A method for network entity identification for IP location

Abstract

This invention proposes a network entity identification method for IP-based location, comprising the following steps: extracting the IPv6 addresses of network entities and obtaining path information to form a dataset; performing feature extraction and anonymization on the dataset to obtain attribute features, and embedding these attribute features into a network topology graph; dividing the network topology graph into subgraphs using a community clustering method; extracting the structural information of nodes in the subgraphs and calculating structural similarity; performing Transformer computation on all nodes in the subgraphs to calculate the comprehensive weight attention of the nodes; selecting the top K nodes for aggregation and updating based on the comprehensive weight attention between nodes, and outputting the updated node representations; training a Transformer network, feeding the updated node representations into a classification layer, and obtaining the device category by predicting probabilities. This invention successfully identified eight different network entities on a publicly collected dataset, achieving an accuracy rate of over 95.49%.

Description

Technical Field

[0001] This invention relates to the technical field of network entity recognition, and more particularly to a network entity recognition method for IP location, which is a network entity recognition method for IP location under a large graph network structure. Background Technology

[0002] Cyberspace mapping involves the detection, analysis, and mapping of various spatial resources within a network. Cyberspace asset analysis is the primary component, divided into physical resource analysis and virtual resource analysis. Network entity identification and IP location fall under physical resource analysis, specifically mapping IP addresses to network entity types and mapping IP addresses to network entity locations, respectively.

[0003] Network entities refer to a collective term for networked devices, specifically those with IP addresses capable of communication in cyberspace. Network entity localization technology uses the IP address of a target entity in cyberspace, primarily combining this with characteristics such as latency and topology, to determine the entity's location. Also known as IP localization, it has wide applications in many fields. IP localization technology is mainly divided into database-based methods, rule-based methods, and learning-based methods. Database-based methods can obtain the location of network entities through simple queries and comparisons; rule-based methods establish location constraints for network entities by constructing network-based rules; learning-based methods include using machine learning, deep learning, and graph neural networks to extract feature information and topological structure information of target nodes, establishing similarity judgments between nodes and landmarks to achieve network entity localization.

[0004] Database-based methods can obtain IP location through mixed data queries. Lee Y et al. proposed a new method for creating an IP address database based on crowdsourced internet broadband performance measurements with location tags. Zhao et al. proposed a novel method to calibrate location databases, using various classifiers and employing time delay as a feature to automatically display the relationship between distance and time delay. Rule-based methods: Liu et al. proposed the Checkin-GEO algorithm, which first obtains ID-location pairs through a mobile application and then establishes an ID-location-IP address mapping relationship on a PC. The GEO-RMP algorithm assumes that each router has a fixed service area over a period of time. Based on this assumption, it infers the service range of a router by analyzing the connection between landmarks and routers. Learning-based methods: Dan O et al. proposed a systematic method that can locate IP addresses using publicly accessible reverse DNS hosts, aiming to combine with other location data sources and treat the task as a machine learning problem. Wang et al. proposed GraphGeo, an IP localization method based on graph neural networks. This method learns by combining relevant host information obtained from the IP address with the surrounding neighborhood relationships of the node to which the IP belongs, mitigating the negative impact of network latency jitter or congestion. In experiments, this method showed the smallest error across various regions. Current best-in-class IP localization algorithms have errors of less than 1km, but the localization results are still at the street level. Further improving the localization granularity to the park level is a complex undertaking. Traditional rule-based and learning-based localization methods have not performed well.

[0005] Zhao et al. pointed out that vulnerabilities in the same devices may be location-related. Through data collection and comparison, vulnerable routers are mainly concentrated in a few countries, vulnerable network cameras are mainly located in China and Vietnam, and vulnerable printers from different manufacturers are mainly located in the United States. From the perspective of zero-day vulnerabilities, network administrators in a region may not update vulnerability patches for devices in that region in a timely manner. Based on this, the location of devices can be constrained to a certain extent based on device type and vulnerability detection. Liu et al. proposed to build IPv4-IPv6 associations by designing rules to expand IPv6 landmarks, but this algorithm, relying solely on rules, easily overlooks some potential IPv4-IPv6 pairs. Robert et al. proposed an active measurement technique to determine whether selected IPv4 and IPv6 address servers belong to the same network device. Based on this, IPv4-IPv6 associations can be built. By judging devices solely based on device fingerprinting technology, theoretically, the host can be more accurately identified based on the device type, and a more accurate IPv4-IPv6 association can be built.

[0006] However, when the granularity of network entity positioning reaches the campus access level, it becomes difficult to obtain location information using traditional positioning methods. Instead, judgments are made based on the network entity's attribute information. For example, if the entity is a server device, its location (IDC - Internet Data Center) can be determined using its public dataset information. Furthermore, IP addresses are merely logical characters within a network; the IP addresses of network entities are not static. The mapping relationship between IP addresses, locations, and network entities can change, and different devices have different IP address change frequencies. When a network entity is an IoT device or a server device, its IP address is more stable and does not change easily, serving as a high-precision landmark. Obtaining the device type of a network entity helps in further refining network entity positioning.

[0007] Existing network entity recognition methods such as Figure 1 As shown, network entity recognition primarily establishes connections with network entities through network probing tools. This involves sending data packets, receiving response data packets from the network entities, extracting relevant attribute features and characteristic information fields, and then performing classification processing using appropriate methods. Currently, network entity recognition is mainly divided into rule-based methods and learning-based classification. Rule-based methods mainly include fingerprint-based methods, banner-based methods, and flag-based methods. Among these, fingerprint-based classification mainly involves collecting and establishing a corresponding fingerprint database, and identifying or constraining classification devices based on relevant feature field information contained in the response data packets, achieving high accuracy. Learning-based classification mainly involves using machine learning and deep learning methods to embed the features extracted from network entities into a model for learning and classification. These methods achieve more effective classification results by integrating or analyzing multi-source datasets. Learning-based classification methods can effectively transform features into a higher-dimensional space for further processing.

[0008] Rule-based methods emerge from network entity traffic interaction data to identify information such as device brand or manufacturer. The basic idea is to use regular expressions or natural language processing (NLP) to analyze and extract tag information (manufacturer, device model, etc.) from the traffic as rules. During device identification, these regular expressions are used to match target network entities. Currently, most network probing platforms, including active probing platforms like Shodan, ZoomEyes, and Fofa, establish connections with hosts and analyze text data for rule-based identification. However, rule extraction is complex and carries the risk of network entities spoofing keywords. Feng et al. proposed the ARE framework. This method actively sends probe packets to collect target application-layer data, filters keywords using regular expression matching and NLP techniques, then searches the web for these keywords and expands them with other network entity attributes (e.g., type, brand, model) to build a device fingerprint database. Finally, the Apriori algorithm is used to identify the network entity type. However, this method fails to identify traffic fields that rely on network entity feedback and do not contain key information. Wan et al. proposed the DevTag rule base for identifying IoT devices. This method, based on the ARE framework, also uses the open-source tools Nmap and Ztag, collecting more than 40,000 rules. This method can obtain fine-grained network entity device information with high accuracy in a short time.

[0009] The basic idea behind learning-based methods is to select node features from the training set and embed these features into the model using supervised, semi-supervised, and unsupervised learning approaches. A classification model is then trained based on labeled data. Chen et al. proposed a TCP fingerprinting technique based on retransmission to actively identify network entities. This method increases the granularity of traditional TCP values ​​by selecting multiple sets of features from TCP retransmission packets. Then, an ensemble learning strategy is used to generate a combined classifier of various machine learning algorithms, achieving a 96.7% accuracy rate in vehicle-to-everything (V2X) identification. Aneja et al. proposed a deep convolutional neural network model. This method analyzes only the arrival time interval of data packets as an identification feature. A deep network structure, including 50 ResNet layers and basic CNN-5 layers, is built for learning. Experimental results show that this method has good performance but is susceptible to device signature attacks. Song et al. performed fine-grained network entity category and manufacturer identification for network cameras by analyzing data traffic packets. First, network camera devices were screened based on complete HTTP packets. Then, a combination of device fingerprint clustering and manual annotation was used to identify network cameras of different models, while also obtaining the latitude and longitude information of the network entities. Thom et al. combined Locality Sensitive Hashing (LSH) and neural networks to identify network entities based on network traffic. This method can identify network entities in real time, but the classifier requires a large amount of data for training, and the model's accuracy is low when the amount of data is small.

[0010] Currently, despite some significant achievements, network entity recognition still faces several challenges: 1) Fingerprint-based classification methods require a large and complex array of device labels. Limited by the size of the network entity fingerprint database, large-scale network entity classification is difficult. These methods can only identify network entities with the same or similar models in the existing database, failing to effectively identify new devices. Furthermore, some network entities send encrypted data packets. 2) Learning-based methods rely on complete feature dimensions. However, with the advent of anti-mapping techniques, previous detection methods cannot effectively acquire complete features. Training the model when features are missing or dimensions are mismatched will reduce classification accuracy or even prevent classification. Traditional learning-based classification methods only consider the network entity's attributes, ignoring structural information. 3) When detecting network device fingerprints, individual network entities are vulnerable to attacks, and their selected features are easily deceived, significantly reducing the accuracy of target network entity identification. 4) With the emergence of IPv6 technology, scanning the entire cyberspace becomes impractical, as does enumerating IPv6 network entities.

[0011] Recently, graph neural networks (GNNs) have rapidly developed in various research areas, as the topological features of network entities are well-suited to the architectural representation of GNNs. Graphs provide a general data representation method, and many other types of data can also be transformed into graph representations. Compared to traditional machine learning and deep learning models, GNNs have the advantage of expressing high-dimensional nonlinear features (i.e., network topology) and high-dimensional relational features (i.e., network attributes). Early graph structures mainly used spectral methods to transform signals on the graph to the spectral domain, implemented the definition of graph convolution in the spectral domain, and then transformed the result to the spatial domain. ChebyNet is a graph convolutional neural network based on spectral methods. Later, many convolutional methods were developed, including GCN (Graph Convolutional Networks), GraphSAGE (Graph Sample and Aggregate), and GAT (Graph Attention Networks). The main difference between these three methods lies in the method of aggregating neighbor nodes: GCN aggregates all surrounding neighbor nodes, GraphSAGE randomly aggregates a fixed number of neighbor nodes, and GAT aggregates neighbor nodes with higher weights relative to the central node. GNNs have been widely used in various computer network models.

[0012] The core of graph convolutional networks is aggregation, updating, and recurrence. For homologous tasks, the features of a node and its surrounding neighbors are quite similar. However, for heterologous tasks, the surrounding neighbors are no longer the most suitable points for aggregation operations. It is necessary to try to obtain long-distance dependency information. Hu.Z et al. proposed a method combining GNN and Transformer, which considers obtaining long-distance dependencies by calculating the similarity of nodes. However, this method discards the structural information of the graph. In fact, the network entities themselves have certain network structural characteristics that can be extracted.

[0013] The aforementioned network entity recognition technologies are susceptible to limitations (such as difficulty in building feature databases, feature loss, or deception), leading to decreased recognition rates or failure to recognize entities. Most traditional rule-based or data mining-based entity recognition methods identify individual network entities, but due to the presence of firewalls and the limitations of feature detection, features of individual targets are easily missing, resulting in decreased accuracy in network entity recognition. Summary of the Invention

[0014] To address the technical problem of reduced positioning accuracy due to missing network entity features, this invention proposes a network entity recognition method for IP positioning. This method embeds network entities into a graph structure and utilizes graph neural networks to improve the current problem of missing or spoofed features, thereby increasing the accuracy of current network entity recognition.

[0015] To achieve the above objectives, the technical solution of the present invention is implemented as follows: a network entity identification method for IP positioning, comprising the following steps:

[0016] Step 1, Data Processing: Extract the IPv6 addresses of network entities and obtain path information to obtain a dataset; perform feature extraction and anonymization on the dataset, filter to obtain attribute features, and embed the attribute features into the network topology graph;

[0017] Step 2, Subgraph Partitioning: The network topology graph is partitioned into communities using the community clustering method, resulting in several subgraphs;

[0018] Step 3: Attention Weight Calculation: Extract the structural information of nodes in the subgraph and calculate the structural similarity. Perform Transformer calculation on all nodes in the subgraph to calculate the comprehensive attention weight of the nodes.

[0019] Step 4, Node Update: Select nodes for aggregation and update based on the comprehensive weight attention among nodes, and output the updated node representation;

[0020] Step 5, Fully Connected Classification: Train the Transformer network, feed the updated node representations into the classification layer, and obtain the device category by predicting probabilities.

[0021] Preferably, the feature extraction involves: analyzing the acquired traffic data, analyzing each attribute feature, and selecting the top 20% of types belonging to each feature type as attribute features; the attribute features include: IP address --- IP, IPv6 suffix --- IP s IPv6 address embedding type---IP a Port, Network Layer Protocol, Transport Layer Protocol, Application Layer Protocol, TCP Window Size, TTL Value, Vulnerability Type, ICMPv6 Rate, Operating System

[0022] The GWS-Geo method is used to perform equivalent replacement processing on anonymous nodes to reduce the number of anonymous nodes in the network topology. For nodes that still cannot be anonymized, one-hot encoding is used to set all features of the anonymous node to "other", its feature vector is all 0, and the label is set to "other device".

[0023] Preferably, based on the path information and the path connection relationships, the path is decomposed into pairwise connections, and a network topology graph is constructed using the DGLGraph function; the network topology graph is a graph G = {V, X, E}, with nodes V = v1, v2, ..., v i The node's attribute characteristic X = IP, IP s IPa Port, NP, TP, AP, CVE, IR, OS, edge set e ij Representative node v i With node v j The edge between them, where en represents the size of the matrix; and the edge between node v i The set of adjacent neighbor nodes N(v) i )={u1,u2,...,u n u i &v i ∈V} includes its own nodes; the critical matrix A of graph G is [a ij ] is a symmetric matrix, if node v i With node v j There is a common edge between them, element a ij =1, otherwise element a ij =0.

[0024] Preferably, the community clustering method is the Leiden community partitioning algorithm; the Leiden community partitioning algorithm calculates the relationship between nodes and edges between communities, and during iterative application, it converges to a partition in which all subsets of all communities are locally optimally assigned, thereby generating communities that guarantee connectivity.

[0025] Select modularity To evaluate the quality of node grouping within the community, modularity for:

[0026]

[0027] Where mc represents the total number of edges, c represents the community, and e represents the number of edges. c D represents the number of edges within community c. c Let γ represent the degree of node c in community, and γ be the resolution parameter: the density within a community is at least the resolution parameter γ, while the density between communities is lower than the resolution parameter γ.

[0028] Preferably, the clustering steps of the community clustering method are as follows: 1) Local movement of nodes, each node is regarded as a separate community, and a single node is moved from one community to another to improve the quality function in order to discover the partitioning situation; 2) Improve the partitioning result, improve the nodes, merge the nodes with randomly selected communities, and increase the quality function; 3) Agglomerate the network based on the improved partitioning situation, and initialize the agglomerated network based on the unimproved partitioning situation; repeat the above steps until no further improvement is possible.

[0029] Preferably, the Transformer computation is implemented as follows: node feature vector X = x1, x2, ..., x... i ∈Rn ×d This represents the input to the hidden layer of the Transformer, where d is the dimension of the hidden layer, and x is the value of x. i ∈R 1×d Here is the hidden layer representation at position ix; the hidden layer representation is x. i Through three matrices and Project onto the corresponding vectors Q, TK, TV. The results after feature vector mapping are as follows:

[0030] Using a kernel function to approximate softmax, let the attention matrix... Replace with kernel function Here, φ represents the attention mechanism, which can be written as: The kernel function φ is a random feature map and:

[0031]

[0032] Among them, R x and -R x Concatenate them according to the last feature dimension, where x represents the node feature vector and m represents m random features;

[0033] The self-attention weights are:

[0034]

[0035] Where j and j' are nodes in the node set V.

[0036] Preferably, the method for calculating the comprehensive weighted attention of the computing nodes is as follows: each node defines a set of node neighborhoods GN(v i )=N(v i ), N(v i ) represents node v i Neighbor set, N(v) i X represents node v i The neighborhood is characterized by randomly selecting z neighboring nodes with replacement, and calculating node v using the Jaccard similarity coefficient. i ,v j The neighbor set GN(v) i ),GN(v j ), the feature vector is: NX(v i ) = S i1 ,S i2 ,…S iu ,NX(v j ) = S j1 ,S j2 ,…Sju ;

[0037] Among them, S i1 ,S i2 ,…S iu S j1 ,S j2 ,…S ju This represents the feature vector, where u represents the number of features selected.

[0038] The similarity NJ between the features of the neighbors of two nodes is calculated as follows:

[0039]

[0040] in, This is represented as the calculation of the similarity between a pair of neighboring nodes, where z is the neighboring node and NX is the feature vector;

[0041] By calculating self-attention weights, node proximity centrality, and the similarity of the node's surrounding neighbors, nodes with distant similarity are jointly found, denoted as NA, NC, and NJ respectively. The final comprehensive attention weight NW of the node is:

[0042]

[0043] Where w1, w2, and w3 represent the weight matrices, respectively.

[0044] Preferably, in step four, the top-k method is used to ensure more effective information aggregation and to ensure that the feature vector dimensions are the same. The comprehensive weight attention NW of each node with all other nodes is calculated, and the top K nodes with the largest relation values ​​are selected as the nodes to be aggregated. i The set to be aggregated is K(v) i )={k1,k2,…,k ik};

[0045] The aggregation update method is as follows: aggregation is directly performed using the GCN method; the GCN method uses SUM, Mean, and Max aggregation, f aggregate Denotes an aggregate function, and: A v =f aggregate (K(v));

[0046] Where K(v) represents the set of node neighbors after the top-k method, and A v This indicates that the neighbor characteristics of node v converge to node v;

[0047] During aggregation, the impact of all nodes on the central node has already been considered, and the updated node representation is H. v The formula is shown below:

[0048] H v=f update (A v =ReLU(VX) v +A v );

[0049] Among them, f upgate This represents the update function, which can be either SUM or concat. ReLU represents the activation function.

[0050] Preferably, in step five, the updated node representation information is transformed into network entity categories through a fully connected layer and a classification layer. A fully connected layer and a classification layer are used to calculate the predicted label probability. The fully connected layer reduces the dimensionality of the feature matrix of the node representation, and the classification layer uses the Softmax function to output the probability of the corresponding category. When the maximum value of the Softmax function is lower than the threshold α, it is classified as an unknown device; where W represents the learned weight matrix and bias represents the bias.

[0051] Preferably, the Transformer network is trained using standard cross-entropy as the loss function, employing the Adam optimizer, and trained via stochastic gradient descent, with the loss function...

[0052] Where L1 represents the loss function and C represents the classification label. Quantity, y ic Represents a symbolic function, if node v i The true category is equal to c, y ic Set to 1, otherwise set to 0; Represents node v i The probability of being predicted as category c.

[0053] The beneficial effects of this invention are mainly comprised of five steps: data processing, subgraph segmentation, weight calculation, node update, and classification. The data processing step extracts features and anonymizes the acquired dataset. The subgraph segmentation step constructs a network topology graph of the target nodes and segments them according to a community partitioning algorithm. The weight calculation step combines the self-attention mechanism of TransFormer with the structural features of the graph to enhance the features of network entities. The node update step aggregates and updates the nodes based on the weight calculation results, outputting the updated node representation matrix. The classification step classifies the nodes. This invention successfully identified eight different network entities on a publicly collected dataset, achieving an accuracy rate of over 95.49%. This invention effectively improves the identification of network entities in cases of missing network entity features and provides a new method for node aggregation in heterogeneous network topology graphs. This invention provides a new method for network entity identification, overcoming the limitation that network entities cannot be identified when features are missing or when they are deceived. This invention constructs a graph structure for network entity recognition tasks, incorporating graph structure information into the weight calculation of node aggregation. This effectively utilizes the structural characteristics of network entities within the Internet, increases learnable attribute information, and significantly improves the recognition rate. This invention achieves higher accuracy than existing network entity classification models in IPv6 network entity classification models, providing a novel method for node aggregation in heterogeneous network topology graphs. Attached Figure Description

[0054] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0055] Figure 1 A flowchart for existing fine-grained IP localization methods.

[0056] Figure 2 This is a schematic diagram of the process of the present invention.

[0057] Figure 3 This is a schematic diagram illustrating the extraction of feature attributes from experimental data to create word clouds for attribute embedding in this invention, where (a) represents the port, (b) represents the protocol, (c) represents the operating system, and (d) represents the vulnerability type.

[0058] Figure 4 These are schematic diagrams of entities in the same location in the network structure of this invention, whose device categories are also similar.

[0059] Figure 5This is a schematic diagram illustrating that the surrounding neighbors of two nodes in this invention have similar attributes, and the two nodes are also similar.

[0060] Figure 6 This is a cumulative distribution diagram of the experimental positioning error of this invention. Detailed Implementation

[0061] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0062] like Figure 2 As shown, a network entity recognition method for IP localization constructs a GraphNEI model through multi-feature fusion learning based on IPv6 address, IP suffix, IPv6 address embedding type, port, network layer protocol, transport layer protocol, and application layer protocol. The method mainly includes five steps: data processing, subgraph segmentation, weight calculation, node update, and classification. This invention attempts to solve the network entity recognition problem based on graph learning, incorporating the network topology and neighborhood connectivity (structural information) inherent in the network entity itself into the network entity recognition features. It assumes that network entities of the same category perform similar tasks in their respective networks; that is, if two network entities have similar graph structures and similar neighbors, then these two network entity categories are also similar. When considering aggregated graph nodes, the similarity of graph node features and the structural information of the graph are utilized together. Leveraging the aggregation characteristics of similar nodes, effective feature completion is achieved for network entities with missing features. This invention connects independent network entity feature data using network structure, providing a new perspective for improving the accuracy of network entity recognition.

[0063] This invention first constructs a network topology graph of a region, then divides a large graph into communities, and uses graph learning to pass features from distant nodes to achieve feature completion. Finally, the updated nodes are fed into a classification layer. The specific steps of this invention are as follows:

[0064] Step 1, Data Processing: Obtain the dataset, extract IPv6 addresses, use a probe to probe the IPv6 addresses and obtain path information; perform feature extraction and anonymization on the dataset, filter to obtain relevant attribute features, and embed the attribute features into the network topology graph.

[0065] The acquired Pcap data stream cannot be directly used as input data for the model; feature extraction and representation in an embeddable form are required. First, the acquired traffic data is analyzed. Data directly or indirectly obtained in the experiment includes IPv6 addresses, ports, protocols, services, components, clock offsets, vulnerability types, ICMPv6 rates, IPv6 address suffixes, IPv6 address embedding types, operating systems and versions, and hostnames. Analysis of each attribute characteristic reveals that: IPv4 addresses are relatively few and their allocation is random. Compared to the massive number of IPv6 addresses, administrators may assign addresses systematically for ease of management, such as using suffixes from ::0 to ::9; for routing allocation, home routers use EUI-64, and the MAC address of a network entity can be determined from the EUI-64 address, thus inferring the Wi-Fi module manufacturer to some extent; Wang et al. proposed that the type of network entity device can be quickly identified based on common open ports or port combinations; Yang et al. proposed that network layer, transport layer, and application layer protocol characteristics can be combined. This invention combines device fingerprinting to identify network entities. Although ports generally have compatible services and components, there are still services and components on unused ports, which still serve as effective identification features. Lanze et al. pointed out that there are distinguishable clock skew differences between any physical devices, and this clock skew is stable, so network entity classification can be achieved based on clock skew. Alvarez et al. determined the manufacturer of a network entity based on the different ICMPv6 device rates initialized by different manufacturers. Yu et al. proposed that network entity categories can be directly inferred based on the hostname keywords that DHCP and mDNS may contain. Ammar et al. pointed out that network entity classification is constrained by the type of operating system. Blinowski et al. pointed out that different network entity devices have different vulnerability types, and simple network entity classification can be achieved by analyzing the vulnerability types. This invention embeds IP address, IP suffix, port, service, protocol, vulnerability type, ICMPv6 rate, IPv6 address embedding type, and operating system into the framework. All these features are embedded into the attribute features of network entity nodes in the form of feature vectors using one-hot encoding. However, not all features can be embedded into the model, including traffic acquisition associated with clock skew and hostnames. Some features extracted in this invention are as follows: Figure 3 As shown, Figure 3This section presents the feature processing results for ports, protocols, and vulnerabilities. Feature extraction involved filtering features in the dataset and selecting the top 20% of each feature type. The feature processing method involved filtering for frequently occurring feature types in the dataset as the final node features. Specifically, 15 types were selected for ports, protocols, and vulnerabilities, and 14 types for the operating system. The feature vectors for ports, protocols, and vulnerabilities are each 16-dimensional (including other classes), while the feature vector for the operating system is 15-dimensional (including other classes). The anonymization method used is GWS-Geo.

[0066] For each feature, a 0 / 1 model is used to determine whether a classification exists. The final selected attribute feature X is: IP address --- IP, IP suffix --- IP. s IPv6 address embedding type---IP a Port, Network Layer Protocol (NP), Transport Layer Protocol (TP), Application Layer Protocol (AP), TCP Window Size (WS), TTL Value (TTL), Vulnerability Type (CVE), ICMPv6 Rate (IR), Operating System (OS), represented as X = IP, IP s IP a Port, NP, TP, AP, WS, TTL, CVE, IR, OS, each feature ultimately forms a one-dimensional vector.

[0067] Based on the collected dataset, a network topology graph is constructed. Multiple probes are used to probe the IP addresses in the dataset and obtain their topological path information to build a large-scale network topology. The graph is defined as G = {V, X, E}, with nodes V = v1, v2, ..., v... i The node's attribute characteristic X = IP, IP s IP a Port, NP, TP, AP, CVE, IR, OS, edge set e ij Representative node v i With node v j The edges between nodes v and y are defined by the matrix size 'en'. Since there are limited attribute information available as features in a network topology graph, edge attribute information is not considered. i The set of adjacent neighbor nodes N(v) i )={u1,u2,...,u n u i &v i ∈V} includes its own nodes. The critical matrix A = [a ij If node v i With node v j There is a common edge between them, that is, the two nodes exist in v.i and v j In the set of neighboring nodes, a ij =1, no connection a ij =0. Since the round-trip path of IP packets during traceroute probing is consistent, it can be regarded as an undirected edge, and the critical matrix is ​​a symmetric matrix. Due to the existence of anonymous routing in the probing, GWS-Geo (GWS-Geo: A graph neural network based model for street-level IPv6 geolocation) is used to replace anonymous nodes in an equivalent manner. This method minimizes the number of anonymous nodes in the network topology, thereby reducing the impact of anonymous nodes on the experimental accuracy. For nodes that still cannot be anonymized, this paper uses independent numbering, sets all features of the anonymous node to "other", its feature vector is all 0, and the label is set to "other device", so that anonymous nodes can participate in model training.

[0068] Step 2, Subgraph Partitioning: The network topology graph is partitioned into subgraphs using the community clustering method.

[0069] Based on the path information in step one, the paths are broken down into pairs based on their connection relationships. The network topology graph is constructed using the DGLGraph function, and communities are divided according to the Leiden community partitioning algorithm.

[0070] Processing a large graph directly involves enormous computational costs; community partitioning is necessary. This considers that each network entity resides in its own community G. c The tasks undertaken by Leiden's algorithm are similar: attempting to partition the current large graph into communities using a community-based approach. Compared to Louvain's community discovery algorithm, Leiden's algorithm adds a refinement step to ensure the connectivity of partitioned communities, which is crucial for maintaining the original network topology. Leiden's algorithm calculates the relationships between nodes and edges between communities, ensuring the validity of connections within communities and achieving community partitioning. When Leiden's algorithm is applied iteratively, it converges to a partition where all subsets of all communities are locally optimally assigned, thus producing communities that maintain connectivity. The modularity of Leiden's algorithm... The formula is shown below:

[0071]

[0072] Where mc represents the total number of edges, c represents the community, and e represents the number of edges. c D represents the number of edges within community c. cLet γ represent the degree of node c in community c, and γ be a resolution parameter that acts as a threshold: the density within a community should be at least γ, while the density between communities should be lower than γ. A higher resolution parameter will result in more communities, while a lower resolution parameter will result in fewer communities, and γ > 0. The network structure of community partitioning is unknown; this invention selects the module degree... This is used to evaluate the quality of node grouping within a community. The higher the modularity, the more tightly grouped the nodes are internally and loosely grouped externally, which better aligns with the principles of community division.

[0073] The clustering steps of the community clustering method mainly consist of three steps: 1) Local movement of nodes: Each node is treated as a separate community, and individual nodes are moved from one community to another to improve the quality function and discover partitions. 2) Improving the partition results: The nodes are improved. The improvement stage does not follow a greedy method; nodes are merged with randomly selected communities, thereby increasing the quality function. This randomness allows for a wider discovery of the partition space. 3) Agglomerating the network based on the improved partitions: The agglomerated network is initialized based on the unimproved partitions. The above steps are then repeated until no further improvement is possible. Community partitioning means clustering a large network topology. The result of the clustering is to separate it into several smaller network topologies. The Leiden algorithm is used to divide it into multiple communities, and the subgraphs are the results after community partitioning. The principle is that the structure of the internet topology is a clustered structure. For example, a real community or campus (hospital) has only a few exit firewalls (connecting to the external network). The network structure of the real community or campus (hospital) is a cluster and can be divided into a network community.

[0074] Step 3: Attention Weight Calculation: Extract the structural information of nodes in the subgraph and calculate the structural similarity. Perform Transformer calculation on all nodes in the subgraph to calculate the comprehensive attention weight of the nodes.

[0075] This paper combines the self-attention mechanism of the Transformer with the structural features of the graph to enhance the features of network entities. Although GNNs (Graph Neural Networks) have achieved good results in most scenarios, they have revealed shortcomings in network entity recognition. The network topology graph presented by network entities has heterogeneous relationships, and the relationship between the entity categories of the surrounding neighbors of a node and the node is weak. Moreover, the same network entities may not have direct connections. It is not possible to infer the device model of a node solely based on the attributes of its surrounding neighbors. Considering the influence of all nodes on the central node, this paper attempts to use an improved Transformer to calculate the weight information between any two points. The Transformer consists of a self-attention module and a position-wise feed-forward network. Let the node feature vector X = x1, x2, ..., xi ∈R n×d This represents the input to the Transformer Layer (hidden layer), where d is the dimension of the hidden layer, and x... i ∈R 1×d This is the hidden layer representation at position x. Input x i Through three matrices and Project onto the corresponding vectors Q, TK, TV. These are the results after feature vector mapping, and the above process is represented as follows:

[0076]

[0077] Where X contains the hidden layer representation x i .

[0078] The self-attention weights are represented as follows:

[0079]

[0080] Where V is a set of nodes, i, j, j' are the node numbers in the set V, and node v i Corresponding to node feature x i `exp` is a trainable kernel function defined on node features. Since calculating each pair of nodes is still quite complex, its time complexity is O(N). 2 Here, a linear self-attention mechanism is used to reduce complexity, and a kernel function is used to approximate Softmax, making the attention matrix... Replace with Here, φ represents the kernel function, and the attention mechanism is written as: Where the kernel function φ is a random feature map, the formula is shown below:

[0081]

[0082] Among them, R x ,-R x Concatenate them according to the last dimension (feature dimension), where x represents the node feature vector and m represents m random features.

[0083] Self-attention weights are transformed into:

[0084]

[0085] Let j and j' be initially set to 1.

[0086] Different network entities undertake different network tasks, and their positions within the network also differ, such as... Figure 4As shown, nodes 1 and 2 have similar proximity centrality, meaning they perform similar tasks in their respective networks and have similar network entity device types. Routing and switching devices and security devices are located close to the center of their respective networks, resulting in higher proximity centrality. Proximity centrality reflects the degree of proximity of a node to other nodes in a network. If the shortest distances from a node to other nodes in the graph are all small, then its proximity centrality is high. Compared to degree or betweenness centrality, proximity centrality is closer to the geometric center.

[0087] First, normalization is performed to calculate node v. i The average shortest distance to all other nodes is calculated using the following formula:

[0088]

[0089] Where nc represents the number of nodes, and the smaller the average shortest distance of a node, the greater its proximity centrality. If node v i With node v ji The edge e between ij If it does not exist, then define the distance d. ij It is infinite, and its reciprocal is 0.

[0090] The proximity centrality of a node is calculated using the following formula:

[0091]

[0092] Among them, NC i Represents node v i The proximity centrality of D i This represents node v. i The average distance to all other points, D ij Represents node v i to node v j The shortest distance, if node v i and node v j No path reachable, D ij Infinity. Approaching centrality NC i The larger the value of node v, the more i The greater the proximity to centrality.

[0093] This invention additionally considers the similarity of the features of a node's neighbors. Although in heterogeneous networks for identifying network entities, surrounding neighbors cannot be aggregated to the central node to achieve the enhancement of node features, the similarity of the attributes of the surrounding neighbor nodes of two nodes can, to some extent, constrain the network entity device category of the central node. Figure 5This diagram illustrates a similarity calculation method. In the diagram, A and A′ have similar neighboring attributes, and their network entity categories are similar. This invention defines a set of node neighborhoods GN(v) for each node. i )=N(v i ), N(v i )X,N(v i ) represents node v i Neighbor set, N(v) i X represents node v i The characteristics of the neighborhood, in actual calculation, are the neighbor set N(v i ) and N(v j The number of nodes is not the same. Here, z neighboring nodes are randomly selected with replacement. The number of neighbors of these nodes is not high. The Jaccard similarity coefficient is used to calculate the similarity between nodes v and z. i v j The neighbor set is GN(v) i ), GN(v j Its characteristics are as follows:

[0094] NX(v i ) = S i1 S i2 ,...S iu NX(v) j ) = S j1 S j2 ,...S ju (8)

[0095] Among them, S i1 S i2 ,...S iu S j1 S j2 ,...S ju Let represent the feature vector, and u represent the number of features selected.

[0096] Based on the above substructure, let NJ represent the similarity of features between the neighbors of two nodes, expressed by the formula:

[0097]

[0098] in, This represents the calculation of the similarity between a pair of neighboring nodes. z represents the neighboring node, and NX represents the feature.

[0099] Nodes with distant similarity are found by calculating self-attention weights, node proximity centrality, and the similarity of the node's surrounding neighbors, denoted as NA, NC, and NJ, respectively. The final node weights are given by the following formula:

[0100]

[0101] Here, w1, w2, and w3 represent weight matrices used for model training.

[0102] Since selecting all graph nodes results in a large computational cost for aggregation, and full aggregation can easily lead to differences in feature dimensions, this invention considers aggregating only a subset of nodes. The method ensures more effective information aggregation and guarantees that the feature vectors have the same dimension. Similar to the KNN algorithm, it calculates the weight NW of each node with all other nodes, and then selects the K nodes with the largest relation values ​​as the nodes to be aggregated. i The set to be aggregated is K(v) i )={k1,k2,...,k ik The overall attention between nodes is NW, which is the result of model training. The Top-K method is used to select the neighbors of some important nodes.

[0103] Step 4: Node Update: Based on the comprehensive weight attention among nodes, select the top K nodes for aggregation and update, and output the updated node representation.

[0104] To ensure generalization ability, after selecting K nodes, aggregation is directly performed using the GCN method, without considering the weights of the nodes and the nodes to be aggregated. It is assumed here that all K nodes are important to the central node. The GCN aggregation method uses SUM, Mean, and Max aggregation. aggregate The aggregate function is represented by the following formula:

[0105] A v =f aggregate (K(v)) (11)

[0106] Where K(v) represents the set of node neighbors after filtering by the Top-K method, and A v This indicates that the neighbor characteristics of node v converge to node v.

[0107] During aggregation, the impact of all nodes on the central node has already been considered, and the updated node representation is H. v The formula is shown below:

[0108] H v =f update (A v =ReLU(VX) v +A v (12)

[0109] Among them, f aggregate This represents the update function, which can be either SUM or CONCAT. Here, to achieve feature completion, the aggregated feature information of node K(v) is added to node v.i VX (inherent characteristics) v In this context, ReLU represents the activation function. The process of averaging the sum of matrices results in nodes containing more information than the original feature vector matrix.

[0110] Step 5, Fully Connected Classification: Train the Transformer network, feed the updated node representations into the classification layer, and obtain the device category by predicting probabilities.

[0111] This invention focuses on the semi-supervised node classification problem. It transforms updated node representations into network entity categories using fully connected layers and a classification layer. A fully connected layer and a classification layer are used to calculate predicted label probabilities. The fully connected layer reduces the dimensionality of the feature matrix, and the classification layer uses the Softmax function to output the corresponding classification probability. Considering that some anonymized data may not be effectively identified, when the maximum value of Softmax is below a threshold α (0.5 in the actual experiment), it is classified as an unknown device. The experiment uses standard cross-entropy as the loss function and the Adam optimizer, training the GraphNEI model through stochastic gradient descent.

[0112]

[0113] Where L represents the loss function and C represents the classification label. Quantity, y ic The sign function (0 or 1) is represented if node v i The true category is equal to c, y ic Set the value to 1, otherwise set it to 0. Represents node v i The probability of being predicted as category c.

[0114] The optimized algorithm is shown below:

[0115] Input: Nodes v after graph convolution i Characteristic matrix H v

[0116] Output: Device Category DT

[0117] for a batch ∈ training set; / / Take a batch of data from the training set for training.

[0118] This represents the weight matrix, used for model training, and bias represents the deviation.

[0119] The maximum value;

[0120] IF CH is less than or equal to αthen

[0121] DT=8; / / meaning unknown device.

[0122] ELSE IF CH maximum value is less than or equal to αthen

[0123]

[0124]

[0125] EndIF;

[0126] EndFOR;

[0127] Return DT;

[0128] Where W is a learned weight matrix, bias is the bias coefficient, initially constant, and then changes with the model. DT represents the device category, and CH represents the label. The value of , This means converting the largest value in the matrix to 1 and all other values ​​to 0. The output of the model training is the probability value of the node belonging to each node, which is a 0-1 value presented as a one-dimensional vector. The Argmax function is used to set the largest probability value in the one-dimensional vector to 1 and the others to 0. This represents a rule-based function that converts a vector into a device number.

[0129] Network entities are mainly divided into eight categories, including application layer server devices, network storage devices, cloud service devices, security protection devices, router and switching devices, human-computer interaction devices, Internet of Things devices, and other devices. The tags are represented by One-Hot codes 0 or 1. The specific types of devices included are shown in Table 1 below:

[0130] Table 1 Equipment Types

[0131]

[0132] Table 2 shows the performance comparison of different algorithms on datasets from three regions (in 3% of the dataset, some feature information of some nodes was deleted or modified). Table 2 compares the performance of the model of this invention with various algorithms in network entity recognition, with the best results highlighted in bold. It can be seen that the GraphNEI model proposed in this invention achieves optimal performance on all evaluation metrics.

[0133] Table 2 Performance Comparison

[0134]

[0135] Traditional positioning methods currently have a mainstream positioning granularity at the street level, but finer-grained positioning is difficult due to limitations in the number and accuracy of landmarks. Therefore, this paper proposes a method for fine-grained positioning and stable landmark capture by judging network entity types. Two discrimination rules are proposed: (1) Determine whether the network entity type belongs to the computer room, including (servers, local storage, and security equipment, etc.), and then obtain high-precision latitude and longitude information of relevant departments of the network center belonging to the public infrastructure through public dataset information. Finally, establish a mapping relationship between high-precision latitude and longitude information and network entity IP; (2) Determine whether the network entity type is IoT device information and treat the captured nodes as stable nodes. This invention focuses on analyzing the content of fine-grained IP positioning.

[0136] Since no detailed campus-level IP location algorithm has been proposed yet, experiments cannot be directly conducted based on campus-level location. Therefore, coarse-grained locations of network entities were first obtained. Based on public datasets, the locations of all IDC (Internet Data Center) server rooms within a 5-kilometer radius of the entity were identified, and the closest location was selected to replace the coarse-grained location result. The network environment used for the experimental network entities in this invention is IPv6. Therefore, two algorithms with better location accuracy in IPv6 network environments were selected: SubvectorS_Geo (SubvectorS_Geo: A Neural-Network-Based IPv6 Geolocation Algorithm) and GWS-Geo (GWS-Geo: A graph neural network based model for street-level IPv6 geolocation).

[0137] Based on the preceding model, device categories were obtained. Building upon coarse-grained localization, fine-grained localization experiments were conducted. Following the established rule-based method, the model achieved good results. Using an IP location database, the Shanghai dataset obtained in this invention was labeled with the device's location. This Shanghai dataset was collected with user consent. Experimental parameters were set to the highest performance level as described in the original paper. The model performance metric remained error kilometers. The algorithms using the rules of this invention were named: Rule-Based Function-SubvectorS_Geo and GraphNEI-GWS-Geo, respectively. The cumulative distribution of experimental localization errors is shown below. Figure 6 As shown.

[0138] Experimental analysis shows that, compared to SubvectorS_Geo and GWS-Geo, GraphNEI-SubvectorS_Geo and GraphNEI-GWS-Geo both exhibit a certain reduction in average algorithm error kilometers. Based on... Figure 6Within the 0-5km range, GraphNEI-SubvectorS_Geo and TCEI-GWS-Geo have a higher error ratio than SubvectorS_Geo and GWS-Geo algorithms. This is because this range is close to a community, and using network entity categories for assistance helps achieve higher accuracy in localization. The error difference is not as significant in the 5-40km range, which aligns with the assumption that network entity category-assisted localization is only effective at the community level; beyond this limit, the location cannot be accurately constrained. Furthermore, GraphNEI-GWS-Geo has a smaller error range than GraphNEI-SubvectorS_Geo because of its higher proportion within the 0-5km range. Based on this, network entity type-assisted localization is more effective, demonstrating that the higher the proportion of the initial localization algorithm within the 0-5km range, the greater the error reduction achieved by this invention. The algorithm of this invention achieves optimal performance when the experimental area of ​​the initial localization algorithm is at the park level.

[0139] This invention is a graph-based network entity recognition method. By selecting a set of potential, broad features, including IPv6 addresses, IID types, and ports, and processing the data to obtain fused feature data, it effectively compensates for situations where network entity information is missing or spoofed. Based on the structural characteristics of graphs, it attempts to obtain nodes with similar features and structures from distant nodes, and achieves feature completion and stabilization through graph neural networks. In three real datasets with missing or modified data, this invention outperforms current network entity recognition methods, fully verifying its superiority. This also fully demonstrates that large-scale network entity recognition models based on graph structure learning are superior to current rule-based and independent node-based learning methods. The model of this invention has been deployed at Yuanjiang Shengbang Company, providing network entity recognition tasks. Based on this network entity device recognition, research has been conducted on IP positioning for campus access-level positioning tasks, proving the effectiveness of high-precision positioning based on network entity categories. If the positioning granularity of the experimental algorithm is at the campus level, theoretically, access-level positioning can be effectively achieved.

[0140] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for network entity identification for IP location, the method comprising: The steps are as follows: Step 1, Data Processing: Extract the IPv6 addresses of network entities and obtain path information to obtain a dataset; perform feature extraction and anonymization on the dataset, filter to obtain attribute features, and embed the attribute features into the network topology graph; Step 2, Subgraph Partitioning: The network topology graph is partitioned into communities using the community clustering method, resulting in several subgraphs; Step 3: Attention Weight Calculation: Extract the structural information of nodes in the subgraph and calculate the structural similarity. Perform Transformer calculation on all nodes in the subgraph to calculate the comprehensive attention weight of the nodes. Step 4, Node Update: Select nodes for aggregation and update based on the comprehensive weight attention among nodes, and output the updated node representation; Step 5, Fully Connected Classification: Train the Transformer network, feed the updated node representations into the classification layer, and obtain the device category by predicting probabilities.

2. The method of network entity identification for IP location according to claim 1, wherein, The feature extraction process involves analyzing the acquired traffic data, analyzing each attribute feature, filtering for feature types that appear multiple times in the dataset, and selecting the top 20% of each feature type as attribute features. These attribute features include: IP address (IP address), IPv6 suffix, etc. IPv6 address embedding type--- ,port--- Network layer protocols Transport layer protocols Application layer protocols TCP window size--- TTL value--- Vulnerability Type--- ICMPv6 rate--- ,operating system--- ; The GWS-Geo method is used to perform equivalent replacement processing on anonymous nodes to reduce the number of anonymous nodes in the network topology. For nodes that still cannot be replaced, one-hot encoding is used to set all features of the anonymous node to "other", its feature vector is all 0, and the label is set to "other device".

3. The network entity identification method for IP positioning according to claim 2, characterized in that, Based on the path information and the path connection relationship, the path is broken down into pairs of connections, and the network topology graph is constructed using the DGLGraph function; The network topology diagram is shown in Figure 1. ,node Node attributes edge set , Representative node With nodes The edge between, Indicates the size of the matrix; and the nodes The set of adjacent neighbor nodes Including its own nodes; graph Critical matrix If node With nodes There are shared edges between them, elements Otherwise element .

4. The network entity identification method for IP positioning according to any one of claims 1-3, characterized in that, The community clustering method is the Leiden community partitioning algorithm. The Leiden community partitioning algorithm calculates the relationship between nodes and edges between communities. During iterative application, it converges to a partition in which all subsets of all communities are locally optimally assigned, thereby generating communities that guarantee connectivity. Modularity to evaluate the quality of node grouping within a community, modularity is: ； Where mc represents the total number of edges, and c represents the community. This represents the number of edges within community c. The sum of the degrees of node c in the community. It is a resolution parameter: the density value within the community is at least the resolution parameter. The density values ​​between communities are lower than the resolution parameter. .

5. The network entity identification method for IP positioning according to claim 4, characterized in that, The clustering steps of the community clustering method are as follows: 1) Local movement of nodes: each node is regarded as a separate community. Moving a single node from one community to another improves the quality function to discover partitioning situations; 2) Improving the partitioning results: the nodes are improved by merging them with randomly selected communities to increase the quality function; 3) Agglomerating the network based on the improved partitioning situation: the agglomerated network is initialized based on the unimproved partitioning situation; repeat the above steps until no further improvement is possible.

6. The network entity identification method for IP positioning according to claim 3 or 5, characterized in that, The implementation method of the Transformer computation is as follows: node features This represents the input to the hidden layer of the Transformer, where d is the dimension of the hidden layer. Let be the hidden layer representation at position i; hidden layer representation Through three matrices , and Project onto the corresponding vectors Q, TK, TV. , , The results after feature vector mapping are as follows: ; Using a kernel function to approximate softmax, let the attention matrix... Replace with kernel function The attention mechanism is written as: Kernel function For random feature mapping and: ； in, and Concatenate them according to the last feature dimension, where x represents the node feature vector and m represents m random features; The self-attention weights are: NA= ; Where j and j' are nodes in the node set V.

7. The network entity identification method for IP positioning according to claim 6, characterized in that, The method for calculating the integrated weighted attention of the nodes is as follows: each node defines a set of node neighborhoods. , Represents a node Neighbors gather, Represents a node The neighborhood is characterized by randomly selecting z neighboring nodes with replacement, and using the Jaccard similarity coefficient to calculate the node similarity. The feature vector is: ; , u denotes the number of feature selections; The similarity NJ between the features of the neighbors of two nodes is calculated as follows: ； wherein, is computed as a pair-wise node neighbor similarity, z is a neighbor node, NXis a feature vector; By calculating self-attention weights, node proximity centrality, and the similarity of the node's surrounding neighbors, nodes with distant similarity are jointly found, denoted as NA, NC, and NJ respectively. The final comprehensive attention weight NW of the node is: ； wherein , , respectively represent weight matrices.

8. The method of network entity identification for IP location according to claim 7, wherein, The TOP-K method is adopted in the fourth step to ensure that the aggregation is more effective information and the dimensions of the feature vectors are the same, the comprehensive weight attention NW of each node and all other nodes is calculated, the first K nodes with the maximum comprehensive weight attention NW are selected as the nodes to be aggregated, and the node The set to be aggregated is ; The method for aggregating the updated is: directly using the GCN method to aggregate; the GCN method uses SUM, Mean and Max aggregation, denotes an aggregation function, and: ; in, This represents the set of node neighbors after filtering using the top-k method. This indicates that the neighbor characteristics of node v converge to node v; The impact of all nodes on the central node has already been considered during aggregation, and the updated node representation... The formula is shown below: ； in, This indicates the update function, which can be either SUM or CONCAT. This represents the activation function. This represents the inherent characteristics of node v.

9. The network entity identification method for IP positioning according to claim 1, 7, or 8, characterized in that, In step five, the updated node representation information is transformed into network entity categories through a fully connected layer and a classification layer. A fully connected layer and a classification layer are used to calculate the predicted label probability. The fully connected layer reduces the dimensionality of the feature matrix of the node representation, and the classification layer uses the Softmax function to output the probability of the corresponding category. When the probability The maximum value is lower than the threshold. At that time, it is classified as an unknown device; where W represents the learned weight matrix. Indicates deviation, This is the updated node representation.

10. The network entity identification method for IP positioning according to claim 9, characterized in that, The Transformer network is trained using standard cross-entropy as the loss function, using the Adam optimizer, trained by stochastic gradient descent, and the loss function ; Where L1 represents the loss function and C represents the classification label. Quantity, Represents a symbolic function, if the node The true category is equal to c. Set to 1, otherwise set to 0; Represents a node The probability of being predicted as category c.

Images