Internet of Things equipment type identification method and device based on LSTM algorithm

Abstract

The invention provides an Internet of Things equipment type identification method and device based on an LSTM algorithm, relates to the technical field of computer networks, and solves the technical problem that an existing Internet of Things equipment identification method is relatively low in identification efficiency. The method comprises the following steps: acquiring initial network traffic between Internet of Things equipment and a router by using a network TAP through a traffic capturing system, and performing data preprocessing on the initial network traffic to obtain traffic data; screening key feature data from the traffic data, and extracting the key feature data from the traffic data; inputting the key feature data into a specified LSTM network for model training to obtain a trained Internet of Things equipment classification model; and analyzing to-be-analyzed network traffic between to-be-identified equipment and a router by using the Internet of Things equipment classification model to obtain an analysis result, and determining an equipment type identification result of the to-be-identified equipment according to the analysis result.

Description

Technical Field

[0001] The present application relates to the field of computer network technology, and in particular to a method and apparatus for identifying the type of IoT devices based on an LSTM algorithm. Background Art

[0002] The particularity of the IoT environment has led to a large number of front-end devices being distributed in unattended places. These devices are prone to becoming targets of hacker attacks due to the lack of effective security protection. Once compromised, attackers can easily penetrate the entire network, thereby affecting the normal operation of the core business system and even causing the leakage of a large amount of sensitive information. Therefore, building a sound IoT control mechanism and a comprehensive security system is the key to ensuring the security of the IoT. There are many types of IoT terminals, and their number far exceeds that of traditional network terminals. In addition, these devices may have unique communication protocols, functional characteristics, and security requirements according to different application scenarios and technical standards. The security threats faced by different types of IoT devices are also different. For example, smart home devices may be threatened by privacy leakage, while industrial control systems may be attacked for production interruption or equipment damage. Therefore, how to accurately and efficiently identify and classify IoT terminals has become an important issue in improving the security management level of the IoT.

[0003] At present, IoT device identification technology is mainly based on device fingerprint analysis. Device fingerprints are the characteristics of devices in network communications, including IP addresses, open ports, packet header fields, communication behaviors, etc. These characteristics can be used to build a device fingerprint library, and classify and identify the device by comparing the data in the fingerprint library with the device to be identified. However, the existing device fingerprint identification method has low recognition efficiency. Summary of the invention

[0004] The purpose of the present invention is to provide a method and device for identifying the type of an Internet of Things device based on an LSTM algorithm, so as to solve the technical problem of low recognition efficiency of the existing Internet of Things device recognition method.

[0005] In a first aspect, the present application provides a method for identifying the type of IoT device based on a long short-term memory network (LSTM) algorithm, the method comprising: The initial network traffic between the IoT device and the router is obtained by using a network test access point (TAP) through a traffic capture system, and data preprocessing is performed on the initial network traffic to obtain traffic data; Screening the traffic data for key feature data, and extracting the key feature data from the traffic data; Input the key feature data into a specified LSTM network for model training to obtain a trained IoT device classification model; The network traffic to be analyzed between the device to be identified and the router is analyzed using the IoT device classification model to obtain an analysis result, and a device type identification result of the device to be identified is determined based on the analysis result.

[0006] In a possible implementation, performing data preprocessing on the initial network traffic to obtain traffic data includes: Performing structured processing on the initial network traffic to obtain structured data; The structured data is preprocessed to obtain flow data.

[0007] In a possible implementation, extracting the key feature data from the traffic data includes: Using a designated Pcap2Json auxiliary tool to read data packet information in an Ethernet packet sniffer file (PCAP) corresponding to the traffic data, determining a device identity document (ID) according to a device name of the IoT device for distinction, generating a key feature JSON string according to the data packet information, and outputting the key feature lightweight data exchange format (JavaScriptObjectNotation, JSON) string to a corresponding file; The designated PcapSplitter auxiliary tool is used to read the data packet information in the PCAP file corresponding to the traffic data, the device ID is determined according to the device name of the IoT device for distinction, and the data packet information is transmitted to the decomposed PCAP file.

[0008] In a possible implementation, it also includes: According to the data packet protocol in the data packet information, the data packets referred to by the data packet information are divided into control data packets and user data packets; the control data packets are used to represent data packets that do not carry data sending and receiving tasks and include Address Resolution Protocol (ARP), Domain Name System (DNS), Internet Control Message Protocol (ICMP), and Network Time Protocol (NTP); the user data packets are used to represent data packets that include Transmission Control Protocol (TCP), User Datagram Protocol (UDP), Hypertext Transfer Protocol (HTTP), and Transport Layer Security (TLS) and are used to exchange information with a server; The key feature data includes a first category of key feature data and a second category of key feature data; wherein the first category of key feature data is a feature related to the number of data packets, including the number of control class data packets in the time window and the number of user class data packets in the time window; the second category of key feature data is a feature related to the length of data packets, including the average length of the control class data packets in the time window, the maximum length of the control class data packets in the time window, the average length of the user class data packets in the time window and the maximum length of the user class data packets in the time window.

[0009] In a possible implementation, inputting the key feature data into a specified LSTM network for model training to obtain a trained IoT device classification model includes: The json data obtained from the pcap2json processing is input into the data processor to generate training and test data sets; the pre-processed traffic data is classified according to the device name and the device ID in the data packet information, the data packets are grouped according to the preset time window length and the preset overlap ratio, each group of the data packets is counted, the key feature data is extracted, and a feature vector is generated according to the key feature data; a feature time series for model input is generated according to the feature vector, the preset feature vector sequence depth and the preset overlap length, and the input feature time series is normalized to obtain a normalized processing result; based on the normalized processing result, the device ID is added as the ground truth to generate a target data set, the training and test data sets obtained after the data processor is processed and the target data set are input into a specified LSTM network, and through initialization and several iterations, the one with the best loss is selected as the applied IoT device classification model; the IoT device classification model is used to classify different IoT devices.

[0010] In one possible implementation, the IoT device classification model includes a two-layer LSTM with an input size of 6 and a hidden layer size of 100, and a fully connected layer model with an input layer size of 100 and an output layer size of 16.

[0011] In a possible implementation, the key feature data includes any one or more of the following: Data on packet size, transmission frequency, and protocol used.

[0012] In the second aspect, the present application provides an IoT device type identification device based on an LSTM algorithm, comprising: An acquisition module is used to acquire the initial network traffic between the IoT device and the router by using a network TAP through a traffic capture system, and perform data preprocessing on the initial network traffic to obtain traffic data; An extraction module, used for screening the traffic data for key feature data and extracting the key feature data from the traffic data; A training module, used for inputting the key feature data into a specified LSTM network for model training to obtain a trained IoT device classification model; The analysis module is used to analyze the network traffic to be analyzed between the device to be identified and the router using the IoT device classification model to obtain an analysis result, and determine the device type identification result of the device to be identified based on the analysis result.

[0013] In a third aspect, the present application provides an electronic device, comprising a memory and a processor, wherein the memory stores a computer program executable on the processor, and when the processor executes the computer program, the method described in the first aspect is implemented.

[0014] In a fourth aspect, the present application further provides a computer-readable storage medium, which stores computer-executable instructions. When the computer-executable instructions are called and executed by a processor, the computer-executable instructions prompt the processor to execute the method described in the first aspect.

[0015] This application brings the following beneficial effects: The present application provides a method and device for identifying the type of IoT device based on the LSTM algorithm, which can obtain the initial network traffic between the IoT device and the router through the network TAP of the traffic capture system, and perform data preprocessing on the initial network traffic to obtain traffic data; screen the traffic data for key feature data, and extract the key feature data from the traffic data; input the key feature data into the specified LSTM network for model training to obtain a trained IoT device classification model; use the IoT device classification model to analyze the network traffic to be analyzed between the device to be identified and the router to obtain the analysis result, and determine the device type identification result of the device to be identified based on the analysis result. In this solution, for the identification of the type of IoT device, the network traffic is analyzed by the LSTM algorithm to capture the long-term dependency in the traffic time series data, and the accurate identification of the type of IoT device is realized. This method can still maintain a high recognition accuracy rate when the amount of data is small, thereby improving the recognition efficiency of IoT devices and solving the technical problem of low recognition efficiency of the existing IoT device identification method.

[0016] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, preferred embodiments are specifically cited below and described in detail with reference to the attached drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the specific implementation methods of the present application or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0018] Figure 1 A schematic diagram of a flow chart of a method for identifying the type of IoT device based on an LSTM algorithm provided in an embodiment of the present application; Figure 2 This is a system architecture diagram of the method for identifying the type of IoT device based on the LSTM algorithm provided in an embodiment of the present application.

[0019] Figure 3 Another schematic diagram of the process of the method for identifying the type of IoT device based on the LSTM algorithm provided in the embodiment of the present application; Figure 4 A flowchart of data transmission and processing in an LSTM classifier provided in an embodiment of the present application; Figure 5 A schematic diagram of the structure of an IoT device type identification device based on an LSTM algorithm provided in an embodiment of the present application; Figure 6 A schematic structural diagram of an electronic device provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0020] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution of the present application will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present application.

[0021] The terms "including" and "having" and any variations thereof mentioned in the embodiments of the present application are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device including a series of steps or units is not limited to the listed steps or units, but may optionally include other steps or units that are not listed, or may optionally include other steps or units that are inherent to these processes, methods, products or devices.

[0022] At present, the existing device fingerprint analysis methods usually rely on manual summary and analysis, which consumes a lot of human resources. This not only reduces the recognition efficiency, but also limits the update speed of the fingerprint library and cannot adapt to the emergence of new devices in a timely manner. With the rapid update and iteration of IoT devices, new device types and communication protocols continue to emerge, and the applicability and flexibility of traditional methods are low.

[0023] Moreover, existing fingerprint libraries often show insufficient recognition capabilities when facing emerging devices. Since the construction of device fingerprint libraries relies on the characteristics of known devices, it is often impossible to effectively classify new devices that have not been identified. This limitation puts tremendous pressure on security management in the IoT environment, which may lead to the failure to timely identify new devices when they are connected to the network, thus bringing hidden dangers to the overall network security.

[0024] Furthermore, with the rapid increase in the number of IoT devices, the complexity of network communications has also increased significantly. The coexistence and interaction of multiple protocols have led to the diversity and unpredictability of device behavior, which has brought technical challenges to device identification. In this complex environment, quickly and accurately identifying device types has become an important technical difficulty in IoT security management.

[0025] Based on this, the embodiment of the present application provides a method and device for identifying the type of an Internet of Things device based on the LSTM algorithm. This method can solve the above-mentioned technical problems such as the low recognition efficiency of the existing Internet of Things device identification method.

[0026] The embodiments of the present invention are further described below in conjunction with the accompanying drawings.

[0027] Figure 1 The present invention provides a flow chart of a method for identifying the type of IoT device based on the LSTM algorithm. Figure 1 As shown, the method includes: Step S110, using the network TAP through the traffic capture system to obtain the initial network traffic between the IoT device and the router, and performing data preprocessing on the initial network traffic to obtain traffic data.

[0028] As an optional implementation, data preprocessing is performed on the initial network traffic to obtain traffic data, including: structuring the initial network traffic to obtain structured data; and preprocessing the structured data to obtain traffic data.

[0029] In actual applications, IoT devices can usually communicate directly with routers. Through traffic capture software, the network traffic between these devices and routers can be effectively captured, and the captured data can be sent to the classifier for device type identification. In the embodiment of the present application, network TAP technology is used to capture all passing traffic in real time between IoT devices and routers. The traffic capture software can extract key features of the message, such as data packet size, transmission frequency, and protocol used, to provide data support for subsequent data analysis. After structured processing, the data is transmitted to the classifier, and a machine learning algorithm is used to perform feature analysis on the traffic data to identify the device type. The system architecture diagram is shown below. Figure 2 shown.

[0030] The method of the embodiment of the present application includes three main steps: data preprocessing, feature selection, and LSTM model training. Figure 3 As shown, first, the raw traffic data is processed, feature extracted and LSTM model trained. The network traffic between IoT devices and routers is effectively captured through traffic capture software and the data is structured. The structured data is then preprocessed.

[0031] Step S120, screening the traffic data for key feature data, and extracting the key feature data from the traffic data.

[0032] In the embodiment of the present application, the key feature data includes any one or more of the following: data packet size data, transmission frequency data and usage protocol data.

[0033] As an optional implementation, in order to achieve better training results, feature screening is performed on the traffic information to extract useful features. Exemplarily, extracting key feature data from traffic data includes: using the specified Pcap2Json auxiliary tool to read the data packet information in the PCAP file corresponding to the traffic data, determining the device ID according to the device name of the IoT device for distinction, generating a key feature JSON string according to the data packet information, and outputting the key feature JSON string to the corresponding file; using the specified PcapSplitter auxiliary tool to read the data packet information in the PCAP file corresponding to the traffic data, determining the device ID according to the device name of the IoT device for distinction, and transferring the data packet information to the decomposed PCAP file.

[0034] As an example, two auxiliary tools are used to complete some tasks of data processing and feature extraction. The specific process is as follows: Use the self-developed Pcap2Json auxiliary tool to read the data packet information in the PCAP file, specify the device ID according to the device name for distinction, and generate a feature JSON string to output to the corresponding file. Use the self-developed PcapSplitter auxiliary tool to read the data packet information in the PCAP file, specify the device ID according to the device name for distinction, and output the data packet information to the decomposed PCAP file.

[0035] It can be seen that the embodiment of the present application has developed two auxiliary tools to complete some tasks of data processing and feature extraction. The Pcap2Json tool is used to read the data packet information in the PCAP file, specify the device ID according to the device name for distinction, and generate a feature JSON string to output to the corresponding file. In addition, the accompanying batch processing tool can realize the function of batch automatic conversion. The PcapSplitter tool is used to read the data packet information in the PCAP file, specify the device ID according to the device name for distinction, and output the data packet information to the decomposed PCAP file. In addition, the accompanying batch processing tool can realize the function of batch automatic decomposition.

[0036] Since the number of device data in the dataset is unevenly distributed, after excluding devices with too little data in the test set, 16 of them were selected as devices to be classified, as shown in Table 1 (names of IoT devices tested).

[0037]

[0038] In an optional embodiment, the method also includes: according to the data packet protocol in the data packet information, dividing the data packets referred to by the data packet information into control class data packets and user class data packets; the control class data packets are used to represent data packets that do not carry data sending and receiving tasks and include ARP, DNS, ICMP, and NTP; the user class data packets are used to represent data packets that include TCP, UDP, HTTP, and TLS and are used to exchange information with the server; the key feature data includes a first category of key feature data and a second category of key feature data; wherein the first category of key feature data is a feature related to the number of data packets, including the number of control class data packets within the time window and the number of user class data packets within the time window; the second category of key feature data is a feature related to the length of the data packet, including the average length of the control class data packets within the time window, the maximum length of the control class data packets within the time window, the average length of the user class data packets within the time window, and the maximum length of the user class data packets within the time window.

[0039] In practical applications, data packets are divided into two categories: control data packets and user data packets. The selected features are also mainly divided into two categories. One category is the features related to the number of data packets, the number of control data packets in the time window and the number of user data packets in the time window. The other category is the features related to the length of data packets, including the average length of control data packets in the time window, the maximum length of control data packets in the time window, the average length of user data packets in the time window, and the maximum length of user data packets in the time window.

[0040] In the process of feature selection, multiple pieces of information are recorded in the JSON readable string of network traffic generated by the pcap2json tool, so it is necessary to screen this information before use to extract useful features. According to the packet protocol, the packets are divided into two categories: control packets and user packets. Control packets refer to packets such as ARP, DNS, ICMP, and NTP that do not carry data sending and receiving tasks; while user packets refer to packets such as TCP, UDP, HTTP, and TLS that are used to exchange information with the server. The selected features are also mainly divided into two categories. One category is the features related to the number of packets, the number of control packets in the time window, and the number of user packets in the time window. The other category is the features related to the length of the packet, including the average length of the control packet in the time window, the maximum length of the control packet in the time window, the average length of the user packet in the time window, and the maximum length of the user packet in the time window.

[0041] Step S130, inputting the key feature data into the specified LSTM network for model training to obtain a trained IoT device classification model.

[0042] In the embodiment of the present application, the feature-extracted data is input into the LSTM network for model training. Specifically, step S130 may include: inputting the json data obtained from the pcap2json processing into the data processor to generate training and test data sets; classifying the pre-processed traffic data according to the device name and device ID in the data packet information, grouping the data packets according to the preset time window length and the preset overlap ratio, performing statistics on each group of data packets, extracting key feature data, and generating feature vectors according to the key feature data; generating a feature time series for model input according to the feature vector, the preset feature vector sequence depth and the preset overlap length, normalizing the input feature time series, and obtaining a normalized processing result; adding the device ID as ground_truth based on the normalized processing result, generating a target data set, inputting the training and test data sets and the target data set obtained after the data processor is processed into the specified LSTM network, and selecting the one with the best loss as the applied IoT device classification model through initialization and several iterations; the IoT device classification model is used to classify different IoT devices.

[0043] It should be noted that ground truth refers to real, accurate or standard data or information in the field of machine learning and data analysis. It is usually used as a benchmark for model evaluation and performance measurement in order to compare with the model's prediction results.

[0044] For the specific process of LSTM training, the pre-processed data is classified according to the device name of the data packet information and the specified device id. The data packets are grouped according to the set time window length (60s) and overlap ratio (50%), and each group of data packets is counted to extract the features selected above and generate feature vectors. According to the set feature vector sequence depth (30) and overlap length (15), a feature time series for model input is generated. Finally, the input feature sequence is normalized, and the device id is added as ground_truth to generate a data set. The data set is placed in the model. After initialization and several iterations, the one with the best loss is selected as the application model. The resulting model can achieve the purpose of classifying different IoT devices.

[0045] Specifically, the json data obtained from pcap2json processing is put into a data processor to generate training and test data sets. The device id is specified according to the device name of the data packet information in the json file for classification. The data packets are grouped according to the set time window length (60s) and overlap ratio (50%). Then statistics are performed on each group of data packets, and the features selected above are extracted to generate feature vectors. According to the set feature vector sequence depth (30) and overlap length (15), a feature time series is generated for model input. Finally, the input feature sequence is normalized, and the device id is added as ground_truth to generate a data set. The data set obtained after processing from the data processor is put into the model. After initialization and several iterations, the one with the best loss is selected as the application model. The resulting model can achieve the purpose of classifying different IoT devices. The internal principle of LSTM is as follows Figure 4 shown.

[0046] As a possible implementation, the IoT device classification model includes a double-layer LSTM with an input size of 6 and a hidden layer size of 100, and a fully connected layer model with an input layer size of 100 and an output layer size of 16. In the embodiment of the present application, a double-layer LSTM with an input size of 6 and a hidden layer size of 100, and a fully connected layer with an input layer size of 100 and an output layer size of 16 are constructed, and the adam optimizer is used to improve the model.

[0047] Step S140, using the IoT device classification model to analyze the network traffic to be analyzed between the device to be identified and the router, obtaining an analysis result, and determining a device type identification result of the device to be identified based on the analysis result.

[0048] In the embodiment of the present application, for the identification of the type of IoT device, the LSTM algorithm is used to analyze the network traffic, capture the long-term dependencies in the traffic time series data, and realize the accurate identification of the type of IoT device. This method can maintain a high recognition accuracy rate even when the amount of data is small, showing good adaptability and robustness. Moreover, through the new methods of intelligent algorithms and machine learning, the accuracy and efficiency of IoT device identification can be improved, which can not only enhance the security protection capabilities of the IoT, but also provide strong support for the sustainable development of the IoT in the future. Through innovative identification methods, it is possible to effectively respond to ever-changing security threats and ensure that the application of the IoT in various industries is safer and more reliable.

[0049] The IoT device type identification method based on LSTM algorithm solves the technical problem of how to identify IoT devices with high accuracy by analyzing network traffic, and proposes an IoT device type identification method based on LSTM algorithm, which is suitable for the field of computer network technology, and particularly relates to an IoT device type identification method and system based on machine learning.

[0050] The core content of the IoT device type identification method based on the LSTM algorithm provided in the embodiment of the present application is the implementation of a classifier for network traffic. Due to the differences in feature selection, data set generation methods, and the number of classifications, the performance of various learning algorithms varies greatly. After investigation, the embodiment of the present application selects LSTM to implement the classification of different IoT devices. The short-term memory network (LSTM) is a significant variant of the recurrent neural network (RNN) and is specifically designed to process sequential data. It has been proven to be very effective for many applications, including speech recognition, handwriting recognition, and anomaly detection.

[0051] Figure 5 A schematic diagram of the structure of an IoT device type recognition device based on an LSTM algorithm is provided. Figure 5 As shown, the IoT device type identification device 500 based on the LSTM algorithm includes: The acquisition module 501 is used to acquire the initial network traffic between the IoT device and the router by using the network TAP through the traffic capture system, and perform data preprocessing on the initial network traffic to obtain traffic data; An extraction module 502, used to screen the traffic data for key feature data and extract the key feature data from the traffic data; The training module 503 is used to input the key feature data into a specified LSTM network for model training to obtain a trained IoT device classification model; The analysis module 504 is used to analyze the network traffic to be analyzed between the device to be identified and the router using the IoT device classification model to obtain an analysis result, and determine a device type identification result of the device to be identified based on the analysis result.

[0052] The IoT device type identification device based on the LSTM algorithm provided in the embodiment of the present application has the same technical features as the IoT device type identification method based on the LSTM algorithm provided in the above embodiment, so it can also solve the same technical problems and achieve the same technical effects.

[0053] An electronic device provided in an embodiment of the present application is Figure 6As shown, the electronic device 600 includes a processor 602 and a memory 601, wherein the memory stores a computer program that can be run on the processor, and the processor implements the steps of the method provided in the above embodiment when executing the computer program.

[0054] See also Figure 6 The electronic device further includes: a bus 603 and a communication interface 604, a processor 602, a communication interface 604 and a memory 601 are connected via the bus 603; the processor 602 is used to execute an executable module stored in the memory 601, such as a computer program.

[0055] The memory 601 may include a high-speed random access memory (RAM), and may also include a non-volatile memory, such as at least one disk storage. The communication connection between the system network element and at least one other network element is realized through at least one communication interface 604 (which may be wired or wireless), and the Internet, wide area network, local area network, metropolitan area network, etc. may be used.

[0056] The bus 603 may be an ISA bus, a PCI bus, or an EISA bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 6 Only one bidirectional arrow is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0057] Among them, the memory 601 is used to store programs, and the processor 602 executes the program after receiving the execution instruction. The method executed by the device defined by the process disclosed in any embodiment of the present application can be applied to the processor 602 or implemented by the processor 602.

[0058] The processor 602 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit or software instructions in the processor 602. The above processor 602 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in the embodiments of the present application can be directly embodied as a hardware decoding processor to execute, or the hardware and software modules in the decoding processor are combined to execute. The software module can be located in a storage medium mature in the art, such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory 601, and the processor 602 reads the information in the memory 601 and completes the steps of the above method in combination with its hardware.

[0059] Corresponding to the above-mentioned method for identifying the type of an Internet of Things device based on the LSTM algorithm, an embodiment of the present application also provides a computer-readable storage medium, which stores computer-executable instructions. When the computer-executable instructions are called and executed by a processor, the computer-executable instructions prompt the processor to execute the steps of the above-mentioned method for identifying the type of an Internet of Things device based on the LSTM algorithm.

[0060] The IoT device type identification device based on the LSTM algorithm provided in the embodiment of the present application can be specific hardware on the device or software or firmware installed on the device. The implementation principle and technical effects of the device provided in the embodiment of the present application are the same as those of the aforementioned method embodiment. For the sake of brief description, for matters not mentioned in the device embodiment, reference can be made to the corresponding contents in the aforementioned method embodiment. Technical personnel in the relevant field can clearly understand that for the convenience and simplicity of description, the specific working processes of the systems, devices and units described above can all refer to the corresponding processes in the aforementioned method embodiment, and will not be repeated here.

[0061] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0062] For another example, the flowchart and block diagram in the accompanying drawings show the possible architecture, function and operation of the device, method and computer program product according to multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of the code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or the flowchart, and the combination of the boxes in the block diagram and / or the flowchart can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0063] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0064] In addition, each functional unit in the embodiments provided in the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0065] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the IoT device type identification method based on the LSTM algorithm described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk, and other media that can store program codes.

[0066] It should be noted that similar numbers and letters represent similar items in the following figures. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. In addition, the terms "first", "second", "third", etc. are only used to distinguish the description and are not to be understood as indicating or implying relative importance.

[0067] Finally, it should be noted that the above-described embodiments are only specific implementation methods of the present application, which are used to illustrate the technical solution of the present application, rather than to limit it. The protection scope of the present application is not limited thereto. Although the present application is described in detail with reference to the aforementioned embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solution recorded in the aforementioned embodiments within the technical scope disclosed in the present application, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solution deviate from the scope of the technical solution of the embodiment of the present application. They should all be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. A method for identifying the type of IoT devices based on LSTM algorithm, characterized in that: The method comprises: The initial network traffic between the IoT device and the router is obtained by using a network TAP through a traffic capture system, and data preprocessing is performed on the initial network traffic to obtain traffic data; Screening the traffic data for key feature data, and extracting the key feature data from the traffic data; Input the key feature data into a specified LSTM network for model training to obtain a trained IoT device classification model; The network traffic to be analyzed between the device to be identified and the router is analyzed using the IoT device classification model to obtain an analysis result, and a device type identification result of the device to be identified is determined based on the analysis result.

2. The method according to claim 1, characterized in that The performing data preprocessing on the initial network traffic to obtain traffic data includes: Performing structured processing on the initial network traffic to obtain structured data; The structured data is preprocessed to obtain flow data.

3. The method according to claim 1, characterized in that The step of extracting the key characteristic data from the traffic data comprises: Using the specified Pcap2Json auxiliary tool to read the data packet information in the PCAP file corresponding to the traffic data, determining the device ID according to the device name of the IoT device for distinction, generating a key feature JSON string according to the data packet information, and outputting the key feature JSON string to a corresponding file; The designated PcapSplitter auxiliary tool is used to read the data packet information in the PCAP file corresponding to the traffic data, the device ID is determined according to the device name of the IoT device for distinction, and the data packet information is transmitted to the decomposed PCAP file.

4. The method according to claim 3, characterized in that Also includes: According to the data packet protocol in the data packet information, the data packets referred to by the data packet information are divided into control class data packets and user class data packets; The control data packets are used to represent data packets that do not carry data transmission and reception tasks, including ARP, DNS, ICMP, and NTP; the user data packets are used to represent data packets that include TCP, UDP, HTTP, and TLS and are used to exchange information with the server; The key feature data includes a first category of key feature data and a second category of key feature data; wherein the first category of key feature data is a feature related to the number of data packets, including the number of control class data packets in the time window and the number of user class data packets in the time window; the second category of key feature data is a feature related to the length of data packets, including the average length of the control class data packets in the time window, the maximum length of the control class data packets in the time window, the average length of the user class data packets in the time window and the maximum length of the user class data packets in the time window.

5. The method according to claim 3, characterized in that: The key feature data is input into a designated LSTM network for model training to obtain a trained IoT device classification model, including: The json data obtained from the pcap2json processing is input into the data processor to generate training and test data sets; the pre-processed traffic data is classified according to the device name and the device ID in the data packet information, the data packets are grouped according to the preset time window length and the preset overlap ratio, each group of the data packets is counted, the key feature data is extracted, and a feature vector is generated according to the key feature data; a feature time series for model input is generated according to the feature vector, the preset feature vector sequence depth and the preset overlap length, and the input feature time series is normalized to obtain a normalized processing result; based on the normalized processing result, the device ID is added as ground truth to generate a target data set, and the training and test data sets obtained after the data processor is processed and the target data set are input into the specified LSTM network, and through initialization and several iterations, the one with the best loss is selected as the applied IoT device classification model; the IoT device classification model is used to classify different IoT devices.

6. The method according to claim 1, characterized in that The IoT device classification model contains a two-layer LSTM with an input size of 6 and a hidden layer size of 100, and a fully connected layer model with an input layer size of 100 and an output layer size of 16.

7. The method according to claim 1, characterized in that The key feature data includes any one or more of the following: Data on packet size, transmission frequency, and protocol used.

8. An IoT device type identification device based on LSTM algorithm, characterized in that: include: An acquisition module is used to acquire the initial network traffic between the IoT device and the router by using a network TAP through a traffic capture system, and perform data preprocessing on the initial network traffic to obtain traffic data; An extraction module, used for screening the traffic data for key feature data and extracting the key feature data from the traffic data; A training module, used for inputting the key feature data into a specified LSTM network for model training to obtain a trained IoT device classification model; The analysis module is used to analyze the network traffic to be analyzed between the device to be identified and the router using the IoT device classification model to obtain an analysis result, and determine the device type identification result of the device to be identified based on the analysis result.

9. An electronic device comprising a memory and a processor, wherein the memory stores a computer program that can be run on the processor, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions. When the computer-executable instructions are called and executed by a processor, the computer-executable instructions prompt the processor to execute the method according to any one of claims 1 to 7.

Images