Iot device identification method based on locality sensitive hashing in smart home

Abstract

The application discloses a kind of local sensitive hash-based internet of things equipment identification method: (1) obtaining device traffic at gateway, and classifying according to the physical address of specific device;(2) the device traffic of good classification is filtered, slicing and reorganization to create device signature;(3) using local sensitive hash algorithm to generate digest for each signature, digest is stored in digest database together with device label;(4) generate the digest of the traffic to be identified, compare it with all instances in the database, calculate four indexes;(5) use the three linear regression model trained by multi-index evaluation method to fit the similarity score of 10 pieces of signature aggregation, and the device with the highest fitting score is returned as the predicted value of the device.The application can realize fast and accurate fine-grained internet of things equipment identification, and avoids the cumbersome process of feature extraction and model training in machine learning, reduces the computing overhead and is simple to deploy.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of Internet of Things, and more particularly, relates to an Internet of Things device identification method based on local sensitive hashing in a smart home. BACKGROUND

[0002] Internet of Things technology plays an important role in the fields of intelligent transportation, intelligent logistics, intelligent building, intelligent security, intelligent home, etc. In recent years, with the development of Internet of Things technology, the number of Internet of Things devices connected to the Internet has increased dramatically. Internet of Things connects various terminal devices to realize interconnection, and empowers various fields of people's life and production. However, while Internet of Things devices have facilitated our lives, the network security problems and user privacy leakage problems they have brought cannot be ignored. Due to the limited computing resources and security protection capabilities of online devices, attacks on IoT devices in the global market are increasing. If the Internet of Things devices in the smart home cannot be detected in time, it is easy to cause security problems. Identifying Internet of Things devices not only helps to more reasonably allocate resources to meet the different quality of service (QoS) requirements of heterogeneous Internet of Things devices, but also provides data support for security analysis. Therefore, developing an Internet of Things device identification system in a smart home environment can enable users to accurately and timely grasp the fine-grained information of Internet of Things devices connected to the network.

[0003] The main task of the application is to extract features from device traffic and generate device signatures, and then use the LSH function to calculate the digest of the device signature. In general hash algorithms, when the original content changes slightly, the change of the hash value is unpredictable. However, local sensitive hashing (LSH) generates similar digests for similar traffic signatures, so it can be determined whether they come from the same type of device by calculating the similarity score between different traffic digests. After establishing a device traffic signature database, the type, manufacturer and even specific model of unknown devices can be identified.

[0004] Existing Internet of Things device identification schemes mainly fall into two categories: 1) machine learning-based methods. 2) other techniques not based on machine learning. These methods have certain limitations.

[0005] (1) Machine learning-based identification methods

[0006] Machine learning-based identification methods mainly rely on analyzing and identifying the features extracted from the traffic generated by the device. Many methods extract features representing IoT devices from the payload of traffic packets. Although this method can achieve high identification accuracy, accessing packet payloads can pose a significant risk to user data privacy and violate privacy policies and rules. There are also methods that identify by extracting statistical features of device traffic, such as packet size, packet arrival time, and traffic activity time. Although this method does not violate user privacy, the feature design is not universal and requires a lot of manpower to design specific features. Moreover, machine learning generally has the problem of parameter adjustment and retraining of the model.

[0007] (2) Other techniques not based on machine learning

[0008] Other techniques not based on machine learning generally rely on the differences in application layer packets of different IoT devices. Some solutions use network port scanning and regular expressions to construct device type fingerprints, but their fingerprint database needs to be continuously developed by engineers. Some research uses LSH-based automatic fingerprinting of IoT devices to enable network practitioners to identify devices or detect abnormal traffic. However, these methods are more dependent on the size of device traffic, and the identification effect of low-traffic devices that generate less traffic per unit time is poor. In addition, for devices of the same type or from the same supplier, their identification effect is also poor because they have similar traffic patterns. SUMMARY

[0009] To address the above deficiencies and / or improve improvements of prior art, the present application provides an Internet of Things device identification method based on local sensitive hashing in smart home, which aims to achieve fast and accurate fine-grained identification of Internet of Things devices in smart home environment. To avoid the tedious process of feature extraction, parameter adjustment, and retraining of the model in machine learning, the present application uses an automatic construction of device fingerprint library based on local sensitive hashing. To solve the problem of similar traffic patterns of devices of the same type or from the same supplier, the present application adds a feature packet filtering model for fine-grained processing of Internet of Things device traffic. It uses the idea of feature extraction in machine learning and only retains the three types of packets that contribute most to identification. These three types of packets, plus the total number of packets, constitute four key attributes. After filtering, splitting, and recombining, the traffic signature features are extremely obvious, greatly improving the identification performance of similar devices. To solve the problem of poor identification effect of low-traffic devices that generate less traffic per unit time, the present application introduces a multi-index evaluation model, which uses a ternary linear regression model to fit the similarity scores of 10 pieces of signature aggregation, examines the similarity between devices from a longer time range, and solves the identification problem of low-traffic devices at a smaller time cost.

[0010] To achieve the above object, according to one aspect of the present application, a local sensitive hash-based Internet of Things device identification method in a smart home is provided, comprising the following steps:

[0011] (1) obtaining device network traffic data at the gateway;

[0012] (2) preprocessing the traffic data obtained in step (1), and classifying according to the MAC address of the specific device;

[0013] (3) further processing the traffic data in step (2), i.e. feature bag filtering, slicing and recombination, and then creating a device signature;

[0014] (4) using the local sensitive hash algorithm (LSH) to calculate the digest of the device signature generated in step (3), and storing the digest together with the device label in the digest database;

[0015] (5) defining four indicators, using a multi-indicator evaluation method to train a ternary linear regression model, and verifying the model. The model is used to fit the similarity score of 10 pieces of signature aggregation;

[0016] (6) generating the digest of the traffic to be identified, and comparing it with all instances of each device in the database in (4) to calculate the top three indicators;

[0017] (7) inputting the three indicators of the traffic to be identified in (6) into the regression model to fit the similarity score of 10 pieces of signature aggregation. The device with the highest fitting score is returned as the predicted value of the Internet of Things device.

[0018] In one embodiment of the present application, step (1) obtains device network traffic at the gateway, specifically, through tcpdump at the gateway, collects all Internet of Things devices and non-Internet of Things devices in the local area network to the gateway. The collected traffic F N can be expressed as:

[0019]

[0020] where, represents the i-th data packet generated by device d n .

[0021] In one embodiment of the present application, step (2) specifically comprises the following sub-steps:

[0022] (2.1) dividing the network traffic obtained in step (1) according to the fixed MAC address of each device as the device identifier, and obtaining the traffic generated by each device;

[0023] (2.2) Device type and model identification is performed on the flow data of each device obtained in (2.1).

[0024] In one embodiment of the present application, step (3) is specifically divided into three steps: first, feature package filtering, then slice reorganization, and finally generating device signatures.

[0025] (3.1) Feature package filtering. The flow of each device for a day is filtered and screened, and only DNS (Domain Name System) protocol packets, NTP (Network Time Protocol) protocol packets, and three types of data packets with raw data (RAW) are retained, and other data packets are discarded as irrelevant packets.

[0026] (3.2) Slice reorganization. The flow data of a device for a day obtained in (3.1) is sliced into 110 slices, each containing flow data of 13 minutes. Each flow slice is reorganized according to the specified order (DNS, NTP, RAW) and used as a signature of the device. Randomly use 100 signatures as the fingerprint library of the device, and use the remaining 10 signatures for testing. The device d j Flow signatures generated can be represented as:

[0027]

[0028] wherein, represents the device d j a set of DNS protocol data packets generated in 13 minutes, represents the device d j a set of NTP protocol data packets generated in 13 minutes, represents the device d j a set of data packets with raw data generated in 13 minutes.

[0029] In one embodiment of the present application, step (4) includes the following sub-steps:

[0030] (4.1) For each device, use the local sensitive hashing algorithm (LSH) to calculate 110 summaries from the 110 device signatures generated in step (3), and store the summaries in the summary database together with the device label.

[0031] (4.2) For each device, there are 100 summary values in the fingerprint library. When comparing the test summary with the fingerprint library, 100 similarity scores will be generated.

[0032] In one embodiment of the present application, step (5) includes the following sub-steps:

[0033] (5.1) Define four indicators:

[0034] x1: the average of 100 similarity scores;

[0035] x2: the average of top 30 similarity scores;

[0036] x3: the average of top 10 similarity scores.

[0037] y: the average similarity score of 10 pieces of aggregated signatures.

[0038] (5.2) Train a ternary linear regression model using the multi-indicator evaluation method:

[0039] y = β1x1+ 2x2+ 3x3

[0040] Write the regression model expression in matrix form as follows:

[0041] Y = βX

[0042] Where Y is the response variable column vector of the training set, β is the model parameter column vector, X is the m x n dimensional explanatory variable matrix of the training set, m is the number of training set samples, and n is the number of explanatory variables. Get β by matrix operation:

[0043] β = (XX T ) -1 X T Y

[0044] Use the traffic data of another day to generate 484 groups of data (22 devices in pairs, 22 x 22 = 484) for training the ternary linear regression model. Calculation gives

[0045] β1= 0.26; β2= 0.23; β1= 0.51

[0046] (5.3) Verify the ternary linear regression model.

[0047] Use R-squared to evaluate the ternary linear regression model in (6.1). First, calculate the total sum of squares:

[0048]

[0049] Where y i is the i-th sample of the evaluation set, is the average value of y. Then calculate the residual sum of squares:

[0050]

[0051] Finally, calculate R-squared:

[0052]

[0053] The calculated R2 is 0.9593, indicating that the fitting degree is quite high.

[0054] In an embodiment of the present application, step (6) comprises the following sub-steps:

[0055] (6.1) Calculate the digest of the to-be-identified traffic by the local sensitive hashing algorithm (LSH), and compare it with all the digests of all devices in the database in (4). Calculate a set of similarity scores, denoted as:

[0056]

[0057]

[0058] …

[0059]

[0060] wherein, is the similarity score of the i-th digest of the to-be-identified traffic and device d n .

[0061] (6.2) Calculate the first three indicators x1, x2, x3 of the to-be-identified traffic and each device in the database according to the results of (6.1).

[0062] In an embodiment of the present application, step (7) specifically inputs the calculation results of step (6.2) into the ternary linear regression model trained in (5.2), fits the average similarity score of the 10-piece signature aggregation, and returns the device with the highest fitting score as the predicted value of the Internet of Things device.

[0063] Overall, compared with the prior art, the above technical solutions conceived by the present application have the following beneficial effects:

[0064] (1) Simple design and low computational overhead. The present application uses a new identification method based on local sensitive hashing, which does not require the cumbersome operations of feature extraction and parameter adjustment used in machine learning methods, and can complete device identification only by relying on the similarity scores of the LSH digests of different traffic signatures;

[0065] (2) Suitable for identification systems of diversified Internet of Things networks. The present application only selects 3 types of most common feature packets, so it is almost suitable for all Internet of Things devices. When a new device is added to the original network, the present solution can automatically complete the process of collecting traffic, generating signatures, calculating LSH digest values, and joining the database, so the traffic digest database is very easy to expand without the need for retraining;

[0066] (3)Solved the problem of low recognition rate of similar devices in traditional recognition scheme. The feature packet filtering model further processes the Internet of Things device traffic in a fine-grained manner, only retaining the three data packets that contribute most to recognition, and eliminating irrelevant data packets. After filtering, splitting and recombining, the traffic signature features are extremely obvious, greatly improving the recognition performance of similar devices;

[0067] (4)Solved the problem of low recognition rate of low-traffic devices with small time cost. The traffic features contained in each piece of signature of low-traffic devices are too few, and the actual recognition process cannot spend dozens of hours to collect more traffic. The present application uses a ternary linear regression model to fit the similarity scores of 10 pieces of signature aggregation, and examines the similarity between devices from a longer time range, solving the recognition problem of low-traffic devices with small time cost. BRIEF DESCRIPTION OF DRAWINGS

[0068] Figure 1 is a flow chart of an intelligent home Internet of Things device recognition method based on local sensitive hashing in an embodiment of the present application;

[0069] Figure 2(a) is a similarity score color matrix diagram of nine representative devices compared with each other in an embodiment of the present application, wherein Figure 2(a) is a similarity score diagram between original device traffic; Figure 2(b) is a similarity score diagram between device traffic after feature packet filtering;

[0070] Figure 3 is a schematic diagram of generating device traffic signatures in an embodiment of the present application;

[0071] Figure 4 is a comparison diagram of recognition effects of the present application (named CMLSIF) and the machine learning method IoTSentinel, wherein the second Y axis represents the accuracy rate of CMLSIF minus the accuracy rate of IoTSentinel;

[0072] Figure 5 is a comparison diagram of recognition effects of the present application (named CMLSIF) and the machine learning method SysID, wherein the second Y axis represents the precision or recall rate of CMLSIF minus the precision or recall rate of IoTSentinel;

[0073] Figure 6 is a comparison diagram of recognition effects of the present application (named CMLSIF) and the traditional non-machine learning recognition scheme LSIF;

[0074] Fig. 7 is a schematic diagram of a confusion matrix of the identification result of the Internet of Things device in the embodiment of the present application, wherein: Fig. 7(a) is a schematic diagram of a confusion matrix of the identification result of the CMLSIF; and Fig. 7(b) is a schematic diagram of a confusion matrix of the identification result of the traditional non-machine learning identification scheme LSIF. DETAILED DESCRIPTION

[0075] In order to make the objects, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and do not limit the present application. In addition, the technical features involved in each embodiment of the present application described below can be combined with each other as long as they do not conflict with each other.

[0076] As shown in Figure 1 , the intelligent home-based local sensitive hash-based Internet of Things device identification method of the present application comprises the following steps:

[0077] (1) Obtain device network traffic data at the gateway, specifically collect all Internet of Things devices and non-Internet of Things devices in the local area network to the gateway at the gateway through tcpdump. The collected traffic F N can be expressed as:

[0078]

[0079] wherein, represents the i-th packet generated by the device d n .

[0080] (2) Preprocess the traffic data obtained in step (1) and identify the type and model of each device. The name and type of the device are shown in Table 1.

[0081] Table 1: Schematic diagram of detailed information of devices used in the experiment

[0082]

[0083] (2.1) Divide the network traffic obtained in step (1) according to the fixed MAC (Media Access Control Address) address of each device as the device identifier, and obtain the traffic generated by each device;

[0084] (2.2) Identify the type and model of each device traffic data obtained in (2.1).

[0085] (3) Further process the traffic data in step (2), i.e. feature packet filtering, slicing and recombination, and then create a device signature;

[0086] (3.1) Feature packet filtering. The one-day traffic of each device is filtered and screened, only keeping DNS protocol packets, NTP protocol packets and three types of data packets with raw data (RAW), and discarding other data packets as irrelevant packets. In order to verify that feature packet filtering can improve the similarity score of the traffic summary of the same device and reduce the similarity score of the traffic summary of different devices, the present application selects nine representative devices and draws a color matrix table, as shown in Figure 2. Figure 2(a) shows the similarity scores between the original device traffic summaries, and Figure 2(b) shows the similarity scores between the device traffic summaries after feature packet filtering. The results show that after feature packet filtering, the similarity scores between the same devices increase by 4.89%, and the similarity scores between different devices decrease by 25.46%, proving the effectiveness of feature packet filtering.

[0087] (3.2) Slice reorganization. The one-day traffic data of the device obtained in (3.1) is sliced into 110 slices, each slice containing traffic data with a size of 13 min. Each traffic slice is reorganized according to the specified order (DNS, NTP, RAW) and used as the signature of the device. Figure 3 The structure diagram of generating device traffic signatures in the embodiment of the present application is shown, and the structure of each slice of traffic signature is composed of three parts. Random 100 signatures are used as the fingerprint library of the device, and the remaining 10 signatures are used for testing. The device d j Traffic signatures generated may be represented as:

[0088]

[0089] wherein, represents the device d j a set of DNS protocol packets generated in 13 min, represents the device d j a set of NTP protocol packets generated in 13 min, represents the device d j a set of packets with raw data generated in 13 min.

[0090] (4) Using the local sensitive hash algorithm (LSH) to calculate the summary of the device signature generated in step (3), and storing the summary together with the device label in the summary database;

[0091] (4.1) For each device, using the local sensitive hash algorithm (LSH) to calculate 110 summaries from the 110 device signatures generated in step (3), and storing the summaries together with the device label in the summary database.

[0092] (4.2) For each device, there are 100 summary values in its fingerprint library. When comparing the test summary with its fingerprint library, 100 similarity scores are generated.

[0093] (5) Define 4 indicators, use the method of multi-indicator evaluation to train a ternary linear regression model, and verify the model. The model is used to fit the similarity scores of 10 pieces of signature aggregation;

[0094] (5.1) Define 4 indicators:

[0095] x1: the average value of 100 similarity scores;

[0096] x2: the average value of the top 30 similarity scores;

[0097] x3: the average value of the top 10 similarity scores.

[0098] y: the average similarity score of 10 pieces of signature aggregation.

[0099] (5.2) Use the method of multi-indicator evaluation to train a ternary linear regression model:

[0100] y = β1x1 + 2x2 + 3x3

[0101] The regression model expression can be written in matrix form as follows:

[0102] Y = βX

[0103] Where Y is the response variable column vector of the training set, β is the model parameter column vector, X is the m x n dimensional training set of explanatory variable matrix, m is the number of training set samples, and n is the number of explanatory variables. β is obtained by matrix operation:

[0104] β = (XX T ) -1 X T Y

[0105] Use another day's traffic data to generate 484 groups of data (22 devices in pairs, 22 x 22 = 484) for training the ternary linear regression model. It is calculated that

[0106] β1 = 0.26; β2 = 0.23; β1 = 0.51

[0107] (5.3) Verify the ternary linear regression model.

[0108] Use R-squared to evaluate the ternary linear regression model in (6.1). First, calculate the total sum of squares:

[0109]

[0110] where y i is the i-th sample of the evaluation set, is the mean of y. Then the residual sum of squares is calculated:

[0111]

[0112] Finally, the R-squared is calculated:

[0113]

[0114] The calculated R2 is 0.9593, indicating a fairly high degree of fitting.

[0115] (6) Generate the summary of the traffic to be identified and compare it with all instances of each device in the database in (4), and calculate the top 3 indicators;

[0116] (6.1) Calculate the summary of the traffic to be identified by the local sensitive hashing algorithm (LSH), and compare it with all summaries of all devices in the database in (4). Calculate the set of similarity scores, denoted as:

[0117]

[0118]

[0119] …

[0120]

[0121] where, is the similarity score of the i-th summary of the traffic to be identified and the device d n .

[0122] (6.2) Calculate the top three indicators x1, x2, x3 of the traffic to be identified and each device in the database from the results of (6.1).

[0123] (7) Input the calculation results of (6.2) into the ternary linear regression model trained in (5.2), fit the average similarity score of 10 pieces of signature aggregation, and return the device with the highest fitting score as the predicted value of the Internet of Things device.

[0124] (8) The device identification scheme described above is named CMLSIF. The present application completes the comparative experiment of CMLSIF and traditional machine learning scheme, traditional LSH scheme on three public data sets (setup data set: traffic generated in the device setting stage; idle data set: traffic generated in the device resting state; active data set: traffic generated in the device active state).

[0125] (8.1)Figure 4 shows the accuracy comparison of CMLSIF and a traditional machine learning based identification scheme (IoTSentinel) on the setup dataset. From Figure 5 It can be seen that the identification effect of CMLSIF on the first 16 devices is similar to that of IoTSentinel, but for the last 11 devices, the identification effect of CMLSIF is better than that of IoTSentinel.

[0126] (8.2) Figure 5 shows the performance comparison of CMLSIF and another machine learning based identification scheme (SysID) on the setup dataset. Overall, CMLSIF has equal or better identification performance for almost all devices except Withings.

[0127] (8.3) Figure 6 visually shows the performance difference of CMLSIF and a traditional LSH based identification scheme (LSIF) in 6 evaluation indicators. Figure 7 shows the confusion matrix diagram of the classification results of CMLSIF and LSIF on the active dataset, respectively. Among them: Figure 7(a) is the confusion matrix diagram of the identification result of CMLSIF; Figure 7(b) is the confusion matrix diagram of the identification result of the traditional non-machine learning identification scheme LSIF. Overall, the classification performance of the proposed CMLSIF is much better than that of LSIF, and CMLSIF can effectively solve the misidentification problem caused by similar traffic patterns or lack of data packets.

[0128] Those skilled in the art will readily understand that the above description is only the preferred embodiment of the present application, and is not intended to limit the present application, and any modifications, equivalent replacements and improvements made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1.A method for identifying an Internet of Things (IoT) device based on locality sensitive hashing in a smart home, the method comprising: The method comprises the following steps: (1) obtaining network traffic data of Internet of Things devices at the smart home intranet gateway; (2) preprocessing the traffic data obtained in step (1) and classifying according to the MAC address of the specific device; (3) further processing the traffic data in step (2), i.e. feature packet filtering, slicing and reorganization, and then creating a device signature; (4) using the local sensitive hashing algorithm LSH to calculate the digest of the device signature generated in step (3), and storing the digest together with the device label in the digest database; (5) defining four indicators, using a multi-index evaluation method to train a ternary linear regression model, and verifying the model; the model is used to fit the similarity score of 10 signature aggregations; step (5) comprises the following sub-steps: (5.1) defining four indicators: x1: the average of 100 similarity scores; x2: the average of the top 30 similarity scores; x3: the average of the top 10 similarity scores; y: the average similarity score of 10 signature aggregations; (5.2) using a multi-index evaluation method to train a ternary linear regression model: y = β1x1 + β2x2 + β3x3 Write the regression model expression in matrix form as follows: Y = βX Where Y is the response variable column vector of the training set, β is the model parameter column vector, X is the m*n dimensional training set of explanatory variable matrix, m is the number of training set samples, and n is the number of explanatory variables; obtain β through matrix operation: β = (XX T ) -1 X T Y Use another day's traffic data to generate 484 groups of data for training the ternary linear regression model; calculate β1＝0.26；β2＝0.23；β1＝0.51 (5.3) verify the ternary linear regression model; Use R-squared to evaluate the ternary linear regression model in (6.1); first calculate the total sum of squares: where y i is the ith sample of the evaluation set, is the mean of y; then the residual sum of squares is computed: Finally, calculate R-squared: The calculated R2 is 0.9593, indicating a very high fitting degree; (6) generate the digest of the traffic to be identified and compare it with all instances of each device in the database in (4) to calculate the top three indicators; (7) input the three indicators of the traffic to be identified in (6) into the regression model to fit the similarity score of 10 signature aggregations, and return the device with the highest fitting score as the predicted value of the Internet of Things device. 2.The method of claim 1, wherein The network flow data of the Internet of Things device is acquired at the smart home inner network gateway, specifically, at the gateway, through tcpdump, all Internet of Things devices and non-Internet of Things devices in the local area network are collected in units of days, and the flow sent to the gateway; the collected flow F of one day N may be represented as: wherein, representing device d n generated ith data packet. 3.The method of claim 1, wherein, Step (2) comprises the following sub-steps: (2.1) divide the network traffic obtained in step (1) according to the fixed MAC address of each device as the device identifier to obtain the traffic generated by each device; (2.2) identify the device type and model of each device traffic data obtained in (2.1). 4.The method of claim 1, wherein Step (3) is divided into three steps: first, feature packet filtering, then slicing and reorganization, and finally generating a device signature, which specifically includes: (3.1) feature packet filtering, filtering and screening the traffic generated by each device in a day, only retaining DNS protocol packets, NTP protocol packets and three types of data packets with raw data RAW, and discarding other data packets as irrelevant packets; (3.2) Slice reorganization, slice the traffic data of a device in a day into 110 slices, each slice contains traffic data with size of 13 min, reorganize each traffic slice according to the specified order DNS, NTP, RAW, and use it as the signature of the device; use 100 random signatures as the fingerprint library of the device, and the remaining 10 signatures for testing; device d j Traffic signature generated may be expressed as: wherein, representing device d j a set of DNS protocol packets generated in 13 min, representing device d j a set of NTP protocol packets generated in 13 min, representing device d j a set of packets with raw data generated in 13 min. 5.The method of claim 1, wherein Step (4) comprises the following sub-steps: (4.1) For each device, use the local sensitive hashing algorithm LSH to calculate 110 summaries from the 110 device signatures generated in step (3), and store the summaries in the summary database together with the device label; (4.2) For each device, there are 100 summary values in its fingerprint library; when comparing the test summary with its fingerprint library, 100 similarity scores will be generated. 6.The method of claim 1, wherein, The step (6) includes the following sub-steps: (6.1) Calculate the summary of the traffic to be identified by the local sensitive hashing algorithm LSH, and compare it with all summaries of all devices in the database in (4); calculate a set of similarity scores, denoted as: wherein, is the i-th summary of the flow and device d to be identified n the similarity score of the i-th summary (6.2) Calculate the first three indicators x1, x2, x3 of the traffic to be identified and each device in the database from the results of (6.1). 7.The method of claim 6, wherein, The step (7) specifically inputs the calculation results of step (6.2) into the ternary linear regression model trained in (5.2), fits the average similarity scores of the 10-piece signature aggregation, and returns the device with the highest fitting score as the predicted value of the Internet of Things device.

Images