A network device identification method, device, apparatus and storage medium

Abstract

The application discloses a network device identification method and device, equipment and a storage medium. The method comprises the following steps: obtaining at least two characteristics of a network device to be identified; determining at least one similarity between the network device to be identified and at least one network device based on the at least two characteristics of the network device to be identified and a characteristic table of the at least one network device in a preset device library; determining a first network device with a matching success based on the at least one similarity; and obtaining a device type corresponding to the first network device as a device type of the network device to be identified. In this way, the similarity between the network device to be identified and each network device in the device library is determined by comparing the at least two characteristics of the network device to be identified with the at least two characteristics in the characteristic table of each network device in the device library, the similarity is determined based on the comparison result in multiple dimensions, the accuracy of the similarity result can be improved, and the accuracy of the identification result is further improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network communication, and in particular to a network device identification method and device, equipment and storage medium. BACKGROUND

[0002] In a network environment, there are a large number of network devices, in order to prevent illegal network devices from accessing the network and causing serious consequences, it is necessary to identify the network devices. In the prior art, traffic data is often used to identify network devices. In the process of identifying network devices using traffic data, the process is mainly divided into IP division and User-Agent identification, wherein the IP division is used to determine the network device to be identified, and the User-Agent identification is used to determine the type of the network device to be identified. The User-Agent identification is usually performed by matching the keywords in the User-Agent with the keywords in the device keyword matching library to determine the type of the network device to be identified. The User-Agent identification method is a simple keyword matching method, and has the problem of low identification accuracy. SUMMARY

[0003] To solve the above technical problems, the embodiments of the present application expect to provide a network device identification method, device, equipment and storage medium.

[0004] The technical solution of the present application is implemented as follows:

[0005] In a first aspect, a network device identification method is provided, the method comprising:

[0006] obtaining at least two features of a network device to be identified;

[0007] determining at least one similarity between the network device to be identified and at least one network device in a preset device library based on the at least two features of the network device to be identified and a feature table of the at least one network device in the preset device library, wherein the feature table comprises at least two features of each network device;

[0008] determining a first network device matched successfully based on the at least one similarity;

[0009] obtaining a device type corresponding to the first network device as a device type of the network device to be identified.

[0010] In the scheme, the determining the at least one similarity between the to-be-identified network device and the at least one network device based on the at least two features of the to-be-identified network device and the feature table of the at least one network device in the preset device library comprises: comparing the features in the second network device feature table with the features of the to-be-identified network device to determine at least one same feature between the second network device and the to-be-identified network device; and determining the similarity between the to-be-identified network device and the second network device based on the at least one same feature.

[0011] In the scheme, the feature table further comprises a feature weight corresponding to each feature; and the determining the similarity between the to-be-identified network device and the second network device based on the at least one same feature comprises: determining the similarity between the to-be-identified network device and the second network device based on the at least one same feature and the feature weight of the at least one same feature.

[0012] In the scheme, the comparing the features in the second network device feature table with the features of the to-be-identified network device to determine at least one same feature between the second network device and the to-be-identified network device comprises: calculating a cosine similarity between a first feature of the to-be-identified network device and a second feature of the second network device; and determining that the first feature and the second feature are same features if the cosine similarity is greater than or equal to a preset cosine similarity threshold; the first feature is one feature of the to-be-identified network device, and the second feature is one feature in the feature table of the second network device.

[0013] In the scheme, the feature table further comprises a feature weight corresponding to each feature; and the method further comprises: obtaining a training set; wherein the training set comprises at least one training network device and at least two features corresponding to the training network device; determining at least one similarity between the training network device and at least one network device in the device library based on the at least two features of the training network device and the feature table of the at least one network device; determining whether the training network device matches the network device in the device library successfully based on the at least one similarity; and adjusting the feature weight of the network device corresponding to the maximum value in the at least one similarity between the training network device and the at least one network device until the matching is successful, to obtain a trained feature weight, if the matching fails.

[0014] In the scheme, the method further comprises: determining a matching failure based on the at least one similarity, recording a number of matching failures and a total number of recognitions from a last training end to a current time on the device library; calculating a ratio of the number of matching failures to the total number of recognitions; and training the device library if the ratio is greater than or equal to a preset ratio threshold.

[0015] In the scheme, the device library further comprises: a similarity range corresponding to each network device; and the first network device with a matching success determined based on the at least one similarity comprises: determining a maximum value of the at least one similarity; and the maximum value of the similarity is within the similarity range of the corresponding network device, and the network device corresponding to the maximum value of the similarity is taken as the first network device.

[0016] In the scheme, the method further comprises: determining a matching failure if the maximum value of the similarity is outside the similarity range of the corresponding network device; and adding the network device to be recognized as a new network device to the device library.

[0017] In the scheme, the method further comprises: determining an acquisition difficulty value of each feature; and determining a traversal order of at least one network device in the device library based on the acquisition difficulty value.

[0018] The traversal order is used to indicate a similarity determination order of the network device to be recognized and the at least one network device.

[0019] In a second aspect, a network device recognition apparatus is provided, and the apparatus comprises:

[0020] An acquisition module is configured to acquire at least two features of a network device to be recognized.

[0021] A processing module is configured to determine at least one similarity of the network device to be recognized and at least one network device based on the at least two features of the network device to be recognized and a feature table of the at least one network device in a preset device library, wherein the feature table comprises at least two features of each network device.

[0022] The processing module is further configured to determine a first network device with a matching success based on the at least one similarity.

[0023] The acquisition module is further configured to acquire a device type corresponding to the first network device as a device type of the network device to be recognized.

[0024] In a third aspect, a network device identification device is provided, and the device comprises a processor and a memory configured to store a computer program capable of running on the processor, wherein the processor is configured to execute the steps of the method of any preceding aspect when running the computer program.

[0025] In a fourth aspect, a computer storage medium is provided, and the computer storage medium stores a computer program, wherein the computer program is executed by a processor to implement the steps of the method.

[0026] The present application discloses a network device identification method, which determines the similarity between a to-be-identified network device and each network device in a device library by comparing at least two features of the to-be-identified network device with at least two features in a feature table of each network device in the device library, and determines the similarity based on the comparison results in multiple dimensions, thereby improving the accuracy of the similarity results and further improving the accuracy of the identification results. BRIEF DESCRIPTION OF DRAWINGS

[0027] Figure 1 FIG. 1 is a first flowchart of a network device identification method according to an embodiment of the present application;

[0028] Figure 2 FIG. 2 is a second flowchart of a network device identification method according to an embodiment of the present application;

[0029] Figure 3 FIG. 3 is a third flowchart of a network device identification method according to an embodiment of the present application;

[0030] Figure 4 FIG. 4 is a structural diagram of a network device identification device according to an embodiment of the present application;

[0031] Figure 5 FIG. 5 is a structural diagram of a network device identification device according to an embodiment of the present application. DETAILED DESCRIPTION

[0032] In order to enable more detailed understanding of the features and technical contents of the embodiments of the present application, the implementation of the embodiments of the present application will be described in detail below with reference to the accompanying drawings, which are only used for reference and do not limit the embodiments of the present application.

[0033] Figure 1 FIG. 1 is a first flowchart of a network device identification method according to an embodiment of the present application. As shown in FIG. 1, the network device identification method can specifically include: Figure 1

[0034] Step 101: Obtain at least two features of a to-be-identified network device;

[0035] ​Here, the network device is a physical entity connected to a computer network. Exemplarily, the network device is a computer (whether it is a personal computer or a server), a hub, a switch, a bridge, a router, a gateway, a network interface card, a wireless access point, a printer and a modem, a fiber transceiver, an optical cable, etc. The network device to be identified is an unknown device, and the identification result can be the device type and model of the network device.

[0036] Here, the at least two features are attribute information corresponding to the network device, which can be obtained by analyzing the data of the network device. Exemplarily, the at least two features can be device identification keywords, operating systems, total traffic rates, system names, etc.

[0037] Step 102: determining at least one similarity between the network device to be identified and at least one network device in the preset device library based on the at least two features of the network device to be identified and the feature table of the at least one network device in the preset device library.

[0038] In the feature table, the at least two features of each network device are included.

[0039] Here, the preset device library is a database containing the feature table of at least one network device, and the network devices in the device library can be updated continuously. The feature table contains at least two features of the data network device.

[0040] Here, the similarity between the network device to be identified and a network device in the device library is determined, which is used to represent the similarity between the identified device and the network device.

[0041] Exemplarily, the similarity between the network device to be identified and a network device in the device library can be determined by comparing the at least two features of the network device to be identified with the features in the feature table of the network device, and determining the similarity between the network device to be identified and the network device according to the comparison result.

[0042] Exemplarily, in some embodiments, the determining at least one similarity between the network device to be identified and at least one network device in the preset device library based on the at least two features of the network device to be identified and the feature table of the at least one network device in the preset device library comprises: comparing the features in the feature table of the second network device with the features of the network device to be identified to determine at least one same feature between the second network device and the network device to be identified; wherein the second network device is any network device in the device library; and determining the similarity between the network device to be identified and the second network device based on the at least one same feature.

[0043] Exemplarily, in some embodiments, the method further comprises: traversing the device library, and calculating the similarity between the to-be-identified network device and each network device in the device library.

[0044] Exemplarily, in some embodiments, the method further comprises: determining an acquisition difficulty value of each feature; determining a traversal order corresponding to at least one network device in the device library based on the acquisition difficulty value; and wherein the traversal order is used to indicate the similarity determination order of the to-be-identified network device and the at least one network device.

[0045] By sorting the network devices in the device library, the recognition efficiency can be improved.

[0046] Step 103: determining a first network device that matches successfully based on the at least one similarity.

[0047] Here, the matching success indicates that there is a network device in the device library that matches the to-be-identified network device. The first network device is the network device in the database that has the highest similarity with the to-be-identified network device, and is used to determine the recognition result of the to-be-identified network device based on the first network device. Exemplarily, the recognition result can be the determination of the device type, device model, etc. of the to-be-identified network device.

[0048] Exemplarily, in some embodiments, the device library further comprises: a similarity range corresponding to each network device; and the determining of the first network device that matches successfully based on the at least one similarity comprises: determining a maximum value of the at least one similarity; and determining the network device corresponding to the maximum value of the similarity as the first network device, if the maximum value of the similarity is within the similarity range of the corresponding network device.

[0049] Exemplarily, in some embodiments, the method further comprises: if the maximum value of the similarity is outside the similarity range of the corresponding network device, determining a matching failure; and adding the to-be-identified network device as a new network device to the device library.

[0050] Here, the matching failure indicates that there is no network device in the device library that matches the to-be-identified network device. By adding the to-be-identified network device as a new network device to the device library when the matching fails, the network devices in the device library can be automatically enriched in the continuous recognition process, and self-adaptive recognition can be achieved without hot start.

[0051] Exemplarily, in some embodiments, the method further comprises: determining a matching failure based on the at least one similarity, recording a number of matching failures and a total number of recognitions of the device library from the last training end to the current time; calculating a ratio of the number of matching failures to the total number of recognitions; and training the device library if the ratio is greater than or equal to a preset ratio threshold.

[0052] Here, the preset ratio threshold can be understood as a preset failure rate. When the ratio of the number of matching failures to the total number of recognitions of the device library from the last training end to the current time is greater than or equal to the preset ratio threshold, it indicates that the error of network device recognition based on the device library is large, and the device library needs to be trained. Exemplarily, in actual application, training the device library can be training the features and / or feature weights in the feature table of the network device in the device library.

[0053] By training the device library when the failure rate reaches the preset failure rate, dynamic adjustment and update of the device library can be achieved, and the recognition efficiency can be improved.

[0054] Step 104: Obtain the device type corresponding to the first network device as the device type of the network device to be identified.

[0055] Here, the device type can also be device model information, etc., which is used to distinguish network devices.

[0056] Here, the execution subject of steps 101 to 104 can be a processor of a network device identification device.

[0057] The technical solution of the present application determines the similarity of the network device to be identified and each network device in the device library by comparing at least two features of the network device to be identified with at least two features in the feature table of each network device in the device library, realizes determining the similarity based on the comparison results of multiple dimensions, and can improve the accuracy of the similarity results and the accuracy of the recognition results.

[0058] In order to better reflect the purpose of the present application, on the basis of the embodiments of the present application, further example is given, Figure 2 is a second flowchart of the network device identification method in the embodiments of the present application. As shown in Figure 2 The network device identification method can specifically include:

[0059] Step 201: Obtain at least two features of the network device to be identified;

[0060] Here, the network device is a physical entity connected to a computer network. Exemplarily, the network device is a computer (whether it is a personal computer or a server), a hub, a switch, a bridge, a router, a gateway, a network interface card, a wireless access point, a printer and a modem, a fiber transceiver, an optical cable, etc. The network device to be identified is an unknown device, and the identification result can be the device type and the device model of the network device.

[0061] Here, the at least two features are attribute information corresponding to the network device, which can be obtained by analyzing the data of the network device. Exemplarily, the at least two features can be a device identification keyword, an operating system, a total traffic rate, a system name, etc. of the network device.

[0062] Step 202: comparing the features in the second network device feature table with the features of the network device to be identified, to determine at least one same feature of the second network device and the network device to be identified.

[0063] Here, the second network device is any network device in the device library.

[0064] Here, the preset device library is a database containing a feature table of at least one network device, and the network devices in the device library can be updated continuously. The feature table contains at least two features of the data network device.

[0065] Here, the similarity between the network device to be identified and a network device in the device library is used to represent the similarity between the identified device and the network device.

[0066] Exemplarily, in some embodiments, the method further comprises: traversing the device library to calculate the similarity between the network device to be identified and each network device in the device library.

[0067] Exemplarily, in some embodiments, the method further comprises: determining an acquisition difficulty value of each feature; determining a traversal order corresponding to at least one network device in the device library based on the acquisition difficulty value; wherein the traversal order is used to indicate the similarity determination order between the network device to be identified and the at least one network device.

[0068] Step 203: determining the similarity between the network device to be identified and the second network device based on the at least one same feature.

[0069] Exemplarily, in some embodiments, the determination of the similarity between the network device to be identified and the second network device based on the at least one same feature can be based on the number of same features or the proportion of same features in the total features in the second network device feature table, to determine the similarity between the network device to be identified and the second network device.

[0070] Exemplarily, in some embodiments, the feature table further comprises: a feature weight corresponding to each feature; and determining the similarity between the network device to be identified and the second network device based on the at least one same feature comprises: determining the similarity between the network device to be identified and the second network device based on the at least one same feature and the feature weight of the at least one same feature.

[0071] Exemplarily, in actual application, determining the similarity between the network device to be identified and the second network device based on the at least one same feature and the feature weight of the at least one same feature can be: generating a comparison result list based on the at least one same feature and the feature table of the second network device, wherein the comparison result of the same feature is 1, and the comparison result of the remaining features in the feature table is 0; calculating the product of the comparison result of all features in the result list and the corresponding feature weight and summing up to obtain the similarity between the network device to be identified and the second network device.

[0072] Exemplarily, in some embodiments, determining the at least one same feature between the second network device and the network device to be identified by comparing the features in the feature table of the second network device with the features of the network device to be identified comprises: calculating the cosine similarity of a first feature of the network device to be identified and a second feature of the second network device; if the cosine similarity is greater than or equal to a preset cosine similarity threshold, determining that the first feature and the second feature are the same feature; the first feature is a feature of the network device to be identified, and the second feature is a feature in the feature table of the second network device.

[0073] Exemplarily, in actual application, each feature can be represented by a feature vector, and calculating the cosine similarity of the first feature of the network device to be identified and the second feature of the second network device can be obtained by calculating the cosine similarity between a first vector representing the first feature and a second vector representing the second feature.

[0074] Step 204: determining the maximum value of the at least one similarity;

[0075] Step 205: the maximum value of the similarity is located in the similarity range of the corresponding network device, and the network device corresponding to the maximum value of the similarity is taken as the first network device.

[0076] Here, the device library predefines the similarity range corresponding to each network device.

[0077] Step 206: obtaining the device type corresponding to the first network device as the device type of the network device to be identified.

[0078] Step 207: determining that the matching fails when the maximum similarity is outside the similarity range of the corresponding network device;

[0079] Step 208: adding the network device to be identified as a new network device to the device library;

[0080] For example, adding the network device to be identified as a new network device to the device library includes: obtaining default feature weight values and a default similarity range; constructing a feature table of the new network device based on the features of the features to be identified and the default feature weight values; and adding the feature table and the similarity range of the new network device to the device library.

[0081] Step 209: recording the number of matching failures and the total number of recognitions from the last training end to the current time on the device library;

[0082] Step 210: calculating the ratio of the number of matching failures to the total number of recognitions;

[0083] Step 211: training the device library when the ratio is greater than or equal to a preset ratio threshold.

[0084] Here, the preset ratio threshold can be understood as a preset failure rate. When the ratio of the number of matching failures to the total number of recognitions from the last training end to the current time on the device library is greater than or equal to the preset ratio threshold, it indicates that the error of network device recognition based on the device library is large, and the device library needs to be trained. For example, when the feature table further includes a feature weight corresponding to each feature, training the device library can be training the feature weight in the feature table of the network device in the device library.

[0085] For example, in some embodiments, the method further includes training the device library. For example, the feature table further includes a feature weight corresponding to each feature; and the training of the device library includes: obtaining a training set; wherein the training set includes at least one training network device and at least two features corresponding to the training device; determining at least one similarity between the training network device and at least one network device in the device library based on the at least two features of the training network device and the feature table of the at least one network device in the device library; determining whether the training network device matches the network device in the device library based on the at least one similarity; if the matching fails, adjusting the feature weight of the network device corresponding to the maximum value of the at least one similarity between the training network device and the at least one network device until the matching succeeds, to obtain the trained feature weight.

[0086] By training the feature weight in the device library when the failure rate reaches the preset failure rate, dynamic adjustment and update of the device library can be realized, and the recognition efficiency is improved.

[0087] Here, the execution subject of steps 201 to 211 can be a processor of a network device recognition device.

[0088] The technical scheme of the present application determines the similarity between the network device to be identified and the network device in the device library by comparing at least two features of the network device to be identified with the feature table of the network device in the device library, which can determine the similarity between the two network devices based on the comparison results in multiple dimensions, improve the accuracy of the similarity results, and make the recognition results based on the similarity more accurate. By adding the network device to be identified as a new network device to the device library when the matching fails, the network devices in the device library can be automatically enriched in the continuous identification process, adaptive identification is realized, and hot start is not required. By training the device library when the failure rate reaches the preset value, dynamic adjustment and update of the device library can be realized, and the recognition efficiency is improved.

[0089] In order to better reflect the purpose of the present application, on the basis of the embodiments of the present application, further example is given, Figure 3 The third flowchart of the network device recognition method in the embodiments of the present application is shown in FIG. 3. Figure 3 As shown in the figure, the network device recognition method can specifically include:

[0090] Step 301: training to obtain a device library;

[0091] The device library includes a feature table of at least one network device; the feature table includes at least two features and feature weights.

[0092] The training of the device library specifically includes the following steps 311-313:

[0093] Step 311: define a global variable similarity overall threshold mapping Z, including the similarity range of each network device in the initial device library.

[0094] Step 312: define a global variable non-threshold range elasticity ratio V (equivalent to the ratio threshold in the present application).

[0095] The non-threshold range elasticity ratio V is used to determine whether the device library needs to be trained. Specifically, when the ratio of the number of matching failures from the last training of the device library to the current time to the total number of recognitions is greater than or equal to V, it means that the feature weight setting in the device library is problematic or some features are not included, and adjustment is needed.

[0096] Step 313: training to obtain a device library.

[0097] Specifically, given U known types of network devices, the characteristics and initial weights of each known type of network device are obtained to form an initial feature table; the similarity S of each network device is calculated based on a cosine similarity algorithm r , as follows:

[0098]

[0099] In the formula, S r represents the similarity of network device r, X i represents the comparison result of each feature, a i represents the feature weight of each feature, and N represents the number of features in the feature table of network device r. The formula states that for each feature of network device r, a complete match is performed with the features of the network device of the same type in the device library. If it matches, the comparison result of the feature is 1, otherwise the comparison result is 0.

[0100] If S r is not within the similarity range Z w of the network device of the same type (if there is no similarity range, take the default value), it means that the weight setting is biased, and a self-learning algorithm is used for training until it is within the range Z w , the weight value is updated or new features are added to the feature table of the network device of the same type, and the network device r is added to the device library.

[0101] Here, the feature table is a pre-set list containing at least two features. It is used for feature comparison based on the features in the list. The feature table also includes feature weights, and the sum of the feature weights of all features in the feature table of each network device is 1. The weight update condition is used to guide the feature weight training. For example, Table 1 is a feature table.

[0102] Table 1

[0103]

[0104]

[0105]

[0106] Step 302: Sort the network devices in the device library;

[0107] Wherein, the sorting reference is the matching difficulty, the easier the better. Specifically: determine the acquisition difficulty value of each feature; determine the traversal order corresponding to at least one network device in the device library based on the acquisition difficulty value; wherein the traversal order is used to indicate the similarity determination order of the network device to be identified and the at least one network device.

[0108] Step 303: traversing the device library, calculating the similarity of the network device to be identified;

[0109] Specifically, for each network device w to be identified, the cosine similarity algorithm is used to calculate the similarity Y w , and the formula is as follows:

[0110]

[0111] The formula states that for each feature of the current network device to be identified, a complete match is performed with each feature of each network device in the device library. If it is matched, it is 1, otherwise it is 0. Wherein, Y w represents the similarity of the network device to be identified, X i represents the comparison result of each feature item obtained, a i represents the feature weight of each feature item.

[0112] Step 304: determine the maximum value of the similarity;

[0113] Specifically, the maximum similarity value Y w is selected from all Y max , and the corresponding network device is w max .

[0114] Step 305: determine whether the maximum value meets the similarity threshold;

[0115] Specifically, the similarity Y max of the collected network device is compared with the similarity threshold Z max of the network device w w in the saved device library. If it is within the range of Z w , it means that the matching is successful, and step 306 is executed. If the maximum value of the similarity is not within the range of Z w , it means that the matching is not successful, and step 307 is executed.

[0116] Step 306: return the matched network device;

[0117] Specifically, the information of the network device w max is returned.

[0118] Step 307: update the device library;

[0119] Specifically, the network device to be identified is added to the device library as a new network device.

[0120] Step 308: determine whether the global non-threshold range elasticity ratio V is reached;

[0121] Specifically, the current non-threshold range elasticity ratio V w is calculated, and if V wThe global non-threshold range elasticity ratio V indicates that the error is large, and the device library needs to be trained, and step 309 is performed.

[0122] Step 309: training the feature weight in the device library;

[0123] Specifically, a training set is obtained; wherein the training set includes the known network device in step 313 and the corresponding feature table; based on the training set and the training process in step 313, the feature weight in the device library is trained, and the feature table of the network device in the device library is updated.

[0124] Step 310: returning the to-be-identified network device as a new device.

[0125] The technical scheme of the present application trains the device library by combining the cosine similarity algorithm and the self-learning algorithm, without hot start; and uses the initial device library and the global variable similarity overall threshold mapping Z to find the most matched network device, if found, judges the threshold condition, and returns the network device information within the threshold range, and if not within the threshold range, uses the self-updating mechanism to realize adaptive updating of the network device library; meanwhile, the concept of non-threshold range elasticity ratio is introduced, and the weight is dynamically adjusted, so as to reduce the identification cost, reduce the identification error, and improve the identification accuracy.

[0126] Figure 4 The component structure of the network device identification apparatus in the embodiment of the present application is shown in a schematic diagram, which shows an implementation apparatus 40 of a network device identification method, and the apparatus 40 specifically includes:

[0127] The acquisition module 401 is configured to acquire at least two features of a to-be-identified network device.

[0128] The processing module 402 is configured to determine at least one similarity between the to-be-identified network device and at least one network device based on the at least two features of the to-be-identified network device and a feature table of the at least one network device in a preset device library; wherein the feature table includes at least two features of each network device.

[0129] The processing module 402 is further configured to determine a first network device with a matching success based on the at least one similarity.

[0130] The acquisition module 401 is further configured to acquire a device type corresponding to the first network device as a device type of the to-be-identified network device.

[0131] In some embodiments, the processing module 402 is configured to compare the features in the second network device feature table with the features of the network device to be identified, determine at least one same feature of the second network device and the network device to be identified, wherein the second network device is any network device in the device library; and determine the similarity between the network device to be identified and the second network device based on the at least one same feature.

[0132] In some embodiments, the feature table further comprises a feature weight corresponding to each feature; and the processing module 402 is configured to determine the similarity between the network device to be identified and the second network device based on the at least one same feature and the feature weight of the at least one same feature.

[0133] In some embodiments, the processing module 402 is configured to calculate a cosine similarity between a first feature of the network device to be identified and a second feature of the second network device; and determine that the first feature and the second feature are same features if the cosine similarity is greater than or equal to a preset cosine similarity threshold, wherein the first feature is a feature of the network device to be identified, and the second feature is a feature in the feature table of the second network device.

[0134] In some embodiments, the feature table further comprises a feature weight corresponding to each feature; and the processing module 402 is further configured to obtain a training set, wherein the training set comprises at least one training network device and at least two features corresponding to the training device; determine at least one similarity between the training network device and at least one network device in the device library based on the at least two features of the training network device and the feature table of the at least one network device in the device library; determine whether the training network device matches the network device in the device library successfully based on the at least one similarity; adjust the feature weight of the network device corresponding to the maximum value of the at least one similarity between the training network device and the at least one network device if the matching fails, until the matching is successful, and obtain a trained feature weight.

[0135] In some embodiments, the processing module 402 is further configured to record the number of matching failures and the total number of recognitions from the last training end to the current time in the device library based on the determination that the matching fails based on the at least one similarity; calculate the ratio of the number of matching failures to the total number of recognitions; and train the device library if the ratio is greater than or equal to a preset ratio threshold.

[0136] In some embodiments, the device library further comprises: a similarity range corresponding to each network device; the processing module 402 is configured to determine a maximum value of the similarity in the at least one similarity; and when the maximum value of the similarity is within the similarity range of the corresponding network device, the network device corresponding to the maximum value of the similarity is determined as the first network device.

[0137] In some embodiments, the processing module 402 is further configured to determine a matching failure when the maximum value of the similarity is outside the similarity range of the corresponding network device; and add the network device to be identified as a new network device to the device library.

[0138] In some embodiments, the processing module 402 is further configured to determine an acquisition difficulty value of each feature; determine an traversal order of at least one network device in the device library based on the acquisition difficulty value; and wherein the traversal order is used to indicate a similarity determination order of the network device to be identified and the at least one network device.

[0139] Based on the hardware implementation of each unit in the above network device identification apparatus, another network device identification device is provided in an embodiment of the present application, Figure 5 The network device identification device in an embodiment of the present application is shown in a component structure diagram. As shown in the figure, Figure 5 the device 50 comprises a processor 501 and a memory 502 configured to store a computer program capable of running on the processor;

[0140] When the processor 501 is configured to run the computer program, the method steps in the foregoing embodiments are executed.

[0141] Of course, in actual application, as shown in the figure, Figure 5 each component in the network device identification device is coupled together through a bus system 503. It can be understood that the bus system 503 is used to realize the connection and communication between the components. The bus system 503 includes a data bus, a power supply bus, a control bus and a state signal bus. However, for the purpose of clear illustration, Figure 5 all kinds of buses are marked as the bus system 503.

[0142] In practical applications, the processor can be at least one of an application specific integrated circuit (ASIC), a digital signal processing device (DSPD), a programmable logic device (PLD), a field programmable gate array (FPGA), a controller, a microcontroller, and a microprocessor. It can be understood that, for different devices, the electronic device used to implement the functions of the processor can also be other devices, and the embodiments of the present application are not limited specifically.

[0143] The memory can be a volatile memory (such as a random access memory (RAM)), a non-volatile memory (such as a read-only memory (ROM), a flash memory, a hard disk (HDD) or a solid-state disk (SSD)), or a combination of the above types of memories, and provides instructions and data to the processor.

[0144] In exemplary embodiments, the embodiments of the present application also provide a computer readable storage medium, such as a memory including a computer program, which can be executed by a processor of a network device to complete the steps of the foregoing method.

[0145] It should be understood that the terms used in the present application are merely for the purpose of describing specific embodiments, and are not intended to limit the present application. The singular forms "a", "an" and "the" used in the present application and the appended claims are also intended to include the plural forms, unless the context clearly indicates otherwise. It should also be understood that the term "and / or" used herein refers to and includes any or all possible combinations of one or more associated listed items. In the present application, the expressions "have", "may have", "include" and "contain", or "may include" and "may contain" can be used herein to indicate the presence of a corresponding feature (for example, elements such as numerical values, functions, operations or components), but do not exclude the presence of additional features.

[0146] It should be understood that, although the terms first, second, third, etc. can be adopted in the present application to describe various information, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other, and do not necessarily be used to describe a particular order or sequence. For example, the first information can also be referred to as the second information, and similarly, the second information can also be referred to as the first information, without departing from the scope of the present application.

[0147] The technical solutions described in the embodiments of the present application can be combined arbitrarily without conflict.

[0148] In several embodiments provided in the present application, it should be understood that the disclosed methods, devices and equipment can be implemented by other ways. The above described embodiments are only illustrative, for example, the division of units is only a logical function division, and actual implementation can have another division way, such as: multiple units or components can be combined, or can be integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between each component part shown or discussed can be through some interface, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0149] The units described above as separate components can or can not be physically separated, and the components shown as units can or can not be physical units, that is, they can be located in one place or distributed on multiple network units; part or all of the units can be selected according to actual needs to achieve the purpose of the embodiments of the present application.

[0150] In addition, each functional unit in each embodiment of the present application can be integrated into one processing unit, or each unit can be a separate unit, or two or more units can be integrated into one unit; the integrated unit can be realized in the form of hardware or in the form of hardware plus software functional unit.

[0151] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited to this. Any person skilled in the art can easily think of changes or replacements within the technical range disclosed in the present application, which should be covered in the protection scope of the present application.

Claims

1. A method for identifying network devices, characterized in that, The method includes: Obtain at least two features of the network device to be identified; Based on at least two features of the network device to be identified, and a feature table of at least one network device in a preset device library, at least one similarity between the network device to be identified and the at least one network device is determined; wherein, the feature table contains at least two features of each network device and a feature weight corresponding to each feature; Based on the at least one similarity, determine whether the network device to be identified is successfully matched with at least one network device in the device library; Based on the at least one similarity, a successful match is determined, a first type of network device is identified, and the device type corresponding to the first type of network device is obtained as the device type of the network device to be identified. Based on the at least one similarity, a matching failure is determined, and the number of matching failures and the total number of recognitions from the end of the last training of the device library to the current time are recorded; the ratio of the number of matching failures to the total number of recognitions is calculated; if the ratio is greater than or equal to a preset ratio threshold, the device library is trained; the method for training the device library includes: obtaining a training set; wherein the training set includes at least one training network device and at least two features corresponding to the training network device; based on the at least two features of the training network device and the feature table of at least one network device in the device library, at least one similarity between the training network device and at least one network device in the device library is determined; based on the at least one similarity, it is determined whether the training network device is successfully matched with a network device in the device library; if the matching fails, the feature weights of the network device corresponding to the maximum value of the at least one similarity between the training network device and the at least one network device are adjusted until the matching is successful, and the trained feature weights are obtained.

2. The method according to claim 1, characterized in that, The step of determining at least one similarity between the network device to be identified and the at least one network device based on at least two features of the network device to be identified and a feature table of at least one network device in a preset device database includes: Compare the features in the second network device feature table with the features of the network device to be identified, and determine that the second type of network device has at least one identical feature to the network device to be identified; wherein, the second type of network device is any network device in the device library; Based on the at least one shared feature, the similarity between the network device to be identified and the second type of network device is determined.

3. The method according to claim 2, characterized in that, Determining the similarity between the network device to be identified and the second type of network device based on the at least one identical feature includes: Based on the at least one identical feature and the feature weight of the at least one identical feature, the similarity between the network device to be identified and the second type of network device is determined.

4. The method according to claim 2, characterized in that, The step of comparing the features in the second network device feature table with the features of the network device to be identified, and determining that the second type of network device and the network device to be identified share at least one common feature, includes: Calculate the cosine similarity between the first feature of the network device to be identified and the second feature of the second type of network device; If the cosine similarity is greater than or equal to a preset cosine similarity threshold, the first feature and the second feature are determined to be the same feature. The first feature is a feature of the network device to be identified, and the second feature is a feature in the feature table of the second type of network device.

5. The method according to claim 1, characterized in that, The device library also includes: a similarity range for each type of network device; the method further includes: Determine the maximum similarity among the at least one similarity; If the maximum similarity value is within the similarity range of the corresponding network device, the network device corresponding to the maximum similarity value is taken as the first type of network device.

6. The method according to claim 5, characterized in that, The method further includes: If the maximum similarity value is outside the similarity range of the corresponding network device, the match is determined to have failed. The network device to be identified is added to the device library as a new network device.

7. The method according to claim 1, characterized in that, The method further includes: Determine the difficulty value for obtaining each feature; The traversal order corresponding to at least one network device in the device library is determined based on the acquisition difficulty value; The traversal order is used to indicate the order in which the similarity between the network device to be identified and the at least one network device is determined.

8. A network device identification device, the device comprising: The acquisition module is used to acquire at least two features of the network device to be identified. The processing module is configured to determine at least one similarity between the network device to be identified and the at least one network device based on at least two features of the network device to be identified and a feature table of at least one network device in a preset device library; wherein the feature table contains at least two features of each network device and a feature weight corresponding to each feature; The processing module is further configured to: determine whether the network device to be identified successfully matches at least one network device in the device library based on the at least one similarity; determine a successful match based on the at least one similarity, identify a first type of network device, and obtain the device type corresponding to the first type of network device as the device type of the network device to be identified; determine a failed match based on the at least one similarity, record the number of failed matches and the total number of identifications from the end of the last training of the device library to the current time; calculate the ratio of the number of failed matches to the total number of identifications; if the ratio is greater than or equal to a preset ratio threshold, train the device library; the method package for training the device library is... The process includes: obtaining a training set; wherein the training set includes at least one training network device and at least two features corresponding to the training network device; determining at least one similarity between the training network device and at least one network device in the device library based on the at least two features of the training network device and the feature table of at least one network device in the device library; determining whether the training network device is successfully matched with a network device in the device library based on the at least one similarity; if the matching fails, adjusting the feature weight of the network device corresponding to the maximum value of the at least one similarity between the training network device and the at least one network device until the matching is successful, and obtaining the trained feature weights; The acquisition module is further configured to acquire the device type corresponding to the first type of network device, as the device type of the network device to be identified.

9. A network device identification device, characterized in that, The device includes: a processor and a memory configured to store computer programs capable of running on the processor. Wherein, when the processor is configured to run the computer program, it performs the steps of the method according to any one of claims 1-7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method described in any one of claims 1-7.

Images