A monitoring terminal identification method and related device

Abstract

The application discloses a kind of monitoring terminal identification method and related devices, it is related to communication technical field.In the present application, cloud server determines that target port is any one in each port of each network switch;According to the set time window, for the data stream transmitted by target port, continuously carry out N times data monitoring, obtain corresponding N group monitoring results;For N group monitoring results, comprehensive feature extraction is carried out, and the data feature vector of data stream is obtained;Based on data feature vector, the terminal type of target terminal directly connected with target port is obtained.Using this way, when the data stream of monitoring terminal and switch is transmitted, it has the characteristics of strong stability compared with the data stream transmitted by other terminal equipment, the data stream of target port is monitored, and then feature extraction is carried out, so as to realize the terminal type identification of target terminal directly connected with target port, improve the efficiency and accuracy of monitoring terminal identification.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to a monitoring terminal identification method and related apparatus. Background Technology

[0002] With the rapid development of digital networks and the increasing awareness of security, more and more monitoring terminals are being deployed in network environments. These are mainly divided into network cameras (Internet Protocol Cameras, abbreviated as IPCs) and network video recorders (NVRs) that are paired with IPCs. However, in monitoring scenarios, an excessive number of non-camera network devices can put significant pressure on outbound bandwidth and network operation, thereby affecting the normal transmission of monitoring video data from the monitoring terminals. Therefore, how to efficiently and accurately identify monitoring terminals is a problem that every cloud management platform (also known as the cloud) needs to solve. This is of great significance for the implementation of intelligent network operation and maintenance based on terminal type.

[0003] Currently, the following methods are mainly used to identify monitoring terminals in a network under relevant technologies:

[0004] Method 1: Manually label each monitoring terminal directly connected to a switch port by the personnel deploying the monitoring terminal through manual data entry.

[0005] Method 2: Based on monitoring terminals produced by different manufacturers, construct corresponding network data rules, and identify monitoring terminals within the network through the corresponding network data rules.

[0006] Method 3: Identify monitoring terminals directly connected to the switch through the Open Network Video Interface Forum (ONVIF) protocol, and then obtain and analyze Real Time Streaming Protocol (RTSP) message data to distinguish between IPC and NVR.

[0007] Method 4: Obtain wireless network traffic in the environment through a personal computer, classify and analyze its characteristics, and identify wireless cameras in the current environment based on the characteristics of wireless camera data streams.

[0008] Using method one can easily lead to data entry errors, and if the number of terminals in the network becomes too large, it will generate a lot of manpower costs.

[0009] When using method two, since monitoring terminals from different manufacturers are deployed with different configurations, the characteristics of their video stream network data are different. Therefore, it is necessary to build corresponding expert rules for each type and configuration of monitoring terminal. Furthermore, as the terminal system is updated, the expert rules also need to be continuously improved, resulting in a large overhead in building and maintaining a complete rule base.

[0010] When using method three, all packets within the switch need to be detected and identified, which places certain demands on the switch's hardware performance and increases the processing load on the switch's built-in CPU. In addition, this method can only identify monitoring terminals that support the ONVIF protocol, and most monitoring terminals, although they support the ONVIF protocol, usually have it disabled by default. For the monitoring terminals to be identified, ONVIF protocol support needs to be manually enabled. Therefore, this method has certain limitations.

[0011] When using method four, only wireless camera terminals existing within the network can be identified, and wired camera terminals cannot be identified. However, wired monitoring terminals are the majority in the monitoring network, and this method also relies on external devices to collect wireless traffic data, which also has certain limitations.

[0012] In view of this, a new method for identifying monitoring terminals is needed to address the above problems. Summary of the Invention

[0013] This application provides a monitoring terminal identification method and related apparatus to improve the efficiency and accuracy of monitoring terminal identification in a switch network.

[0014] In a first aspect, embodiments of this application provide a monitoring terminal identification method, the method comprising:

[0015] Determine the target port, which can be any one of the ports on each network switch;

[0016] According to the set time window, data monitoring is performed N times continuously for the data stream transmitted on the target port to obtain N sets of monitoring results; each set of monitoring results includes at least one traffic status attribute of the data stream.

[0017] Comprehensive feature extraction is performed on N sets of monitoring results to obtain the data feature vector of the data stream. The data feature vector represents the traffic distribution of the data stream passing through the target port at different time points within N time windows.

[0018] Based on the data feature vector, the terminal type of the target terminal directly connected to the target port is obtained.

[0019] Optionally, comprehensive feature extraction is performed on the N sets of monitoring results to obtain the data feature vector of the data stream, including:

[0020] Obtain the preset vector template, which records: the element type of each vector element contained in the data feature vector, and the calculation method of the element value corresponding to each element type;

[0021] Based on N sets of monitoring results, the corresponding vector element values ​​are obtained by calculating the values ​​of each element recorded in the vector template.

[0022] Based on the obtained vector element values, the data feature vector is obtained.

[0023] Optionally, based on N sets of monitoring results, the corresponding vector element values ​​are obtained by calculating the values ​​of each element recorded in the vector template, including:

[0024] For N sets of monitoring results, perform the following operations respectively: determine the time period covered by the time window corresponding to a set of monitoring results; based on the time period, obtain statistical parameters corresponding to at least one traffic status attribute of the data stream contained in the set of monitoring results; and use the obtained at least one statistical parameter as the statistical result corresponding to the set of monitoring results.

[0025] Based on the obtained N sets of statistical results, the corresponding vector element values ​​are obtained by calculating the values ​​of each element recorded in the vector template.

[0026] Optionally, based on the data feature vector, the terminal type of the target terminal directly connected to the target port can be obtained, including:

[0027] The data feature vector is input into a pre-trained terminal type recognition model to obtain the terminal type of the target terminal. The terminal type recognition model is obtained after training based on the historical data streams transmitted by each port of each network switch and the historical terminal types directly connected to each port.

[0028] Optionally, after obtaining the terminal type of the target terminal directly connected to the target port, the following may also be included:

[0029] Store the target port number and the terminal type of the target terminal in the cloud database.

[0030] Optionally, the target terminal's terminal type must be at least one of the following:

[0031] IPCs belonging to the monitoring terminal;

[0032] NVRs are part of the monitoring terminals;

[0033] Other network devices besides IPCs and NVRs.

[0034] Secondly, embodiments of this application also provide a monitoring terminal identification device, the device comprising:

[0035] The port selection module is used to determine the target port, which can be any one of the ports of each network switch;

[0036] The data monitoring module is used to continuously monitor the data stream transmitted on the target port N times according to a set time window, and obtain corresponding N sets of monitoring results; wherein each set of monitoring results includes at least one traffic status attribute of the data stream.

[0037] The feature extraction module is used to perform comprehensive feature extraction on N sets of monitoring results to obtain the data feature vector of the data stream. The data feature vector represents the flow distribution of the data stream passing through the target port at different time points within N time windows.

[0038] The type identification module is used to obtain the terminal type of the target terminal directly connected to the target port based on the data feature vector.

[0039] Optionally, when performing comprehensive feature extraction on N sets of monitoring results to obtain the corresponding data feature vectors, the feature extraction module is used for:

[0040] Obtain the preset vector template, which records: the element type of each vector element contained in the data feature vector, and the calculation method of the element value corresponding to each element type;

[0041] Based on N sets of monitoring results, the corresponding vector element values ​​are obtained by calculating the values ​​of each element recorded in the vector template.

[0042] Based on the obtained vector element values, the data feature vector is obtained.

[0043] Optionally, based on N sets of monitoring results, when obtaining the corresponding vector element values ​​using the calculation methods for each obtained element value, the feature extraction module is used for:

[0044] For N sets of monitoring results, perform the following operations respectively: determine the time period covered by the time window corresponding to a set of monitoring results; based on the time period, obtain statistical parameters corresponding to at least one traffic status attribute of the data stream contained in the set of monitoring results; and use the obtained at least one statistical parameter as the statistical result corresponding to the set of monitoring results.

[0045] Based on the obtained N sets of statistical results, the corresponding vector element values ​​are obtained by calculating the values ​​of each element recorded in the vector template.

[0046] Optionally, when obtaining the terminal type of the target terminal directly connected to the target port based on the data feature vector, the type identification module is used for:

[0047] The data feature vector is input into the pre-trained monitoring terminal identification model to obtain the terminal type of the target terminal. The monitoring terminal identification model is obtained after training based on the historical data streams transmitted by each port of each network switch and the historical terminal types directly connected to each port.

[0048] Optionally, after obtaining the terminal type of the target terminal directly connected to the target port, the type identification module is also used for:

[0049] Store the target port number and the terminal type of the target terminal in the cloud database.

[0050] Optionally, the target terminal's terminal type must be at least one of the following:

[0051] IPCs belonging to the monitoring terminal;

[0052] NVRs are part of the monitoring terminals;

[0053] Other network devices besides IPCs and NVRs.

[0054] Thirdly, embodiments of this application provide an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the method as described in any of the first aspects.

[0055] Fourthly, embodiments of this application provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of any of the methods described in the first aspect.

[0056] Fifthly, embodiments of this application provide a computer program product that, when invoked by a computer, causes the computer to execute the method described in the first aspect.

[0057] In this embodiment, the cloud server determines the target port as any one of the ports of each network switch; according to the set time window, it continuously monitors the data stream transmitted through the target port N times to obtain N sets of monitoring results; each set of monitoring results includes at least one traffic status attribute of the data stream; comprehensive feature extraction is performed on the N sets of monitoring results to obtain the data feature vector of the data stream; the data feature vector represents the traffic distribution of the data stream passing through the target port at different time points within the N time windows; based on the data feature vector, the terminal type of the target terminal directly connected to the target port is obtained.

[0058] In this approach, when the monitoring terminal transmits data with the switch, its data stream has stronger stability compared to the data streams transmitted by other terminal devices. By monitoring the data stream and extracting features from the target port, the monitoring terminal can be identified as the target terminal directly connected to the target port, thus improving the efficiency and accuracy of monitoring terminal identification. Attached Figure Description

[0059] Figure 1 This is a schematic diagram of the system architecture in an embodiment of this application;

[0060] Figure 2 This is a detailed flowchart of the monitoring terminal identification process under the system architecture in this application embodiment;

[0061] Figure 3 This is a schematic diagram illustrating a scenario where data flow monitoring of a target port is performed under the system architecture of this application embodiment;

[0062] Figure 4 This is a schematic diagram of N1 sets of monitoring results obtained by monitoring the data flow of the target port under the system architecture in this application embodiment;

[0063] Figure 5 This is a detailed flowchart of the process for obtaining data feature vectors in the embodiments of this application;

[0064] Figure 6 This is a schematic diagram of the data flow during the identification of the monitoring terminal in this embodiment of the application;

[0065] Figure 7 This is a flowchart illustrating the identification of a monitoring terminal in a real-world application scenario provided in this application embodiment;

[0066] Figure 8 This is a schematic diagram of a monitoring terminal identification scenario in a real-world application scenario provided in the embodiments of this application.

[0067] Figure 9 This is a schematic diagram of a monitoring terminal identification scenario in another practical application scenario provided in this application embodiment;

[0068] Figure 10 This is a schematic diagram of the structure of a monitoring terminal identification device in an embodiment of this application;

[0069] Figure 11 This is a schematic diagram of the structure of an electronic device according to an embodiment of this application. Detailed Implementation

[0070] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings of the embodiments of this application. Obviously, the described embodiments are only some embodiments of the technical solutions of this application, and not all embodiments. Based on the embodiments recorded in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the technical solutions of this application.

[0071] The following describes some of the concepts involved in the embodiments of this application.

[0072] (1) Classification Models: Classification is one of the uses of machine learning. Classification models are used to learn from existing data and labels to predict the labels of unknown data. They include binary classification models and multi-class classification models. Binary classification refers to choosing one category from two categories. In a binary classification model, one category is called the positive class and the other category is called the negative class. Multi-class classification refers to choosing one category from multiple categories.

[0073] (2) Decision tree: It is a basic classification model that uses a binary tree or multi-branch tree to represent the decision process. The root node of the tree contains the entire sample set, each leaf node corresponds to a decision result, and each internal node corresponds to a decision process.

[0074] (3) Classification and Regression Tree (CART): A decision tree with a binary tree as its logical structure, used to complete linear regression tasks. It divides the sample space at each node through binary recursive partitioning, and has only two choices, yes or no, at each step of the decision.

[0075] The design concept of this application is briefly introduced below:

[0076] IPCs and NVRs are monitoring terminals used together in a network. The IPC is responsible for capturing monitoring video and then transmitting it to the NVR via a switch. The transmission of video data from the IPC to the NVR involves five stages: capture, encoding, transmission, decoding, and playback. The capture and encoding stages primarily occur at the IPC, the transmission stage primarily occurs at the switch, and the decoding and playback primarily occur at the NVR.

[0077] The network traffic of monitoring terminals during the transmission phase exhibits distinct characteristics. This is because the video data collected by the IPC needs to undergo an encoding stage before transmission. This encoding stage primarily uses the H.264 encoding protocol, which defines each frame within a group as three types: I-frames, B-frames, and P-frames. An I-frame represents a complete keyframe, essentially preserving the entire frame. A P-frame contains only information different from the previous frame, indicating the difference between this frame and the previous keyframe. Decoding requires overlaying the previously cached frames with the differences defined in this frame to generate the final image. A B-frame records the differences between this frame and the frames before and after it. Decoding a B-frame requires not only retrieving the previously cached frames but also decoding the subsequent frames, obtaining the final image by overlaying the data from the previous and subsequent frames with the current frame's data. During the transmission phase, the data transmitted by the monitoring terminal mainly consists of I-frames and P-frames. Therefore, the network traffic of monitoring terminals exhibits greater stability compared to other terminals, with similar traffic distributions at different times and a certain periodicity, unlike the traffic of non-monitoring terminals.

[0078] In summary, by acquiring the data stream transmitted through the switch port and performing feature analysis, it is possible to more accurately identify whether the terminal directly connected to the switch port is a monitoring terminal.

[0079] The preferred embodiments of this application will now be described in detail with reference to the accompanying drawings.

[0080] See Figure 1 As shown in the embodiment of this application, it includes three main parts: a cloud server 100, a target switch 101, and a target terminal 102. The target switch 101 transmits data with the target terminal 102 through its target port 103. The cloud server deploys an IPC identification model and an NVR identification model. When the cloud server 100 identifies whether the terminal type of the target terminal 102 belongs to a monitoring terminal, it first performs N consecutive data monitoring on the data stream transmitted through the target port 103 according to a set time window, and obtains N sets of monitoring results, which include at least one state attribute of the data stream. Then, it performs comprehensive feature extraction on the N sets of monitoring results to obtain the data feature vector of the data stream. Finally, it inputs the data feature vector into the IPC identification model and / or the NVR identification model to obtain that the terminal type of the target terminal 102 belongs to the monitoring terminal IPC or NVR, or other network devices other than IPC and NVR. The cloud server stores the terminal type of the target terminal 102 and the target port number of the target port 103 in the cloud database.

[0081] Based on the above system architecture, see [link / reference] Figure 2 As shown in the embodiments of this application, the detailed process of monitoring terminal identification is as follows:

[0082] First, randomly select one port from all the ports of each network switch as the target port and execute step 201.

[0083] Step 201: According to the set time window, perform N consecutive data monitoring on the data stream transmitted to the target port to obtain the corresponding N sets of monitoring results.

[0084] Each set of monitoring results includes at least one traffic status attribute of the data stream.

[0085] For example, see Figure 3 As shown, assuming the set time window is 5 minutes and N = 3 (in this embodiment, N ≥ 3), for the data stream passing through the target port in the subsequent time period starting from 12:00, the cloud server continuously monitors the data three times according to the set time window of 5 minutes, and obtains the monitoring results for the three time periods: N1: 12:00~12:05, N2: 12:05~12:10, and N3: 12:10~12:15.

[0086] Specifically, in this embodiment of the application, each set of monitoring results includes: the sum of uplink traffic within a unit time window (hereinafter referred to as the sum of uplink traffic), the sum of downlink traffic within a unit time window (hereinafter referred to as the sum of downlink traffic), the number of uplink data packets within a unit time window (hereinafter referred to as the number of uplink data packets), and the number of downlink data packets within a unit time window (hereinafter referred to as the number of downlink data packets), for a total of four traffic status attributes.

[0087] Step 202: Perform comprehensive feature extraction on N sets of monitoring results to obtain the data feature vector of the data stream.

[0088] Among them, the data feature vector represents the traffic distribution of the data flow passing through the target port at different time points within N time windows.

[0089] Specifically, in this embodiment, since the data obtained in step 201 is based on monitoring results aggregated within a unit time window, in order to eliminate the influence of aggregated monitoring results, preprocessing of the N sets of monitoring results is required before executing step 202. This preprocessing includes:

[0090] For N sets of monitoring results, perform the following operations respectively: determine the time period covered by the time window corresponding to a set of monitoring results; based on the time period, obtain statistical parameters corresponding to at least one traffic status attribute of the data stream contained in the set of monitoring results; and use the obtained at least one statistical parameter as the statistical result corresponding to the set of monitoring results.

[0091] Optionally, each set of statistical results may include, but is not limited to, the following data: uplink rate, downlink rate, uplink-to-downlink rate ratio, unit uplink packet size, unit downlink packet size, unit uplink-to-downlink packet value ratio, and uplink-to-downlink packet number ratio.

[0092] For example, see Figure 4 As shown, assuming that within the 5-minute time window corresponding to monitoring result N1, the total uplink traffic is 3000MB and the number of uplink data packets is 100, the total downlink traffic is 1500MB and the number of downlink data packets is 500, then:

[0093] The upload speed is 3000MB / (5min×60s) = 10MB / s;

[0094] The downlink speed is 1500MB / (5min×60s) = 5MB / s;

[0095] The ratio of uplink to downlink speed is (10MB / s) / (5MB / s) = 2MB / s;

[0096] The size of a single uplink packet is 3000 / 100 = 30MB;

[0097] The size of a single downlink packet is 1500 / 500 = 3MB;

[0098] The ratio of the unit uplink to downlink packet values ​​is 30 / 3 = 10;

[0099] The ratio of uplink to downlink packets is 100 / 500 = 0.2.

[0100] The four flow status attributes contained in the original N1 group monitoring results are transformed into seven statistical parameters to form a set of statistical results. Similarly, the calculation method for the statistical results of N2 and N3 groups is the same.

[0101] Let Z represent the output data of the current step, and i represent the target terminal directly connected to the target port, then Z i Z represents the output vector of target terminal i after detection and preprocessing. i The structure is: 7*N, where N=3.

[0102] Furthermore, in the embodiments of this application, see... Figure 5 As shown, the detailed process of obtaining the data feature vector of the data stream based on the preprocessed N sets of detection results, i.e., N sets of statistical results, is as follows:

[0103] Step 501: Obtain the preset vector template, which records the element type of each vector element contained in the data feature vector, and the calculation method of the element value corresponding to each element type.

[0104] For example, the vector element values ​​contained in the data feature vector are the mean, median, standard deviation, interquartile range median ratio, and coefficient of variation characteristics corresponding to the seven statistical parameters contained in each group of statistical results, totaling five feature values. The vector template records the calculation methods of the five feature values ​​corresponding to the seven statistical parameters.

[0105] Step 502: Based on the N sets of statistical results, calculate the corresponding vector element values ​​using the calculation methods recorded in the vector template.

[0106] For example, based on the uplink rates contained in the statistical results of groups N1, N2, and N3, their corresponding mean, median, standard deviation, interquartile range median ratio, and coefficient of variation are calculated and used as five vector element values ​​of the data feature vector.

[0107] Step 503: Based on the obtained vector element values, obtain the data feature vector.

[0108] For example, referring to Table 1, for the output vector Z i The following eigenvalue submatrices are obtained:

[0109] Table 1

[0110]

[0111] At this point, the eigenvalue matrix has a 5x7 structure. To simplify the format, it is serialized, transforming the structure into a 35x1 matrix. Let X represent the output data of the current step, then X... i Let X represent the data feature vector of target terminal i after feature extraction. Then, the data feature vector X at this time... i The structure is 35*1.

[0112] Step 203: Based on the data feature vector, obtain the terminal type of the target terminal directly connected to the target port.

[0113] Specifically, in this embodiment of the application, the terminal type of the target terminal is obtained by inputting the data feature vector into a pre-trained terminal type recognition model. The terminal type recognition model is obtained after training based on the historical data streams transmitted by each port of each network switch and the historical terminal types directly connected to each port.

[0114] For example, an IPC identification model and an NVR identification model are deployed on a cloud server, and the output results of the two models are Y. ipc and Y nvr .

[0115] Optionally, in this embodiment of the application, the terminal type of the target terminal is at least any one of the following:

[0116] IPCs belonging to the monitoring terminal;

[0117] NVRs are part of the monitoring terminals;

[0118] Other network devices besides IPCs and NVRs.

[0119] For example, see the data flow examples in this application. Figure 6 As shown, the cloud server first processes the data feature vector X i The input is fed into the IPC recognition model to obtain the output result Y. i ipc。

[0120] If Y i ipc If the value is ≥0.5, it means that the target terminal i is a network camera belonging to the monitoring terminal, and NVR identification will no longer be performed.

[0121] If Y i ipc If the value is less than 0.5, it means that the target terminal i is not a network camera belonging to the monitoring terminal.

[0122] Furthermore, the data feature vector X i The input is fed into the NVR recognition model to obtain the output result Y. i nvr .

[0123] If Y i nvr If ≥0.5, it means that target terminal i is a network video recorder belonging to the monitoring terminal.

[0124] If Y i nvr If the value is less than 0.5, it means that the target terminal i is not a network video recorder belonging to the monitoring terminal.

[0125] If the output of both models is less than 0.5, it indicates that the target terminal i is a network device other than IPC and NVR.

[0126] In another alternative embodiment, the cloud server may first process the data feature vector X. i The input is fed into the NVR recognition model to obtain the output result Y. i nvr .

[0127] If Y i nvr If the value is ≥0.5, it indicates that the target terminal i is a network video recorder belonging to the monitoring terminal, and IPC identification will no longer be performed.

[0128] If Yi nvr If the value is less than 0.5, it means that the target terminal i is not a network video recorder belonging to the monitoring terminal.

[0129] Furthermore, the data feature vector X i The input is fed into the IPC recognition model to obtain the output result Y. i ipc .

[0130] If Y i ipc If ≥0.5, it means that the target terminal i is a network camera belonging to the monitoring terminal.

[0131] If Y i ipc If the value is less than 0.5, it means that the target terminal i is not a network camera belonging to the monitoring terminal.

[0132] If the output of both models is less than 0.5, it indicates that the target terminal i is a network device other than IPC and NVR.

[0133] Furthermore, in this embodiment of the application, after obtaining the terminal type of the target terminal directly connected to the target port through the pre-trained model, the method further includes:

[0134] The target port number and the terminal type of the target terminal are stored in the cloud database. At the same time, the corresponding information stored includes the serial number of the target switch and the MAC address of the target terminal.

[0135] Based on step 203, the model recognition method can efficiently and accurately identify monitoring terminals directly connected to switch ports, simplifying the process of manually labeling monitoring terminals and solving the limitations of traditional methods that rely on ONVIF and RTSP message recognition to obtain terminal types.

[0136] Optionally, the IPC recognition model and NVR recognition model in this application embodiment are both boosting decision tree models, which belong to the binary classification model in classification models. They mainly adopt the idea of ​​Gradient Boosting, and their base learners are classification regression trees. The final classification result is generated by combining the results of multiple classification regression trees.

[0137] When training the recognition model, based on actual research and business experience, it is confirmed that some switch ports are directly connected to IPCs or NVRs belonging to monitoring terminals. The data streams transmitted in the switch ports that have been confirmed to be directly connected to monitoring terminals are used as the training data of the recognition model, i.e., the training set.

[0138] For the data stream transmitted by the switch ports in the training set, the cloud server continuously monitors the data t times (t≥3) according to a set time window, obtains T sets of monitoring results, and obtains the data feature vector x based on the t sets of monitoring results according to the method described above.

[0139] Because the data stream from the monitoring terminal is more stable than that from other network terminals, the traffic distribution at different times is similar and has a certain periodicity, one or more of the following features are used in the data feature vector x: mean feature, median feature, standard deviation feature, interquartile range median ratio feature, and coefficient of variation feature to fit the traffic distribution of the switch port.

[0140] Among them, the coefficient of variation is defined as the ratio of the standard deviation to the mean. The lower the value, the more stable the observed values ​​are. The interquartile range median ratio is defined as the ratio of the interquartile range to the median. It is mainly used to measure the dispersion of the middle 50% of the observed data.

[0141] Assuming the current training set size is n, y ipc Indicates the IPC monitoring terminal identifier, y nvr This represents the NVR monitoring terminal identifier, where 'r' represents the terminal to be identified. Taking IPC identification samples as an example, if the terminal to be identified, 'r', is a network camera belonging to the monitoring terminal, then y ipc =1, data from this type of terminal becomes a positive sample. If the terminal to be identified, r, is not a network camera belonging to the monitoring terminal, then y ipc =0, the data of such terminals are negative samples, and the ratio of positive and negative samples should be as balanced as possible when training the recognition model.

[0142] The training samples for the IPC recognition model are (x r y r ipc The training set consisting of n training samples for training IPC recognition models is:

[0143] D ipc ={(x r y r ipc )}(D ipc =n);

[0144] Similarly, the training samples for the NVR recognition model are (x r y r nvr The training set, consisting of n training samples for training NVR recognition models, is as follows:

[0145] D nvr ={(x r y r nvr)}(D nvr =n);

[0146] Using training set D respectively ipc Training the IPC recognition model using D nvr The training methods for the NVR recognition model, IPC model, and NVR model are completely identical, only the training objective y differs; their model expressions can be uniformly described. The boosting decision tree model is represented as the sum of K functions to predict the output, expressed as:

[0147]

[0148] Among them, y r Here, F represents the predicted values ​​for each terminal type in the training set, and F is the space of the classification and regression tree, specifically expressed as:

[0149] F = {f(x) = w} q(x)}(q:R→T,w∈R T )

[0150] q represents the structure of each classification regression tree, T is the number of leaf nodes in the tree, and each f k This corresponds to an independent tree structure q and leaf node weight w.

[0151] The training set is used to learn and continuously optimize the tree structure q and weights w. Finally, a decision tree model with high classification accuracy is trained and deployed to a cloud server for use in subsequent recognition processes. Furthermore, when new terminals are connected to the network, new recognition models can be generated based on the continuous optimization of the training set.

[0152] In summary, using the boosted decision tree model as the identification model for monitoring terminals not only allows for flexible processing of various types of data but also provides high prediction accuracy and is easy to deploy and iteratively optimize in cloud servers.

[0153] The above embodiments will be further described in detail below through specific application scenarios.

[0154] Scenario 1: Suppose a new terminal R is connected to port a of switch A. (See...) Figure 7 and Figure 8 As shown, the detailed process of cloud server monitoring and identifying terminal R is as follows:

[0155] Step 701: Perform data monitoring five times consecutively for the data stream transmitted on port a within a 1-minute time window, obtain five sets of monitoring results, and then proceed to step 702.

[0156] Step 702: Perform data preprocessing on the 5 sets of monitoring results to obtain 5 sets of statistical results, and then proceed to step 703.

[0157] Step 703: Perform comprehensive feature extraction on the 5 sets of statistical results to obtain the data feature vector p, and then proceed to step 704.

[0158] Step 704: Input the data feature vector p into the IPC identification model and / or NVR identification model to obtain the terminal type of terminal R.

[0159] Among them, the output result y of the IPC recognition model R ipc =0.8 indicates that the newly connected terminal R is an IPC. Therefore, the cloud server stores the serial number of switch A, the port number of port a, the terminal type of terminal R, and the MAC address of terminal R in the cloud database for subsequent operation and maintenance and management of terminal R.

[0160] Scene 2: See Figure 9 As shown, suppose the cloud database records that the terminal S directly connected to port b of switch B is an NVR. However, after querying, it is found that the MAC address of terminal S no longer exists, indicating that the terminal connected to port b is no longer terminal S. Suppose the latest terminal connected to port b is terminal E. At this time, the cloud server identifies the terminal type, and the specific execution steps are similar to those in scenario one.

[0161] When the cloud server detects the data stream on port b and obtains the data feature q, it inputs it into the IPC identification model and / or the NVR identification model, and obtains the output result y. E ipc and y E nvr均 If the value is less than 0.5, it indicates that terminal E is a network device other than IPC and NVR. Therefore, the cloud server will delete the serial number of switch B, the port number of port b, the terminal type of terminal S, and the MAC address of terminal S from the cloud database.

[0162] Furthermore, although the operations of the method of this application are described in a specific order in the accompanying drawings, this does not require or imply that these operations must be performed in that specific order, or that all the operations shown must be performed to achieve the desired result. Additionally or alternatively, certain steps may be omitted, multiple steps may be combined into one step, and / or one step may be broken down into multiple steps.

[0163] Based on the same technical concept, see [reference] Figure 10 As shown in the figure, this application embodiment also provides a monitoring terminal identification device, which includes:

[0164] The port selection module 1001 is used to determine the target port, which is any one of the ports of each network switch;

[0165] The data monitoring module 1002 is used to continuously monitor the data stream transmitted on the target port N times according to a set time window, and obtain corresponding N sets of monitoring results; wherein each set of monitoring results includes at least one traffic status attribute of the data stream.

[0166] The feature extraction module 1003 is used to perform comprehensive feature extraction on N sets of monitoring results to obtain the data feature vector of the data stream. The data feature vector represents the flow distribution of the data stream passing through the target port at different time points within N time windows.

[0167] The type recognition module 1004 is used to obtain the terminal type of the target terminal directly connected to the target port based on the data feature vector.

[0168] Optionally, when performing comprehensive feature extraction on N sets of monitoring results to obtain the data feature vector of the data stream, the feature extraction module 1003 is used for:

[0169] Obtain the preset vector template, which records: the element type of each vector element contained in the data feature vector, and the calculation method of the element value corresponding to each element type;

[0170] Based on N sets of monitoring results, the corresponding vector element values ​​are obtained by calculating the values ​​of each element recorded in the vector template.

[0171] Based on the obtained vector element values, the data feature vector is obtained.

[0172] Optionally, based on N sets of monitoring results, when obtaining the corresponding vector element values ​​using the calculation method recorded in the vector template for each element, the feature extraction module 1003 is used for:

[0173] For N sets of monitoring results, perform the following operations respectively: determine the time period covered by the time window corresponding to a set of monitoring results; based on the time period, obtain statistical parameters corresponding to at least one traffic status attribute of the data stream contained in the set of monitoring results; and use the obtained at least one statistical parameter as the statistical result corresponding to the set of monitoring results.

[0174] Based on the obtained N sets of statistical results, the corresponding vector element values ​​are obtained by calculating the values ​​of each element recorded in the vector template.

[0175] Optionally, when obtaining the terminal type of the target terminal directly connected to the target port based on the data feature vector, the type identification module 1004 is used for:

[0176] The data feature vector is input into a pre-trained terminal type recognition model to obtain the terminal type of the target terminal. The terminal type recognition model is obtained after training based on the historical data streams transmitted by each port of each network switch and the historical terminal types directly connected to each port.

[0177] Optionally, after obtaining the terminal type of the target terminal directly connected to the target port, the type identification module 1004 is further used for:

[0178] Store the target port number and the terminal type of the target terminal in the cloud database.

[0179] Optionally, the target terminal's terminal type must be at least one of the following:

[0180] IPCs belonging to the monitoring terminal;

[0181] NVRs are part of the monitoring terminals;

[0182] Other network devices besides IPCs and NVRs.

[0183] Based on the same technical concept, this application also provides an electronic device that can implement the monitoring terminal identification method provided in the above embodiments of this application.

[0184] In one embodiment, the electronic device may be a server, a terminal device, or other electronic devices.

[0185] See Figure 11 As shown, the electronic device may include:

[0186] At least one processor 1101 and a memory 1102 connected to at least one processor 1101. In this embodiment, the specific connection medium between the processor 1101 and the memory 1102 is not limited. Figure 11 The example shown is the connection between processor 1101 and memory 1102 via bus 1100. Bus 1100 is... Figure 11 The connections between other components are shown in thick lines only and are not intended to be limiting. Bus 1100 can be divided into address bus, data bus, control bus, etc., for ease of representation. Figure 11 The term 1101 is represented by a single thick line, but this does not imply that there is only one bus or one type of bus. Alternatively, the processor 1101 may also be referred to as a controller; there is no restriction on the name.

[0187] In this embodiment, memory 1102 stores instructions executable by at least one processor 1101. By executing the instructions stored in memory 1102, at least one processor 1101 can execute the monitoring terminal identification method described above. Processor 1101 can implement... Figure 10 The functions of each module in the device shown.

[0188] The processor 1101 is the control center of the device. It can connect to various parts of the control device through various interfaces and lines. By running or executing instructions stored in memory 1102 and calling data stored in memory 1102, the processor can perform various functions and process data, thereby monitoring the device as a whole.

[0189] In one possible design, processor 1101 may include one or more processing units. Processor 1101 may integrate an application processor and a modem processor, wherein the application processor mainly handles the operating system, user interface, and applications, and the modem processor mainly handles wireless communication. It is understood that the modem processor may also not be integrated into processor 1101. In some embodiments, processor 1101 and memory 1102 may be implemented on the same chip; in some embodiments, they may also be implemented on separate chips.

[0190] The processor 1101 can be a general-purpose processor, such as a CPU, digital signal processor, application-specific integrated circuit, field-programmable gate array or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component, capable of implementing or executing the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the monitoring terminal identification method disclosed in the embodiments of this application can be directly manifested as being executed by a hardware processor, or executed by a combination of hardware and software modules within the processor.

[0191] Memory 1102, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer-executable programs, and modules. Memory 1102 may include at least one type of storage medium, such as flash memory, hard disk, multimedia card, card-type memory, random access memory (RAM), static random access memory (SRAM), programmable read-only memory (PROM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), magnetic storage, magnetic disk, optical disk, etc. Memory 1102 can be any other medium capable of carrying or storing desired program code in the form of instructions or data structures that can be accessed by a computer, but is not limited thereto. In the embodiments of this application, memory 1102 can also be a circuit or any other device capable of implementing storage functions for storing program instructions and / or data.

[0192] By designing and programming the processor 1101, the code corresponding to the monitoring terminal identification method described in the foregoing embodiments can be embedded into the chip, thereby enabling the chip to execute the code during operation. Figure 2 The illustrated embodiment presents the steps of a monitoring terminal identification method. How to design and program the processor 1101 is a technique well-known to those skilled in the art and will not be described further here.

[0193] Based on the same inventive concept, embodiments of this application also provide a storage medium storing computer instructions that, when executed on a computer, cause the computer to perform a monitoring terminal identification method described above.

[0194] In some possible implementations, various aspects of the monitoring terminal identification method provided by this application can also be implemented in the form of a program product, which includes program code. When the program product is run on a device, the program code is used to cause the control device to perform the steps in the monitoring terminal identification method according to various exemplary embodiments of this application described above.

[0195] It should be noted that although several units or sub-units of the device have been mentioned in the detailed description above, this division is merely exemplary and not mandatory. In fact, according to embodiments of this application, the features and functions of two or more units described above can be embodied in one unit. Conversely, the features and functions of one unit described above can be further divided and embodied by multiple units.

[0196] Furthermore, although the operations of the method of this application are described in a specific order in the accompanying drawings, this does not require or imply that these operations must be performed in that specific order, or that all the operations shown must be performed to achieve the desired result. Additionally or alternatively, certain steps may be omitted, multiple steps may be combined into one step, and / or one step may be broken down into multiple steps.

[0197] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0198] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0199] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0200] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0201] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A method of monitoring terminal identification, characterized by, The method comprises: determining a target port, the target port being any one of each port of each network switch; according to a set time window, continuously performing N times of data monitoring on a data stream transmitted by the target port to obtain N groups of monitoring results, wherein each group of monitoring results comprises at least one traffic state attribute of the data stream; obtaining a preset vector template, and based on the N groups of monitoring results, obtaining corresponding vector element values by using each element value calculation method recorded in the vector template; and based on the obtained vector element values, obtaining a data feature vector, wherein the vector template records the element type of each vector element included in the data feature vector and the element value calculation method corresponding to each element type; and the data feature vector represents the traffic distribution of the data stream passing through the target port at different time points within N time windows; based on the data feature vector, obtaining a terminal type of a target terminal directly connected to the target port.

2. The method of claim 1, wherein, The method comprises: for the N groups of monitoring results, respectively performing the following operations: determining a time period covered by the time window corresponding to a group of monitoring results, obtaining at least one statistical parameter corresponding to at least one traffic state attribute of the data stream included in the group of monitoring results based on the time period, and taking the obtained at least one statistical parameter as a statistical result corresponding to the group of monitoring results; based on the N groups of statistical results, obtaining corresponding vector element values by using each element value calculation method recorded in the vector template.

3. The method according to any one of claims 1 to 2, wherein, The method comprises: inputting the data feature vector into a pre-trained terminal type identification model to obtain the terminal type of the target terminal, wherein the terminal type identification model is obtained by training based on historical data streams transmitted by each port of each network switch and historical terminal types directly connected to each port.

4. The method according to any one of claims 1 to 2, wherein After obtaining the terminal type of the target terminal directly connected to the target port, the method further comprises: storing the target port number of the target port and the terminal type of the target terminal in a cloud database.

5. The method of any one of claims 1-2, wherein, The terminal type of the target terminal is at least any one of the following: a network camera IPC belonging to a monitoring terminal; a network video camera NVR belonging to a monitoring terminal; other network devices other than the IPC and the NVR.

6. A monitoring terminal identification device, characterized by comprising: The method comprises: a port selection module configured to determine a target port, the target port being any one of each port of each network switch; a data monitoring module configured to, according to a set time window, continuously perform N times of data monitoring on a data stream transmitted by the target port to obtain N groups of monitoring results, wherein each group of monitoring results comprises at least one traffic state attribute of the data stream; and obtain a preset vector template, and based on the N groups of monitoring results, obtain corresponding vector element values by using element value calculation manners recorded in the vector template respectively; and based on the obtained vector element values, obtain a data feature vector, wherein the vector template records element types of each vector element included in the data feature vector and element value calculation manners corresponding to each element type; and the data feature vector represents flow distribution of a data stream passing through the target port at different time points within the N time windows; a type identification module, configured to obtain a terminal type of a target terminal directly connected to the target port based on the data feature vector.

7. An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor implements the method according to any one of claims 1-5 when executing the computer program.

8. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program, when executed by a processor, implements the steps of the method according to any one of claims 1-5.

9. A computer program product, characterised in that, The computer program product, when invoked by a computer, causes the computer to perform the method according to any one of claims 1-5.

Images