Terminal equipment classification method and system based on flow analysis

Abstract

The invention discloses a terminal equipment classification method and system based on flow analysis, which combines the feature extraction capability of CNN, the robustness of fuzzy decision and the focusing capability of an attention mechanism, classifies to-be-tested equipment based on network flow data, and improves the classification accuracy of the to-be-tested equipment. The method not only improves the accuracy and robustness of classification, but also enhances the interpretability and adaptability of the model, optimizes the calculation efficiency, and improves the user experience. Through the comprehensive method, the terminal equipment classification technology can better meet increasingly complex application requirements, and a solid foundation is laid for future intelligent system development.

Description

Technical Field

[0001] The present invention relates to the field of Internet technology, and in particular to a method and system for classifying terminal devices based on traffic analysis. Background Art

[0002] In the current network environment, the diversity of terminal devices is increasing, from traditional personal computers to smartphones, tablets, IoT devices, etc., each device has its own unique network behavior characteristics. Traditional device identification methods mainly rely on the physical identification of the device or manual configuration by the user, which are cumbersome and inflexible in a dynamically changing network environment. In addition, with the continuous evolution of network attack methods, accurately identifying and classifying terminal devices has become crucial for network security management.

[0003] Existing automatic identification technologies, such as those based on MAC addresses or IP addresses, are simple and easy to use, but are susceptible to changes in network configuration or address spoofing and cannot provide continuous and accurate device identification. Therefore, developing a method that can automatically and accurately identify the type of terminal devices, especially without the need for additional hardware support, has become an important research direction in the current network management field. Summary of the invention

[0004] The purpose of the present invention is to provide a terminal device classification method and system based on traffic analysis to solve the above-mentioned problems existing in the prior art.

[0005] An embodiment of the present invention provides a terminal device classification method based on traffic analysis, the method comprising:

[0006] Obtain network traffic data of the device under test;

[0007] The network traffic data is input into a pre-trained device prediction network, and the device prediction network extracts network traffic data features to obtain network traffic features; a prediction probability vector is obtained based on the network traffic features, and the prediction probability vector includes multiple prediction probability values, and each prediction probability value corresponds to a device type;

[0008] Convert network traffic features into fuzzy values;

[0009] Perform fuzzy reasoning on the fuzzy value to obtain a reasoning probability vector, the reasoning probability vector includes multiple reasoning probability values, and each reasoning probability value corresponds to a device type;

[0010] Obtain an attention weight vector based on the prediction probability vector and the inference probability vector; adjust the prediction probability vector based on the attention weight vector to obtain a device classification probability vector; the device classification probability vector includes multiple classification probability values, each classification probability value corresponds to a device type;

[0011] The device type corresponding to the largest classification probability value in the device classification probability vector is taken as the type of the device to be tested.

[0012] Optionally, the training method of the device prediction network includes:

[0013] The device prediction network includes an input layer, multiple convolutional layers, multiple pooling layers, a fully connected layer, and an output layer. Multiple convolutional layers and multiple pooling layers are cross-set.

[0014] A training set is obtained, the training set includes network traffic data of multiple training devices; the multiple training devices include training devices of different device types, and each training device is pre-labeled with a device type; each device type corresponds to a device label value; the device label values ​​of the multiple training devices constitute a training type vector;

[0015] Perform data alignment processing on the training set through the input layer to obtain aligned training data;

[0016] Align the training data through the convolution layer to perform convolution operations and obtain convolution features;

[0017] The convolution data is pooled through the pooling layer to obtain the pooling number features;

[0018] The pooled number features are converted into training prediction vectors through the fully connected layer, and the training prediction vectors are output through the output layer; the training prediction vectors include multiple training probabilities, each training probability corresponds to a device type; the training prediction vectors correspond to the training devices one by one;

[0019] Convert the pooled data features into training fuzzy values;

[0020] Perform fuzzy reasoning on the training fuzzy value to obtain a training reasoning vector; the training reasoning vector includes multiple training probability values, each training probability value corresponds to a device type; the training reasoning vector corresponds to the training device one by one;

[0021] Obtain a training attention weight vector based on the training prediction vector and the training inference vector; adjust the training prediction probability vector based on the training attention weight vector to obtain a training device classification probability vector; the training device classification probability vector includes multiple training classification probability values, each training classification probability value corresponds to a device type; the training device classification probability vector corresponds to the training device one by one;

[0022] Obtaining a model loss function based on the classification probability vector of the training device;

[0023] If the model loss function converges, it is determined that the device prediction network training is completed.

[0024] Optionally, a model loss function is obtained based on the classification probability vector of the training device, including:

[0025] A plurality of training device classification probability vectors are obtained corresponding to the plurality of training devices; the plurality of training device classification probability vectors are used as columns of a training prediction probability matrix to form a training prediction probability matrix;

[0026] Obtain the correlation index between the training type vector and the training prediction probability matrix;

[0027] The correlation index is used as the loss function.

[0028] Optionally, obtain the correlation index between the training type vector and the training prediction probability matrix, including:

[0029] The information entropy of each column of the training type vector and the training prediction probability matrix is ​​obtained, and each column of the training prediction probability matrix corresponds to an information entropy; if the training prediction probability matrix has multiple rows, multiple information entropies are obtained correspondingly;

[0030] The mean of multiple information entropies is used as the correlation index.

[0031] Optionally, a training attention weight vector is obtained based on the training prediction vector and the training inference vector, including:

[0032] Get the dot product similarity between the training prediction vector and the training inference vector: S(i, j) = P i I j , where P i Represents the i-th element of the training prediction vector, I j represents the jth element of the training inference vector, and the values ​​of i and j are positive integers; S(i, j) represents the dot product similarity between the i-th element of the training prediction vector and the j-th element of the training inference vector; the attention score is obtained based on the dot product similarity: A(i, j) = f(S(i, j)), where A(i, j) is the attention score between the i-th element of the training prediction vector and the j-th element of the training inference vector; f(S(i, j)) is the RELU function;

[0033] Normalized weights: Among them, α j is the jth element of the training inference vector I j The attention weight of k is 1, 2, ..., N, where N is the number of elements in the training reasoning vector; N is a positive integer;

[0034] A training attention weight vector is formed by taking multiple normalized weights as elements of the training attention weight vector.

[0035] Optionally, adjusting the training prediction probability vector based on the training attention weight vector to obtain the training device classification probability vector includes:

[0036] Perform a cross product operation on the training attention weight vector and the training prediction probability vector to obtain the training device classification probability vector.

[0037] The embodiment of the present invention further provides a terminal device classification system based on traffic analysis, the system comprising:

[0038] An acquisition module is used to obtain network traffic data of the device under test;

[0039] A prediction module is used to input network traffic data into a pre-trained device prediction network, and the device prediction network extracts network traffic data features to obtain network traffic features; based on the network traffic features, a prediction probability vector is obtained, and the prediction probability vector includes multiple prediction probability values, each of which corresponds to a device type;

[0040] A classification module is used to convert network traffic features into fuzzy values; perform fuzzy reasoning on the fuzzy values ​​to obtain an inference probability vector, the inference probability vector includes multiple inference probability values, and each inference probability value corresponds to a device type; obtain an attention weight vector based on the prediction probability vector and the inference probability vector; adjust the prediction probability vector based on the attention weight vector to obtain a device classification probability vector; the device classification probability vector includes multiple classification probability values, and each classification probability value corresponds to a device type; the device type corresponding to the largest classification probability value in the device classification probability vector is used as the type of the device to be tested.

[0041] Optionally, in the terminal device classification system based on traffic analysis, the training method of the device prediction network includes:

[0042] The device prediction network includes an input layer, multiple convolutional layers, multiple pooling layers, a fully connected layer, and an output layer. Multiple convolutional layers and multiple pooling layers are cross-set.

[0043] A training set is obtained, the training set includes network traffic data of multiple training devices; the multiple training devices include training devices of different device types, and each training device is pre-labeled with a device type; each device type corresponds to a device label value; the device label values ​​of the multiple training devices constitute a training type vector;

[0044] Perform data alignment processing on the training set through the input layer to obtain aligned training data;

[0045] Align the training data through the convolution layer to perform convolution operations and obtain convolution features;

[0046] The convolution data is pooled through the pooling layer to obtain the pooling number features;

[0047] The pooled number features are converted into training prediction vectors through the fully connected layer, and the training prediction vectors are output through the output layer; the training prediction vectors include multiple training probabilities, each training probability corresponds to a device type; the training prediction vectors correspond to the training devices one by one;

[0048] Convert the pooled data features into training fuzzy values;

[0049] Perform fuzzy reasoning on the training fuzzy value to obtain a training reasoning vector; the training reasoning vector includes multiple training probability values, each training probability value corresponds to a device type; the training reasoning vector corresponds to the training device one by one;

[0050] Obtain a training attention weight vector based on the training prediction vector and the training inference vector; adjust the training prediction probability vector based on the training attention weight vector to obtain a training device classification probability vector; the training device classification probability vector includes multiple training classification probability values, each training classification probability value corresponds to a device type; the training device classification probability vector corresponds to the training device one by one;

[0051] Obtaining a model loss function based on the classification probability vector of the training device;

[0052] If the model loss function converges, it is determined that the device prediction network training is completed.

[0053] Optionally, in a terminal device classification system based on traffic analysis, a model loss function is obtained based on a training device classification probability vector, including:

[0054] A plurality of training device classification probability vectors are obtained corresponding to the plurality of training devices; the plurality of training device classification probability vectors are used as columns of a training prediction probability matrix to form a training prediction probability matrix;

[0055] Obtain the correlation index between the training type vector and the training prediction probability matrix;

[0056] The correlation index is used as the loss function.

[0057] Optionally, in the terminal device classification system based on traffic analysis, obtaining a correlation index between the training type vector and the training prediction probability matrix includes:

[0058] The information entropy of each column of the training type vector and the training prediction probability matrix is ​​obtained, and each column of the training prediction probability matrix corresponds to an information entropy; if the training prediction probability matrix has multiple rows, multiple information entropies are obtained correspondingly;

[0059] The mean of multiple information entropies is used as the correlation index.

[0060] Compared with the prior art, the embodiments of the present invention achieve the following beneficial effects:

[0061] The embodiment of the present invention provides a terminal device classification method and system based on traffic analysis, the method comprising: by combining the feature extraction capability of CNN, the robustness of fuzzy decision and the focusing capability of attention mechanism, classifying the device to be tested based on network traffic data, thereby improving the accuracy of classification of the device to be tested, specifically: obtaining network traffic data of the device to be tested; inputting the network traffic data into a pre-trained device prediction network, the device prediction network extracts features of the network traffic data to obtain network traffic features; obtaining a prediction probability vector based on the network traffic features, the prediction probability vector includes multiple prediction probability values, each prediction probability value corresponds to a device type; converting the network traffic features into fuzzy values; performing fuzzy reasoning on the fuzzy values ​​to obtain an inference probability vector, the inference probability vector includes multiple inference probability values, each inference probability value corresponds to a device type; obtaining an attention weight vector based on the prediction probability vector and the inference probability vector; adjusting the prediction probability vector based on the attention weight vector to obtain a device classification probability vector; the device classification probability vector includes multiple classification probability values, each classification probability value corresponds to a device type; taking the device type corresponding to the largest classification probability value in the device classification probability vector as the type of the device to be tested. It not only improves the accuracy and robustness of classification, but also enhances the interpretability and adaptability of the model, optimizes computing efficiency, and improves user experience. Through this comprehensive approach, terminal device classification technology can better cope with increasingly complex application requirements and lay a solid foundation for the development of future intelligent systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] Figure 1 It is a flow chart of a terminal device classification method based on traffic analysis provided by an embodiment of the present invention.

[0063] Figure 2 It is a schematic diagram of the structure of an electronic device provided by an embodiment of the present invention.

[0064] Markings in the figure: 500 - bus; 501 - receiver; 502 - processor; 503 - transmitter; 504 - memory; 505 - bus interface. DETAILED DESCRIPTION

[0065] The present invention will be described in detail below in conjunction with the accompanying drawings.

[0066] Example

[0067] The embodiment of the present invention relates to a terminal device classification method based on traffic analysis, which realizes automatic classification of terminal devices by analyzing characteristic data in network traffic. The method uses advanced data mining technology and machine learning algorithms to accurately identify different types of terminal devices, such as smart phones, tablet computers, laptops, etc., thereby improving the efficiency and security of network management.

[0068] Specifically, the embodiment of the present invention provides a terminal device classification method based on traffic analysis, such as Figure 1 As shown, the method includes:

[0069] S101: Obtain network traffic data of the device under test. Network traffic data can be captured by network monitoring tools such as network sniffers and network analyzers (such as Wireshark, tcpdump, etc.). Network traffic data includes traffic packet size (traffic value), traffic direction, timestamp, protocol type, etc. Optionally, network traffic data includes: basic traffic information, traffic characteristics, timestamp, traffic session information, application layer data, traffic type, common traffic and security events, and QoS (quality of service) indicators, etc.

[0070] Basic traffic information: Source IP address: the IP address of the device that sends the data packet. Destination IP address: the IP address of the device that receives the data packet. Source port: the port number of the data sent. Destination port: the port number of the data received. Protocol type: such as TCP, UDP, ICMP, etc. Traffic characteristics: Packet size: the number of bytes in each packet. Traffic rate: the amount of data transmitted per unit time (such as bps, Kbps, Mbps). Traffic direction: the direction of the data flow, such as inbound (download) and outbound (upload). Timestamp: Capture time: the time when the data packet is captured. Session duration: the length of time from the establishment to the end of a session. Traffic session information: Session ID: an ID that uniquely identifies a network session. Session status: such as establishment, termination, activity, etc. Transmission control information: such as TCP handshake, connection closure, etc. Application layer data: URL: the address of the web page visited. HTTP header information: header information in the request and response. DNS query and response: domain name resolution request and its results. Traffic type: application type: such as web traffic, FTP, streaming media, VoIP, etc. User agent information: client information such as browser and operating system. Abnormal traffic and security events: Abnormal traffic patterns: Detected abnormal traffic (such as sudden increase in traffic). Attack patterns: Identified network attacks (such as DDoS, scanning, etc.). QoS (quality of service) indicators: Latency: The delay in data transmission from source to destination. Packet loss rate: The proportion of data packets lost during transmission. Jitter, etc.

[0071] S102: Input the network traffic data into a pre-trained device prediction network, and the device prediction network extracts network traffic data features to obtain network traffic features; obtain a prediction probability vector based on the network traffic features. The prediction probability vector includes multiple prediction probability values, wherein each prediction probability value corresponds to a device type.

[0072] In the embodiment of the present invention, features are extracted from the original network traffic data. Common features include: number of packets, number of bytes, average packet size, etc. Time series features of traffic, such as peak hours of traffic, etc. Usage of specific protocols (such as HTTP, FTP, etc.).

[0073] S103: Convert network traffic characteristics into fuzzy values.

[0074] Specifically, S103 includes: defining fuzzy rules: defining fuzzy rules according to traffic characteristics, for example, "if the packet size is large and the protocol is HTTP, the device type may be a PC".

[0075] Definition of fuzzy sets: define fuzzy sets for each feature and set membership functions (such as triangular or trapezoidal membership functions). That is, define fuzzy sets for each input and output variable. For example:

[0076] Input: Traffic size can be defined as "small", "medium", or "large".

[0077] Output: Device type can be defined as "mobile phone", "computer", "IoT device", etc.

[0078] Rule example: If the traffic size is small (the traffic size is less than the threshold, the threshold value is 20G) and the protocol is HTTP, then the device type is a mobile phone. If the traffic size is large (the traffic size is greater than the threshold, the threshold value is 20G) and the protocol is TCP, then the device type is a computer.

[0079] Definition of Inference Engine: Uses fuzzy reasoning mechanisms (such as Mamdani or Sugeno methods) to combine fuzzy rules and arrive at decisions.

[0080] S104: Perform fuzzy reasoning on the fuzzy value to obtain a reasoning probability vector. The reasoning probability vector includes multiple reasoning probability values, each of which corresponds to a device type.

[0081] Among them, the fuzzy rules are combined with the fuzzy input using the fuzzy reasoning mechanism, which usually includes the following steps:

[0082] Rule evaluation: Evaluate each fuzzy rule. Calculate the activation degree of each rule (i.e., the degree to which the condition is satisfied), usually using minimum or multiplication to combine the input membership. For example: for "if the traffic size is small and the protocol is HTTP", calculate the minimum value of the membership of the traffic size and protocol as the activation degree of the rule.

[0083] Fuzzy reasoning: The fuzzy value of the output is determined according to the degree of activation of the rule. For example: The fuzzy value of the output is determined according to the degree of activation of the rule. For each rule's activation degree, it is combined with the fuzzy set of the corresponding output. Commonly used combination methods include: Mamdani reasoning: For each rule, the activation degree (such as the minimum value) is used to scale the output membership function. For example: If the membership of the traffic size is "small" is 0.7, and the rule is "If the traffic is small and the protocol is HTTP, then the device type is mobile phone", then the membership function of the output "mobile phone" will be fuzzified according to 0.7. Sugeno reasoning: In the Sugeno model, the output is a linear combination or constant, and the output value is usually given directly after the rule is activated without fuzzification.

[0084] Aggregate output: Aggregate the output fuzzy values ​​of all rules. Common aggregation methods include:

[0085] Maximum method: For each output variable, select the maximum value of all rule output memberships as the membership of the final output. Weighted average method: The output values ​​of all rules are weighted averaged to obtain the final fuzzy output. Defuzzification: Convert the aggregated fuzzy output to an exact value. Common defuzzification methods include: Centroid method: Calculate the centroid of the fuzzy output membership function to obtain the final output value. The centroid method is one of the most commonly used methods because it can effectively handle complex fuzzy outputs. Maximum membership method: Select the output value with the maximum membership as the final result.

[0086] Let’s take an example to explain the implementation process of the above technical solution in detail:

[0087] 1. Data preparation:

[0088] Collects data related to network traffic, including the following characteristics: Traffic characteristics: packet size, transmission rate, transmission protocol, etc. Session information: source IP, destination IP, source port, destination port, session duration, etc. Application layer data: HTTP requests, domain name queries, etc.

[0089] 2. Feature extraction:

[0090] Extract features from raw network traffic data. Common features include: number of packets, number of bytes, average packet size, etc. Time series features of traffic, such as peak hours of traffic, etc. Usage of specific protocols (such as HTTP, FTP, etc.).

[0091] 3. Fuzzy logic system design:

[0092] Designing a fuzzy logic system involves the following steps:

[0093] Define input and output variables: Input variables: traffic characteristics (such as packet size, traffic rate, etc.) Output variables: probability of device type (such as the probability that the device type is a mobile phone, computer, IoT device).

[0094] Fuzzification: Convert input features into fuzzy values. For example, classify packet sizes into "small", "medium", and "large", and traffic rates into "low", "medium", and "high".

[0095] Build fuzzy rules: Create fuzzy rules to define the relationship between input and output. For example: If "packet size is large" and "traffic rate is high", then the probability of "device type is computer" is high. If "packet size is small" and "traffic rate is low", then the probability of "device type is mobile phone" is high.

[0096] 4. Reasoning:

[0097] The output is calculated using fuzzy reasoning methods (such as Mamdani reasoning or Sugeno reasoning): the input is reasoned according to the fuzzy rules to obtain the fuzzy value of each device type.

[0098] 5. Defuzzification:

[0099] Convert fuzzy output to specific probability value: Use defuzzification method (such as centroid method) to convert fuzzy output to certain probability value. For example, the device continues to predict the network traffic data characteristics through fuzzy decision and obtain the device type probability as follows:

[0100] To convert the fuzzy output into a specific probability value, the following steps can be taken:

[0101] Select the defuzzification method: Centroid Method: Calculates the centroid of the fuzzy output to get a specific value, which can be used as the probability of each device type. Max Membership Method: Selects the output value with the largest membership as the final result.

[0102] Calculate probability: For each device type, calculate the corresponding probability based on the inference results. For example, for the three output categories of "mobile phone", "computer" and "IoT device", get the corresponding probability values.

[0103] 6. Output results:

[0104] The final output will be a probability distribution, indicating the probability of the device type corresponding to the network traffic data. For example:

[0105] The probability of device type "mobile phone" is 0.70. The probability of device type "computer" is 0.20. The probability of device type "IoT device" is 0.10. These probability values ​​form an inference probability vector.

[0106] Optionally, the method further includes:

[0107] 7. Model evaluation and optimization:

[0108] Evaluate model performance: Use methods such as cross-validation to evaluate the performance of the fuzzy decision model and calculate indicators such as accuracy, recall, and F1-score.

[0109] Optimize fuzzy rules: Based on the evaluation results, adjust the fuzzy rules, input features, and membership functions to improve the accuracy and robustness of the model.

[0110] 8. Application and deployment:

[0111] The trained fuzzy decision model is applied to the real-time network traffic monitoring system to analyze and predict the device type in real time.

[0112] Models are updated regularly to adapt to changes in network traffic characteristics and the emergence of new device types.

[0113] As an example:

[0114] Assume that there are the following feature data:

[0115] Packet size: 1500 bytes; traffic rate: 200kbps.

[0116] These characteristics can be fuzzified into: Packet size: Large. Traffic rate: Medium.

[0117] Based on the set fuzzy rules, it may be deduced that if the packet size is "large" and the traffic rate is "medium", then the probability that the device type is "computer" may be derived.

[0118] S105: Obtain an attention weight vector based on the prediction probability vector and the inference probability vector; adjust the prediction probability vector based on the attention weight vector to obtain a device classification probability vector, wherein the device classification probability vector includes multiple classification probability values, each of which corresponds to a device type.

[0119] Specifically, the dot product similarity between the predicted probability vector and the inference probability vector is obtained; the attention score is obtained based on the dot product similarity between the predicted probability vector and the inference probability vector. The weights are normalized, and then the attention weight vector is formed with multiple normalized weights as elements of the attention weight vector. A cross multiplication operation is performed on the attention weight vector and the predicted probability vector to obtain a device classification probability vector. For specific implementation methods, please refer to the description of the part of obtaining the model loss function based on the training device classification probability vector in the training method of the device prediction network described below.

[0120] S106: Taking the device type corresponding to the largest classification probability value in the device classification probability vector as the type of the device to be tested.

[0121] Among them, the training method of the device prediction network includes:

[0122] The device prediction network includes an input layer, multiple convolutional layers, multiple pooling layers, a fully connected layer and an output layer, and multiple convolutional layers and multiple pooling layers are cross-set.

[0123] A training set is obtained, where the training set includes network traffic data of multiple training devices; the multiple training devices include training devices of different device types, and each training device is pre-labeled with a device type; each device type corresponds to a device label value; the device label values ​​of the multiple training devices constitute a training type vector; for example, the device label values ​​of mobile phones, computers, and IoT devices in the device type are 1, 2, and 3, respectively.

[0124] The training set is processed by the input layer to align the data and obtain the aligned training data. Specifically, it includes: Resampling: resampling the network traffic data in the training set to the same time interval. For example, using the mean, sum or interpolation method to fill the missing values. Interpolation: using linear interpolation, spline interpolation and other methods to fill the missing values. Timestamp alignment: ensure that all network traffic data have the same timestamp, and can be aligned by interpolation or other methods if necessary.

[0125] The convolution layer aligns the training data and performs convolution operations to obtain convolution features. The pooling layer performs pooling operations on the convolution data to obtain pooling data features.

[0126] The output of each convolution layer is used as the input of the next pooling layer, and the output of the pooling layer is used as the input of the next convolution layer. For example, if there are 3 convolution layers and 3 pooling layers, the input of the first convolution layer is the aligned training data, the input of the first pooling layer is the output of the first convolution layer, the input of the second convolution layer is the output of the first pooling layer, the input of the second pooling layer is the output of the second convolution layer, the input of the third convolution layer is the output of the second pooling layer, and the input of the third pooling layer is the output of the third convolution layer.

[0127] The pooled number features are converted into training prediction vectors through the fully connected layer, and the training prediction vectors are output through the output layer; the training prediction vectors include multiple training probabilities, each training probability corresponds to a device type; the training prediction vectors correspond to the training devices one by one.

[0128] That is, the output of the third pooling layer (pooled number features) is converted into a training prediction vector through a fully connected layer. Specifically, the pooled number features can be classified (specifically, a convolutional neural network can be used for classification), and then a dimensionality reduction operation is performed to obtain a training prediction vector.

[0129] The pooled data features are converted into training fuzzy values. Fuzzy reasoning is performed on the training fuzzy values ​​to obtain a training reasoning vector; the training reasoning vector includes multiple training probability values, each training probability value corresponds to a device type; the training reasoning vector corresponds to the training device one by one. The specific method can refer to the above method, which will not be repeated here.

[0130] A training attention weight vector is obtained based on the training prediction vector and the training inference vector; and a training prediction probability vector is adjusted based on the training attention weight vector to obtain a training device classification probability vector. The training device classification probability vector includes multiple training classification probability values, each of which corresponds to a device type. The training device classification probability vector corresponds to the training device one-to-one.

[0131] The model loss function is obtained based on the classification probability vector of the training device. If the model loss function converges, it is determined that the training of the device prediction network is completed.

[0132] The model loss function is obtained based on the classification probability vector of the training device, including:

[0133] A plurality of training device classification probability vectors are obtained corresponding to the plurality of training devices; the plurality of training device classification probability vectors are used as columns of the training prediction probability matrix to form the training prediction probability matrix. A correlation index between the training type vector and the training prediction probability matrix is ​​obtained. The correlation index is used as the loss function.

[0134] Specifically, the correlation index between the training type vector and the training prediction probability matrix is ​​obtained, including:

[0135] Obtain the information entropy (or cross entropy) of the training type vector and each column of the training prediction probability matrix. Each column of the training prediction probability matrix corresponds to obtaining one information entropy; if the training prediction probability matrix has multiple rows, multiple information entropies are obtained correspondingly;

[0136] The mean of multiple information entropies is used as the correlation index.

[0137] As a further step, a training attention weight vector is obtained based on the training prediction vector and the training inference vector, including:

[0138] Get the dot product similarity between the training prediction vector and the training inference vector: S(i, j) = P i I j , where P i Represents the i-th element of the training prediction vector, I j represents the jth element of the training inference vector, i and j are positive integers; S(i, j) represents the dot product similarity between the i-th element of the training prediction vector and the j-th element of the training inference vector;

[0139] Attention scores are obtained based on dot product similarity: A(i, j) = f(S(i, j)), where A(i, j) is the attention score of the i-th element of the training prediction vector and the j-th element of the training inference vector; f(S(i, j)) is the RELU function;

[0140] Normalized weights: Among them, α j is the jth element of the training inference vector I j The attention weight of k is 1, 2, ..., N, where N is the number of elements in the training reasoning vector; N is a positive integer;

[0141] A training attention weight vector is formed by taking multiple normalized weights as elements of the training attention weight vector.

[0142] Finally, the training prediction probability vector is adjusted based on the training attention weight vector to obtain the training device classification probability vector. Specifically, a cross multiplication operation is performed on the training attention weight vector and the training prediction probability vector to obtain the training device classification probability vector.

[0143] This application adopts the terminal device classification method based on traffic analysis, combined with Convolutional Neural Network (CNN), fuzzy decision and attention mechanism to show many beneficial effects in terminal device classification. The following is a detailed description of these effects:

[0144] 1. Improve classification accuracy: Feature extraction and selection: CNN's powerful feature extraction capabilities combined with the attention mechanism can automatically identify and focus on the most discriminative features. This combination reduces the interference of irrelevant features, thereby improving classification accuracy. Dealing with ambiguity: Fuzzy decision-making can effectively handle overlap and uncertainty between categories. When there are fuzzy labels in the input data, the model can still make reasonable judgments through fuzzy logic.

[0145] 2. Enhance model robustness: Anti-interference ability to noise and deformation: CNN has strong robustness to noise and deformation in input data. After combining with fuzzy logic, the model can operate more stably in the face of uncertainty and changes. Dynamic adaptability: The attention mechanism enables the model to dynamically adjust the feature area of ​​interest according to different inputs, improving the adaptability of classification in various environments.

[0146] 3. Improve decision explainability: Enhance model transparency: The fuzzy decision system can provide a clear explanation of the decision-making process, improve classification accuracy, help users understand why the model classifies a terminal device into a specific category, and enhance user trust.

[0147] 4. Optimize computational efficiency: Reduce redundant computation: The attention mechanism can automatically filter key information during processing, reduce the computation of unnecessary features, and improve the overall efficiency of the model. Speed ​​up training: By focusing on important features, the model converges faster during training, thereby speeding up the use of training time and resources.

[0148] 5. Support multimodal data processing and integration of multiple data sources: Combining CNN and attention mechanism, it can effectively process multimodal data (such as images, text and sensor data) to provide a more comprehensive perspective and information for terminal device classification. This multimodal processing capability enables the model to comprehensively utilize data from different sources when facing complex scenarios, improving the accuracy and reliability of classification.

[0149] 6. Improve adaptability and flexibility: Multi-scenario application: The new method combining fuzzy decision-making and attention mechanism can be flexibly applied to the classification of various types of terminal devices, adapting to the needs in different fields (such as smart homes, industrial equipment, mobile terminals, etc.). Real-time update capability: Due to the flexibility of fuzzy decision-making, the model can be quickly adjusted according to new data and rules, continuously optimizing classification performance and adapting to the rapid development and changes of technology.

[0150] 7. Enhance user experience: Intelligent recommendations and personalized services: Through more accurate classification, the system can provide users with more personalized recommendations and services, improving user experience. Reduce the risk of misjudgment: The introduction of fuzzy decision-making reduces misjudgments caused by uncertainty, enhances the reliability of classification results, and enables users to rely on the judgment of the system more confidently.

[0151] In summary, the method of combining CNN, fuzzy decision and attention mechanism to classify terminal devices shows significant advantages in terminal device classification. This method not only improves the accuracy and robustness of classification, but also enhances the interpretability and adaptability of the model, optimizes computational efficiency, and improves user experience. Through this comprehensive approach, terminal device classification technology can better cope with increasingly complex application requirements and lay a solid foundation for the development of future intelligent systems.

[0152] Based on the above-mentioned terminal device classification method based on traffic analysis, an embodiment of the present invention provides a terminal device classification system based on traffic analysis, the system comprising:

[0153] An acquisition module is used to obtain network traffic data of the device under test;

[0154] A prediction module is used to input network traffic data into a pre-trained device prediction network, and the device prediction network extracts network traffic data features to obtain network traffic features; based on the network traffic features, a prediction probability vector is obtained, and the prediction probability vector includes multiple prediction probability values, each of which corresponds to a device type;

[0155] A classification module is used to convert network traffic features into fuzzy values; perform fuzzy reasoning on the fuzzy values ​​to obtain an inference probability vector, the inference probability vector includes multiple inference probability values, and each inference probability value corresponds to a device type; obtain an attention weight vector based on the prediction probability vector and the inference probability vector; adjust the prediction probability vector based on the attention weight vector to obtain a device classification probability vector; the device classification probability vector includes multiple classification probability values, and each classification probability value corresponds to a device type; the device type corresponding to the largest classification probability value in the device classification probability vector is used as the type of the device to be tested.

[0156] Optionally, in the terminal device classification system based on traffic analysis, the training method of the device prediction network includes:

[0157] The device prediction network includes an input layer, multiple convolutional layers, multiple pooling layers, a fully connected layer, and an output layer. Multiple convolutional layers and multiple pooling layers are cross-set.

[0158] A training set is obtained, the training set includes network traffic data of multiple training devices; the multiple training devices include training devices of different device types, and each training device is pre-labeled with a device type; each device type corresponds to a device label value; the device label values ​​of the multiple training devices constitute a training type vector;

[0159] Perform data alignment processing on the training set through the input layer to obtain aligned training data;

[0160] Align the training data through the convolution layer to perform convolution operations and obtain convolution features;

[0161] The convolution data is pooled through the pooling layer to obtain the pooling number features;

[0162] The pooled number features are converted into training prediction vectors through the fully connected layer, and the training prediction vectors are output through the output layer; the training prediction vectors include multiple training probabilities, each training probability corresponds to a device type; the training prediction vectors correspond to the training devices one by one;

[0163] Convert the pooled data features into training fuzzy values;

[0164] Perform fuzzy reasoning on the training fuzzy value to obtain a training reasoning vector; the training reasoning vector includes multiple training probability values, each training probability value corresponds to a device type; the training reasoning vector corresponds to the training device one by one;

[0165] Obtain a training attention weight vector based on the training prediction vector and the training inference vector; adjust the training prediction probability vector based on the training attention weight vector to obtain a training device classification probability vector; the training device classification probability vector includes multiple training classification probability values, each training classification probability value corresponds to a device type; the training device classification probability vector corresponds to the training device one by one;

[0166] Obtaining a model loss function based on the classification probability vector of the training device;

[0167] If the model loss function converges, it is determined that the device prediction network training is completed.

[0168] The specific implementation of the functions of each module of the above system is as described in the terminal device classification method based on traffic analysis above, and will not be repeated here.

[0169] The embodiment of the present invention also provides an electronic device for integrating the above-mentioned terminal device classification system based on traffic analysis, such as Figure 2 As shown, the electronic device includes a memory 504, a processor 502, and a computer program stored in the memory 504 and executable on the processor 502. When the processor 502 executes the program, the steps of any of the terminal device classification methods based on traffic analysis described above are implemented.

[0170] Among them, Figure 2In the embodiment of the present invention, a bus architecture (represented by bus 500) is shown, which may include any number of interconnected buses and bridges, and bus 500 links various circuits including one or more processors represented by processor 502 and memory represented by memory 504. Bus 500 may also link various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. Bus interface 505 provides an interface between bus 500 and receiver 501 and transmitter 503. Receiver 501 and transmitter 503 may be the same element, namely a transceiver, providing a unit for communicating with various other devices over a transmission medium. Processor 502 is responsible for managing bus 500 and general processing, while memory 504 may be used to store data used by processor 502 when performing operations.

[0171] An embodiment of the present invention further provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the program implements the steps of any method of the terminal device classification method based on traffic analysis described above.

[0172] The algorithm and display provided herein are not inherently related to any particular computer, virtual system or other device. Various general purpose systems can also be used together with the teachings based on this. According to the above description, it is obvious that the structure required for constructing such systems. In addition, the present invention is not directed to any specific programming language either. It should be understood that various programming languages ​​can be utilized to realize the content of the present invention described herein, and the description of the above specific languages ​​is for disclosing the best mode of the present invention.

[0173] In the description provided herein, a large number of specific details are described. However, it is understood that embodiments of the present invention can be practiced without these specific details. In some instances, well-known methods, structures and techniques are not shown in detail so as not to obscure the understanding of this description.

[0174] Similarly, it should be understood that in order to streamline the present disclosure and aid in understanding one or more of the various inventive aspects, in the above description of exemplary embodiments of the present invention, various features of the present invention are sometimes grouped together into a single embodiment, figure, or description thereof. However, this disclosed method should not be interpreted as reflecting the intention that the claimed invention requires more features than those explicitly recited in each claim. More specifically, as reflected in the claims below, inventive aspects lie in less than all the features of the individual embodiments disclosed above. Therefore, the claims that follow the specific embodiment are hereby expressly incorporated into the specific embodiment, with each claim itself serving as a separate embodiment of the present invention.

[0175] Those skilled in the art will appreciate that the modules in the devices in the embodiments may be adaptively changed and arranged in one or more devices different from the embodiments. The modules or units or components in the embodiments may be combined into one module or unit or component, and in addition they may be divided into a plurality of submodules or subunits or subcomponents. Except that at least some of such features and / or processes or units are mutually exclusive, all features disclosed in this specification (including the accompanying claims, abstracts and drawings) and all processes or units of any method or device disclosed in this manner may be combined in any combination. Unless otherwise expressly stated, each feature disclosed in this specification (including the accompanying claims, abstracts and drawings) may be replaced by an alternative feature providing the same, equivalent or similar purpose.

[0176] In addition, those skilled in the art will appreciate that, although some embodiments herein include certain features included in other embodiments but not other features, the combination of features of different embodiments is meant to be within the scope of the present invention and form different embodiments. For example, in the claims below, any one of the claimed embodiments may be used in any combination.

[0177] The various component embodiments of the present invention may be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. It should be understood by those skilled in the art that a microprocessor or digital signal processor (DSP) may be used in practice to implement some or all of the functions of some or all of the components in the apparatus according to an embodiment of the present invention. The present invention may also be implemented as a device or device program (e.g., a computer program and a computer program product) for executing part or all of the methods described herein. Such a program implementing the present invention may be stored on a computer-readable medium, or may have the form of one or more signals. Such a signal may be downloaded from an Internet website, or provided on a carrier signal, or provided in any other form.

Claims

1. A terminal device classification method based on traffic analysis, It is characterized in that The method comprises: Obtain network traffic data of the device under test; The network traffic data is input into a pre-trained device prediction network, and the device prediction network extracts network traffic data features to obtain network traffic features; a prediction probability vector is obtained based on the network traffic features, and the prediction probability vector includes multiple prediction probability values, and each prediction probability value corresponds to a device type; Convert network traffic features into fuzzy values; Perform fuzzy reasoning on the fuzzy value to obtain a reasoning probability vector, the reasoning probability vector includes multiple reasoning probability values, and each reasoning probability value corresponds to a device type; Obtain an attention weight vector based on the prediction probability vector and the inference probability vector; adjust the prediction probability vector based on the attention weight vector to obtain a device classification probability vector; the device classification probability vector includes multiple classification probability values, each classification probability value corresponds to a device type; The device type corresponding to the largest classification probability value in the device classification probability vector is taken as the type of the device to be tested.

2. The terminal device classification method based on traffic analysis according to claim 1, It is characterized in that The training methods for the device prediction network include: The device prediction network includes an input layer, multiple convolutional layers, multiple pooling layers, a fully connected layer, and an output layer. Multiple convolutional layers and multiple pooling layers are cross-set. A training set is obtained, the training set includes network traffic data of multiple training devices; the multiple training devices include training devices of different device types, and each training device is pre-labeled with a device type; each device type corresponds to a device label value; the device label values ​​of the multiple training devices constitute a training type vector; Perform data alignment processing on the training set through the input layer to obtain aligned training data; Align the training data through the convolution layer to perform convolution operations and obtain convolution features; The convolution data is pooled through the pooling layer to obtain the pooling number features; The pooled number features are converted into training prediction vectors through the fully connected layer, and the training prediction vectors are output through the output layer; the training prediction vectors include multiple training probabilities, each training probability corresponds to a device type; the training prediction vectors correspond to the training devices one by one; Convert the pooled data features into training fuzzy values; Perform fuzzy reasoning on the training fuzzy value to obtain a training reasoning vector; the training reasoning vector includes multiple training probability values, each training probability value corresponds to a device type; the training reasoning vector corresponds to the training device one by one; Obtain a training attention weight vector based on the training prediction vector and the training inference vector; adjust the training prediction probability vector based on the training attention weight vector to obtain a training device classification probability vector; the training device classification probability vector includes multiple training classification probability values, each training classification probability value corresponds to a device type; the training device classification probability vector corresponds to the training device one by one; Obtaining a model loss function based on the classification probability vector of the training device; If the model loss function converges, it is determined that the device prediction network training is completed.

3. The terminal device classification method based on traffic analysis according to claim 2, It is characterized in that The model loss function is obtained based on the classification probability vector of the training device, including: A plurality of training device classification probability vectors are obtained corresponding to the plurality of training devices; the plurality of training device classification probability vectors are used as columns of a training prediction probability matrix to form a training prediction probability matrix; Obtain the correlation index between the training type vector and the training prediction probability matrix; The correlation index is used as the loss function.

4. The terminal device classification method based on traffic analysis according to claim 3, It is characterized in that Get the correlation index between the training type vector and the training prediction probability matrix, including: The information entropy of each column of the training type vector and the training prediction probability matrix is ​​obtained, and each column of the training prediction probability matrix corresponds to an information entropy; if the training prediction probability matrix has multiple rows, multiple information entropies are obtained correspondingly; The mean of multiple information entropies is used as the correlation index.

5. The terminal device classification method based on traffic analysis according to claim 4, It is characterized in that The training attention weight vector is obtained based on the training prediction vector and the training inference vector, including: Get the dot product similarity between the training prediction vector and the training inference vector: S(i, j) = P i I j , where P i Represents the i-th element of the training prediction vector, I j Represents the jth element of the training inference vector, where i and j are positive integers; S(i, j) represents the dot product similarity between the i-th element of the training prediction vector and the j-th element of the training inference vector; the attention score is obtained based on the dot product similarity: A(i, j) = f(S(i, j)), where A(i, j) is the attention score between the i-th element of the training prediction vector and the j-th element of the training inference vector; f(S(i, j)) is the RELU function; Normalized weights: Among them, α j is the jth element of the training inference vector I j The attention weight of k is 1, 2, ..., N, where N is the number of elements in the training reasoning vector; N is a positive integer; A training attention weight vector is formed by taking multiple normalized weights as elements of the training attention weight vector.

6. The terminal device classification method based on traffic analysis according to claim 4, It is characterized in that The training prediction probability vector is adjusted based on the training attention weight vector to obtain the training device classification probability vector, including: Perform a cross product operation on the training attention weight vector and the training prediction probability vector to obtain the training device classification probability vector.

7. A terminal device classification system based on traffic analysis, It is characterized in that The system comprises: An acquisition module is used to obtain network traffic data of the device under test; A prediction module is used to input network traffic data into a pre-trained device prediction network, and the device prediction network extracts network traffic data features to obtain network traffic features; based on the network traffic features, a prediction probability vector is obtained, and the prediction probability vector includes multiple prediction probability values, each of which corresponds to a device type; A classification module is used to convert network traffic features into fuzzy values; perform fuzzy reasoning on the fuzzy values ​​to obtain an inference probability vector, the inference probability vector includes multiple inference probability values, and each inference probability value corresponds to a device type; obtain an attention weight vector based on the prediction probability vector and the inference probability vector; adjust the prediction probability vector based on the attention weight vector to obtain a device classification probability vector; the device classification probability vector includes multiple classification probability values, and each classification probability value corresponds to a device type; the device type corresponding to the largest classification probability value in the device classification probability vector is used as the type of the device to be tested.

8. The terminal device classification system based on traffic analysis according to claim 7, It is characterized in that The training methods for the device prediction network include: The device prediction network includes an input layer, multiple convolutional layers, multiple pooling layers, a fully connected layer, and an output layer. Multiple convolutional layers and multiple pooling layers are cross-set. A training set is obtained, the training set includes network traffic data of multiple training devices; the multiple training devices include training devices of different device types, and each training device is pre-labeled with a device type; each device type corresponds to a device label value; the device label values ​​of the multiple training devices constitute a training type vector; Perform data alignment processing on the training set through the input layer to obtain aligned training data; Align the training data through the convolution layer to perform convolution operations and obtain convolution features; The convolution data is pooled through the pooling layer to obtain the pooling number features; The pooled number features are converted into training prediction vectors through the fully connected layer, and the training prediction vectors are output through the output layer; the training prediction vectors include multiple training probabilities, each training probability corresponds to a device type; the training prediction vectors correspond to the training devices one by one; Convert the pooled data features into training fuzzy values; Perform fuzzy reasoning on the training fuzzy value to obtain a training reasoning vector; the training reasoning vector includes multiple training probability values, each training probability value corresponds to a device type; the training reasoning vector corresponds to the training device one by one; Obtain a training attention weight vector based on the training prediction vector and the training inference vector; adjust the training prediction probability vector based on the training attention weight vector to obtain a training device classification probability vector; the training device classification probability vector includes multiple training classification probability values, each training classification probability value corresponds to a device type; the training device classification probability vector corresponds to the training device one by one; Obtaining a model loss function based on the classification probability vector of the training device; If the model loss function converges, it is determined that the device prediction network training is completed.

9. The terminal device classification system based on traffic analysis according to claim 8, It is characterized in that The model loss function is obtained based on the classification probability vector of the training device, including: A plurality of training device classification probability vectors are obtained corresponding to the plurality of training devices; the plurality of training device classification probability vectors are used as columns of a training prediction probability matrix to form a training prediction probability matrix; Obtain the correlation index between the training type vector and the training prediction probability matrix; The correlation index is used as the loss function.

10. The terminal device classification system based on traffic analysis according to claim 9, It is characterized in that Get the correlation index between the training type vector and the training prediction probability matrix, including: The information entropy of each column of the training type vector and the training prediction probability matrix is ​​obtained, and each column of the training prediction probability matrix corresponds to an information entropy; if the training prediction probability matrix has multiple rows, multiple information entropies are obtained correspondingly; The mean of multiple information entropies is used as the correlation index.

Images