Internet of Things equipment identification method and device based on machine learning

Abstract

The invention discloses an Internet of Things equipment identification method and device based on machine learning, and the method comprises the steps: obtaining a data set containing network flows of Internet of Things equipment, carrying out the data preprocessing, obtaining a plurality of network flows, extracting a plurality of flow features from the network flows through a plurality of feature selection algorithms, so as to determine an optimal feature subset, and carrying out the recognition of the Internet of Things equipment. The method comprises the following steps: inputting a trained machine learning model to carry out Internet of Things equipment identification to obtain an equipment identification result, respectively carrying out comparative analysis based on a feature selection algorithm corresponding to the equipment identification result to complete Internet of Things equipment identification, and evaluating the effectiveness of network traffic features by adopting various feature selection algorithms. According to the method, the BGWO is introduced to determine the optimal feature subset of the identification of the Internet of Things equipment to fit the optimal model and realize the optimal accuracy among different classifiers, the reliability of the identification result is ensured by using two public Internet of Things network flow data sets, the performance of the classifiers is improved, and the BGWO realizes higher accuracy in all the classifiers.

Description

Technical Field

[0001] The present invention belongs to the technical field of Internet of Things device identification, and in particular relates to an Internet of Things device identification method and device based on machine learning. Background Art

[0002] With the widespread use of IoT devices and their participating technologies in different fields, the risk of large-scale cyber attacks has increased. IoT devices cover a wide range of hardware, which are standard devices that can communicate and interact remotely through the network. In addition to common smart devices such as PCs, smartphones and other gadgets, IoT also requires a variety of traditional non-smart technologies and everyday items that connect and exchange data online through technological integration. One of the most critical tasks of IoT applications and networks is to identify the type of connected devices to prevent potential vulnerabilities such as cyber attacks on IoT devices; network administrators can quickly filter out suspicious devices with abnormal activities. If the network administrator knows the identity of the infected device, this procedure is a mitigation process. For example, if a smart light bulb is found to send emails or stream movies instead of controlling its brightness and color, it can be identified as a suspicious device and further filtering process should be carried out on the device.

[0003] Currently, most hardware and device behaviors are used to identify deployed devices. Depending on the requirements of the environment, behavior-based identification of IoT devices can be divided into two different levels of granularity, mainly including single device model identification and device type identification. In single device model identification, a combination of RF fingerprinting and low-level component analysis is used to distinguish devices. In low-level component analysis, devices of the same model are distinguished based on hardware manufacturing differences. For example, the performance of several indicators such as CPU, GPU or RAM is monitored throughout the operation. This technique is called hardware performance analysis and is one of the most commonly used methods to determine the device model. In order to distinguish devices with the same hardware and software, chip manufacturing differences must be checked, so lower-level behavioral monitoring is required for the identification of individual devices. However, in this case, attackers may exploit device context or components to change the values ​​that create device identification fingerprints, thereby interrupting the identification process. In the second method, device type identification (such as cameras, light bulbs, etc.), based on several characteristics (such as network activities or running processes), the data generated by the device network traffic is analyzed to determine the type of device, so that any anomalies obtained from these data through the network may indicate a potential threat to the device.

[0004] Despite the irrefutable advantages of the Internet of Things, the growth of the Internet of Things has brought security and privacy issues due to the lack of adequate security design of IoT devices. For example, most IoT components have low power consumption, and they cannot handle complex security mechanisms due to limited consumption and computing power. In addition, since most IoT devices are wirelessly connected and operate without human supervision, they are extremely vulnerable to hacker attacks. IoT devices will be ideal targets for attackers seeking unauthorized access and inferring sensitive information. Therefore, it is urgent to provide a method and apparatus for identifying IoT devices based on machine learning to solve the above-mentioned technical problems. Summary of the invention

[0005] In view of this, the present invention provides an IoT device identification method and apparatus based on machine learning, which evaluates the effectiveness of network traffic features by adopting various feature selection algorithms to fit the best model and achieve the best accuracy among different classifiers, and introduces BGWO to determine the best feature subset for IoT device identification to solve the above-mentioned technical problems, which is specifically implemented by the following technical solutions.

[0006] In a first aspect, the present invention provides an IoT device identification method based on machine learning, comprising the following steps: Acquire a data set containing network traffic of IoT devices, and perform data preprocessing on the data set to obtain network traffic of multiple IoT devices, wherein the data set includes a training set and a test set, the training set containing labels is used to train the model, and the test set is used to test the classification performance of the model; Extracting a plurality of traffic features from the network traffic using a plurality of feature selection algorithms to determine an optimal feature subset, wherein the number of selected traffic features ranges from a minimum value to a maximum value of the entire device traffic; The optimal feature subset is input into the trained machine learning model to perform IoT device identification to obtain a device identification result, and a comparative analysis is performed based on the feature selection algorithms corresponding to the device identification result to complete IoT device identification.

[0007] As a preferred embodiment of the above technical solution, obtaining a data set containing network traffic of IoT devices includes: After the machine learning model is trained on the labeled training set, the test set is used to predict the device labels of the test set without labels, where the classification performance of the machine learning model is measured by accuracy, which is the ratio of correctly predicted observations to total observations, and the corresponding expression is: (1) Among them, T or F indicates whether the prediction result is right or wrong, P or N indicates whether the label of the predicted class is correct or incorrect, TP indicates the number of correctly classified positive instances, FP indicates the number of misclassified negative instances, TN indicates the number of correctly classified negative instances, and FN indicates the number of misclassified positive instances.

[0008] As a preferred embodiment of the above technical solution, data preprocessing is performed on the data set to obtain network traffic of multiple IoT devices, including: Dividing the data set into a first data subset and a second data subset, normalizing a first feature of the first data subset, and removing irrelevant features or features with zero variance to obtain a second feature, wherein the number of devices and the type of devices in the first feature and the second feature are the same; The device type of the second data subset is converted and the corresponding feature is added to obtain a third feature, the device quantity and features are filtered and normalized according to the third feature, and irrelevant features or features with zero variance are removed to obtain a fourth feature, wherein the fourth feature and the third feature have the same device type; The feature selection process is as follows: Select a new feature subset , F is the number of selected features, is the number of original features.

[0009] As a preferred embodiment of the above technical solution, multiple feature selection algorithms are used to extract multiple traffic features from the network traffic to determine the best feature subset, including: The feature selection algorithms include filter-based feature selection and wrapper-based feature selection, wherein the filter-based feature selection ranks features according to certain statistical criteria; and independently evaluates the relevance of each feature, and the filter-based feature selection includes Pearson correlation coefficient PCC and common information MI; The Pearson correlation coefficient was used to evaluate the linear relationship between two continuous variables. The value range of the Pearson correlation coefficient was from -1 to +1, where -1 indicated a perfect negative linear correlation, 0 indicated no linear correlation, and +1 indicated a perfect positive linear correlation. Pearson correlation coefficient is calculated by dividing the covariance of the two variables by the product of their standard deviations. The expression is: (2) in, is the covariance, yes The standard deviation of yes When using the Pearson correlation coefficient to select features, calculate the correlation coefficient between each feature and remove the features with the highest absolute correlation coefficient with other features; The common information MI is used to measure the correlation of random variables. It measures the amount of information inferred from one variable by observing the value of another variable. The expression of the common information MI between two discrete random variables X and Y is: (3) in, is the joint probability distribution function of X and Y, and are the probability distribution functions of X and Y respectively.

[0010] As a preferred embodiment of the above technical solution, the wrapper-based feature selection algorithm includes a binary genetic algorithm BGA and a particle swarm optimization PSO algorithm, wherein the binary genetic algorithm BGA is selected based on data attributes and direct performance on a specific classifier, and the binary genetic algorithm is used to perform simulated selection, crossover and mutation genetic operations to optimize the feature subset; The execution process of the binary genetic algorithm BGA is as follows: randomly generate an initial chromosome population, each chromosome represents a feature subset, and each chromosome can be represented as a binary vector, where 1 represents the selected feature and 0 represents the unselected feature; use the fitness function to evaluate the fitness of each chromosome, which measures the performance of the feature subset in the classification task, and select chromosomes as parents based on the fitness value to generate the next generation, where the selected parent chromosomes are prone to generate new offspring chromosomes after crossover, and the offspring chromosomes mutate with a certain probability; the new generation of chromosomes replaces the unsuitable chromosomes of the previous generation, and the process is repeated until the stopping criteria are met; Each ion in the ion swarm optimization PSO algorithm corresponds to an individual in the group and is characterized by a feature subset as its position in the search space. The execution process of the ion swarm optimization PSO algorithm is: randomly generate a set of particles representing the feature subset, initialize the speed and position of each particle, use the fitness function to evaluate the fitness of each particle position, and determine the global optimal position; wherein, in each iteration, the speed and position of each ion will be updated according to its optimal position and the global optimal position until the maximum number of iterations is reached or the global optimal fitness value is not significantly improved. The speed update equation is as follows: (4) in, represents the velocity of particle i at time t, represents the position of particle i, represents the position experienced by particle i, represents the positions experienced by all ions, represents the inertia weight, and It is the learning factor. and is a random number between 0 and 1, and the position of the ion in binary space consists of 1 and 0, and Indicates the selection and non-selection of features; the speed passes through the function The logical transformation is expressed as formula (6) The probability of is 1, and the position of the ion is updated based on formula (5): (5) (6).

[0011] As a preferred embodiment of the above technical solution, the feature selection algorithm also includes a binary gray wolf optimizer, which divides the gray wolves into two types according to their dominance and leadership. , , and , is the best solution found by the leader representative, is the best candidate representing the second best solution, The third level represents the third best solution. Represents the rest of the wolves and is at the lowest level; The gray wolves are randomly distributed in the search space to represent candidate solutions, and the corresponding positions are iteratively updated to improve the quality of the solution. The positions of the gray wolves during the hunting process are embedded in the mathematical model provided by the following equation: (7) (8) in, is the position of the gray wolf, t represents the number of current iterations, Indicates the location of the prey, The definition of refers to formula (3), , Using equations (9) and (10) yields: (9) (10) in, and from Randomly select from It decreases linearly from 2 to 0 and is defined as: (11) Among them, the maximum number of iterations is denoted as t; Indicates the drive to hunt, and They may also be involved in hunting, and the hunting behavior of gray wolves can be used to predict , and More information about the location of the prey will be obtained.

[0012] As a preferred embodiment of the above technical solution, after the first three candidate solutions are completed, the remaining search agents adjust their positions to match the best search position of the agent position. Formula (12) shows the updated position: (12) in, , , Defined in formulas (13), (14) and (15) respectively: (13) (14) (15) in, , , are the first three best solutions at iteration t, , , The definition is as follows: (16) (17) (18) The binary variant of the Gray Wolf Optimizer is used for feature selection to perform the binary Gray Wolf Optimizer BGWO. The formula for calculating the new position in (12) is rewritten using formula (19): (19) According to formula (20), the probability of adopting the decision variable is given by The value of is represented by , where r is a number randomly chosen between 0 and 1: (20).

[0013] As a preferred embodiment of the above technical solution, the fitness function used in the binary grey wolf optimizer BGWO is used to evaluate the feature set of IoT devices identified using a supervised learning algorithm, and the corresponding expression is: (twenty one) in, is the classification accuracy in formula (1), is the length of the original feature, N is the length of the selected feature set, is the weight of classification accuracy relative to the evaluation criterion.

[0014] In a second aspect, the present invention provides an IoT device identification device based on machine learning, which is applied to the above-mentioned IoT device identification method based on machine learning, comprising: A data acquisition module is used to acquire a data set containing network traffic of IoT devices, and perform data preprocessing on the data set to obtain network traffic of multiple IoT devices, wherein the data set includes a training set and a test set, the training set containing labels is used to train the model, and the test set is used to test the classification performance of the model; a feature selection module, for extracting a plurality of traffic features from the network traffic using a plurality of feature selection algorithms to determine an optimal feature subset, wherein the number of the selected traffic features ranges from a minimum value to a maximum value of the entire device traffic; The device identification module is used to input the optimal feature subset into the trained machine learning model to perform IoT device identification to obtain device identification results, and perform comparative analysis based on the feature selection algorithms corresponding to the device identification results to complete IoT device identification.

[0015] The present invention provides an Internet of Things device identification method and device based on machine learning. A data set of network traffic containing Internet of Things devices is obtained, and data preprocessing is performed on the data set to obtain network traffic of multiple Internet of Things devices. Multiple traffic features are extracted from the network traffic by using multiple feature selection algorithms to determine an optimal feature subset. The optimal feature subset is input into a trained machine learning model to perform Internet of Things device identification to obtain a device identification result. Feature selection algorithms corresponding to the device identification result are respectively compared and analyzed to complete Internet of Things device identification. Various feature selection algorithms are used to evaluate the effectiveness of network traffic features to fit the optimal model and achieve the best accuracy between different classifiers. BGWO is introduced to determine the optimal feature subset for Internet of Things device identification. Two public Internet of Things network traffic data sets are used to ensure the reliability of the identification result, thereby improving the performance of the classifier. BGWO selects fewer features and achieves higher accuracy in all classifiers. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments are briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without creative work.

[0017] Figure 1 A flow chart of the method for identifying IoT devices based on machine learning provided by the present invention; Figure 2 The schematic diagram of the random forest RF provided by the present invention; Figure 3 A schematic diagram of the support vector machine SVM provided by the present invention; Figure 4 A schematic diagram of the artificial neural network ANN provided by the present invention; Figure 5 This is a structural block diagram of the Internet of Things device identification device based on machine learning provided by the present invention. DETAILED DESCRIPTION

[0018] Embodiments of the present invention are described in detail below, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and cannot be understood as limiting the present invention.

[0019] See also Figure 1 The present invention provides an IoT device identification method based on machine learning, comprising the following steps: S1: Obtain a data set containing network traffic of IoT devices, and perform data preprocessing on the data set to obtain network traffic of multiple IoT devices, wherein the data set includes a training set and a test set, the training set containing labels is used to train the model, and the test set is used to test the classification performance of the model; S2: extracting a plurality of traffic features from the network traffic using a plurality of feature selection algorithms to determine an optimal feature subset, wherein the number of the selected traffic features ranges from a minimum value to a maximum value of the entire device traffic; S3: Input the optimal feature subset into the trained machine learning model to perform IoT device identification to obtain a device identification result, and perform comparative analysis based on the feature selection algorithms corresponding to the device identification result to complete IoT device identification.

[0020] In this embodiment, the machine learning model ML is constructed using a set of features that describe the state of the object. If the features are not enough, the ML model may not have enough information to accurately capture the relationship between the input data and the output label, which may lead to insufficient fitting. On the contrary, if there are too many features, the ML model may overfit, which will result in low accuracy and time-consuming. Therefore, many researchers perform feature selection before building a classifier to improve accuracy and reduce costs. The unsupervised learning algorithm Kmeans cannot effectively identify IoT devices. In contrast, the use of supervised learning algorithms has good performance. The artificial neural network (ANN) achieved an accuracy of 92.8% when identifying 3 devices with 110-dimensional features. After feature selection using the gradient boosted decision tree (XGBoost), the result was further improved to 97.6%. ANN and XGBoost also achieved a high accuracy of 99.995% in anomaly detection. The ReliefF feature selection algorithm was used to select important features from the periodic traffic features and protocol features of the K nearest neighbor (KNN) algorithm. Eight devices were identified using KNN with an average accuracy of 95%. The performance of four supervised learning algorithms (K-nearest neighbor, random forest, support vector machine, and multilayer perceptron) in identifying 14 collected IoT devices and 8 self-collected IoT devices was compared, and 10 features were selected based on the length of the data packet for identification. The results show that random forest has the best performance with an accuracy of 99.5% and 99.4% on 14 devices and 8 devices, respectively. In the use of KNN, random forest, and extremely random tree lights to identify the constructed smart home devices, unlike the feature set that combines the flow and flow rate as well as the text features of the port, domain name, and cipher suite, this embodiment uses a filtering feature selection method based on NSGA-III to select features only from statistics related to the flow. The results show that the RF algorithm has the best accuracy of 99.5%, and the cost of the NSGA-III feature set is lower than the selected feature set in terms of both training time and feature dimension.

[0021] It should be noted that given a dataset containing network traffic of IoT devices, the goal is to develop a supervised machine learning algorithm that accurately identifies each device based on its unique behavior (network traffic). The dataset is divided into a training set and a test set. The training set containing labels is used to train the model, and the test set is used to test the classification performance of the model. After the ML model is trained on the labeled training set, it will be used to predict the device labels of the test set with the labels removed. Feature selection is a key task in machine learning, and its purpose is to select the most informative feature subset to improve the performance of the model. The importance of feature selection lies in the fact that not all features are equally relevant or useful for a given problem. Using all available features may lead to overfitting, while using too few features may lead to underfitting. The number of selected features can range from a minimum value for the entire device traffic to a maximum value, that is, the number of features extracted from the network traffic. Using all features may lead to increased computational complexity, and irrelevant features may affect the accuracy of classification. On the other hand, selecting very few features may lead to information loss and low precision. Therefore, selecting the optimal feature subset is crucial to achieve optimal model performance. Finding the best solution is time-consuming, and random selection is unlikely to capture the underlying relationships in the data. The main goal of feature selection is to minimize the number of relevant sets used for training and testing purposes. Therefore, the heuristic algorithm can provide us with a feasible solution at an acceptable cost.

[0022] Specifically, this embodiment applies two FS types, including filter-based and wrapper-based algorithms, a meta-heuristic optimizer and compares several other feature selection methods to determine the best feature subset to minimize cost and maximize accuracy. The supervised classifier of the machine learning model includes at least one of a decision tree, a random forest, a support vector machine, or a neural network.

[0023] Specifically, a dataset containing network traffic of IoT devices is obtained, including: After the machine learning model is trained on the labeled training set, the test set is used to predict the device labels of the test set without labels, where the classification performance of the machine learning model is measured by accuracy, which is the ratio of correctly predicted observations to total observations, and the corresponding expression is: (1) Among them, T or F indicates whether the prediction result is right or wrong, P or N indicates whether the label of the predicted class is correct or incorrect, TP indicates the number of correctly classified positive instances, FP indicates the number of misclassified negative instances, TN indicates the number of correctly classified negative instances, and FN indicates the number of misclassified positive instances.

[0024] It should be understood that by obtaining a data set containing network traffic of IoT devices and performing data preprocessing on the data set to obtain network traffic of multiple IoT devices, multiple feature selection algorithms are used to extract multiple traffic features from the network traffic to determine the best feature subset, the best feature subset is input into the trained machine learning model to perform IoT device identification to obtain a device identification result, and comparative analysis is performed based on the feature selection algorithms corresponding to the device identification result to complete IoT device identification, various feature selection algorithms are used to evaluate the effectiveness of network traffic features to fit the best model and achieve the best accuracy among different classifiers, BGWO is introduced to determine the best feature subset for IoT device identification, two public IoT network traffic data sets are used to ensure the reliability of the identification results, and the performance of the classifier is improved. BGWO selects fewer features and achieves higher accuracy in all classifiers.

[0025] Optionally, data preprocessing is performed on the data set to obtain network traffic of multiple IoT devices, including: Dividing the data set into a first data subset and a second data subset, normalizing a first feature of the first data subset, and removing irrelevant features or features with zero variance to obtain a second feature, wherein the number of devices and the type of devices in the first feature and the second feature are the same; The device type of the second data subset is converted and the corresponding feature is added to obtain a third feature, the device quantity and features are filtered and normalized according to the third feature, and irrelevant features or features with zero variance are removed to obtain a fourth feature, wherein the fourth feature and the third feature have the same device type; The feature selection process is as follows: Select a new feature subset , F is the number of selected features, is the number of original features.

[0026] In this embodiment, two data sets, namely the first data subset and the second data subset, are used. The first data subset contains eight device types, which are connected via Wi-Fi and extract features from TCP, IP, DNS, and HTTP protocols. The original data set contains 298 features in CSV format. After removing noise (irrelevant or causing zero variance), 188 features are retained in the first data subset; the second data subset contains ten selected devices, most of which are connected via Wi-Fi, and some are connected via ZigBee and Ethernet. The collected pcap files are converted into json files to obtain the names of the features contained in the pcap files; then, the features are extracted into CSV files according to the same protocol as in the first data subset. However, due to the different protocols of the devices, the functions of different devices are also different. After eliminating redundant functions that may affect each other and the same devices from the same manufacturer, only 70 functions from IP and TCP are left, which can be maintained with new devices and functions. This process leaves ten unique devices. After normalizing the 70 features and removing irrelevant or zero-variance features, 30 features are retained in the second subset. Table 1 shows the comparison between the two data sets. The first data subset is recorded as Dataset1, and the second data subset is recorded as Dataset2.

[0027]

[0028] Optionally, a plurality of feature selection algorithms are used to extract a plurality of traffic features from the network traffic to determine an optimal feature subset, including: The feature selection algorithms include filter-based feature selection and wrapper-based feature selection, wherein the filter-based feature selection ranks features according to certain statistical criteria; and independently evaluates the relevance of each feature, and the filter-based feature selection includes Pearson correlation coefficient PCC and common information MI; The Pearson correlation coefficient was used to evaluate the linear relationship between two continuous variables. The value range of the Pearson correlation coefficient was from -1 to +1, where -1 indicated a perfect negative linear correlation, 0 indicated no linear correlation, and +1 indicated a perfect positive linear correlation. Pearson correlation coefficient is calculated by dividing the covariance of the two variables by the product of their standard deviations. The expression is: (2) in, is the covariance, yes The standard deviation of yes When using the Pearson correlation coefficient to select features, calculate the correlation coefficient between each feature and remove the features with the highest absolute correlation coefficient with other features; The common information MI is used to measure the correlation of random variables. It measures the amount of information inferred from one variable by observing the value of another variable. The expression of the common information MI between two discrete random variables X and Y is: (3) in, is the joint probability distribution function of X and Y, and are the probability distribution functions of X and Y, respectively. When using the Pearson correlation coefficient to select features, the correlation coefficient between each feature is calculated, and then the features with the highest absolute correlation coefficient with other features are removed, thereby reducing the feature dimension. By selecting the top k features with the highest mutual information with the target variable, the dimensionality of the dataset can be reduced while retaining the most informative features for the ML model.

[0029] In this embodiment, the wrapper-based feature selection algorithm includes a binary genetic algorithm (BGA) and a particle swarm optimization (PSO) algorithm, wherein the binary genetic algorithm (BGA) is selected based on data attributes and direct performance on a specific classifier, and the binary genetic algorithm is used to perform simulated selection, crossover, and mutation genetic operations to optimize feature subsets; the execution process of the binary genetic algorithm (BGA) is as follows: randomly generating an initial chromosome population, each chromosome represents a feature subset, and each chromosome can be represented as a binary vector, wherein 1 represents a selected feature and 0 represents an unselected feature; using a fitness function to evaluate the fitness of each chromosome, the fitness function measures the performance of the feature subset in the classification task, and based on the fitness value, the chromosome is selected as a parent to generate the next generation, wherein the selected parent chromosome is prone to generate a new offspring chromosome after crossover, and the offspring chromosome mutates with a certain probability; the new generation of chromosomes replaces the unsuitable chromosomes of the previous generation, and the process is repeated until the stopping criterion is met; Each ion in the ion swarm optimization PSO algorithm corresponds to an individual in the group and is characterized by a feature subset as its position in the search space. The execution process of the ion swarm optimization PSO algorithm is: randomly generate a set of particles representing the feature subset, initialize the speed and position of each particle, use the fitness function to evaluate the fitness of each particle position, and determine the global optimal position; wherein, in each iteration, the speed and position of each ion will be updated according to its optimal position and the global optimal position until the maximum number of iterations is reached or the global optimal fitness value is not significantly improved. The speed update equation is as follows: (4) in, represents the velocity of particle i at time t, represents the position of particle i, represents the position experienced by particle i, represents the positions experienced by all ions, represents the inertia weight, and It is the learning factor. and is a random number between 0 and 1, and the position of the ion in binary space consists of 1 and 0, and Indicates the selection and non-selection of features; the speed passes through the function The logical transformation is expressed as formula (6) The probability of is 1, and the position of the ion is updated based on formula (5): (5) (6).

[0030] It should be noted that, unlike the filtering-based type that selects features independently, in wrapper-based feature selection, features are selected based on data attributes and their direct performance on a specific classifier. Since the features are selected independently, this method directly optimizes the model and can provide better results compared to filtering methods, but wrapper-based methods are computationally more expensive than their counterparts.

[0031] Optionally, the feature selection algorithm also includes a binary gray wolf optimizer that divides the gray wolves into , , and , is the best solution found by the leader representative, is the best candidate representing the second best solution, The third level represents the third best solution. Represents the rest of the wolves and is at the lowest level; The gray wolves are randomly distributed in the search space to represent candidate solutions, and the corresponding positions are iteratively updated to improve the quality of the solution. The positions of the gray wolves during the hunting process are embedded in the mathematical model provided by the following equation: (7) (8) in, is the position of the gray wolf, t represents the number of current iterations, Indicates the location of the prey, The definition of refers to formula (3), , Using equations (9) and (10) yields: (9) (10) in, and from Randomly select from It decreases linearly from 2 to 0 and is defined as: (11) Among them, the maximum number of iterations is denoted as t; Drive hunting, and They may also be involved in hunting, and the hunting behavior of gray wolves can be used to predict , and More information about the location of the prey will be obtained.

[0032] In this embodiment, after the first three candidate solutions are completed, the remaining search agents adjust their positions to match the best search position of the agent position. Formula (12) shows the updated position: (12) in, , , Defined in formulas (13), (14) and (15) respectively: (13) (14) (15) in, , , are the first three best solutions at iteration t, , , The definition is as follows: (16) (17) (18) The binary variant of the Gray Wolf Optimizer is used for feature selection to perform the binary Gray Wolf Optimizer BGWO. The formula for calculating the new position in (12) is rewritten using formula (19): (19) According to formula (20), the probability of adopting the decision variable is given by The value of is represented by , where r is a number randomly chosen between 0 and 1: (20).

[0033] It should be noted that the fitness function used in the binary grey wolf optimizer BGWO is used to evaluate the feature set of IoT devices identified using a supervised learning algorithm, and the corresponding expression is: (twenty one) in, is the classification accuracy in formula (1), is the length of the original feature, N is the length of the selected feature set, is the weight of classification accuracy relative to the evaluation criterion.

[0034] Specifically, a decision tree (DT) is a supervised learning technique that uses a graph to describe decisions and their results in the form of a tree, where nodes represent choices or events and edges represent decision rules or conditions. When a DT algorithm is used to classify a sample, the algorithm will begin to compare the attributes of the sample with the value of the root node of the tree and jump to the next node along the corresponding branch of the value. The algorithm will repeat the comparison until the final result is obtained. Figure 2 , Random Forest (RF) is a supervised learning algorithm that combines multiple trees through the idea of ​​ensemble learning. As the name implies, RF builds a forest in a random way. A forest contains many DTs, and there is no correlation between each DT in a random forest. When a new input sample enters the forest after collection, each decision tree (DT) in the forest will be asked to decide which category the sample should belong to (for classification algorithms). In the end, the sample is expected to belong to the most popular category determined by most decision trees. Figure 3 , Support vector machine (SVM) is one of the most commonly used supervised learning techniques, mainly used for multi-class and binary classification, using an N-dimensional hyperplane to best divide the data into two groups, and SVM for classification. The goal of SVM is to find an ideal hyperplane that separates vector clusters, so that cases belonging to one category of the target variable are on one side of the plane, and cases belonging to the other category are on the other side of the plane. Figure 3 As shown, line A is the optimal hyperplane, and SVM has the following advantages: Avoid overfitting and non-probability. Neural network (NN) is a mathematical or computer model used to simulate the structure and function of biological neural networks. The model consists of three parts: input layer, hidden layer and output layer. Figure 4 As shown, each successive layer takes the output of the previous layer , multiply the previous layer output by the corresponding weight and calculate their sum , and then use the corresponding activation function Calculate the result and provide it to the next layer . Neural networks can be used for supervised and unsupervised learning tasks. A supervised neural network is used. In a supervised neural network, the actual output is known in advance. The predicted output is compared with the actual result, and the network parameters are adjusted according to the error. This process is repeated iteratively to improve the accuracy of the model. In this embodiment, 70% of the samples of each data set are allocated to create a training set, and the remaining 30% are used to create a test set. The experiment is repeated 10 times with different seeds, and the samples of the training set are randomly selected, thereby reducing the impact of random changes, ensuring more reliable results, and avoiding unexpected events.

[0035] Specifically, the Pearson correlation coefficient (PCC) between each feature was determined and five different cutoff points (0.5, 0.6, 0.7, 0.8, and 0.9) were used to eliminate features. Each feature with a Pearson correlation coefficient above the critical threshold was eliminated. After eliminating features with strong correlation coefficients with other variables, the dimensionality of the dataset was reduced, as these variables are likely to represent features with high correlation coefficients. The average results of feature selection using PCC in the first and second data subsets, the number of selected features using the correlation boundary is represented by the purple bar, and the accuracy achieved by applying the corresponding classifier, the selected features are shown by the line. In the first data subset, when the cutoff boundary was set to 0.7, only the random forest classifier achieved the highest accuracy of 97.01%, thereby retaining 33 features. As the feature selection cutoff boundary increases, the classification accuracy of the other three classifiers, DT, NN, and SVM, also improves. All classifiers achieve the highest accuracy with a cutoff boundary of 0.9 and 67 features retained: DT achieves 95.25%, NN achieves 94.83%, and SVM achieves 94.59%. The rate of accuracy improvement slows down as the PCC boundary increases, indicating that features with high PCC have a smaller or even negative impact on the accuracy. For example, when the number of selected features RR classifier increases from 33 to 67, the classification accuracy actually decreases. Similarly, only RF achieves the highest accuracy of 99.61% when the cutoff boundary is equal to 0.7. As the cutoff boundary and the number of selected features increase, the other methods show better performance in classification. This is because most of the attributes in the second data subset are uncorrelated with each other and the dimensionality is not too large. 19 out of 30 features have a PCC below 0.5. The accuracy differences caused by different PCC boundaries are not significant.

[0036] Specifically, since the common information is calculated between two discrete variables, the continuous variables were initially converted to discrete variables, and each continuous feature value was replaced by the interval to which it belonged after the range of each continuous feature was evenly divided into intervals corresponding to the number of devices in the dataset. Next, the common information existing between the target variable and the features was determined, and for the selection of features, five MI boundaries (0.01, 0.1, 0.2, 0.3, 0.4, and 0.5) were examined, and those with MI values ​​above the boundaries were retained. The recognition performance of all algorithms improved as the MI boundary increased from 0.5 to 0.6, and the improvement slowed down thereafter. The highest accuracies of the SVM and NN algorithms were 95.51% and 95.47%, respectively, with an MI boundary of 0.2. In contrast, the tree-based algorithms achieved the highest accuracy with an MI boundary of 0.01, with DT and RF reaching 95.42% and 96.89%, respectively. In the second data subset, the DT and RF classifiers showed excellent and consistent performance regardless of the MI boundary selected. With only six selected features, the accuracy of DT and RF reached 98.95% and 99.03%, respectively. As the number of selected features increased, the recognition accuracy of SVM and NN classifiers increased steadily, and both classifiers reached the highest accuracy when the MI margin was 0.01, with SVM reaching 95% accuracy and NN reaching 96.49% accuracy.

[0037] Specifically, wrapper-based FS algorithms are distinguished from filter-based methods by selecting features based on classification results rather than solely on dataset information. Therefore, the selected features may vary depending on the classifier used. Experiments performed on the first and second data subsets using various wrapper-based feature selection methods. The number of features selected by different classifiers and the classification accuracy achieved are presented on the horizontal axis for each experiment. The bars represent the number of features selected by each feature selection method for each classifier, and the lines represent the corresponding classification accuracy in percentage.

[0038] Among them, in the results of 10 experiments using BGA as a feature selection method with different supervised learning algorithms, the number of features selected by BGA for the SVM classifier varied greatly in the experiments, ranging from 80 to 160. The classification accuracy of SVM ranged from 95.47% to 96.88%. The accuracy of BGA improved, with the largest difference of 1.52% and the smallest difference of -0.41%, indicating that in some cases, accuracy was sacrificed for the reduction of features. NN showed a relatively stable number of selected features, mostly between 85 and 100. The classification accuracy of the neural network ranged from 95.17% to 96.48%, with an accuracy improvement of 0.21% to 1.74%. At the same time, the DT classifier of the first data subset always selected between 81 and 99 features, with an average of 90.2, and the accuracy was still high, ranging from 95.65% to 97.33%, with an average accuracy of 96.44%. The difference in accuracy improvement was between 0.40% and 2.49%, indicating that feature selection brought significant benefits. Similarly, RF in the first data subset selected features in a narrow range from 81 to 102, with an average of 90.3. The classification accuracy was the highest among all classifiers, ranging from 96.98% to 98.13%, with an average accuracy of 97.65%. The accuracy improvement was small, ranging from 0.00% to 1.24%, indicating the robustness of the performance of the selected features. In the second data subset, the SVM classifier still showed a wider range of the number of selected features from 17 to 30, with an average of 24.5. The classification accuracy ranged from 95.5% to 96.78%, with an average of 96.49%. The accuracy improvement was not significant, ranging from -0.22% to 0.22%. The neural network for the second data subset showed variability in feature selection from 13 to 30, with an average of 23.3, and the accuracy ranged from 95.63% to 96.67%, with an average of 96.03%. The improvement differences ranged from 0.00% to 2.68%, indicating that FS effectively improved the performance. The DT classifier in the second data subset maintained a narrow range of selected features, from 7 to 16, with an average of 13.7, and it achieved extremely high accuracies of 99.29% to 99.73%, with the smallest improvement differences ranging from -0.11% to 0.51%. Similarly, RF in the second data subset consistently selected between 12 and 20 features, achieving accuracies of 99.51% to 99.84%. The improvement differences were still small, ranging from -0.06% to 0.38%, indicating that the performance of the selected feature set was stable.

[0039] Among them, in the first data subset, the features selected by BPSO for the SVM classifier ranged from 83 to 100, with an average of 94.3, and the classification accuracy ranged from 95.57% to 96.68%, with an average of 96.20%. The improvement in accuracy ranged from -0.21% to 1.52%, indicating that although feature selection sometimes slightly reduces accuracy, it usually provides a moderate improvement. The NN in the first data subset uses BPSO for feature selection, selecting between 84 and 104 features, with an average of 93.3. The accuracy ranges from 95.98% to 97.31%, with an average of 96.65%. The difference in accuracy improvement ranges from 1.04% to 2.59%, indicating that feature selection and continued performance improvement bring significant benefits. The DT classifier in the first data subset uses BPSO to select features in a narrow range of 82 to 102, with an average of 93.6. The classification accuracy ranges from 95.24% to 97.09%, with an average of 96.61%. The difference in accuracy improvement ranged from 0.40% to 2.91%, indicating that feature selection brought substantial gains. RF on the first data subset using BPSO consistently selected between 77 and 102 features, with an average of 89. Classification accuracy was high, ranging from 97.18% to 98.13%, with an average of 97.68%. The difference in accuracy improvement was smaller, ranging from 0.21% to 1.24%, indicating that the combination of BPSO and RF performed stably.

[0040] The NN in the second dataset used BPSO for feature selection, with a range of 14 to 30 features, with an average of 18.9. The accuracy ranged from 95.09% to 96.51%, with an average of 96.01%. The accuracy improvement varied from -0.33% to 2.63%, indicating that feature selection using BPSO can significantly improve the performance of the NN, although it slightly degrades in some cases. The DT classifier of dataset 2 using BPSO also showed a narrow range of selected features from 10 to 30, with an average of 15.7, and consistently high accuracy ranging from 99.12% to 99.73%, with an average of 99.39%. The accuracy improvement varied slightly, from -0.16% to 0.22%. The RF in the second dataset used BPSO to select features between 9 and 17, with an average of 13.6, and the classification accuracy ranged from 99.45% to 99.89%, with an average of 99.71%. The accuracy improvement varied slightly, from -0.05% to 0.34%. Since DT and RF already have good performance when using the original feature set of the second data subset, the accuracy improvement of feature selection is not obvious, but the effect of dimensionality reduction is considerable.

[0041] Among them, in the results obtained using BGWO as a feature selection method for various supervised learning algorithms in the first data subset, the classification accuracy of the SVM algorithm increased from 94.83% to 96.89% using the original feature set to 96.96% to 97.95% using the feature set selected by BGWO, with an accuracy increment ranging from 0.62% to 2.17%. At the same time, BGWO selected 80 to 111 features from 188 features for the SVM classifier. Similarly, the accuracy of the NN in the first data subset was significantly improved, ranging from 93.97% to 96.07% initially to 96.58% to 97.95% using the features selected by BGWO, with an improvement ranging from 1.61% to 3.23%. Compared with SVM, the number of features selected using the neural network was smaller, ranging from 50 to 87. When using the original feature set, the accuracy of using decision trees ranged from 96.18% to 97.92%, and when using the feature set selected by BGWO, it was 96.45% to 97.71%, with an improvement range of 0.11% to 0.5%. The number of selected features for decision trees ranged from 62 to 93, which was between neural networks and SVMs. For another tree-based algorithm, since random forests combine multiple decision trees, it has the advantages of not being prone to overfitting and better performance in handling high-dimensional feature spaces. After using the feature set selected by BGWO, the classification accuracy of random forests increased from 96.18% to 97.92% to 97.99% to 99.38%, the highest among all algorithms. BGWO reduced the 188 features of random forests to 21 to 37 features, indicating an improvement in time complexity.

[0042] In contrast, the second data subset showed less pronounced improvements for the SVM, with accuracy ranging from 95.73% to 96.83% for the original feature set and 96.01% to 96.99% for the selected features, a slight improvement of -0.16% to 0.39%. The accuracy of the neural network varied widely due to data sensitivity, ranging from 93.18% to 96.67% initially, improving to 95.64% to 98.52% with BGWO, and improving by 0.66% to 2.52% with 13–23 features selected from the 30 features. Both DT and RF maintained stable performance in the second data subset, with DT achieving an accuracy of 99.38% to 99.84% with the selected features, up from an initial 99.16% to 99.67%. Random forest achieved an accuracy of 99.62% to 99.95% from the initial 99.29% to 99.78% with selected features, while decision tree had the smallest increment of accuracy, from 0.11% to 0.50%, and random forest had the smallest accuracy, from 0.00% to 0.38%. Decision tree selected 13 to 23 features, while random forest selected 5 to 15 features, highlighting BGWO's efficient feature selection capabilities for them.

[0043] See also Figure 5 The present invention provides an IoT device identification device based on machine learning, which is applied to the above-mentioned IoT device identification method based on machine learning, including: A data acquisition module is used to acquire a data set containing network traffic of IoT devices, and perform data preprocessing on the data set to obtain network traffic of multiple IoT devices, wherein the data set includes a training set and a test set, the training set containing labels is used to train the model, and the test set is used to test the classification performance of the model; a feature selection module, for extracting a plurality of traffic features from the network traffic using a plurality of feature selection algorithms to determine an optimal feature subset, wherein the number of the selected traffic features ranges from a minimum value to a maximum value of the entire device traffic; The device identification module is used to perform IoT device identification in the trained machine learning model according to the optimal feature subset input to obtain device identification results, and perform comparative analysis based on the feature selection algorithms corresponding to the device identification results to complete IoT device identification.

[0044] In this embodiment, in order to make the feature selection algorithm achieve the best performance in terms of both feature selection and classification accuracy, the fitness value is calculated. ,The package-based feature selection method was also used for MI-based and PCC-based feature selection to evaluate the performance of each boundary. The boundary results for achieving the highest fitness value were selected to represent the FS method for comparison. The comparison results between different classifiers using various feature selection methods. In the first data subset corresponding to the method, the random forest (RF) algorithm consistently showed the highest accuracy among all feature selection methods, especially in BGWO. It performed very well on both high-dimensional and low-dimensional datasets, demonstrating its robustness. The other three classifiers did not show significant differences in recognition accuracy. When using PCC, BGA, and BPSO methods, the recognition accuracy of the DT algorithm was slightly higher than that of SVM and NN. The neural network performed poorly in the other feature selection algorithms, but showed strong performance in the BGWO method. This significant improvement shows that the effective feature selection of BGWO greatly improved the learning ability of the neural network. The SVM showed a moderate recognition accuracy, and when combined with different feature selection methods, it consistently selected more features, which confirmed its better performance on high-dimensional datasets.

[0045] It should be noted that in the second data subset, the recognition accuracy of the tree models (DT and RF) is significantly higher than that of SVM and neural network. The performance of decision tree in the second data subset containing 30 features is significantly better than that of the first data subset containing 188 features. DT performs better on low-dimensional data because such data sets can more effectively prevent overfitting in decision trees. Random forests continue to show the highest accuracy regardless of the feature selection method used. Since decision trees and random forests already perform very well on the original feature set, the feature selection algorithm does not significantly improve their recognition accuracy. However, these algorithms are still able to reduce the number of features without affecting accuracy. The low dimensionality of the second data subset imposes some restrictions on the effectiveness of feature selection algorithms. SVM's preference for high-dimensional data sets means that its recognition accuracy in the second data subset is not outstanding, and feature selection does not significantly improve its performance. Consistent with the performance in the first data subset, SVM performs better on high-dimensional data, which is why the feature selection algorithm leads to a reduction in features. The neural network exhibited similar behavior in the second data subset as in the first data subset, and the recognition accuracy was significantly improved only when the BGWO feature selection algorithm was used, which shows that the BGWO method plays an irreplaceable role in enhancing the ability of neural networks to select features for IoT device identification.

[0046] In addition, filter-based algorithms select features based on the statistical relationship between features or between features and the target variable, while wrapper-based feature selection algorithms select features through iterative training and model evaluation. In both the first and second data subsets, wrapper-based feature selection algorithms consistently show higher performance in improving recognition accuracy compared to filter-based feature selection algorithms. Filter-based feature selection methods are generally unable to reduce features without affecting recognition accuracy. The PCC feature selection algorithm significantly reduced the number of features in the first data subset, but also significantly reduced the recognition accuracy of SVM and NN. Similarly, the random forest algorithm performed slightly worse on the feature set selected by the MI-based feature selection method compared to the original feature set. Among the filter-based methods, the MI-based feature selection method outperformed the PCC-based feature selection method for SVM, NN, and DT classifiers in the first data subset. However, PCC was shown to be more effective for the RF classifier.

[0047] In contrast, wrapper-based feature selection algorithms reduce the number of features without reducing recognition accuracy. Among these methods, BGWO shows superior performance on all classifiers and datasets. Using the same number of search agents and iterations, BGWO selects fewer features while achieving higher accuracy for each classifier. Although BGA and BPSO are slightly less efficient than BGWO, they still significantly reduce the number of features and improve recognition accuracy. In the second data subset, BPSO and BGA select a comparable number of features for each classifier, with BPSO generally providing better accuracy improvements. BPSO is more effective than BGA in improving the accuracy of NN, DT, and RF classifiers, and BGA is only slightly better than BPSO for SVM algorithms. In Dataset2, which has fewer features, feature selection algorithms do not significantly improve the recognition accuracy of SVM, DT, and RF algorithms. However, it is still observed that wrapper-based feature selection methods outperform filter-based methods, and BGWO remains the best-performing feature selection algorithm, not only selecting a more concise set of features to improve recognition efficiency, but also improving recognition accuracy. Compared with other classifiers, neural networks (NNs) are more sensitive to feature selection, and similar to the performance in the first data subset, BGWO shows a significant performance improvement. BGWO significantly improves the performance of NN by selecting the most relevant features to help it. BPSO and BGA also improve the recognition performance of NN to some extent, while PCC and MI do not improve the classification accuracy of NN.

[0048] It should be understood that the present invention has performed a performance evaluation on several high-reputation ML classifiers for IoT device identification, and evaluated the effectiveness of network traffic features by utilizing various feature selection methods (including filter-based and wrapper-based algorithms) to fit the best model and achieve the best accuracy among different classifiers. In addition, BGWO was introduced to determine the best feature subset for IoT device identification, and two public IoT network traffic datasets were used to ensure the reliability of the identification results. The wrapper-based feature selection algorithm outperformed the filter-based method in terms of accuracy and feature parsimony. BGWO was proven to be the most effective feature selection method, significantly improving the performance of RF and NN classifiers. Compared with other wrapper-based methods such as BPSO and BGA, BGWO selected fewer features while achieving higher accuracy in all classifiers. In order to obtain more reliable results, larger datasets containing more devices and more features can provide a deeper understanding of the behavior of classifiers and feature selection methods.

[0049] In all examples shown and described herein, any specific values ​​should be interpreted as merely exemplary and not as limiting, and thus other examples of the exemplary embodiments may have different values.

[0050] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, further definition and explanation thereof is not required in subsequent drawings.

[0051] The above-mentioned embodiments only express several implementation methods of the present invention, and the description thereof is relatively specific and detailed, but it cannot be understood as limiting the scope of the present invention. It should be pointed out that for ordinary technicians in this field, several modifications and improvements can be made without departing from the concept of the present invention, which all belong to the protection scope of the present invention.

Claims

1. A method for identifying IoT devices based on machine learning, characterized in that: The following steps are involved: Acquire a data set containing network traffic of IoT devices, and perform data preprocessing on the data set to obtain network traffic of multiple IoT devices, wherein the data set includes a training set and a test set, the training set containing labels is used to train the model, and the test set is used to test the classification performance of the model; Extracting a plurality of traffic features from the network traffic using a plurality of feature selection algorithms to determine an optimal feature subset, wherein the number of selected traffic features ranges from a minimum value to a maximum value of the entire device traffic; The optimal feature subset is input into the trained machine learning model to perform IoT device identification to obtain a device identification result, and a comparative analysis is performed based on the feature selection algorithms corresponding to the device identification result to complete IoT device identification.

2. The method for identifying IoT devices based on machine learning according to claim 1, characterized in that: Get a dataset containing network traffic from IoT devices, including: After the machine learning model is trained on the labeled training set, the test set is used to predict the device labels of the test set without labels, where the classification performance of the machine learning model is measured by accuracy, which is the ratio of correctly predicted observations to total observations, and the corresponding expression is: （1） Among them, T or F indicates whether the prediction result is right or wrong, P or N indicates whether the label of the predicted class is correct or incorrect, TP indicates the number of correctly classified positive instances, FP indicates the number of misclassified negative instances, TN indicates the number of correctly classified negative instances, and FN indicates the number of misclassified positive instances.

3. The method for identifying IoT devices based on machine learning according to claim 1, characterized in that: The data set is preprocessed to obtain network traffic of multiple IoT devices, including: Dividing the data set into a first data subset and a second data subset, normalizing a first feature of the first data subset, and removing irrelevant features or features with zero variance to obtain a second feature, wherein the number of devices and the type of devices in the first feature and the second feature are the same; The device type of the second data subset is converted and the corresponding feature is added to obtain a third feature, the device quantity and features are filtered and normalized according to the third feature, and irrelevant features or features with zero variance are removed to obtain a fourth feature, wherein the fourth feature and the third feature have the same device type; The feature selection process is as follows: Select a new feature subset , F is the number of selected features, is the number of original features.

4. The method for identifying IoT devices based on machine learning according to claim 1, characterized in that: A plurality of traffic features are extracted from the network traffic using a plurality of feature selection algorithms to determine an optimal feature subset, including: The feature selection algorithms include filter-based feature selection and wrapper-based feature selection, wherein the filter-based feature selection ranks features according to certain statistical criteria; and independently evaluates the relevance of each feature, and the filter-based feature selection includes Pearson correlation coefficient PCC and common information MI; The Pearson correlation coefficient was used to evaluate the linear relationship between two continuous variables. The value range of the Pearson correlation coefficient was from -1 to +1, where -1 indicated a perfect negative linear correlation, 0 indicated no linear correlation, and +1 indicated a perfect positive linear correlation. Pearson correlation coefficient is calculated by dividing the covariance of the two variables by the product of their standard deviations. The expression is: （2） in, is the covariance, yes The standard deviation of yes When using the Pearson correlation coefficient to select features, calculate the correlation coefficient between each feature and remove the features with the highest absolute correlation coefficient with other features; The common information MI is used to measure the correlation of random variables. It measures the amount of information inferred from one variable by observing the value of another variable. The expression of the common information MI between two discrete random variables X and Y is: （3） in, is the joint probability distribution function of X and Y, and are the probability distribution functions of X and Y respectively.

5. The method for identifying IoT devices based on machine learning according to claim 4, characterized in that: The wrapper-based feature selection algorithms include binary genetic algorithm (BGA) and particle swarm optimization (PSO) algorithm. The binary genetic algorithm (BGA) is selected based on data attributes and direct performance on specific classifiers. The binary genetic algorithm is used to simulate selection, crossover and mutation genetic operations to optimize feature subsets. The execution process of the binary genetic algorithm BGA is as follows: randomly generate an initial chromosome population, each chromosome represents a feature subset, and each chromosome can be represented as a binary vector, where 1 represents the selected feature and 0 represents the unselected feature; use the fitness function to evaluate the fitness of each chromosome, which measures the performance of the feature subset in the classification task, and select chromosomes as parents based on the fitness value to generate the next generation, where the selected parent chromosomes are prone to generate new offspring chromosomes after crossover, and the offspring chromosomes mutate with a certain probability; the new generation of chromosomes replaces the unsuitable chromosomes of the previous generation, and the process is repeated until the stopping criteria are met; Each ion in the ion swarm optimization PSO algorithm corresponds to an individual in the group and is characterized by a feature subset as its position in the search space. The execution process of the ion swarm optimization PSO algorithm is: randomly generate a set of particles representing the feature subset, initialize the speed and position of each particle, use the fitness function to evaluate the fitness of each particle position, and determine the global optimal position; wherein, in each iteration, the speed and position of each ion will be updated according to its optimal position and the global optimal position until the maximum number of iterations is reached or the global optimal fitness value is not significantly improved. The speed update equation is as follows: （4） in, represents the velocity of particle i at time t, represents the position of particle i, represents the position experienced by particle i, represents the positions experienced by all ions, represents the inertia weight, and It is the learning factor. and is a random number between 0 and 1, and the position of the ion in binary space consists of 1 and 0, and Indicates the selection and non-selection of features; the speed passes through the function The logical transformation is expressed as formula (6) The probability of is 1, and the position of the ion is updated based on formula (5): （5） （6）。 6. The method for identifying IoT devices based on machine learning according to claim 5, characterized in that: The feature selection algorithm also includes a binary gray wolf optimizer that divides the gray wolves into , , and , is the best solution found by the leader representative, is the best candidate representing the second best solution, The third level represents the third best solution. Represents the rest of the wolves and is at the lowest level; The gray wolves are randomly distributed in the search space to represent candidate solutions, and the corresponding positions are iteratively updated to improve the quality of the solution. The positions of the gray wolves during the hunting process are embedded in the mathematical model provided by the following equation: （7） （8） in, is the position of the gray wolf, t represents the number of current iterations, Indicates the location of the prey, The definition of refers to formula (3), , Using equations (9) and (10) yields: （9） （10） in, and from Randomly select from It decreases linearly from 2 to 0 and is defined as: （11） Among them, the maximum number of iterations is denoted as t; Indicates the drive to hunt, and They may also be involved in hunting, and the hunting behavior of gray wolves can be used to predict , and More information about the location of the prey will be obtained.

7. The method for identifying IoT devices based on machine learning according to claim 6, characterized in that: After the first three candidate solutions are completed, the remaining search agents adjust their positions to match the best search position of the agent position. Equation (12) shows the updated position: （12） in, , , Defined in formulas (13), (14) and (15) respectively: （13） （14） （15） in, , , are the first three best solutions at iteration t, , , The definition is as follows: （16） （17） （18） The binary variant of the Gray Wolf Optimizer is used for feature selection to perform the binary Gray Wolf Optimizer BGWO. The formula for calculating the new position in (12) is rewritten using formula (19): （19） According to formula (20), the probability of adopting the decision variable is given by The value of is represented by , where r is a number randomly chosen between 0 and 1: （20）。 8. The method for identifying IoT devices based on machine learning according to claim 7, characterized in that: The fitness function used in the binary grey wolf optimizer BGWO is used to evaluate the feature set used to identify IoT devices using supervised learning algorithms. The corresponding expression is: （21） in, is the classification accuracy in formula (1), is the length of the original feature, N is the length of the selected feature set, is the weight of classification accuracy relative to the evaluation criterion.

9. The method for identifying IoT devices based on machine learning according to claim 1, characterized in that: The supervised classifier of the machine learning model includes at least one of a decision tree, a random forest, a support vector machine, or a neural network.

10. An IoT device identification device based on machine learning, characterized in that: The method for identifying an IoT device based on machine learning as described in any one of claims 1 to 9 comprises: A data acquisition module is used to acquire a data set containing network traffic of IoT devices, and perform data preprocessing on the data set to obtain network traffic of multiple IoT devices, wherein the data set includes a training set and a test set, the training set containing labels is used to train the model, and the test set is used to test the classification performance of the model; a feature selection module, for extracting a plurality of traffic features from the network traffic using a plurality of feature selection algorithms to determine an optimal feature subset, wherein the number of the selected traffic features ranges from a minimum value to a maximum value of the entire device traffic; The device identification module is used to input the optimal feature subset into the trained machine learning model to perform IoT device identification to obtain device identification results, and perform comparative analysis based on the feature selection algorithms corresponding to the device identification results to complete IoT device identification.

Images