Method and system for automatically identifying Internet of Things equipment based on comprehensive feature analysis

Abstract

The invention discloses an Internet of Things equipment automatic identification method and system based on comprehensive feature analysis, and relates to the technical field of power systems, and the method comprises the steps: obtaining the information of accessed Internet of Things equipment, analyzing a data packet transmitted by a network, and identifying an equipment application data mode and a communication protocol; based on the collected Internet of Things equipment information, in combination with an application data mode and a communication protocol, constructing fingerprint features of the equipment; inputting the equipment fingerprint features into a pre-trained machine learning model, and outputting an equipment identification result; and generating an equipment identification report according to the equipment identification result and the equipment fingerprint features, and performing risk assessment on the identified equipment. According to the method, the type of the equipment is accurately identified, and reliable decision support is provided for subsequent equipment management and maintenance; and risk identification is carried out on the identified equipment, so that timely adjustment of security strategies and defense measures is facilitated, occurrence of security accidents is reduced, and stable operation of a power system is guaranteed.

Description

Technical Field

[0001] The present invention relates to the technical field of power systems, and in particular to an automatic identification method and system for Internet of Things devices based on comprehensive feature analysis. Background Art

[0002] With the rapid development of Internet of Things technology, the application of power Internet of Things in modern power grids has become more and more extensive; Power Internet of Things is a new intelligent network system that combines Internet of Things technology and power systems. It realizes real-time monitoring and management of power generation, transmission, distribution and consumption through a large number of sensors and intelligent devices; the application of this technology has greatly improved the efficiency and reliability of the power system, reduced operating costs, and also improved the security and flexibility of power supply. In the power Internet of Things system, various devices such as smart meters, transformer monitoring equipment, temperature sensors, voltage monitoring equipment, etc. are connected through the network to continuously collect and transmit data to the central management system; these data are crucial for the operation of the power system. Including but not limited to power load monitoring, equipment status assessment, fault prediction and energy management; however, with the increase in the number of devices and the increase in system complexity, how to ensure the safe and accurate identification and management of these devices has become an important issue. There are many types of devices in the power Internet of Things, including various sensors, controllers and intelligent terminals, which have different hardware configurations, software environments and communication protocols.

[0003] Therefore, the diversity and complexity of devices have brought significant challenges to device management. Accurate identification of devices is not only related to the normal operation of the system, but also directly affects the security of the system. Incorrect or ambiguous device identification may lead to incorrect data processing or incorrect decision support, which in turn affects the stability and reliability of the power system. In addition, the security threats faced by power IoT devices are increasing, including hardware attacks, software attacks, and network attacks. The security of devices has become a priority in system design. The security vulnerabilities of a device may be exploited to carry out a wider network attack, endangering the security of the entire power system. Therefore, it is necessary not only to accurately identify the devices, but also to evaluate and manage their potential security risks. Automatic identification and risk assessment of devices are particularly critical in the power IoT, because manual processing of large amounts of device data is unrealistic and prone to errors. Automatic identification methods can improve the efficiency and accuracy of device management, while risk assessment helps to promptly discover and solve security issues and ensure the stable operation of the power system. Summary of the invention

[0004] In view of the problems existing in the existing method for automatic identification of IoT devices based on comprehensive feature analysis, the present invention is proposed. Therefore, the problem to be solved by the present invention is how to provide a method and system for automatic identification of IoT devices based on comprehensive feature analysis.

[0005] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0006] In the first aspect, the present invention provides an automatic identification method for Internet of Things devices based on comprehensive feature analysis, which includes obtaining information of connected Internet of Things devices, analyzing data packets transmitted on the network, and identifying device application data patterns and communication protocols; constructing fingerprint features of the device based on the collected Internet of Things device information combined with the application data patterns and communication protocols; inputting the device fingerprint features into a pre-trained machine learning model and outputting device identification results; generating a device identification report based on the device identification results and the device fingerprint features, and performing risk assessment on the identified devices.

[0007] As a preferred solution of the method for automatic identification of Internet of Things devices based on comprehensive feature analysis described in the present invention, wherein: the Internet of Things device information includes hardware features and software information; the hardware features include processor type, memory and storage information, network interface; the software information includes operating system, firmware version, application, service and daemon.

[0008] As a preferred solution of the method for automatic identification of Internet of Things devices based on comprehensive feature analysis described in the present invention, the identification of device application data patterns and communication protocols includes the following steps: using the Wireshark network traffic analysis tool to capture data packets passing through the central management system; based on the captured data packets, using the Wireshark network traffic analysis tool to parse the communication protocols of the IP layer, transport layer, session layer and application layer, and identifying the communication protocol type of each data packet; analyzing the payload of each data packet, and identifying the patterns hidden in the application data based on regular expressions; defining multiple groups of regular expressions based on known data patterns and communication behaviors; parsing the captured data packets, and applying the defined regular expressions to perform regular matching operations on the application data of each data packet, checking whether the data payload conforms to the pattern defined by the regular expression, and if the match is successful, recording the pattern and associating it with the corresponding device and communication protocol.

[0009] As a preferred solution of the method for automatic identification of IoT devices based on comprehensive feature analysis described in the present invention, wherein: the construction of the fingerprint feature of the device includes the following steps: hardware feature extraction, converting the hardware attributes into numerical or vector representation, and establishing a mapping table between attribute values ​​and integer labels for discrete hardware attributes; converting each attribute value into its corresponding one-hot vector, if the hardware attribute has n different values, the dimension of the one-hot vector of the attribute is n, and mapping the attribute value to a low-dimensional continuous vector space; constructing an autoencoder network, and designing the autoencoder architecture, the encoder of the autoencoder compresses the input hardware feature vector into a low-dimensional latent space representation, the encoder includes L layers, and the output of the lth layer is h (l) , the input is h (l-1) , the weight matrix is ​​W (l) , the bias vector is b (l) , the activation function is f (l) ;

[0010] h (l) =f (l) (W (l) h (l-1) +b (l) )

[0011] Reconstruct the latent space representation of the encoder output and restore the original input vector; use cross entropy as the reconstruction loss to calculate the difference between the probability distribution of the encoder output and the true distribution. The calculation formula is:

[0012]

[0013] Among them, L CE is the cross entropy, y ij is the true one-hot value of the jth feature of the ith sample, is the probability value of the jth feature output by the autoencoder; extract software information features, build a directed graph based on the dependencies between software components, and the software components constitute the nodes in the graph. Each node v i Using vector x i Indicates that the dependencies between software components constitute the edges in the graph. If a software component v i Depends on component v j , then at node v i and v j Create a directed edge e between ij ; Construct an adjacency matrix. The adjacency matrix describes the connection relationship between nodes in the graph. For a directed graph, if there is an edge from node i to node j, then the adjacency matrix A ij =1, otherwise the adjacency matrix A ij = 0; Update the node representation by aggregating the information of neighboring nodes. For the node representation of the lth layer, H(l) , the update formula is:

[0014]

[0015]

[0016] in, To add the adjacency matrix after self-connection, is the corresponding degree matrix, W (l) is the weight matrix, σ is the activation function; use random initialization or pre-trained word embedding to initialize the node representation, sampled from a uniform distribution or a normal distribution; update the node representation by iteratively aggregating neighbor information, the new representation of node i The representation of the node itself and its neighbor nodes is calculated through convolution operations; a global pooling operation is applied to obtain the representation of the entire graph, a fixed-length representation is obtained from the graph, and the representation of all nodes is aggregated using a global pooling operation;

[0017]

[0018] Where s is the software feature vector; the fingerprint features of the device are comprehensively constructed and the final device fingerprint is calculated.

[0019] As a preferred solution of the method for automatic identification of IoT devices based on comprehensive feature analysis described in the present invention, the calculation of the final device fingerprint includes obtaining hardware feature vectors and software information feature vectors, and calculating the importance weights of different modal features. The calculation formula is:

[0020]

[0021] Where q is the query vector, k i is the key vector of the i-th modal feature, d k is the key vector dimension; weighted sum of each modal feature to obtain the final device fingerprint, the calculation formula is:

[0022] F=α1h+α2s

[0023] Where F is the final device fingerprint, α1 and α2 are the importance weights of the modal features of the hardware feature vector and the software information feature vector, respectively.

[0024] As a preferred solution of the method for automatic identification of IoT devices based on comprehensive feature analysis described in the present invention, wherein: the output of device identification results includes the following steps: collecting information of known IoT devices, extracting network protocol features and constructing device fingerprints for known IoT devices; generating a label for each device, the label corresponding to the specific type of the device, and standardizing each feature in the device fingerprint feature, and independently encoding if there is a classification feature; using the pre-processed data as training data to train a support vector machine; the support vector machine uses a radial basis function as a kernel function, and cross-validation is used to optimize the parameters of the model during model training; the support vector machine uses a kernel function to map the original data to a higher-dimensional space, and finds a hyperplane, the equation of the hyperplane is expressed as follows:

[0025] w·x+b=0;

[0026] Among them, w represents the normal vector of the hyperplane; x represents the eigenvector; b represents the intercept of the hyperplane; the classification decision is calculated based on the signed distance, and the decision function expression is:

[0027] f(x)=sgn(w·x+b);

[0028] Where sgn represents the sign function. If w·x+b≥0, sgn returns 1, otherwise it returns -1. The kernel function is used to calculate data that is not linearly separable. The expression is as follows:

[0029] K(x i ,x j )=exp(-γ|x i -x j | 2 );

[0030] In the formula, x i and x j represents the i-th eigenvector and the j-th eigenvector, γ represents the parameter of the kernel function, which controls the nonlinearity of the mapped space, |x i -x j | 2 Indicates: x i and x j The square of the Euclidean distance between them; perform parameter optimization, optimize the parameters w, b and γ in the process of training the support vector machine, and complete it by minimizing the objective function. The expression of the objective function is as follows:

[0031]

[0032] subjecttoy i (w·x i +b)≥1-ε i ,ε i≥0;

[0033] In the formula, y i represents the label of the i-th sample; ε i represents the slack variable; C represents the regularization parameter, which balances the interval maximization and the classification error rate; the trained support vector machine is used to output the device recognition result.

[0034] As a preferred solution of the method for automatic identification of IoT devices based on comprehensive feature analysis described in the present invention, the risk assessment of the identified devices includes the following steps: based on the device identification report, obtaining device risk-related data, removing duplicates, processing missing values, correcting erroneous data, and integrating data from different sources into a unified format and structure; calculating the risk score of each device based on the feature data of each device, and calculating the risk score of each device, the calculation formula is:

[0035]

[0036] Where n is the total number of risk factors; w i represents the weight of the i-th risk factor; f i Represents the value of the i-th risk factor; divide the device into different risk levels according to its risk score, generate a risk report for each device, formulate corresponding response measures to determine the priority of handling risk events; when the device score is lower than the first risk limit f1 for the first time, the device risk level is judged to be low risk, increase the frequency of log records, send an email to the device user to remind him, put the device in the security audit list, mark the device and wait for the high and medium risk devices to be identified before calculating the secondary risk score; when the device score reaches above the first risk limit f1 but lower than the second risk limit f2, the device risk level is preliminarily judged to be medium risk, start real-time monitoring, require the user to perform secondary identity authentication, and perform security audits on the device after the high-risk device is processed Perform a secondary risk score calculation. If the device risk level is at medium risk for two consecutive times, the device risk level is increased to high risk, and a risk warning is sent to the security team for manual device identification. When the device score is above the second risk limit f2, the device risk level is preliminarily judged to be high risk, and the device network connection is immediately cut off for immediate response. The secondary risk score calculation is performed without delay, and all relevant logs are recorded. If the device risk level is high risk for two consecutive times, the event is recorded and reported to the management personnel, and the emergency response team is activated to prepare for data recovery and system reconstruction. Continuously monitor the device status, regularly update the device risk score, evaluate the prediction effect of the model, detect overfitting or underfitting, and iteratively improve the model based on data feedback.

[0037] In the second aspect, the present invention provides an automatic identification system for Internet of Things devices based on comprehensive feature analysis, which includes: an acquisition module, used to obtain information of connected Internet of Things devices, analyze data packets transmitted on the network, and identify device application data patterns and communication protocols; a construction module, used to construct fingerprint features of the device based on the collected Internet of Things device information combined with application data patterns and communication protocols; an identification module, used to input the device fingerprint features into a pre-trained machine learning model and output device identification results; an evaluation module, used to generate a device identification report based on the device identification results and device fingerprint features, and perform risk assessment on the identified devices.

[0038] In a third aspect, the present invention provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: when the processor executes the computer program, the steps of a method for automatic identification of Internet of Things devices based on comprehensive feature analysis are implemented.

[0039] In a fourth aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein: when the computer program is executed by a processor, the steps of a method for automatic identification of Internet of Things devices based on comprehensive feature analysis are implemented.

[0040] The beneficial effects of the present invention are as follows: by collecting information on IoT devices and extracting and identifying the pattern of application data and specific communication protocols through network protocol features, a device fingerprint feature is constructed based on the basic hardware and software data features of the device, the pattern of application data and the specific communication protocol to obtain a comprehensive feature, and then the device fingerprint feature is used as the input of a machine learning model to accurately identify the category, specific model and status of the device, and reliable decision support is provided for subsequent equipment management and maintenance through accurate identification; and by identifying risks of the identified devices, it is helpful to timely adjust security strategies and defense measures, reduce the occurrence of safety accidents, and ensure the stable operation of the power system. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0042] Figure 1 Flowchart of the method for automatic identification of IoT devices based on comprehensive feature analysis. DETAILED DESCRIPTION

[0043] In order to make the above-mentioned purposes, features and advantages of the present invention more understandable, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0044] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0045] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The term "in one embodiment" that appears in different places in this specification does not necessarily refer to the same embodiment, nor does it refer to a separate or selective embodiment that is mutually exclusive with other embodiments.

[0046] Example 1

[0047] Reference Figure 1 , which is the first embodiment of the present invention, and provides an automatic identification method for IoT devices based on comprehensive feature analysis, comprising:

[0048] S1: Obtain information about connected IoT devices, analyze data packets transmitted over the network, and identify device application data patterns and communication protocols;

[0049] Specifically, obtain information about all IoT devices that access the central management system through the network; use network traffic analysis tools to monitor and parse data packets transmitted through the network to identify application data patterns and specific communication protocols;

[0050] IoT device information includes hardware features, software information and security features; hardware features include processor type, memory and storage information, and network interface; software information includes operating system, firmware version, applications, services and daemons; security features include security vulnerability information, encryption methods and authentication mechanisms.

[0051] Use Wireshark network traffic analysis tool to capture data packets passing through the central management system;

[0052] Based on the captured data packets, the Wireshark network traffic analysis tool is used to parse the communication protocols of the IP layer, transport layer, session layer, and application layer, and identify the communication protocol type of each data packet;

[0053] Analyze the payload of each packet and identify patterns hidden in application data based on regular expressions;

[0054] Define multiple sets of regular expressions based on known data patterns and communication behaviors;

[0055] Parse the captured data packets and apply the defined regular expressions to perform regular matching operations on the application data of each data packet to check whether the data payload conforms to the pattern defined by the regular expression. If the match is successful, record the pattern and associate it with the corresponding device and communication protocol.

[0056] S2: Build the fingerprint features of the device based on the collected IoT device information combined with the application data mode and communication protocol;

[0057] Specifically, the device fingerprint features are constructed based on the basic hardware and software data characteristics of the device, the mode of application data, and the specific communication protocol; the device identification report is automatically generated based on the device identification results and detailed device fingerprint features. The report should include key information such as basic device information, identification categories, potential security configuration issues, etc. The fingerprint includes not only static attributes, but also dynamic communication behavior characteristics to form a comprehensive device portrait. The report should include key information such as basic device information, identification categories, potential security configuration issues, etc.

[0058] Perform hardware feature extraction, convert hardware attributes into numerical or vector representations, and for discrete hardware attributes (such as CPU model, RAM type), establish a mapping table between attribute values ​​and integer labels;

[0059] Then convert each attribute value into its corresponding one-hot vector. If a hardware attribute has n different values, the dimension of the attribute's one-hot vector is n.

[0060] For hardware attributes with rich semantic information, use pre-trained word embedding models (such as Word2Vec and GloVe) to map attribute values ​​to low-dimensional continuous vector space;

[0061] Construct an autoencoder network and design the autoencoder architecture. The encoder part of the autoencoder consists of a series of fully connected layers, which is used to compress the input hardware feature vector into a low-dimensional latent space representation. The encoder contains L layers, and the output of the lth layer is h (l) , the input is h (l-1) (For the first layer, h (0) is the input vector), and the weight matrix is ​​W (l) , the bias vector is b (l) , the activation function is f (l) ;

[0062] h (l)=f (l) (W (l) h (l-1) +b (l) )

[0063] The role of the decoder is to reconstruct the latent space representation of the encoder output and restore the original input vector. The architecture of the decoder is similar to that of the encoder, but the size of the layer gradually increases until it has the same dimension as the input vector.

[0064] Using cross entropy as the reconstruction loss, the difference between the probability distribution output by the autoencoder and the true distribution is calculated. The calculation formula is:

[0065]

[0066] Among them, L CE is the cross entropy, y ij is the true one-hot value of the jth feature of the ith sample, is the probability value of the jth feature output by the autoencoder;

[0067] Use the back-propagation algorithm to optimize the weight parameters of the autoencoder;

[0068] Extract software information features and build a directed graph based on the dependencies between software components. Software components (such as applications, libraries, frameworks, etc.) constitute the nodes in the graph. Each node v i We can use a vector x i To represent, the vector can be a one-hot encoding, word embedding or other forms of initial representation.

[0069] The dependencies between software components constitute the edges in the graph. If a software component v i Depends on component v j , then at node v i and v j Create a directed edge e between ij ;

[0070] Construct an adjacency matrix. The adjacency matrix describes the connection relationship between nodes in the graph. For a directed graph, if there is an edge from node i to node j, then the adjacency matrix A ij =1, otherwise the adjacency matrix A ij =0;

[0071] GCN is used to update the node representation by aggregating the information of neighboring nodes. For the node representation H of the lth layer (l) , the update formula of GCN is:

[0072]

[0073] in, To add the adjacency matrix after self-connection, is the corresponding degree matrix, W (l) is the weight matrix, σ is the activation function;

[0074] Initialize node representations using random initialization or pre-trained word embeddings, sampling from a uniform or normal distribution;

[0075] By iteratively updating the node representation, the neighbor information is aggregated, and the new representation of node i The representation of the node itself and its neighbors is calculated through convolution operations;

[0076] Apply a global pooling operation to obtain a representation of the entire graph, obtain a fixed-length representation from the graph, and use a global pooling operation to aggregate the representations of all nodes;

[0077]

[0078] Where s is the software feature vector; the fingerprint features of the device are comprehensively constructed and the final device fingerprint is calculated.

[0079] Obtain the hardware feature vector and software information feature vector, and calculate the importance weights of different modal features. The calculation formula is:

[0080]

[0081] Where q is the query vector, k i is the key vector of the i-th modal feature, d k is the key vector dimension;

[0082] The weighted sum of each modal feature is used to obtain the final device fingerprint. The calculation formula is:

[0083] F=α1h+α2s

[0084] Where F is the final device fingerprint, α1 and α2 are the importance weights of the modal features of the hardware feature vector and the software information feature vector, respectively.

[0085] S3: Input the device fingerprint features into the pre-trained machine learning model and output the device identification results;

[0086] Specifically, the device fingerprint feature is used as the input of the trained machine learning model, the device identification result is output based on the trained machine learning model, and the device identification report is constructed based on the device identification result and the device fingerprint feature;

[0087] Collect information about known IoT devices, extract network protocol features and construct device fingerprints for known IoT devices;

[0088] Generate a label for each device, the label corresponds to the specific type of the device, and standardize each feature in the device fingerprint feature. If there is a classification feature, it will be independently encoded;

[0089] The preprocessed data is used as training data to train the support vector machine;

[0090] The support vector machine uses radial basis function as the kernel function, and cross-validation is used to optimize the parameters of the model during model training;

[0091] The support vector machine uses a kernel function to map the original data to a higher-dimensional space and find a hyperplane. The equation of the hyperplane is expressed as follows:

[0092] w·x+b=0;

[0093] Where w represents the normal vector of the hyperplane; x represents the eigenvector; b represents the intercept of the hyperplane;

[0094] The classification decision is calculated based on the signed distance, and the decision function expression is:

[0095] f(x)=sgn(w·x+b);

[0096] Where sgn represents the sign function. If w·x+b≥0, sgn returns 1, otherwise it returns -1.

[0097] Use the kernel function to calculate data that is not linearly separable. The expression is as follows:

[0098] K(x i ,x j )=exp(-γ|x i -x j | 2 );

[0099] In the formula, x i and x j represents the i-th eigenvector and the j-th eigenvector, γ represents the parameter of the kernel function, which controls the nonlinearity of the mapped space, |x i -x j | 2 Indicates: x i and x j The square of the Euclidean distance between them;

[0100] Parameter optimization is performed to optimize the parameters w, b and γ during the training of the support vector machine. This is done by minimizing the objective function, which is expressed as follows:

[0101]

[0102] subjecttoyi (w·x i +b)≥1-ε i ,ε i ≥0;

[0103] In the formula, y i represents the label of the i-th sample; ε i represents the slack variable; C represents the regularization parameter, balancing the maximum interval and the classification error rate;

[0104] The trained support vector machine is used to output the device recognition results.

[0105] SVM achieves highly accurate classification by finding the optimal hyperplane in feature space to maximize the interval between data points of different categories. For IoT device identification, this means that device types and states can be distinguished more accurately, and high recognition rates can be maintained even when device types are similar or data features overlap.

[0106] Using kernel techniques, especially radial basis function (RBF), SVM can handle nonlinear classification problems, which is particularly important for feature analysis of IoT devices. The features of IoT devices may show nonlinear relationships due to the complexity of various hardware and software configurations. SVM effectively solves this problem by mapping to a high-dimensional space, thereby achieving more accurate device classification.

[0107] By adjusting the parameters of SVM, such as the regularization parameter C and the kernel function parameter γ, the complexity of the model and the risk of overfitting can be effectively controlled. This adjustment capability makes SVM very suitable for dealing with the challenges brought by the diversity of IoT devices and environmental changes, providing system administrators with powerful tools to adapt to different device identification needs.

[0108] S4: Generate a device identification report based on the device identification results and device fingerprint features, and perform risk assessment on the identified devices.

[0109] Specifically, the device identification report is used as input, and the risk prediction model is further used to conduct risk assessment on the identified devices. The risk prediction model needs to consider multiple factors such as device type, historical security events, software update status, etc. to comprehensively evaluate the security status of the device. The model has been trained on a large number of known device types to achieve high-precision recognition. The output result is the automatic identification classification of the device, including device type, possible security configuration, etc. A feedback mechanism is implemented to feed back the risk assessment results to the central management system for real-time adjustment of security policies, such as limiting network access rights of high-risk devices. Continuously collect new device data and network behavior, continuously train and optimize machine learning models, and ensure that the accuracy of device identification and risk assessment improves over time.

[0110] Based on the device identification report, obtain device risk-related data, remove duplicates, handle missing values, correct erroneous data, and integrate data from different sources into a unified format and structure;

[0111] The risk score of each device is calculated based on the characteristic data. The risk score of each device is calculated using the following formula:

[0112]

[0113] Where n is the total number of risk factors; w i represents the weight of the i-th risk factor; f i represents the value of the i-th risk factor;

[0114] Classify devices into different risk levels according to their risk scores, generate risk reports for each device, formulate corresponding response measures based on risk levels, and determine the priority of handling risk events based on risk levels;

[0115] When the device score is lower than the first risk limit f1 for the first time, the device risk level is judged to be low risk, the logging frequency is increased, an email is sent to the device user to remind him, the device is included in the security audit list, and the device is marked to wait for the high and medium risk devices to be identified and then a second risk score calculation is performed;

[0116] When the device score reaches above the first risk limit f1 but below the second risk limit f2, the device risk level is preliminarily judged to be medium risk, and real-time monitoring is initiated. Users are required to perform secondary identity authentication. After the high-risk device processing is completed, the device risk score is calculated for the second time. If the device risk level is at medium risk for two consecutive times, the device risk level is increased to high risk, and a risk warning is sent to the security team for manual device identification.

[0117] When the device score is above the second risk limit f2, the device risk level is preliminarily judged to be high risk. The device network connection is immediately cut off for immediate response. The secondary risk score calculation is performed without delay and all relevant logs are recorded. If the device risk level is high risk twice in a row, the event is recorded and reported to the management personnel, and the emergency response team is activated to prepare for data recovery and system reconstruction.

[0118] Continuously monitor the status of the equipment, regularly update the risk score of the equipment, evaluate the prediction effect of the model, detect overfitting or underfitting, and iteratively improve the model based on data feedback.

[0119] Furthermore, this embodiment also provides an automatic identification system for Internet of Things devices based on comprehensive feature analysis, including: an acquisition module, used to obtain information of connected Internet of Things devices, analyze data packets transmitted on the network, and identify device application data patterns and communication protocols; a construction module, used to construct fingerprint features of the device based on the collected Internet of Things device information combined with application data patterns and communication protocols; an identification module, used to input the device fingerprint features into a pre-trained machine learning model and output device identification results; an evaluation module, used to generate a device identification report based on the device identification results and device fingerprint features, and perform risk assessment on the identified devices.

[0120] This embodiment also provides a computer device, which is suitable for the case of an automatic identification method of an Internet of Things device based on comprehensive feature analysis, including: a memory and a processor; the memory is used to store computer executable instructions, and the processor is used to execute computer executable instructions to implement all or part of the steps of the method described in the embodiment of the present invention as proposed in the above embodiment.

[0121] This embodiment also provides a storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the method in any optional implementation of the above embodiment is executed. Wherein, the storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (Static Random Access Memory, referred to as SRAM), electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, referred to as EEPROM), erasable programmable read-only memory (Erasable Programmable Read-Only Memory, referred to as EPROM), programmable read-only memory (Programmable Red-Only Memory, referred to as PROM), read-only memory (Read-Only Memory, referred to as ROM), magnetic memory, flash memory, disk or optical disk.

[0122] The storage medium proposed in this embodiment and the data storage method proposed in the above embodiment belong to the same inventive concept. The technical details not fully described in this embodiment can be found in the above embodiment, and this embodiment has the same beneficial effects as the above embodiment.

[0123] Example 2

[0124] Referring to Table 1, which is a second embodiment of the present invention, this embodiment provides an automatic identification method for IoT devices based on comprehensive feature analysis. In order to verify the beneficial effects of the present invention, scientific demonstration is carried out through economic benefit calculation and simulation experiments.

[0125] Table 1 Technical characteristics comparison table

[0126]

[0127] As can be seen from the above, the present invention collects information on IoT devices, and identifies the pattern of application data and specific communication protocols through network protocol feature extraction, constructs device fingerprint features based on the basic hardware and software data features of the device, the pattern of application data and the specific communication protocol, and obtains a comprehensive feature. The device fingerprint features are then used as the input of the machine learning model to accurately identify the category, specific model and status of the device, and provide reliable decision support for subsequent equipment management and maintenance through accurate identification; and by identifying risks of identified devices, it is helpful to adjust security strategies and defense measures in a timely manner, reduce the occurrence of safety accidents, and ensure the stable operation of the power system.

[0128] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A method for automatic identification of IoT devices based on comprehensive feature analysis, characterized in that: include, Obtain information about connected IoT devices, analyze data packets transmitted over the network, and identify device application data patterns and communication protocols; Build the fingerprint features of the device based on the collected IoT device information combined with the application data mode and communication protocol; Input device fingerprint features into the pre-trained machine learning model and output device identification results; Generate a device identification report based on the device identification results and device fingerprint features, and perform risk assessment on the identified devices.

2. The method for automatic identification of IoT devices based on comprehensive feature analysis according to claim 1, characterized in that: The IoT device information includes hardware features and software information; the hardware features include processor type, memory and storage information, and network interface; the software information includes operating system, firmware version, application, service, and daemon.

3. The method for automatic identification of Internet of Things devices based on comprehensive feature analysis as claimed in claim 2, characterized in that: The identification device application data mode and communication protocol comprises the following steps: Use Wireshark network traffic analysis tool to capture data packets passing through the central management system; Based on the captured data packets, the Wireshark network traffic analysis tool is used to parse the communication protocols of the IP layer, transport layer, session layer, and application layer, and identify the communication protocol type of each data packet; Analyze the payload of each packet and identify patterns hidden in application data based on regular expressions; Define multiple sets of regular expressions based on known data patterns and communication behaviors; Parse the captured data packets and apply the defined regular expressions to perform regular matching operations on the application data of each data packet to check whether the data payload conforms to the pattern defined by the regular expression. If the match is successful, record the pattern and associate it with the corresponding device and communication protocol.

4. The method for automatic identification of IoT devices based on comprehensive feature analysis as claimed in claim 3, characterized in that: The fingerprint feature of the device is constructed by the following steps: Perform hardware feature extraction, convert hardware attributes into numerical or vector representations, and establish a mapping table between attribute values ​​and integer labels for discrete hardware attributes; Convert each attribute value into its corresponding one-hot vector. If a hardware attribute has n different values, the dimension of the attribute's one-hot vector is n. Map the attribute value to a low-dimensional continuous vector space. Construct an autoencoder network and design the autoencoder architecture. The encoder of the autoencoder compresses the input hardware feature vector into a low-dimensional latent space representation. The encoder contains L layers, and the output of the lth layer is h (l) , the input is h (l-1) , the weight matrix is ​​W (l) , the bias vector is b (l) , the activation function is f (l) ; h (l) =f (l) (W (l) h (l-1) +b (l) ) Reconstruct the latent space representation of the encoder output and restore the original input vector; Using cross entropy as the reconstruction loss, the difference between the probability distribution output by the autoencoder and the true distribution is calculated. The calculation formula is: Among them, L CE is the cross entropy, y ij is the true one-hot value of the jth feature of the ith sample, is the probability value of the jth feature output by the autoencoder; Extract software information features and construct a directed graph based on the dependencies between software components. Software components constitute nodes in the graph. Each node v i Using vector x i express; The dependencies between software components constitute the edges in the graph. If a software component v i Depends on component v j , then at node v i and v j Create a directed edge e between ij ; Construct an adjacency matrix. The adjacency matrix describes the connection relationship between nodes in the graph. For a directed graph, if there is an edge from node i to node j, then the adjacency matrix A ij =1, otherwise the adjacency matrix A ij =0; Update the node representation by aggregating the information of neighboring nodes. For the node representation H of the lth layer (l) , the update formula is: in, To add the adjacency matrix after self-connection, is the corresponding degree matrix, W (l) is the weight matrix, σ is the activation function; Initialize node representations using random initialization or pre-trained word embeddings, sampling from a uniform or normal distribution; By iteratively updating the node representation, the neighbor information is aggregated, and the new representation of node i The representation of the node itself and its neighbors is calculated through convolution operations; Apply a global pooling operation to obtain a representation of the entire graph, obtain a fixed-length representation from the graph, and use a global pooling operation to aggregate the representations of all nodes; Where s is the software feature vector; the fingerprint features of the device are comprehensively constructed and the final device fingerprint is calculated.

5. The method for automatic identification of Internet of Things devices based on comprehensive feature analysis as claimed in claim 4, characterized in that: The calculation of the final device fingerprint includes obtaining the hardware feature vector and the software information feature vector, and calculating the importance weights of different modal features. The calculation formula is: Where q is the query vector, k i is the key vector of the i-th modal feature, d k is the key vector dimension; The weighted sum of each modal feature is used to obtain the final device fingerprint. The calculation formula is: F=α1h+α2s Where F is the final device fingerprint, α1 and α2 are the importance weights of the modal features of the hardware feature vector and the software information feature vector, respectively.

6. The method for automatic identification of Internet of Things devices based on comprehensive feature analysis as claimed in claim 5, characterized in that: The output device identification result comprises the following steps: Collect information about known IoT devices, extract network protocol features and construct device fingerprints for known IoT devices; Generate a label for each device, the label corresponds to the specific type of the device, and standardize each feature in the device fingerprint feature. If there is a classification feature, it will be independently encoded; The preprocessed data is used as training data to train the support vector machine; The support vector machine uses radial basis function as the kernel function, and cross-validation is used to optimize the parameters of the model during model training; The support vector machine uses a kernel function to map the original data to a higher-dimensional space and find a hyperplane. The equation of the hyperplane is expressed as follows: w·x+b=0; Where w represents the normal vector of the hyperplane; x represents the eigenvector; b represents the intercept of the hyperplane; The classification decision is calculated based on the signed distance, and the decision function expression is: f(x)=sgn(w·x+b); Where sgn represents the sign function. If w·x+b≥0, sgn returns 1, otherwise it returns -1. Use the kernel function to calculate data that is not linearly separable. The expression is as follows: K(x i ,x j )=exp(-γ|x i -x j | 2 ); In the formula, x i and x j represents the i-th eigenvector and the j-th eigenvector, γ represents the parameter of the kernel function, which controls the nonlinearity of the mapped space, |x i -x j | 2 Indicates: x i and x j The square of the Euclidean distance between them; Parameter optimization is performed to optimize the parameters w, b and γ during the training of the support vector machine. This is done by minimizing the objective function, which is expressed as follows: subject to y i (w·x i +b)≥1-ε i ,ε i ≥0; In the formula, y i Represents the label of the i-th sample; ε i represents the slack variable; C represents the regularization parameter, which balances the interval maximization and the classification error rate; the trained support vector machine is used to output the device recognition result.

7. The method for automatic identification of Internet of Things devices based on comprehensive feature analysis as claimed in claim 6, characterized in that: The risk assessment of the identified equipment includes the following steps: Based on the device identification report, obtain device risk-related data, remove duplicates, handle missing values, correct erroneous data, and integrate data from different sources into a unified format and structure; The risk score of each device is calculated based on the characteristic data. The risk score of each device is calculated using the following formula: Where n is the total number of risk factors; w i represents the weight of the i-th risk factor; f i represents the value of the i-th risk factor; Classify devices into different risk levels according to their risk scores, generate risk reports for each device, formulate corresponding response measures and determine the priority of handling risk events; When the device score is lower than the first risk limit f1 for the first time, the device risk level is judged to be low risk, the logging frequency is increased, an email is sent to the device user to remind him, the device is included in the security audit list, and the device is marked to wait for the high and medium risk devices to be identified and then a second risk score calculation is performed; When the device score reaches above the first risk limit f1 but below the second risk limit f2, the device risk level is preliminarily judged to be medium risk, and real-time monitoring is initiated. Users are required to perform secondary identity authentication. After the high-risk device processing is completed, the device risk score is calculated for the second time. If the device risk level is at medium risk for two consecutive times, the device risk level is increased to high risk, and a risk warning is sent to the security team for manual device identification. When the device score is above the second risk limit f2, the device risk level is preliminarily judged to be high risk. The device network connection is immediately cut off for immediate response. The secondary risk score calculation is performed without delay and all relevant logs are recorded. If the device risk level is high risk twice in a row, the event is recorded and reported to the management personnel, and the emergency response team is activated to prepare for data recovery and system reconstruction. Continuously monitor the status of the equipment, regularly update the risk score of the equipment, evaluate the prediction effect of the model, detect overfitting or underfitting, and iteratively improve the model based on data feedback.

8. An automatic identification system for Internet of Things devices based on comprehensive feature analysis, based on the automatic identification method for Internet of Things devices based on comprehensive feature analysis according to any one of claims 1 to 7, characterized in that: include, The acquisition module is used to obtain the information of connected IoT devices, analyze the data packets transmitted by the network, and identify the device application data mode and communication protocol; A construction module is used to construct the fingerprint characteristics of the device based on the collected IoT device information combined with the application data mode and communication protocol; The recognition module is used to input the device fingerprint features into the pre-trained machine learning model and output the device recognition results; The assessment module is used to generate a device identification report based on the device identification results and device fingerprint features, and to perform risk assessment on the identified devices.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method for automatic identification of Internet of Things devices based on comprehensive feature analysis as described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method for automatic identification of Internet of Things devices based on comprehensive feature analysis as described in any one of claims 1 to 7 are implemented.

Images