Iot device identification method and system based on multi-scale attention capsule network

Abstract

The present application relates to the technical field of Internet of Things security, in particular to an Internet of Things device identification method and system based on a multi-scale attention capsule network, original traffic data of a target Internet of Things device to be identified is collected, and the original traffic data is normalized and preprocessed to obtain normalized and preprocessed traffic data; the normalized and preprocessed traffic data is input into a pre-trained capsule network device identification model, and the pre-trained capsule network device identification model is used to identify the type of the target Internet of Things device; wherein the capsule network device identification model comprises a feature extraction layer for extracting multi-scale features of input data in a fine-grained manner, a feature fusion layer for fusing the extracted multi-scale features, and a capsule layer for classifying and outputting the fused features. The present application does not require prior knowledge, avoids the complexity of manual feature extraction, can extract traffic features of Internet of Things devices in a fine-grained manner, has strong feature representation capability, and improves the identification accuracy and efficiency.

Description

Technical Field

[0001] This invention relates to the field of Internet of Things (IoT) security technology, and in particular to an IoT device identification method and system based on multi-scale attention capsule networks. Background Technology

[0002] With the continuous popularization and development of IoT technology, more and more devices are being connected to networks, including sensors, wireless modules, and smart home devices. It is estimated that by 2025, nearly 64 billion IoT devices will be connected to various scenarios, such as smart cities, Industry 4.0, or crowd sensing. With such a massive number of interconnected IoT devices, their security management faces significant challenges. These devices are often highly accessible, lack built-in security, and are vulnerable to attacks, potentially leading to network disruption. Therefore, effective device management, including timely understanding of connected devices, is a crucial prerequisite for network administrators to monitor network status and defend against attacks. To achieve this goal, IoT device identification technology has gradually become a research hotspot and has attracted widespread attention. By automatically and accurately identifying device manufacturers, types, and models, and gaining a comprehensive understanding of the network architecture and key nodes, IoT device identification technology can help network administrators better configure and manage devices, avoid security risks such as unauthorized device access, and effectively ensure the security and integrity of the overall network.

[0003] The most direct method for identifying existing IoT devices is rule-based matching. This involves parsing identifiable fields from collected device data and identifying devices based on a matching rule database. Examples include unique organization identifiers in MAC addresses, manufacturer information in TLS certificates, and user agents in HTTP requests. However, rule-based matching methods have poor anti-interference capabilities and significant limitations. If key fields, banner content, or other metadata are missing or hidden, the identification capability will be significantly reduced. Furthermore, this method is ineffective for data that cannot be parsed, such as encrypted data. Device fingerprinting is more prevalent, constructing device fingerprints by extracting static attributes or behavioral features, such as device identifiers and network traffic characteristics, and then using machine learning or deep learning methods for training and identification. The features for constructing device fingerprints are manually extracted, and their performance depends heavily on the quality of feature extraction. This method is highly dependent on expert experience and cannot bypass significant manual and time investment. Moreover, the constructed device fingerprints often only work well for specific devices and lack general applicability. To automate device identification, deep learning methods are increasingly being used. Converting device traffic data into grayscale images and then using convolutional neural networks to automatically learn device features and classify them effectively improves the efficiency of device identification. However, the traffic characteristics of devices are highly sequential. Convolutional neural networks only focus on local features and ignore the spatial relationship between traffic characteristics of IoT devices, which makes it impossible to fully extract these features. Secondly, the pooling operation and the increase of network depth in convolutional neural networks will reduce the spatial resolution of feature maps, causing the loss of key information of device traffic and affecting the classification accuracy. This results in the inability to fully extract and use device traffic features, affecting the final device identification result. Summary of the Invention

[0004] To address this issue, the present invention provides an IoT device identification method and system based on multi-scale attention capsule networks, which solves the problem that existing deep learning methods suffer from insufficient feature extraction and loss of key information when identifying IoT devices, thus affecting the accuracy of device classification and identification.

[0005] According to the design scheme provided by this invention, an IoT device identification method based on multi-scale attention capsule networks is provided, comprising:

[0006] Collect raw traffic data of the target IoT device to be identified, and obtain preprocessed normalized traffic data by normalizing the raw traffic data.

[0007] Normalized traffic data is input into a pre-trained capsule network device identification model, which is then used to identify the type of target IoT device.

[0008] The capsule network device identification model includes a feature extraction layer for fine-grained extraction of multi-scale features from input data, a feature fusion layer for fusing the extracted multi-scale features, and a capsule layer for classifying the fused features.

[0009] As part of the IoT device identification method based on multi-scale attention capsule networks of this invention, the method further includes preprocessing the original traffic data to obtain preprocessed normalized traffic data, comprising:

[0010] First, the raw traffic data is split into multiple sessions, each containing a bidirectional communication stream;

[0011] Next, the identification information in the session stream data that is unrelated to the device itself but is a unique identifier of the device is anonymized. The identification information includes the IP address and MAC address.

[0012] Then, the anonymized session stream data is truncated or padded to make each session stream data reach a preset length, and the binary bit stream of each byte in the session stream data is read, and each byte is matched with a pixel in sequence to convert the session stream data into a grayscale image.

[0013] As an IoT device identification method based on multi-scale attention capsule network of the present invention, when the feature extraction layer extracts multi-scale features of input data in a fine-grained manner, firstly, the shape of the input data feature map is adjusted by using the first convolutional kernel, and then, the receptive field of the convolutional layer is increased by using the Res2Net residual network to extract multi-scale features in a fine-grained manner. Furthermore, the feature weights of space and channel in feature extraction are updated by a lightweight attention mechanism in the spatial and channel dimensions to highlight the key features of the input data.

[0014] As an IoT device identification method based on multi-scale attention capsule network of the present invention, the receptive field of the convolutional layer is further increased by using Res2Net residual network to extract multi-scale features in a fine-grained manner. The Res2Net residual network includes a second convolutional kernel, multiple parallel residual block branches and a third convolutional kernel. The second convolutional kernel is used to divide the shaped feature map into several groups, each group corresponding to a residual block branch. Each branch layer nests the residual block sequence output of the previous branch. The third convolutional kernel is used to perform multi-scale fusion of the branch outputs spliced ​​in the channel dimension.

[0015] As an IoT device identification method based on multi-scale attention capsule networks, this invention further updates the feature weights of space and channels in feature extraction using a lightweight attention mechanism in the spatial and channel dimensions. This includes: assigning weights to different channels using channel attention and assigning weights to different spatial locations using spatial attention. Specifically, channel attention uses average pooling and max pooling to compress features in the spatial dimension, respectively. The two attention prototypes obtained by average pooling and max pooling are then fed into a shared network. The outputs of the shared network are summed and passed through an activation function to obtain the channel assignment weights. Spatial attention uses average pooling and max pooling to aggregate channel information to obtain feature maps for two channels. The feature maps are then convolved using a fourth convolution kernel and activated using an activation function to obtain the spatial location assignment weights.

[0016] As an IoT device identification method based on multi-scale attention capsule network of the present invention, further, the feature fusion layer is used to perform feature fusion on the extracted multi-scale features, including: using the fifth convolution kernel to perform channel matching on the extracted multi-scale features, and adding and fusing the channel-matched features to obtain fused features.

[0017] As an IoT device identification method based on multi-scale attention capsule networks of the present invention, further, in the classification output of fused features using capsule layers, the capsule layer includes: an initial capsule for converting fused features into capsule vectors, and a routing capsule for fully connecting the initial capsule output and the digital capsule output and aggregating capsules with similar feature attributes to output classification.

[0018] As an IoT device identification method based on multi-scale attention capsule networks of the present invention, further, the fused features are classified and output using capsule layers, which includes: achieving this through an iterative process of dynamic routing algorithm, specifically: using the weight matrix and the output vector of the current low-level capsule to obtain the prediction vector of the next high-level capsule, weighting and summing the prediction vectors of the next high-level capsule as the input of the next high-level capsule, compressing and standardizing the input through a nonlinear squeezing function to obtain the output of the next high-level capsule, iterating to output capsule information that meets the preset iteration termination condition, and obtaining the target IoT device type based on the output capsule information.

[0019] As an IoT device identification method based on multi-scale attention capsule networks of this invention, the input is further compressed and standardized by a nonlinear squeezing function to obtain the output of the next higher-level capsule, wherein the nonlinear squeezing function is expressed as: s j For the input of the high-level capsule j, and u j|ic is the prediction vector of the next higher-level capsule j obtained based on the previous lower-level capsule i. ij Let represent the coupling parameter between sj and uj|i, and b ij This represents the log-prior probability that couples the lower-level capsule i and the higher-level capsule j.

[0020] Furthermore, the present invention also provides an IoT device identification system based on multi-scale attention capsule networks, comprising: a data processing module and a device identification module, wherein,

[0021] The data processing module is used to collect raw traffic data of the target IoT device to be identified, and to obtain preprocessed normalized traffic data by performing normalization preprocessing on the raw traffic data.

[0022] The device identification module is used to input normalized traffic data into a pre-trained capsule network device identification model, and use the pre-trained capsule network device identification model to identify the type of target IoT device. The capsule network device identification model includes a feature extraction layer for fine-grained extraction of multi-scale features from the input data, a feature fusion layer for feature fusion of the extracted multi-scale features, and a capsule layer for classification output of the fused features.

[0023] The beneficial effects of this invention are:

[0024] This invention integrates feature extraction and classification models, utilizing multi-scale attention capsule networks to automatically extract and select features, directly processing IoT device traffic. It enables end-to-end device identification in the IoT, eliminating the need for prior knowledge and avoiding the complexity of manual feature extraction. It allows for fine-grained extraction of IoT device traffic features, possessing strong feature representation capabilities and improving device identification accuracy. Furthermore, experimental data validates that this solution is particularly effective in classifying similar devices and is applicable to identifying IoT device models, suppliers, and other types. Attached image description:

[0025] Figure 1 This is a schematic diagram illustrating the IoT device identification principle based on multi-scale attention capsule networks in the embodiment;

[0026] Figure 2 This is a schematic diagram illustrating the feature extraction principle in the example.

[0027] Figure 3 This is a schematic diagram illustrating the principle of updating feature weights in the spatial and channel dimensions using the lightweight attention mechanism in this embodiment.

[0028] Figure 4 This is a schematic diagram illustrating the principle of channel attention updating channel weights in the embodiment;

[0029] Figure 5 This is a schematic diagram illustrating the principle of spatial attention updating spatial position weights in the embodiment;

[0030] Figure 6 This is a schematic diagram illustrating the feature fusion principle in the embodiment;

[0031] Figure 7 This is a schematic diagram of the traffic visualization results of IoT devices in the embodiment;

[0032] Figure 8 This is a schematic diagram illustrating the accuracy of IoT device identification in the example.

[0033] Figure 9 This is a schematic diagram of a confusion matrix used in an embodiment to analyze the causes of identification errors in IoT devices. Detailed implementation method:

[0034] To make the objectives, technical solutions, and advantages of this invention clearer and more understandable, the invention will be further described in detail below with reference to the accompanying drawings and technical solutions.

[0035] Capsule Network (CapsNet) aims to address the shortcomings of traditional Convolutional Neural Networks (CNNs) in processing image data, such as insufficient high-order feature representation and lack of robustness to transformations. CapsNet uses capsules to represent features and a dynamic routing mechanism to pass information between capsules. The output of each capsule is a vector, where the length represents the probability of the feature's presence, and the direction represents the feature's attribute. This invention provides an IoT device identification method based on a multi-scale attention capsule network. It integrates feature engineering and capsule networks to directly process IoT device traffic and automatically extract and select features, achieving end-to-end IoT device access identification. The specific process includes:

[0036] S101. Collect the raw traffic data of the target IoT device to be identified, and obtain the preprocessed normalized traffic data by performing normalization preprocessing on the raw traffic data.

[0037] S102. Input the normalized traffic data into the pre-trained capsule network device identification model, and use the pre-trained capsule network device identification model to identify the target IoT device type.

[0038] The capsule network device identification model is designed to include a feature extraction layer for fine-grained extraction of multi-scale features from the input data, a feature fusion layer for fusing the extracted multi-scale features, and a capsule layer for classifying the fused features. See also... Figure 1As shown, for IoT device traffic collected from the gateway, it is first converted into a grayscale image through data normalization preprocessing. Then, the feature extraction layer extracts device traffic features comprehensively and in fine granularity, and fuses the features from multiple stages. Finally, the capsule layer can decompress and reconstruct layer by layer through the routing mechanism to extract deeper features, so as to achieve efficient and accurate classification and identification of IoT access devices.

[0039] As a preferred embodiment, further, by performing normalization preprocessing on the original traffic data, the preprocessed normalized traffic data can be designed to include the following:

[0040] First, the raw traffic data is split into multiple sessions, each containing a bidirectional communication stream;

[0041] Next, the identification information in the session stream data that is unrelated to the device itself but is a unique identifier of the device is anonymized. The identification information includes the IP address and MAC address.

[0042] Then, the anonymized session stream data is truncated or padded to make each session stream data reach a preset length, and the binary bit stream of each byte in the session stream data is read, and each byte is matched with a pixel in sequence to convert the session stream data into a grayscale image.

[0043] To better utilize IoT device traffic data, it is standardized into a neural network input format. The normalization preprocessing converts the raw traffic data in PCAP format into a grayscale image through operations such as session segmentation, anonymization, and grayscale conversion.

[0044] This involves segmenting raw device traffic into multiple sessions. A stream refers to a data packet with the same source IP, destination IP, source port number, destination port number, and transport protocol. Each segmented session contains bidirectional streams, allowing for a wider range of communication patterns and behaviors from IoT devices compared to unidirectional streams.

[0045] While IP addresses and MAC addresses in traffic data are unrelated to the devices themselves, they often uniquely identify devices and may reveal device category labels, potentially leading to overfitting in deep learning models during training. Therefore, these two items cannot be used as features and need to be anonymized. Specifically, in implementation, hexadecimal 0x00 can be used to replace relevant information; MAC addresses are replaced with 0:00:00:00:00:00:00, and IP addresses are replaced with 0.0.0.0.

[0046] To meet the input requirements of the neural network, the first 784 bytes of data for each session can be extracted. If the total length is less than 784 bytes, it is padded with 0x00 to reach the set length. Extracting the first 784 bytes of the session can reduce the training scale while containing as much network traffic feature information as possible without affecting classification accuracy.

[0047] In grayscale processing, the binary bitstream of each byte of the session is read and converted into a hexadecimal string in sequence. 0x00 corresponds to all black and 0xff corresponds to all white. Each byte corresponds to one pixel. The result is a 28×28 two-dimensional grayscale image, which is then stored in PNG format.

[0048] The richness of feature extraction directly affects the performance of model classification. However, the initial capsule network only used two convolutional layers to extract low-level features from the input image, impacting prediction performance. CBAM (Convolutional Block Attention Module) is a lightweight attention module that can perform attention operations in both spatial and channel dimensions. In this embodiment, when the feature extraction layer extracts multi-scale features from the input data in a fine-grained manner, specifically, firstly, the shape of the input data feature map is adjusted using the first convolutional kernel. Then, a Res2Net residual network is used to increase the receptive field of the convolutional layers during feature extraction to extract multi-scale features in a fine-grained manner. Furthermore, a lightweight attention mechanism is used to update the spatial and channel feature weights in feature extraction to highlight key features of the input data.

[0049] See Figure 2 As shown, this embodiment improves the feature extraction part of the capsule network by using three sets of consecutive feature extraction units to increase the model's depth, thereby improving its feature representation ability and generalization performance. First, a 3x3 convolution changes the shape of the feature map. Then, a Res2Net residual network is used to increase the receptive field of the convolutional layers, extracting multi-scale features with finer granularity. The CBAM module is integrated to update the spatial and channel feature weights, highlighting useful features and enabling the extraction of richer feature information. Following the construction method of mainstream attention models, the CBAM module is added before the residual connections of the Res2Net residual network module and after the 1×1 convolution, thus implementing feature weighting within Res2Net to highlight key information.

[0050] Specifically, the Res2Net residual network can be designed to include a second convolutional kernel, multiple parallel residual block branches, and a third convolutional kernel. The second convolutional kernel is used to divide the shaped feature map into several groups, each group corresponding to a residual block branch. Each branch layer nests the residual block sequence output of the previous branch, and the third convolutional kernel is used to perform multi-scale fusion of the branch outputs spliced ​​in the channel dimension.

[0051] Res2Net is a novel network architecture proposed based on the ResNet residual network. It improves the network's ability to extract multi-scale features with almost no change in computational cost. In this embodiment, the Res2Net residual network consists of multiple parallel branches, each containing several residual blocks. Within each branch, a hierarchically nested sequence of residual blocks gradually deepens feature representation and extracts multi-scale information, connecting them to form a network module with high-level, multi-scale feature representation capabilities. This design increases the dimensionality and resolution of the feature space while reducing the number of model parameters and computational overhead, further improving the model's performance and generalization ability.

[0052] Specifically, see Figure 2 As shown, the input feature map is divided into four groups after a 1×1 convolution: X1, X2, X3, and X4. The number of channels in each group is one-quarter of the number of channels in the input feature map. Except for X1, each group undergoes a 3×3 convolution. For X3 and X4, the feature maps are first added to the output of the previous group, and then the sum is convolved again. Finally, the outputs of these four groups are concatenated along the channel dimension, and multi-scale information is fused using a 1×1 convolution. Similar to the residual blocks in ResNet, Res2Net blocks use residual connections to connect the input to the output of the last convolutional layer. Through ensemble effects, Res2Net blocks can extract features from different receptive fields and at multiple scales, effectively extracting both global and local features.

[0053] Furthermore, in the lightweight attention mechanism of this embodiment, channel attention is used to assign weights to different channels, and spatial attention is used to assign weights to different spatial locations. Specifically, channel attention uses average pooling and max pooling to compress features in the spatial dimension, and the two attention prototypes obtained by average pooling and max pooling are fed into a shared network. The outputs of the shared network are summed and passed through an activation function to obtain the channel assignment weights. Spatial attention uses average pooling and max pooling to aggregate channel information to obtain feature maps of two channels. The feature maps are convolved through a fourth convolution kernel and activated by an activation function to obtain the spatial location assignment weights.

[0054] CBAM is an attention mechanism based on convolutional neural networks. Its core idea is to combine global statistical information and spatial location information to adaptively weight the channel and spatial features of an image, while suppressing noise and useless information, thereby improving the model's ability to extract and represent important information. Figure 3As shown, unlike SENet which only focuses on channel information, CBAM consists of channel attention and spatial attention, simultaneously considering both spatial and channel information. For the input feature map F∈R... C*H*W Where the channel is C, the height is H, the width is W, and the channel attention is M. c ∈R C×1×1 Different weights are assigned to the channels, while spatial attention M s ∈R 1×H×B Different weights are assigned to different spatial locations, using symbols. This represents element-wise multiplication. The calculation process of the CBAM module can be represented as:

[0055]

[0056]

[0057] like Figure 4 As shown, the channel attention module uses average pooling (AvgPool) and max pooling (MaxPool) to compress features in the spatial dimension. The resulting two attention prototypes are fed into the shared network MLP, and then the outputs are summed and passed through an activation function to obtain the attention weights for each channel. These weights are then multiplied into each channel to obtain the new feature map M. c (F). The calculation formula is as follows:

[0058] M c (F)=δ(MLP(AvgPool(F))+MLP(MaxPool(F))) (3)

[0059] In the formula, δ represents the activation function.

[0060] like Figure 5 As shown, the spatial attention module first uses average pooling and max pooling to aggregate channel information, then merges them to obtain a feature map with 2 channels. This is then processed by a 7×7 convolution kernel, and activated using the sigmoid function to obtain the spatial attention weights. Multiplying these weights back yields the updated spatial feature map M. s (F). The calculation formula is as follows:

[0061] M s (F)=δ(f 7×7 ([AvgPool(F);MaxPool(F)])) (4)

[0062] Where δ represents the activation function, f 7×7 This represents a convolution operation with a 7x7 kernel.

[0063] Furthermore, in the feature fusion of this embodiment, a fifth convolution kernel can be used to perform channel matching on the extracted multi-scale features, and the channel-matched features are added together to obtain fused features.

[0064] Increasing the depth of convolutions allows networks to learn more abstract and complex features, improving their expressive power. However, as depth increases, convolution operations reduce image resolution, leading to the loss of some detailed information and decreasing the model's granularity in device classification, especially for similar devices. Therefore, in this embodiment, a lateral output is performed after each feature extraction unit to fuse feature information from different stages. This enriches the feature information and compensates for information loss caused by multiple downsampling steps, helping the network learn and retain more detailed and local information.

[0065] like Figure 6 As shown, for the outputs M1, M2, and M3 of the three feature extraction units, channel matching is first performed using 1x1 convolutions, and then they are directly added together for fusion. This allows the network to consider feature information from multiple levels simultaneously, better capturing the characteristics of device traffic, improving model classification performance, and enhancing generalization ability. The fusion module process is shown below:

[0066] M fusion =Conv 1×1 (M1)+Conv 1×1 (M2)+Conv 1×1 (M3) (5)

[0067] Where M1, M2, and M3 represent the outputs of feature extraction units at different stages, M fusion Represents the merged output, Conv 1×1 This represents a 1×1 convolution operation.

[0068] In the classification output of fused features using capsule layers, the capsule layer may contain: an initial capsule for transforming the fused features into capsule vectors, and a routing capsule for fully connecting the output of the initial capsule and the output of the digital capsule and aggregating capsules with similar feature attributes to output a classification.

[0069] Specifically, this can be achieved through the iterative process of a dynamic routing algorithm. The process can be described as follows: use the weight matrix and the output vector of the current low-level capsule to obtain the prediction vector of the next high-level capsule; use the weighted sum of the prediction vectors of the next high-level capsule as the input of the next high-level capsule; use the input to compress and standardize it through a nonlinear squeezing function to obtain the output of the next high-level capsule; output the capsule information that meets the preset iteration termination condition through iteration; and obtain the target IoT device type based on the output capsule information.

[0070] The capsule layer consists of two parts: an initial capsule and digital capsules. The initial capsule uses convolution operations and the Squash function to transform the scalar features output from the convolutional layer into vector capsules. Then, a dynamic routing mechanism is used to fully connect the initial capsule to the digital capsule layer, thus obtaining the output of the entire network. In this layer, the number of routing iterations can be set to 3, and the final number of high-level capsules output is the number of device categories.

[0071] Dynamic routing algorithms are a key component of capsule networks, used to transfer information between capsule layers. Each layer in a capsule network combines and abstracts features through feature clustering, and dynamic routing represents the clustering process iteratively. The dynamic routing algorithm calculates weights based on the similarity between capsules, making capsules with similar features more tightly connected. The entire capsule operation process involves taking the input L-th layer capsule i and passing it through the dynamic routing algorithm to predict the output L+1-th layer capsule j. Assume the input features of the L-th layer are u1, u2, ..., u... n There are n capsules in total, and the feature vectors of the next layer are v1, v2, ..., v k That is, there are k capsules, which means that the n feature vectors of the previous layer are clustered into k cluster centers through a dynamic routing algorithm.

[0072] Let ui be the output of capsule i, and let uj|i be the prediction vector from capsule i to capsule j.

[0073] u j|i =w ij ·u i (6)

[0074] Among them, w ij It is a weight matrix that is learned through backpropagation.

[0075] Input s of capsule j j It is all predicted vectors u j|i The weighted sum, then

[0076]

[0077] Among them, c ij s j and u j|i The coupled system is constantly updated in a dynamic process, c ij The larger the value, the higher the similarity between the lower-level capsules and the higher-level capsules. The update process is as follows:

[0078]

[0079] b ij =b ij +u j | i ·v j(9)

[0080] Among them, b ij This represents the logarithmic prior probability of coupling between capsule i and capsule j, initially set to 0, and expressed through the prediction vector u of capsule i. j|i and the output vector v of capsule j j Update c using the inner product. ij .

[0081] For capsule j, input s j The output vector v is obtained by compression and standardization using a nonlinear compression function. j The expression for the squeeze function is as follows:

[0082]

[0083] The compression function preserves the direction of the vector while compressing its length to the range of 0 to 1, achieving compression and redistribution of the vector length. The magnitude of vj represents the probability of the corresponding class; the closer it is to 1, the higher the probability, and vice versa.

[0084] Capsule networks are trained and optimized using a marginal loss function, and the weight coefficients w in formula (6) are adjusted accordingly. i j is iteratively updated. The marginal loss function is calculated as follows:

[0085] L c =T c ·max(0,m+-||V c ||) 2 +λ(1-T c )·max(0,||V c ||-m-) 2 (11)

[0086] In the formula, T c Indicates whether class c exists, if T c =1 indicates existence, T c =0 indicates non-existence. m+ is usually 0.9, which penalizes false positives; m- is usually 0.1, which penalizes false negatives; λ is 0.5, which is a proportionality coefficient.

[0087] In this solution, a multi-scale attention capsule network combined with Res2Net blocks provides multi-scale feature extraction capabilities, while CBAM attention enhancement improves the extraction and representation of important information. This design gives the model better feature representation capabilities, enabling more comprehensive and complete extraction of IoT device traffic features. It can directly process IoT device traffic and automatically extract and select features without prior knowledge, avoiding the complexity of manual feature extraction and achieving end-to-end IoT device access identification. Fusing features from multiple stages enriches feature information and compensates for information loss caused by multiple downsampling, helping the network learn and retain more detailed and local information, resulting in better feature representation capabilities and classification performance.

[0088] Furthermore, based on the above method, this embodiment of the invention also provides an IoT device identification system based on a multi-scale attention capsule network, comprising: a data processing module and a device identification module, wherein,

[0089] The data processing module is used to collect raw traffic data of the target IoT device to be identified, and to obtain preprocessed normalized traffic data by performing normalization preprocessing on the raw traffic data.

[0090] The device identification module is used to input normalized traffic data into a pre-trained capsule network device identification model, and use the pre-trained capsule network device identification model to identify the type of target IoT device. The capsule network device identification model includes a feature extraction layer for fine-grained extraction of multi-scale features from the input data, a feature fusion layer for feature fusion of the extracted multi-scale features, and a capsule layer for classification output of the fused features.

[0091] To verify the effectiveness of this solution, the following explanation is based on experimental data:

[0092] Experiments were conducted on the Aalto public dataset. The dataset includes traffic generated during the startup setup of 27 different types of IoT devices, such as smart sockets and smart surveillance devices. The setup process for each device was repeated 20 times, generating a total of 64MB of data. Dataset information is shown in Table 1.

[0093] Table 1

[0094]

[0095]

[0096] like Figure 7 As shown, the visualization results of traffic from 27 devices are presented, demonstrating a certain degree of differentiation between the traffic from different devices. The grayscale images were divided into training and test sets in an 8:2 ratio.

[0097] Classification performance is measured by accuracy, precision, recall, and F1 score. The calculation formulas are as follows.

[0098]

[0099]

[0100]

[0101]

[0102] Where TP represents the number of positive samples predicted as positive; TN represents the number of negative samples predicted as negative; FP represents the number of negative samples predicted as positive; and FN represents the number of positive samples predicted as negative. In multi-label classification tasks, one class is typically chosen as the positive class, and the others as the negative classes. The F1-score is a comprehensive metric for measuring model accuracy. Furthermore, a confusion matrix is ​​used to specifically describe classification performance.

[0103] Comparative experiments were conducted using Convolutional Neural Networks (CNN), Res2Net50 Residual Networks (Res2Net50), BiLSTM, CNN+BiLSTM, CapsNet, and other deep learning models compared to the proposed solution. All compared deep learning models were configured with the same training parameters. The experimental results are shown in Table 2.

[0104] Table 2

[0105] Serial Number Model Accuracy Recall rate F1 value accuracy 1 CapsNet 0.8890 0.8889 0.8879 0.8889 2 CNN 0.9394 0.9288 0.9288 0.9288 3 CNN+CapsNet 0.9408 0.9417 0.9408 0.9408 4 Res2Net50 0.9235 0.9202 0.9205 0.9202 6 BiLSTM 0.8930 0.8922 0.8922 0.8922 7 CNN+BiLSTM 0.9316 0.9294 0.9299 0.9295 8 This article 0.9690 0.9674 0.9673 0.9674

[0106] As can be seen, the network model in this solution achieved the best performance with an accuracy of 96.90%, a recall of 96.74%, an F1 score of 96.73%, and a precision of 96.74, indicating that its classification performance is significantly better than other models.

[0107] To analyze the device recognition performance of the network model in this embodiment, such as Figure 8 and 9The diagram shows the recognition accuracy and confusion matrix for 27 devices. Although the recognition accuracy of some devices is significantly lower than that of others, except for the TP-Link Plug HS110 and Edimax Plug 2101W, the recognition accuracy of the remaining devices all exceed 80%, and 14 devices achieve 100% recognition accuracy. Further analysis of the confusion matrix reveals that errors are mainly concentrated between different devices from the same vendor, including D-Links, Edimax, TP-Link, and WeMo. This is because devices from the same vendor often have similar hardware and software, operating modes, and generate highly similar communication traffic. The results demonstrate that the network model in this embodiment has a good recognition capability for IoT devices, even different models of the same type from the same manufacturer.

[0108] To verify the effectiveness of each module of the capsule network model in this proposal, ablation experiments were conducted on the Aalto dataset while ensuring consistent experimental parameters. The experiments used CapsNet as the base network, with the addition of convolutional layers, a Res2Net block for multi-scale feature extraction, a CBAM attention mechanism, and a multi-stage feature fusion module. The experimental results are shown in Table 3.

[0109] Table 3

[0110]

[0111]

[0112] Compared to the original capsule network, Model 2 achieved a 5.19% performance improvement after increasing the number of convolutional layers. This is because as the number of convolutional layers increases, the model abstracts the input features more deeply, covers more key features, and thus achieves higher accuracy. Adding a Res2Net block and a CBAM attention mechanism to Model 2 resulted in performance improvements of 1.98% and 0.25%, respectively. Adding these two modules simultaneously improved accuracy by 2.19%, indicating that the Res2Net block effectively increases the network's receptive field, and the attention mechanism helps the network better understand and process data. In this embodiment, adding a multi-stage feature fusion module further improved accuracy by 0.47%, achieving the optimal recognition accuracy. This demonstrates that multi-stage feature fusion can compensate for information loss caused by depth, thereby improving recognition accuracy.

[0113] Based on the experimental data above, it can be demonstrated that the accuracy rate of the proposed solution reaches 96.74%. Compared with other existing methods, the proposed solution has higher identification accuracy and better classification effect for similar devices. Therefore, it can be applied to the identification of a large number of IoT devices, including computer equipment, software, wireless sensors and actuators.

[0114] Unless otherwise specifically stated, the relative steps, numerical expressions, and values ​​of the components and steps described in these embodiments do not limit the scope of the invention.

[0115] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the systems disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple; relevant parts can be referred to the method section.

[0116] The units and method steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of each example have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations are not considered to be beyond the scope of this invention.

[0117] Those skilled in the art will understand that all or part of the steps in the above methods can be implemented by a program instructing related hardware, and the program can be stored in a computer-readable storage medium, such as a read-only memory, a disk, or an optical disk. Optionally, all or part of the steps in the above embodiments can also be implemented using one or more integrated circuits. Accordingly, each module / unit in the above embodiments can be implemented in hardware or as a software functional module. This invention is not limited to any particular combination of hardware and software.

[0118] Finally, it should be noted that the above-described embodiments are merely specific implementations of the present invention, used to illustrate the technical solutions of the present invention, and not to limit it. The scope of protection of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments within the technical scope disclosed in the present invention, or make equivalent substitutions for some of the technical features; and these modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for Internet of Things device recognition based on a multi-scale attention capsule network, characterized in that, Include: Collect raw traffic data of the target IoT device to be identified, and obtain preprocessed normalized traffic data by normalizing the raw traffic data. Normalized traffic data is input into a pre-trained capsule network device identification model, which is then used to identify the type of target IoT device. The capsule network device recognition model includes a feature extraction layer for fine-grained extraction of multi-scale features from input data, a feature fusion layer for fusing the extracted multi-scale features, and a capsule layer for classifying the fused features. The feature extraction layer consists of multiple cascaded feature extraction units, each consisting of a convolutional layer and an improved Res2Net block. The improved Res2Net block consists of a CBAM module and a Res2Net block, with the CBAM module located before the residual connection of the Res2Net block and after the second 1×1 convolution of the Res2Net block. When the feature fusion layer works, it first uses the convolutional layer to convolve the features extracted by each feature extraction unit, and then adds the convolutional results to obtain the fused features.

2. The IoT device identification method based on multi-scale attention capsule networks according to claim 1, characterized in that, By performing normalization preprocessing on the raw traffic data, we obtain preprocessed normalized traffic data, which includes: First, the raw traffic data is split into multiple sessions, each containing a bidirectional communication stream; Next, the identification information in the session stream data that is unrelated to the device itself but is a unique identifier of the device is anonymized. The identification information includes the IP address and MAC address. Then, the anonymized session stream data is truncated or padded to make each session stream data reach a preset length, and the binary bit stream of each byte in the session stream data is read, and each byte is matched with a pixel in sequence to convert the session stream data into a grayscale image.

3. The IoT device identification method based on multi-scale attention capsule networks according to claim 1, characterized in that, When the feature extraction layer extracts multi-scale features from the input data in a fine-grained manner, it first uses the first convolutional kernel to adjust the shape of the input data feature map. Then, it uses the Res2Net residual network to increase the receptive field of the convolutional layer during the feature extraction process, so as to extract multi-scale features in a fine-grained manner. Furthermore, it uses a lightweight attention mechanism in the spatial and channel dimensions to update the feature weights of the spatial and channel dimensions in the feature extraction process, so as to highlight the key features of the input data.

4. The IoT device identification method based on multi-scale attention capsule networks according to claim 3, characterized in that, The Res2Net residual network is used to increase the receptive field of the convolutional layers during feature extraction, enabling fine-grained extraction of multi-scale features. The Res2Net residual network includes a second convolutional kernel, multiple parallel residual block branches, and a third convolutional kernel. The second convolutional kernel is used to divide the shaped feature map into several groups, each group corresponding to a residual block branch. The branches of the latter two groups are nested at the level of the residual block sequence output of the former branch. The third convolutional kernel is used to perform multi-scale fusion of the branch outputs spliced ​​in the channel dimension.

5. The IoT device identification method based on multi-scale attention capsule networks according to claim 3 or 4, characterized in that, A lightweight attention mechanism is used to update the feature weights of space and channels in feature extraction, including: assigning weights to different channels using channel attention and assigning weights to different spatial locations using spatial attention. Specifically, channel attention uses average pooling and max pooling to compress features in the spatial dimension, and the two attention prototypes obtained by average pooling and max pooling are fed into a shared network. The outputs of the shared network are summed and then passed through an activation function to obtain the channel assignment weights. Spatial attention uses average pooling and max pooling to aggregate channel information to obtain feature maps of two channels. The feature maps are then convolved through a fourth convolutional kernel and activated by an activation function to obtain the spatial location assignment weights.

6. The IoT device identification method based on multi-scale attention capsule networks according to claim 1, characterized in that, The feature fusion layer is used to fuse the extracted multi-scale features, which includes: using the fifth convolution kernel to perform channel matching on the extracted multi-scale features, and adding and fusing the channel-matched features to obtain fused features.

7. The IoT device identification method based on multi-scale attention capsule networks according to claim 1, characterized in that, In the classification output of fused features using capsule layers, the capsule layer contains: an initial capsule for transforming fused features into capsule vectors, and a routing capsule for fully connecting the initial capsule output and the digital capsule output and aggregating capsules with similar feature attributes to output a classification.

8. The IoT device identification method based on multi-scale attention capsule networks according to claim 7, characterized in that, The classification output of fused features is achieved through a capsule layer, which includes: an iterative process of dynamic routing algorithm, specifically: using the weight matrix and the output vector of the current low-level capsule to obtain the prediction vector of the next high-level capsule, the weighted sum of the prediction vectors of the next high-level capsule is used as the input of the next high-level capsule, the input is compressed and standardized by a nonlinear squeezing function to obtain the output of the next high-level capsule, the capsule information that meets the preset iteration termination condition is output through iteration, and the target IoT device type is obtained based on the output capsule information.

9. The IoT device identification method based on multi-scale attention capsule networks according to claim 8, characterized in that, The input is compressed and normalized using a nonlinear squeezing function to obtain the output of the next higher-level capsule, where the nonlinear squeezing function is expressed as: s j For the input of the high-level capsule j, and u j|i c is the prediction vector of the next higher-level capsule j obtained based on the previous lower-level capsule i. ij s j and u j|i The coupling parameters, and b ij This represents the log-prior probability that couples the lower-level capsule i and the higher-level capsule j.

10. An IoT device identification system based on multi-scale attention capsule networks, characterized in that, It includes: a data processing module and a device identification module, wherein, The data processing module is used to collect raw traffic data of the target IoT device to be identified, and to obtain preprocessed normalized traffic data by performing normalization preprocessing on the raw traffic data. The device identification module is used to input normalized traffic data into a pre-trained capsule network device identification model, and to identify the type of target IoT device using the pre-trained capsule network device identification model. The capsule network device identification model includes a feature extraction layer for fine-grained extraction of multi-scale features from the input data, a feature fusion layer for fusing the extracted multi-scale features, and a capsule layer for classifying the fused features. The feature extraction layer consists of multiple cascaded feature extraction units, each consisting of a convolutional layer and an improved Res2Net block. The improved Res2Net block consists of a CBAM module and a Res2Net block, with the CBAM module located before the residual connection of the Res2Net block and after the second 1×1 convolution of the Res2Net block. When the feature fusion layer operates, it first convolves the features extracted by each feature extraction unit using the convolutional layer, and then adds the convolutional results to obtain the fused features.

Images