Internet of Things equipment identification method and device based on two-stage feature selection

Abstract

The invention discloses an Internet of Things equipment identification method and device based on two-stage feature selection. The method comprises the following steps: extracting features of Internet of Things equipment flow data according to packet information to construct feature table data; designing a two-stage feature selection scheme; a population filtering genetic algorithm is proposed by using a population filtering mechanism, a linear fitness function is designed, and a feature subset with efficient recognition capability is selected; aggregated features are introduced to carry out deep mining and fusion on data packet information; using a multi-step neural network and a sequential attention mechanism to accurately identify table data generated by Internet of Things equipment packet level identification; according to the method, a two-stage feature selection scheme is designed for the problem that the generalization ability of the feature subsets is insufficient in the identification scene of the Internet of Things equipment, the feature subsets with high generalization ability are selected, the identification precision of packet-level equipment is improved, the efficiency of network asset management is improved, and the network security of the Internet of Things is improved.

Description

Technical Field

[0001] The present invention relates to the field of Internet of Things device identification, and more specifically, to an Internet of Things device identification method and device based on two-stage feature selection. Background Art

[0002] With the updating and iteration of science and technology in today's society, the Internet of Things has developed rapidly, opening and leading the era of the Internet of Everything. It has become an indispensable part of the new generation of information technology and is widely used in medical care, industrial manufacturing, agriculture, transportation and other fields, providing people with a more intelligent, convenient and comfortable experience in their daily lives.

[0003] The number of IoT devices around the world is growing exponentially due to the increase in market demand. According to GSMA statistics, the total number of IoT connections worldwide reached 5.2 billion in 2015 and 12 billion in 2019. It is estimated that by 2025, the number of IoT devices worldwide will reach 24.6 billion, and the number of IoT devices in China will also exceed 8 billion.

[0004] The development of the Internet of Things is moving forward in great strides. However, the increasing scale of IoT device assets has also brought many security risks. In addition, IoT sensing nodes are mostly placed in unsupervised environments. The computing power and storage resources of IoT devices are very limited. Traditional network security measures such as firewalls and antivirus software are difficult to deploy in them, making IoT devices vulnerable to network attacks. Once IoT devices with vulnerabilities are exploited by hackers, serious consequences will occur. How to solve the security vulnerabilities of IoT devices is imminent.

[0005] IoT device identification constitutes the first line of defense for IoT security. By accurately obtaining detailed information such as the type, model, and attributes of the device, it lays a solid foundation for the subsequent implementation of targeted security protection measures. This includes but is not limited to regular password changes, timely firmware upgrades, and rapid patching of known vulnerabilities, aiming to effectively reduce the incidence of security incidents. In addition, this process also greatly promotes the rational allocation of resources, ensuring that the overall performance and security of the IoT system can be comprehensively improved according to the specific needs of different heterogeneous IoT devices.

[0006] In recent years, a lot of research has been carried out at home and abroad on the identification of IoT devices. Fan et al. proposed AutoIoT, which can automatically update the model when a new type of device is inserted, and can achieve a high recognition accuracy with only a small amount of labeled data. Wang et al. proposed the IBHBA feature selection algorithm, which uses four improvement factors to expand the search range and improve the search ability, and adopts a binary mechanism to make the algorithm more suitable for feature selection in IoT device identification. Kostas et al. proposed a machine learning-based method IoTDevID to identify devices through the network data packet features of the device. Aksoy et al. proposed an automatic classification system for device features based on network traffic, SysID, which uses genetic algorithms to determine the relevant features in different protocol headers and uses machine learning algorithms to classify devices. Fan et al. proposed a model for identifying IoT and non-IoT devices, which achieves high scalability by applying a unified model to all devices, and proposed representative device selection methods and model update methods to solve the concept drift problem caused by new devices.

[0007] However, existing research on packet-level recognition has shortcomings in the following three aspects. (1) Insufficient generalization of feature subsets. The selected feature subsets are trained for specific datasets, but the performance varies greatly on different datasets. (2) Low recognition rate of package-level device identification. Insufficient information obtained from package-level device identification can lead to confusion about device behavior. (3) Deep learning has poor adaptability to tabular data. Classic deep learning models have limitations in tabular data in packet-level device recognition scenarios. Summary of the invention

[0008] In view of the above defects or improvement needs of the prior art, the present invention provides an IoT device identification method based on two-stage feature selection, the purpose of which is to effectively identify IoT devices, accurately classify the device types in the IoT device traffic, lay the foundation for the subsequent targeted security measures, and ensure the safe operation of the IoT. The IoT device identification method fully mines feature information and correlation, constructs a two-stage feature selection scheme based on the population filtering genetic algorithm, and first proposes an improved population filtering genetic algorithm (IPFGA) as the first-stage feature screening, uses aggregated features to alleviate the defect of insufficient packet-level information acquisition, and combines multi-step neural networks and sequential attention mechanisms to efficiently and accurately identify IoT device types. The above measures solve the existing problems of IoT device identification, which has a good guiding reference value.

[0009] To achieve the above object, according to one aspect of the present invention, a method for identifying IoT devices based on two-stage feature selection is provided, comprising the following steps:

[0010] Extract packet-level features from IoT device traffic data packets and construct feature table data;

[0011] A two-stage feature selection mechanism is used to select target features from the constructed feature table data to form the filtered feature table data. In the first stage of the two-stage feature selection mechanism, the fitness function and genetic operator set by the population filtering genetic algorithm are used to preliminarily screen the original features of the feature table data to screen out the features that meet the conditions. In the second stage, the features screened in the first stage are introduced into the aggregated features by feature fusion to obtain the target features.

[0012] A multi-step neural network and a sequential attention mechanism are used to classify devices based on the features in the filtered feature table data.

[0013] In an optional implementation, the original features of the feature table data are preliminarily screened using the fitness function and genetic operator set by the population filtering genetic algorithm to screen out features that meet the conditions, including:

[0014] Set the data structure of individuals and populations in the population filtering genetic algorithm;

[0015] Set the fitness function according to the classification effect index and the number of features;

[0016] Create an initial population;

[0017] Set the genetic operator and the number of iterations, perform evolution according to the set genetic operator, and select the individual with the highest fitness as the final optimal solution;

[0018] According to the value of the corresponding feature in the individual code with the highest fitness, the features that meet the conditions are obtained to form the selected feature subset.

[0019] In an optional implementation, in the second stage, the features selected in the first stage are introduced into aggregate features by feature fusion to obtain target features, including:

[0020] Calculate the sum, mean, standard deviation, maximum, minimum and kurtosis of the features screened in the first stage;

[0021] The six aggregated features are added to the feature subset consisting of the features screened out in the first stage to obtain the final feature subset.

[0022] In an optional implementation, the fitness function is set according to the classification effect index and the number of features, including setting the fitness function by a method of linearly weighting the classification effect index and the number of features, specifically:

[0023]

[0024] Among them, a∈[0,1], b=(1-a) represent the weights of the two targets respectively, F1score is the F1 score, |SelectedFea| represents the number of features in the selected feature subset, and |AllFea| represents the initial number of features.

[0025] In an optional implementation, a multi-step neural network and a sequential attention mechanism are used to classify devices based on features in the filtered feature table data, including:

[0026] A deep learning network TabNet for tabular data is pre-built. The TabNet encoder includes two modules: Attentive Transformer and Feature Transformer. The Attentive Transformer module is used for feature selection, and the Feature Transformer module is used to process the features selected by the Attentive Transformer module.

[0027] The TabNet encoder is used to perform sequential multi-step processing based on multiple steps, where each decision step takes the output of the previous decision step as input to decide which features to use, processes the selected features, and then outputs the processed feature representations, aggregating the feature representations output by each decision step into an overall decision;

[0028] Linear mapping is used to map the overall decision to the device type to obtain the IoT device identification result.

[0029] In an optional implementation, the feature selection method of the Attentive Transformer module is:

[0030] M[i]=sparsemax(P[i-1]*h i (a[i-1]))

[0031] where M[i]∈R B*D is the learnable mask matrix, B is the batch size, D is the feature dimension, and h i (.) is a trainable function, P[i-1] is the prior scale, indicating the degree to which the feature is used in the i-1th decision step, and a[i-1] represents the feature information obtained in the i-1th decision step;

[0032] The feature processing of the Feature Transformer module includes:

[0033] Use the processing function to perform feature processing on the result of feature selection of the Attentive Transformer module in the current decision step:

[0034] [d[i],a[i]]=f i (M[i]*f)

[0035] in represents the output of the ith decision step, represents the feature information obtained in the i-th decision step, which serves as the prior information for the subsequent decision steps. i Represents the processing function of the feature inside the Feature Transformer module;

[0036] By processing two shared layers and multiple feature blocks related to two decision steps, the feature processing result of the current decision step is obtained.

[0037] In an optional implementation, the method further includes:

[0038] Calculate the contribution of the output of each decision step of a sample to the final output result;

[0039] The contribution of the output of each decision step of each sample to the final result is summarized to obtain the contribution of each input to the final output.

[0040] According to two aspects of the present invention, there is provided an IoT device identification device based on two-stage feature selection, comprising:

[0041] The feature extraction module is used to extract packet-level features of IoT device traffic data packets and construct feature table data;

[0042] A two-stage feature selection module is used to select target features from the constructed feature table data using a two-stage feature selection mechanism to form the filtered feature table data. In the first stage of the two-stage feature selection mechanism, the fitness function and genetic operator set by the population filtering genetic algorithm are used to preliminarily screen the original features of the feature table data to screen out the features that meet the conditions. In the second stage, the features screened in the first stage are introduced into the aggregated features using feature fusion to obtain the target features.

[0043] The classification module is used to classify devices based on the features in the filtered feature table data using a multi-step neural network and a sequential attention mechanism.

[0044] According to three aspects of the present invention, a computer-readable storage medium is provided, on which a computer program is stored. When the program is executed by a processor, the method for identifying an Internet of Things device based on two-stage feature selection described in the first aspect is implemented.

[0045] According to four aspects of the present invention, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the method for identifying an Internet of Things device based on two-stage feature selection as described in the first aspect is implemented.

[0046] Compared with the prior art, the advantages and beneficial technical effects of the present invention are as follows:

[0047] The present invention proposes an IoT device identification method based on two-stage feature selection, performs packet-level feature extraction on IoT device traffic data packets and constructs feature table data; designs a two-stage feature selection scheme; proposes a population filtering genetic algorithm using a population filtering mechanism, designs a linear fitness function, and selects a feature subset with efficient recognition capability; introduces aggregate features to perform deep mining and fusion of data packet information; uses a multi-step neural network and a sequential attention mechanism to accurately identify the table data generated by IoT device packet-level recognition; the present invention designs a two-stage feature selection scheme to address the problem of insufficient generalization capability of feature subsets in IoT device recognition scenarios, selects feature subsets with strong generalization capability, thereby improving the accuracy of packet-level device recognition, helping to improve the efficiency of network asset management, and further improving the network security of the IoT. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0049] Figure 1 is a flow chart of an IoT device identification method based on two-stage feature selection in an embodiment of the present invention;

[0050] Figure 2 is a schematic diagram of an IoT device identification method based on two-stage feature selection in an embodiment of the present invention;

[0051] Figure 3 It is a comparison chart of the Accuracy and F1 score indicators in the present invention and the existing invention embodiments;

[0052] Figure 4 It is the hyper-parameter selection diagram of the fitness function of the present invention;

[0053] Figure 5 It is the final selected feature result diagram of the second-stage feature selection of the present invention;

[0054] Figure 6 This is a comparison chart of three different feature selection strategies of the present invention: IPFGA, GA, and no feature selection;

[0055] Figure 7 Is the present invention introduces a comparison chart of polymer features?

[0056] Figure 8 It is a comparison chart of three different classification algorithms of the present invention: TabNet, Decision Tree (DT), and Gradient Boosting Decision Tree;

[0057] Fig. 9 is the importance of each feature of the present invention;

[0058] Fig.10 It is the feature mask heat map of the three decision steps (decision steps 0, 1 and 2) of the present invention on the UNSW dataset;

[0059] Fig.11 It is the feature mask heat map of two decision steps (decision steps 3 and 4) of the present invention on the UNSW dataset;

[0060] Fig.12 It is the feature mask heat map of the three decision steps (decision steps 0, 1 and 2) of the present invention on the CIC dataset;

[0061] Fig.13 It is the feature mask heat map of the two decision steps (decision steps 3 and 4) of the present invention on the CIC dataset;

[0062] It should be noted that, in all the drawings, the triangular icons represent the experimental results of the present invention on the UNSW dataset, and the square icons represent the experimental results on the CIC dataset. DETAILED DESCRIPTION

[0063] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0064] Embodiment 1

[0065] The present invention discloses a method for identifying IoT devices based on two-stage feature selection, see Figure 1 ,include:

[0066] S1: Extract packet-level features from IoT device traffic data packets and construct feature table data;

[0067] S2: A two-stage feature selection mechanism is used to select target features from the constructed feature table data to form the filtered feature table data. In the first stage of the two-stage feature selection mechanism, the fitness function and genetic operator set by the population filtering genetic algorithm are used to preliminarily screen the original features of the feature table data to screen out the features that meet the conditions. In the second stage, the features screened in the first stage are introduced into the aggregated features by feature fusion to obtain the target features.

[0068] S3: Use multi-step neural network and sequential attention mechanism to classify devices based on the features in the filtered feature table data.

[0069] The following first explains and illustrates the technical terms and related definitions of the present invention:

[0070] Genetic Algorithm (GA): Genetic algorithm is an optimization search algorithm that simulates the biological evolution process in nature. It draws on the principles of natural selection and genetics in biological evolution, and finds the optimal solution or approximate optimal solution to the problem by simulating operations such as selection, crossover and mutation in the biological evolution process.

[0071] Individual: In genetic algorithms, an individual is a name for an object in a problem (generally the solution to the problem), representing a potential solution to the problem.

[0072] Population: In genetic algorithms, population is a key concept that represents a set of potential solutions to a problem.

[0073] Fitness function: The fitness function is a standard or indicator used to evaluate the quality of each individual in the genetic algorithm. It is determined according to the objective function of the problem and is used to distinguish between good and bad individuals in the group. The value of the fitness function is usually non-negative, and it is always hoped that the larger the better, because it represents the adaptability and survival competitiveness of the individual in the environment.

[0074] Packet-level device identification: IoT packet-level device identification analyzes the data packets transmitted by IoT devices in the network, extracts feature information that can reflect the characteristics and behaviors of the devices, and then classifies and identifies the devices.

[0075] In one embodiment, the fitness function and genetic operator set by the population filtering genetic algorithm are used to preliminarily screen the original features of the feature table data to screen out the features that meet the conditions, including:

[0076] Set the data structure of individuals and populations in the population filtering genetic algorithm;

[0077] Set the fitness function according to the classification effect index and the number of features;

[0078] Create an initial population;

[0079] Set the genetic operator and the number of iterations, perform evolution according to the set genetic operator, and select the individual with the highest fitness as the final optimal solution;

[0080] According to the value of the corresponding feature in the individual code with the highest fitness, the features that meet the conditions are obtained to form the selected feature subset.

[0081] Specifically, the population filtering genetic algorithm mainly includes individuals and populations, the classification effect indicator is the F1 score, which is the harmonic mean of precision and recall, and the number of features includes the initial number of features and the number of features in the selected feature subset. Genetic operators include selection, crossover and mutation.

[0082] In the specific implementation process, the IPFGA algorithm is designed. As the first stage of the two-stage feature selection, the original features are preliminarily screened, which can be achieved in the following ways:

[0083] (1.1) Define data structure. In the IPFGA algorithm, two data structures are mainly involved: individuals and populations. Each individual X is represented as follows:

[0084] X=(x 1 ,x 2 ,x 3 ,…,x Ndim )

[0085] Among them, x represents whether the feature corresponding to the bit is selected, and the value is 0 or 1. i Indicates whether the feature of the i-th dimension is selected, N dim Represents the feature dimension.

[0086] The population is represented as follows:

[0087]

[0088] Among them, N S represents the population size, that is, how many individuals are contained in a population. Indicates the Nth S The Nth individual dim The eigenvalue of the dimension.

[0089] (1.2) Design fitness function. In order to maximize the classification effect and minimize the number of features at the same time, a multi-objective optimization problem is formed. The fitness function is designed using the linear weighted method. The formula is as follows:

[0090]

[0091] Among them, a∈[0,1], b=(1-a) represent the weights of the two objectives respectively, |SelectedFea| represents the number of features in the selected feature subset, and |AllFea| represents the initial number of features.

[0092] (1.2) Create an initial population. In the population initialization stage, generate individuals twice the size of the population. By evaluating the fitness of each individual, select half of the individuals with the best fitness as the initial population.

[0093] (1.3) Selection. Selection is applied as a genetic operator in the IPFGA algorithm. The individuals with the top 60% fitness scores in the incoming population P′ are selected as the new generation population P″, thereby selecting the dominant individuals in the population.

[0094] (1.4) Crossover. Use each individual in P″ to exchange the specified gene fragment with the next individual, and add the crossed individuals to P″ to obtain P″′.

[0095] (1.5) Mutation. Since the randomness of mutation may lead to deviation from the optimal solution, in order to alleviate this problem, a partial mutation mechanism is adopted to retain the first 20 best individuals of the P″′ population without mutation, and the subsequent individuals are randomly mutated to obtain the population P″′.

[0096] (1.6) Iteration. According to the set number of iterations, the three steps of selection, crossover, and mutation are iterated continuously. After the iteration is completed, the individual with the highest fitness is selected. As the final optimal solution, according to The corresponding feature value in is 0 or 1 to determine whether the feature is selected, thereby obtaining the selected feature subset F. (Individual The final result is a binary string of 0101, with a length equal to the dimension of the initial feature. Assuming there are 4 features A, B, C, and D, is 0101, then the selected feature subset includes features B and D)

[0097] In one implementation, in the second stage, the features selected in the first stage are subjected to feature fusion to introduce aggregate features to obtain target features, including:

[0098] Calculate the sum, mean, standard deviation, maximum, minimum and kurtosis of the features screened in the first stage;

[0099] The six aggregated features are added to the feature subset consisting of the features screened out in the first stage to obtain the final feature subset.

[0100] Specifically, in order to alleviate the problem of insufficient device identification information at the package level, which leads to overlapping device behavior features, feature aggregation is performed based on F, and the six aggregated features are added to the selected feature subset F for secondary reconstruction to obtain the final feature subset F′

[0101] In one embodiment, the fitness function is set according to the classification effect index and the number of features, including setting the fitness function by a method of linearly weighting the classification effect index and the number of features, specifically:

[0102]

[0103] Among them, a∈[0,1], b=(1-a) represent the weights of the two objectives respectively, F1score is the F1 score, |SelextedFea| represents the number of features in the selected feature subset, and |AllFea| represents the initial number of features.

[0104] In one embodiment, a multi-step neural network and a sequential attention mechanism are used to classify devices based on features in the filtered feature table data, including:

[0105] A deep learning network TabNet for tabular data is pre-built. The TabNet encoder includes two modules: Attentive Transformer and Feature Transformer. The Attentive Transformer module is used for feature selection, and the Feature Transformer module is used to process the features selected by the Attentive Transformer module.

[0106] The TabNet encoder is used to perform sequential multi-step processing based on multiple steps, where each decision step takes the output of the previous decision step as input to decide which features to use, processes the selected features, and then outputs the processed feature representations, aggregating the feature representations output by each decision step into an overall decision;

[0107] Linear mapping is used to map the overall decision to the device type to obtain the IoT device identification result.

[0108] In one implementation, the feature selection method of the Attentive Transformer module is:

[0109] M[i]=sparsemax(P[i-1]*h i(a[i-1]))

[0110] where M[i]∈R B*D is the learnable mask matrix, B is the batch size, D is the feature dimension, and h i (.) is a trainable function, P[i-1] is the prior scale, indicating the degree to which the feature is used in the i-1th decision step, and a[i-1] represents the feature information obtained in the i-1th decision step;

[0111] The feature processing of the Feature Transformer module includes:

[0112] Use the processing function to perform feature processing on the result of feature selection of the Attentive Transformer module in the current decision step:

[0113] [d[i],a[i]]=f i (M[i]*f)

[0114] in represents the output of the ith decision step, represents the feature information obtained in the i-th decision step, which serves as the prior information for the subsequent decision steps. i Represents the processing function of the feature inside the Feature Transformer module;

[0115] By processing two shared layers and multiple feature blocks related to two decision steps, the feature processing result of the current decision step is obtained.

[0116] Specifically, multi-step neural network and sequential attention mechanism are used for device classification. TabNet is based on multi-step neural network, which consists of multiple consecutive steps (N steps ), using a sequential attention mechanism to select features. Figure 2 This is a schematic diagram of the IoT device identification method based on two-stage feature selection in an embodiment of the present invention. The device classification using a multi-step neural network and a sequential attention mechanism includes the following contents:

[0117] (3.1) TabNet receives the table data f∈R corresponding to F′ B*D Enter each decision step, where B is the batch size and D is the feature dimension. The TabNet encoder is mainly composed of two modules: Attentive Transformer and Feature Transformer, which are responsible for feature selection and feature processing respectively. TabNet encoding is based on N stepsThe i-th step inputs the information processed in the i-1th step to decide which features to use, and outputs the processed feature representation, which is aggregated into an overall decision. (Each decision step is that AttentiveTransformer performs feature selection for the current step, and then uses Feature Transformer to calculate or process the features to obtain the processed feature representation)

[0118] (3.2) Attentive Transformer feature selection module. Use a learnable mask matrix M[i]∈R B*D Used for soft selection of features. The mask is in the form of a product, i.e., M[i]*f, based on the feature information a[i-1] obtained in step i-1, and the mask is calculated using sparsemax normalization (Martins):

[0119] M[i]=sparsemax(P[i-1]*h i (a[i-1]))

[0120] in represents the value of the bth row and jth column of the mask matrix M in the i-th decision step, h i (.) is a trainable function, and P[i-1] refers to the prior scale, which indicates the extent to which the feature was used in the previous decision step.

[0121]

[0122] Where γ is a relaxation parameter. When γ = 1, a feature can only be used in one decision step. When γ > 1, a feature can be used in multiple decision steps.

[0123] (3.3) Feature Transformer feature processing module. Feature processing is performed based on the result of feature selection in the AttentiveTransformer module in the current step. First, splitting is performed:

[0124] [d[i],a[i]]=f i (M[i]*f)

[0125] in is the output of this decision step, is the prior information used for subsequent processing steps, f i Represents the processing function performed on the data within the Feature Transformer module.

[0126] The feature processing result of the current step is obtained by processing multiple feature blocks in two shared layers and two decision-step related layers.

[0127] (3.4) Decision fusion. In order to fuse the decision results of multiple steps to achieve a more comprehensive consideration, the overall decision embedding d out for:

[0128]

[0129] Finally, apply the linear mapping W final Processing holistic decision embedding out Finally, the final output (type of equipment) is obtained.

[0130] In one embodiment, the method further comprises:

[0131] Calculate the contribution of the output of each decision step of a sample to the final output result;

[0132] The contribution of the output of each decision step of each sample to the final result is summarized to obtain the contribution of each input to the final output.

[0133] Specifically, TabNet provides local interpretability as well as global interpretability. The model first provides the output vector of a step to obtain a scalar to reflect the importance of the step to the final result. For example, the contribution of the i-th decision step of the b-th sample to the final result can be expressed as:

[0134]

[0135] Among them, N d represents the feature dimension selected in the i-th decision step, d b,c [i] represents the contribution of the cth feature of the bth sample, i.e. the bth row and jth column.

[0136] The contribution of each input to the output can be obtained by summing up the feature importance masks across all steps:

[0137]

[0138] Among them, i represents the i-th decision step, b represents the b-th sample, i.e. the b-th row, j represents the j-th feature, i.e. the j-th column, and D represents the initial feature dimension of the input TabNet.

[0139] In the classification task, TabNet uses cross entropy loss as the loss function, the formula is as follows:

[0140]

[0141] Where N is the number of samples; C is the number of device categories; y i,c is a binary indicator (0 or 1), if the true category of the i-th sample is c, then yi,c =1, otherwise 0; p i,c is the probability that the i-th sample is predicted to be class c.

[0142] In general, the above technical solution conceived by the present invention has the following beneficial effects compared with the prior art:

[0143] (1) The feature subset has strong generalization ability. The IoT device recognition model of the present invention uses an improved algorithm to efficiently screen features on a small data set. These features have strong generalization ability on new large-scale data sets, ensuring that the model can stably identify IoT devices in different network environments and improve recognition accuracy.

[0144] (2) High detection accuracy: The TabNet deep learning model and multi-step neural network are used to deeply explore feature correlations, achieve high-precision packet-level device identification, effectively avoid false positives and false negatives, and provide network administrators with a fast and accurate identification method.

[0145] (3) Strong adaptability and easy deployment: The model can flexibly adapt to different IoT devices and network environments without the need for additional modification. It is simple and quick to deploy, reducing deployment costs and time. It has broad application prospects and high market value.

[0146] In order to more clearly demonstrate the effect of the method provided by the present invention, the following examples are provided with experimental data. Figure 3 to Figure 11 .

[0147] in, Figure 3 The results of comparative experiments are shown. It can be seen from the experimental results that the Accuracy and F1 score performance indicators of the present invention on two data sets are higher than those of all other comparative models, which proves the effectiveness of the present invention. This is because the present invention designs a two-stage feature selection strategy, deeply explores the potential correlation between features, and uses a multi-step neural network to comprehensively consider multiple feature combinations for classification.

[0148] Figure 4 The result diagram of the hyperparameter experiment of the present invention is shown, and the combination with the highest F1 score a=0.8, b=0.2 is selected.

[0149] Figure 5 The figure shows the selected feature results and their explanation diagram when the parameters of the fitness function are selected as a=0.8 and b=0.2.

[0150] Figure 6 The effectiveness of the IPFGA algorithm is verified. According to the experimental results, it can be seen that the IPFGA feature selection algorithm is better than the other two feature selection strategies on the UNSW and CIC datasets.

[0151] Figure 7 The effectiveness of the aggregation features is verified. According to the experimental results, after the introduction of aggregation features, the two evaluation indicators on the two data sets are improved to varying degrees.

[0152] Figure 8 Verified the effectiveness of the classification algorithm,According to the experimental results, it can be seen that TabNet is better than the other two classification algorithms in both evaluation indicators on the two data sets.

[0153] Fig. 9 This is a schematic diagram of the importance of each feature of the present invention. The feature names are shown in Figure 5 The six aggregation features are the sum of the features, mean, standard deviation, maximum, minimum, and kurt.

[0154] Fig.10 and Fig.11 It is the feature mask heat map of the five decision steps of the present invention on the UNSW dataset, FeatureIndex represents the feature index, Mask Value represents the mask matrix value, and Mask Step represents the decision step.

[0155] Fig.12 and Fig.13 It is the feature mask heat map of the five decision steps of the present invention on the CIC dataset, FeatureIndex represents the feature index, Mask Value represents the mask matrix value, and Mask Step represents the decision step.

[0156] Embodiment 2

[0157] Based on the same inventive concept, this embodiment discloses an IoT device identification device based on two-stage feature selection, including:

[0158] The feature extraction module is used to extract packet-level features of IoT device traffic data packets and construct feature table data;

[0159] A two-stage feature selection module is used to select target features from the constructed feature table data using a two-stage feature selection mechanism to form the filtered feature table data. In the first stage of the two-stage feature selection mechanism, the fitness function and genetic operator set by the population filtering genetic algorithm are used to preliminarily screen the original features of the feature table data to screen out the features that meet the conditions. In the second stage, the features screened in the first stage are introduced into the aggregated features using feature fusion to obtain the target features.

[0160] The classification module is used to classify devices based on the features in the filtered feature table data using a multi-step neural network and a sequential attention mechanism.

[0161] Since the device introduced in the second embodiment of the present invention is a device used to implement the method for identifying IoT devices based on two-stage feature selection in the first embodiment of the present invention, those skilled in the art can understand the specific structure and deformation of the device based on the method introduced in the first embodiment of the present invention, so it is not repeated here. All devices used in the method in the first embodiment of the present invention belong to the scope of protection of the present invention.

[0162] Embodiment 3

[0163] Based on the same inventive concept, the present invention further provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the method described in the first embodiment is implemented.

[0164] Since the computer-readable storage medium introduced in the third embodiment of the present invention is the computer-readable storage medium used to implement the method for identifying IoT devices based on two-stage feature selection in the first embodiment of the present invention, based on the method introduced in the first embodiment of the present invention, those skilled in the art can understand the specific structure and deformation of the computer-readable storage medium, so it is not repeated here. All computer-readable storage media used in the method of the first embodiment of the present invention belong to the scope of protection of the present invention.

[0165] Embodiment 4

[0166] The present invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method described in Embodiment 1 when executing the program.

[0167] Since the computer device introduced in the fourth embodiment of the present invention is a computer device used to implement the method for identifying IoT devices based on two-stage feature selection in the first embodiment of the present invention, those skilled in the art can understand the specific structure and deformation of the computer device based on the method introduced in the first embodiment of the present invention, so it is not repeated here. All computer devices used in the method of the first embodiment of the present invention belong to the scope of protection of the present invention.

[0168] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0169] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0170] Although preferred embodiments of the present invention have been described, additional changes and modifications may be made to these embodiments by those skilled in the art once the basic creative concepts are known. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention. Obviously, those skilled in the art may make various changes and modifications to the embodiments of the present invention without departing from the spirit and scope of the embodiments of the present invention. Thus, if these modifications and variations of the embodiments of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A method for identifying IoT devices based on two-stage feature selection, characterized in that: include: Extract packet-level features from IoT device traffic data packets and construct feature table data; A two-stage feature selection mechanism is used to select target features from the constructed feature table data to form the filtered feature table data. In the first stage of the two-stage feature selection mechanism, the fitness function and genetic operator set by the population filtering genetic algorithm are used to preliminarily screen the original features of the feature table data to screen out the features that meet the conditions. In the second stage, the features screened in the first stage are introduced into the aggregated features by feature fusion to obtain the target features. A multi-step neural network and a sequential attention mechanism are used to classify devices based on the features in the filtered feature table data.

2. The method for identifying IoT devices based on two-stage feature selection according to claim 1, characterized in that: The fitness function and genetic operator set by the population filtering genetic algorithm are used to preliminarily screen the original features of the feature table data, and the features that meet the conditions are screened out, including: Set the data structure of individuals and populations in the population filtering genetic algorithm; Set the fitness function according to the classification effect index and the number of features; Create an initial population; Set the genetic operator and the number of iterations, perform evolution according to the set genetic operator, and select the individual with the highest fitness as the final optimal solution; According to the value of the corresponding feature in the individual code with the highest fitness, the features that meet the conditions are obtained to form the selected feature subset.

3. The method for identifying IoT devices based on two-stage feature selection as claimed in claim 1, characterized in that: In the second stage, the features selected in the first stage are fused to introduce aggregate features to obtain target features, including: Calculate the sum, mean, standard deviation, maximum, minimum and kurtosis of the features screened in the first stage; The six aggregated features are added to the feature subset consisting of the features screened out in the first stage to obtain the final feature subset.

4. The method for identifying IoT devices based on two-stage feature selection as claimed in claim 2, characterized in that: The fitness function is set according to the classification effect index and the number of features, including setting the fitness function by a method of linearly weighting the classification effect index and the number of features, specifically: Among them, a∈[0,1], b=(1-a) represent the weights of the two targets respectively, F1score is the F1 score, |SelectedFea| represents the number of features in the selected feature subset, and |AllFea| represents the initial number of features.

5. The method for identifying IoT devices based on two-stage feature selection according to claim 1, characterized in that: Use multi-step neural networks and sequential attention mechanisms to classify devices based on the features in the filtered feature table data, including: A deep learning network TabNet for tabular data is pre-built. The TabNet encoder includes two modules: Attentive Transformer and Feature Transformer. The Attentive Transformer module is used for feature selection, and the Feature Transformer module is used to process the features selected by the Attentive Transformer module. The TabNet encoder is used to perform sequential multi-step processing based on multiple steps, where each decision step takes the output of the previous decision step as input to decide which features to use, processes the selected features, and then outputs the processed feature representations, aggregating the feature representations output by each decision step into an overall decision; Linear mapping is used to map the overall decision to the device type to obtain the IoT device identification result.

6. The method for identifying IoT devices based on two-stage feature selection as claimed in claim 5, characterized in that: The feature selection method of the Attentive Transformer module is: M[i]=sparsemax(P[i-1]*h i (a[i-1])) where M[i]∈R B*D is the learnable mask matrix, B is the batch size, D is the feature dimension, and h i (.) is a trainable function, P[i-1] is the prior scale, indicating the degree to which the feature is used in the i-1th decision step, and a[i-1] represents the feature information obtained in the i-1th decision step; The feature processing of the Feature Transformer module includes: Use the processing function to perform feature processing on the result of feature selection of the Attentive Transformer module in the current decision step: [d[i],a[i]]=f i (M[i]*f) in represents the output of the ith decision step, represents the feature information obtained in the i-th decision step, which serves as the prior information for the subsequent decision steps. i Represents the processing function of the feature inside the Feature Transformer module; By processing two shared layers and multiple feature blocks related to two decision steps, the feature processing result of the current decision step is obtained.

7. The method for identifying IoT devices based on two-stage feature selection according to claim 1, characterized in that: The method further comprises: Calculate the contribution of the output of each decision step of a sample to the final output result; The contribution of the output of each decision step of each sample to the final result is summarized to obtain the contribution of each input to the final output.

8. An IoT device identification device based on two-stage feature selection, characterized in that: include: The feature extraction module is used to extract packet-level features of IoT device traffic data packets and construct feature table data; A two-stage feature selection module is used to select target features from the constructed feature table data using a two-stage feature selection mechanism to form the filtered feature table data. In the first stage of the two-stage feature selection mechanism, the fitness function and genetic operator set by the population filtering genetic algorithm are used to preliminarily screen the original features of the feature table data to screen out the features that meet the conditions. In the second stage, the features screened in the first stage are introduced into the aggregated features using feature fusion to obtain the target features. The classification module is used to classify devices based on the features in the filtered feature table data using a multi-step neural network and a sequential attention mechanism.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method for identifying an Internet of Things device based on two-stage feature selection as described in any one of claims 1 to 7 is implemented.

10. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the method for identifying an Internet of Things device based on two-stage feature selection as described in any one of claims 1 to 7 is implemented.

Images