Internet of Things equipment type identification method and device, electronic equipment and medium

Abstract

The invention provides an Internet of Things equipment type identification method and device, electronic equipment and a medium, and relates to the technical field of Internet of Things, and the method comprises the steps: obtaining a traffic data packet of Internet of Things equipment through man-in-the-middle gateway equipment, and carrying out the preprocessing of the traffic data packet, and obtaining a data packet sequence; wherein the man-in-the-middle gateway equipment is arranged between the Internet of Things equipment and a public network; inputting the data packet sequence into a pre-trained semantic recognition model for semantic recognition to obtain a semantic feature vector corresponding to each data packet; and inputting the semantic feature vector into a pre-trained behavior classification model for classification to obtain the equipment type of the Internet of Things equipment. According to the invention, the identification efficiency and accuracy of the Internet of Things equipment are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of Internet of Things, and in particular to a method, device, electronic equipment and medium for identifying the type of Internet of Things equipment. Background Art

[0002] In recent years, the Internet of Things (IoT) technology has shown an explosive growth trend, and has penetrated widely and deeply into many key areas such as medical care, transportation, and infrastructure, bringing unprecedented changes and convenience to people's lives, and gradually becoming an indispensable part of modern society. However, with its development, the number of IoT devices has shown a sharp upward trend. According to relevant data, the number of IoT devices has exceeded 20 billion in 2020, and is expected to soar to 75 billion by 2030. At the same time, these devices are diverse, ranging from various sensors to common daily necessities such as refrigerators and electric lights. The surge in the number of IoT devices and the diversity of their types directly lead to a lot of time-consuming and error-prone device configuration, which seriously affects the deployment efficiency and stability of the IoT system. At the same time, at the network security level, due to the lack of effective measures to give differentiated priorities to network traffic based on different device types, it is difficult to achieve efficient network resource management and security protection, which puts the network environment at great risk.

[0003] At present, the existing IoT device detection methods are mostly to extract traffic information features to carry out machine learning, such as using long short-term memory network (LSTM), support vector machine (SVM) and extreme random tree (ET), etc. However, these methods have the defects of being difficult to implement on large-scale training samples and insufficient accuracy. Summary of the invention

[0004] In view of this, an object of the present invention is to provide a method, apparatus, electronic device and medium for identifying the type of IoT device, so as to improve the efficiency and accuracy of IoT device identification.

[0005] In order to achieve the above object, the technical solution adopted by the present invention is as follows: In a first aspect, the present invention provides a method for identifying the type of an Internet of Things device, comprising: obtaining traffic data packets of an Internet of Things device through an intermediary gateway device, and preprocessing the traffic data packets to obtain a data packet sequence; wherein the intermediary gateway device is arranged between the Internet of Things device and a public network; inputting the data packet sequence into a pre-trained semantic recognition model for semantic recognition to obtain a semantic feature vector corresponding to each data packet; inputting the semantic feature vector into a pre-trained behavior classification model for classification to obtain the device type of the Internet of Things device.

[0006] Optionally, the traffic data packets are preprocessed to obtain a data packet sequence, including: using a traffic parsing tool to convert the traffic data packets into a JSON format text file; wherein each line in the JSON format text file represents a TCP stream data packet sequence; filtering the data in the JSON format text file, and converting the filtered data packets into a CSV file format file; using a data visualization tool to verify the data packets in the CSV file format file, and rearranging the verified data packets in the CSV file format file to obtain a data packet sequence.

[0007] Optionally, the semantic recognition model includes a multi-layer encoder, each sublayer includes: a self-attention layer and a feedforward fully connected network; the data packet sequence is input into a pre-trained semantic recognition model for semantic recognition to obtain a semantic feature vector corresponding to each data packet, including: converting each data packet in the data packet sequence into an embedding vector, and inputting the embedding vector into the first sublayer; performing semantic recognition on the embedding vector of each data packet through the first sublayer to obtain a feature vector output by the first sublayer; inputting the feature vector output by the first sublayer into the next sublayer, and repeating the semantic recognition until the last sublayer to obtain the semantic feature vector corresponding to each data packet, and determining the behavioral semantics of the IoT device based on the semantic feature vector; wherein the semantic recognition step includes: for each data packet, calculating the attention weight matrix between the embedding vectors of the data packet through the self-attention layer; performing a nonlinear transformation on the attention weight matrix output by the self-attention layer through the feedforward fully connected network to obtain a transformed weight matrix; adding the transformed weight matrix output by the feedforward fully connected network and the input of the current sublayer and performing layer normalization to obtain a feature vector.

[0008] Optionally, the construction of the semantic recognition model includes: constructing a simulation experiment environment; wherein the simulation experiment environment includes different types of IoT devices; obtaining traffic data packets of IoT devices in the simulation experiment environment through a middleman gateway device, and preprocessing the traffic data packets to obtain a training data set and a test data set; inputting the data packets in the training data set into the Transformer model to obtain the semantic feature vector corresponding to the data packet, and verifying the Transformer model based on the test data set to obtain a trained semantic recognition model.

[0009] Optionally, constructing a behavior classification model includes: dividing the semantic feature vector output by the trained semantic recognition model into a training set and a test set, and determining a corresponding feature set and a device type set based on the semantic feature vector; training a Transformer classifier based on the training set, the feature set, the device type set and the test set to obtain a trained behavior classification model.

[0010] Optionally, a Transformer classifier is trained based on a training set, a feature set, a device type set, and a test set to obtain a trained behavior classification model, including: extracting training samples from the training set using a random gradient descent method to obtain multiple training batches; for each training batch, extracting semantic features corresponding to the training samples from the feature set, and inputting the extracted semantic features into the Transformer classifier to obtain device type features for each training batch; combining the device type features of each training batch to obtain a device type feature set; inputting the semantic features corresponding to the test samples in the test set into the Transformer classifier for classification, and normalizing the classification results using a softmax function to obtain device types of the test samples in the test set; repeatedly classifying the test samples in the test set until the device type of each test sample in the test set is obtained, thereby obtaining a trained behavior classification model.

[0011] Optionally, it also includes: storing semantic feature vectors, traffic data packets and IoT devices in the process of semantic recognition model training to obtain a behavior classification database.

[0012] In a second aspect, the present invention provides an apparatus for identifying the type of an Internet of Things device, comprising: a middleman data acquisition module, used to acquire traffic data packets of an Internet of Things device through a middleman gateway device, and preprocess the traffic data packets to obtain a data packet sequence; wherein the middleman gateway device is arranged between the Internet of Things device and a public network; a semantic recognition module, used to input the data packet sequence into a pre-trained semantic recognition model for semantic recognition, and obtain a semantic feature vector corresponding to each data packet; a behavior classification module, used to input the semantic feature vector into a pre-trained behavior classification model for classification, and obtain the device type of the Internet of Things device.

[0013] In a third aspect, the present invention provides an electronic device comprising a processor and a memory, wherein the memory stores computer-executable instructions that can be executed by the processor, and the processor executes the computer-executable instructions to implement the steps of any one of the methods provided in the first aspect above.

[0014] In a fourth aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps of any one of the methods provided in the first aspect are executed.

[0015] The present invention brings the following beneficial effects: The method, device, electronic device and medium for identifying the type of IoT device provided by the present invention first obtain the traffic data packets of IoT devices through a middleman gateway device, and preprocess the traffic data packets to obtain a data packet sequence; wherein the middleman gateway device is arranged between the IoT device and the public network; then the data packet sequence is input into a pre-trained semantic recognition model for semantic recognition to obtain a semantic feature vector corresponding to each data packet; finally, the semantic feature vector is input into a pre-trained behavior classification model for classification to obtain the device type of the IoT device. The above method uses a middleman gateway device to obtain the traffic data packets of IoT devices, and performs semantic recognition on the traffic data packets of IoT devices through a semantic recognition model, and classifies the semantic feature vectors to determine the device type of the IoT device, thereby significantly improving the accuracy and efficiency of IoT device identification.

[0016] Other features and advantages of the present invention will be described in the following description, and partly become apparent from the description, or understood by practicing the present invention. The purpose and other advantages of the present invention are realized and obtained by the structures particularly pointed out in the description, claims and drawings.

[0017] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the preferred embodiments are specifically mentioned below and described in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0019] Figure 1 A flowchart of a method for identifying the type of an Internet of Things device provided by an embodiment of the present invention; Figure 2 A flowchart of another method for identifying the type of an Internet of Things device provided by an embodiment of the present invention; Figure 3 A schematic diagram of the structure of an IoT device type identification device provided by an embodiment of the present invention; Figure 4 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0020] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0021] At present, in the absence of device identification, IoT devices will face the following major threats: 1. Risk of malicious attacks: IoT devices are widely distributed and have various access methods. Their simple communication protocols and encryption algorithms, such as lightweight encryption, are easily invaded by hackers through password cracking and protocol vulnerabilities. After the invasion, they can obtain private data through privilege escalation, tamper with the firmware to implant malicious code, and launch attacks such as DDoS. A large number of hacked devices send request packets to paralyze the target server. Because the attack sources are scattered and difficult to locate and block, it seriously threatens the stability of network infrastructure.

[0022] 2. Equipment vulnerability risks: The design and manufacturing of IoT devices have security risks. Chips lack hardware protection mechanisms and are vulnerable to attacks. Customized simplified versions of software have vulnerabilities and are difficult to update and repair. Common vulnerabilities such as buffer overflows and SQL injections allow attackers to remotely control devices. Because many devices are difficult to update, vulnerabilities exist for a long time, threatening the ecological security of the IoT.

[0023] 3. Network traffic chaos: Network traffic generated by different types of devices is intertwined. If the device type cannot be accurately identified, it will be difficult to effectively manage and monitor the network traffic, resulting in frequent problems such as network congestion and traffic anomalies, affecting the real-time transmission of key businesses. It is also difficult to detect anomalies because the boundaries between normal and abnormal traffic are blurred, increasing the difficulty of security protection and making it easier for attackers to hide their attacks.

[0024] Existing IoT device detection methods mostly extract traffic information features to carry out machine learning, such as using long short-term memory networks (LSTM), support vector machines (SVM) and extreme random trees (ET). These methods have the defects of being difficult to implement on large-scale training samples and lack of accuracy.

[0025] Based on this, an embodiment of the present invention provides a method, device, electronic device and medium for identifying the type of an IoT device, which can improve the efficiency and accuracy of IoT device identification.

[0026] To facilitate understanding of this embodiment, a method for identifying the type of IoT device disclosed in an embodiment of the present invention is first introduced in detail. The method can be executed by an electronic device such as a smart phone, a computer, a tablet computer, etc. Figure 1The flowchart of a method for identifying the type of IoT device shown in FIG. 1 illustrates that the method mainly includes the following steps S101 to S103: Step S101: Obtain traffic data packets of IoT devices through a middleman gateway device, and pre-process the traffic data packets to obtain a data packet sequence.

[0027] In one implementation, in order to obtain the traffic of IoT devices, a Man-in-the-Middle (MitM) gateway device can be set up. The Man-in-the-Middle gateway device is set between the IoT device and the public network, and provides network access services in the form of routers or switches, allowing the Man-in-the-Middle gateway to intercept all traffic to or from the IoT device without affecting the functions of the existing IoT devices. The Man-in-the-Middle gateway device supports network monitoring functions so that all traffic packets on the network can be captured.

[0028] When the middleman gateway device is properly deployed, configure the middleman gateway device to enable a specific network monitoring mode, such as Promiscuous mode. In this mode, the gateway captures all traffic packets passing through it, and after capturing the traffic packets, preprocesses these packets for subsequent packet semantic detection. Preprocessing may include: decapsulation, filtering (removing irrelevant packets), reassembly and parsing. After completing the necessary preprocessing, a packet sequence can be constructed. The packet sequence can be organized in chronological order or classified by content (such as IP address, port, etc.).

[0029] Step S102: input the data packet sequence into a pre-trained semantic recognition model for semantic recognition, and obtain a semantic feature vector corresponding to each data packet.

[0030] In one embodiment, the pre-trained semantic recognition model is a large-scale Transformer semantic recognition model based on word embedding, and the pytorch library is used to pre-complete the construction of a large-scale Transformer semantic recognition model based on word embedding. In an embodiment of the present invention, the semantics of a data packet sequence is parsed by a pre-trained semantic recognition model, and the data interaction and control behavior of the data packet sequence are identified and detected, so as to determine the basic behavior of the data packet source device in the data packet sequence. The semantic recognition model can eventually output a semantic feature vector corresponding to each data packet, and the semantic feature vector is used to identify the behavioral semantics of the data packet sequence, such as sensor information feedback, remote control information download, audio and video data uplink and downlink, etc.

[0031] Step S103: inputting the semantic feature vector into a pre-trained behavior classification model for classification to obtain the device type of the IoT device.

[0032] In one embodiment, the behavior classification model is a behavior classification model based on a Transformer classifier, and the pytorch library is used to pre-complete the construction of the behavior classification model based on the Transformer classifier. In an embodiment of the present invention, the semantic feature vector corresponding to each data packet output by the semantic recognition model is input into the behavior classification model, and the device type of the source device of each data packet can be obtained.

[0033] The above-mentioned method for identifying the type of IoT device provided by the present invention adopts a middleman gateway device to obtain the traffic data packets of the IoT device, and performs semantic recognition on the traffic data packets of the IoT device through a semantic recognition model, and classifies the semantic feature vectors to determine the device type of the IoT device, thereby significantly improving the accuracy and efficiency of IoT device identification.

[0034] In one embodiment, for the aforementioned step S101, that is, when preprocessing the traffic data packet to obtain a data packet sequence, the following methods can be used, including but not limited to: first, using a traffic parsing tool to convert the traffic data packet into a JSON format text file; wherein each line in the JSON format text file represents a TCP stream data packet sequence; then, the data in the JSON format text file is filtered, and the filtered data packets are converted into a CSV file format file; finally, using a data visualization tool to verify the data packets in the CSV file format file, and rearrange the verified data packets in the CSV file format file to obtain a data packet sequence.

[0035] In the specific implementation, firstly, the traffic data packets of IoT devices are collected through the middleman gateway device, and the original data files are organized into a unified folder structure. Then, the traffic parsing tool joy is used to convert the original data files into JSON format text files containing TCP flow features, where each line represents a complete TCP flow packet sequence; then, the packet content related to classification is selected from the data of the generated JSON format text file, and the selected packets are converted into an easy-to-process CSV file format and stored in the CSV output folder; finally, the extracted packets are analyzed and verified using data visualization tools to ensure that the selected packets are complete and representative in time and logic, and have significant distinguishing capabilities for classification tasks. Finally, the data in the CSV file is rearranged to generate a packet sequence suitable for machine learning model input.

[0036] In one embodiment, the Transformer model consists of an encoder and a decoder, each of which is composed of a plurality of identical layers stacked together. For the semantic recognition of network behavior of IoT devices, the encoder part is mainly focused on because the encoder is responsible for extracting features and understanding the behavioral semantics of input data packets. Based on this, in an embodiment of the present invention, the semantic recognition model includes an encoder, and the encoder includes a plurality of identical sub-layers, each of which includes: a self-attention layer, a feedforward fully connected network, and layer normalization.

[0037] Further, for the aforementioned step S102, that is, when inputting the data packet sequence into the pre-trained semantic recognition model for semantic recognition and obtaining the semantic feature vector corresponding to each data packet, the following methods may be used, including but not limited to: First, each packet in the packet sequence is converted into an embedding vector and the embedding vector is input to the first sub-layer.

[0038] In specific implementation, each data packet in the data packet sequence first needs to be converted into a series of embedding vectors (Embeddings), which include word embeddings and positional encodings. Positional encoding ensures that the model can understand the positional relationship between each data packet in the data packet sequence. This process usually involves converting the original data into a form that can be understood by the machine learning model. A common way is to use word embedding technology, such as Word2Vec, GloVe, or BERT, to process text data. For non-text data, other encoding methods may be used, such as normalizing numerical data and performing one-hot encoding on categorical data. The converted embedding vector of each data packet is input into the first sublayer of the semantic recognition model.

[0039] Then, the first sub-layer performs semantic recognition on the embedding vector of each data packet to obtain the feature vector output by the first sub-layer.

[0040] In practice, the first sublayer processes the input embedding vector to extract deeper features and capture the semantic information in the data packet. For example, in the Transformer architecture, the correlation between data can be captured through the self-attention mechanism.

[0041] Specifically, the steps of semantic recognition include the following (1)-(3): (1) For each data packet, the attention weight matrix between the embedding vectors of the data packet is calculated through the self-attention layer.

[0042] In specific implementation, the core of the Transformer model is the multi-head self-attention mechanism, which allows the model to learn information in different representation subspaces in parallel. For each data packet, the attention weights of it and other data packets in the sequence are calculated through the self-attention layer to identify the dependencies between them. The formula is as follows:

[0043]

[0044]

[0045] in, , , They are query, key and value matrices respectively. , , is a learnable weight matrix, is the output attention weight matrix.

[0046] (2) The attention weight matrix output by the self-attention layer is nonlinearly transformed through a feedforward fully connected network to obtain the transformed weight matrix.

[0047] In the specific implementation, the output of the self-attention layer is transformed nonlinearly through a feedforward fully connected network. The formula is as follows:

[0048] in, and is a learnable weight matrix, and is the bias term.

[0049] (3) The transformed weight matrix output by the feedforward fully connected network is added to the input of the current sub-layer and then layer normalized to obtain the feature vector.

[0050] In the specific implementation, the output of each sub-layer (self-attention layer and feed-forward fully connected network) is added to the input of the sub-layer, and then layer normalization is performed. This helps the flow of gradients and the training stability of the model. The formula is as follows:

[0051] in, It is l The input of each sub-layer is It is l +1 sub-layer input, that is, lThe output of a sublayer, Sublayer can be a self-attention layer or a feed-forward fully connected network, It is l The weight of each sub-layer.

[0052] Finally, the feature vector output by the first sublayer is input into the next sublayer, and semantic recognition is repeated until the last sublayer to obtain the semantic feature vector corresponding to each data packet, and the behavioral semantics of the IoT device is determined based on the semantic feature vector.

[0053] In the specific implementation, the feature vector output by the first sub-layer will be passed as input to the next sub-layer to continue semantic recognition. After being processed by multiple layers of encoders, the semantic recognition model outputs a semantic feature vector, which is used to identify the behavioral semantics of the data packet sequence, such as sensor information feedback, remote control information transmission, audio and video data uplink and downlink, etc. By clustering, classifying or other machine learning operations on these feature vectors, behavioral semantic information about the behavior of IoT devices can be extracted.

[0054] In one embodiment, for the aforementioned step S103, that is, when the semantic feature vector is input into a pre-trained behavior classification model for classification to obtain the device type of the IoT device, the following methods may be used, including but not limited to: first, the semantic feature vector is input into the pre-trained behavior classification model, and the semantic feature vector is passed to the model through the input layer of the behavior classification model. The model passes through multiple layers of Transformer encoders to generate an output vector, which contains the probability distribution of the model for the input sample (i.e., the semantic feature vector) belonging to different categories (such as different types of IoT devices); then, according to the result of the model output, the device type of the IoT device corresponding to the input semantic feature vector is determined. Specifically, a threshold may be set or other decision rules (such as voting mechanism, soft maximum function, etc.) may be used to determine which category has the highest probability, thereby obtaining the final classification result.

[0055] For ease of understanding, the embodiment of the present invention also provides a process for constructing a semantic recognition model and a behavior classification model. The construction of the semantic recognition model includes the following steps 1 to 3: Step 1: Build a simulation experiment environment; the simulation experiment environment includes different types of IoT devices.

[0056] In the specific implementation, during the model training phase, a simulation experimental environment was established, which included a series of different types of IoT devices.

[0057] Step 2: Obtain the traffic data packets of the IoT devices in the simulation experiment environment through the middleman gateway device, and preprocess the traffic data packets to obtain the training data set and the test data set.

[0058] In the specific implementation, the traffic data packets of the IoT devices in the simulation experiment environment are obtained through the middleman gateway device, and the original data files are organized into a unified folder structure; then, the traffic parsing tool joy is used to convert these original data files into JSON format text files containing TCP flow features, and each line represents a complete TCP flow packet sequence. In order to ensure the training effect of the classifier, the data volume of the IoT devices is screened, the IoT devices with fewer samples are eliminated, and the data of some devices with rich sample volume are retained, and the generated text files are stored in the source data folder. The data packet content related to the classification is selected from the generated JSON format data, and it is converted into an easy-to-process CSV file format and stored in the CSV output folder. Then, the extracted data packets are analyzed and verified using data visualization tools to ensure that the selected data packets are complete and representative in time and logic, and have significant distinguishing ability for classification tasks. Finally, the data in the CSV file is rearranged to generate training data sets and test data sets suitable for machine learning model input.

[0059] Step 3: Input the data packet in the training data set into the Transformer model to obtain the semantic feature vector corresponding to the data packet, and verify the Transformer model based on the test data set to obtain a trained semantic recognition model.

[0060] In the specific implementation, the data packets in the training data set are input into the Transformer model for model training, and the Transformer model is verified using the test data set to obtain a trained semantic recognition model. During the model training process, the generated semantic feature vectors, the collected traffic data packets of the IoT devices, and the corresponding IoT devices can be stored to form a behavior classification database.

[0061] Furthermore, based on the semantic recognition model, the pytorch library is used to complete the construction of the behavior classification model based on the Transformer classifier. The specific implementation algorithm is as follows: First, the semantic feature vectors output by the trained semantic recognition model are divided into a training set and a test set, and the corresponding feature set and device type set are determined based on the semantic feature vectors.

[0062] In the specific implementation, the semantic feature vector output by the semantic recognition model is used as the training set and test set for the behavior classification model training. Assume that the training set is ,Depend on training samples, that is , let the feature set be ,have dimensional features, i.e. , the device type set is ,have categories, namely , the test set is ,have test samples, that is .

[0063] Then, the Transformer classifier is trained based on the training set, feature set, device type set and test set to obtain a trained behavior classification model.

[0064] Specifically, the following steps are included: (1) to (5): Step (1): Use the stochastic gradient descent method to extract training samples from the training set to obtain multiple training batches.

[0065] Specifically, from the capacity The training set In the process, the stochastic gradient descent method is used, that is, small batches of training samples are iteratively extracted as a training batch B k , thus obtaining multiple training batches.

[0066] Step (2): For each training batch, the semantic features corresponding to the training samples are extracted from the feature set, and the extracted semantic features are input into the Transformer classifier to obtain the device type features of each training batch.

[0067] Specifically, for the training batch B k , from the feature set The semantic features are extracted from the model and input into the Transformer model. The Transformer model consists of an encoder and a decoder. The encoder encodes the input semantic feature sequence into a continuous vector representation, and the decoder generates an output sequence based on the encoded vector representation. The attention mechanism captures the dependencies between sequences and generates a complete device type feature from the root node to the bottom. V k , no feature selection is performed.

[0068] Step (3): Combine the device type features of each training batch to obtain a device type feature set.

[0069] Specific, repetitive m Steps (1) and (2) yield m training batches B 1 , B 2 ,…, Bm , and generate device type characteristics V 1 , V 2 ,…, V m ,Will m The device type features are combined to form a device type feature set V.

[0070] Step (4): Input the semantic features corresponding to the test samples in the test set into the Transformer classifier for classification, and use the softmax function to normalize the classification results to obtain the device type of the test samples in the test set.

[0071] Specifically, the test set Test samples The semantic features of are input into the Transformer classifier, allowing the Transformer classifier to Make a classification decision, and then use the softmax function to normalize the classification results, and finally decide The device type.

[0072] Step (5): Repeat the classification of the test samples in the test set until the device type of each test sample in the test set is obtained, and a trained behavior classification model is obtained.

[0073] Specific, repetitive Next step (4) until the test set The classification is completed and a trained behavior classification model is obtained.

[0074] The above method provided by the embodiment of the present invention is aimed at the field of IoT device type identification. By introducing a data packet behavior semantic detection and classification method, it achieves efficient classification and accurate identification of various IoT devices, thereby improving the ability and efficiency of network security defense.

[0075] For ease of understanding, the present invention also provides a flowchart of a specific method for identifying the type of IoT device, see Figure 2 As shown: First, the data packets of IoT devices are sent through the middleman gateway device; then the data packets are semantically detected. This process parses the semantics of the data packets through a large-scale Transformer semantic recognition model based on word embedding, identifies and detects the data interaction and control behavior of the data packet sequence, thereby determining the basic behavior of the source device of the data packet in the sequence and obtaining the behavioral semantic information (i.e., semantic feature vector). Finally, the semantic feature modeling and classification are entered. This process uses a behavior classification model based on the Transformer classifier to classify the basic types and subdivided brands of IoT devices according to the behavioral semantic information from each IoT device and the behavior classification database.

[0076] The present invention realizes efficient classification of IoT device traffic characteristics through a method for IoT device type identification based on a middleman data packet semantic detection method, which has significant advantages in the case of a large number of devices and complex characteristics, and provides a new technical solution for network security and IoT traffic identification.

[0077] For the method for identifying the type of IoT device provided in the above embodiment, the present invention also provides an apparatus for identifying the type of IoT device, see Figure 3 The schematic diagram of the structure of an identification device for an IoT device type is shown, indicating that the device mainly includes the following parts: The middleman data acquisition module 301 is used to acquire the traffic data packets of the IoT device through the middleman gateway device, and pre-process the traffic data packets to obtain a data packet sequence; wherein the middleman gateway device is set between the IoT device and the public network; The semantic recognition module 302 is used to input the data packet sequence into a pre-trained semantic recognition model for semantic recognition, and obtain a semantic feature vector corresponding to each data packet; The behavior classification module 303 is used to input the semantic feature vector into a pre-trained behavior classification model for classification to obtain the device type of the IoT device.

[0078] The above-mentioned IoT device type identification device provided by the present invention adopts a middleman gateway device to obtain the traffic data packets of the IoT device, and performs semantic recognition on the traffic data packets of the IoT device through a semantic recognition model, and classifies the semantic feature vectors to determine the device type of the IoT device, thereby significantly improving the accuracy and efficiency of IoT device identification.

[0079] It should be noted that the implementation principle and technical effects of the device provided in the embodiment of the present invention are the same as those of the aforementioned method embodiment. For the sake of brief description, for matters not mentioned in the device embodiment, reference may be made to the corresponding contents in the aforementioned method embodiment.

[0080] An embodiment of the present invention further provides an electronic device. Specifically, the electronic device includes a processor and a storage device. The storage device stores a computer program, and when the computer program is executed by the processor, it executes the method described in any one of the above implementation methods.

[0081] Figure 4 A structural diagram of an electronic device provided in an embodiment of the present invention, the electronic device 100 includes: a processor 40, a memory 41, a bus 42 and a communication interface 43, wherein the processor 40, the communication interface 43 and the memory 41 are connected via the bus 42; the processor 40 is used to execute an executable module stored in the memory 41, such as a computer program.

[0082] The memory 41 may include a high-speed random access memory (RAM), and may also include a non-volatile memory, such as at least one disk memory. The communication connection between the system network element and at least one other network element is realized through at least one communication interface 43 (which may be wired or wireless), and the Internet, wide area network, local area network, metropolitan area network, etc. may be used.

[0083] The bus 42 may be an ISA bus, a PCI bus, or an EISA bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 4 Only one bidirectional arrow is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0084] Among them, the memory 41 is used to store programs, and the processor 40 executes the program after receiving the execution instruction. The method executed by the device for flow process definition disclosed in any embodiment of the above-mentioned embodiment of the present invention can be applied to the processor 40 or implemented by the processor 40.

[0085] The processor 40 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit or software instructions in the processor 40. The above processor 40 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present invention can be implemented or executed. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor. The steps of the method disclosed in the embodiment of the present invention can be directly embodied as a hardware decoding processor to be executed, or the hardware and software modules in the decoding processor can be executed. The software module can be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory 41, and the processor 40 reads the information in the memory 41 and completes the steps of the above method in combination with its hardware.

[0086] The computer program product of the readable storage medium provided in the embodiment of the present invention includes a computer-readable storage medium storing program code, and the instructions included in the program code can be used to execute the methods described in the previous method embodiments. The specific implementation can be referred to the previous method embodiments, which will not be repeated here.

[0087] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc., which can store program codes.

[0088] Finally, it should be noted that the above-described embodiments are only specific implementations of the present invention, which are used to illustrate the technical solutions of the present invention, rather than to limit them. The protection scope of the present invention is not limited thereto. Although the present invention is described in detail with reference to the above-mentioned embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the above-mentioned embodiments within the technical scope disclosed by the present invention, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. A method for identifying the type of an Internet of Things device, characterized in that: include: Obtaining traffic data packets of the IoT device through a middleman gateway device, and preprocessing the traffic data packets to obtain a data packet sequence; wherein the middleman gateway device is arranged between the IoT device and the public network; Inputting the data packet sequence into a pre-trained semantic recognition model for semantic recognition to obtain a semantic feature vector corresponding to each data packet; The semantic feature vector is input into a pre-trained behavior classification model for classification to obtain the device type of the Internet of Things device.

2. The identification method according to claim 1, characterized in that: Preprocessing the traffic data packet to obtain a data packet sequence includes: Using a traffic analysis tool to convert the traffic data packet into a JSON format text file; wherein each line in the JSON format text file represents a TCP stream data packet sequence; Filter the data in the JSON format text file, and convert the filtered data packets into a CSV file format file; The data packets in the CSV file format file are verified using a data visualization tool, and the verified data packets in the CSV file format file are rearranged to obtain a data packet sequence.

3. The identification method according to claim 1, characterized in that: The semantic recognition model includes a multi-layer encoder, each sub-layer includes: a self-attention layer and a feed-forward fully connected network; The data packet sequence is input into a pre-trained semantic recognition model for semantic recognition, and a semantic feature vector corresponding to each data packet is obtained, including: Convert each packet in the packet sequence into an embedding vector, and input the embedding vector into a first sub-layer; Performing semantic recognition on the embedding vector of each data packet through the first sub-layer to obtain a feature vector output by the first sub-layer; The feature vector output by the first sub-layer is input to the next sub-layer, and semantic recognition is repeated until the last sub-layer to obtain the semantic feature vector corresponding to each of the data packets, and the behavioral semantics of the Internet of Things device is determined based on the semantic feature vector; wherein the step of semantic recognition includes: for each of the data packets, the attention weight matrix between the embedded vectors of the data packets is calculated by the self-attention layer; the attention weight matrix output by the self-attention layer is nonlinearly transformed by the feedforward fully connected network to obtain the transformed weight matrix; the transformed weight matrix output by the feedforward fully connected network is added to the input of the current sub-layer and then layer normalized to obtain the feature vector.

4. The identification method according to claim 1, characterized in that: The construction of the semantic recognition model includes: Constructing a simulation experiment environment; wherein the simulation experiment environment includes different types of Internet of Things devices; Obtaining traffic data packets of IoT devices in the simulation experiment environment through a middleman gateway device, and preprocessing the traffic data packets to obtain a training data set and a test data set; The data packets in the training data set are input into the Transformer model to obtain the semantic feature vector corresponding to the data packet, and the Transformer model is verified based on the test data set to obtain a trained semantic recognition model.

5. The identification method according to claim 4, characterized in that: The construction of the behavior classification model includes: Dividing the semantic feature vectors output by the trained semantic recognition model into a training set and a test set, and determining corresponding feature sets and device type sets based on the semantic feature vectors; The Transformer classifier is trained based on the training set, the feature set, the device type set and the test set to obtain a trained behavior classification model.

6. The identification method according to claim 5, characterized in that: The Transformer classifier is trained based on the training set, the feature set, the device type set, and the test set to obtain a trained behavior classification model, including: Using a stochastic gradient descent method to extract training samples from the training set to obtain multiple training batches; For each of the training batches, extracting semantic features corresponding to the training samples from the feature set, and inputting the extracted semantic features into the Transformer classifier to obtain device type features of each of the training batches; Combining the device type features of each of the training batches to obtain a device type feature set; Inputting the semantic features corresponding to the test samples in the test set into the Transformer classifier for classification, and normalizing the classification results using a softmax function to obtain the device types of the test samples in the test set; Repeat the classification of the test samples in the test set until the device type of each test sample in the test set is obtained, thereby obtaining a trained behavior classification model.

7. The identification method according to claim 4, characterized in that: Also includes: The semantic feature vectors, traffic data packets and Internet of Things devices in the semantic recognition model training process are stored to obtain a behavior classification database.

8. A device for identifying the type of IoT device, characterized in that: include: A middleman data acquisition module, used to acquire the flow data packets of the Internet of Things device through the middleman gateway device, and pre-process the flow data packets to obtain a data packet sequence; wherein the middleman gateway device is arranged between the Internet of Things device and the public network; A semantic recognition module, used for inputting the data packet sequence into a pre-trained semantic recognition model for semantic recognition, and obtaining a semantic feature vector corresponding to each data packet; The behavior classification module is used to input the semantic feature vector into a pre-trained behavior classification model for classification to obtain the device type of the Internet of Things device.

9. An electronic device, characterized in that: The method comprises a processor and a memory, wherein the memory stores computer executable instructions that can be executed by the processor, and the processor executes the computer executable instructions to implement the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are performed.

Images