Local area network equipment identification method and system based on machine learning

Abstract

The invention discloses a local area network equipment identification method and system based on machine learning, and the method comprises the steps: obtaining the equipment flow data of to-be-identified equipment in response to an access request of the to-be-identified equipment; preprocessing the equipment traffic data to obtain processed data; inputting the processed data into a trained MLP recognition model to obtain a device recognition result of the to-be-recognized device; the MLP recognition model is obtained through training of a training data set comprising a plurality of training equipment parameters, training flow data and corresponding equipment recognition result labels; and determining an access strategy of the to-be-identified equipment according to the equipment identification result and a preset corresponding relationship between a result and a strategy, and executing the access strategy. Therefore, according to the method and the device, the device traffic data can be fully combined to identify the device, so that more accurate and safer device identification and access can be realized.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a local area network device identification method and system based on machine learning. Background Art

[0002] In the modern network environment, there are many network devices in the local area network, which may include routers, switches, hosts, etc. For network administrators, it is very important to understand and manage these devices. However, among the huge network devices, how to quickly and accurately detect and identify devices has always been a difficult point in network management. When solving the problem of device identification in the local area network, the existing technology generally only identifies device information based on the preset communication protocol, and cannot effectively identify abnormal devices and access warnings. The accuracy and security of device identification are lacking. It can be seen that the existing technology has defects and needs to be solved urgently. Summary of the invention

[0003] The technical problem to be solved by the present invention is to provide a local area network device identification method and system based on machine learning, which can fully combine the device traffic data to identify the device, so as to achieve more accurate and secure device identification and access.

[0004] In order to solve the above technical problems, the first aspect of the present invention discloses a local area network device identification method based on machine learning, the method comprising: In response to an access request of a device to be identified, acquiring device traffic data of the device to be identified; Preprocessing the device flow data to obtain processed data; Inputting the processed data into a trained MLP recognition model to obtain a device recognition result of the device to be recognized; the MLP recognition model is trained by a training data set including a plurality of training device parameters, training flow data and corresponding device recognition result annotations; According to the device identification result and the correspondence between the preset result and the policy, the access policy of the device to be identified is determined, and the access policy is executed.

[0005] As an optional implementation, in the first aspect of the present invention, the device traffic data includes IP address, MAC address, device type, protocol type, traffic size, device performance parameters and device historical transmission data.

[0006] As an optional implementation, in the first aspect of the present invention, the preprocessing of the device flow data to obtain processed data includes: For any part of the device flow data, determine the data type corresponding to the part of the data; the data type is numerical data or text data; According to the correspondence between the preset data type and the preprocessing method, the data preprocessing method corresponding to the part of the data is determined according to the data type; the data preprocessing method is a normalization method or a word representation processing method; the normalization method is a z-score normalization method or a min-max normalization method; the word representation processing method is a bag-of-words model processing method or a word vector model processing method; Based on the corresponding data preprocessing method, all partial data in the device flow data are processed to obtain processed data.

[0007] As an optional embodiment, in the first aspect of the present invention, the MLP recognition model adopts an MLP model structure with three fully connected layers, the activation function adopts the ReLU function, the output layer adopts the softmax function for classification, the cross entropy loss function and Adam optimizer are used in the training and optimization of the model, and the L2 regularization algorithm is used to prevent overfitting.

[0008] As an optional implementation, in the first aspect of the present invention, the step of inputting the processed data into a trained MLP recognition model to obtain a device recognition result of the device to be recognized includes: Inputting the processed data into a trained MLP recognition model to obtain a first recognition result corresponding to the device to be recognized; When the first identification result is a known device, determining that the device identification result of the device to be identified is a safe result and the device type of the known device; When the first identification result is an unknown device, obtaining flow change data corresponding to the device to be identified; A device identification result corresponding to the device to be identified is determined according to the traffic change data.

[0009] As an optional implementation, in the first aspect of the present invention, determining the device identification result corresponding to the device to be identified according to the traffic change data includes: Based on similarity clustering, a stable flow set is screened out from all the flow data; Inputting the stable flow set into the MLP recognition model to obtain device information of the closest known device; Determine historical flow data corresponding to the device information from a preset device flow database; Calculating a first similarity between the stable flow set and the historical flow data; Determine whether the first similarity is greater than a first similarity threshold, and if so, determine that the device identification result of the device to be identified is a safety result and the device type corresponding to the device information; If not, input the stable traffic set into the trained data risk identification neural network to obtain the data risk parameters corresponding to the stable traffic set. When the data risk parameters are greater than the first parameter threshold, determine that the device identification result of the device to be identified is a dangerous result and the data risk parameters. When the data risk parameters are less than the first parameter threshold, determine that the device identification result of the device to be identified is a safe result and the data risk parameters.

[0010] As an optional implementation, in the first aspect of the present invention, the similarity-based clustering to select a stable flow set from all the flow data includes: For the flow data corresponding to any two time points in the flow change data, calculate the second similarity between the two flow data; Based on the second similarity and the clustering algorithm, all the traffic data are clustered and grouped to obtain a stable traffic set; wherein the second similarity between any two of the traffic data in the stable traffic set is greater than a second similarity threshold, and the second similarity between any of the traffic data in the stable traffic set and any of the traffic data in non-stable traffic sets is less than a third similarity threshold; and the third similarity threshold is less than the second similarity threshold.

[0011] As an optional implementation manner, in the first aspect of the present invention, determining the access policy of the device to be identified according to the device identification result and the correspondence between the preset result and the policy includes: When the device identification result is a safety result, determining the access policy of the device to be identified as directly accessing the target local area network; When the device identification result is a dangerous result, determining whether the data dangerous parameter is greater than a second parameter threshold value to obtain a determination result; the second parameter threshold value is greater than the first parameter threshold value; When the judgment result is yes, determining that the access policy of the device to be identified is to deny access to the target local area network; If the judgment result is yes or no, the difference between the device firewall performance parameter of each candidate transfer device and the data risk parameter is calculated to obtain the device priority corresponding to each candidate transfer device; The candidate transfer device with the highest device priority is determined as the target transfer device, and the access policy of the device to be identified is determined to access the target local area network via the target transfer device.

[0012] A second aspect of an embodiment of the present invention discloses a local area network device identification system based on machine learning, the system comprising: An acquisition module, configured to acquire device flow data of the device to be identified in response to an access request of the device to be identified; A preprocessing module, used for preprocessing the device flow data to obtain processed data; An identification module, used for inputting the processed data into a trained MLP identification model to obtain a device identification result of the device to be identified; the MLP identification model is trained by a training data set including a plurality of training device parameters, training flow data and corresponding device identification result annotations; The execution module is used to determine the access strategy of the device to be identified according to the device identification result and the corresponding relationship between the preset result and strategy, and execute the access strategy.

[0013] As an optional implementation, in the second aspect of the present invention, the device traffic data includes IP address, MAC address, device type, protocol type, traffic size, device performance parameters and device historical transmission data.

[0014] As an optional implementation, in the second aspect of the present invention, the preprocessing module preprocesses the device flow data to obtain the processed data in a specific manner, including: For any part of the device flow data, determine the data type corresponding to the part of the data; the data type is numerical data or text data; According to the correspondence between the preset data type and the preprocessing method, the data preprocessing method corresponding to the part of the data is determined according to the data type; the data preprocessing method is a normalization method or a word representation processing method; the normalization method is a z-score normalization method or a min-max normalization method; the word representation processing method is a bag-of-words model processing method or a word vector model processing method; Based on the corresponding data preprocessing method, all partial data in the device flow data are processed to obtain processed data.

[0015] As an optional embodiment, in the second aspect of the present invention, the MLP recognition model adopts an MLP model structure with three fully connected layers, the activation function adopts the ReLU function, the output layer adopts the softmax function for classification, the cross entropy loss function and Adam optimizer are used in the training and optimization of the model, and the L2 regularization algorithm is used to prevent overfitting.

[0016] As an optional implementation, in the second aspect of the present invention, the specific manner in which the recognition module inputs the processed data into the trained MLP recognition model to obtain the device recognition result of the device to be recognized includes: Inputting the processed data into a trained MLP recognition model to obtain a first recognition result corresponding to the device to be recognized; When the first identification result is a known device, determining that the device identification result of the device to be identified is a safe result and the device type of the known device; When the first identification result is an unknown device, obtaining flow change data corresponding to the device to be identified; A device identification result corresponding to the device to be identified is determined according to the traffic change data.

[0017] As an optional implementation, in the second aspect of the present invention, the identification module determines the specific manner of the device identification result corresponding to the device to be identified according to the traffic change data, including: Based on similarity clustering, a stable flow set is screened out from all the flow data; Inputting the stable flow set into the MLP recognition model to obtain device information of the closest known device; Determine historical flow data corresponding to the device information from a preset device flow database; Calculating a first similarity between the stable flow set and the historical flow data; Determine whether the first similarity is greater than a first similarity threshold, and if so, determine that the device identification result of the device to be identified is a safety result and the device type corresponding to the device information; If not, input the stable traffic set into the trained data risk identification neural network to obtain the data risk parameters corresponding to the stable traffic set. When the data risk parameters are greater than the first parameter threshold, determine that the device identification result of the device to be identified is a dangerous result and the data risk parameters. When the data risk parameters are less than the first parameter threshold, determine that the device identification result of the device to be identified is a safe result and the data risk parameters.

[0018] As an optional implementation, in the second aspect of the present invention, the specific manner in which the identification module selects a stable flow set from all the flow data based on similarity clustering includes: For the flow data corresponding to any two time points in the flow change data, calculate the second similarity between the two flow data; Based on the second similarity and the clustering algorithm, all the traffic data are clustered and grouped to obtain a stable traffic set; wherein the second similarity between any two of the traffic data in the stable traffic set is greater than a second similarity threshold, and the second similarity between any of the traffic data in the stable traffic set and any of the traffic data in non-stable traffic sets is less than a third similarity threshold; and the third similarity threshold is less than the second similarity threshold.

[0019] As an optional implementation, in the second aspect of the present invention, the execution module determines the specific manner of the access policy of the device to be identified according to the device identification result and the correspondence between the preset result and the policy, including: When the device identification result is a safety result, determining the access policy of the device to be identified as directly accessing the target local area network; When the device identification result is a dangerous result, determining whether the data dangerous parameter is greater than a second parameter threshold value to obtain a determination result; the second parameter threshold value is greater than the first parameter threshold value; When the judgment result is yes, determining that the access policy of the device to be identified is to deny access to the target local area network; If the judgment result is yes or no, the difference between the device firewall performance parameter of each candidate transfer device and the data risk parameter is calculated to obtain the device priority corresponding to each candidate transfer device; The candidate transfer device with the highest device priority is determined as the target transfer device, and the access policy of the device to be identified is determined to access the target local area network via the target transfer device.

[0020] The third aspect of the present invention discloses another local area network device identification system based on machine learning, the system comprising: A memory storing executable program code; a processor coupled to the memory; The processor calls the executable program code stored in the memory to execute part or all of the steps in the local area network device identification method based on machine learning disclosed in the first aspect of the present invention.

[0021] The fourth aspect of the present invention discloses a computer storage medium, which stores computer instructions. When the computer instructions are called, they are used to execute some or all of the steps in the local area network device identification method based on machine learning disclosed in the first aspect of the present invention.

[0022] Compared with the prior art, the embodiments of the present invention have the following beneficial effects: The present invention can pre-process the device traffic data of the device to be identified to obtain processed data, and then input the processed data into a trained MLP recognition model to obtain a device identification result, so as to determine a reasonable and accurate access strategy based on the device identification result and the correspondence between the preset result and the strategy, so as to fully combine the device traffic data to identify the device, so as to achieve more accurate and secure device identification and access. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0024] Figure 1 It is a flow chart of a local area network device identification method based on machine learning disclosed in an embodiment of the present invention.

[0025] Figure 2 It is a structural diagram of a local area network device identification system based on machine learning disclosed in an embodiment of the present invention.

[0026] Figure 3 It is a structural diagram of another local area network device identification system based on machine learning disclosed in an embodiment of the present invention. DETAILED DESCRIPTION

[0027] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0028] The terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish different objects, rather than to describe a specific order. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, device, product or equipment that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units that are not listed, or may optionally include other steps or units that are inherent to these processes, methods, products or equipment.

[0029] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present invention. The appearance of the phrase in various places in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0030] The present invention discloses a local area network device identification method and system based on machine learning, which can pre-process the device flow data of the device to be identified to obtain processed data, and then input the processed data into a trained MLP recognition model to obtain a device identification result, so as to determine a reasonable and accurate access strategy based on the device identification result and the correspondence between the preset result and the strategy, so as to fully combine the device flow data to identify the device, so as to achieve more accurate and secure device identification and access. The following are detailed descriptions.

[0031] Embodiment 1 See also Figure 1 , Figure 1 1 is a flow chart of a method for identifying a local area network device based on machine learning disclosed in an embodiment of the present invention. Figure 1 The described LAN device identification method based on machine learning can be applied to a data processing system / data processing device / data processing server (wherein the server includes a local processing server or a cloud processing server). Figure 1 As shown, the local area network device identification method based on machine learning may include the following operations: 101. In response to an access request of a device to be identified, obtain device traffic data of the device to be identified.

[0032] 102. Pre-process the device flow data to obtain processed data. 103. Input the processed data into the trained MLP recognition model to obtain a device recognition result of the device to be recognized. Optionally, the MLP recognition model is trained by using a training data set including a plurality of training device parameters, training traffic data, and corresponding device recognition result annotations.

[0033] 104. According to the device identification result and the correspondence between the preset result and the policy, determine the access policy of the device to be identified, and execute the access policy.

[0034] It can be seen that the above-mentioned embodiments of the invention can pre-process the device traffic data of the device to be identified to obtain processed data, and then input the processed data into the trained MLP recognition model to obtain the device identification result, so as to determine a reasonable and accurate access strategy based on the device identification result and the correspondence between the preset result and strategy, so as to fully combine the device traffic data to identify the device, so as to achieve more accurate and secure device identification and access.

[0035] As an optional embodiment, in the above steps, the device traffic data includes IP address, MAC address, device type, protocol type, traffic size, device performance parameters and device historical transmission data.

[0036] It can be seen that through the above optional embodiments, the content of the device parameters is limited to comprehensively characterize the characteristics of the device to be identified, and to assist in identifying the device in full combination with the device traffic data, so as to achieve more accurate and secure device identification and access.

[0037] As an optional embodiment, in the above steps, preprocessing the device flow data to obtain processed data includes: For any part of the device flow data, determine the data type corresponding to the part of the data; optionally, the data type is numerical data or text data; According to the correspondence between the preset data type and the preprocessing method, the data preprocessing method corresponding to the part of the data is determined according to the data type; optionally, the data preprocessing method is a normalization method or a word representation processing method; the normalization method is a z-score normalization method or a min-max normalization method; the word representation processing method is a bag-of-words model processing method or a word vector model processing method; Based on the corresponding data preprocessing method, all partial data in the device flow data are processed to obtain processed data.

[0038] It can be seen that through the above optional embodiments, the content of the preprocessing step is limited, and the device flow data can be fully and comprehensively preprocessed based on the preprocessing method corresponding to the data type, which is convenient for subsequent device identification and assists in fully combining the device flow data to identify the device, so as to achieve more accurate and secure device identification and access.

[0039] As an optional embodiment, in the above steps, the MLP recognition model adopts an MLP model structure with three fully connected layers, the activation function adopts the ReLU function, the output layer adopts the softmax function for classification, the cross entropy loss function and Adam optimizer are used in the training and optimization of the model, and the L2 regularization algorithm is used to prevent overfitting.

[0040] It can be seen that through the above optional embodiments, the structure and training details of the MLP recognition model are limited, which can achieve more accurate device recognition and assist in fully combining device traffic data to identify the device, so as to achieve more accurate and secure device identification and access.

[0041] As an optional embodiment, in the above step, inputting the processed data into the trained MLP recognition model to obtain a device recognition result of the device to be recognized includes: Inputting the processed data into the trained MLP recognition model to obtain a first recognition result corresponding to the device to be recognized; When the first identification result is a known device, determining that the device identification result of the device to be identified is a safe result and a device type of the known device; When the first identification result is an unknown device, obtaining flow change data corresponding to the device to be identified; According to the traffic change data, the device identification result corresponding to the device to be identified is determined.

[0042] It can be seen that through the above optional embodiments, it is possible to first determine whether the device to be identified is a known device and the device type based on the MLP recognition model, and determine the identification result of the device based on the traffic change data after identifying it as an unknown device. This can achieve more accurate device identification and assist in fully combining the device traffic data to identify the device, so as to achieve more accurate and secure device identification and access.

[0043] As an optional embodiment, in the above step, determining the device identification result corresponding to the device to be identified according to the traffic change data includes: Based on similarity clustering, a stable flow set is selected from all flow data; Input the stable flow set into the MLP recognition model to obtain the device information of the closest known device; Determine historical flow data corresponding to the device information from a preset device flow database; Calculating a first similarity between the stable flow set and the historical flow data; Determine whether the first similarity is greater than a first similarity threshold, and if so, determine that a device identification result of the device to be identified is a safety result and a device type corresponding to the device information; If not, the stable traffic set is input into the trained data risk identification neural network to obtain the data risk parameters corresponding to the stable traffic set. When the data risk parameter is greater than the first parameter threshold, the device identification result of the device to be identified is determined to be a dangerous result and the data risk parameter. When the data risk parameter is less than the first parameter threshold, the device identification result of the device to be identified is determined to be a safe result and the data risk parameter.

[0044] It can be seen that through the above-mentioned optional embodiments, the identification result of the device can be determined based on the traffic change data based on similarity clustering and similarity calculation and judgment, which can achieve more accurate device identification and assist in fully combining the device traffic data to identify the device, so as to achieve more accurate and secure device identification and access.

[0045] As an optional embodiment, in the above step, based on similarity clustering, a stable flow set is screened out from all flow data, including: For the flow data corresponding to any two time points in the flow change data, calculate the second similarity between the two flow data; Based on the second similarity and the clustering algorithm, all traffic data are clustered and grouped to obtain a stable traffic set; optionally, the second similarity between any two traffic data in the stable traffic set is greater than a second similarity threshold, and the second similarity between any traffic data in the stable traffic set and any traffic data in the unstable traffic set is less than a third similarity threshold; the third similarity threshold is less than the second similarity threshold.

[0046] It can be seen that through the above optional embodiments, a set of stable traffic can be determined based on the similarity calculation and clustering algorithm between the traffic data, so as to facilitate more accurate device identification in the future, and assist in identifying the device by fully combining the device traffic data, so as to achieve more accurate and secure device identification and access.

[0047] As an optional embodiment, in the above steps, determining the access policy of the device to be identified according to the device identification result and the correspondence between the preset result and the policy includes: When the device identification result is a safe result, the access policy of the device to be identified is determined as directly accessing the target local area network; When the device identification result is a dangerous result, determine whether the data dangerous parameter is greater than a second parameter threshold to obtain a determination result; optionally, the second parameter threshold is greater than the first parameter threshold; When the judgment result is yes, determining the access policy of the device to be identified as denying access to the target local area network; If the result of the judgment is no, the difference between the device firewall performance parameter and the data risk parameter of each candidate transfer device is calculated to obtain the device priority corresponding to each candidate transfer device; The candidate transfer device with the highest device priority is determined as the target transfer device, and the access policy of the device to be identified is determined to access the target local area network via the target transfer device.

[0048] It can be seen that through the above optional embodiments, a safer access strategy can be determined based on multiple judgments of device identification results and the intervention of transit devices, so that the device can be identified by fully combining device traffic data to achieve more accurate and secure device identification and access.

[0049] Embodiment 2 See also Figure 2 , Figure 2 : is a structural diagram of a local area network device identification system based on machine learning disclosed in an embodiment of the present invention. Figure 2 The described local area network device identification system based on machine learning can be applied to a data processing system / data processing device / data processing server (wherein the server includes a local processing server or a cloud processing server). Figure 2 As shown, the local area network device identification system based on machine learning may include: The acquisition module 201 is used to acquire device traffic data of the device to be identified in response to an access request of the device to be identified.

[0050] The preprocessing module 202 is used to preprocess the device flow data to obtain processed data. The identification module 203 is used to input the processed data into the trained MLP identification model to obtain the device identification result of the device to be identified. Optionally, the MLP recognition model is trained by using a training data set including a plurality of training device parameters, training traffic data, and corresponding device recognition result annotations.

[0051] The execution module 204 is used to determine the access policy of the device to be identified according to the device identification result and the corresponding relationship between the preset result and the policy, and execute the access policy.

[0052] It can be seen that the above-mentioned embodiments of the invention can pre-process the device traffic data of the device to be identified to obtain processed data, and then input the processed data into the trained MLP recognition model to obtain the device identification result, so as to determine a reasonable and accurate access strategy based on the device identification result and the correspondence between the preset result and strategy, so as to fully combine the device traffic data to identify the device, so as to achieve more accurate and secure device identification and access.

[0053] As an optional embodiment, the device traffic data includes IP address, MAC address, device type, protocol type, traffic size, device performance parameters and device historical transmission data.

[0054] It can be seen that through the above optional embodiments, the content of the device parameters is limited to comprehensively characterize the characteristics of the device to be identified, and to assist in identifying the device in full combination with the device traffic data, so as to achieve more accurate and secure device identification and access.

[0055] As an optional embodiment, the preprocessing module preprocesses the device flow data to obtain the processed data in a specific manner, including: For any part of the device flow data, determine the data type corresponding to the part of the data; optionally, the data type is numerical data or text data; According to the correspondence between the preset data type and the preprocessing method, the data preprocessing method corresponding to the part of the data is determined according to the data type; optionally, the data preprocessing method is a normalization method or a word representation processing method; the normalization method is a z-score normalization method or a min-max normalization method; the word representation processing method is a bag-of-words model processing method or a word vector model processing method; Based on the corresponding data preprocessing method, all partial data in the device flow data are processed to obtain processed data.

[0056] It can be seen that through the above optional embodiments, the content of the preprocessing step is limited, and the device flow data can be fully and comprehensively preprocessed based on the preprocessing method corresponding to the data type, which is convenient for subsequent device identification and assists in fully combining the device flow data to identify the device, so as to achieve more accurate and secure device identification and access.

[0057] As an optional embodiment, the MLP recognition model adopts an MLP model structure with three fully connected layers, the activation function adopts the ReLU function, the output layer adopts the softmax function for classification, the cross entropy loss function and the Adam optimizer are used in the training and optimization of the model, and the L2 regularization algorithm is used to prevent overfitting.

[0058] It can be seen that through the above optional embodiments, the structure and training details of the MLP recognition model are limited, which can achieve more accurate device recognition and assist in fully combining device traffic data to identify the device, so as to achieve more accurate and secure device identification and access.

[0059] As an optional embodiment, the specific manner in which the recognition module inputs the processed data into the trained MLP recognition model to obtain the device recognition result of the device to be recognized includes: Inputting the processed data into the trained MLP recognition model to obtain a first recognition result corresponding to the device to be recognized; When the first identification result is a known device, determining that the device identification result of the device to be identified is a safe result and a device type of the known device; When the first identification result is an unknown device, obtaining flow change data corresponding to the device to be identified; According to the traffic change data, the device identification result corresponding to the device to be identified is determined.

[0060] It can be seen that through the above optional embodiments, it is possible to first determine whether the device to be identified is a known device and the device type based on the MLP recognition model, and determine the identification result of the device based on the traffic change data after identifying it as an unknown device. This can achieve more accurate device identification and assist in fully combining the device traffic data to identify the device, so as to achieve more accurate and secure device identification and access.

[0061] As an optional embodiment, the identification module determines the specific manner of the device identification result corresponding to the device to be identified according to the traffic change data, including: Based on similarity clustering, a stable flow set is selected from all flow data; Input the stable flow set into the MLP recognition model to obtain the device information of the closest known device; Determine historical flow data corresponding to the device information from a preset device flow database; Calculating a first similarity between the stable flow set and the historical flow data; Determine whether the first similarity is greater than a first similarity threshold, and if so, determine that a device identification result of the device to be identified is a safety result and a device type corresponding to the device information; If not, the stable traffic set is input into the trained data risk identification neural network to obtain the data risk parameters corresponding to the stable traffic set. When the data risk parameter is greater than the first parameter threshold, the device identification result of the device to be identified is determined to be a dangerous result and the data risk parameter. When the data risk parameter is less than the first parameter threshold, the device identification result of the device to be identified is determined to be a safe result and the data risk parameter.

[0062] It can be seen that through the above-mentioned optional embodiments, the identification result of the device can be determined based on the traffic change data based on similarity clustering and similarity calculation and judgment, which can achieve more accurate device identification and assist in fully combining the device traffic data to identify the device, so as to achieve more accurate and secure device identification and access.

[0063] As an optional embodiment, the specific method of the identification module to screen out the stable flow set from all flow data based on similarity clustering includes: For the flow data corresponding to any two time points in the flow change data, calculate the second similarity between the two flow data; Based on the second similarity and the clustering algorithm, all traffic data are clustered and grouped to obtain a stable traffic set; optionally, the second similarity between any two traffic data in the stable traffic set is greater than a second similarity threshold, and the second similarity between any traffic data in the stable traffic set and any traffic data in the unstable traffic set is less than a third similarity threshold; the third similarity threshold is less than the second similarity threshold.

[0064] It can be seen that through the above optional embodiments, a set of stable traffic can be determined based on the similarity calculation and clustering algorithm between the traffic data, so as to facilitate more accurate device identification in the future, and assist in identifying the device by fully combining the device traffic data, so as to achieve more accurate and secure device identification and access.

[0065] As an optional embodiment, the execution module determines the specific manner of the access policy of the device to be identified according to the device identification result and the correspondence between the preset result and the policy, including: When the device identification result is a safe result, the access policy of the device to be identified is determined as directly accessing the target local area network; When the device identification result is a dangerous result, determine whether the data dangerous parameter is greater than a second parameter threshold to obtain a determination result; optionally, the second parameter threshold is greater than the first parameter threshold; When the judgment result is yes, determining the access policy of the device to be identified as denying access to the target local area network; If the result of the judgment is no, the difference between the device firewall performance parameter and the data risk parameter of each candidate transfer device is calculated to obtain the device priority corresponding to each candidate transfer device; The candidate transfer device with the highest device priority is determined as the target transfer device, and the access policy of the device to be identified is determined to access the target local area network via the target transfer device.

[0066] It can be seen that through the above optional embodiments, a safer access strategy can be determined based on multiple judgments of device identification results and the intervention of transit devices, so that the device can be identified by fully combining device traffic data to achieve more accurate and secure device identification and access.

[0067] Embodiment 3 See also Figure 3 , Figure 3 It is another local area network device identification system based on machine learning disclosed in an embodiment of the present invention. Figure 3 The described local area network device identification system based on machine learning is applied to a data processing system / data processing device / data processing server (wherein the server includes a local processing server or a cloud processing server). Figure 3As shown, the local area network device identification system based on machine learning may include: A memory 301 storing executable program codes; a processor 302 coupled to the memory 301; The processor 302 calls the executable program code stored in the memory 301 to execute the steps of the local area network device identification method based on machine learning described in the first embodiment.

[0068] Embodiment 4 An embodiment of the present invention discloses a computer-readable storage medium storing a computer program for electronic data exchange, wherein the computer program enables a computer to execute the steps of the local area network device identification method based on machine learning described in the first embodiment.

[0069] Embodiment 5 An embodiment of the present invention discloses a computer program product, which includes a non-transitory computer-readable storage medium storing a computer program, and the computer program is operable to enable a computer to execute the steps of the local area network device identification method based on machine learning described in Example 1.

[0070] The above describes specific embodiments of the present specification, and other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the accompanying drawings do not necessarily have to be performed in the specific order or sequential order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0071] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0072] For the convenience of description, the above device is described in various units according to their functions. Of course, when implementing this specification, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0073] Those skilled in the art will appreciate that the embodiments of this specification may be provided as methods, systems, or computer program products. Therefore, the embodiments of this specification may be in the form of complete hardware embodiments, complete software embodiments, or embodiments in combination with software and hardware. Moreover, the embodiments of this specification may be in the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0074] This specification is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of this specification. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0075] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0076] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0077] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0078] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0079] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0080] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0081] This specification may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. This specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0082] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0083] Finally, it should be noted that the LAN device identification method and system based on machine learning disclosed in the embodiment of the present invention discloses only the preferred embodiments of the present invention, which are only used to illustrate the technical solution of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, it should be understood by those skilled in the art that the technical solutions described in the aforementioned embodiments can still be modified, or some of the technical features therein can be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A local area network device identification method based on machine learning, characterized in that: The method comprises: In response to an access request of a device to be identified, acquiring device traffic data of the device to be identified; Preprocessing the device flow data to obtain processed data; Inputting the processed data into a trained MLP recognition model to obtain a device recognition result of the device to be recognized; the MLP recognition model is trained by a training data set including a plurality of training device parameters, training flow data and corresponding device recognition result annotations; According to the device identification result and the correspondence between the preset result and the policy, the access policy of the device to be identified is determined, and the access policy is executed.

2. The local area network device identification method based on machine learning according to claim 1, characterized in that: The device traffic data includes IP address, MAC address, device type, protocol type, traffic size, device performance parameters and device historical transmission data.

3. The local area network device identification method based on machine learning according to claim 1, characterized in that: The preprocessing of the device flow data to obtain processed data includes: For any part of the device flow data, determine the data type corresponding to the part of the data; the data type is numerical data or text data; According to the correspondence between the preset data type and the preprocessing method, the data preprocessing method corresponding to the part of the data is determined according to the data type; the data preprocessing method is a normalization method or a word representation processing method; the normalization method is a z-score normalization method or a min-max normalization method; the word representation processing method is a bag-of-words model processing method or a word vector model processing method; Based on the corresponding data preprocessing method, all partial data in the device flow data are processed to obtain processed data.

4. The local area network device identification method based on machine learning according to claim 1, characterized in that: The MLP recognition model adopts an MLP model structure with three fully connected layers, the activation function adopts the ReLU function, the output layer adopts the softmax function for classification, the cross entropy loss function and the Adam optimizer are used in the training and optimization of the model, and the L2 regularization algorithm is used to prevent overfitting.

5. The local area network device identification method based on machine learning according to claim 1, characterized in that: The step of inputting the processed data into a trained MLP recognition model to obtain a device recognition result of the device to be recognized includes: Inputting the processed data into a trained MLP recognition model to obtain a first recognition result corresponding to the device to be recognized; When the first identification result is a known device, determining that the device identification result of the device to be identified is a safe result and the device type of the known device; When the first identification result is an unknown device, obtaining flow change data corresponding to the device to be identified; A device identification result corresponding to the device to be identified is determined according to the traffic change data.

6. The local area network device identification method based on machine learning according to claim 5, characterized in that: The determining, according to the traffic change data, a device identification result corresponding to the device to be identified includes: Based on similarity clustering, a stable flow set is screened out from all the flow data; Inputting the stable flow set into the MLP recognition model to obtain device information of the closest known device; Determine historical flow data corresponding to the device information from a preset device flow database; Calculating a first similarity between the stable flow set and the historical flow data; Determine whether the first similarity is greater than a first similarity threshold, and if so, determine that the device identification result of the device to be identified is a safety result and the device type corresponding to the device information; If not, input the stable traffic set into the trained data risk identification neural network to obtain the data risk parameters corresponding to the stable traffic set. When the data risk parameters are greater than the first parameter threshold, determine that the device identification result of the device to be identified is a dangerous result and the data risk parameters. When the data risk parameters are less than the first parameter threshold, determine that the device identification result of the device to be identified is a safe result and the data risk parameters.

7. The local area network device identification method based on machine learning according to claim 6, characterized in that: The similarity-based clustering method selects a stable flow set from all the flow data, including: For the flow data corresponding to any two time points in the flow change data, calculate the second similarity between the two flow data; Based on the second similarity and the clustering algorithm, all the traffic data are clustered and grouped to obtain a stable traffic set; wherein the second similarity between any two of the traffic data in the stable traffic set is greater than a second similarity threshold, and the second similarity between any of the traffic data in the stable traffic set and any of the traffic data in non-stable traffic sets is less than a third similarity threshold; and the third similarity threshold is less than the second similarity threshold.

8. The local area network device identification method based on machine learning according to claim 6, characterized in that: Determining the access policy of the device to be identified according to the device identification result and the correspondence between the preset result and the policy includes: When the device identification result is a safety result, determining the access policy of the device to be identified as directly accessing the target local area network; When the device identification result is a dangerous result, determining whether the data dangerous parameter is greater than a second parameter threshold value to obtain a determination result; the second parameter threshold value is greater than the first parameter threshold value; When the judgment result is yes, determining that the access policy of the device to be identified is to deny access to the target local area network; If the judgment result is yes or no, the difference between the device firewall performance parameter of each candidate transfer device and the data risk parameter is calculated to obtain the device priority corresponding to each candidate transfer device; The candidate transfer device with the highest device priority is determined as the target transfer device, and the access policy of the device to be identified is determined to access the target local area network via the target transfer device.

9. A local area network device identification system based on machine learning, characterized in that: The system comprises: An acquisition module, configured to acquire device flow data of the device to be identified in response to an access request of the device to be identified; A preprocessing module, used for preprocessing the device flow data to obtain processed data; An identification module, used for inputting the processed data into a trained MLP identification model to obtain a device identification result of the device to be identified; the MLP identification model is trained by a training data set including a plurality of training device parameters, training flow data and corresponding device identification result annotations; The execution module is used to determine the access strategy of the device to be identified according to the device identification result and the corresponding relationship between the preset result and strategy, and execute the access strategy.

10. A local area network device identification system based on machine learning, characterized in that: The system comprises: A memory storing executable program code; a processor coupled to the memory; The processor calls the executable program code stored in the memory to execute the local area network device identification method based on machine learning as described in any one of claims 1-8.

Images