the obtained feature vector is fed into a random forest model for identification to obtain the group label of the device to be detected. If the group label is "group X", the group label and other packets from the data collection module are sent to the phase 1 module. If the group label is "unknown", the system administrator will mark a new group label, and the new group label and the corresponding DHCP feature vector will be fed into the machine learning model for relearning.

[0061] Figure 3 The flowchart of the phase 1 module implementation is shown. The recognition process of phase 1 is described below.

[0062] First, DNS data packets from the data collection module are received. The top 50 domain names accessed by the device within 5 minutes of connecting to the network are extracted from these packets and preprocessed; any domains less than 50 are padded with zero vectors. Then, the domain names are processed using a one-to-one algorithm to obtain the DNS feature vector corresponding to the device. Next, based on the group labels provided by the phase 0 module, a textCNN model trained on a subset of the data from the corresponding group is selected for further device identification, yielding the final classification label. If the classification label is: Manufacturer-Type-Model, the entire identification process ends; if the classification label is: Unknown, similar to the phase 0 module, the new classification label marked by the system administrator and the corresponding DNS feature vector are fed into the appropriate textCNN model for relearning.

[0063] The preferred embodiments of the present invention have been described in detail above. It should be understood that those skilled in the art can make numerous modifications and variations based on the concept of the present invention without creative effort. Therefore, all technical solutions that can be obtained by those skilled in the art based on the concept of the present invention through logical analysis, reasoning, or limited experimentation on the basis of existing technology should be within the scope of protection defined by the claims.

Claims

1. An IoT terminal identification system based on cross-layer combined features, characterized in that, It includes a data collection module, a phase 0 module, a phase 1 module, and DHCP and DNS feature databases; among them, The data collection module collects the communication traffic of devices connected to the network and filters and preprocesses the collected data packets. The phase 0 module receives DHCP data packets from the data collection module, extracts the option list and request message option sequence from the DHCP data packets, generates corresponding DHCP feature vectors, and groups devices with the same DHCP feature vectors into one group. Specifically, the generated DHCP feature vectors are fed into a trained random forest model. If the model gives a classification label of "group X", it means that the device belongs to a known group, and this classification label will be sent to the phase 1 module along with other communication data packets for further identification. If the model gives an unknown classification label, it means that the device belongs to a new group, which is then labeled, and the new label and new features are fed into the model for relearning. The phase 1 module receives DNS data packets from the data collection module, processes DNS domain name features using the mapping characteristics of domain names and the one-hot encoding approach, and sends the generated DNS feature vectors into a trained text classification model. Using a text classification model suitable for text classification problems, combined with the classification labels given by the phase 0 module, the device is classified and identified in the corresponding subsample set.

2. The IoT terminal identification system based on cross-layer combined features as described in claim 1, characterized in that, The phase 1 module classifies and identifies devices in the corresponding subsample set, including: if the final classification label given by the model is: manufacturer-type-model, then the entire identification process has been completed; if the given label is: unknown, then similar to the phase 0 module, the new label and features are sent into the model for retraining.

3. The IoT terminal identification system based on cross-layer combined features as described in claim 1, characterized in that, The DHCP feature database stores DHCP features and corresponding group labels for known device types, as well as DHCP features and corresponding new group labels for new device types obtained through relearning.

4. The IoT terminal identification system based on cross-layer combined features as described in claim 1, characterized in that, The DNS feature database includes: storing DNS features and corresponding classification labels for known device types, as well as DNS features and corresponding new classification labels for new device types obtained through relearning.

5. A method for identifying an Internet of Things (IoT) terminal, characterized in that, The IoT terminal identification system as described in any one of claims 1 to 4 includes the following steps: Step 101: The data collection module deployed at the gateway continuously monitors the communication traffic of devices connected to the network. If a new device is found to have joined the network, then step 102 is executed. Step 102: The data collection module filters out the acquired DHCP data packets and immediately sends them to the phase 0 module. At the same time, it continues to monitor the communication traffic of the device. After a predetermined time, it pauses the monitoring of the device and sends the collected DNS data packets to the phase 1 module. Step 103: After receiving the DHCP data packet from the data collection module, the phase 0 module extracts the first 9 option numbers from the option list in the DHCP data packet and the first 10 option numbers from the request message, and fills them into the DHCP feature vector in sequence to obtain a DHCP feature vector containing 19 features: {δ o1 δ o2 , ..., δ o9 δ r1 δ r2 , ..., δ r10 }, where δ oi δ represents the i-th option in the DHCP request. rj This represents the j-th option in the request message. If there are not enough options, the corresponding positions in the feature vector are padded with "0". Step 104: Input the generated DHCP feature vector into the trained random forest model to obtain the group label of the device. If the group label is: group X, skip step 105 and proceed to step 106; if the group label is: unknown, proceed to step 105. Step 105: Manually set corresponding group labels for the device samples, and send the new labels and new features into the random forest model for relearning. After the relearning is completed, proceed to step 106. Step 106: The phase 1 module receives DNS data packets from the data collection module and device group tags from the phase 0 module, extracts a predetermined number m different domain names accessed by the device, and fills them with zero vectors if the number of domain names is insufficient. The one-to-one algorithm is used to process the features of the predetermined number of DNS domain names to obtain a two-dimensional feature vector of m×66. Step 107: Input the generated DNS feature vector into the trained text classification model. The text classification model is trained on a subset of samples of the group corresponding to the device group label in phase 0 module. The final classification label of the device is given. If the classification label is: manufacturer-type-model, the entire recognition process ends. If the classification label is: unknown, proceed to step 108. Step 108: Add corresponding classification labels to the device, and feed the classification labels and corresponding DNS feature vectors into the text classification model for relearning.

6. The IoT terminal identification method as described in claim 5, characterized in that, The text classification model is the textCNN model.

7. The IoT terminal identification method as described in claim 5, characterized in that, The one2one algorithm in step 106 includes the following steps: Step 106-1: List all the independent elements that make up the text; Step 106-2: Generate a 1×n binary vector for each element, where n is the total number of elements; Step 106-3: Divide the text to be processed into individual elements, and superimpose the vectors corresponding to each element. The final vector obtained is the feature vector that can represent the text to be processed.

8. An electronic device, characterized in that, The electronic device includes: At least one processor; and, A memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 5-7.

9. A non-transitory computer-readable storage medium, characterized in that, The non-transitory computer-readable storage medium stores computer instructions for causing the computer to perform the method described in any one of claims 5-7.

Images