Device identification and access method and device based on radio frequency information and network traffic

Abstract

The present invention provides a device identification and access method and apparatus based on radio frequency information and network traffic, and relates to the technical field of wireless communication networks. The method includes: obtaining the communication data packet of the device to be accessed, and calling the dual-path feature extraction network to extract radio frequency features and network traffic features for feature cross-fusion to obtain the device features of the device to be accessed; calling the integrated classifier based on Bayesian optimization to identify the device features and obtain the device type of the device to be accessed; verifying the device type according to a preset whitelist to access the wireless communication network for the device to be accessed. Through the present application, the radio frequency features and network traffic features of the device to be accessed can be extracted and fused at the same time, achieving more accurate and reliable device identification, and solving the shortcomings of the single feature method in the prior art. A whitelist mechanism is set to manage the access of the identified device types, thereby further ensuring network security.

Description

Technical Field

[0001] The present invention relates to the field of wireless communication network technology, and in particular to a device identification and access method and device based on radio frequency information and network traffic. Background Art

[0002] As mobile communications develop towards wider bandwidths and higher frequency bands, widely distributed wireless communication network devices are gradually becoming the new "eyes" for humans to perceive the physical world. However, due to the diversity and complexity of wireless communication network devices, as well as the dynamic and open nature of wireless networks, it is particularly important to accurately identify the type of device in a wireless network environment and implement effective wireless communication network access management based on the device type.

[0003] The methods for wireless communication network device identification in the prior art are mainly device identification methods based on hardware radio frequency information and device identification methods based on network traffic. The device identification methods based on hardware radio frequency information are easily interfered by external environmental factors in real application scenarios, thereby affecting the extraction of radio frequency features and further affecting the accuracy of identification. Although the device identification method based on network traffic has good environmental adaptability and is not affected by changes in the external environment, in actual applications, network traffic characteristics (such as the time interval between data packet arrivals and the average data packet length, etc.) may be tampered with due to changes in network behavior. Network attackers can interfere with the identification process by simulating or modifying normal network behavior, thereby affecting the reliability of identification. Since the reliability and accuracy of wireless communication network device type identification are affected, the security of wireless communication network device access is reduced. Summary of the invention

[0004] The present invention provides a device identification and access method and device based on radio frequency information and network traffic, which are used to solve the defect in the prior art that when wireless communication network devices are accessed, the security of wireless communication network device access is reduced due to low accuracy and reliability of device type identification.

[0005] The present invention provides a device identification and access method based on radio frequency information and network traffic, comprising the following steps:

[0006] Acquire a communication data packet of the device to be connected, and call a dual-path feature extraction network to extract features of the communication data packet to obtain radio frequency features and network traffic features of the device to be connected;

[0007] Performing feature cross-fusion on the radio frequency feature and the network traffic feature to obtain device features of the device to be connected;

[0008] Invoking an integrated classifier based on Bayesian optimization to identify the device features and obtain the device type of the device to be connected;

[0009] The device type is verified according to a preset whitelist to obtain a whitelist verification result, and the wireless communication network is accessed to the device to be accessed according to the whitelist verification result.

[0010] In some embodiments, the communication data packet includes CSI information and network layer information, the dual-path feature extraction network includes a first path network and a second path network, and calling the dual-path feature extraction network to extract features of the communication data packet to obtain the radio frequency features and network traffic features of the device to be accessed includes:

[0011] Calling the first path network to perform feature extraction on the CSI information to obtain radio frequency features of the device to be connected;

[0012] The second path network is called to perform feature extraction on the network layer information to obtain network traffic features of the device to be accessed.

[0013] In some embodiments, the calling the first path network to extract features from the CSI information to obtain radio frequency features of the device to be connected includes:

[0014] Dividing the CSI information into a first patch sequence, and inserting a CLS tag as a first patch into a header of the first patch sequence to obtain an input patch sequence;

[0015] Performing linear projection on each patch in the input patch sequence to obtain a CSI information token of the patch;

[0016] Determining a position feature of each of the patches in the input patch sequence;

[0017] The location feature is fused with the CSI information token, and the fused token feature is input into the first path network for encoding processing to obtain the radio frequency feature of the device to be connected.

[0018] In some embodiments, the dual-path feature extraction network further includes a feature fusion encoder, the feature fusion encoder includes a cross self-attention network and a feedforward network, and the cross-fusion of the radio frequency features and the network traffic features to obtain the device features of the device to be connected includes:

[0019] Inputting the radio frequency feature and the network traffic feature into the cross self-attention network for CLS-based cross attention mechanism processing to obtain attention output information;

[0020] The feedforward network is called to perform linear mapping processing on the attention output information to obtain device characteristics of the device to be connected.

[0021] In some embodiments, the integrated classifier based on Bayesian optimization includes multiple basic learning classifiers, and calling the integrated classifier based on Bayesian optimization to identify the device features to obtain the device type of the device to be connected includes:

[0022] Inputting the device features into each of the basic learning classifiers respectively, and performing prediction processing on the device features by the basic learning classifier to obtain a soft label of the device type;

[0023] Aggregate each of the soft tags to obtain an integrated feature vector;

[0024] The secondary classifier is called to perform prediction processing on the integrated feature vector to obtain the device type of the device to be connected.

[0025] In some embodiments, the device type is verified according to a preset whitelist to obtain a whitelist verification result, including:

[0026] When the device type exists in the preset whitelist, determining that the device to be accessed is a quasi-access device, and taking the quasi-access device as a whitelist verification result;

[0027] When the device type does not exist in the preset whitelist, it is determined that the device to be connected is a non-secure device, and the non-secure device is used as a whitelist verification result.

[0028] In some embodiments, the step of performing wireless communication network access on the device to be accessed according to the whitelist verification result includes:

[0029] When the whitelist verification result is a ready-to-access device, wireless communication access is performed on the device to be accessed;

[0030] When the whitelist verification result is a non-safe device, the device to be connected is safely processed according to a preset security policy.

[0031] The present invention also provides a device identification and access device based on radio frequency information and network traffic, the device comprising the following modules:

[0032] A feature extraction module is used to obtain the communication data packet of the device to be connected, and call the dual-path feature extraction network to extract the features of the communication data packet to obtain the radio frequency features and network traffic features of the device to be connected;

[0033] A feature cross-connect module, used to perform feature cross-connection fusion on the radio frequency feature and the network traffic feature to obtain the device feature of the device to be connected;

[0034] A device identification module, used to call an integrated classifier based on Bayesian optimization to identify the device features and obtain the device type of the device to be connected;

[0035] The communication access module is used to verify the device type according to a preset white list, obtain a white list verification result, and perform wireless communication network access on the device to be accessed according to the white list verification result.

[0036] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, a device identification and access method based on radio frequency information and network traffic as described in any one of the above is implemented.

[0037] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the device identification and access method based on radio frequency information and network traffic as described in any one of the above is implemented.

[0038] The present invention also provides a computer program product, including a computer program, which, when executed by a processor, implements any of the above-mentioned device identification and access methods based on radio frequency information and network traffic.

[0039] The device identification and access method and device based on radio frequency information and network traffic provided by the present invention extracts the radio frequency characteristics and network traffic characteristics of the communication data packets of the device to be accessed through a dual-path feature extraction network, and cross-integrates them into device characteristics for predicting the device type. When extracting the network device type, both the radio frequency characteristics and the network traffic characteristics are considered simultaneously, which not only ensures the accuracy of device type identification but also improves the reliability, and solves the shortcomings of the single feature method in the prior art. During the network device access process, the identified device type is verified according to the preset whitelist, so that the wireless communication network access is performed for the device to be accessed according to the verification result, further improving the security of wireless communication network device access. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced one by one below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0041] Figure 1 It is a flow chart of a device identification and access method based on radio frequency information and network traffic provided by the present invention.

[0042] Figure 2 It is a working principle diagram of the device identification and access method based on radio frequency information and network traffic provided by the present invention.

[0043] Figure 3 It is a schematic diagram of the CrossFormer network feature extraction provided by the present invention.

[0044] Figure 4 It is a process diagram of device identification based on device feature integrated learning provided by the present invention.

[0045] Figure 5 It is a structural schematic diagram of a device identification and access apparatus based on radio frequency information and network traffic provided by the present invention.

[0046] Figure 6 It is a schematic diagram of the physical structure of an electronic device provided by the present invention. DETAILED DESCRIPTION

[0047] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings in the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0048] Combine the following Figure 1 Describe the device identification and access method based on radio frequency information and network traffic provided by the present invention, Figure 1 is a flow chart of a device identification and access method based on radio frequency information and network traffic provided by the present invention, such as Figure 1 As shown, the method includes the following steps.

[0049] In step 101, a communication data packet of a device to be connected is obtained, and a dual-path feature extraction network is called to extract features of the communication data packet to obtain radio frequency features and network traffic features of the device to be connected.

[0050] First, in the process of wireless communication network devices (i.e., devices to be connected), in order to extract and fuse RF features and network traffic features, it is necessary to collect and obtain the communication data packets of the devices to be connected. However, before the wireless communication network devices access the wireless network, it is necessary to determine the network topology of the access points and terminals. Figure 2 , Figure 2: is a working principle diagram of the device identification and access method based on radio frequency information and network traffic provided by the present invention. Figure 2 As shown, the raw data of the acquired device communication data packets (i.e., network communication data packets) are first parsed to determine the network topology of the access points and terminals. Before extracting the features of the network communication data packets, the device type associated with a specific MAC address is still unknown. Therefore, in order to improve the accuracy of subsequent identification of wireless communication network device types, the device data with the same MAC address is aggregated here, that is, the MAC addresses are aggregated according to the principle of "the minority obeys the majority", and the device type with the same MAC address is classified as the device type with the highest frequency.

[0051] Next is the feature extraction process. The present invention calls the dual-path feature extraction network to extract features from the communication data packets to obtain the radio frequency features and network traffic features of the device to be connected. The dual-path feature extraction network is a dual-path vision transformer (ViT) network, called the CrossFormer network. The following specifically describes the process of extracting device features using the CrossFormer network.

[0052] The CrossFormer network includes two path branches, which are divided into the first path network and the second path network, and the communication data packet includes the channel state information (CSI) and network layer information of the device to be connected. Therefore, when the dual-path feature extraction network extracts features from the communication data packet, the CSI information is input into one path branch of the dual-path feature extraction network, and the first path network in the path branch is called to extract features from the CSI information to obtain the RF features of the device to be connected. The network layer information is input into another path branch of the dual-path feature extraction network, and the second path network is called to extract features from the network layer information to obtain the network traffic features of the device to be connected.

[0053] For details, please refer to Figure 3 , Figure 3It is a schematic diagram of the CrossFormer network feature extraction provided by the present invention. The CrossFormer network is divided into two path branches, and the CSI information and the network layer information are input respectively for feature extraction. First, when the first path network extracts the RF features of the CSI information, the CSI information is divided into a first patch sequence, and the CLS label is inserted into the header of the first patch sequence as the first patch to obtain the input patch sequence, so that the CSI information data is converted into sequence data as the input of the first path network. After the sequence is input, a linear projection layer is used to linearly project each patch in the input patch sequence to obtain the CSI information token of the patch. In order to help the first path network better understand the position of each CSI information token, the position feature of each patch in the input patch sequence can be determined here, and then the position feature is fused with the CSI information token, thereby integrating the corresponding position information into each CSI information token. Finally, the fused token feature is input into the encoder of the first path network for encoding processing to obtain the RF features of the device to be connected.

[0054] like Figure 3 As shown, the encoder of the first path network is composed of N encoder blocks (i.e. Figure 3 The CSI information token after fusing the position features is encoded through N encoder blocks. Each encoder block has two main parts: one is a multi-head self-attention network that helps understand the information features, and the other is a feedforward network that processes the attention output information. During the entire forward process, each encoder block also performs a normalization operation and adds some residual connections to ensure that information is not lost. In addition, the number of encoder blocks in the first path network is different from that of the second path network, so each path branch uses a different number of encoders to extract features, which can balance the computational cost.

[0055] like Figure 3 As shown, similar to the first path network, the second path network extracts features from the network layer information to obtain the network traffic features of the device to be connected. First, when the second path network extracts the network traffic features of the network layer information, the network layer information is also divided into a second patch sequence, and the CLS label is inserted as the first patch into the header of the second patch sequence to obtain the input patch sequence, thereby converting the network layer information data into sequence data as the input of the second path network. After the sequence is input, a linear projection layer is also used to perform linear projection on each patch in the input patch sequence to obtain the network layer information token of the patch. Then, it is also necessary to determine the position features of each patch in the input patch sequence, and then fuse the position features with the network layer token. Finally, the fused token features are input into the encoder of the second path network for encoding processing to obtain the network traffic features of the device to be connected. As shown Figure 3As shown, the encoder of the second path network is composed of M encoder blocks (i.e. Figure 3 The process of extracting features in the two path branches is similar, so we will not go into details here.

[0056] Continue to see Figure 1 In step 102, the radio frequency features and the network traffic features are cross-fused to obtain the device features of the device to be connected.

[0057] The CrossFormer network also includes a feature fusion encoder, which is the most important structural part of the CrossFormer network. The feature fusion encoder includes a cross self-attention network and a feedforward network. Figure 3 As shown, the cross-self-attention network includes L cross-attention modules (i.e. Figure 3 The “cross attention × L” shown in the figure is a feedforward network, and the feedforward network is a multilayer perceptron (MLP), with two of them distributed on two path branches, which process the information output by the cross self-attention network respectively. The following describes the process of the CrossFormer network performing feature cross-fusion on the RF features and network traffic features to obtain the device features of the device to be connected.

[0058] First, the extracted RF features and network traffic features are input into the cross-self-attention network for CLS-based cross-attention mechanism processing to obtain attention output information. Here, during cross-fusion, the RF features output by N encoder blocks and the network traffic features output by M encoder blocks are simultaneously input into L cross-attention modules. Since the RF features are encoded by the input patch sequence with the CLS label inserted, the encoded features of the CLS label represent the entire global features of the input patch sequence, that is, the entire RF features. Therefore, when inputting the feature fusion encoder, cross input is used to input the CLS encoded features in the RF features of the first path branch and the network traffic features (that is, the network layer information token encoding) of the other branch into the cross-attention module.

[0059] Specific as Figure 3 As shown, we first use the function f to calculate the query vector in the attention mechanism for the CLS encoding feature, and then use the query weight In order to reflect the crossover, the CLS encoding feature is combined with the network layer information token encoding to calculate the value vector and key vector in the attention mechanism, and the value authority is used to calculate the value vector and key vector respectively. With key weight They are weighted separately. The weighted query vector and the weighted value vector are multiplied, and the multiplication result is normalized by the softmax function. The normalized result is then multiplied by the weighted key vector. The multiplication result is merged with the query vector, and finally the function g calculates the attention calculation result of another path branch (network layer information token encoding). This attention calculation result is fused with the RF feature of the first path branch (ie, CSI information token encoding) as the input of the next cross-attention module. In this way, each cross-attention module repeats the above-mentioned CLS-based cross-attention mechanism processing process until the last cross-attention module among the L cross-attention modules is processed and the attention output information is obtained.

[0060] From the calculation process of the above cross-attention module, it can be seen that the CLS encoding feature of the first path branch (such as the path branch that processes CSI information) is first used to exchange information with the token encoding of the second path branch (such as the path branch that processes network layer information) to complete the attention calculation, and then the calculated attention calculation result is back-projected back to the first path branch as the input of the next cross-attention module. Since the CLS encoding feature has learned the feature information between all tokens in the first path branch, the interaction with the token encoding feature of the second path branch helps to fuse the information between different features. After being fused with the token encoding of the first path branch, the CLS encoding feature interacts with the token feature of the first path branch again at the next cross-attention module, thereby passing the feature information learned in other path branches back to its own token feature to enrich the feature representation of each token.

[0061] according to Figure 3 After the L cross-attention modules of the cross-self-attention network are processed, the RF features are finally cross-fused with the network process features, and the attention output information of the features is output. Then, the feedforward network in the feature fusion encoder is called to perform linear mapping on the attention output information to obtain the device features of the device to be connected. Here, the attention output information is input into the multi-layer perceptrons of the two path branches for linear mapping, and then the mapping results of the two path branches are merged to obtain the device features of the device to be connected. The merging process can be feature vector splicing or feature vector summation.

[0062] In addition, it should be noted that the CrossFormer network is trained through supervised learning and acts as a feature extractor, which learns to extract device features from communication packets of different device categories. In order to ensure the generalization ability of the network, a large amount of data is used during the training process to enable CrossFormer to adapt and recognize new device categories. After the training is completed, the classifier part is removed, and the output of the CrossFormer network is used as the device feature representation, which will then be used for subsequent device recognition tasks.

[0063] In the embodiment of the present invention, the radio frequency features and network traffic features of the communication data packets of the device to be connected are extracted through a dual-path feature extraction network, and cross-fused into device features for predicting the device type of the wireless communication network. In the process of extracting the device type of the wireless communication network, the radio frequency features and network traffic features are considered at the same time, which not only ensures the accuracy of device type identification but also improves the reliability, overcoming the shortcomings of the single feature prediction method in the prior art.

[0064] Continue to see Figure 1 In step 103, an integrated classifier based on Bayesian optimization is called to identify device features to obtain the device type of the device to be connected.

[0065] After the device features of the device to be connected are extracted in step 102, the device features are then used to perform the device identification task to identify the device type of the device to be connected. In order to improve the accuracy and efficiency of wireless communication network device type identification and to facilitate expansion to the identification of new device types, the present invention calls an integrated classifier based on Bayesian optimization to identify the device features, thereby determining the device type of the device to be connected.

[0066] Continue to see Figure 2 After CrossFormer extracts the device features, the extracted device features are used to integrate the learning of device identification, that is, the integrated classifier based on Bayesian optimization is used to identify the device features. The process of integrated learning can be seen in Figure 4 , Figure 4 is a process diagram of device identification based on device feature integration learning provided by the present invention. Figure 4 As shown, the integrated classifier based on Bayesian optimization includes K (K is an integer greater than 1) basic learning classifiers (referred to as base classifiers, such as Figure 4The base classifiers 1, 2, 3, ..., K shown in the figure are some machine learning classifiers such as random forest, support vector machine, decision tree, XGBoost, etc. The number of classifiers K can be determined according to the number of device types. The Bayesian optimization process uses Bayesian optimization technology to dynamically update the parameters of the basic learning classifiers. This is a global optimization strategy based on the Bayesian statistical principle, which can effectively adjust the classifier parameters to adapt to the changes in input features.

[0067] During the recognition process, the device features will be input into each basic learning classifier (i.e., base classifier), and the device features will be predicted and processed by the basic learning classifier to obtain the soft label of the device type. Here, each base classifier will predict the original probability distribution of the output device type, which is called a soft label.

[0068] Next, the soft label combination strategy is adopted to aggregate the soft labels corresponding to each base classifier to obtain an integrated feature vector. Here, each soft label is summarized and integrated into a feature vector, which brings together the prediction information of all base learners on the device category.

[0069] Then the secondary classifier is called to predict the integrated feature vector to obtain the device type of the device to be connected. Figure 4 As shown in the figure, the aggregated integrated feature vector is input into a secondary classifier (i.e. Figure 4 In the support vector machine shown in Figure 1, the secondary classifier will make a secondary prediction for the integrated feature vector and finally identify the classification result, that is, determine the device type of the device to be connected. During the secondary prediction process, the support vector machine can comprehensively utilize the prediction information from different base learners to make accurate device identification decisions.

[0070] Since the prediction information in the original probability distribution is retained in the secondary prediction process, information-free device identification is achieved, thereby further improving the accuracy and robustness of device type identification.

[0071] Continue to see Figure 1 In step 104, the device type is verified according to the preset white list to obtain a white list verification result, and the wireless communication network is accessed to the access device according to the white list verification result.

[0072] After identifying the device type of the device to be accessed, in order to ensure the completeness of the access of the wireless communication network device, the present invention sets up a whitelist mechanism, and determines a preset whitelist in advance. The whitelist needs to record the MAC address of the device that is allowed to access the network and its corresponding device type information. Because the device type of the device to be accessed has been aggregated according to the MAC address before the device type is identified. Therefore, the whitelist of the present invention directly lists the device types that are allowed to access the wireless network, and then verifies the identified device types according to the preset whitelist to obtain the whitelist verification result.

[0073] Specifically, when the device type identified by the access device exists in the preset whitelist, the access device is determined to be a quasi-access device, and the quasi-access device is used as the whitelist verification result. When the device type identified by the access device does not exist in the preset whitelist, the access device is determined to be a non-safe device, and the non-safe device is used as the whitelist verification result.

[0074] Here Figure 4 As shown, during the whitelist verification process, when it is determined that the device type identified by the access device exists on the whitelist, the access device is determined to be a whitelist device. When it is determined that the device type identified by the access device does not exist on the whitelist, the access device is determined to be a non-whitelist device.

[0075] Next, the wireless communication network access is performed on the access device according to the whitelist verification result. If the whitelist verification result is an access device, the access device can be accessed through the wireless communication network. If the whitelist verification result is an unsafe device, the access device is processed securely according to the preset security policy.

[0076] like Figure 4 As shown, when the whitelist verification result is a quasi-access device, that is, when the device to be accessed is a whitelist device, it means that the device to be accessed is a certified security device type, then it is determined that access to the wireless network is allowed, and the device to be accessed can be wirelessly accessed. When the whitelist verification result is a non-safe device, that is, when the device to be accessed is a non-whitelist device, it means that the device to be accessed is a dangerous device type, then the access device is securely processed according to the preset security policy. The preset security policy includes operations such as denying access, automatic alarm, and recording logs, so as to avoid network security problems. Among them, denying access can prevent wireless communication network devices from accessing the wireless communication network, automatic alarm can trigger the alarm mechanism to notify the management personnel for processing, and recording logs is to record the device type information that is denied access, which is convenient for the management personnel to analyze later to maintain the whitelist.

[0077] In the embodiment of the present invention, when a network device is accessed, the identified device type is verified according to a preset whitelist, and then the wireless communication network is accessed for the device to be accessed according to the verification result, which not only realizes efficient management of wireless communication network device access, but also further improves the security of device access.

[0078] The following describes the device identification and access apparatus based on radio frequency information and network traffic provided by the present invention. The device identification and access apparatus based on radio frequency information and network traffic described below and the device identification and access method based on radio frequency information and network traffic described above can be referenced to each other.

[0079] See also Figure 5 , Figure 5 Schematic diagram of the structure of the device identification and access device based on radio frequency information and network traffic provided by the present invention. Figure 5 As shown, the device identification and access apparatus based on radio frequency information and network traffic provided by the present invention specifically includes the following modules: feature extraction module 501, feature cross module 502, device identification module 503, and communication access module 504. Among them, the feature extraction module 501 is used to obtain the communication data packet of the device to be accessed, and call the dual-path feature extraction network to extract the features of the communication data packet to obtain the radio frequency features and network traffic features of the device to be accessed; the feature cross module 502 is used to perform feature cross fusion on the radio frequency features and the network traffic features to obtain the device features of the device to be accessed; the device identification module 503 is used to call the integrated classifier based on Bayesian optimization to identify the device features and obtain the device type of the device to be accessed; the communication access module 504 is used to verify the device type according to the preset white list, obtain the white list verification result, and perform wireless communication network access on the device to be accessed according to the white list verification result.

[0080] Figure 6 FIG. 1 is a schematic diagram of the physical structure of an electronic device provided by the present invention, such as Figure 6As shown, the electronic device may include: a processor 610, a communication interface 620, a memory 630 and a communication bus 640, wherein the processor 610, the communication interface 620 and the memory 630 communicate with each other through the communication bus 640. The processor 610 may call the logic instructions in the memory 630 to execute a device identification and access method based on radio frequency information and network traffic, the method comprising: obtaining a communication data packet of a device to be accessed, and calling a dual-path feature extraction network to extract features of the communication data packet to obtain radio frequency features and network traffic features of the device to be accessed; performing feature cross-fusion on the radio frequency features and the network traffic features to obtain device features of the device to be accessed; calling an integrated classifier based on Bayesian optimization to identify the device features to obtain the device type of the device to be accessed; verifying the device type according to a preset white list to obtain a white list verification result, and performing wireless communication network access on the device to be accessed according to the white list verification result.

[0081] In addition, the logic instructions in the above-mentioned memory 630 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0082] On the other hand, the present invention also provides a computer program product, which includes a computer program, and the computer program can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the device identification and access method based on radio frequency information and network traffic provided by the above methods, and the method includes: obtaining a communication data packet of the device to be accessed, and calling a dual-path feature extraction network to perform feature extraction on the communication data packet to obtain the radio frequency characteristics and network traffic characteristics of the device to be accessed; performing feature cross-fusion on the radio frequency characteristics and the network traffic characteristics to obtain the device characteristics of the device to be accessed; calling an integrated classifier based on Bayesian optimization to identify the device characteristics to obtain the device type of the device to be accessed; verifying the device type according to a preset whitelist to obtain a whitelist verification result, and performing wireless communication network access on the device to be accessed according to the whitelist verification result.

[0083] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute the device identification and access method based on radio frequency information and network traffic provided by the above-mentioned methods, the method comprising: obtaining a communication data packet of a device to be accessed, and calling a dual-path feature extraction network to perform feature extraction on the communication data packet to obtain the radio frequency features and network traffic features of the device to be accessed; performing feature cross-fusion on the radio frequency features and the network traffic features to obtain the device features of the device to be accessed; calling an integrated classifier based on Bayesian optimization to identify the device features to obtain the device type of the device to be accessed; verifying the device type according to a preset whitelist to obtain a whitelist verification result, and performing wireless communication network access on the device to be accessed according to the whitelist verification result.

[0084] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0085] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0086] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A device identification and access method based on radio frequency information and network traffic, characterized in that: The method comprises: Acquire a communication data packet of the device to be accessed, wherein the communication data packet includes CSI information and network layer information; Calling the first path network in the CrossFormer network to perform feature extraction on the CSI information to obtain the radio frequency features of the device to be connected; calling the second path network in the CrossFormer network to perform feature extraction on the network layer information to obtain the network traffic features of the device to be connected; Performing feature cross-fusion on the radio frequency feature and the network traffic feature to obtain device features of the device to be connected; Inputting the device features into a plurality of basic learning classifiers respectively, performing prediction processing on the device features through the basic learning classifiers, and obtaining soft labels of a plurality of device types; Aggregate the plurality of soft tags to obtain an integrated feature vector; Calling a secondary classifier to perform prediction processing on the integrated feature vector to obtain a device type of the device to be connected, wherein the device type has the same MAC address; The device type is verified according to a preset whitelist to obtain a whitelist verification result, and the wireless communication network is accessed to the device to be accessed according to the whitelist verification result.

2. The device identification and access method based on radio frequency information and network traffic according to claim 1 is characterized in that: The calling of the first path network in the CrossFormer network to extract features from the CSI information to obtain radio frequency features of the device to be connected includes: Dividing the CSI information into a first patch sequence, and inserting a CLS tag as a first patch into a header of the first patch sequence to obtain an input patch sequence; Performing linear projection on each patch in the input patch sequence to obtain a CSI information token of the patch; Determining a position feature of each of the patches in the input patch sequence; The location feature is fused with the CSI information token, and the fused token feature is input into the first path network for encoding processing to obtain the radio frequency feature of the device to be connected.

3. The device identification and access method based on radio frequency information and network traffic according to claim 1 is characterized in that: The CrossFormer network also includes a feature fusion encoder, which includes a cross self-attention network and a feedforward network. The cross-fusion of the radio frequency features and the network traffic features to obtain the device features of the device to be connected includes: Inputting the radio frequency feature and the network traffic feature into the cross self-attention network for CLS-based cross attention mechanism processing to obtain attention output information; The feedforward network is called to perform linear mapping processing on the attention output information to obtain device characteristics of the device to be connected.

4. The device identification and access method based on radio frequency information and network traffic according to claim 1 is characterized in that: The device type is verified according to the preset whitelist to obtain a whitelist verification result, including: When the device type exists in the preset whitelist, determining that the device to be accessed is a quasi-access device, and taking the quasi-access device as a whitelist verification result; When the device type does not exist in the preset whitelist, it is determined that the device to be connected is a non-secure device, and the non-secure device is used as a whitelist verification result.

5. The device identification and access method based on radio frequency information and network traffic according to claim 1 is characterized in that: The step of accessing the device to be accessed to a wireless communication network according to the whitelist verification result includes: When the whitelist verification result is a ready-to-access device, wireless communication access is performed on the device to be accessed; When the whitelist verification result is a non-safe device, the device to be connected is safely processed according to a preset security policy.

6. A device identification and access device based on radio frequency information and network traffic, characterized in that: The device comprises: A feature extraction module is used to obtain a communication data packet of a device to be connected, wherein the communication data packet includes CSI information and network layer information; call the first path network in the CrossFormer network to perform feature extraction on the CSI information to obtain the radio frequency feature of the device to be connected; call the second path network in the CrossFormer network to perform feature extraction on the network layer information to obtain the network traffic feature of the device to be connected; A feature cross-connect module, used to perform feature cross-connection fusion on the radio frequency feature and the network traffic feature to obtain the device feature of the device to be connected; A device identification module, used for inputting the device features into a plurality of basic learning classifiers respectively, and performing prediction processing on the device features through the basic learning classifiers to obtain soft labels of a plurality of device types; Aggregate the plurality of soft tags to obtain an integrated feature vector; Calling a secondary classifier to perform prediction processing on the integrated feature vector to obtain a device type of the device to be connected, wherein the device type has the same MAC address; The communication access module is used to verify the device type according to a preset white list, obtain a white list verification result, and perform wireless communication network access on the device to be accessed according to the white list verification result.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the device identification and access method based on radio frequency information and network traffic is implemented as described in any one of claims 1 to 5.

8. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the device identification and access method based on radio frequency information and network traffic is implemented as described in any one of claims 1 to 5.

Images