BLE device identification system and method based on traffic

Abstract

The present application provides a traffic-based BLE device identification model construction system and method. The system according to the present application includes: a BLE traffic monitoring and collection module, which is used to obtain traffic data of a preset number of BLE devices, and then obtain BLE device data packets; a data processing and feature extraction module, which is used to extract features from the BLE device data packets to obtain feature data; a sample database module, which is used to label the feature data obtained by the data processing and feature extraction module, and store the labeled labels and the feature data; an AI algorithm model module, which is used to perform model training based on the labeled labels and feature data stored in the sample database module to generate a trained classification model; an AI model database module, which is used to save the classification model. The technical solution provided by the present application can be applied to the automatic identification and management of BLE devices, and has the characteristics of high identification accuracy, easy use and low cost.

Description

Technical Field

[0001] This document relates to the technical field of BLE device identification, and in particular to a traffic-based BLE device identification system and method. Background Art

[0002] The widespread use of IoT devices has brought severe challenges to device asset management and network security. With the increase in IoT devices, there are many types of IoT devices, especially WiFi devices and BLE Bluetooth devices are widely used. Device asset management has become increasingly difficult, and network administrators usually need to regularly monitor, update and maintain IoT devices in the network. Considering the large scale of IoT devices and the remote distribution of some devices, traditional manual management methods require a lot of resources. It is necessary to use technical means to automatically identify IoT devices in order to achieve the purpose of monitoring and managing IoT devices. At the same time, in order to reduce the security threats brought by IoT devices, it is crucial to identify IoT devices. This is not only an important prerequisite for ensuring the security of IoT networks, but also helps to build the first line of defense against cross-network attacks from IoT to the Internet. It also makes it easier for administrators to better understand the topological relationship between devices and realize network management automation. Summary of the invention

[0003] The embodiments of the present invention provide a traffic-based BLE device identification system and method, aiming to solve the above-mentioned problems.

[0004] According to an embodiment of the present invention, a traffic-based BLE device identification system is provided, comprising:

[0005] BLE traffic monitoring and collection module, data processing and feature extraction module, data communication module, sample database module, AI algorithm model module and AI model database module;

[0006] The BLE traffic monitoring and collection module is used to obtain traffic data of a preset number of BLE devices, and then obtain BLE device data packets;

[0007] The data processing and feature extraction module is used to extract features from the BLE device data packet to obtain feature data;

[0008] The sample database module is used to label the feature data acquired by the data processing and feature extraction module, and store the label and the feature data;

[0009] The AI ​​algorithm model module is used to perform model training based on the annotation labels and feature data stored in the sample database module to generate a trained classification model;

[0010] The AI ​​model database module is used to store the classification model.

[0011] According to an embodiment of the present invention, a flow-based BLE device identification method is provided, comprising:

[0012] The traffic data of a preset number of BLE devices is obtained through the BLE traffic monitoring and collection module, and then the BLE device data packets are obtained;

[0013] Perform feature extraction on the BLE device data packet to obtain feature data through a data processing and feature extraction module;

[0014] Labeling the feature data acquired by the data processing and feature extraction module through a sample database module, and storing the labeling and the feature data;

[0015] Performing model training based on the annotation labels and feature data stored in the sample database module through the AI ​​algorithm model module to generate a trained classification model;

[0016] The classification model is saved to the AI ​​model database module.

[0017] According to the embodiment of the present invention, based on the monitored traffic, a method for identifying and classifying BLE devices is proposed by using machine learning technology, and a prototype system for identifying BLE devices is designed. Without hardware modification or software transplantation of system equipment, the type of Bluetooth devices can be automatically identified without affecting the operation of the original business, and the automatic classification of Bluetooth devices can be realized, which is convenient for management and has high accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate one or more embodiments of this specification or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0019] Figure 1 A schematic diagram of a BLE device identification system based on traffic according to an embodiment of the present invention;

[0020] Figure 2 Flow chart of a method for identifying a BLE device based on traffic according to an embodiment of the present invention;

[0021] Figure 3 A system structure diagram of a flow-based BLE device identification system according to an embodiment of the present invention;

[0022] Figure 4 A schematic diagram of a data frame of a broadcast message according to an embodiment of the present invention;

[0023] Figure 5 A schematic diagram of a PDU header of a broadcast message according to an embodiment of the present invention;

[0024] Figure 6 A schematic diagram of real-time classification of a BLE device identification system based on traffic according to an embodiment of the present invention;

[0025] Figure 7 This is a flow chart of BLE traffic feature sample data collection according to an embodiment of the present invention;

[0026] Figure 8 The present invention is a flowchart of a real-time classification of a traffic-based BLE device identification system according to an embodiment of the present invention. DETAILED DESCRIPTION

[0027] In order to enable those skilled in the art to better understand the technical solutions in one or more embodiments of this specification, the following will be combined with the drawings in one or more embodiments of this specification to clearly and completely describe the technical solutions in one or more embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on one or more embodiments of this specification, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this document.

[0028] System Example

[0029] According to an embodiment of the present invention, a BLE device identification system based on traffic is provided. Figure 1 is a schematic diagram of a BLE device identification system based on traffic according to an embodiment of the present invention. Figure 1 As shown, the flow-based BLE device identification system of the embodiment of the present invention specifically includes:

[0030] BLE traffic monitoring and collection module 10, data processing and feature extraction module 11, data communication module 12, sample database module 13, AI algorithm model module 14 and AI model database module 15;

[0031] The BLE traffic monitoring and collection module 10 is used to obtain traffic data of a preset number of BLE devices, and then obtain BLE device data packets;

[0032] The BLE traffic monitoring and collection module 10 of the embodiment of the present invention integrates the Ubertooth tool and installs the relevant driver program to capture Bluetooth data packets through the Ubertooth tool.

[0033] The data processing and feature extraction module 11 is used to extract features from the BLE device data packet to obtain feature data;

[0034] Bluetooth low energy follows the IEEE 802.15.1 protocol and uses the master-slave mode for communication, that is, the slave continuously sends broadcast data frames to make the host aware of its presence. In the Bluetooth low energy specification, the data packet format is divided into two types: broadcast message and data message. Broadcast messages are used for device discovery, connection establishment, and transmission broadcasts, and data messages are used for adaptive frequency hopping and data transmission between devices. Figure 4 Schematic diagram of the data frame format of the broadcast message of the embodiment of the present invention; Figure 4 It can be seen that the broadcast data frame includes: "preamble", "access code", "PDU protocol processing unit" and "Cyclical Redundancy Check (CRC)" check code. Among them, "access code" is also called "access address". Figure 5 Intent of the PDU header of the broadcast message.

[0035] PDU types are shown in Table 1:

[0036] Table 1 PDU type table

[0037]

[0038] The broadcast message PDU data contains N AD Structures, each of which consists of Length, AD Type and AD Data.

[0039] Length: The length of AD Type and AD Data.

[0040] AD Type: Indicates the meaning of AD Data.

[0041] Commonly used AD Types include: format definition field 0x01 (Flags), UUID field, device name field 0x09, manufacturer custom field 0xFF, etc.

[0042] Table 2 shows the meaning of AD Type:

[0043] Table 2AD Type meaning table

[0044] AD Type meaning 0x01 Device identification (flag) 0x08 Abbreviated device name 0x09 Full device name (UTF-8) 0x0A Transmit power 0x19 Equipment appearance 0xFF Manufacturer custom data

[0045] The present invention realizes the collection of Bluetooth broadcast messages, collects a large number of BLE device messages, and selects to use ADV_IND and ADV_NONCONN_IND type broadcast packets.

[0046] The TxAdd field is 0b, indicating that the broadcast device address type is public and this MAC address is fixed and unique.

[0047] Generally, AdvData will contain "Device Name", "Flags", "Appearance", and "UUID". The device name is the name we see when searching for a device; Flags is used to identify the discovery mode and whether BR / EDR is used; Appearance is used to define the type of the product, such as keyboard, mouse, remote control, etc.; UUID is generally used to identify which attributes the device uses.

[0048] The features extracted by the present invention mainly include "public MAC address", "AdvData type", "Device Name", "Flags", "Appearance", "UUID", "TX Power Level" and other information.

[0049] Public MAC address: It is a fixed and unique device MAC address.

[0050] AdvData type: The AdvData field on the ADV_IND and ADV_NONCONN_IND payloads consists of a significant part (Significant Part) and a non-significant part (Non-Significant Part). The non-significant part is used to fill the message when necessary and is filled with 0 bytes. The significant part consists of a series of AD structures. The first byte of each AD structure indicates the length of the Data field. The first byte of the Data field indicates the type of the AD structure, and the remaining bytes are the data corresponding to the AD type.

[0051] Device Name: Surface device name, existence characteristics.

[0052] Flags: Flags AD data reflects the device's broadcast mode and protocol compatibility, indicating Limited Discoverable Mode, General Discoverable Mode, BR / EDR Not Supported, whether the Bluetooth controller layer supports both LE and BR / EDR, and whether the Bluetooth host layer supports both LE and BR / EDR.

[0053] Appearance: The AD data of the appearance type reflects the appearance of the low-power Bluetooth device that transmits the message.

[0054] Service UUID type: Service UUID AD data reflects the functions of the device and the Bluetooth SIG (Bluetooth Special Interest Group) member to which the device belongs. There are three sizes of AD data containing Service UUID, namely 16 bits, 32 bits and 128 bits. The 16-bit and 32-bit UUIDs are allocated by the Bluetooth SIG, and the 128-bit is customized by the manufacturer. Each size provides two types, one means that all services of the broadcasting device are included, and the other means that the included services are not complete. Therefore, there are six types of Service UUID type AD data.

[0055] TX Power Level transmission power level: AD data of the transmission power level type reflects the transmission power of the broadcast packet containing this data type. According to the protocol, the transmission power level AD data can be used to calculate the path loss of the received data packet, that is, the transmission power value minus the received signal strength of the received data packet is calculated. The path loss value is obviously related to the distance between the transceiver and the transceiver, so the program can select a closer device by calculating the path loss value. In the identification scenario, this type of AD data reflects the power of the Bluetooth chip RF end when the BLE device is broadcasting.

[0056] The data communication module 12 mainly supports communication interfaces such as HTTP / HTTPS, conforms to the RESTful API specification, and facilitates the independent development of the device end and the cloud platform. It also supports wired Ethernet and wireless WiFi communication.

[0057] The sample database module 13 is used to label the feature data acquired by the data processing and feature extraction module, and store the label and the feature data;

[0058] The sample database module 13 uses the MySQL database to store and update the characteristics of different BLE devices to facilitate the subsequent AI model to carry out targeted model training. In the embodiment of the present invention, the BLE device type is manually determined in advance, and the data is labeled and stored in the database.

[0059] The AI ​​algorithm model module 14 is used to perform model training based on the annotation labels and feature data stored in the sample database module to generate a trained classification model;

[0060] The extracted BLE traffic features and label information are used to normalize the features and perform PCA dimensionality reduction processing, and the SVM classifier is used for model training.

[0061] The AI ​​model database module 15 is used to store the classification model.

[0062] For different BLE devices, the models generated by the SVM classifier are saved to improve the efficiency and real-time performance of monitoring prediction.

[0063] The traffic-based BLE device identification model construction system further includes: a BLE identification and classification module, which is used to predict the BLE device based on the marked label and feature data according to the classification model to obtain the BLE device type.

[0064] Figure 3 is a system structure diagram of an embodiment of the present invention, according to Figure 3 It can be seen that the flow-based BLE device identification system of the embodiment of the present invention includes a device end and a cloud platform. The device end monitors and collects the air interface flow data of the BLE device through the BLE flow monitoring and collection device, and uploads it to the cloud platform after data processing and feature extraction. The cloud platform saves various types of BLE data into the database, and uses the machine learning algorithm to train the model and save the model. After that, the machine learning model can be used to identify and classify various types of BLE devices.

[0065] The present invention first uses the hardware board acquisition module to collect the traffic information of the device and extracts features for model training. During the operation of the device, the generated model is used to identify and classify the device according to the real-time collected BLE traffic data.

[0066] For BLE devices such as Bluetooth voice recorders, Bluetooth speakers, Bluetooth bracelets, Bluetooth headsets, Bluetooth watches, and Bluetooth oximeters, the traffic data of the devices is pre-monitored, the BLE traffic features are extracted, and the labels are saved in the database. When the sample data meets a certain number, the AI ​​model is trained and the generated model is saved in the database.

[0067] After using the samples to train the model of the corresponding device, the BLE traffic data is collected in real time, and classification prediction is performed based on this model to determine which BLE device type the current device belongs to. Figure 6 A schematic diagram of real-time classification of a traffic-based BLE device identification system according to an embodiment of the present invention.

[0068] Figure 7 This is a flow chart of BLE traffic feature sample data collection in an embodiment of the present invention; Figure 8 It can be seen that the BLE traffic feature sample data collection process is as follows:

[0069] (1) Initialize monitoring and set the Bluetooth monitoring channel.

[0070] (2) Monitor BLE traffic data, extract features such as "public MAC address", "AdvData type", "Device Name", "Flags", "Appearance", "UUID", and "TX Power Level", and upload the feature information to the cloud platform;

[0071] (3) Label the samples according to the BLE device type;

[0072] (4) Save or update the feature data into the sample database;

[0073] (5) When sufficient samples are collected, normalize the feature data and perform PCA dimensionality reduction

[0074] (6) Use the SVM algorithm to train the model and save the trained model into the model database.

[0075] Figure 8 Flow chart of real-time classification of a BLE device identification system based on traffic according to an embodiment of the present invention. Figure 8 It can be seen that the real-time classification process of BLE devices is as follows:

[0076] (1) Initialize monitoring and set the Bluetooth monitoring channel;

[0077] (2) Extract BLE traffic feature information and upload the processed feature information to the cloud platform in real time;

[0078] (3) Normalize and PCA dimension reduction of feature information data;

[0079] (4) Retrieve the corresponding type of machine learning model from the model database, and use the feature data after normalization and PCA dimensionality reduction to predict the type of the BLE device.

[0080] The flow-based BLE device identification system of the embodiment of the present invention is tested with various brands of BLE Bluetooth devices such as Bluetooth voice recorders, Bluetooth speakers, Bluetooth bracelets, Bluetooth headsets, Bluetooth watches, and Bluetooth oximeters. The present invention can automatically identify the type of Bluetooth devices, realize automatic classification of Bluetooth devices, and facilitate management. The accurate recognition rate can reach more than 97%.

[0081] By adopting the embodiments of the present invention, the following beneficial effects are achieved:

[0082] According to the embodiment of the present invention, based on the monitored traffic, a method for identifying and classifying BLE devices is proposed by using machine learning technology, and a prototype system for identifying BLE devices is designed. Without hardware modification or software transplantation of system equipment, the type of Bluetooth devices can be automatically identified without affecting the operation of the original business, and the automatic classification of Bluetooth devices can be realized, which is convenient for management and has high accuracy.

[0083] Method Embodiment

[0084] According to an embodiment of the present invention, a BLE device identification method based on traffic is provided. Figure 2 is a flow chart of a method for identifying a BLE device based on traffic according to an embodiment of the present invention. Figure 2 As shown, the flow-based BLE device identification method of the embodiment of the present invention specifically includes:

[0085] S11, obtaining traffic data of a preset number of BLE devices through a BLE traffic monitoring and collection module, and then obtaining BLE device data packets;

[0086] S12, extracting features from the BLE device data packet through a data processing and feature extraction module to obtain feature data;

[0087] S13, labeling the feature data acquired by the data processing and feature extraction module through a sample database module, and storing the label and the feature data;

[0088] S14, performing model training based on the annotation labels and feature data stored in the sample database module through the AI ​​algorithm model module to generate a trained classification model;

[0089] S15. Save the classification model to the AI ​​model database module.

[0090] The BLE device data packet includes:

[0091] Broadcast message data packets and data message data packets.

[0092] The extracting features of the BLE device data packet by the data processing and feature extraction module to obtain feature data specifically includes:

[0093] Extract characteristic data from the BLE device data, the characteristic data including: public MAC address, AdvData type, Device Name, Flags, Appearance, UUID and TX PowerLevel transmission power level.

[0094] The AI ​​algorithm model module performs model training based on the annotation labels and feature data stored in the sample database module to generate a trained classification model specifically includes:

[0095] The feature data stored in the sample database module is normalized and PCA dimension reduction processed, and a SVM classifier is used to perform model training according to the annotated labels to obtain a trained classification model.

[0096] The method for constructing a traffic-based BLE device identification model further includes: predicting the BLE device based on the marked label and feature data according to the classification model to obtain the BLE device type.

[0097] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A traffic-based BLE device identification model construction system, characterized in that include: BLE traffic monitoring and collection module, data processing and feature extraction module, data communication module, sample database module, AI algorithm model module and AI model database module; The BLE traffic monitoring and collection module is used to obtain traffic data of a preset number of BLE devices, and then obtain BLE device data packets; The data processing and feature extraction module is used to extract features from the BLE device data packet to obtain feature data; The sample database module is used to label the feature data acquired by the data processing and feature extraction module, and store the label and the feature data; The AI ​​algorithm model module is used to perform model training based on the annotation labels and feature data stored in the sample database module to generate a trained classification model; The AI ​​model database module is used to store the classification model.

2. The system according to claim 1, characterized in that The BLE device data packet includes: Broadcast message data packets and data message data packets.

3. The system according to claim 1, characterized in that The data processing and feature extraction module is specifically used for: Extract characteristic data from the BLE device data, the characteristic data including: public MAC address, AdvData type, Device Name, Flags, Appearance, UUID and TX Power Level transmission power level.

4. The system according to claim 1, characterized in that The AI ​​algorithm model module is specifically used for: The feature data stored in the sample database module is normalized and PCA dimension reduction processed, and a SVM classifier is used to perform model training according to the annotated labels to obtain a trained classification model.

5. The system according to claim 1, characterized in that The traffic-based BLE device identification model construction system further includes: a BLE identification and classification module, which is used to predict the BLE device based on the marked label and feature data according to the classification model to obtain the BLE device type.

6. A method for constructing a BLE device identification model based on traffic, characterized in that include: The traffic data of a preset number of BLE devices is obtained through the BLE traffic monitoring and collection module, and then the BLE device data packets are obtained; Perform feature extraction on the BLE device data packet to obtain feature data through a data processing and feature extraction module; Labeling the feature data acquired by the data processing and feature extraction module through a sample database module, and storing the labeling and the feature data; Performing model training based on the annotation labels and feature data stored in the sample database module through the AI ​​algorithm model module to generate a trained classification model; The classification model is saved to the AI ​​model database module.

7. The method according to claim 6, characterized in that The BLE device data packet includes: Broadcast message data packets and data message data packets.

8. The method according to claim 6, characterized in that The extracting features of the BLE device data packet by the data processing and feature extraction module to obtain feature data specifically includes: Extract characteristic data from the BLE device data, the characteristic data including: public MAC address, AdvData type, Device Name, Flags, Appearance, UUID and TX Power Level transmission power level.

9. The method according to claim 6, characterized in that The AI ​​algorithm model module performs model training based on the annotation labels and feature data stored in the sample database module to generate a trained classification model specifically includes: The feature data stored in the sample database module is normalized and PCA dimension reduction processed, and a SVM classifier is used to perform model training according to the annotated labels to obtain a trained classification model.

10. The method according to claim 6, characterized in that The method for constructing a traffic-based BLE device identification model further includes: predicting the BLE device based on the marked label and feature data according to the classification model to obtain the BLE device type.

Images