Device type identification method based on flow sampling, terminal devices and storage media

Abstract

This invention discloses a device type identification method, terminal device, and storage medium based on traffic sampling. It eliminates the need to collect complete device traffic data; device identification is achieved simply by sampling traffic at the gateway. To address the issue of missing traffic features, traditional tensor imputation algorithms learn the embeddings corresponding to tensor rows, columns, and depths, but cannot generalize to unknown rows, columns, or depths. This results in repeated retraining, time-consuming and costly feature imputation. This invention proposes an inductive tensor imputation method that utilizes historical information to learn and generate embedding functions, enabling fast and effective device traffic feature imputation.

Description

Technical Field

[0001] This invention relates to the fields of deep learning and device identification technology, and in particular to a device type identification method, terminal device, and storage medium based on traffic sampling. Background Technology

[0002] With the development of embedded systems, wireless communication, cloud computing, and artificial intelligence, the Internet of Things (IoT) is being widely used in industry, homes, and offices. To ensure the security and service management of IoT, timely identification of IoT devices is crucial for the overall management of the IoT environment. For example, network service providers can allocate higher bandwidth to devices identified as smart speakers to improve user experience and satisfaction; and they can provide more reliable communication services to devices identified as smoke detectors or smart door locks to ensure user safety.

[0003] Device identification based on traffic characteristics is an effective method for identifying devices. It extracts features such as time intervals, communication traffic, and protocols from the complete traffic of IoT devices and applies machine learning multi-classifiers such as random forests, support vector machines, convolutional neural networks, and long short-term memory networks to classify the device traffic behavior features, thereby achieving device identification. This method can be roughly divided into three steps: (1) collecting the complete traffic of the device; (2) extracting the device traffic behavior features from the collected complete device traffic; and (3) inputting the traffic features into the device identification model, i.e., the machine learning multi-classifier, to identify and classify the device type.

[0004] While this type of device identification based on traffic characteristics boasts high accuracy, it still faces some significant technical challenges. It relies on extracting features from the complete traffic stream, such as source / destination addresses, source / destination ports, network protocols, average / standard deviation of uplink and downlink packet lengths, duration, and payload. Obtaining the complete data stream requires continuous packet capture at the gateway, which not only increases the gateway's computational and storage burden but may also affect network communication speed and stability, thus resulting in poor robustness and practicality of the method.

[0005] In addition, a time-series-based environmental protection equipment identification method is also an effective approach. While not based on equipment flow rate, this method still requires the acquisition of complete real-time waveform data of the environmental protection equipment. Even though it uses graph neural networks to extract node features from grayscale images and constructs a type-II fuzzy classification network using these features to filter fuzzy rules for higher identification accuracy, significant data acquisition overhead still exists when the number of devices is large. Furthermore, the type-II fuzzy classification network may require more computational resources and time to process higher-dimensional and more complex data, and there is a risk of overfitting or underfitting. Modeling as grayscale images may result in the loss of some detailed information from the environmental protection equipment waveform data, and it may also be affected by noise or interference, leading to poor identification accuracy.

[0006] Meanwhile, there is another method for anomaly detection in power IoT devices based on graph neural networks. This method uses graph neural networks to detect anomalies in IoT devices. However, at the data acquisition source, it still needs to collect complete traffic and service data from different devices in the power IoT. When the number of connected devices is large, it will still cause significant data acquisition overhead, placing a heavy burden on the data acquisition source, such as the gateway, and further affecting its basic function as a network forwarding device. Summary of the Invention

[0007] The technical problem to be solved by the present invention is to provide a device type identification method, terminal device and storage medium based on traffic sampling to address the shortcomings of the existing technology. This solves the problem that traditional device identification methods based on device traffic characteristics rely on collecting and storing complete device traffic at the gateway, which results in a large computational burden and storage pressure on the gateway, leading to poor robustness and practicality of the device identification method.

[0008] To solve the above-mentioned technical problems, the technical solution adopted by the present invention is: a device type identification method based on flow sampling, comprising the following steps:

[0009] S1. Intermittently collect data packets from IoT devices;

[0010] S2. Extract the features of the collected data packets to obtain the feature vector of each data packet. Stack the feature vectors of all data packets to form a third-order sparse tensor. Use the third-order sparse tensor to construct a bipartite graph G = {Vm, Vw, E}, where the set of left nodes Vm of the bipartite graph is the set of devices, the set of right nodes Vw is the set of data packet measurement windows, and the set of edges E between the set of left nodes and the set of right nodes is the feature set.

[0011] S3. Use the bipartite graph as input to the device identification model to obtain the updated device identification model.

[0012] This invention only requires sampling traffic at the gateway to perform device identification based on device traffic characteristics, without needing to collect complete device traffic data. Therefore, it reduces measurement costs and storage pressure, solves the problems of high overhead and poor practicality of existing device identification methods based on traffic characteristics, and lowers identification costs.

[0013] In this invention, the specific implementation process of step S1 includes:

[0014] Set up multiple measurement windows;

[0015] Randomly select a portion of the measurement window and collect the device flow rate within the selected measurement window.

[0016] In step S3, the device identification model includes:

[0017] The first graph neural network message passing layer is used to perform the first graph information passing on the input bipartite graph and update the vector representations of nodes and edges in the bipartite graph.

[0018] The second neural network message passing layer is used to update the vector representations of nodes and edges in the bipartite graph output by the first neural network message passing layer based on the 2-hop neighbor relationships in the bipartite graph.

[0019] The missing feature completion layer is used to estimate the missing feature edges based on the node information in the bipartite graph output by the message passing layer of the second graph neural network, and output the complete feature edge set.

[0020] A convolutional unit is used to perform convolution operations on the completed set of feature edges.

[0021] The linear output layer takes concatenated features as input and outputs the device category. The concatenated feature acquisition process includes: flattening the features output by the convolutional unit, concatenating the flattened features with the node vector output by the message passing layer of the second graph neural network to obtain the concatenated features.

[0022] This invention learns how to generate embeddings in an inductive manner, rather than learning the embeddings themselves. This can effectively and quickly complete the behavioral characteristics of unsampled traffic from devices and can also handle newly arriving devices, thus better meeting the needs of device identification scenarios and improving the accuracy of device type identification.

[0023] The specific implementation process of updating the vector representations of nodes and edges in the bipartite graph by the message-passing layer of the first graph neural network includes:

[0024] The neighbor aggregation vector of node v in the first graph information transmission is constructed using the following formula.

[0025]

[0026] N(v) is the set of neighboring nodes of v. These are the neighboring nodes of node v. Let be the initial vector representation of node v's 1-hop neighbor node u. Let represent the initial vector of edge uv, CONCAT(·) denotes the concatenation operation, Mean{·} is the mean aggregation function, and ReLU(·) is the nonlinear activation function. These are the learnable parameters for the construction process in the first graph information transmission.

[0027] Update the node vector representation using the following formula: in, Let v be the representation vector updated by node v in the first graph information transmission. These are the learnable parameters for the node representation update process in the first graph information transmission.

[0028] Update the edge vector representation using the following formula: in, Let uv be the representation vector updated by edge uv in the first graph information transmission. These are the learnable parameters for the edge representation update process in the first graph information transmission.

[0029] Through the first graph information passing, each node in the graph is updated once. Its representation can capture the complex features and patterns of its first-order expanded neighbor subtree structure, such as the node's degree, the attribute distribution of neighbors, and the connection relationships between neighbors. These features and patterns can reflect the node's position and role in the graph, as well as the similarity and differences between the node and its neighbors. The specific implementation process of the second graph neural network message passing layer updating the vector representations of nodes and edges in the bipartite graph output by the first graph neural network message passing layer includes:

[0030] The neighbor aggregation vector of node v in the second graph information transmission is constructed using the following formula. Let be the vector representation of node u in the first graph information transmission. These are the learnable parameters for the construction process in the second graph information transmission.

[0031] Update node vector representation: Let v be the representation vector updated by node v in the second graph information transmission. These are the learnable parameters for the node representation update process in the second graph information transmission.

[0032] Update edge vector representation: Let uv be the representation vector updated by the edge in the second graph information transmission. These are the learnable parameters for the edge representation update process in the second graph information transmission.

[0033] Through the second graph information transmission, each node in the graph undergoes a second update, allowing its representation to incorporate information from its second-order expanded neighbor subtrees and graph structure information, thereby improving the quality and expressive power of the node representation. This means that the node representation can reflect not only information from its direct neighbors but also information from its indirect neighbors, such as the node's clustering coefficient, the degree distribution of its neighbors, and the path length between neighbors. This information, along with the graph structure information, can reflect more distant local subgraph information, and even the information of the entire graph. This allows for the capture of more complex and higher-order features and patterns in the graph, which is beneficial for subsequent missing feature completion tasks. The specific implementation process of the missing feature completion layer obtaining the completed feature edge set includes:

[0034] Estimate missing feature edges: in, It is an estimate of the missing feature edge between nodes v and u, which is a K-dimensional feature vector. and W represents the updated representation vectors of nodes v and u in the message passing layer of the second graph neural network, respectively. pred The parameters are learnable, and Sigmoid(·) is a non-linear activation function;

[0035] The estimated values ​​of all missing feature edges are merged into the known feature edge set to obtain the completed feature edge set.

[0036] After two graph message passes, the missing features can be estimated through the missing feature completion layer. Compared with the traditional tensor completion algorithm, its advantages are mainly threefold: (1) It can estimate the missing features by utilizing the structural features of the graph without relying on auxiliary information; (2) The feature completion process is inductive, and it can use historical information to generalize to unknown rows, columns, and depths without retraining the model; (3) It can use graph patterns to capture the interdependencies between nodes, thereby improving the accuracy of feature estimation.

[0037] The convolutional unit of the present invention comprises multiple convolutional modules connected in series.

[0038] In this invention, the linear output layer first maps the input concatenated features to a fixed length (i.e., the number of device types), and then calculates the probability of the device by softmax. The device type corresponding to the maximum probability value is the final device category.

[0039] As an inventive concept, the present invention also provides a terminal device, which includes:

[0040] One or more processors;

[0041] A memory having stored one or more programs that, when executed by one or more processors, cause the one or more processors to implement the steps of the method described above.

[0042] As an inventive concept, the present invention also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the method described above.

[0043] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0044] 1. This invention does not require collecting complete device traffic; it only collects device traffic within a few random windows. Device identification based on device traffic characteristics can be performed simply by sampling traffic at the gateway. Since it does not require collecting complete device traffic, it reduces measurement costs and storage pressure, and solves the problems of high overhead and poor practicality of existing traffic-based device identification methods. This invention uses intermittent data packet collection, further reducing identification costs.

[0045] 2. This invention uses bipartite graph modeling for devices, which effectively solves the problem of feature loss caused by reducing identification costs by collecting device traffic only in a few random windows. Therefore, it can achieve high device identification accuracy with relatively low overhead compared to existing device identification methods based on traffic features.

[0046] 3. This invention proposes a missing feature completion model based on graph neural networks. Unlike traditional tensor filling algorithms, this model can utilize historical information to learn and generate embedding functions. When a new device arrives, it can quickly and accurately complete the missing features of unsampled traffic. This invention learns how to generate embeddings in an inductive manner, rather than learning the embeddings themselves. It can effectively and quickly complete the behavioral features of unsampled traffic of devices and can cope with newly arrived devices, thus better meeting the needs of device identification scenarios and achieving high-precision device type identification.

[0047] 4. This invention proposes a device recognition model based on convolutional neural networks. This model can achieve high-accuracy device recognition by utilizing completed device features and node embeddings learned from graph neural networks. This invention employs a loss function that mixes feature completion loss and device recognition loss, effectively balancing the feature completion and device recognition tasks. By minimizing the loss function, the completed features will better adapt to the structure of the feature space, and the completed features will also possess a certain degree of discriminative power following the labels.

[0048] Therefore, it can achieve high device identification accuracy while solving the problems of high overhead and poor model robustness of existing device identification methods based on traffic characteristics. Attached Figure Description

[0049] Figure 1 This is a flowchart of the device identification method based on flow sampling according to an embodiment of the present invention;

[0050] Figure 2 This is a schematic diagram of intermittent data packet acquisition according to an embodiment of the present invention;

[0051] Figure 3 This is a diagram illustrating the data modeling and processing process according to an embodiment of the present invention;

[0052] Figure 4 A schematic diagram illustrating the drawbacks of filling existing tensors;

[0053] Figure 5 Data modeling for tensor filling in embodiments of the present invention;

[0054] Figure 6 This is a schematic diagram of the network structure according to an embodiment of the present invention;

[0055] Figure 7 This is a performance comparison between the tensor filling algorithm of this invention and the traditional tensor filling algorithm. Detailed Implementation

[0056] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0057] Traditional device identification methods based on device traffic require collecting complete device traffic data, resulting in high overhead. To overcome this problem, this invention proposes a device identification method based on device traffic. Compared to traditional methods, this method does not require collecting complete device traffic data; it only needs to sample traffic at the gateway for device identification. To address the issue of missing traffic features, traditional tensor imputation algorithms learn the embeddings corresponding to tensor rows, columns, and depths, but cannot generalize to unknown rows, columns, or depths. This leads to repeated retraining, time-consuming and costly feature imputation. This invention proposes an inductive tensor imputation algorithm that utilizes historical information to learn and generate embedding functions, enabling fast and effective device traffic feature imputation.

[0058] Example 1

[0059] like Figure 1 As shown, the present invention provides a device identification method based on traffic sampling, comprising the following steps:

[0060] Step (1) involves intermittently collecting traffic from IoT devices. Unlike collecting the full amount of device traffic, this step divides the device traffic into multiple measurement windows based on time. Therefore, this step performs intermittent data packet collection on different devices to reduce the overhead of full data packet collection and dumping. Specifically, this step only collects data packets from IoT devices within a portion of random measurement windows, rather than all of them, thus reducing measurement costs and storage pressure. Figure 2 As shown in the example, this step involves intermittent packet capture of the IoT device. In this example, the device traffic is divided into five measurement windows based on time, with a window size of 5, representing the capture of 5 packets in chronological order. Windows w2 and w4 are randomly selected, and the packet sequence p within them... w2 and p w4 Collected and dumped.

[0061] Step (2) performs feature engineering on the data packet sequences partially collected in step (1), extracts traffic features, and performs data modeling and processing. In this step, six data features are extracted, including the number of uplink data packets, the number of downlink data packets, the mean length of uplink data packets, the mean length of downlink data packets, the standard deviation of uplink data packet length, and the standard deviation of downlink data packet length. In the execution example of step (1), the data packet sequences p in measurement windows w2 and w4... w2 and p w4 Collected and dumped. For example... Figure 3 As shown, this step involves the data packet sequence p. w2 and p w4 Perform feature engineering separately to obtain the feature vector a2 = (a 21 ,a 22 ,a 23 ,a 24 a 25 ,a 26 ) and a4 = (a 41 ,a 42 ,a 43 ,a 44 ,a 45 ,a 46Each feature vector includes six simple traffic features: the number of uplink data packets, the number of downlink data packets, the mean length of the uplink data packets, the mean length of the downlink data packets, the standard deviation of the uplink data packet length, and the standard deviation of the downlink data packet length. After this step, the feature vectors of an IoT device form a K*T sparse matrix, where K is the number of features and T is the number of windows. Figure 3 As shown in execution example (a), the traffic characteristics of one IoT device form a 6*5 sparse matrix. At the same execution time, the traffic characteristics of multiple IoT devices will stack to form a K*T*M third-order sparse tensor. Figure 3 As shown in example (b) in the example, at the same execution time, three IoT devices are stacked to form a 6*5*3 third-order sparse tensor.

[0062] For the resulting sparse tensors, this invention employs tensor completion technology to fill in missing features. Existing tensor completion techniques can be divided into two steps: training and completion.

[0063] ① Training steps. Train the embeddings corresponding to the three dimensions using known elements in the sparse tensor.

[0064]

[0065] Where Ω represents the set of known elements in the sparse tensor. They are respectively row r k Column C t and depth d m The embedding of Θ. Θ represents other parameters in the model. f(·) is an interaction function, which can be an inner product, outer product, etc.

[0066] ② Feature completion. The trained embeddings and parameters Θ are fed into the function f(·), where an unknown element... It can be estimated as

[0067] However, the existing tensor filling methods described above are linear. They cannot be directly generalized to unseen rows, columns, or depths unless time-consuming retraining is performed. This is not effective for device recognition scenarios, as device instances may arrive dynamically.

[0068] Here, using Figure 4 The following example illustrates the shortcomings of the tensor filling algorithm described above. At time T1, three device instances, device1, device2, and device3, arrive and form a third-order tensor A1∈R. 6*5*3 .

[0069] In the training step, using the set of known elements in the tensor, we can train and obtain six row embeddings. Corresponding to six types of features, five column embeddings Corresponding to five time windows, three deep embeddings This corresponds to three device instances to be classified. In the feature completion step, these trained embeddings can be used to estimate the features missing due to traffic sampling.

[0070] At time T2, four new unclassified devices, device4, device5, device6, and device7, arrive, thus forming a new third-order tensor A2∈R. 6*5*4 Although the device instance embedding was learned above at time T1. However, these are not embeddings of the four newly arrived devices and cannot be used to estimate the missing entries in A2. Therefore, at time T2, the entire model must be retrained using the data from A2, without the previously learned prior information.

[0071] To address the aforementioned problems, unlike existing tensor filling methods, this invention proposes an inductive tensor filling method. This method constructs a bipartite graph from historical device traffic data and utilizes message passing within the bipartite graph to learn how to generate embeddings—that is, learning the embedding generation function, rather than directly learning the embeddings themselves. Message passing within the bipartite graph consists of three steps and can be repeated multiple times (rounds).

[0072] ①Message construction and aggregation

[0073]

[0074] in, It is the neighbor aggregation vector of node v during the l-th message passing. It is the embedding of node u during the l-th message pass. It is the embedding of edge uv during the l-th message pass. N(v) represents the set of neighbors of node v. CONCAT is the concatenation operation. σ is a learnable parameter, σ is a non-linear activation function, and AGG is the aggregation operation.

[0075] ② Node embedding update

[0076]

[0077] in, This refers to the neighbor embedding of node v during the l-th message transmission. It is the embedding of node v during the (l-1)th message pass. It is a learnable parameter.

[0078] ③ Edge embedding update

[0079]

[0080] in, This refers to the embedding of edge uv during the l-th message passing. It is the embedding of node u during the l-th message pass. It is the embedding of node v during the l-th message pass. It is a learnable parameter.

[0081] Therefore, when a new device traffic instance to be classified arrives, the above steps can be used to quickly obtain the embeddings of the nodes at both ends of the bipartite graph and estimate the missing features.

[0082] Based on this, the third-order sparse tensor at the same execution time will first be further constructed as a bipartite graph G = {Vm, Vw, E}, where the set of left nodes Vm is the device set, the set of right nodes Vw is the window set, and the set of edges E between the left and right nodes is the feature set. For example... Figure 5 As shown in the execution example, at the same execution time, a 6*5*3 third-order sparse tensor is constructed into a bipartite graph with a left node set size |Vm|=3, a right node set size |Vw|=5, and an edge set dimension of 6.

[0083] Step (3) first inputs the bipartite graph G = {Vm, Vw, E} constructed in step (2) into the feature completion module, which uses the inductive tensor completion technique proposed in this embodiment to complete the missing features. Then, the completed data and the device node representation learned during the completion process will be input into the recognition module based on the convolutional neural network for device recognition.

[0084] Specifically, the feature completion module and the recognition module (collectively referred to as the device recognition model) in this step are obtained through the following steps of joint training:

[0085] Step (3-1) uses IoT device traffic collected from real-world IoT environments as a dataset and divides it into training, validation, and test sets in a 7:1:2 ratio.

[0086] Specifically, this invention uses 21 types of IoT devices, and the dataset is named dataset-21, including: smart air conditioners, fans, refrigerators, table lamps, microwave ovens, vacuum cleaners, washing machines, and other IoT devices. It should be understood that this invention is not limited to the aforementioned IoT devices; any IoT device is included within the scope of protection of this invention.

[0087] Step (3-2) involves intermittent data packet collection and feature engineering of the dataset from step (3-1) to obtain the traffic feature matrix of different devices, forming traffic feature tensors at different times, and further forming bipartite graphs G = {Vm, Vw, E} at different times.

[0088] Step (3-3) inputs the bipartite graph G = {Vm, Vw, E} obtained after processing in step (3-2) into the device recognition model.

[0089] Step (3-4) uses the backpropagation algorithm to update and optimize the device identification model parameters to obtain the updated device identification model.

[0090] Specifically, the model parameters are initialized using the Xavier method. To accelerate the descent of the loss value, the backpropagation algorithm in this step uses Adam as the optimizer, due to its advantages of momentum and adaptive learning rate.

[0091] Step (3-5) iteratively trains the device recognition model updated in step (3-4) until the loss function of the device recognition model reaches its minimum.

[0092] The loss function of the device recognition model is L, which is composed of the feature completion loss L. 特征补全 and equipment classification damage L 设备分类 It consists of two parts.

[0093] ① Feature completion loss L 特征补全 :

[0094]

[0095] Where nodes u and v represent the left and right node sets in the bipartite graph, and the device node set V m and window node set V w e uv Let be the feature edge between node u and node v in the bipartite graph. To estimate the feature edges after missing edge completion using a graph neural network. E is the set of all edges in a bipartite graph.

[0096] ② Equipment Classification Loss L 设备分类 :

[0097]

[0098]

[0099] Where Φ is the convolutional neural network classifier, Let i be the feature set formed after feature completion by a graph neural network for device i. Let i be the vector representation of device i learned through a graph neural network. For the predicted category label, y i For actual category labels. V m This is the set of all devices in all training data.

[0100] Finally, the device recognition model loss function L:

[0101] L = L 设备分类 +λL 特征补全

[0102] Here, λ is a learnable weighting factor used to balance the weights of device completion and device recognition during the training process.

[0103] Step (3-6) uses the validation set in the dataset obtained in step (3-1) to iteratively validate the iteratively trained device recognition model until the recognition accuracy reaches the optimal level, thereby obtaining the trained device recognition model, and then performs performance testing on the test set.

[0104] For the device identification model in this embodiment of the invention, its network has an 8-layer structure, such as... Figure 6 As shown, the network consists of one input layer, two message passing layers based on graph neural networks, one missing feature completion layer, three device recognition layers based on convolutional neural networks, and one linear output layer. The first four layers are feature completion modules, and the last four layers are device recognition modules. Its specific network structure is as follows:

[0105] The first layer is the input layer, which takes a bipartite graph G = {Vm, Vw, E} as input.

[0106] The second layer is the graph neural network message passing layer. This layer performs the first graph information passing on the input bipartite graph, updating the vector representations of nodes and edges in the graph based on the one-hop neighbor relationships. It includes the following three steps:

[0107] ① Message Construction and Aggregation. The process of constructing and aggregating information can be expressed as follows:

[0108]

[0109] in, This is the neighbor aggregation vector of node v in the first graph information transmission. Let v be the initial vector representation of node u, a 1-hop neighbor of node v. This is the initial vector representation of edge u. CONCAT(·) represents the concatenation operation. This operation converts the initial representation vector of node u into a single vector. Initial vector representation of edge uv They are concatenated together. Mean{·} is the mean aggregation function. ReLU(·) is the non-linear activation function. These are the learnable parameters for the message construction and aggregation process in the first graph information transmission.

[0110] ② Node representation update. The vector representation of a node set can be updated through the neighbor aggregation vector. The update of the node vector representation can be expressed as follows:

[0111]

[0112] in, Let CONCAT(·) represent the concatenation operation, where CONCAT is the updated representation vector of node v in the first graph information transmission. This operation concatenates the initial representation vector of node v. Its neighbor vectors aggregated in the first graph information transfer They are concatenated together. ReLU(·) is a non-linear activation function. These are the learnable parameters for the node representation update process in the first graph information transmission.

[0113] ③ Edge representation update. After updating the vector representations of all nodes in the graph, the updated node vector representations are used...

[0114] The vector representation of an edge can be updated. The update of the edge vector representation can be expressed as follows:

[0115]

[0116] in, Let be the representation vector updated by edge u / v in the first graph information transmission. CONCAT(·) represents the concatenation operation. This operation concatenates the representation vector updated by node u in the first graph information transmission. The representation vector updated by node v in the first graph information transmission The initial vector representation of edge uv They are concatenated together. ReLU(·) is a non-linear activation function. These are the learnable parameters for the edge representation update process in the first graph information transmission.

[0117] The third layer is consistent with the second layer. This layer performs a second graph information transfer, updating the vector representations of nodes and edges in the bipartite graph based on the 2-hop neighbor relationships. It includes the following three steps:

[0118] ① Message Construction and Aggregation. The construction and aggregation of information can be expressed as follows:

[0119]

[0120] in, This is the neighbor aggregation vector of node v in the second graph information transmission. Let be the vector representation of node u in the first graph information transmission. Let uv be the vector representation of edge uv in the first graph information transmission. These are the learnable parameters for the message construction and aggregation process in the second graph information transmission.

[0121] ② Node representation update. The update of the node vector representation can be expressed as follows:

[0122]

[0123] in, This is the representation vector updated by node v in the second graph information transmission. These are the learnable parameters for the node representation update process in the second graph information transmission.

[0124] ③ Edge representation update. The update of the edge vector representation can be expressed as follows:

[0125]

[0126] in, Let uv be the representation vector updated by the edge in the second graph information transmission. These are the learnable parameters for the edge representation update process in the second graph information transmission.

[0127] The fourth layer is the missing feature completion layer. This layer takes the node information updated after two information passes as input and estimates the missing feature edges. The specific process can be represented by the following formula:

[0128]

[0129] in, It is an estimate of the missing feature edge between nodes v and u, which is a K-dimensional feature vector. and W represents the updated representation vectors of nodes v and u in the second graph information transmission, respectively. pred is a learnable parameter used to estimate missing feature edges. Sigmoid(·) is a non-linear activation function used to constrain the value between 0 and 1. After this layer, the output is the set of padded feature edges, denoted as .

[0130] The fifth layer is a 2D convolutional module, with the input being the completed feature edge set. This module contains a 2D convolution (64 channels, 3 kernels, 1 stride, 1 padding), a ReLU activation function, a 2D MaxPool (3 kernels, 1 stride, 1 padding), and a 2D Dropout (probability 0.2). The output matrix is ​​K*T in size and has 64 channels.

[0131] The sixth layer is a 2D convolutional module, taking the output of the fifth layer as input. This module contains, in sequence, a 2D convolution (128 channels, 3 kernels, 1 stride, 1 padding), a ReLU activation function, a 2D MaxPool (3 kernels, 1 stride, 1 padding), and a 2D Dropout (probability 0.2). The output matrix is ​​K*T in size and has 128 channels.

[0132] The seventh layer is a 2D convolutional module, taking the output of the sixth layer as input. This module contains, in sequence, a 2D convolution (64 channels, 3 kernels, 1 stride, 1 padding), a ReLU activation function, a 2D MaxPool (3 kernels, 1 stride, 1 padding), and a 2D Dropout (probability 0.2). The output matrix is ​​of size K*T and has 64 channels.

[0133] The eighth layer is a linear output layer. Its input consists of the outputs of the seventh layer and the device node vector representations from the third layer. This layer first flattens the output of the seventh layer, then concatenates it with the device node vector representations from the third layer, using this as its input. The number of output nodes represents the number of device types, and the probability distribution is normalized using softmax. The device type corresponding to the highest probability value is the final device type.

[0134] The principle behind the final classification using the linear output layer (linear layer + softmax layer) is as follows: The linear layer is a fully connected layer that maps the input feature vector to a fixed-length vector. Each element of this vector corresponds to a score for a device type; a higher score indicates a greater likelihood of belonging to that type. The length of the vector is equal to the number of device types. The softmax layer is an activation function that transforms the output vector of the linear layer into a probability distribution. This is achieved by performing an exponential operation on each element and then dividing by the sum of the exponents of all elements, ensuring that the sum equals 1, representing the probability of each device type. The classification result is the device type corresponding to the highest probability value in the softmax layer's output vector.

[0135] Test Results

[0136] The device type identification method based on traffic sampling proposed in this embodiment of the invention is used to test the traffic of IoT devices in the test set, and the identification results are given. In the testing section, the selected evaluation indicators are the Feature Completion Error (NMAE) and the Device Identification Accuracy (F1-score).

[0137]

[0138] Where, x i For the true value of the feature, is the feature estimate, and n is the total number of missing features.

[0139]

[0140] Among them, R k P represents the recall rate of the k-th type of device. k F1-score represents the accuracy of the k-th device category, where m is the total number of device categories. The F1-score ranges from [0,1] and reflects the recognition accuracy of each device category. A higher F1-score means higher device recognition accuracy.

[0141] Figure 7 This paper demonstrates the filling error of the inductive tensor filling algorithm proposed in this invention compared to traditional tensor filling algorithms. As shown in the figure, the inductive tensor filling algorithm proposed in this invention can effectively estimate missing traffic features in the IoT environment and achieves the best missing feature completion performance compared to other traditional algorithms.

[0142] Table 2 shows the time consumption of the inductive tensor imputation algorithm proposed in this embodiment of the invention compared to the traditional tensor imputation algorithm for completing missing features when 256 device instances to be classified arrive. Since this embodiment of the invention employs an inductive method that learns an embedding generation function, it can directly generate embeddings when new device instances arrive. However, traditional methods are probabilistic and do not support estimation for new device instances. When new device instances arrive, they must undergo model retraining. As shown in the table, the time consumption of retraining is very high. Even the fastest traditional method consumes 38 times more time than this invention, reflecting that the inductive tensor imputation algorithm of this embodiment is more suitable for device recognition scenarios.

[0143] Table 2 shows the time consumption of the inductive tensor filling algorithm proposed in this invention compared with the traditional tensor filling algorithm for completing missing features.

[0144] This invention NTC NTM CoSTCo NTF Time (s) 0.0843 209.5121 51.3745 3.2331 3.2622

[0145] Table 3 shows a comparison of the accuracy of the device identification method proposed in this invention with that of device identification after using a traditional tensor filling algorithm for flow feature filling. The results show that the feature completion algorithm proposed in this invention is better suited for device identification scenarios compared to traditional filling algorithms.

[0146] Table 3 compares the accuracy of the device identification method proposed in this invention with that of device identification after using a traditional tensor filling algorithm for flow feature filling.

[0147]

[0148] Table 4 shows the F1-scores of the embodiments of the present invention at different sampling rates. The results show that the present invention still achieves high device identification accuracy even at low traffic sampling rates. For example, when sampling data packet sequences for 30% of the measurement window, the identification accuracy is 0.8444. This reflects that the present invention can achieve high device identification accuracy without requiring complete traffic acquisition, thus reducing acquisition and dumping overhead.

[0149] Table 5 shows a performance comparison between the embodiments of the present invention and commonly used device identification methods based on device traffic. It can be seen that even with a 60% sampling rate, the present invention still achieves high identification accuracy, with an F1-score of 0.9245. Furthermore, because only 60% of the data packets are collected, the overhead of data packet collection and dumping is reduced by 40% compared to traditional methods.

[0150] Table 4. F1-scores of the embodiments of the present invention at different sampling rates.

[0151]

[0152] Table 5. Performance comparison of the embodiments of the present invention with commonly used device identification methods based on device traffic in the field.

[0153]

[0154] Example 2

[0155] Embodiment 2 of the present invention provides a terminal device corresponding to Embodiment 1 above. The terminal device can be a processing device for a client, such as a mobile phone, a laptop, a tablet computer, a desktop computer, etc., to execute the method of the above embodiments.

[0156] The terminal device in this embodiment includes a memory, a processor, and a computer program stored in the memory; the processor executes the computer program in the memory to implement the steps of the method in Embodiment 1 described above.

[0157] In some implementations, the memory may be high-speed random access memory (RAM), and may also include non-volatile memory, such as at least one disk storage device.

[0158] In other implementations, the processor can be any type of general-purpose processor, such as a central processing unit (CPU) or a digital signal processor (DSP), and there is no limitation here.

[0159] Example 3

[0160] Embodiment 3 of the present invention provides a computer-readable storage medium corresponding to Embodiment 1 above, on which a computer program / instructions are stored. When the computer program / instructions are executed by a processor, they implement the steps of the method of Embodiment 1 above.

[0161] A computer-readable storage medium can be a tangible device that holds and stores instructions for use by an instruction execution device. A computer-readable storage medium can be, for example, but not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any combination thereof.

[0162] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code. The solutions in the embodiments of this application can be implemented in various computer languages, such as the object-oriented programming language Java and the interpreted scripting language JavaScript.

[0163] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0164] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0165] Although preferred embodiments of this application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of this application.

[0166] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A device type identification method based on flow sampling, characterized in that, Includes the following steps: S1. Intermittently collect data packets from IoT devices; S2. Extract the features of the collected data packets to obtain the feature vector of each data packet. Stack the feature vectors of all data packets to form a third-order sparse tensor. Use the third-order sparse tensor to construct a bipartite graph G={Vm, Vw, E}, where the set of left nodes Vm of the bipartite graph is the set of devices, the set of right nodes Vw is the set of data packet measurement windows, and the set of edges E between the set of left nodes and the set of right nodes is the feature set. S3. Use the bipartite graph as input to the device identification model to obtain the updated device identification model; The device identification model includes: The first graph neural network message passing layer is used to perform the first graph information passing on the input bipartite graph and update the vector representations of nodes and edges in the bipartite graph. The second neural network message passing layer is used to update the vector representations of nodes and edges in the bipartite graph output by the first neural network message passing layer based on the 2-hop neighbor relationships in the bipartite graph. The missing feature completion layer is used to estimate the missing feature edges based on the node information in the bipartite graph output by the message passing layer of the second graph neural network, and output the complete feature edge set. A convolutional unit is used to perform convolution operations on the completed set of feature edges. The linear output layer takes concatenated features as input and outputs the device category. The concatenated feature acquisition process includes: flattening the features output by the convolutional unit, concatenating the flattened features with the node vector output by the message passing layer of the second graph neural network to obtain the concatenated features.

2. The device type identification method based on flow sampling according to claim 1, characterized in that, The specific implementation process of step S1 includes: Set up multiple measurement windows; Randomly select a portion of the measurement window and collect the device flow rate within the selected measurement window.

3. The device type identification method based on flow sampling according to claim 1, characterized in that, The specific implementation process of updating the vector representations of nodes and edges in the bipartite graph by the message-passing layer of the first graph neural network includes: The neighbor aggregation vector of node v in the first graph information transmission is constructed using the following formula. : ； Let v be the set of neighboring nodes. Let v be a neighboring node. Let be the initial vector representation of node v's 1-hop neighbor node u. Let be the initial vector representation of edge uv. This indicates a splicing operation. It is the mean aggregation function. It is a non-linear activation function. These are the learnable parameters for the construction process in the first graph information transmission. Update the node vector representation using the following formula: ;in, Let v be the representation vector updated by node v in the first graph information transmission. For the learnable parameters of the node representation update process in the first graph information transmission, The initial vector representation of node v; Update the edge vector representation using the following formula: ;in, Let uv be the representation vector updated by edge uv in the first graph information transmission. For the learnable parameters of the edge representation update process in the first graph information transmission, This is the vector representation of node u updated in the second message passing.

4. The device type identification method based on flow sampling according to claim 3, characterized in that, The specific implementation process of updating the vector representations of nodes and edges in the bipartite graph output by the message-passing layer of the neural network in the second graph includes: The neighbor aggregation vector of node v in the second graph information transmission is constructed using the following formula. : ; Let be the vector representation of node u in the first graph information transmission. These are the learnable parameters for the construction process in the second graph information transmission. Update node vector representation: ; Let v be the representation vector updated by node v in the second graph information transmission. These are the learnable parameters for the node representation update process in the second graph information transmission. Update edge vector representation: ; Let uv be the representation vector updated by the edge in the second graph information transmission. For the learnable parameters of the edge representation update process in the second graph information transmission, This is the vector representation of node u updated in the 3rd message passing.

5. The device type identification method based on flow sampling according to claim 1, characterized in that, The specific implementation process of the missing feature completion layer obtaining the completed feature edge set includes: Estimate missing feature edges: ;in, It is an estimate of the missing feature edge between nodes v and u, which is a K-dimensional feature vector. and Let v and u be the representation vectors updated by nodes v and u in the message passing layer of the second graph neural network, respectively. For learnable parameters, It is a non-linear activation function; The estimated values ​​of all missing feature edges are merged into the known feature edge set to obtain the completed feature edge set. .

6. The device type identification method based on flow sampling according to claim 1, characterized in that, The convolutional unit comprises multiple convolutional modules connected in series.

7. The device type identification method based on flow sampling according to claim 1, characterized in that, The linear output layer first maps the input concatenated vector into a vector with a length equal to the number of device types. Each element in this vector corresponds to a score for a device type. Then, the softmax layer transforms the vector into a probability distribution, and the device type corresponding to the maximum value is the final device type.

8. A terminal device, characterized in that, include: One or more processors; A memory having stored one or more programs thereon, which, when executed by the one or more processors, cause the one or more processors to perform the steps of the method according to any one of claims 1 to 7.

9. A computer-readable storage medium, characterized in that, It stores a computer program that, when executed by a processor, implements the steps of the method as described in any one of claims 1 to 7.

Images