Sample imbalance-oriented Internet of Things equipment identification method and system

Abstract

The invention relates to the technical field of software engineering and artificial intelligence, in particular to a sample imbalance-oriented Internet of Things equipment identification method and system, and the method comprises the steps: carrying out the data collection and preprocessing of network traffic in an Internet of Things environment, and obtaining an initial Internet of Things equipment traffic sample; the method comprises the following steps of: obtaining a standard Internet of Things equipment traffic sample, inputting the standard Internet of Things equipment traffic sample into a generative adversarial network for training to obtain the standard Internet of Things equipment traffic sample, inputting the standard Internet of Things equipment traffic sample into a deep residual neural network and a bidirectional long-short memory-based neural network to generate equipment fingerprints, and updating neural network parameters by utilizing an optimizer based on a cross entropy loss function; and identifying the Internet of Things equipment by using the classifier. According to the method, the traffic sample is generated by using the generative adversarial network based on the network traffic, and the high-quality Internet of Things equipment fingerprint is generated by using the deep residual network and the bidirectional long and short memory neural network, so that the identification precision of the Internet of Things equipment is improved, and the identification application range of the Internet of Things equipment is expanded.

Description

Technical Field

[0001] The present invention relates to the fields of software engineering and artificial intelligence technology, and in particular to a sample imbalance-oriented Internet of Things device identification method and system. Background Art

[0002] In the IoT environment, it is not necessary to provide security protection for all IoT devices, as that would greatly increase the security protection overhead. Instead, only some specific target devices need to be protected. In order to reduce the security protection overhead of IoT devices, these target devices need to be accurately identified. Identifying IoT devices from the perspective of the network traffic generated by IoT devices is an important research method and the key to achieving security protection for target devices. Taking the above measures can effectively reduce the security protection overhead of IoT devices while protecting the security and privacy of target devices. This will provide a more reliable foundation for the development of the IoT and promote the widespread application and promotion of IoT technology.

[0003] At present, the IoT device identification methods and models proposed can be summarized into the following three categories: IoT device identification methods based on original network traffic features, IoT device identification methods based on statistical network traffic features, and IoT device identification methods based on deep network traffic features. The IoT device identification method based on original network traffic features mainly completes the identification of IoT devices through the size, direction, and protocol header information of network traffic packets. However, it is difficult to extract the original traffic feature information of network traffic, and the available information is insufficient, which leads to the need to improve the accuracy of IoT device identification. Some researchers have statistically analyzed the features in network traffic to reflect the traffic patterns and behavioral characteristics of different IoT devices, but the use of machine learning classifiers to identify IoT devices has resulted in insufficient identification accuracy. The IoT device identification method based on deep network traffic features extracts deep features in network traffic through deep learning models to better capture the differences and behavioral patterns between devices. Experimental results show that the accuracy of IoT device identification has been significantly improved.

[0004] However, in order to improve the recognition efficiency of IoT devices, some researchers have extracted fewer initial traffic features of IoT devices, resulting in insufficient recognition accuracy of IoT devices; some research works have increased the initial traffic feature information of IoT devices by statistically analyzing the feature information in the traffic of IoT devices, but only used machine learning algorithms for classification, resulting in low recognition accuracy of IoT devices. On the other hand, some predecessors used deep learning models to learn the implicit feature information in the traffic of IoT devices, improving the recognition accuracy of IoT devices, but did not take into account the problem of large differences in traffic samples generated by IoT devices, resulting in insufficient recognition accuracy of some IoT devices. Summary of the invention

[0005] To this end, the technical problem to be solved by the present invention is to overcome the problems of low recognition efficiency and insufficient recognition accuracy of IoT devices in the prior art.

[0006] In order to solve the above technical problems, the present invention provides an IoT device identification method for sample imbalance, comprising:

[0007] Collect network traffic data in IoT environments;

[0008] Preprocessing the collected network traffic data to obtain an initial IoT device traffic sample;

[0009] Inputting the initial IoT device traffic sample into a generative adversarial network based on network traffic for training, so that the target IoT device generates an IoT device traffic sample to obtain a standard IoT device traffic sample; the target IoT device is an IoT device whose sample number in the IoT device traffic sample set does not meet the preset number;

[0010] The standard IoT device traffic samples are respectively input into a deep residual neural network and a bidirectional long short-term memory neural network to learn the spatial and temporal features in the IoT device traffic and generate IoT device fingerprints;

[0011] A cross entropy loss function is obtained based on the IoT device fingerprint, and the parameters of the deep residual neural network and the bidirectional long short-term memory neural network are updated using an AdamW optimizer;

[0012] Identify IoT devices through the Softmax classifier.

[0013] In one embodiment of the present invention, the collected network traffic data is subjected to data preprocessing to obtain an initial IoT device traffic sample, specifically including:

[0014] Dividing the initial IoT device traffic sample according to the MAC address of the IoT device, so as to divide the large-volume IoT device traffic file into small-volume IoT device traffic files;

[0015] Performing feature selection on the small-volume IoT device traffic file to reduce the dimension of the IoT device traffic, and selecting payload information in the IoT device traffic as initial IoT device traffic features;

[0016] Obtain the payload data of the network data packet in the initial IoT device traffic feature, convert the payload data into decimal data for length statistics, select the payload data within a preset length range, and convert it into a gray image to obtain the initial IoT device traffic sample.

[0017] In one embodiment of the present invention, the initial IoT device traffic sample is input into a generative adversarial network based on network traffic for training, so that the target IoT device generates an IoT device traffic sample, and obtains a standard IoT device traffic sample, specifically including:

[0018] The IoT device traffic samples whose sample quantity is within the target quantity range among the initial IoT device traffic samples are taken as the real traffic sample set;

[0019] Inputting the real traffic sample set into the generative adversarial network for training;

[0020] The generative adversarial network is improved by setting a generator and a discriminator, and after a preset number of trainings, the generator is used to generate traffic samples of IoT devices;

[0021] The IoT device traffic sample is combined with the initial IoT device traffic sample to obtain the standard IoT device traffic sample.

[0022] In one embodiment of the present invention, the real traffic sample set is input into the generative adversarial network for training, specifically including:

[0023] Using a generator to randomly generate IoT device traffic samples, and inputting them into the discriminator for identification together with the real traffic sample set;

[0024] The parameters of the generator and discriminator are updated by the loss value of the discriminator and the loss value of the generator.

[0025] In one embodiment of the present invention, the generative adversarial network is improved by setting a generator and a discriminator, and after a preset number of trainings, the generator is used to generate traffic samples of IoT devices, specifically including:

[0026] For IoT devices with different sample numbers, the loss thresholds of the generator and discriminator are set separately;

[0027] When the loss values ​​of the generator and the discriminator are both less than the loss threshold, the traffic sample generated by the generator is added to the real traffic sample and input into the generator, so that the generator learns the traffic feature information of the IoT device;

[0028] After a preset number of trainings, the generator is used to generate the IoT device traffic samples.

[0029] In one embodiment of the present invention, the standard IoT device traffic samples are respectively input into a deep residual neural network and a bidirectional long short-term memory neural network to learn the spatial traffic characteristics and temporal traffic characteristics in the IoT device traffic, and generate IoT device fingerprints, specifically including:

[0030] Input the standard IoT device traffic sample into a deep residual neural network to obtain spatial traffic feature information;

[0031] Inputting the spatial traffic feature information into a bidirectional long short-term memory neural network for learning to obtain the temporal traffic features between data packets in the network traffic;

[0032] The time flow feature is input into the flattening layer of the neural network to obtain the IoT device fingerprint.

[0033] In one embodiment of the present invention, the standard IoT device traffic sample is input into a deep residual neural network to obtain spatial traffic feature information, specifically including:

[0034] Inputting the standard IoT device traffic into the first convolutional structure of the deep residual neural network to extract initial spatial traffic features from the IoT device traffic features;

[0035] The initial spatial traffic features are input into a pooling layer to reduce training parameters, and then input into a residual module to extract deep spatial traffic feature information in network traffic.

[0036] In one embodiment of the present invention, a cross entropy loss function is obtained based on the IoT device fingerprint, and the parameters of the deep residual neural network and the bidirectional long short-term memory neural network are updated using the AdamW optimizer, wherein the calculation formula of the cross entropy loss function is:

[0037]

[0038] Where N is the number of IoT devices, E(r i,k ) is the probability that the i-th traffic sample belongs to the K-th IoT device type in real life, J(r i,k ) is the probability of predicting that the i-th traffic sample belongs to the K-th IoT device type.

[0039] In one embodiment of the present invention, the IoT device is identified by a Softmax classifier, and the identification result of the IoT device is obtained by the following calculation:

[0040] Device_Result i =argmax(softmax(score i ));

[0041] Among them, score i is the similarity score of the IoT device corresponding to the ith traffic sample, softmax is the normalization function, argmax is the function that obtains the index corresponding to the maximum value, and Device_Result i Identification result of IoT device.

[0042] The present invention also provides an IoT device identification system for sample imbalance, comprising:

[0043] Traffic data collection module, used to collect network traffic data in the IoT environment;

[0044] A data preprocessing module, used to preprocess the collected network traffic data to obtain an initial IoT device traffic sample;

[0045] A data enhancement module is used to input the initial IoT device traffic sample into a generative adversarial network based on network traffic for training, so that the target IoT device generates an IoT device traffic sample to obtain a standard IoT device traffic sample; the target IoT device is an IoT device whose sample number in the IoT device traffic sample set does not meet the preset number;

[0046] A deep feature extraction and IoT device fingerprint generation module, which is used to input the standard IoT device traffic samples into a deep residual neural network and a bidirectional long short-term memory neural network, respectively, to learn the spatial features and temporal features in the IoT device traffic and generate IoT device fingerprints;

[0047] A device identification model parameter training module, used to obtain a cross entropy loss function based on the IoT device fingerprint, and to update the parameters of the deep residual neural network and the bidirectional long short-term memory neural network using an AdamW optimizer;

[0048] The IoT device identification module is used to identify IoT devices through the Softmax classifier.

[0049] The above technical solution of the present invention has the following beneficial effects compared with the prior art:

[0050] 1) In order to improve the recognition efficiency of the IoT device recognition model, the present invention studies and analyzes the network traffic generated by IoT devices. The effective load information in the network traffic can reflect the behavioral characteristics of different IoT devices. Therefore, the effective load information is used as the initial traffic feature of the IoT device to reduce the characteristic dimension of the original IoT device traffic. In addition, in order to shorten the input time of the neural network model data, the network traffic is converted into a gray image format to accelerate the input of data.

[0051] 2) In order to solve the problem of imbalanced IoT device traffic samples in IoT device traffic datasets, a generative adversarial network algorithm based on network traffic is proposed;

[0052] 3) In order to deeply mine the potential features in network traffic, first, a deep residual neural network model is used to extract the spatial features in network traffic; then, a bidirectional long short-term memory neural network model is used to extract the temporal features in network traffic; finally, the generated IoT device traffic feature matrix is ​​input into the flattening layer to generate a feature vector, and a softmax classifier is used to complete the identification of IoT devices;

[0053] 4) The present invention utilizes the proposed generative adversarial network based on network traffic to solve the problem of sample imbalance in IoT device datasets, and the proposed integrated deep learning model extracts important potential features in network traffic to improve the recognition accuracy of IoT devices.

[0054] 5) The IoT device identification method for sample imbalance proposed in the present invention is verified in two IoT device data sets of different sizes. The experimental results show that the IoT device identification method solves the problem of sample imbalance in IoT device data sets. In addition, the identification accuracy of IoT devices is improved to a certain extent. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] In order to make the content of the present invention more clearly understood, the present invention is further described in detail below according to specific embodiments of the present invention in conjunction with the accompanying drawings, wherein:

[0056] Figure 1 A flowchart of a method for identifying IoT devices with imbalanced samples provided by an embodiment of the present invention;

[0057] Figure 2 A framework diagram of a method for identifying IoT devices with imbalanced samples provided by an embodiment of the present invention;

[0058] Figure 3 A schematic diagram of collecting traffic samples of IoT devices provided by an embodiment of the present invention;

[0059] Figure 4 A data preprocessing flow chart provided for an embodiment of the present invention;

[0060] Figure 5 A schematic diagram of the payload length distribution information of the IoT Sentinel dataset provided by an embodiment of the present invention;

[0061] Figure 6 A schematic diagram of the payload length distribution information of the UNSW dataset provided by an embodiment of the present invention;

[0062] Figure 7 A schematic diagram of adjusting the data length of the network traffic data packet payload provided by an embodiment of the present invention;

[0063] Figure 8 A data enhancement flow chart provided for an embodiment of the present invention;

[0064] Fig. 9 A neural network structure diagram provided for an embodiment of the present invention;

[0065] Fig.10 A diagram showing the classification effect of a UNSW dataset device provided by an embodiment of the present invention;

[0066] Fig.11 This is a diagram showing the device classification effect of the IoT Sentinel dataset provided by an embodiment of the present invention;

[0067] Fig.12 The classification accuracy of various types of equipment on the UNSW dataset using different models provided by the embodiments of the present invention;

[0068] Fig.13 The classification recall rates of various types of equipment on the UNSW dataset for different models provided by the embodiments of the present invention;

[0069] Fig.14 The classification F1 scores of various types of equipment on the UNSW dataset for different models provided by the embodiments of the present invention;

[0070] Fig.15 The confusion matrix of the classification results of the UNSW dataset provided by the embodiment of the present invention;

[0071] Fig.16 The confusion matrix of the IoT Sentinel classification results provided by the embodiment of the present invention;

[0072] Fig.17 The F1 scores of different IoT device identification methods provided by the embodiments of the present invention classified on the UNSW dataset;

[0073] Fig.18The classification accuracy of different IoT device identification methods provided by the embodiments of the present invention on the UNSW dataset. DETAILED DESCRIPTION

[0074] The present invention is further described below in conjunction with the accompanying drawings and specific embodiments so that those skilled in the art can better understand the present invention and implement it, but the embodiments are not intended to limit the present invention.

[0075] In order to overcome the problems existing in the prior art, the present invention proposes an IoT device identification method and system for sample imbalance. First, the payload information in the IoT device traffic is selected as the initial traffic feature; then, the payload information is converted into a gray image through data preprocessing; then, a generative adversarial network algorithm based on network traffic is proposed to balance the IoT device traffic samples; the spatial and temporal features in the IoT device traffic are extracted respectively by using a deep residual neural network and a bidirectional long short-term memory neural network; finally, the IoT device identification is completed using a Softmax classifier.

[0076] Reference Figure 1 As shown, Figure 1 A flowchart of a method for identifying IoT devices with imbalanced samples provided by an embodiment of the present invention, the method comprising:

[0077] S101: Collect network traffic data in the IoT environment.

[0078] For example, in order to complete the identification of the target IoT device, the network traffic data in the IoT environment must be collected. When the collected IoT device traffic sample data reaches a certain scale, it can be used as an experimental sample and input into the trained IoT device identification model for identification. Figure 3 , which is a schematic diagram of collecting traffic samples of IoT devices.

[0079] S102: Preprocess the collected network traffic data to obtain an initial IoT device traffic sample.

[0080] In some possible implementations, step S102 specifically includes: dividing the initial IoT device traffic sample according to the MAC address of the IoT device to divide the large-volume IoT device traffic file into small-volume IoT device traffic files; performing feature selection on the small-volume IoT device traffic file to reduce the dimension of the IoT device traffic, and selecting the payload information in the IoT device traffic as the initial IoT device traffic feature; obtaining the payload data of the network data packet in the initial IoT device traffic feature, converting the payload data into decimal data for length statistics to select the payload data within a preset length range, and converting it into a gray image to obtain the initial IoT device traffic sample.

[0081] Exemplarily, step S102 mainly performs data preprocessing on the original IoT device traffic. The flowchart of data preprocessing is as follows: Figure 4 As shown in Figure 2, the data preprocessing method mainly includes three parts: traffic segmentation, feature selection and gray image generation.

[0082] Step 1, traffic segmentation: In order to extract traffic files of different devices from mixed IoT device traffic files, the present invention segments traffic of different IoT devices according to the source destination address and destination address in the IoT device traffic data packet, that is, merges IoT device traffic files with the same address, thereby segmenting IoT device traffic files that are too large in scale. Traffic segmentation can enable the IoT device recognition model to process traffic data of different IoT devices more quickly and accurately.

[0083] Step 2, feature selection: In order to improve the accuracy and efficiency of the IoT device recognition model, the present invention conducts in-depth research and analysis on the original IoT device traffic. The study found that making full use of the payload information in the IoT device traffic data packet as the initial traffic feature plays an important role in improving the recognition performance.

[0084] The specific reason is that IoT devices usually use specific protocols and application layer data formats when communicating with each other. In this process, the payload information contains recognizable patterns and data structures related to different IoT devices. By deeply analyzing this information, the communication characteristics between different IoT devices can be effectively distinguished; different IoT devices may implement communication protocols in unique ways, resulting in differences in the payload information in the IoT device traffic. Taking these differences into full consideration, the IoT device type and IoT device manufacturer information can be more accurately identified to improve the accuracy of the overall IoT device identification model; in addition, the payload information in the IoT device traffic data packet can also be used to detect whether the IoT device is under security threats and whether there are abnormal behaviors. By monitoring this information, potential security risks can be discovered in a timely manner and the security of the IoT system can be enhanced.

[0085] In general, selecting the payload information in the original IoT device traffic as the initial traffic feature for IoT device identification can improve the recognition efficiency of the IoT device identification model.

[0086] Step 3, Gray Image Conversion: After performing feature selection on IoT device traffic to extract payload data, this data cannot be directly used as the input of the deep learning model. This is because in IoT device traffic, payload data is stored in hexadecimal format. Therefore, the payload data needs to be converted to decimal format first. In addition, by observing Figure 5 and Figure 6 It can be seen that the length of the decimal format payload data in the network traffic data packet is different in different IoT device data sets. In order to ensure the input consistency of the IoT device identification model, the following steps are taken: first, the payload information data is converted into decimal format; then, according to Figure 5 and Figure 6 The payload data length in different IoT device traffic data sets is calculated, and the payload length threshold is set to λ respectively.

[0087] The payload length of different packets in IoT device traffic is analyzed as follows: Figure 7 The processing shown is as follows: when the payload data length of the data packet in the IoT device traffic is greater than λ, the payload information is trimmed; when the payload data length of the data packet in the IoT device traffic is less than a certain value a, the payload information is filled with '0'. Finally, the processed IoT device traffic with uniform payload data length is converted into a grayscale image, in which the pixel values ​​are mapped one by one to complete the grayscale image conversion. This ensures the consistency of the length of the input data of the IoT device recognition model, and provides a unified data input for accurate recognition of the IoT device model.

[0088] S103: Input the initial IoT device traffic sample into a generative adversarial network based on network traffic for training, so that the target IoT device generates an IoT device traffic sample to obtain a standard IoT device traffic sample; the target IoT device is an IoT device whose sample number in the IoT device traffic sample set does not meet the preset number.

[0089] In some possible implementations, step S103 specifically includes: taking the IoT device traffic samples whose sample quantity is within the target quantity range in the initial IoT device traffic samples as a real traffic sample set; inputting the real traffic sample set into the generative adversarial network for training; improving the generative adversarial network by setting the generator and discriminator loss value thresholds, and generating IoT device traffic samples using the generator after a preset number of trainings; merging the IoT device traffic samples with the initial IoT device traffic samples to obtain the standard IoT device traffic samples.

[0090] In some possible implementations, the real traffic sample set is input into the generative adversarial network for training, specifically including: using a generator to randomly generate IoT device traffic samples, and inputting them into a discriminator for identification at the same time as the real traffic sample set; and updating the parameters of the generator and the discriminator through the loss value of the discriminator and the loss value of the generator.

[0091] In some possible implementations, the generative adversarial network is improved by setting a generator and a discriminator, and after a preset number of trainings, the generator is used to generate IoT device traffic samples, specifically including: setting loss thresholds of the generator and the discriminator respectively for IoT devices with different sample numbers; when the loss values ​​of the generator and the discriminator are both less than the loss thresholds, adding the traffic samples generated by the generator to the real traffic samples and inputting them into the generator, so that the generator learns the traffic feature information of the IoT device; after a preset number of trainings, the generator is used to generate the IoT device traffic samples.

[0092] For example, Figure 8 The flowchart based on the generative adversarial network proposed by the present invention is shown in FIG. Step S103 is mainly divided into three steps: IoT device traffic sample screening, IoT device traffic sample generation, generative adversarial network improvement, and standard IoT device traffic sample set generation.

[0093] Step 1: IoT device traffic sample screening: The IoT device traffic samples with a relatively small number of samples in the initial IoT device traffic samples obtained after data preprocessing are respectively used as real traffic sample sets;

[0094] Step 2: Generate IoT device traffic samples: Input real IoT device traffic samples into the network traffic generative adversarial network for training. First, use the generator to randomly generate IoT device traffic samples, and input them into the discriminator for identification with real IoT device traffic samples. The discriminator is used to distinguish between real traffic samples and fake traffic samples. The parameters of the generator and discriminator are updated through the loss value of the discriminator and the loss value of the generator. The loss value of the discriminator is L D and the generator loss value L G The calculation is as follows:

[0095]

[0096] Where m is the number of samples in each batch during training, z i is the noise vector sampled from the random noise distribution of the generator, D(G(z i )) is the output of the discriminator for the data generated by the generator, x i is the number of real data samples, D(x i ) is the output of the discriminator to the data generated by the generator. The goal of the generator and discriminator model is to generate data samples that are as real as possible through continuous confrontation. That is, the generator needs to generate fake data samples that are as realistic as possible to deceive the discriminator, and the discriminator needs to learn to more accurately identify the fake data in x. The objective function V of the generative adversarial network is as follows:

[0097]

[0098] Step 3, improvement of generative adversarial network: In order to improve the authenticity of generated IoT device traffic samples, a generative adversarial network based on network traffic is proposed; first, for IoT devices with different sample numbers (i.e., devices with a small number of samples), the loss value threshold λ of the generator and the discriminator are set respectively; then, in the training process of the generative adversarial network based on network traffic, when the loss values ​​of the generator and the discriminator are both less than the threshold, the traffic samples generated by the generator are added to the real traffic samples and input into the generator, so that the generator can learn more about the traffic characteristics of these IoT devices; finally, after a certain batch of training, the generator is used to generate traffic samples for IoT devices to balance the number of samples in the data set.

[0099] Step 4: Generate a standard IoT device traffic sample set: merge the generated IoT device traffic samples with the initial IoT device traffic samples to obtain a standard IoT device traffic sample set.

[0100] S104: Input the standard IoT device traffic samples into a deep residual neural network and a bidirectional long short-term memory neural network respectively, so as to learn the spatial characteristics and temporal characteristics in the IoT device traffic and generate an IoT device fingerprint.

[0101] In some possible implementations, step S104 specifically includes: inputting the standard IoT device traffic sample into a deep residual neural network to obtain spatial traffic feature information; inputting the spatial traffic feature information into a bidirectional long short-term memory neural network for learning to obtain the temporal traffic features between data packets in the network traffic; inputting the temporal traffic features into the flattening layer of the neural network to obtain the IoT device fingerprint.

[0102] In some possible implementations, the standard IoT device traffic sample is input into a deep residual neural network to obtain spatial traffic feature information, specifically including: inputting the standard IoT device traffic into the first layer convolution structure of the deep residual neural network to extract the initial spatial traffic features in the IoT device traffic features; inputting the initial spatial traffic features into a pooling layer to reduce training parameters, and then inputting them into a residual module to extract deep spatial traffic feature information in network traffic.

[0103] Exemplarily, step S104 is specifically divided into four steps: standard IoT device traffic input, IoT device traffic spatial feature extraction, IoT device traffic temporal feature extraction, and IoT device fingerprint generation. Fig. 9 As shown, it is a neural network structure diagram proposed by the present invention, which includes a deep residual network structure and a bidirectional long short-term memory neural network structure.

[0104] Step 1: Standard IoT device traffic input: Define the standard IoT device traffic sample set as S i ∈R N ×T , where S i represents the traffic information matrix, N represents the number of data packets, and T represents the dimension of the payload data of each data packet; S i Input into the deep residual neural network.

[0105] Step 2: Extracting spatial features of IoT device traffic: First, S i Input into the first convolutional structure to extract low-level spatial features from IoT device traffic features; then, input these features into the pooling layer to reduce training parameters; then input the traffic feature information into the residual block to extract deep traffic spatial feature information from network traffic; finally, input the extracted traffic feature information into the bidirectional long short-term memory neural network model through the adaptive average pooling layer. The whole process is as follows:

[0106] y1=Relu(BN(Conv(S i )));

[0107] y2 = Maxpooling(y1);

[0108] Among them, Conv(S i ) represents the convolution operation, BN represents batch normalization, Relu represents the activation function, and Maxpooling represents the pooling operation.

[0109] y3=BasicBlock1(y2);

[0110] y4=BasicBlock2(y3);

[0111] y5 = BasicBlock3 (y4);

[0112] y6 = BasicBlock4 (y5);

[0113] y7 = AdaptiveAvgPool(y6);

[0114] Among them, BasicBlock represents the residual block structure, AdaptiveAvgPool represents the adaptive pooling layer, and the traffic feature information is input into the neural network structure based on bidirectional long short-term memory. The traffic feature information transmission methods in the residual block are:

[0115] F(y i )=Relu(BN(Conv(y i )))+Shortcut(y i );

[0116] F(y i )=Sigmod(BN(Conv(y i )));

[0117] Among them, Shortcut represents the jump structure, and Sigmod also represents the activation function.

[0118] Step 3: Extract the time series features of IoT device traffic: Extract the feature matrix information y based on the output of the deep residual network 11 Input to the bidirectional long short-term memory neural network for learning to further explore the time flow characteristics between data packets in network traffic. Suppose the input traffic feature information is x t , represents the input feature information at time t; the bidirectional long short-term memory neural network structure consists of an input gate, a forget gate, an output gate, a storage unit, and a hidden state. At time t, the forget gate f t, input gate i t and output gate o t , which is calculated as follows:

[0119] f t =σ(W f ·[h t-1 ,x t ]+b f );

[0120] i t =σ(W i ·[h t-1 ,x t ]+b i );

[0121] o t =σ(W o ·[h t-1 ,x t ]+b o );

[0122] Where W f , W i , W o and b f 、b i 、b o are the weight matrices and neural network bias values ​​of the forget gate, input gate, and output gate respectively; h t-1 represents the hidden state at time t-1; σ is the activation function.

[0123] At time t, use the forget gate value and the old unit state C at time t-1 t-1 Multiply and add the current cell state Multiply the value of the memory gate value to get the current cell state C t , calculated as follows:

[0124]

[0125]

[0126] The unimportant IoT device traffic information transmitted by the unit at the previous moment is filtered out through the forget gate, and then the important IoT device traffic information at the current moment is extracted through the input gate, and finally the output gate is used to extract the important IoT device traffic information at the current moment. t Calculate the current hidden state h t , calculated as follows:

[0127] h t =o t ×tanh(C t );

[0128] Bidirectional LSTM neural network forwards the hidden state of the LSTM neural network and the hidden state of the reverse LSTM neural network Combine to generate a new hidden state h t , calculated as follows:

[0129]

[0130] Here h t It is the traffic feature information output by the bidirectional long short-term memory neural network.

[0131] Step 4: Generate IoT device fingerprint: Obtain traffic feature matrix information h t Input into the flattened layer to get the IoT device fingerprint:

[0132] Device_fingerprint i =f(flatten(h t ));

[0133] Among them, Device_fingerprint i Fingerprinting for IoT devices.

[0134] S105: A cross entropy loss function is obtained based on the IoT device fingerprint, and the parameters of the deep residual neural network and the bidirectional long short-term memory neural network are updated using an AdamW optimizer.

[0135] In some possible implementations, a cross entropy loss function is obtained based on the IoT device fingerprint, and the parameters of the deep residual neural network and the bidirectional long short-term memory neural network are updated using an AdamW optimizer, wherein the calculation formula of the cross entropy loss function is:

[0136]

[0137] Where N is the number of IoT devices, E(r i,k ) is the probability that the i-th traffic sample belongs to the K-th IoT device type in real life, J(r i,k ) is the probability of predicting that the i-th traffic sample belongs to the K-th IoT device type.

[0138] Furthermore, J(r i,k ) is calculated as:

[0139] score i =FC2(FC1(Device_fingerprint i ));

[0140] J(ri,k )=softmax(score i ) k ;

[0141] Among them, Device_fingerprint i is the fingerprint of the IoT device corresponding to the i-th traffic sample, FC is the fully connected layer, and score i is the similarity score of the IoT device corresponding to the i-th traffic sample.

[0142] S106: Identify IoT devices through a Softmax classifier.

[0143] In some possible implementations, the IoT device is identified by a Softmax classifier, and the identification result of the IoT device is obtained by the following calculation:

[0144] Device_Result i =argmax(softmax(score i ));

[0145] Among them, score i is the similarity score of the IoT device corresponding to the ith traffic sample, softmax is the normalization function, argmax is the function that obtains the index corresponding to the maximum value, and Device_Result i Identification result of IoT device.

[0146] At this point, the model training process and IoT devices of the present invention have been calculated. It is implemented on a Windows 10 platform, with a GPU using NVIDIA GeForce GTX 1660 SUPER, a CPU using Inter Core i7-9700, and a memory size of 32GB. It is implemented using Python 3.8, tensorflow 2.10.0, and pytorch 1.11.0. During the model training process, the AdamW optimizer was used. In order to evaluate the present invention, two data sets with different traffic sample sizes were used for testing, namely, a UNSW data set with a large traffic sample size and an IoT Sentinel data set with a small traffic sample size. The reason for selecting data sets of different sizes is to verify that the proposed IoT device identification method can solve the problem of low identification accuracy of some IoT devices caused by the imbalance of sample numbers in data sets of different sizes. The number of IoT device samples in the two data sets is shown in Table 1.

[0147]

[0148]

[0149]

[0150] Table 1

[0151] This experiment mainly uses the commonly used evaluation indicators of IoT device identification to evaluate the proposed IoT device identification method and algorithm, including accuracy, precision, recall and F1 score. Accuracy is used to measure the proportion of IoT device identification model to identify correct IoT device traffic samples, that is, the number of correctly identified IoT device traffic samples divided by the total number of IoT device traffic samples; precision is used to measure how many of the predicted correct IoT device traffic samples are truly correct IoT device traffic samples; recall is used to measure the ability of IoT device identification model to truly identify correct IoT device traffic samples, that is, the proportion of truly correct IoT device traffic samples predicted as correct IoT device traffic samples; F1 score is the harmonic mean of precision and recall, which is mainly used to comprehensively consider the accuracy and comprehensiveness of IoT device identification model. The higher the F1 score of the IoT device identification model recognition result, the better the model is for IoT device identification. The formulas of each evaluation indicator are as follows:

[0152]

[0153] Among them, TP is the number of target IoT device traffic samples predicted as correct IoT device traffic samples; TN is the number of non-target IoT device traffic samples in incorrect IoT device traffic samples; FP is the number of non-target IoT device traffic samples in correct IoT device traffic samples; FN is the number of target IoT device traffic samples in incorrect IoT device traffic samples. In addition, the confusion matrix is ​​used in the experiment to evaluate the classification and recognition performance of the IoT device recognition model.

[0154] The results of the accuracy, precision, recall and F1 score values ​​of all types of IoT devices in the two datasets are shown in Table 2 (values ​​of the four indicators on the UNSW and IoT Sentinel datasets). It can be seen that the four indicators on the UNSW dataset are all above 0.973, and the four indicators on the IoT Sentinel dataset are all above 0.8125.

[0155] Accuracy Precision Recall F1_score UNSW 0.9742 0.9806 0.9687 0.9744 IoTSentinel 0.8166 0.8535 0.8360 0.8387

[0156] Table 2

[0157] Fig.10 and Fig.11The precision, recall and F1 values ​​of various devices on the UNSW and IoT Sentinel datasets are shown respectively. The following conclusions can be drawn from the observations: 1) The IoTDI-ImbS method proposed in the present invention achieves high-precision recognition of most IoT devices in the dataset, and only the recognition accuracy of some IoT devices is not high; 2) The IoTDI-ImbS method achieves an overall recognition accuracy of about 0.974, a precision of about 0.981, a recall of about 0.969, and an F1 score of about 0.974 for IoT devices in the UNSW dataset. In the UNSW dataset, the recall and F1 scores of 11 IoT devices reach above 0.98, of which only the recognition accuracy of Netatmo Welcome and TP-Link Day Night Cloud camera is around 0.940; 3) The IoTDI-ImbNT method is not very effective for IoT devices with small traffic samples. The overall recognition effect of the Sentinel dataset is good, with an accuracy of about 0.817, a precision of about 0.854, a recall of about 0.836, and an F1 score of about 0.839. The main reason for this result is that the traffic samples of most IoT devices in the IoT Sentinel dataset are still relatively small, so the traffic feature information of the IoT devices contained is insufficient. In addition, the dataset contains too many types of IoT devices, and also contains IoT devices of the same type but different models. Fig.11 It can be seen that the recognition accuracy of the IoTDI-ImbNT method for D-Link Water Sensor, D-Link Switch, D-Link Siren, D-Link Sensor and D-Link Home Hub devices is around 0.5, but the IoTDI-ImbNT method still achieves a recognition accuracy of more than 0.90 for 21 IoT devices in the IoT Sentinel dataset, and the recognition accuracy of 11 IoT devices reaches around 0.99.

[0158] To further verify that the Resnet18+BiLSTM integrated model in the IoTDI-ImbS method has better performance than other deep learning models, we used the Resnet18 model, the Resnet18+BiLSTM+AM model and our Resnet18+BiLSTM integrated model for comparison on the UNSW dataset. Fig.12 , Fig.13 and Fig.14The precision, recall and F1 scores of the three models for classifying a single IoT device on the UNSW dataset are shown below. Before the introduction of the attention mechanism and BiLSTM structure, the ResNet18 network can achieve an accuracy of more than 90% for all IoT devices in the UNSW dataset except the Netatmo Welcome device, and the recall and F1 scores also reach more than 90%. After the introduction of the BiLSTM network structure, the IoT device recognition model has an accuracy of more than 93.0% for all IoT devices in the UNSW dataset, and the recognition accuracy of most IoT devices is around 99%. The recall rate is more than 90.1%, and the F1 score is more than 92.3%. After the introduction of the BiLSTM network structure and the attention mechanism structure, the IoT device recognition model has a higher recognition accuracy for HP-Printer devices, PIX-STAR Photo-frame devices, and TP-Link Smart plug devices than the ResNet18-BiLSTM model, but is worse than the ResNet18-BiLSTM model for other IoT devices. The ResNet18-BiLSTM model is not as accurate as the ResNet18-BiLSTM model in terms of recall rate for Smart-Things devices and PIX-STAR Photo-frame devices, but is worse than the ResNet18 model and the ResNet18-BiLSTM model for other IoT devices. Finally, for Withings-Smart BabyMonitor devices and PIX-STAR The F1 score of the recognition effect of the photo-frame device is slightly inferior to the ResNet18 model and the ResNet18-BiLSTM model, but the ResNet18-BiLSTM model has better performance in the F1 score of other IoT devices. In summary, the recognition effect of the ResNet18-BiLSTM model for IoT devices on the UNSW dataset is better than that of the ResNet18 model and the ResNet18-BiLSTM model.

[0159] Fig.15 and Fig.16 The confusion matrices of fingerprint classification results of all samples in the test set of the two datasets are shown respectively. It can be seen that 1) the IoTDI-ImbS method proposed in this invention identifies 49 types of IoT devices in the dataset, that is, it has correctly classified traffic samples for all IoT devices in the dataset; 2) Fig.15It can be seen that the IoTDI-ImbS method accurately identifies the traffic of most IoT devices. Only TPLink Router Bridge LAN (Gateway) and Amazon Echo have more than 100 traffic samples identified as other IoT devices. The reasons may be: first, TPLink Router Bridge LAN (Gateway) has more IoT device traffic samples, so it contains more IoT device traffic feature information. Therefore, it is easier to contain traffic feature information similar to other IoT devices, so it is easy to be identified as other IoT devices by the IoT device recognition model. Amazon Echo devices have 132 traffic samples identified as Netatmo Welcome devices, and Netatmo Welcome devices have 242 traffic samples identified as Amazon Echo devices. The possible reason is that Amazon Echo devices are smart speakers, while NetatmoWelcome is a security camera. Some of the traffic feature information they contain is quite similar. Therefore, in the IoT device recognition process, Amazon Echo traffic samples are easily identified as Netatmo Welcome device traffic; 3) By Fig.16 It can be seen that the IoTDI-ImbS method has a good recognition effect on 26 of the 31 IoT devices in the IoT Sentinel dataset. Only D-Link Water Sensor (water sensor), D-Link Switch (smart switch), D-Link Siren (alarm), D-Link Sensor (universal sensor) and D-Link Home Hub (home central control center) have poor recognition effect. The IoTDI-ImbS method cannot accurately identify these five IoT devices. The reasons may be: first, the number of traffic samples of these five IoT devices is relatively small; more importantly, the five IoT devices D-Link Water Sensor, D-Link Switch, D-Link Siren, D-Link Sensor and D-Link Home Hub may come from the same manufacturer, so they may have similar instruction structures. Therefore, the IoTDI-ImbS method cannot correctly identify their traffic; 4) In summary, the IoTDI-ImbS method achieves high-precision recognition of traffic samples of most IoT devices in the dataset.

[0160] Fig.17 and Fig.18This is a graph of the F1 score and precision results of the IoTDI-ImbS method proposed in the present invention and other IoT device identification methods classified on the UNSW dataset. It can be seen that the present invention chooses to compare with an IoT device identification method based on a sliding window, an IoT device identification method based on encrypted traffic, an IoT device identification method based on a random forest, a behavior-based IoT device identification method, a machine learning method for IoT device identification, an IoT device identification method based on two-stage multi-classification, a method for automatically identifying IoT devices using network traffic, and an IoT device identification method based on network traffic and a lightweight convolutional neural network on the UNSW dataset. Fig.17 It shows that the F1 value of the IoTDI-ImbS method proposed in this paper is 0.974, which is higher than other IoT device identification methods. Fig.18 The accuracy of the IoTDI-ImbS method proposed in this paper is only lower than that of the IoT device identification method based on two-stage multi-classification, but the F1 score of the IoTDI-ImbS method is improved by about 0.174 compared with the IoT device identification method based on two-stage multi-classification, indicating that the IoTDI-ImbS method has higher recognition accuracy. The reason why the IoTDI-ImbS method has higher IoT device identification accuracy is: first, the IoTDI-ImbS method selects the payload data in the network traffic as the initial traffic feature of the IoT device traffic, and the payload data contains the identity information of a large number of IoT devices; in addition, the IoTDI-ImbS method uses a data enhancement module to solve the problem of data sample imbalance in the initial IoT device traffic sample set, further improving the IoT device identification accuracy; finally, the Resnet18 network and BiLSTM network are used to extract the spatial and temporal features in the IoT device traffic, respectively, to improve the accuracy of the IoT device identification model.

[0161] The present invention also provides an IoT device identification system for sample imbalance, such as Figure 2 As shown, it includes: a flow data collection module, which is used to collect network flow data in the Internet of Things environment; illustratively, the flow data collection module is mainly used to collect flow data of Internet of Things devices in the Internet of Things environment.

[0162] The data preprocessing module is used to preprocess the collected network traffic data to obtain an initial IoT device traffic sample. Exemplarily, the data preprocessing module: preprocesses the collected original IoT device traffic data; first, the original IoT device traffic data is segmented to generate a small-volume IoT device traffic file; then, feature selection is performed on the IoT device traffic, and the payload information in the IoT device traffic is used as the initial traffic feature; finally, the payload information is converted into a gray image format to generate an initial IoT device traffic sample set.

[0163] The data enhancement module is used to input the initial IoT device traffic sample into a generative adversarial network based on network traffic for training, so that the target IoT device generates IoT device traffic samples and obtains standard IoT device traffic samples; the target IoT device is an IoT device whose number of samples in the IoT device traffic sample set does not meet the preset number. Exemplarily, the data enhancement module: adds traffic samples to the IoT device traffic with a small number of traffic samples in the initial IoT device traffic data set, that is, inputs the IoT device traffic with a small number of samples into a generative adversarial network based on network traffic for training, and generates traffic samples for the IoT device; finally, the generated traffic samples are merged with the real traffic samples to generate a standard IoT device traffic sample set.

[0164] The deep feature extraction and IoT device fingerprint generation module is used to input the standard IoT device traffic samples into the deep residual neural network and the bidirectional long short-term memory neural network respectively, so as to learn the spatial features and temporal features in the IoT device traffic and generate the IoT device fingerprint. Exemplarily, the deep feature extraction and IoT device fingerprint generation module: input the standard IoT device traffic sample set into the deep residual neural network, the residual neural network is used to mine the spatial features in the traffic, and then input it into the bidirectional long short-term memory neural network structure to mine the temporal relationship between the data packet information in the traffic, and then obtain a new traffic feature matrix; finally, input it into the flattening layer to generate the IoT device fingerprint.

[0165] The device identification model parameter training module is used to obtain the cross entropy loss function based on the IoT device fingerprint, and use the AdamW optimizer to update the parameters of the deep residual neural network and the bidirectional long short-term memory neural network. The IoT device identification module is used to identify IoT devices through the Softmax classifier.

[0166] In summary, the present invention discloses a method and system for identifying IoT devices facing sample imbalance. First, data collection is performed on network traffic in an IoT environment; second, the collected network traffic data is preprocessed based on data to obtain initial IoT device traffic samples; then, the initial IoT device traffic samples are input into a generative adversarial network based on network traffic for training, and IoT device traffic samples are generated for IoT devices with a small number of samples in the IoT device traffic sample set, thereby obtaining standard IoT device traffic samples; then, the standard IoT device traffic samples are input into a deep residual neural network and a bidirectional long short-term memory neural network to learn the spatial and temporal features in IoT device traffic respectively, and generate device fingerprints; then, a cross-entropy loss function is used, and the parameters of the neural network are updated using the AdamW optimizer; finally, the IoT device is identified using the Softmax classifier. Extensive verification experiments were conducted on two general data sets with different traffic scales, and good experimental results were achieved.

[0167] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0168] The present application is described with reference to flowcharts and / or block diagrams of methods according to embodiments of the present application.

[0169] Obviously, the above embodiments are merely examples for clear explanation and are not intended to limit the implementation methods. For those skilled in the art, other different forms of changes or modifications can be made based on the above description. It is not necessary and impossible to list all the implementation methods here. The obvious changes or modifications derived from these are still within the protection scope of the invention.

Claims

1. A method for identifying IoT devices with sample imbalance, characterized in that: include: Collect network traffic data in IoT environments; Preprocessing the collected network traffic data to obtain an initial IoT device traffic sample; Inputting the initial IoT device traffic sample into a generative adversarial network based on network traffic for training, so that the target IoT device generates an IoT device traffic sample to obtain a standard IoT device traffic sample; the target IoT device is an IoT device whose sample number in the IoT device traffic sample set does not meet the preset number; The standard IoT device traffic samples are respectively input into a deep residual neural network and a bidirectional long short-term memory neural network to learn the spatial and temporal features in the IoT device traffic and generate IoT device fingerprints; A cross entropy loss function is obtained based on the IoT device fingerprint, and the parameters of the deep residual neural network and the bidirectional long short-term memory neural network are updated using an AdamW optimizer; Identify IoT devices through the Softmax classifier.

2. The method for identifying an IoT device according to claim 1, characterized in that: The collected network traffic data is preprocessed to obtain an initial IoT device traffic sample, specifically including: Dividing the initial IoT device traffic sample according to the MAC address of the IoT device, so as to divide the large-volume IoT device traffic file into small-volume IoT device traffic files; Performing feature selection on the small-volume IoT device traffic file to reduce the dimension of the IoT device traffic, and selecting payload information in the IoT device traffic as initial IoT device traffic features; Obtain the payload data of the network data packet in the initial IoT device traffic feature, convert the payload data into decimal data for length statistics, select the payload data within a preset length range, and convert it into a gray image to obtain the initial IoT device traffic sample.

3. The method for identifying an Internet of Things device according to claim 2, characterized in that: The initial IoT device traffic sample is input into a generative adversarial network based on network traffic for training, so that the target IoT device generates an IoT device traffic sample, and obtains a standard IoT device traffic sample, specifically including: The IoT device traffic samples whose sample quantity is within the target quantity range among the initial IoT device traffic samples are taken as the real traffic sample set; Inputting the real traffic sample set into the generative adversarial network for training; The generative adversarial network is improved by setting a generator and a discriminator, and after a preset number of trainings, the generator is used to generate traffic samples of IoT devices; The IoT device traffic sample is combined with the initial IoT device traffic sample to obtain the standard IoT device traffic sample.

4. The method for identifying an IoT device according to claim 3, characterized in that: Inputting the real traffic sample set into the generative adversarial network for training, specifically including: Using a generator to randomly generate IoT device traffic samples, and inputting them into the discriminator for identification together with the real traffic sample set; The parameters of the generator and discriminator are updated by the loss value of the discriminator and the loss value of the generator.

5. The method for identifying an IoT device according to claim 3, characterized in that: The generative adversarial network is improved by setting a generator and a discriminator, and after a preset number of trainings, the generator is used to generate IoT device traffic samples, specifically including: For IoT devices with different sample numbers, the loss thresholds of the generator and discriminator are set separately; When the loss values ​​of the generator and the discriminator are both less than the loss threshold, the traffic sample generated by the generator is added to the real traffic sample and input into the generator, so that the generator learns the traffic feature information of the IoT device; After a preset number of trainings, the generator is used to generate the IoT device traffic samples.

6. The method for identifying an Internet of Things device according to claim 3, characterized in that: The standard IoT device traffic samples are respectively input into the deep residual neural network and the bidirectional long short-term memory neural network to learn the spatial traffic characteristics and temporal traffic characteristics in the IoT device traffic and generate the IoT device fingerprint, which specifically includes: Input the standard IoT device traffic sample into a deep residual neural network to obtain spatial traffic feature information; Inputting the spatial traffic feature information into a bidirectional long short-term memory neural network for learning to obtain the temporal traffic features between data packets in the network traffic; The time flow feature is input into the flattening layer of the neural network to obtain the IoT device fingerprint.

7. The method for identifying an IoT device according to claim 6, characterized in that: The standard IoT device traffic sample is input into a deep residual neural network to obtain spatial traffic feature information, including: Inputting the standard IoT device traffic into the first convolutional structure of the deep residual neural network to extract initial spatial traffic features from the IoT device traffic features; The initial spatial traffic features are input into a pooling layer to reduce training parameters, and then input into a residual module to extract deep spatial traffic feature information in network traffic.

8. The method for identifying an Internet of Things device according to claim 1, characterized in that: A cross entropy loss function is obtained based on the IoT device fingerprint, and the parameters of the deep residual neural network and the bidirectional long short-term memory neural network are updated using the AdamW optimizer, wherein the calculation formula of the cross entropy loss function is: Where N is the number of IoT devices, E(r i,k ) is the probability that the i-th traffic sample belongs to the K-th IoT device type in real life, J(r i,k ) is the probability of predicting that the i-th traffic sample belongs to the K-th IoT device type.

9. The method for identifying an IoT device according to claim 1, characterized in that: The IoT devices are identified through the Softmax classifier. The identification results of the IoT devices are obtained by the following calculation: Device_Result i =argmax(softmax(score i )); Among them, score i is the similarity score of the IoT device corresponding to the ith traffic sample, softmax is the normalization function, argmax is the function that obtains the index corresponding to the maximum value, and Device_Result i Identification result of IoT device.

10. A sample imbalanced IoT device identification system, characterized in that: include: Traffic data collection module, used to collect network traffic data in the IoT environment; A data preprocessing module, used to preprocess the collected network traffic data to obtain an initial IoT device traffic sample; A data enhancement module is used to input the initial IoT device traffic sample into a generative adversarial network based on network traffic for training, so that the target IoT device generates an IoT device traffic sample to obtain a standard IoT device traffic sample; the target IoT device is an IoT device whose sample number in the IoT device traffic sample set does not meet the preset number; A deep feature extraction and IoT device fingerprint generation module, which is used to input the standard IoT device traffic samples into a deep residual neural network and a bidirectional long short-term memory neural network, respectively, to learn the spatial features and temporal features in the IoT device traffic and generate IoT device fingerprints; A device identification model parameter training module, used to obtain a cross entropy loss function based on the IoT device fingerprint, and to update the parameters of the deep residual neural network and the bidirectional long short-term memory neural network using an AdamW optimizer; The IoT device identification module is used to identify IoT devices through the Softmax classifier.

Images