Industrial Internet of Things equipment intelligent identification method and device based on deep learning

Abstract

The invention relates to the technical field of network security in industrial Internet of Things security, in particular to an industrial Internet of Things equipment intelligent identification method and device based on deep learning. According to a multi-modal data equipment identification model optimized based on a bidirectional adaptive time convolution network, a bidirectional gating circulation unit, a self-attention mechanism and a particle swarm optimization algorithm, when traffic data of complex industrial Internet of Things equipment is processed, the equipment identification accuracy is remarkably improved, the model training time is shortened, and the resource consumption is optimized. The model can effectively cope with diversified device traffic in an industrial Internet of Things scene, has higher adaptability and robustness, and has a wide application prospect in the field of device intelligent identification. The problems of low efficiency and complexity of dependence on expert experience and insufficient universality of equipment customization identification of the conventional characteristic engineering process for identifying the industrial internet-of-things equipment at present are solved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology in industrial Internet of Things security, and in particular to a method and device for intelligently identifying industrial Internet of Things equipment based on deep learning. Background Art

[0002] In industrial control systems, unauthorized or deceptive devices may endanger or damage the performance and security of critical infrastructure. In actual scenarios of industrial control systems, such as coal mines, thermal power plants, and automobile factories, attackers can use wireless networks to inject false data and commands by invading specific wireless smart devices, causing abnormal operation of the equipment, resulting in serious security threats to the industrial network, affecting normal industrial production and causing huge economic losses to society. Therefore, the potential harm of these industrial devices makes the task of ICS network security monitoring particularly important. Researching and applying industrial IoT device identification technology can effectively solve the security problems of equipment and data in the industrial Internet. Therefore, efficient and accurate identification of IoT devices has become a security technology worthy of research. It can help manage and configure devices, detect and isolate vulnerable devices, and take restrictive measures when devices deviate from normal behavior to prevent the expansion of security threats.

[0003] An effective device identification method can provide an exhaustive list of devices present in the network, enabling network administrators to locate vulnerable devices and set up automatic vulnerability patching for specific device types. Therefore, device identification technology is essential to achieving the security of industrial IoT networks. Industrial IoT device data involves confidential information in the industrial field, and its privacy security needs to be protected. In complex practical industrial environments, there are a large number of devices from different manufacturers in heterogeneous industrial networks. The current traditional feature engineering process for industrial IoT device identification relies on the inefficiency and complexity of expert experience, and the lack of universality of customized device identification. Summary of the invention

[0004] The main purpose of the present invention is to provide a method and device for intelligent identification of industrial Internet of Things devices based on deep learning, aiming to solve the problems of low efficiency and complexity of the traditional feature engineering process for industrial Internet of Things device identification relying on expert experience, and insufficient versatility of customized equipment identification.

[0005] To achieve the above-mentioned purpose, the first aspect of the present invention proposes an intelligent identification method for industrial Internet of Things devices based on deep learning, comprising the following steps:

[0006] Obtain traffic data from industrial IoT devices;

[0007] Convert the traffic data into a grayscale image sequence and a one-dimensional vector sequence;

[0008] Extracting bidirectional temporal features of the grayscale image sequence and extracting bidirectional gated temporal features of the one-dimensional vector sequence;

[0009] Fusing the bidirectional time series feature and the bidirectional gated time feature to obtain a fused feature;

[0010] The fused features are weighted through the self-attention mechanism to generate a context feature vector;

[0011] Classification is performed according to the context feature vector, and a device category result is output.

[0012] Furthermore, it also includes optimizing feature extraction parameters and self-attention mechanism parameters using a particle swarm optimization algorithm.

[0013] Furthermore, the conversion of the flow data into a grayscale image sequence and a one-dimensional vector sequence comprises the following steps:

[0014] Divide the traffic data according to the session-level segmentation granularity to obtain the traffic session;

[0015] Delete the MAC and IP addresses that uniquely identify the device in the traffic session and fill the original location of the data with preset characters;

[0016] Determine whether the bytes of the traffic session are greater than or equal to the preset byte value. If so, truncate the traffic of the traffic session after the preset byte number to obtain the session data; if not, add the preset characters to the end of the traffic session until the bytes of the traffic session are the preset byte value to obtain the session data;

[0017] Convert session data into a one-dimensional vector sequence;

[0018] The session data is converted into two dimensions, and each byte is used as the data of a pixel in the grayscale image to generate a grayscale image; several grayscale images are converted into grayscale image sequences.

[0019] Furthermore, extracting the bidirectional temporal features of the grayscale image sequence comprises the following steps:

[0020] The grayscale image sequence is bidirectionally convolved through a bidirectional adaptive temporal convolutional network to obtain forward sequence convolution results and backward sequence convolution results;

[0021] Preserve the previous layer information through gated residual connections;

[0022] Concatenate the forward sequence convolution result and the backward sequence convolution result, and output them as bidirectional time series features.

[0023] Furthermore, the method for extracting the bidirectional gated time feature of the one-dimensional vector sequence is:

[0024] Extract features from the one-dimensional vector sequence through a bidirectional gated recurrent unit to obtain the forward sequence hidden state and the backward sequence hidden state;

[0025] The forward hidden state and the backward hidden state are concatenated and output as a bidirectional gated temporal feature.

[0026] Furthermore, fusing the bidirectional timing feature and the bidirectional gated time feature comprises the following steps:

[0027] Converting the bidirectional time series feature into a time series feature sequence, and converting the bidirectional gated time feature into a time feature sequence;

[0028] The temporal feature sequence and the time series feature are concatenated into a fusion matrix to obtain a fusion feature.

[0029] Furthermore, generating a context feature vector includes the following steps:

[0030] Calculate the attention score of the fused features;

[0031] Normalize the attention score to get the attention weight;

[0032] Multiply the attention weights by the value matrix to get the context feature vector.

[0033] Furthermore, the particle swarm optimization algorithm is used to optimize the feature extraction parameters and the parameters of the self-attention mechanism, including the following steps:

[0034] Iteratively update the particle's velocity and position until the optimal solution is found;

[0035] Introduce random perturbations to the velocities of some particles through mutation operations;

[0036] The loss function adopts the cross entropy loss function;

[0037] The model parameters are updated by gradient descent through the back-propagation algorithm to minimize the loss function.

[0038] The second aspect of the present invention discloses an intelligent identification device for industrial Internet of Things equipment based on deep learning, comprising:

[0039] Acquisition module, used to obtain flow data of industrial IoT devices;

[0040] A conversion module, used for converting the flow data into a grayscale image sequence and a one-dimensional vector sequence;

[0041] A feature extraction module, used to extract bidirectional temporal features of the grayscale image sequence and bidirectional gated temporal features of the one-dimensional vector sequence;

[0042] A self-attention module is used to fuse the bidirectional temporal features and the bidirectional gated time features to obtain fused features; and to perform weighted processing on the fused features to generate a context feature vector;

[0043] The classification module is used to perform classification according to the context feature vector and output a device category result.

[0044] The third aspect of the present invention discloses an intelligent identification device for industrial Internet of Things equipment based on deep learning, a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, the method described in any one of the first aspects of the present invention is implemented.

[0045] The technical solution provided by the present invention may include the following beneficial effects:

[0046] The invention is based on a multimodal data device identification model optimized by a bidirectional adaptive temporal convolutional network, a bidirectional gated recurrent unit, a self-attention mechanism, and a particle swarm optimization algorithm. When processing complex industrial Internet of Things device flow data, it significantly improves the accuracy of device identification, reduces model training time, and optimizes resource consumption. The model can effectively cope with the diversified device flow in the industrial Internet of Things scenario, has stronger adaptability and robustness, and has broad application prospects in the field of device intelligent identification.

[0047] Among them, the bidirectional adaptive temporal convolutional network and the bidirectional gated recurrent unit capture the spatiotemporal features of grayscale image sequences and one-dimensional vector sequences. The bidirectional adaptive temporal convolutional network is used to extract bidirectional temporal features in traffic grayscale images. The bidirectional adaptive temporal convolutional network expands the receptive field while maintaining the integrity of the input sequence through bidirectional dilated causal convolution, thereby capturing long-term dependencies in traffic data and extracting more comprehensive temporal features. The bidirectional gated recurrent unit is used to extract bidirectional gated temporal features in device traffic. The bidirectional gated recurrent unit can simultaneously process the forward and backward time information of the input sequence, capture the dynamic changes of device traffic in the time series, and further enhance the comprehensive extraction of device traffic features. Finally, the fusion features are weighted through the self-attention mechanism, which can dynamically capture the key features in multimodal data, highlight the feature information at key moments in device traffic, and weaken irrelevant or redundant features to improve the accuracy of device identification. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the structures shown in these drawings without paying creative work.

[0049] Figure 1 This is a flow chart of a method for intelligent identification of industrial Internet of Things devices according to an embodiment of the present invention;

[0050] Figure 2 It is a flow chart of converting flow data into grayscale image sequence and one-dimensional vector sequence in the present invention;

[0051] Figure 3 It is a schematic diagram of the structure of the dilated causal convolution in the bidirectional adaptive temporal convolutional network of the present invention;

[0052] Figure 4 This is a schematic diagram of the structure of the bidirectional adaptive temporal convolutional network and the bidirectional gated recurrent unit in parallel.

[0053] Figure 5 This is a schematic diagram of the structure of an intelligent identification device for industrial Internet of Things equipment according to an embodiment of the present invention;

[0054] Figure 6 The figure is a schematic diagram of the structure of an intelligent identification device for industrial Internet of Things equipment according to an embodiment of the present invention. DETAILED DESCRIPTION

[0055] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0056] It should be noted that all directional indications in the embodiments of the present invention (such as up, down, left, right, front, back, etc.) are only used to explain the relative position relationship, movement status, etc. between the components under a certain specific posture (as shown in the accompanying drawings). If the specific posture changes, the directional indication will also change accordingly.

[0057] In the present invention, unless otherwise clearly specified and limited, the terms "connection", "fixation", etc. should be understood in a broad sense. For example, "fixation" can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection or an indirect connection through an intermediate medium, it can be the internal connection of two elements or the interaction relationship between two elements, unless otherwise clearly defined. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0058] In addition, in the present invention, descriptions such as "first", "second", etc. are only used for descriptive purposes and cannot be understood as indicating or implying their relative importance or implicitly indicating the number of technical features indicated. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In addition, the meaning of "and / or" appearing in the full text is to include three parallel solutions. Taking "A and / or B as an example", it includes solution A, or solution B, or solutions that satisfy both A and B. In addition, the technical solutions between the various embodiments can be combined with each other, but it must be based on the ability of ordinary technicians in this field to implement. When the combination of technical solutions is contradictory or cannot be implemented, it should be deemed that such combination of technical solutions does not exist and is not within the scope of protection required by the present invention.

[0059] In industrial control systems, unauthorized or deceptive devices may endanger or damage the performance and security of critical infrastructure. In actual scenarios of industrial control systems, such as coal mines, thermal power plants, and automobile factories, attackers can use wireless networks to inject false data and commands by invading specific wireless smart devices, causing abnormal operation of the equipment, resulting in serious security threats to the industrial network, affecting normal industrial production and causing huge economic losses to society. Therefore, the potential harm of these industrial devices makes the task of ICS network security monitoring particularly important. Researching and applying industrial IoT device identification technology can effectively solve the security problems of equipment and data in the industrial Internet. Therefore, efficient and accurate identification of IoT devices has become a security technology worthy of research. It can help manage and configure devices, detect and isolate vulnerable devices, and take restrictive measures when devices deviate from normal behavior to prevent the expansion of security threats.

[0060] An effective device identification method can provide an exhaustive list of devices present in the network, enabling network administrators to locate vulnerable devices and set up automatic vulnerability patching for specific device types. Therefore, device identification technology is essential to achieving the security of industrial IoT networks. Industrial IoT device data involves confidential information in the industrial field, and its privacy security needs to be protected. In complex practical industrial environments, there are a large number of devices from different manufacturers in heterogeneous industrial networks. The current traditional feature engineering process for industrial IoT device identification relies on the inefficiency and complexity of expert experience, and the lack of universality of customized device identification.

[0061] Combine the following Figure 1 , describing the industrial Internet of Things device intelligent identification method based on deep learning disclosed in the first aspect of the present invention, comprising the following steps:

[0062] Step S1: Obtain the flow data of the industrial Internet of Things device. Specifically, the original network flow data of the industrial Internet of Things device can be collected by passive bypass or active sending of inquiry data frames. The flow data includes the communication data packet, protocol information, timestamp, etc. of the device.

[0063] Step S2: Convert the traffic data into a grayscale image sequence and a one-dimensional vector sequence. By converting the traffic data into a traffic grayscale image sequence and a traffic one-dimensional vector sequence, multimodal equipment traffic data is obtained and the input data is ensured to meet the requirements of the neural network model. This step enables the spatial and temporal characteristics of the traffic data to be clearly expressed, laying the foundation for subsequent model feature extraction. It can enhance the robustness and robustness of industrial IoT device identification.

[0064] Step S3: extracting bidirectional temporal features of the grayscale image sequence and extracting bidirectional gated temporal features of the one-dimensional vector sequence;

[0065] Step S4: fusing the bidirectional time series feature and the bidirectional gated time feature to obtain a fused feature;

[0066] Step S5: weighting the fused features through the self-attention mechanism to generate a context feature vector;

[0067] Step S6: Classify according to the context feature vector and output the device category result.

[0068] The invention is based on a multimodal data device identification model optimized by a bidirectional adaptive temporal convolutional network, a bidirectional gated recurrent unit, a self-attention mechanism, and a particle swarm optimization algorithm. When processing complex industrial Internet of Things device flow data, it significantly improves the accuracy of device identification, reduces model training time, and optimizes resource consumption. The model can effectively cope with the diversified device flow in the industrial Internet of Things scenario, has stronger adaptability and robustness, and has broad application prospects in the field of device intelligent identification.

[0069] Among them, the bidirectional adaptive temporal convolutional network and the bidirectional gated recurrent unit capture the spatiotemporal features of grayscale image sequences and one-dimensional vector sequences. The bidirectional adaptive temporal convolutional network is used to extract bidirectional temporal features in traffic grayscale images. The bidirectional adaptive temporal convolutional network model uses bidirectional dilated causal convolution to expand the receptive field while maintaining the integrity of the input sequence, thereby capturing long-term dependencies in traffic data and extracting more comprehensive temporal features. The bidirectional gated recurrent unit is used to extract bidirectional gated temporal features in device traffic. The bidirectional gated recurrent unit can simultaneously process the forward and backward time information of the input sequence, capture the dynamic changes of device traffic in the time series, and further enhance the comprehensive extraction of device traffic features.

[0070] Finally, by weighting the fused features through the self-attention mechanism, the key features in the multimodal data can be dynamically captured, highlighting the characteristic information at key moments in the device traffic, while weakening irrelevant or redundant features to improve the accuracy of device identification.

[0071] Specifically, Figure 2 As shown, the conversion of flow data into a grayscale image sequence and a one-dimensional vector sequence includes the following steps:

[0072] Step S21: Divide the traffic data according to the session-level segmentation granularity to obtain the traffic session. Different traffic units are divided according to different segmentation granularities. The current mainstream segmentation methods are message level, flow level and session level. All messages with the same five-tuple (destination IP, source IP, destination port, source port and network protocol) are called flows. A session can be defined as a bidirectional flow, which is the basic granularity of this application. The reason for dividing the original network traffic at the session-level granularity is that compared with data packets, sessions contain a large number of communication behavior characteristics of IoT device traffic. More communication behavior characteristics can help deep learning models better identify devices and improve the accuracy of the model. In addition, the session granularity segmentation method retains more information and has a simple and effective processing process that is easy to implement.

[0073] Step S22: Delete the MAC and IP addresses that uniquely identify the device in the traffic session, and fill the original position of the data with preset characters. Specifically, this application identifies the device based on the behavioral characteristics contained in the original traffic, so some irrelevant fields need to be deleted to prevent them from affecting the model training process and generalization ability. Therefore, in the processing step, it is necessary to delete the MAC and IP addresses that can uniquely identify the device, and then fill the original position of the data with the preset character "0".

[0074] Step S23: Determine whether the bytes of the traffic session are greater than or equal to the preset byte value. If so, truncate the traffic after the preset byte number of the traffic session to obtain the session data; if not, add the preset character at the end of the traffic session until the bytes of the traffic session are the preset byte value to obtain the session data. Specifically, in a preferred embodiment of the present application, the byte length of the traffic session is 784. When the byte length of the traffic session is insufficient, it is filled with the preset character "0".

[0075] Step S24: converting the session data into a one-dimensional vector sequence;

[0076] Step S25: Convert the session data into two dimensions, and use each byte as the data of a pixel in the grayscale image to generate a grayscale image; convert several grayscale images into a grayscale image sequence. Specifically, in this embodiment, each byte can be represented as a value between 0 and 255, which can be used as the data of a pixel in the grayscale image, so each session can be drawn as a traffic grayscale map. After unifying the length, convert the session data into two dimensions to generate a 28*28 grayscale map.

[0077] Specifically, extracting the bidirectional temporal features of the grayscale image sequence includes the following steps:

[0078] Step S31a: performing bidirectional convolution on the grayscale image sequence through a bidirectional adaptive temporal convolution network, processing the forward sequence and the backward sequence respectively, and obtaining a forward sequence convolution result and a backward sequence convolution result;

[0079] For example, the input flow grayscale image sequence is X = {x1, x2, ..., x T},in Represents the grayscale image at time t. The convolution output is:

[0080]

[0081] Among them, y t is the convolution output, W k is the weight of the kth convolution kernel, K is the size of the convolution kernel, is the element of the input sequence, d t is the expansion factor, expansion factor d t is an adaptive parameter, the expansion factor d t Dynamically update based on changes in input features:

[0082]

[0083] Among them, d base is the initial expansion factor, α is the adjustment coefficient, C t It is the hidden state of the previous convolution layer. For the fixed expansion factor in traditional TCN, the present invention introduces an adaptive expansion rate and dynamically adjusts the expansion factor through training. In this way, the receptive field of the convolution kernel can adaptively change during the training process, capture dependencies of different lengths, and extract more comprehensive time series features.

[0084] Therefore, the forward sequence convolution result is:

[0085]

[0086] The result of the backward sequence convolution is:

[0087]

[0088] Step S32a: retain the previous layer information through gated residual connection; the residual block is defined as:

[0089]

[0090] Where σ(·) is the Sigmoid activation function, W r is a gating weight matrix, and ⊙ represents element-by-element multiplication. Through this gating mechanism, the model can selectively retain important features and suppress the propagation of irrelevant information.

[0091] Step S33a: Concatenate the forward sequence convolution result and the backward sequence convolution result, and output them as bidirectional time series features.

[0092]

[0093] Represented as a bidirectional time series feature, y forward (t) is the forward sequence convolution result, y backward (t) is the result of backward sequence convolution.

[0094] Specifically, the method for extracting the bidirectional gated time feature of the one-dimensional vector sequence is:

[0095] Step S31b: extracting features from the one-dimensional vector sequence through a bidirectional gated recurrent unit to obtain a forward sequence hidden state and a backward sequence hidden state, wherein the bidirectional gated recurrent unit is parallel to the bidirectional adaptive temporal convolutional network;

[0096] The basic calculation formula is:

[0097] z t =σ(W z ·[h t-1 ,V t ]) Formula (7)

[0098] r t =σ(W r ·[h t-1 ,V t ]) Formula (8)

[0099]

[0100]

[0101] Among them, z t is the update gate, r t is the reset gate, h t is the hidden state, V t is the input at the current moment, Wz ,W r ,W □ They are the weight matrices for the update gate, reset gate, and hidden state respectively; is the candidate hidden state, h t-1 is the hidden state at the previous moment;

[0102] Step S32b: Concatenate the forward hidden state and the backward hidden state and output them as a bidirectional gated temporal feature.

[0103]

[0104] Represented as a bidirectional gated temporal feature, is the forward sequence hidden state, is the backward sequence hidden state.

[0105] Specifically, fusing the bidirectional timing feature and the bidirectional gated time feature comprises the following steps:

[0106] Step S41: converting the bidirectional time series feature into a time series feature sequence, and converting the bidirectional gated time feature into a time feature sequence;

[0107] Specifically, the time series feature sequence is The time feature series is

[0108] Step S42: concatenate the temporal feature sequence and the time series feature into a fusion matrix to obtain a fusion feature.

[0109] H fusion =Concat(Y BiATCN ,H BiGRU ) Formula (12)

[0110] H fusion is the multimodal spatiotemporal feature, Y BiATCN is the time series feature sequence, H BiGRU is a time feature series.

[0111] Specifically, generating a context feature vector includes the following steps:

[0112] Step S51: Calculate the attention score of the fusion feature; specifically, by W Q , W K , W V Three learnable weight matrices are used to construct query, key, and value matrices. The attention score is calculated as:

[0113]

[0114] Where Q is the query vector, is the key vector, V is the value vector, d k is the dimension of the key vector, used for scaling to avoid large values.

[0115] Step S52: performing normalization processing according to the attention score to obtain the attention weight;

[0116] Step S53: Multiply the attention weights by the value matrix to obtain a context feature vector. The context vector generated by the self-attention mechanism can dynamically capture the key features in multimodal data. The context vector is input into the fully connected layer to obtain the final weighted feature representation.

[0117] Preferably, the method for intelligent identification of industrial IoT devices based on deep learning also includes optimizing feature extraction parameters and self-attention mechanism parameters using a particle swarm optimization algorithm, including convolution kernel size, number of GRU units, learning rate, etc.

[0118] Specifically, the particle swarm optimization algorithm is used to optimize the feature extraction parameters and the parameters of the self-attention mechanism, including the following steps:

[0119] Iteratively update the particle's velocity and position until the optimal solution is found;

[0120] The update rules are:

[0121] v i (t+1)=ωv i (t)+c1r1(p i -x i (t))+c2r2(gx i (t))+δ Formula (14)

[0122] x i (t+1)=x i (t)+v i (t+1) Formula (15)

[0123] Among them, v i (t) represents the velocity of particle i at time t, x i (t) represents the position of the particle, p i is the individual optimal position of the particle, g is the global optimal position, ω is the inertia weight, c1 and c2 are learning factors, r1 and r2 are random numbers;

[0124] Introduce small random perturbations to the velocities of some particles through mutation operations; improve diversity and avoid falling into local optimality:

[0125] v′ i (t+1)=v i(t+1)+δ·randn( ) Formula (16)

[0126] Among them, δ is the parameter that controls the amplitude of variation, and randn() represents a random number that obeys the standard normal distribution;

[0127] The loss function of the recognition model adopts the cross entropy loss function; it is defined as:

[0128]

[0129] Among them, y i is the true label, is the prediction result of the model;

[0130] The model parameters are updated by gradient descent through the back-propagation algorithm to minimize the loss function.

[0131] Finally, the Softmax classifier is used to classify the device traffic data into multiple categories based on the optimized features and output the device type. Specifically, the Softmax function is used for multi-category classification:

[0132]

[0133] Among them, z i is the score of the i-th category, C is the number of categories, is the predicted device category.

[0134] like Figure 5 As shown, the second aspect of the present invention discloses an intelligent identification device for industrial Internet of Things equipment based on deep learning, including:

[0135] The acquisition module 501 is used to acquire the flow data of the industrial Internet of Things device. Specifically, the original network flow data of the industrial Internet of Things device can be collected by passive bypass or active sending of inquiry data frames. The flow data includes the communication data packet, protocol information, timestamp, etc. of the device.

[0136] The conversion module 502 is used to convert the flow data into a grayscale image sequence and a one-dimensional vector sequence; by converting the flow data into a flow grayscale image sequence and a flow one-dimensional vector sequence, multi-modal equipment flow data is obtained and the input data is ensured to meet the requirements of the neural network model. This step enables the spatial and temporal characteristics of the flow data to be clearly expressed, laying the foundation for subsequent model feature extraction. It can enhance the robustness and robustness of industrial IoT device identification.

[0137] The feature extraction module 503 is used to extract the bidirectional temporal features of the grayscale image sequence and the bidirectional gated temporal features of the one-dimensional vector sequence. Specifically, the feature extraction module is a parallel bidirectional adaptive temporal convolutional network and a bidirectional gated recurrent unit.

[0138] The self-attention module 504 is used to fuse the bidirectional temporal features and the bidirectional gated time features to obtain fused features; and to perform weighted processing on the fused features to generate a context feature vector.

[0139] The classification module 505 is used to perform classification according to the context feature vector and output a device category result.

[0140] The optimization module 506 is used to optimize the feature extraction module parameters and the self-attention module parameters using a particle swarm optimization algorithm.

[0141] The invention is based on a multimodal data device identification model optimized by a bidirectional adaptive temporal convolutional network, a bidirectional gated recurrent unit, a self-attention mechanism, and a particle swarm optimization algorithm. When processing complex industrial Internet of Things device flow data, it significantly improves the accuracy of device identification, reduces model training time, and optimizes resource consumption. The model can effectively cope with the diversified device flow in the industrial Internet of Things scenario, has stronger adaptability and robustness, and has broad application prospects in the field of device intelligent identification.

[0142] Among them, the bidirectional adaptive temporal convolutional network and the bidirectional gated recurrent unit capture the spatiotemporal features of grayscale image sequences and one-dimensional vector sequences. The bidirectional adaptive temporal convolutional network is used to extract bidirectional temporal features in traffic grayscale images. The bidirectional adaptive temporal convolutional network model uses bidirectional dilated causal convolution to expand the receptive field while maintaining the integrity of the input sequence, thereby capturing long-term dependencies in traffic data and extracting more comprehensive temporal features. The bidirectional gated recurrent unit is used to extract bidirectional gated temporal features in device traffic. The bidirectional gated recurrent unit can simultaneously process the forward and backward time information of the input sequence, capture the dynamic changes of device traffic in the time series, and further enhance the comprehensive extraction of device traffic features.

[0143] Finally, by weighting the fused features through the self-attention mechanism, the key features in the multimodal data can be dynamically captured, highlighting the characteristic information at key moments in the device traffic, while weakening irrelevant or redundant features to improve the accuracy of device identification.

[0144] like Figure 6 As shown, the third aspect of the present invention further discloses an industrial Internet of Things device intelligent identification device 600 based on deep learning, Figure 6The industrial Internet of Things device intelligent identification device 600 shown includes: a processor 601 and a memory 602. The processor 601 and the memory 602 are connected, such as through a bus 603. Further, the industrial Internet of Things device intelligent identification device 600 may also include a transceiver 604. It should be noted that in actual applications, the transceiver 604 is not limited to one, and the structure of the industrial Internet of Things device intelligent identification device 600 does not constitute a limitation on the embodiments of the present application. The processor 601 is used in the embodiments of the present application to implement Figure 5 The functions of the acquisition module 501, the conversion module 502, the feature extraction module 503, the self-attention module 504, the classification module 505 and the optimization module 506 shown. The processor 601 can be a CPU, a general-purpose processor, a DSP, an ASIC, an FPGA or other programmable logic device, a transistor logic device, a hardware component or any combination thereof. It can implement or execute various exemplary logic blocks, modules and circuits described in conjunction with the disclosure of this application. The processor 601 can also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, etc.

[0145] The bus 603 may include a path to transmit information between the above components. The bus 603 may be a PCI bus or an EISA bus, etc. The bus 603 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 6 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0146] The memory 602 may be a ROM or other type of static storage device that can store static information and instructions, a RAM or other type of dynamic storage device that can store information and instructions, or an EEPROM, a CD-ROM or other optical disk storage, an optical disk storage (including a compact disc, a laser disc, an optical disc, a digital versatile disc, a Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto.

[0147] The memory 602 is used to store the application code for executing the solution of the present application, and the execution is controlled by the processor 601. The processor 601 is used to execute the application code stored in the memory 602 to implement Figure 1 The illustrated embodiment provides actions of the method for intelligent identification of industrial Internet of Things devices based on deep learning.

[0148] The above description is only a preferred embodiment of the present invention, and does not limit the patent scope of the present invention. All equivalent structural changes made by using the contents of the present invention specification and drawings under the concept of the present invention, or directly / indirectly applied in other related technical fields are included in the patent protection scope of the present invention.

Claims

1. An intelligent identification method for industrial IoT devices based on deep learning, characterized by: The steps include: Obtain traffic data from industrial IoT devices; Convert the traffic data into a grayscale image sequence and a one-dimensional vector sequence; Extracting bidirectional temporal features of the grayscale image sequence and extracting bidirectional gated temporal features of the one-dimensional vector sequence; Fusing the bidirectional time series feature and the bidirectional gated time feature to obtain a fused feature; The fused features are weighted through the self-attention mechanism to generate a context feature vector; Classification is performed according to the context feature vector, and a device category result is output.

2. The method for intelligent identification of industrial Internet of Things devices based on deep learning according to claim 1 is characterized in that: It also includes the use of particle swarm optimization algorithm to optimize feature extraction parameters and self-attention mechanism parameters.

3. The method for intelligent identification of industrial Internet of Things devices based on deep learning according to claim 1 is characterized in that: The process of converting the flow data into a grayscale image sequence and a one-dimensional vector sequence comprises the following steps: Divide the traffic data according to the session-level segmentation granularity to obtain the traffic session; Delete the MAC and IP addresses that uniquely identify the device in the traffic session and fill the original location of the data with preset characters; Determine whether the bytes of the traffic session are greater than or equal to the preset byte value. If so, truncate the traffic of the traffic session after the preset byte number to obtain the session data; if not, add the preset characters to the end of the traffic session until the bytes of the traffic session are the preset byte value to obtain the session data; Convert session data into a one-dimensional vector sequence; The session data is converted into two dimensions, and each byte is used as the data of a pixel in the grayscale image to generate a grayscale image; several grayscale images are converted into grayscale image sequences.

4. The method for intelligent identification of industrial Internet of Things devices based on deep learning according to claim 1 is characterized in that: Extracting the bidirectional temporal features of the grayscale image sequence comprises the following steps: The grayscale image sequence is bidirectionally convolved through a bidirectional adaptive temporal convolutional network to obtain forward sequence convolution results and backward sequence convolution results; Preserve the previous layer information through gated residual connections; Concatenate the forward sequence convolution result and the backward sequence convolution result, and output them as bidirectional time series features.

5. The method for intelligent identification of industrial Internet of Things devices based on deep learning according to claim 1 is characterized in that: The method for extracting the bidirectional gated time features of the one-dimensional vector sequence is: Extract features from the one-dimensional vector sequence through a bidirectional gated recurrent unit to obtain the forward sequence hidden state and the backward sequence hidden state; The forward hidden state and the backward hidden state are concatenated and output as a bidirectional gated temporal feature.

6. The method for intelligent identification of industrial Internet of Things devices based on deep learning according to claim 1 is characterized in that: Fusion of the bidirectional timing feature and the bidirectional gated time feature comprises the following steps: Converting the bidirectional time series feature into a time series feature sequence, and converting the bidirectional gated time feature into a time feature sequence; The temporal feature sequence and the time series feature are concatenated into a fusion matrix to obtain a fusion feature.

7. The method for intelligent identification of industrial Internet of Things devices based on deep learning according to claim 1 is characterized in that: Generating a context feature vector includes the following steps: Calculate the attention score of the fused features; Normalize the attention score to get the attention weight; Multiply the attention weights by the value matrix to get the context feature vector.

8. The method for intelligent identification of industrial Internet of Things devices based on deep learning according to claim 2 is characterized in that: The optimization of feature extraction parameters and self-attention mechanism parameters using particle swarm optimization algorithm includes the following steps: Iteratively update the particle's velocity and position until the optimal solution is found; Introduce random perturbations to the velocities of some particles through mutation operations; The loss function adopts the cross entropy loss function; The model parameters are updated by gradient descent through the back-propagation algorithm to minimize the loss function.

9. Intelligent identification device for industrial IoT equipment based on deep learning, characterized by: include: Acquisition module, used to obtain flow data of industrial IoT devices; A conversion module, used for converting the flow data into a grayscale image sequence and a one-dimensional vector sequence; A feature extraction module, used to extract bidirectional temporal features of the grayscale image sequence and bidirectional gated temporal features of the one-dimensional vector sequence; A self-attention module, used to fuse the bidirectional temporal features and the bidirectional gated time features to obtain a fused feature; And is used to perform weighted processing on the fused features to generate a context feature vector; The classification module is used to perform classification according to the context feature vector and output a device category result.

10. Intelligent identification device for industrial IoT equipment based on deep learning, characterized by: The method comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the method according to any one of claims 1 to 8 is implemented.

Images