A semi-supervised smart city network device identification method and system
The network device recognition model constructed through the semi-supervised learning method uses graph autoencoder and self-training clustering module, combined with class semantic information, to solve the problem of network device classification and management in smart cities, and realizes efficient equipment recognition and management.
Patent Information
- Application Number
- CN202310570160.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2023-05-19
- Publication Date
- 2025-08-22
- Estimated Expiration
- 2043-05-19
AI Technical Summary
The existing technology is difficult to effectively classify and manage network equipment in smart cities, resulting in increased network security threats and management challenges.
The semi-supervised learning method is adopted to build a network device recognition model through graph autoencoder, self-training clustering and class semantic information modules. The GCN encoder is used to extract device features, and combined with k-means algorithm and zero-sample learning, the model is optimized to improve recognition accuracy.
It realizes efficient classification and management of network equipment, improves the cohesion and discrimination of device representation, and enhances the accuracy and efficiency of network equipment identification.
Smart Images
Figure CN116582444B_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of smart cities, and in particular to a semi-supervised smart city network device identification method and system. Background Art
[0002] In today's society, with the ever-increasing demand for intelligent technologies, the pace of smart city construction and development is accelerating, bringing significant convenience to our lives and work across various sectors. For example, in transportation, shared bicycles and electric vehicles are being introduced, making travel more environmentally friendly and convenient. In logistics, shipping information and routes are easily accessible. In healthcare, intelligent ward care, drug tracking and supervision, and telemedicine are all enabled. In agriculture, intelligent irrigation, temperature and humidity control, and real-time monitoring are all enabled.
[0003] As smart cities are built, the development of IoT technology has led to the emergence of an increasing number of IoT devices. This large number and variety of IoT devices poses a threat to network security and creates even more severe challenges for network management. To address this, researchers have begun analyzing network devices and discovered that accurate and rapid identification of network devices can be used to analyze and assess the distribution of devices and existing vulnerabilities in cyberspace, thereby supporting network management. Therefore, we propose a semi-supervised smart city network device identification method and system. This system first learns the characteristics, structure, and partial label information of network devices to obtain an optimal network device representation. It then uses a softmax function to classify network devices, ensuring accurate and efficient network device identification. Summary of the Invention
[0004] The technical problem to be solved by the present invention is to design a semi-supervised smart city network device identification method and system, which can effectively classify network devices in smart cities.
[0005] In order to achieve the above object, the present invention adopts the following technical solutions:
[0006] A semi-supervised smart city network device identification method includes five main steps: steps S10 to S20 are a network device data preprocessing step, step S30 is a semi-supervised smart city network device identification model construction step, step S40 is an optimization step of the semi-supervised smart city network device identification model, step S50 is a semi-supervised smart city network device identification model training step, and step S60 is a semi-supervised smart city network device identification model result output step.
[0007] S10. Construct a graph structure G = (V, E, X) using network device data.
[0008] S20. Construct an N×N dimensional adjacency matrix A of the graph structure G=(V, E, X);
[0009] S30, based on the graph structure and adjacency matrix established in steps S10 and S20, construct a semi-supervised smart city network device identification model;
[0010] S40, constructing an objective function for model optimization of the semi-supervised smart city network device identification model constructed in step S30;
[0011] S50, setting a training process for a semi-supervised smart city network device identification model and performing iterative training to minimize an objective function, thereby determining parameters of the model;
[0012] S60 , using the semi-supervised smart city network device identification model constructed in step S30 and the model parameters determined in step S50 , identify and classify the network device data, and output the classification results.
[0013] Furthermore, step S10 of the method includes the following specific steps:
[0014] Collect network device data from the smart city system and use the acquired network device data to construct a graph structure G = (V, E, X). During the construction process, network devices are represented as nodes in the graph structure, information transmission between network devices is used as edges in the graph structure, the operating system of the network device, the open ports of the network device, the banner information of the open ports, and the services provided by the network device are used as the features of the nodes in the graph structure, and the marked network device type information is used as the label of the node. The constructed graph structure is denoted as G = (V, E, X), where V = {v1, v2, ..., v N} represents a set of N network devices, where the network device node v n Indicates the nth network device (1≤n≤N); E={e1,e2,…,e F} represents the F edges between network device nodes, where the fth edge (1≤f≤F) is denoted as e f ; X represents the N×R dimension network device node feature matrix, each row represents the characteristics of a network device node, for example, the nth (1≤n≤N) row x n =[x n1 ,x n2 ,…x nR ] is the network device node v n R features of the network device node v n The rth feature of nr ; Y is a dimensional label matrix, where and K represent the number of network device nodes and the number of label categories with labels, respectively. The i-th row and j-th column in the matrix Element Y ij Represents the i-th network device node v i The relationship between the j-th class label, if the network device node v i If it belongs to this category, then Y ij =1, otherwise Y ij =0.
[0015] Furthermore, step S20 of the method includes the following specific steps:
[0016] The N×N dimensional adjacency matrix is denoted as A. The element in the i-th row and j-th column (1≤i≤N,1≤j≤N) in the matrix is A ij Represents the i-th network device node v i and the jth network device node v j Adjacency relationship, if the network device node v i and network device node v j If there is a connecting edge between them, then A ij =1, otherwise, A ij =0.
[0017] Furthermore, the semi-supervised smart city network device identification model in step S30 of the method includes a graph autoencoder module, a self-training clustering module and a class semantic information module. In the graph autoencoder module, the low-dimensional representation of the network device node is obtained through the GCN encoder, and the decoder is used to reconstruct the graph structure information to guide the representation learning; in the self-training clustering module, the k-means algorithm is used to cluster the learned low-dimensional representation, and the results are used to guide the learning process. The learned network device node representation in turn supervises the generation of clusters; in the class semantic information module, the existing label information is used to extract the semantic information of similar network devices from the original information of the network device to supervise the representation learning so that the similar network device nodes have similar representations.
[0018] Furthermore, the overall structure of the model is shown in the attached Figure 1 As shown, the specific operation steps of the semi-supervised smart city network device identification model in step 30 are as follows:
[0019] S31. In the graph autoencoder module, the graph structure G = (V, E, X) is input into the GCN encoder for encoding to obtain the representation vector of the network device node. The formal representation of the encoding process is shown in formula (1):
[0020]
[0021] in, I N represents the N-dimensional identity matrix, yes The degree matrix, H (l) Represents the feature vector of the network device node at layer l, W (l) Represents the parameter matrix of the lth layer; H={h1,h2…,h N} is a set of representation vectors of network device nodes, where the network representation h n Represents the low-dimensional representation of the nth network device node (1≤n≤N). In the encoder, σ represents the activation function Relu(·), which is defined by formula (2):
[0022]
[0023] After obtaining the low-dimensional representation of the network device node through the GCN encoder, the decoder is used to reconstruct its information. The decoder uses a simple inner product function, as shown in formula (3):
[0024]
[0025] in, is the reconstructed adjacency matrix, and δ is the sigmoid function. In this module, the reconstructed adjacency matrix is compared with the original adjacency matrix, and the error between the two is used to train the model to obtain the network device node representation.
[0026] S32. In the self-training clustering module, the k-means algorithm is first used to perform cluster analysis on the network device node representation H to obtain u clusters, and then the Student t distribution is used to measure the network device node representation h i and cluster center vector The similarity is as shown in formula (4):
[0027]
[0028] Among them, q iu Represents the network device node v i The probability of belonging to cluster u is obtained, and the distribution result Q of the network device node cluster is obtained. The target distribution P is calculated using the distribution Q, as shown in formula (5):
[0029]
[0030] Among them, p iu Also represents the network device node v iThe probability of belonging to cluster u, but the target distribution P has a higher confidence. Distribution P depends on distribution Q, and distribution Q is calculated by the participation of network device node representation. Therefore, the clustering result will affect the learned network device node representation, and the quality of network device node representation affects the credibility of the clustering result. Through continuous learning, a clustering result with high credibility is obtained, so that the network device information of the same type can be captured and a better network device node representation can be obtained.
[0031] S33. In the class semantic information module, due to the complexity of network devices, it is impossible to obtain label information of all categories of network devices. Therefore, we draw on the idea of zero-shot learning and use class semantic information, i.e., class attribute information, to supervise and guide model training. The obtained network device node representation can not only distinguish known classes, but also identify unknown classes. Class semantic information is generated from the original network device node features, and its generation process is shown in Equation (6):
[0032]
[0033] Among them, c is the visible class label, c i represents the category label of the i-th network device node, x i Represents the feature vector of the i-th network device node, is the class semantic information, μ c Represents the mean value of the visible class node feature, as shown in formula (7), σ c represents the variance of the visible class node feature, as shown in formula (8):
[0034]
[0035]
[0036] Furthermore, step S40 of the method includes the following specific steps:
[0037] S41. Design a loss function for the graph autoencoder module, self-training clustering module, and class semantic information module described in S30. In the graph autoencoder module, the cross entropy loss function is used to calculate the reconstruction loss. The smaller the reconstruction loss, the more similar the reconstructed adjacency matrix is to the original matrix, and the learned network device node representation is better. The calculation of the cross entropy loss function is shown in formula (9):
[0038]
[0039] Where N is the number of nodes, a is the element in the original adjacency matrix A, and its value is 0 or 1; To reconstruct the adjacency matrix The elements in have values between 0 and 1.
[0040] In the self-training clustering module S42, the target distribution P is used to guide representation learning and supervise the update of the actual distribution Q. Since the distribution P is calculated based on the distribution Q, the distribution Q can reversely supervise the update of the distribution P, thus forming a self-training clustering mechanism. The KL divergence is used to measure the difference between the two distributions, as shown in formula (10):
[0041]
[0042] In the class semantic information module S43, by comparing the real class semantic information obtained from the original features with the predicted class semantic information obtained from the network device node representation, the two class semantic information of the same node are made closer, that is, the similarity between nodes of the same class and the difference between nodes of different classes are increased, thereby guiding the generation of supervised network device node representation and obtaining a better network device node representation result. The loss function of this module is shown in formula (11):
[0043]
[0044] Among them, K′ is the set of labeled nodes, and Represent the true and predicted class semantic information respectively.
[0045] S44, then the final objective function of the semi-supervised smart city network device identification model is shown in formula (12), and the hyperparameter α>0.
[0046] L=L r +α(L c +L s ) (12)
[0047] Furthermore, step S50 of the method includes the following specific steps:
[0048] S51. Initialize the parameters of the semi-supervised smart city network device identification model in step S30, give the adjustment coefficient θ and the number of iterations T, iteratively execute steps S52 to S54 until the number of iterations is reached, complete the training of the semi-supervised smart city network device identification model, and obtain the optimal parameters of the model.
[0049] S52, taking the adjacency matrix A and feature matrix X of the network device data obtained in S10 and S20 as input, and obtaining the network device node representation H = {h1,h2…,h N}.
[0050] S53, according to formula (9), formula (10) and formula (11), we can get the graph autoencoder loss L r , self-training clustering loss L c And the class semantic information loss Ls .
[0051] S54. Input the losses of the three modules into formula (12) to obtain the total loss of the semi-supervised smart city network device identification model, perform backpropagation, and cyclically update the model parameters (neural network parameters W).
[0052] Furthermore, step S60 of the method includes the following specific steps:
[0053] S61, obtain the optimal parameters of the model through S52 to S54, input the network device data, obtain the representation of the network device node through the encoder GCN, and then convert the element value in the representation of each network device node into a probability between 0 and 1 through formula (13);
[0054]
[0055] Among them, z i Refers to the network device node representation h i The i-th element, z j Refers to the network device node representation h i After calculating the probability of each element in the representation of each network device node, the class corresponding to the maximum probability is taken as the category of the network device node.
[0056] S62. Send the classification results to the network analysis platform or operator, so as to obtain the distribution status of devices in the network space and the existing vulnerabilities, and manage the network in a timely manner.
[0057] The present invention also provides a semi-supervised smart city network device identification system for implementing the above-mentioned semi-supervised smart city network device identification method, including a computer processor and memory, a network device data preprocessing unit, a training unit based on a semi-supervised smart city network device identification model, and a result output unit based on the semi-supervised smart city network device identification model.
[0058] Furthermore, the network device data preprocessing unit executes steps S10 to S20, and for the acquired network device data, takes the network device as a node, the information transmission between network devices as an edge, the operating system of the network device, the open port of the network device, the banner information of the open port, and the service information provided by the network device as the network device node features, constructs a graph structure and its adjacency matrix, and loads them into the computer memory; the semi-supervised smart city network device identification model training unit executes steps S30 to S50 according to the graph structure and its adjacency matrix constructed in steps S10 to S20, constructs a semi-supervised smart city network device identification model, and trains the model based on the defined objective function; the semi-supervised smart city network device identification model result output unit executes step S60, classifies the network devices, and sends the classification results to the network analysis platform or operator to obtain the distribution status of the devices in the network space and the existing vulnerabilities, and manage the network in a timely manner.
[0059] Compared with the prior art, the present invention has the following advantages:
[0060] 1. A semi-supervised smart city network device identification method establishes a self-supervisory mechanism and unifies graph autoencoders and self-training clustering into an integrated framework. This improves the ability to extract network device features, enhances the cohesion of network device representation, and provides richer discriminative information for network device classification.
[0061] 2. A semi-supervised smart city network device identification method designs a class semantic information module to increase the similarity between network device nodes of the same class and the difference between network device nodes of different classes, thereby guiding the generation of supervised network device node representations. At the same time, combined with the self-supervision mechanism, the learned network device node representations are more effective in classification tasks. BRIEF DESCRIPTION OF THE DRAWINGS
[0062] Figure 1 This is a structural diagram of the semi-supervised smart city network device identification method in step S30 of the present invention;
[0063] Figure 2 This is a structural diagram of a semi-supervised smart city network device identification system according to the present invention;
[0064] Figure 3 This is a flowchart of the implementation of a semi-supervised smart city network device identification method described in the present invention. DETAILED DESCRIPTION
[0065] In order to further illustrate the technical solution of the present invention, the present invention is further described below with reference to the accompanying drawings and embodiments.
[0066] The network device identification method of the present invention is implemented by a computer program. Figure 3 The process shown here details a specific implementation of the technical solution proposed in this invention. Network device data was collected from a smart city system. The loaded network device data included 155,285 items, of which 10,000 were randomly labeled. A 200-dimensional feature set was generated based on information such as the operating system, open ports, banner information for these open ports, and the services provided by the network devices as network device node features. The technical solution of this invention utilizes and processes network device data from a smart city system to achieve accurate classification of network devices.
[0067] The implementation method mainly includes the following key contents:
[0068] S10. Obtain raw network device data, treat network devices as nodes, information transmission between network devices as edges, and information such as the network device's operating system, open ports, banner information of open ports, and services provided by the network device as network device node features to construct a graph structure. The specific steps are as follows:
[0069] Collect network device data from the smart city system and use the acquired network device data to construct a graph structure G = (V, E, X). During the construction process, network devices are represented as nodes in the graph structure, information transmission between network devices is used as edges in the graph structure, the operating system of the network device, the open ports of the network device, the banner information of the open ports, and the services provided by the network device are used as the features of the nodes in the graph structure, and the marked network device type information is used as the label of the node. The constructed graph structure is denoted as G = (V, E, X), where V = {v1, v2, ..., v N} represents a set consisting of N = 155285 network devices, where network device node v n Indicates the nth network device (1≤n≤N); E={e1,e2,…,e F} indicates that there are F = 322719 edges between network device nodes, where the fth edge (1≤f≤F) is denoted as e f ; X represents the N×R dimension network device node feature matrix, each row represents the characteristics of a network device node, for example, the nth (1≤n≤N) row x n =[x n1 ,x n2 ,…x nR ] is the network device node v n R = 200 features, where network device node v n The rth feature of nr ; Y is a dimensional label matrix, where and K = 15 represent the number of network device nodes and the number of label categories with labels, respectively. The i-th row and j-th column in the matrix Element Y ij Represents the i-th network device node v i The relationship between the j-th class label, if the network device node v i If it belongs to this category, then Y ij =1, otherwise Y ij =0.
[0070] S20. Construct an N×N dimensional adjacency matrix A of the graph structure G=(V, E, X), including the following specific steps:
[0071] The N×N dimensional adjacency matrix is denoted as A. The element in the i-th row and j-th column (1≤i≤N,1≤j≤N) in the matrix is A ij Represents the i-th network device node v i and the jth network device node v j Adjacency relationship, if the network device node v i and network device node v j If there is a connecting edge between them, then A ij =1, otherwise, A ij =0.
[0072] S30. Based on the graph structure and adjacency matrix established in steps S10 and S20, a semi-supervised smart city network device identification model is constructed. The model includes a graph autoencoder module, a self-training clustering module, and a class semantic information module. In the graph autoencoder module, the low-dimensional representation of the network device nodes is obtained through the GCN encoder, and the decoder is used to reconstruct the graph structure information to guide the representation learning; in the self-training clustering module, the k-means algorithm is used to cluster the learned low-dimensional representation of the network device nodes, and the results are used to guide the learning process. The learned network device node representations in turn supervise the generation of clusters; in the class semantic information module, the existing label information is used to extract the semantic information of the same type of nodes from the original features of the network device to supervise the representation learning so that the nodes with the same label have similar representations. Its overall structure is shown in the attached figure. Figure 1 The specific steps are as follows:
[0073] S31. In the graph autoencoder module, the graph structure G = (V, E, X) is input into the GCN encoder for encoding to obtain the representation vector of the network device node. The formal representation of the encoding process is shown in formula (1):
[0074]
[0075] in, IN represents the N-dimensional identity matrix, yes The degree matrix, H (l) Represents the feature vector of the network device node at layer l, W (l) Represents the parameter matrix of the lth layer; H={h1,h2…,h N} is a set of representation vectors of network device nodes, where the network representation h n Represents the low-dimensional representation of the nth network device node (1≤n≤N). In the encoder, σ represents the activation function Relu(·), which is defined by formula (2):
[0076]
[0077] After obtaining the low-dimensional representation of the network device node through the GCN encoder, the decoder is used to reconstruct its information. The decoder uses a simple inner product function, as shown in formula (3):
[0078]
[0079] in, is the reconstructed adjacency matrix, and δ is the sigmoid function. In this module, the reconstructed adjacency matrix Compare it with the original adjacency matrix A and use the error between the two to train the model to obtain the network device node representation.
[0080] S32. In the self-training clustering module, the k-means algorithm is first used to perform cluster analysis on the network device node representation H to obtain u clusters, and then the Student t distribution is used to measure the network device node representation h i and cluster center vector The similarity is as shown in formula (4):
[0081]
[0082] Among them, q iu Represents the network device node v i The probability of belonging to cluster u is obtained, and the distribution result Q of the network device node cluster is obtained. The target distribution P is calculated using the distribution Q, as shown in formula (5):
[0083]
[0084] Among them, p iu Also represents the network device node v iThe probability of belonging to cluster u, but the target distribution P has a higher confidence. Distribution P depends on distribution Q, and distribution Q is calculated by the participation of network device node representation. Therefore, the clustering result will affect the learned network device node representation, and the quality of network device node representation affects the credibility of the clustering result. Through continuous learning, a clustering result with high credibility is obtained, so that the network device information of the same type can be captured and a better network device node representation can be obtained.
[0085] S33. In the class semantic information module, due to the complexity of network devices, it is impossible to obtain label information of all categories of network devices. Therefore, we draw on the idea of zero-shot learning and use class semantic information, i.e., class attribute information, to supervise and guide model training. The obtained network device node representation can not only distinguish known classes, but also identify unknown classes. Class semantic information is generated from the original network device node features, and its generation process is shown in Equation (6):
[0086]
[0087] Among them, c is the visible class label, c i represents the category label of the i-th network device node, x i Represents the feature vector of the i-th network device node, is the class semantic information, μ c Represents the mean value of the visible class node feature, as shown in formula (7), σ c represents the variance of the visible class node feature, as shown in formula (8):
[0088]
[0089]
[0090] S40: Construct an objective function for optimizing the semi-supervised smart city network device identification model constructed in step S30. This includes the following specific steps:
[0091] S41. Design a loss function for the graph autoencoder module, self-training clustering module, and class semantic information module described in S30. In the graph autoencoder module, the cross entropy loss function is used to calculate the reconstruction loss. The smaller the reconstruction loss, the more similar the reconstructed adjacency matrix is to the original matrix, and the learned network device node representation is better. The calculation of the cross entropy loss function is shown in formula (9):
[0092]
[0093] Where N is the number of nodes, a is the element in the original adjacency matrix A, and its value is 0 or 1; To reconstruct the adjacency matrix The elements in have values between 0 and 1.
[0094] In the self-training clustering module S42, the target distribution P is used to guide representation learning and supervise the update of the actual distribution Q. Since the distribution P is calculated based on the distribution Q, the distribution Q can reversely supervise the update of the distribution P, thus forming a self-training clustering mechanism. The KL divergence is used to measure the difference between the two distributions, as shown in formula (10):
[0095]
[0096] In the class semantic information module S43, by comparing the real class semantic information obtained from the original features with the predicted class semantic information obtained from the network device node representation, the two class semantic information of the same node are made closer, that is, the similarity between nodes of the same class and the difference between nodes of different classes are increased, thereby guiding the generation of supervised network device node representation and obtaining a better network device node representation result. The loss function of this module is shown in formula (11):
[0097]
[0098] Among them, K′ is the set of labeled nodes, and Represent the true and predicted class semantic information respectively.
[0099] S44, then the final objective function of the semi-supervised smart city network device identification model is shown in formula (12), and the hyperparameter α>0.
[0100] L=L r +α(L c +L s ) (12)
[0101] S50: Set up a training process for the semi-supervised smart city network device identification model and perform iterative training to minimize the objective function, thereby determining the model parameters. This includes the following specific steps:
[0102] S51. Initialize the parameters of the semi-supervised smart city network device identification model in step S30, give the adjustment coefficient θ and the number of iterations T, iteratively execute steps S52 to S54 until the number of iterations is reached, complete the training of the semi-supervised smart city network device identification model, and obtain the optimal parameters of the model.
[0103] S52, taking the adjacency matrix A and feature matrix X of the network device data obtained in S10 and S20 as input, and obtaining the network device node representation H = {h1,h2…,h N}.
[0104] S53, according to formula (9), formula (10) and formula (11), we can get the graph autoencoder loss L r , self-training clustering loss L c And the class semantic information loss L s .
[0105] S54. Input the losses of the three modules into formula (12) to obtain the total loss of the semi-supervised smart city network device identification model, perform backpropagation, and cyclically update the model parameters (neural network parameters W).
[0106] S60: Using the semi-supervised smart city network device identification model constructed in step S30 and the model parameters determined in step S50, the network devices can be identified and classified, and the classification results are output. The following specific steps are included:
[0107] S61, obtain the optimal parameters of the model through S52 to S54, input the network device data, obtain the representation of the network device node through the encoder GCN, and then convert the element value in the representation of each network device node into a probability between 0 and 1 through formula (13);
[0108]
[0109] Among them, z i Refers to the network device node representation h i The i-th element, z j Refers to the network device node representation h i After calculating the probability of each element in the representation of each network device node, the class corresponding to the maximum probability is taken as the category of the network device node.
[0110] S62. Send the classification results to the network analysis platform or operator, so as to obtain the distribution status of devices in the network space and the existing vulnerabilities, and manage the network in a timely manner.
[0111] Technical effect evaluation:
[0112] In order to verify the effectiveness and advancement of the technical solution proposed in the present invention, the present invention is compared with several classic methods, including the method based on the attention mechanism (ANN), the method based on the k-nearest neighbor (KNN), and the method based on the support vector machine (SVM). The average precision, recall, and F-measure of 20 experiments are used as evaluation indicators to compare and analyze the above matching results. The comparison results are shown in Table 1:
[0113] Table 1 Comparative analysis of results
[0114]
[0115] It can be seen from the results in the table that the technical solution of the present invention can obtain better precision, recall and F-measure value when classifying network devices.
[0116] like Figure 2 As shown, a semi-supervised smart city network device identification system includes a computer processor and memory, a network device data preprocessing unit, a semi-supervised smart city network device identification model training unit, and a semi-supervised smart city network device identification model result output unit. The network device data preprocessing unit executes steps S10 to S20. For the acquired network device data, the network device is regarded as a node, the information transmission between the network devices is regarded as an edge, and the operating system of the network device, the open port of the network device, the banner information of the open port, and the service provided by the network device are used as network device node features to construct a graph structure and its adjacency matrix, and load them into the computer memory; the semi-supervised smart city network device identification model training unit executes steps S30 to S50 based on the graph structure and adjacency matrix constructed in steps S10 to S20, constructs a semi-supervised smart city network device identification model, and trains the model based on a defined objective function; the semi-supervised smart city network device identification model result output unit executes step S60 to classify the network devices and transmit the classification results to the network analysis platform or operator to obtain the distribution status of the devices in the network space and the existing vulnerabilities, and timely manage the network.
[0117] Any matters not described in detail in this specification are prior art known to those skilled in the art. Although the above description of the present invention is based on specific embodiments to facilitate understanding of the present invention by those skilled in the art, it should be understood that the present invention is not limited to the scope of the specific embodiments. As long as various modifications are within the spirit and scope of the present invention as defined and determined by the appended claims, such modifications will be obvious to those skilled in the art, and all inventions and creations utilizing the concepts of the present invention are protected.
Claims
1. A semi-supervised smart city network device identification method, characterized in that: The following steps are involved: S10. Construct a graph structure G = V, E, X using network device data; S20, constructing an N×N dimensional adjacency matrix A of the graph structure G=V,E,X; S30. Based on the established graph structure and its adjacency matrix, a semi-supervised smart city network device identification model is constructed; S31. In the graph autoencoder module, the graph structure G = V, E, X is input into the GCN encoder for encoding to obtain the representation vector of the network device node. The formal representation of the encoding process is shown in formula (1): in, I N represents the N-dimensional identity matrix, yes The degree matrix, H (l) Represents the feature vector of the network device node at layer l, W (l) Represents the parameter matrix of the lth layer; H={h1,h2…,h N } is a set of representation vectors of network device nodes, where network device nodes represent h n represents the low-dimensional representation of the nth network device node, 1≤n≤N, and σ in the encoder represents the activation function Relu(·), which is defined by formula (2): After obtaining the low-dimensional representation of the network device node through the GCN encoder, the decoder is used to reconstruct its information. The decoder uses a simple inner product function, as shown in formula (3): in, is the reconstructed adjacency matrix, δ is the sigmoid function, in this module, the reconstructed adjacency matrix is Compare it with the original adjacency matrix A and use the error between the two to train the model to obtain the network device node representation; S32. In the self-training clustering module, the k-means algorithm is first used to perform cluster analysis on the network device node representation H to obtain u clusters, and then the Student t distribution is used to measure the network device node representation h i and the cluster center vector θ u The similarity is as shown in formula (4): Among them, q iu Represents the network device node v i The probability of belonging to cluster u is obtained, and the distribution result Q of the network device node cluster is obtained. The target distribution P is calculated using the distribution Q, as shown in formula (5): Among them, p iu Also represents the network device node v i The probability of belonging to cluster u, but the target distribution P has a higher confidence. Distribution P depends on distribution Q, which is calculated by the network device node representation. Therefore, the clustering result will affect the learned network device node representation, and the quality of the network device node representation affects the credibility of the clustering result. Through continuous learning, a clustering result with high credibility is obtained, so that the network device information of the same category can be captured and a better network device node representation can be obtained. S40. Constructing an objective function for model optimization for the constructed semi-supervised smart city network device identification model; S50, setting a training process for a semi-supervised smart city network device identification model and performing iterative training to minimize an objective function, thereby determining model parameters; S60. Using the constructed semi-supervised smart city network device identification model and the determined model parameters, the network device data is identified and divided, and the classification results are output.
2. A semi-supervised smart city network device identification method according to claim 1, characterized in that: The step S10 of the method comprises the following specific steps: Network device data is collected from the smart city system and used to construct a graph structure G = V, E, X. During the construction process, network devices are represented as nodes in the graph structure, and information transmission between network devices is used as edges in the graph structure. The operating system of the network device, the open ports of the network device, the banner information of the open ports, and the service information provided by the network device are used as the features of the nodes in the graph structure. The marked network device type information is used as the node label, where: V=v1,v2,…,v N Represents a set of N network devices, where the network device node v n Indicates the nth network device, 1≤n≤N; E={e1,e2,…,e F } represents the F edges between network device nodes, where the fth edge is denoted as e f , 1≤f≤F; X represents the N×R dimension feature matrix of network device nodes, each row represents the feature of a network device node, and its nth row x n =[x n1 , x n2 ,…x nR ] is the network device node v n R features, 1≤n≤N, where network device node v n The rth feature of nr ; Y represents a dimensional node label matrix, N~ and K represent the number of network device nodes with labels and the number of label categories, respectively. The element in the i-th row and j-th column of the matrix is Y ij Represents the i-th network device node v i The relationship between the j-th class label, 1≤j≤K, if the network device node v i If it belongs to this category, then Y ij =1, otherwise Y ij =0.
3. A semi-supervised smart city network device identification method according to claim 1, characterized in that: The step S20 of the method comprises the following specific steps: The N×N dimensional adjacency matrix is denoted as A. The element in the i-th row and j-th column of the matrix is A ij Represents the i-th network device node v i and the jth network device node v j The adjacency relationship, 1≤i≤N, 1≤j≤N, if the network device node v i and network device node v j If there is a connecting edge between them, then A ij =1, otherwise, A ij =0.
4. A semi-supervised smart city network device identification method according to claim 1, characterized in that: In step S30, the semi-supervised smart city network device identification model includes a graph autoencoder module, a self-training clustering module and a class semantic information module. In the graph autoencoder module, a GCN encoder is used to obtain a low-dimensional representation of the network device node, and a decoder is used to reconstruct the graph structure information to guide the representation learning; in the self-training clustering module, the k-means algorithm is used to cluster the learned low-dimensional representation, and the results are used to guide the learning process. The learned network device node representation in turn supervises the generation of clusters; in the class semantic information module, the existing label information is used to extract the semantic information of similar network devices from the original information of the network device to supervise the representation learning so that the similar network device nodes have similar representations.
5. A semi-supervised smart city network device identification method according to claim 4, characterized in that: The step 30 further includes the following steps: S33. In the class semantic information module, due to the complexity of network devices, it is impossible to obtain label information of all categories of network devices. Therefore, we draw on the idea of zero-shot learning and use class semantic information, i.e., class attribute information, to supervise and guide model training. The obtained network device node representation can not only distinguish known classes, but also identify unknown classes. Class semantic information is generated from the original network device node features, and its generation process is shown in formula (6): Among them, c is the visible class label, c i represents the category label of the i-th network device node, x i Represents the feature vector of the i-th network device node, is the class semantic information, μ c Represents the mean value of the visible class node feature, as shown in formula (7), σ c represents the variance of the visible class node feature, as shown in formula (8):
6. A semi-supervised smart city network device identification method according to claim 1, characterized in that: The step S40 of the method includes the following specific steps: S41. Design a loss function for the graph autoencoder module, self-training clustering module, and class semantic information module described in S30. In the graph autoencoder module, a cross entropy loss function is selected to calculate the reconstruction loss. The smaller the reconstruction loss, the more similar the reconstructed adjacency matrix is to the original matrix, and the learned network device node representation is better. The cross entropy loss function is calculated as shown in formula (9): Where N is the number of nodes, a i is an element in the original adjacency matrix A, with a value of 0 or 1; To reconstruct the adjacency matrix The elements in have values between 0 and 1; In the self-training clustering module S42, the target distribution P is used to guide representation learning and supervise the update of the actual distribution Q. Since the distribution P is calculated based on the distribution Q, the distribution Q can reversely supervise the update of the distribution P, thereby forming a self-training clustering mechanism. The KL divergence is used to measure the difference between the two distributions, as shown in formula (10): In the class semantic information module S43, by comparing the real class semantic information obtained from the original features with the predicted class semantic information obtained from the network device node representation, the two types of semantic information of the same type of nodes are made closer, that is, the similarity between nodes of the same type and the difference between nodes of different types are increased, thereby guiding the generation of supervised network device node representation and obtaining a better network device node representation result. The module loss function is shown in formula (11): Among them, K′ is the set of labeled nodes, and Represent the real and predicted class semantic information respectively; S44, then the final objective function of the semi-supervised smart city network device identification model is shown in formula (12), and the hyperparameter α>0; L=L r +α(L c +L s ) (12)。 7. A semi-supervised smart city network device identification method according to claim 1, characterized in that: The step S50 of the method includes the following specific steps: S51, initializing the parameters of the semi-supervised smart city network device identification model in step S30, giving an adjustment coefficient θ and a number of iterations T, iteratively executing steps S52 to S54 until the number of iterations is reached, completing the training of the semi-supervised smart city network device identification model, and obtaining the optimal parameters of the model; S52, taking the adjacency matrix A and feature matrix X of the network device data obtained in S10 and S20 as input, and obtaining the network device node representation H = {h1, h2, ..., h N }; S53, according to formula (9), formula (10) and formula (11), we can get the graph autoencoder loss L r , self-training clustering loss L c And the class semantic information loss L s ; S54. Input the losses of the three modules into formula (12) to obtain the total loss of the semi-supervised smart city network device identification model, perform backpropagation, and cyclically update the model parameters, that is, the neural network parameters W.
8. A semi-supervised smart city network device identification method according to claim 1, characterized in that: The step S60 of the method includes the following specific steps: S61, obtain the optimal parameters of the model through S52 to S54, input the network device data, obtain the representation of the network device node through the encoder GCN, and then convert the element value in the representation of each network device node into a probability between 0 and 1 through formula (13); Among them, z i Refers to the network device node representation h i The i-th element, z j Refers to the network device node representation h i After calculating the probability of each element in the representation of each network device node, the class corresponding to the maximum probability is taken as the category of the network device node; S62. Send the classification results to the network analysis platform or operator, so as to obtain the distribution status of devices in the network space and the existing vulnerabilities, and manage the network in a timely manner.
9. A semi-supervised smart city network device identification system, characterized in that: Used to implement the semi-supervised smart city network device identification method described in any one of claims 1-8, including a computer processor and memory, a network device data preprocessing unit, a training unit based on a semi-supervised smart city network device identification model, and a result output unit based on the semi-supervised smart city network device identification model.
10. A semi-supervised smart city network device identification system according to claim 9, characterized in that: The network device data preprocessing unit executes steps S10 to S20 to construct a graph structure and an adjacency matrix for the acquired network device data, using the network devices as nodes, information transmission between the network devices as edges, and the operating systems of the network devices, the open ports of the network devices, the banner information of the open ports, and the service information provided by the network devices as network device node features, and loads the graph structure and the adjacency matrix into the computer memory; The semi-supervised smart city network device identification model training unit executes steps S30 to S50 according to the graph structure and adjacency matrix constructed in steps S10 to S20, constructs a semi-supervised smart city network device identification model, and trains the model based on the defined objective function; the semi-supervised smart city network device identification model result output unit executes step S60 to classify the network devices, and sends the classification results to the network analysis platform or operator to obtain the distribution status of the devices in the network space and the existing vulnerabilities, and manage the network in a timely manner.