A method and device for identifying IoT devices based on two-stage feature selection

Abstract

The application discloses a kind of based on two-stage feature selection's internet of things equipment identification method and device, wherein the method will internet of things equipment flow data according to packet information extraction feature Construction feature table data;Design two-stage feature selection scheme;Population filtering mechanism is used to propose population filtering genetic algorithm, design linear fitness function, select the feature subset with high efficient identification ability;Introduce aggregate feature to carry out depth mining and fusion to packet information;Multi-step neural network and sequential attention mechanism are used to accurately identify the table data generated by internet of things equipment packet level identification;The application designs two-stage feature selection scheme for the problem of insufficient generalization ability of feature subset in the internet of things equipment identification scene, selects the feature subset with strong generalization ability, improves packet level equipment identification precision, helps to improve the efficiency of network asset management, and then improves the network security of internet of things.

Description

Technical Field

[0001] The present invention relates to the field of IoT device identification, and more specifically, to an IoT device identification method and apparatus based on two-stage feature selection. Background Art

[0002] With the updating and iteration of science and technology in today's society, the Internet of Things has developed rapidly, opening and leading the era of the Internet of Everything and becoming an indispensable part of the new generation of information technology. It has been widely used in medical care, industrial manufacturing, agriculture, transportation and other fields, providing people with a more intelligent, convenient and comfortable experience in their daily lives.

[0003] The number of IoT devices worldwide is growing exponentially due to increasing market demand. According to GSMA data, the total number of IoT connections reached 5.2 billion in 2015 and 12 billion in 2019. It is projected that by 2025, the number of connected IoT devices worldwide will reach 24.6 billion, with the number of IoT devices in China also expected to exceed 8 billion.

[0004] The Internet of Things (IoT) is developing at a rapid pace. However, the growing scale of IoT device assets also presents numerous security risks. Furthermore, IoT sensor nodes are often deployed in unsupervised environments. IoT devices have very limited computing power and storage resources, making them difficult to deploy with traditional network security measures such as firewalls and antivirus software. This makes IoT devices vulnerable to cyberattacks. Once vulnerable IoT devices are exploited by hackers, serious consequences can result. Addressing the security vulnerabilities of IoT devices is an urgent matter.

[0005] IoT device identification constitutes the first line of defense for IoT security. By accurately capturing detailed information such as device type, model, and attributes, it lays a solid foundation for the subsequent implementation of targeted security measures. This includes, but is not limited to, regular password changes, timely firmware upgrades, and prompt patching of known vulnerabilities, effectively reducing the incidence of security incidents. Furthermore, this process greatly facilitates the rational allocation of resources, ensuring that they are tailored to the specific needs of diverse and heterogeneous IoT devices, thereby comprehensively improving the overall performance and security of the IoT system.

[0006] In recent years, a large amount of research has been conducted both domestically and internationally on IoT device identification. Fan et al. proposed AutoIoT, which can automatically update the model when a new type of device is inserted and can achieve high recognition accuracy with only a small amount of labeled data. Wang et al. proposed the IBHBA feature selection algorithm, which uses four improvement factors to expand the search range and improve search capabilities, and adopts a binary mechanism to make the algorithm more suitable for feature selection in IoT device identification. Kostas et al. proposed a machine learning-based method, IoTDevID, which identifies devices based on their network packet features. Aksoy et al. proposed SysID, an automatic device feature classification system based on network traffic, which uses a genetic algorithm to determine relevant features in different protocol headers and uses a machine learning algorithm to classify devices. Fan et al. proposed a model for identifying IoT and non-IoT devices. By applying a unified model to all devices, it achieves high scalability and proposes representative device selection methods and model update methods to address the concept drift problem caused by new devices.

[0007] However, existing research on packet-level recognition has shortcomings in the following three aspects. (1) Insufficient generalization of feature subsets. The selected feature subsets are trained for specific datasets, but the performance varies greatly on different datasets. (2) Low recognition rate of package-level device identification. Insufficient information obtained from package-level device recognition can lead to confusion about device behavior. (3) Deep learning has poor adaptability to tabular data. Classic deep learning models have limitations in tabular data in packet-level device recognition scenarios. Summary of the Invention

[0008] In response to the above defects or improvement needs of the existing technology, the present invention provides an Internet of Things device identification method based on two-stage feature selection, the purpose of which is to effectively identify Internet of Things devices, accurately classify the device types in the traffic of Internet of Things devices, lay the foundation for the subsequent targeted security measures, and ensure the safe operation of the Internet of Things. This Internet of Things device identification method fully mines feature information and correlation, constructs a two-stage feature selection scheme based on the population filtering genetic algorithm, and first proposes an improved population filtering genetic algorithm (IPFGA) as the first stage feature screening, uses aggregated features to alleviate the defect of insufficient packet-level information acquisition, and combines multi-step neural networks and sequential attention mechanisms to efficiently and accurately identify the type of Internet of Things devices. The above measures solve the existing problems of Internet of Things device identification and have good guiding reference value.

[0009] To achieve the above object, according to one aspect of the present invention, a method for identifying IoT devices based on two-stage feature selection is provided, comprising the following steps:

[0010] Extract packet-level features from IoT device traffic data packets and construct feature table data;

[0011] A two-stage feature selection mechanism is used to select target features from the constructed feature table data to form the filtered feature table data. In the first stage of the two-stage feature selection mechanism, the fitness function and genetic operator set by the population filtering genetic algorithm are used to preliminarily screen the original features of the feature table data to select features that meet the conditions. In the second stage, the features selected in the first stage are subjected to feature fusion to introduce aggregate features to obtain the target features.

[0012] A multi-step neural network and a sequential attention mechanism are used to classify devices based on the features in the filtered feature table data.

[0013] In an optional embodiment, the fitness function and genetic operator set by the population filtering genetic algorithm are used to preliminarily screen the original features of the feature table data to select the features that meet the conditions, including:

[0014] Set the data structure of individuals and populations in the population filtering genetic algorithm;

[0015] Set the fitness function according to the classification effect index and the number of features;

[0016] Create an initial population;

[0017] Set the genetic operator and the number of iterations, perform evolution according to the set genetic operator, and select the individual with the highest fitness as the final optimal solution;

[0018] According to the value of the corresponding feature in the individual code with the highest fitness, the features that meet the conditions are obtained to form the selected feature subset.

[0019] In an optional embodiment, the second stage uses feature fusion to introduce aggregate features into the features screened in the first stage to obtain target features, including:

[0020] Calculate the six aggregate features of the sum, mean, standard deviation, maximum, minimum and kurtosis of the features screened in the first stage;

[0021] The six aggregated features are added to the feature subset consisting of the features screened out in the first stage to obtain the final feature subset.

[0022] In an optional embodiment, the fitness function is set according to the classification effect index and the number of features, including setting the fitness function by a method of linearly weighting the classification effect index and the number of features, specifically:

[0023]

[0024] Among them, a∈[0,1], b=(1-a) represent the weights of the two targets respectively, F1score is the F1 score, |SelectedFea| represents the number of features in the selected feature subset, and |AllFea| represents the initial number of features.

[0025] In an optional embodiment, a multi-step neural network and a sequential attention mechanism are used to classify devices based on features in the filtered feature table data, including:

[0026] A deep learning network called TabNet is pre-built for tabular data. The TabNet encoder consists of two modules: Attentive Transformer and Feature Transformer. The Attentive Transformer module is used for feature selection, and the Feature Transformer module is used to process the features selected by the Attentive Transformer module.

[0027] The TabNet encoder is used for sequential multi-step processing based on multiple steps, where each decision step takes the output of the previous decision step as input to decide which features to use, processes the selected features, and then outputs the processed feature representations. The feature representations output by each decision step are aggregated into the overall decision;

[0028] Linear mapping is used to map the overall decision to the device type to obtain the IoT device identification result.

[0029] In an optional implementation, the feature selection method of the Attentive Transformer module is:

[0030] M[i]=sparsemax(P[i-1]*h i (a[i-1]))

[0031] where M[i]∈R B*D is the learnable mask matrix, B is the batch size, D is the feature dimension, h i (.) is a trainable function, P[i-1] is the prior scale, which indicates the degree to which the feature is used in the i-1th decision step, and a[i-1] indicates the feature information obtained in the i-1th decision step;

[0032] The Feature Transformer module processes features including:

[0033] Use the processing function to perform feature processing on the result of feature selection of the Attentive Transformer module in the current decision step:

[0034] [d[i],a[i]]=f i (M[i]*f)

[0035] in represents the output of the i-th decision step, represents the feature information obtained in the i-th decision step, which serves as the prior information for subsequent decision steps. i Represents the processing function of features inside the Feature Transformer module;

[0036] The feature processing result of the current decision step is obtained by processing two shared layers and multiple feature blocks related to the two decision steps.

[0037] In an optional embodiment, the method further includes:

[0038] Calculate the contribution of the output of each decision step of a sample to the final output result;

[0039] The contribution of the output of each decision step of each sample to the final result is summarized to obtain the contribution of each input to the final output.

[0040] According to two aspects of the present invention, there is provided an IoT device identification apparatus based on two-stage feature selection, comprising:

[0041] Feature extraction module, used to extract packet-level features from IoT device traffic data packets and construct feature table data;

[0042] The two-stage feature selection module is used to select target features from the constructed feature table data using a two-stage feature selection mechanism to form the filtered feature table data. In the first stage of the two-stage feature selection mechanism, the fitness function and genetic operator set by the population filtering genetic algorithm are used to preliminarily screen the original features of the feature table data to select features that meet the conditions. In the second stage, the features selected in the first stage are subjected to feature fusion to introduce aggregated features to obtain the target features.

[0043] The classification module is used to classify devices based on the features in the filtered feature table data using a multi-step neural network and a sequential attention mechanism.

[0044] According to three aspects of the present invention, a computer-readable storage medium is provided, on which a computer program is stored. When the program is executed by a processor, the method for identifying an Internet of Things device based on two-stage feature selection described in the first aspect is implemented.

[0045] According to four aspects of the present invention, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, the method for identifying an Internet of Things device based on two-stage feature selection as described in the first aspect is implemented.

[0046] Compared with the prior art, the advantages and beneficial technical effects of the present invention are as follows:

[0047] The present invention proposes an Internet of Things device identification method based on two-stage feature selection, which extracts packet-level features of Internet of Things device traffic data packets and constructs feature table data; designs a two-stage feature selection scheme; proposes a population filtering genetic algorithm using a population filtering mechanism, designs a linear fitness function, and selects a feature subset with efficient recognition capability; introduces aggregate features to perform deep mining and fusion of data packet information; adopts a multi-step neural network and a sequential attention mechanism to accurately identify the table data generated by packet-level recognition of Internet of Things devices; the present invention designs a two-stage feature selection scheme to address the problem of insufficient generalization capability of feature subsets in Internet of Things device identification scenarios, selects feature subsets with strong generalization capability, thereby improving the accuracy of packet-level device recognition, helping to improve the efficiency of network asset management, and further improving the network security of the Internet of Things. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0049] Figure 1 This is a flow chart of a method for identifying IoT devices based on two-stage feature selection in an embodiment of the present invention;

[0050] Figure 2 This is a schematic diagram of a method for identifying IoT devices based on two-stage feature selection in an embodiment of the present invention;

[0051] Figure 3 This is a comparison chart of the Accuracy and F1 score indicators of the present invention and the existing invention embodiments;

[0052] Figure 4 It is the hyper-parameter selection diagram of the fitness function of the present invention;

[0053] Figure 5 This is the final selected feature result diagram of the second stage feature selection of the present invention;

[0054] Figure 6 This is a comparison chart of three different feature selection strategies: IPFGA, GA, and no feature selection;

[0055] Figure 7 Is the present invention introduced into the polymerization characteristics comparison chart;

[0056] Figure 8 This is a comparison chart of three different classification algorithms of the present invention: TabNet, Decision Tree (DT), and Gradient Boosting Decision Tree;

[0057] Figure 9 is the importance of each feature of the present invention;

[0058] Figure 10 is the feature mask heat map of the three decision steps (decision steps 0, 1 and 2) of the present invention on the UNSW dataset;

[0059] Figure 11 It is the feature mask heat map of the two decision steps (decision steps 3 and 4) of the present invention on the UNSW dataset;

[0060] Figure 12 It is the feature mask heat map of the three decision steps (decision steps 0, 1 and 2) of the present invention on the CIC dataset;

[0061] Figure 13 It is the feature mask heat map of the two decision steps (decision steps 3 and 4) of the present invention on the CIC dataset;

[0062] It should be noted that, in all the drawings, the triangular icons represent the experimental results of the present invention on the UNSW dataset, and the square icons represent the experimental results on the CIC dataset. DETAILED DESCRIPTION

[0063] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0064] Example 1

[0065] This invention discloses a method for identifying IoT devices based on two-stage feature selection. Figure 1 ,include:

[0066] S1: Extract packet-level features from IoT device traffic data packets and construct feature table data;

[0067] S2: A two-stage feature selection mechanism is used to select target features from the constructed feature table data to form the filtered feature table data. In the first stage of the two-stage feature selection mechanism, the fitness function and genetic operator set by the population filtering genetic algorithm are used to preliminarily screen the original features of the feature table data to select features that meet the conditions. In the second stage, the features selected in the first stage are subjected to feature fusion to introduce aggregated features to obtain the target features.

[0068] S3: Use multi-step neural networks and sequential attention mechanisms to classify devices based on the features in the filtered feature table data.

[0069] The following first explains and illustrates the technical terms and related definitions of the present invention:

[0070] Genetic Algorithm (GA): Genetic algorithm is an optimization search algorithm that simulates the biological evolution process in nature. It draws on the principles of natural selection and genetics in biological evolution, and finds the optimal solution or approximate optimal solution to the problem by simulating operations such as selection, crossover and mutation in the biological evolution process.

[0071] Individual: In genetic algorithms, individual is a name for the object in the problem (generally the solution to the problem), representing a potential solution to the problem.

[0072] Population: In genetic algorithms, population is a key concept that represents a set of potential solutions to a problem.

[0073] Fitness Function: A fitness function is a metric or indicator used to evaluate the performance of each individual in a genetic algorithm. It is determined based on the problem's objective function and is used to distinguish between good and bad individuals within a population. The value of a fitness function is typically non-negative, and a larger value is desirable, as it represents an individual's ability to adapt to and survive in the environment.

[0074] Packet-level device identification: IoT packet-level device identification analyzes the data packets transmitted by IoT devices in the network, extracts characteristic information that can reflect the characteristics and behavior of the devices, and then classifies and identifies the devices.

[0075] In one embodiment, the fitness function and genetic operator set by the population filtering genetic algorithm are used to preliminarily screen the original features of the feature table data to select the features that meet the conditions, including:

[0076] Set the data structure of individuals and populations in the population filtering genetic algorithm;

[0077] Set the fitness function according to the classification effect index and the number of features;

[0078] Create an initial population;

[0079] Set the genetic operator and the number of iterations, perform evolution according to the set genetic operator, and select the individual with the highest fitness as the final optimal solution;

[0080] According to the value of the corresponding feature in the individual code with the highest fitness, the features that meet the conditions are obtained to form the selected feature subset.

[0081] Specifically, the population filtering genetic algorithm mainly includes individuals and populations. The classification performance indicator is the F1 score, which is the harmonic mean of precision and recall. The number of features includes the initial number of features and the number of features in the selected feature subset. Genetic operators include selection, crossover, and mutation.

[0082] During the specific implementation, the IPFGA algorithm is designed. As the first stage of the two-stage feature selection, the original features are preliminarily screened. This can be achieved by the following methods:

[0083] (1.1) Define the data structure. In the IPFGA algorithm, two data structures are mainly involved: individuals and populations. Each individual X is represented as follows:

[0084] X=(x1,x2,x3,…,x Ndim )

[0085] Among them, x represents whether the feature corresponding to the bit is selected, and the value is 0 or 1. i Indicates whether the feature of the i-th dimension is selected, N dim Represents the feature dimension.

[0086] The population is represented as follows:

[0087]

[0088] Among them, N S Indicates the population size, that is, how many individuals are contained in a population. Indicates the Nth S The Nth individual dim The eigenvalue of the dimension.

[0089] (1.2) Design the fitness function. To maximize the classification effect and minimize the number of features at the same time, a multi-objective optimization problem is formed. The fitness function is designed using the linear weighting method. The formula is as follows:

[0090]

[0091] Among them, a∈[0,1], b=(1-a) represent the weights of the two objectives respectively, |SelectedFea| represents the number of features in the selected feature subset, and |AllFea| represents the initial number of features.

[0092] (1.2) Create the initial population. During the population initialization phase, generate individuals twice the size of the population. By evaluating the fitness of each individual, half of the individuals with the best fitness are selected as the initial population.

[0093] (1.3) Selection. Selection is applied as a genetic operator in the IPFGA algorithm. The individuals with the top 60% fitness scores in the incoming population P′ are selected as the next generation population P″, thereby selecting the dominant individuals in the population.

[0094] (1.4) Crossover. Each individual in P″ is exchanged with the designated gene fragment of the next individual, and the crossed individuals are added to P″ to obtain P″′.

[0095] (1.5) Mutation. Since the randomness of mutation may lead to deviation from the optimal solution, to alleviate this problem, a partial mutation mechanism is adopted. The first 20 optimal individuals of the P″′ population are retained without mutation, and subsequent individuals are randomly mutated to obtain the population P″′.

[0096] (1.6) Iteration. According to the set number of iterations, the three steps of selection, crossover, and mutation are iterated continuously. After the iteration is completed, the individual with the highest fitness is selected. As the final optimal solution, according to The corresponding feature value in is 0 or 1 to determine whether the feature is selected, thereby obtaining the selected feature subset F. (Individual The final result is a binary string of 0101, the length of which is the dimension of the initial feature. Assuming that there are 4 features A, B, C, and D originally, is 0101, then the selected feature subset includes features B and D)

[0097] In one embodiment, the second stage uses feature fusion to introduce aggregate features into the features screened in the first stage to obtain target features, including:

[0098] Calculate the six aggregate features of the sum, mean, standard deviation, maximum, minimum and kurtosis of the features screened in the first stage;

[0099] The six aggregated features are added to the feature subset consisting of the features screened out in the first stage to obtain the final feature subset.

[0100] Specifically, in order to alleviate the problem of insufficient device identification information at the package level, which leads to overlapping device behavior features, feature aggregation is performed based on F, and the six aggregated features are added to the selected feature subset F for secondary reconstruction to obtain the final feature subset F′

[0101] In one embodiment, the fitness function is set according to the classification effect index and the number of features, including setting the fitness function by a method of linearly weighting the classification effect index and the number of features, specifically:

[0102]

[0103] Among them, a∈[0,1], b=(1-a) represent the weights of the two targets respectively, F1score is the F1 score, |SelextedFea| represents the number of features in the selected feature subset, and |AllFea| represents the initial number of features.

[0104] In one embodiment, a multi-step neural network and a sequential attention mechanism are used to classify devices based on features in the filtered feature table data, including:

[0105] A deep learning network called TabNet is pre-built for tabular data. The TabNet encoder consists of two modules: Attentive Transformer and Feature Transformer. The Attentive Transformer module is used for feature selection, and the Feature Transformer module is used to process the features selected by the Attentive Transformer module.

[0106] The TabNet encoder is used for sequential multi-step processing based on multiple steps, where each decision step takes the output of the previous decision step as input to decide which features to use, processes the selected features, and then outputs the processed feature representations. The feature representations output by each decision step are aggregated into the overall decision;

[0107] Linear mapping is used to map the overall decision to the device type to obtain the IoT device identification result.

[0108] In one embodiment, the feature selection method of the Attentive Transformer module is:

[0109] M[i]=sparsemax(P[i-1]*h i (a[i-1]))

[0110] where M[i]∈R B*D is the learnable mask matrix, B is the batch size, D is the feature dimension, h i (.) is a trainable function, P[i-1] is the prior scale, which indicates the degree to which the feature is used in the i-1th decision step, and a[i-1] indicates the feature information obtained in the i-1th decision step;

[0111] The Feature Transformer module processes features including:

[0112] Use the processing function to perform feature processing on the result of feature selection of the Attentive Transformer module in the current decision step:

[0113] [d[i],a[i]]=f i (M[i]*f)

[0114] in represents the output of the i-th decision step, represents the feature information obtained in the i-th decision step, which serves as the prior information for subsequent decision steps. i Represents the processing function of features inside the Feature Transformer module;

[0115] The feature processing result of the current decision step is obtained by processing two shared layers and multiple feature blocks related to the two decision steps.

[0116] Specifically, a multi-step neural network and a sequential attention mechanism are used for device classification. TabNet is based on a multi-step neural network, which consists of multiple consecutive steps (N steps ), using the sequential attention mechanism to select features, Figure 2 This is a schematic diagram of the principle of the IoT device identification method based on two-stage feature selection in an embodiment of the present invention. Device classification using a multi-step neural network and a sequential attention mechanism includes the following:

[0117] (3.1) TabNet receives the table data f∈R corresponding to F′ B*D Enter each decision step, where B is the batch size and D is the feature dimension. TabNet encoder mainly consists of two modules: Attentive Transformer and Feature Transformer, which are responsible for feature selection and feature processing respectively. TabNet encoding is based on N stepsThe i-th step is a sequential multi-step process, where the information processed in step i-1 is input to determine which features to use, and the processed feature representation is output, which is then aggregated into an overall decision. (Each decision step involves AttentiveTransformer performing feature selection for the current step, and then using Feature Transformer to perform feature calculation or processing to obtain the processed feature representation.)

[0118] (3.2) Attentive Transformer feature selection module. Use a learnable mask matrix M[i]∈R B*D Used for soft selection of features. The mask is in the form of a product, i.e. M[i]*f, based on the feature information a[i-1] obtained in step i-1, and the mask is calculated using sparsemax normalization (Martins):

[0119] M[i]=sparsemax(P[i-1]*h i (a[i-1]))

[0120] in Indicates the value of the bth row and jth column of the mask matrix M in the i-th decision step, h i (.) is a trainable function, and P[i-1] refers to the prior scale, which indicates the extent to which the feature was used in the previous decision step.

[0121]

[0122] Where γ is a relaxation parameter. When γ = 1, a feature can only be used in one decision step. When γ > 1, a feature can be used in multiple decision steps.

[0123] (3.3) Feature Transformer feature processing module. Feature processing is performed based on the result of feature selection in the Attentive Transformer module in the current step. First, splitting is performed:

[0124] [d[i],a[i]]=f i (M[i]*f)

[0125] in is the output of the decision step, is the prior information used for subsequent processing steps, f i Represents the data processing function inside the Feature Transformer module.

[0126] The feature processing result of the current step is obtained by processing multiple feature blocks in two shared layers and two decision-step related layers.

[0127] (3.4) Decision Fusion. In order to fuse the decision results of multiple steps to achieve a more comprehensive consideration, the overall decision embedding d out for:

[0128]

[0129] Finally, apply the linear mapping W final Processing holistic decision embedding out Finally, the final output (device category) is obtained.

[0130] In one embodiment, the method further comprises:

[0131] Calculate the contribution of the output of each decision step of a sample to the final output result;

[0132] The contribution of the output of each decision step of each sample to the final result is summarized to obtain the contribution of each input to the final output.

[0133] Specifically, TabNet provides local interpretability and global interpretability. The model first provides a step output vector to obtain a scalar to reflect the importance of the step to the final result. For example, the contribution of the i-th decision step of the b-th sample to the final result can be expressed as:

[0134]

[0135] Among them, N d represents the feature dimension selected in the i-th decision step, d b,c [i] represents the contribution of the cth feature of the bth sample, i.e. the bth row and jth column.

[0136] The contribution of each input to the output can be obtained by summing the feature importance masks across all steps:

[0137]

[0138] Among them, i represents the i-th decision step, b represents the b-th sample, i.e. the b-th row, j represents the j-th feature, i.e. the j-th column, and D represents the initial feature dimension of the input TabNet.

[0139] In the classification task, TabNet uses cross entropy loss as the loss function, the formula is as follows:

[0140]

[0141] Where N is the number of samples; C is the number of device categories; y i,c is a binary indicator (0 or 1), if the true category of the i-th sample is c, then yi,c =1, otherwise 0; p i,c is the probability that the i-th sample is predicted to be class c.

[0142] In general, the above technical solutions conceived by the present invention have the following beneficial effects compared with the prior art:

[0143] (1) Strong generalization ability of feature subsets: The IoT device recognition model of the present invention uses an improved algorithm to efficiently screen features on small data sets. These features have strong generalization ability on new large-scale data sets, ensuring that the model can stably identify IoT devices in different network environments and improve recognition accuracy.

[0144] (2) High detection accuracy: Using the TabNet deep learning model and multi-step neural network, we can deeply explore feature correlations and achieve high-precision device identification at the packet level, effectively avoiding false positives and missed positives, and providing network administrators with a fast and accurate identification method.

[0145] (3) Strong adaptability and easy deployment; the model can flexibly adapt to different IoT devices and network environments without the need for additional modification. It is simple and quick to deploy, reducing deployment costs and time. It has broad application prospects and high market value.

[0146] In order to more clearly demonstrate the effect of the method provided by the present invention, the experimental data are used to illustrate and demonstrate the specific examples. Figures 3-11 .

[0147] in, Figure 3 The results of comparative experiments are presented. It can be seen from the experimental results that the Accuracy and F1 score performance indicators of the present invention on two data sets are higher than those of all other comparative models, proving the effectiveness of the present invention. This is because the present invention designs a two-stage feature selection strategy, deeply explores the potential correlation between features, and uses a multi-step neural network to comprehensively consider multiple feature combinations for classification.

[0148] Figure 4 The results of the super-parameter experiment of the present invention are shown in the figure, and the combination with the highest F1 score is a=0.8, b=0.2.

[0149] Figure 5 The figure shows the selected feature results and their explanation diagram when the parameters of the fitness function are selected as a=0.8 and b=0.2.

[0150] Figure 6 The effectiveness of the IPFGA algorithm is verified. According to the experimental results, it can be seen that the IPFGA feature selection algorithm is better than the other two feature selection strategies on the UNSW and CIC datasets.

[0151] Figure 7 The effectiveness of the aggregation features is verified. According to the experimental results, it can be seen that after the introduction of aggregation features, the two evaluation indicators on the two datasets are improved to varying degrees.

[0152] Figure 8 Verifying the effectiveness of the classification algorithm,According to the experimental results, it can be seen that TabNet outperforms the other two classification algorithms in both,evaluation indicators on the two datasets.

[0153] Figure 9 This is a schematic diagram of the importance of each feature of the present invention. The feature names are shown in Figure 5 The six aggregate features are the sum of the features, mean, standard deviation, maximum value, minimum value, and kurt.

[0154] Figure 10 and Figure 11 It is the feature mask heat map of the five decision steps of the present invention on the UNSW dataset, FeatureIndex represents the feature index, Mask Value represents the mask matrix value, and Mask Step represents the decision step.

[0155] Figure 12 and Figure 13 It is the feature mask heat map of the five decision steps of the present invention on the CIC dataset, FeatureIndex represents the feature index, Mask Value represents the mask matrix value, and Mask Step represents the decision step.

[0156] Example 2

[0157] Based on the same inventive concept, this embodiment discloses an IoT device identification device based on two-stage feature selection, comprising:

[0158] Feature extraction module, used to extract packet-level features from IoT device traffic data packets and construct feature table data;

[0159] The two-stage feature selection module is used to select target features from the constructed feature table data using a two-stage feature selection mechanism to form the filtered feature table data. In the first stage of the two-stage feature selection mechanism, the fitness function and genetic operator set by the population filtering genetic algorithm are used to preliminarily screen the original features of the feature table data to select features that meet the conditions. In the second stage, the features selected in the first stage are subjected to feature fusion to introduce aggregated features to obtain target features.

[0160] The classification module is used to classify devices based on the features in the filtered feature table data using a multi-step neural network and a sequential attention mechanism.

[0161] Since the apparatus described in Example 2 of the present invention is used to implement the method for identifying IoT devices based on two-stage feature selection in Example 1 of the present invention, those skilled in the art will be able to understand the specific structure and variations of the apparatus based on the method described in Example 1 of the present invention, and therefore, a detailed description thereof will not be repeated here. All apparatuses used in the method described in Example 1 of the present invention fall within the scope of protection of the present invention.

[0162] Example 3

[0163] Based on the same inventive concept, the present invention further provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the method described in the first embodiment is implemented.

[0164] Since the computer-readable storage medium described in Example 3 of the present invention is the computer-readable storage medium used to implement the method for identifying IoT devices based on two-stage feature selection in Example 1 of the present invention, those skilled in the art will be able to understand the specific structure and variations of the computer-readable storage medium based on the method described in Example 1 of the present invention, and therefore will not be described in detail here. All computer-readable storage media used in the method of Example 1 of the present invention are within the scope of protection of the present invention.

[0165] Example 4

[0166] The present invention also provides a computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method described in the first embodiment when executing the program.

[0167] Since the computer device described in Example 4 of the present invention is used to implement the method for identifying IoT devices based on two-stage feature selection in Example 1 of the present invention, the specific structure and variations of the computer device are readily apparent to those skilled in the art based on the method described in Example 1 of the present invention, and thus will not be further described here. All computer devices used in the method of Example 1 of the present invention fall within the scope of protection of the present invention.

[0168] It will be understood by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0169] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowcharts and / or block diagrams, as well as combinations of processes and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowcharts and / or block diagrams. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0170] Although preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they are aware of the basic inventive concepts. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention. Obviously, those skilled in the art may make various changes and modifications to the embodiments of the present invention without departing from the spirit and scope of the embodiments of the present invention. Thus, the present invention is intended to include such changes and modifications to the embodiments of the present invention if they fall within the scope of the claims and their equivalents.

Claims

1. A method for identifying IoT devices based on two-stage feature selection, characterized in that: include: Extract packet-level features from IoT device traffic data packets and construct feature table data; A two-stage feature selection mechanism is used to select target features from the constructed feature table data to form the filtered feature table data. In the first stage of the two-stage feature selection mechanism, the fitness function and genetic operator set by the population filtering genetic algorithm are used to preliminarily screen the original features of the feature table data to select features that meet the conditions. In the second stage, the features selected in the first stage are subjected to feature fusion to introduce aggregate features to obtain the target features. A multi-step neural network and a sequential attention mechanism are used to classify devices based on the features in the filtered feature table data.

2. The method for identifying IoT devices based on two-stage feature selection according to claim 1, wherein: The fitness function and genetic operator set by the population filtering genetic algorithm are used to preliminarily screen the original features of the feature table data and select the features that meet the conditions, including: Set the data structure of individuals and populations in the population filtering genetic algorithm; Set the fitness function according to the classification effect index and the number of features; Create an initial population; Set the genetic operator and the number of iterations, perform evolution according to the set genetic operator, and select the individual with the highest fitness as the final optimal solution; According to the value of the corresponding feature in the individual code with the highest fitness, the features that meet the conditions are obtained to form the selected feature subset.

3. The method for identifying IoT devices based on two-stage feature selection according to claim 1, wherein: In the second stage, the features filtered out in the first stage are fused and aggregated to obtain target features, including: Calculate the six aggregate features of the sum, mean, standard deviation, maximum, minimum and kurtosis of the features screened in the first stage; The six aggregated features are added to the feature subset consisting of the features screened out in the first stage to obtain the final feature subset.

4. The method for identifying IoT devices based on two-stage feature selection according to claim 2, wherein: The fitness function is set according to the classification effect index and the number of features, including a method of linearly weighting the classification effect index and the number of features, specifically: Among them, a∈[0,1], b=(1-a) represent the weights of the two targets respectively, F1score is the F1 score, |SelectedFea| represents the number of features in the selected feature subset, and |AllFea| represents the initial number of features.

5. The method for identifying IoT devices based on two-stage feature selection according to claim 1, wherein: A multi-step neural network and sequential attention mechanism are used to classify devices based on the features in the filtered feature table data, including: A deep learning network called TabNet is pre-built for tabular data. The TabNet encoder consists of two modules: Attentive Transformer and Feature Transformer. The Attentive Transformer module is used for feature selection, and the Feature Transformer module is used to process the features selected by the Attentive Transformer module. The TabNet encoder is used for sequential multi-step processing based on multiple steps, where each decision step takes the output of the previous decision step as input to decide which features to use, processes the selected features, and then outputs the processed feature representations. The feature representations output by each decision step are aggregated into the overall decision; Linear mapping is used to map the overall decision to the device type to obtain the IoT device identification result.

6. The method for identifying IoT devices based on two-stage feature selection according to claim 5, wherein: The feature selection method of the Attentive Transformer module is: M[i]=sparsemax(P[i-1]*h i (a[i-1])) where M[i]∈R B*D is the learnable mask matrix, B is the batch size, D is the feature dimension, h i (.) is a trainable function, P[i-1] is the prior scale, which indicates the degree to which the feature is used in the i-1th decision step, and a[i-1] indicates the feature information obtained in the i-1th decision step; The Feature Transformer module processes features including: Use the processing function to perform feature processing on the result of feature selection of the Attentive Transformer module in the current decision step: [d[i],a[i]]=f i (M[i]*f) in represents the output of the i-th decision step, represents the feature information obtained in the i-th decision step, which serves as the prior information for subsequent decision steps. i Represents the processing function of features inside the Feature Transformer module; The feature processing result of the current decision step is obtained by processing two shared layers and multiple feature blocks related to the two decision steps.

7. The method for identifying IoT devices based on two-stage feature selection according to claim 1, wherein: The method further comprises: Calculate the contribution of the output of each decision step of a sample to the final output result; The contribution of the output of each decision step of each sample to the final result is summarized to obtain the contribution of each input to the final output.

8. An IoT device identification device based on two-stage feature selection, characterized in that: include: Feature extraction module, used to extract packet-level features from IoT device traffic data packets and construct feature table data; The two-stage feature selection module is used to select target features from the constructed feature table data using a two-stage feature selection mechanism to form the filtered feature table data. In the first stage of the two-stage feature selection mechanism, the fitness function and genetic operator set by the population filtering genetic algorithm are used to preliminarily screen the original features of the feature table data to select features that meet the conditions. In the second stage, the features selected in the first stage are subjected to feature fusion to introduce aggregated features to obtain the target features. The classification module is used to classify devices based on the features in the filtered feature table data using a multi-step neural network and a sequential attention mechanism.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method for identifying an Internet of Things device based on two-stage feature selection as described in any one of claims 1 to 7 is implemented.

10. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the method for identifying an Internet of Things device based on two-stage feature selection as described in any one of claims 1 to 7 is implemented.

Images