Equipment identification method and device based on large model

Abstract

The invention belongs to the technical field of equipment monitoring, and discloses an equipment identification method and device based on a large model. The method comprises the following steps: acquiring original traffic data of to-be-identified equipment; segmenting and intercepting the original traffic data to obtain first reference traffic data; rejecting the flow data of redundant equipment from the first reference flow data by utilizing an equipment filtering model to obtain second reference flow data; enhancing the second reference traffic data to obtain target traffic data; and identifying an attacked device based on the target traffic data by using a device identification large model. Through the above mode, the traffic data is processed for multiple times and combined with the large model, so that the safety protection capability of the equipment is remarkably improved, and normal operation of the equipment can be ensured.

Description

Technical Field

[0001] The present invention relates to the technical field of equipment monitoring, and in particular to an equipment identification method and device based on a large model. Background Art

[0002] With the continuous advancement of industrial intelligent science and technology, the Industrial Internet of Things technology has been born. The Industrial Internet of Things integrates contemporary communication technology and industrial technology, and is often used for the management of industrial equipment, such as the monitoring of power equipment and the management of power systems. The current Industrial Internet of Things technology has security issues. Attackers can analyze network communication traffic and launch targeted network attacks on specific vulnerable devices, which may cause sensitive data leakage or malicious tampering, seriously affecting the safe and stable operation of industrial equipment.

[0003] Although the problem of manual feature extraction has been solved for the security of the industrial Internet of Things, the existing device identification algorithms still have weak device security protection capabilities and are unable to effectively manage and maintain the normal operation of the equipment.

[0004] The above contents are only used to assist in understanding the technical solution of the present invention and do not constitute an admission that the above contents are prior art. Summary of the invention

[0005] The main purpose of the present invention is to provide a large model-based equipment identification method and device, aiming to solve the technical problem that the existing equipment identification algorithm still has weak equipment security protection capabilities and cannot effectively manage and maintain the normal operation of the equipment.

[0006] To achieve the above object, the present invention provides a device identification method based on a large model, and the device identification method based on a large model comprises the following steps:

[0007] Obtain the original traffic data of the device to be identified;

[0008] The original flow data is segmented and intercepted to obtain first reference flow data;

[0009] Using a device filtering model to remove the flow data of redundant devices from the first reference flow data, to obtain second reference flow data;

[0010] enhancing the second reference flow data to obtain target flow data;

[0011] The device identification model is used to identify the attacked device based on the target traffic data.

[0012] In some embodiments, the segmenting and intercepting of the original traffic data to obtain the first reference traffic data includes:

[0013] Identifying traffic data that complies with a preset protocol in the original traffic data;

[0014] dividing the traffic data conforming to the preset protocol into two-way conversation traffic data;

[0015] Clean irrelevant fields and files of bidirectional conversation traffic data;

[0016] Each session flow data after irrelevant fields and file cleaning processing is cut into fixed-length fields and converted into a preset format for storage to obtain first reference flow data.

[0017] In some embodiments, the irrelevant fields and files are cleaned to remove irrelevant MAC or IP address fields in the bidirectional session traffic data, and to delete empty files or duplicate files at the application layer in the session flow. The interception length is 600 bytes, and the intercepted traffic data in the same format is converted into the IDX file format for storage.

[0018] In some embodiments, the device filtering model includes a standard convolution layer, a first pooling layer, a first composite convolution layer, a second composite convolution layer, a second pooling layer, a fully connected layer and an output layer. The standard convolution layer has 32 channels and a convolution kernel size of 3×3. The convolution kernel size of the maximum pooling layer corresponding to the first pooling layer and the second pooling layer is 2×2 and the step size is 2. The first composite convolution layer and the second composite convolution layer are composed of deep separation convolution and attention mechanism, wherein the deep separation convolution includes channel-by-channel convolution and point-by-point convolution. The neurons of the fully connected layer are connected to all neurons in the previous layer. The convolution result of the second pooling layer is converted into a one-dimensional vector for classification. The output layer uses a Softmax activation function to output the classification result.

[0019] In some embodiments, the standard convolutional layer is used to capture the characteristics of the input data, expressed as F k =σ(F k- 1 W k +b k ), where F k is the k-th layer feature map, F k-1 is the k-1th layer feature map, σ(·) is the ReLU activation function, W k is the k-th layer weight, b k is the bias of the kth layer; the maximum pooling layer with a convolution kernel size of 2×2 and a step size of 2 is used for downsampling, and the feature map is compressed by half to remove redundant information. The expression is F k =maxpool(F k-1 ), where maxpool(·) is the maximum pooling operation.

[0020] In some embodiments, the step of enhancing the second reference flow data to obtain target flow data includes:

[0021] Determine the data volume corresponding to the flow data of each device type in the second reference flow data;

[0022] Perform data balancing on the flow data that is lower than the preset data volume to obtain balanced data;

[0023] The balanced data is expanded to the second reference flow data to obtain target flow data.

[0024] In some embodiments, the step of using a device identification model to identify the attacked device based on the target traffic data includes:

[0025] The feature map corresponding to the input target flow data is transferred to the standard convolution, where the number of channels corresponding to the standard convolution is C 1 , the convolution kernel sizes are 5×5 and 3×3 respectively;

[0026] Multiple convolution operations are performed through the standard convolution, and the convolution results are merged into a high-dimensional output feature map. The number of channels of the high-dimensional output feature map is C 2 ;

[0027] Device features are obtained according to the high-dimensional output feature graph, and the attacked device is identified according to the device features.

[0028] In addition, to achieve the above-mentioned purpose, the present invention further proposes a device identification apparatus based on a large model, and the device identification apparatus based on a large model comprises:

[0029] The acquisition module is used to obtain the original flow data of the device to be identified;

[0030] A processing module, used for segmenting and intercepting the original flow data to obtain first reference flow data;

[0031] The processing module is used to remove the flow data of redundant devices from the first reference flow data by using the device filtering model to obtain second reference flow data;

[0032] The processing module is used to enhance the second reference flow data to obtain target flow data;

[0033] The identification module is used to identify the attacked device based on the target traffic data by using the device identification model.

[0034] In some embodiments, the processing module is used to identify the flow data that complies with a preset protocol in the original flow data;

[0035] dividing the traffic data conforming to the preset protocol into two-way conversation traffic data;

[0036] Clean irrelevant fields and files of bidirectional conversation traffic data;

[0037] Each session flow data after irrelevant fields and file cleaning processing is cut into fixed-length fields and converted into a preset format for storage to obtain first reference flow data.

[0038] In some embodiments, the irrelevant fields and files are cleaned to remove irrelevant MAC or IP address fields in the bidirectional session traffic data, and to delete empty files or duplicate files at the application layer in the session flow. The interception length is 600 bytes, and the intercepted traffic data in the same format is converted into the IDX file format for storage.

[0039] The present invention obtains the original flow data of the device to be identified; divides and intercepts the original flow data to obtain the first reference flow data; uses the device filtering model to remove the flow data of redundant devices from the first reference flow data to obtain the second reference flow data; enhances the second reference flow data to obtain the target flow data; and uses the device identification model to identify the attacked device based on the target flow data. In the above manner, through multiple processing of the flow data and combining with the large model, the security protection capability of the device is significantly improved, and the normal operation of the device can be guaranteed. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 It is a flowchart of the first embodiment of the device identification method based on a large model of the present invention;

[0041] Figure 2 A schematic diagram of the model structure of a device filtering model in a device identification method based on a large model of the present invention;

[0042] Figure 3 It is a structural block diagram of the first embodiment of the device identification apparatus based on large model of the present invention.

[0043] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0044] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.

[0045] The embodiment of the present invention provides a device identification method based on a large model, referring to Figure 1 , Figure 1 The figure is a flow chart of a first embodiment of a device identification method based on a large model of the present invention.

[0046] In this embodiment, the device identification method based on the large model includes the following steps:

[0047] Step S10: Obtaining the original flow data of the device to be identified.

[0048] In this embodiment, the executor of this embodiment is a device identification device based on a large model, wherein the device identification device based on a large model has functions such as data processing, data communication and program running. The device identification device based on a large model can be a computer terminal device or other network device, and of course it can also be other devices with similar functions, and this embodiment does not limit this.

[0049] It should be noted that although the current security issues of the Industrial Internet of Things have solved the problem of difficulty in manually extracting features, the existing device identification algorithms still have the problem of weak equipment security protection capabilities and are unable to effectively manage and maintain the normal operation of equipment.

[0050] In order to solve the above technical problems, in this embodiment, the original flow data of the device to be identified is obtained; the original flow data is segmented and intercepted to obtain the first reference flow data; the flow data of redundant devices is removed from the first reference flow data using the device filtering model to obtain the second reference flow data; the second reference flow data is enhanced to obtain the target flow data; the device identification model is used to identify the attacked device based on the target flow data. In the above manner, through multiple processing of the flow data and combining with the large model, the security protection capability of the device is significantly improved, and the normal operation of the device can be ensured. Specifically, it can be implemented in the following manner.

[0051] In a specific implementation, the present embodiment needs to first obtain the original flow data of the device to be identified. Assume that the original flow data is P, and the original flow data P is also the data packet p. i P = {p i ,p 2 ,...,p Q}, data packet p i With five-tuple information a i , packet length l i etc., so p i ={a i ,l i ,...}, the five-tuple information includes the source IP address, destination IP address, source port, destination port and transport layer protocol, which can uniquely mark a network communication connection. It should be noted that all data packets with the same five-tuple information are unidirectional flows. i The exchange of source and destination is a bidirectional flow. All pi It is called a conversation flow.

[0052] Step S20: dividing and intercepting the original flow data to obtain first reference flow data.

[0053] Based on the above-mentioned original traffic data, the present embodiment further performs segmentation and interception processing on it. The specific process is to identify the traffic data that conforms to the preset protocol in the original traffic data; segment the traffic data that conforms to the preset protocol into two-way conversation traffic data; perform irrelevant field and file cleaning on the two-way conversation traffic data; intercept the fixed-length field of each conversation flow data after the irrelevant field and file cleaning processing and convert it into a preset format for storage to obtain the first reference traffic data.

[0054] It should be noted that the preset protocol can be set to TCP or IP protocol. The splitting and interception processing is for the traffic data of TCP or IP protocol. The splitting can be performed according to the unidirectional flow. The splitting retains P by default. i All layers of the OSI model, that is, the original traffic data P is divided into sessions, and P is retained. i All layer information. Irrelevant fields and files are cleaned to remove irrelevant MAC or IP address fields in the two-way session traffic data, and to delete empty files or duplicate files at the application layer in the session flow. This method can reduce the amount of data, avoid model recognition offset, and deduplicate the same traffic. The traffic data needs to maintain the same dimension and input the subsequent model. Specifically, the fixed last byte of all traffic can be intercepted. If the length is greater than the preset length L, only the first L bytes are intercepted. If it is less than the preset length L, 0x00 is added thereafter until the length meets L bytes. In this embodiment, the interception length is 600 bytes, and the traffic data of the same format after interception is converted into the IDX file format for storage.

[0055] Step S30: using a device filtering model to remove the flow data of redundant devices from the first reference flow data to obtain second reference flow data.

[0056] It should be noted that the model structure of the device filtering model in this embodiment can refer to Figure 2As shown, the device filtering model includes a standard convolution layer, a first pooling layer, a first composite convolution layer, a second composite convolution layer, a second pooling layer, a fully connected layer and an output layer. The standard convolution layer has 32 channels and a convolution kernel size of 3×3. The convolution kernel size of the maximum pooling layer corresponding to the first pooling layer and the second pooling layer is 2×2 and the step size is 2. The first composite convolution layer and the second composite convolution layer are composed of deep separation convolution and attention mechanism, wherein the deep separation convolution includes channel-by-channel convolution and point-by-point convolution. The neurons of the fully connected layer are connected to all neurons in the previous layer. The convolution result of the second pooling layer is converted into a one-dimensional vector for classification. The output layer uses the Softmax activation function to output the classification result.

[0057] Furthermore, the standard convolutional layer is used to capture the features of the input data, expressed as F k =σ(F k-1 W k +b k ), where F k is the k-th layer feature map, F k-1 is the k-1th layer feature map, σ(·) is the ReLU activation function, W k is the k-th layer weight, b k is the bias of the kth layer; the maximum pooling layer with a convolution kernel size of 2×2 and a step size of 2 is used for downsampling, and the feature map is compressed by half to remove redundant information. The expression is F k =maxpool(F k-1 ), where maxpool(·) is the maximum pooling operation. Channel-by-channel convolution applies a single convolution filter to a single channel of the input, and point-by-point convolution uses multiple 1×1 convolution kernels to harvest the output information of different channels of channel-by-channel convolution. New features are constructed through linear combination, which can effectively make up for the problems of many parameters and large amount of calculation brought by standard convolution, and significantly reduce the size of the model. The attention mechanism in this embodiment can adopt Squeeze-and-Excitation Networks (SENet), Efficient Channel Attention for Deep Convolutional Neural Networks (ECANet), GENet, Selective Kernel Network (SKNet), etc., which can be set according to actual needs, and are not limited in this embodiment.

[0058] Step S40: enhancing the second reference flow data to obtain target flow data.

[0059] It can be understood that the original traffic data obtained in this embodiment is a collection of traffic data of different types of equipment. In actual situations, there may be less traffic data of a certain type of equipment. The data volume corresponding to the traffic data of each device type in the second reference traffic data can be determined to identify traffic data lower than the preset data volume, that is, traffic data of devices with less traffic data. For such data, the method adopted is to balance it, and data enhancement is to expand the balanced traffic data to the second reference traffic data, so as to obtain the target traffic data.

[0060] In some embodiments, the specific process of balancing is to distribute the traffic data below the preset data volume as the real data. data ; Build a generator, input 100-dimensional Gaussian random noise, and map it to D data Same dimension, as false data distribution D fake ; Build a discriminator and uniformly sample D data With D fake , calculate the regularization term Gradient Penalize, the penalty coefficient λ = 10, add it to the discriminator objective function, and constrain the discriminator to satisfy the 1-Lipschitz distribution; D data With D fake They are input into the discriminator respectively, assisted by regularization terms, the loss function is calculated, gradient back propagation is performed, and the discriminator parameters are updated; after the discriminator is trained N times (N is the number of times the discriminator needs to iterate every time the generator is updated i times), the 100-dimensional Gaussian random noise is input into the generator again, the generated false data distribution is input into the discriminator, the loss function is calculated and the generator parameters are updated; after the generator and the discriminator reach equilibrium after multiple training games, the balanced data is expanded to the original traffic data set.

[0061] Step S50: using the device identification model to identify the attacked device based on the target traffic data.

[0062] In a specific implementation, the feature map corresponding to the input target flow data is transmitted to the standard convolution, wherein the number of channels corresponding to the standard convolution is C 1 , the convolution kernel sizes are 5×5 and 3×3 respectively; multiple convolution operations are performed through the standard convolution, and the convolution results are merged into a high-dimensional output feature map, and the number of channels of the high-dimensional output feature map is C 2 ; Obtain device features according to the high-dimensional output feature map, and identify the attacked device according to the device features. Assuming that the input size is C×W×H (number of channels×width×height), the high-dimensional output feature map finally obtained is C 2 ×W×H.

[0063] In this embodiment, the original flow data of the device to be identified is obtained; the original flow data is segmented and intercepted to obtain the first reference flow data; the flow data of redundant devices is removed from the first reference flow data using the device filtering model to obtain the second reference flow data; the second reference flow data is enhanced to obtain the target flow data; the device identification model is used to identify the attacked device based on the target flow data. In the above manner, through multiple processing of the flow data and combining with the large model, the security protection capability of the device is significantly improved, and the normal operation of the device can be ensured.

[0064] Reference Figure 3 , Figure 3 It is a structural block diagram of the first embodiment of the device identification apparatus based on large model of the present invention.

[0065] like Figure 3 As shown, the device identification apparatus based on a large model proposed in an embodiment of the present invention includes:

[0066] The acquisition module 10 is used to obtain the original flow data of the device to be identified;

[0067] The processing module 20 is used to segment and intercept the original flow data to obtain first reference flow data;

[0068] The processing module 20 is used to remove the flow data of redundant devices from the first reference flow data by using the device filtering model to obtain second reference flow data;

[0069] The processing module 20 is used to enhance the second reference flow data to obtain target flow data;

[0070] The identification module 30 is used to identify the attacked device based on the target traffic data by using the device identification model.

[0071] In this embodiment, the original flow data of the device to be identified is obtained; the original flow data is segmented and intercepted to obtain the first reference flow data; the flow data of redundant devices is removed from the first reference flow data using the device filtering model to obtain the second reference flow data; the second reference flow data is enhanced to obtain the target flow data; the device identification model is used to identify the attacked device based on the target flow data. In the above manner, through multiple processing of the flow data and combining with the large model, the security protection capability of the device is significantly improved, and the normal operation of the device can be ensured.

[0072] In some embodiments, the processing module 20 is used to identify the flow data that complies with a preset protocol in the original flow data;

[0073] dividing the traffic data conforming to the preset protocol into two-way conversation traffic data;

[0074] Clean irrelevant fields and files of bidirectional conversation traffic data;

[0075] Each session flow data after irrelevant fields and file cleaning processing is cut into fixed-length fields and converted into a preset format for storage to obtain first reference flow data.

[0076] In some embodiments, the irrelevant fields and files are cleaned to remove irrelevant MAC or IP address fields in the bidirectional session traffic data, and to delete empty files or duplicate files at the application layer in the session flow. The interception length is 600 bytes, and the intercepted traffic data in the same format is converted into the IDX file format for storage.

[0077] In some embodiments, the device filtering model includes a standard convolution layer, a first pooling layer, a first composite convolution layer, a second composite convolution layer, a second pooling layer, a fully connected layer and an output layer. The standard convolution layer has 32 channels and a convolution kernel size of 3×3. The convolution kernel size of the maximum pooling layer corresponding to the first pooling layer and the second pooling layer is 2×2 and the step size is 2. The first composite convolution layer and the second composite convolution layer are composed of deep separation convolution and attention mechanism, wherein the deep separation convolution includes channel-by-channel convolution and point-by-point convolution. The neurons of the fully connected layer are connected to all neurons in the previous layer. The convolution result of the second pooling layer is converted into a one-dimensional vector for classification. The output layer uses a Softmax activation function to output the classification result.

[0078] In some embodiments, the standard convolutional layer is used to capture the characteristics of the input data, expressed as F k =σ(F k- 1 W k +b k ), where F k is the k-th layer feature map, F k-1 is the k-1th layer feature map, σ(·) is the ReLU activation function, W k is the k-th layer weight, b k is the bias of the kth layer; the maximum pooling layer with a convolution kernel size of 2×2 and a step size of 2 is used for downsampling, and the feature map is compressed by half to remove redundant information. The expression is F k =maxpool(F k-1 ), where maxpool(·) is the maximum pooling operation.

[0079] In some embodiments, the processing module 20 is used to determine the data volume corresponding to the flow data of each device type in the second reference flow data;

[0080] Perform data balancing on the flow data that is lower than the preset data volume to obtain balanced data;

[0081] The balanced data is expanded to the second reference flow data to obtain target flow data.

[0082] In some embodiments, the recognition module 30 is used to transmit the feature map corresponding to the input target flow data to the standard convolution, wherein the number of channels corresponding to the standard convolution is C 1 , the convolution kernel sizes are 5×5 and 3×3 respectively;

[0083] Multiple convolution operations are performed through the standard convolution, and the convolution results are merged into a high-dimensional output feature map. The number of channels of the high-dimensional output feature map is C 2 ;

[0084] Device features are obtained according to the high-dimensional output feature graph, and the attacked device is identified according to the device features.

[0085] An embodiment of the present application also provides a large model-based device identification device, including a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus, and the memory is used to store a large model-based device identification program; the processor is used to implement the above-mentioned large model-based device identification method when executing the program stored in the memory.

[0086] The communication bus mentioned in the above-mentioned device identification device based on the large model can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc.

[0087] The communication interface is used for communication between the above-mentioned large model-based device identification device and other devices.

[0088] The memory may include a random access memory (RAM) or a non-volatile memory (NVM), such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0089] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, and discrete hardware components.

[0090] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated. The available medium may be a magnetic medium, (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive Solid State Disk (SSD)), etc.

[0091] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0092] Each embodiment in this specification is described in a related manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0093] The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

[0094] It should be understood that the above is only an example and does not constitute any limitation on the technical solution of the present invention. In specific applications, technicians in this field can make settings as needed, and the present invention does not limit this.

[0095] It should be noted that the workflow described above is merely illustrative and does not limit the scope of protection of the present invention. In practical applications, technicians in this field can select part or all of them according to actual needs to achieve the purpose of the present embodiment, and no limitation is made here.

[0096] In addition, for technical details that are not described in detail in this embodiment, reference can be made to the large model-based device identification method provided in any embodiment of the present invention, and will not be repeated here.

[0097] In addition, it should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or system. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or system including the element.

[0098] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0099] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as a read-only memory (ROM) / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0100] The above are only preferred embodiments of the present invention, and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

[0101] It is understandable that the system provided by the embodiment of the present invention corresponds to the method provided by the embodiment of the present invention, and the explanation, examples and beneficial effects of the relevant contents can refer to the corresponding parts in the above method.

Claims

1. A device identification method based on a large model, characterized in that: The device identification method based on the large model includes: Obtain the original traffic data of the device to be identified; The original flow data is segmented and intercepted to obtain first reference flow data; Using a device filtering model to remove the flow data of redundant devices from the first reference flow data, to obtain second reference flow data; enhancing the second reference flow data to obtain target flow data; The device identification model is used to identify the attacked device based on the target traffic data.

2. The device identification method based on a large model as claimed in claim 1, characterized in that: The segmenting and intercepting of the original flow data to obtain the first reference flow data includes: Identifying traffic data that complies with a preset protocol in the original traffic data; dividing the traffic data conforming to the preset protocol into two-way conversation traffic data; Clean irrelevant fields and files of bidirectional conversation traffic data; Each session flow data after irrelevant fields and file cleaning processing is cut into fixed-length fields and converted into a preset format for storage to obtain first reference flow data.

3. The device identification method based on a large model as claimed in claim 2, characterized in that: The irrelevant fields and files cleaning is to remove irrelevant MAC or IP address fields in the two-way session traffic data, and delete empty files or duplicate files at the application layer in the session flow. The interception length is 600 bytes, and the intercepted traffic data in the same format is converted into IDX file format for storage.

4. The device identification method based on a large model as claimed in claim 1, characterized in that: The device filtering model includes a standard convolution layer, a first pooling layer, a first composite convolution layer, a second composite convolution layer, a second pooling layer, a fully connected layer and an output layer. The standard convolution layer has 32 channels and a convolution kernel size of 3×3. The convolution kernel size of the maximum pooling layer corresponding to the first pooling layer and the second pooling layer is 2×2 and the step size is 2. The first composite convolution layer and the second composite convolution layer are composed of deep separation convolution and attention mechanism, wherein the deep separation convolution includes channel-by-channel convolution and point-by-point convolution. The neurons of the fully connected layer are connected to all neurons in the previous layer. The convolution result of the second pooling layer is converted into a one-dimensional vector for classification. The output layer uses a Softmax activation function to output the classification result.

5. The device identification method based on a large model as claimed in claim 5, characterized in that: The standard convolutional layer is used to capture the features of the input data, expressed as F k =σ(F k-1 W k +b k ), where F k is the k-th layer feature map, F k-1 is the k-1th layer feature map, σ(·) is the ReLU activation function, W k is the k-th layer weight, b k is the bias of the kth layer; the maximum pooling layer with a convolution kernel size of 2×2 and a step size of 2 is used for downsampling, and the feature map is compressed by half to remove redundant information. The expression is F k =maxpool(F k-1 ), where maxpool(·) is the maximum pooling operation.

6. The device identification method based on a large model as claimed in claim 1, characterized in that: The step of enhancing the second reference flow data to obtain target flow data includes: Determine the data volume corresponding to the flow data of each device type in the second reference flow data; Perform data balancing on the flow data that is lower than the preset data volume to obtain balanced data; The balanced data is expanded to the second reference flow data to obtain target flow data.

7. The large model-based device identification method according to any one of claims 1 to 6, characterized in that: The method of using a large device identification model to identify the attacked device based on the target traffic data includes: The feature map corresponding to the input target flow data is transferred to the standard convolution, where the number of channels corresponding to the standard convolution is C1, and the convolution kernel sizes are 5×5 and 3×3 respectively; Perform multiple convolution operations through the standard convolution, and merge the convolution results into a high-dimensional output feature map, where the number of channels of the high-dimensional output feature map is C2; Device features are obtained according to the high-dimensional output feature graph, and the attacked device is identified according to the device features.

8. A device identification device based on a large model, characterized in that: The device identification device based on the large model includes: The acquisition module is used to obtain the original flow data of the device to be identified; A processing module, used for segmenting and intercepting the original flow data to obtain first reference flow data; The processing module is used to remove the flow data of redundant devices from the first reference flow data by using the device filtering model to obtain second reference flow data; The processing module is used to enhance the second reference flow data to obtain target flow data; The identification module is used to identify the attacked device based on the target traffic data by using the device identification model.

9. The device identification apparatus based on a large model as claimed in claim 8, characterized in that: The processing module is used to identify the flow data that complies with the preset protocol in the original flow data; dividing the traffic data conforming to the preset protocol into two-way conversation traffic data; Clean irrelevant fields and files of bidirectional conversation traffic data; Each session flow data after irrelevant fields and file cleaning processing is cut into fixed-length fields and converted into a preset format for storage to obtain first reference flow data.

10. The device identification apparatus based on a large model as claimed in claim 9, characterized in that: The irrelevant fields and files cleaning is to remove irrelevant MAC or IP address fields in the two-way session traffic data, and delete empty files or duplicate files at the application layer in the session flow. The interception length is 600 bytes, and the intercepted traffic data in the same format is converted into IDX file format for storage.

Images