Method and system for identifying local area network devices based on machine learning

Abstract

The application discloses a kind of local area network equipment identification method and system based on machine learning, the method includes: in response to the access request of equipment to be identified, the equipment traffic data of the equipment to be identified is obtained;The equipment traffic data is preprocessed, and the processed data is obtained;The processed data is input to the trained MLP identification model to obtain the equipment identification result of the equipment to be identified;The MLP identification model is obtained by training data set including a plurality of training equipment parameters, training traffic data and corresponding equipment identification result label;According to the equipment identification result, and the corresponding relationship of result and strategy of pre-set, the access strategy of the equipment to be identified is determined, and the access strategy is executed.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and in particular to a method and system for identifying local area network devices based on machine learning. Background Technology

[0002] In modern network environments, local area networks (LANs) contain numerous network devices, including routers, switches, and hosts. Understanding and managing these devices is crucial for network administrators. However, quickly and accurately detecting and identifying devices within such a large network has always been a challenge for network management. Existing technologies for device identification within LANs generally rely on preset communication protocols, failing to effectively identify and warn of abnormal devices. Their accuracy and security in device identification are therefore lacking. Clearly, existing technologies have shortcomings that urgently need to be addressed. Summary of the Invention

[0003] The technical problem to be solved by the present invention is to provide a local area network device identification method and system based on machine learning, which can fully combine device traffic data to identify devices, so as to achieve more accurate and secure device identification and access.

[0004] To address the aforementioned technical problems, the first aspect of this invention discloses a method for identifying local area network (LAN) devices based on machine learning, the method comprising:

[0005] In response to an access request from a device to be identified, obtain the device traffic data of the device to be identified;

[0006] The device flow data is preprocessed to obtain processed data;

[0007] The processed data is input into the trained MLP recognition model to obtain the device recognition result of the device to be identified; the MLP recognition model is trained using a training dataset that includes multiple training device parameters, training traffic data and corresponding device recognition result annotations;

[0008] Based on the device identification results and the preset correspondence between results and policies, the access policy for the device to be identified is determined and the access policy is executed.

[0009] As an optional implementation, in the first aspect of the present invention, the device traffic data includes IP address, MAC address, device type, protocol type, traffic volume, device performance parameters, and historical transmission data of the device.

[0010] As an optional implementation, in the first aspect of the present invention, the preprocessing of the device traffic data to obtain processed data includes:

[0011] For any portion of the device traffic data, determine the data type corresponding to that portion of data; the data type is either numerical data or text data.

[0012] Based on the predefined correspondence between data types and preprocessing methods, the data preprocessing method corresponding to this part of the data is determined according to the data type; the data preprocessing method is a normalization method or a word representation processing method; the normalization method is a z-score normalization method or a min-max normalization method; the word representation processing method is a bag-of-words model processing method or a word vector model processing method.

[0013] Based on the corresponding data preprocessing method, all parts of the device traffic data are processed to obtain processed data.

[0014] As an optional implementation, in the first aspect of the present invention, the MLP recognition model adopts a three-layer fully connected MLP model structure, the activation function is the ReLU function, the output layer uses the softmax function for classification, the cross-entropy loss function and the Adam optimizer are used in the training and optimization of the model, and the L2 regularization algorithm is used to prevent overfitting.

[0015] As an optional implementation, in the first aspect of the present invention, the step of inputting the processed data into a trained MLP recognition model to obtain the device recognition result of the device to be recognized includes:

[0016] The processed data is input into the trained MLP recognition model to obtain the first recognition result corresponding to the device to be recognized;

[0017] When the first identification result is a known device, the device identification result of the device to be identified is determined to be a security result and the device type of the known device is determined;

[0018] When the first identification result is an unknown device, obtain the traffic change data corresponding to the device to be identified;

[0019] Based on the traffic change data, determine the device identification result corresponding to the device to be identified.

[0020] As an optional implementation, in the first aspect of the present invention, determining the device identification result corresponding to the device to be identified based on the traffic change data includes:

[0021] Based on similarity clustering, a stable traffic set is selected from all the traffic data;

[0022] The stable traffic set is input into the MLP identification model to obtain the device information of the closest known device;

[0023] Determine the historical traffic data corresponding to the device information from a preset device traffic database;

[0024] Calculate the first similarity between the stable traffic set and the historical traffic data;

[0025] Determine whether the first similarity is greater than the first similarity threshold. If so, determine that the device identification result of the device to be identified is a security result and the device type corresponding to the device information.

[0026] If not, the stable traffic set is input into the trained data risk identification neural network to obtain the data hazard parameter corresponding to the stable traffic set. When the data hazard parameter is greater than the first parameter threshold, the device identification result of the device to be identified is determined to be a dangerous result and the data hazard parameter is determined. When the data hazard parameter is less than the first parameter threshold, the device identification result of the device to be identified is determined to be a safe result and the data hazard parameter is determined.

[0027] As an optional implementation, in the first aspect of the invention, the step of filtering out a stable traffic set from all the traffic data based on similarity clustering includes:

[0028] For any two time points in the traffic change data, calculate the second similarity between the two traffic data points;

[0029] Based on the second similarity and clustering algorithm, all the traffic data are clustered to obtain a stable traffic set; wherein, the second similarity between any two traffic data in the stable traffic set is greater than the second similarity threshold, and the second similarity between any traffic data in the stable traffic set and any traffic data not in the stable traffic set is less than the third similarity threshold; the third similarity threshold is less than the second similarity threshold.

[0030] As an optional implementation, in the first aspect of the present invention, determining the access strategy of the device to be identified based on the device identification result and the preset correspondence between the result and the strategy includes:

[0031] When the device identification result is a safe result, the access policy of the device to be identified is determined to be direct access to the target local area network;

[0032] When the device identification result is a dangerous result, it is determined whether the data danger parameter is greater than the second parameter threshold, and a judgment result is obtained; the second parameter threshold is greater than the first parameter threshold.

[0033] When the determination result is yes, the access policy of the device to be identified is determined to be to refuse access to the target local area network;

[0034] If the judgment result is negative, calculate the difference between the device firewall performance parameter and the data danger parameter of each candidate relay device to obtain the device priority corresponding to each candidate relay device;

[0035] The candidate relay device with the highest priority is identified as the target relay device, and the access policy for the device to be identified is to access the target local area network via the target relay device.

[0036] A second aspect of this invention discloses a local area network (LAN) device identification system based on machine learning, the system comprising:

[0037] The acquisition module is used to acquire device traffic data of the device to be identified in response to the access request of the device to be identified;

[0038] The preprocessing module is used to preprocess the device flow data to obtain processed data;

[0039] The identification module is used to input the processed data into the trained MLP identification model to obtain the device identification result of the device to be identified; the MLP identification model is trained by a training dataset including multiple training device parameters, training traffic data and corresponding device identification result annotations;

[0040] The execution module is used to determine the access policy of the device to be identified based on the device identification result and the preset correspondence between the result and the policy, and to execute the access policy.

[0041] As an optional implementation, in a second aspect of the present invention, the device traffic data includes IP address, MAC address, device type, protocol type, traffic volume, device performance parameters, and historical device transmission data.

[0042] As an optional implementation, in a second aspect of the present invention, the preprocessing module preprocesses the device traffic data to obtain processed data in the following specific manner:

[0043] For any portion of the device traffic data, determine the data type corresponding to that portion of data; the data type is either numerical data or text data.

[0044] Based on the predefined correspondence between data types and preprocessing methods, the data preprocessing method corresponding to this part of the data is determined according to the data type; the data preprocessing method is a normalization method or a word representation processing method; the normalization method is a z-score normalization method or a min-max normalization method; the word representation processing method is a bag-of-words model processing method or a word vector model processing method.

[0045] Based on the corresponding data preprocessing method, all parts of the device traffic data are processed to obtain processed data.

[0046] As an optional implementation, in the second aspect of the present invention, the MLP recognition model adopts a three-layer fully connected MLP model structure, the activation function is the ReLU function, the output layer uses the softmax function for classification, the cross-entropy loss function and the Adam optimizer are used in the training and optimization of the model, and the L2 regularization algorithm is used to prevent overfitting.

[0047] As an optional implementation, in a second aspect of the present invention, the specific method by which the recognition module inputs the processed data into a trained MLP recognition model to obtain the device recognition result of the device to be recognized includes:

[0048] The processed data is input into the trained MLP recognition model to obtain the first recognition result corresponding to the device to be recognized;

[0049] When the first identification result is a known device, the device identification result of the device to be identified is determined to be a security result and the device type of the known device is determined;

[0050] When the first identification result is an unknown device, obtain the traffic change data corresponding to the device to be identified;

[0051] Based on the traffic change data, determine the device identification result corresponding to the device to be identified.

[0052] As an optional implementation, in a second aspect of the present invention, the specific method by which the identification module determines the device identification result corresponding to the device to be identified based on the traffic change data includes:

[0053] Based on similarity clustering, a stable traffic set is selected from all the traffic data;

[0054] The stable traffic set is input into the MLP identification model to obtain the device information of the closest known device;

[0055] Determine the historical traffic data corresponding to the device information from a preset device traffic database;

[0056] Calculate the first similarity between the stable traffic set and the historical traffic data;

[0057] Determine whether the first similarity is greater than the first similarity threshold. If so, determine that the device identification result of the device to be identified is a security result and the device type corresponding to the device information.

[0058] If not, the stable traffic set is input into the trained data risk identification neural network to obtain the data hazard parameter corresponding to the stable traffic set. When the data hazard parameter is greater than the first parameter threshold, the device identification result of the device to be identified is determined to be a dangerous result and the data hazard parameter is determined. When the data hazard parameter is less than the first parameter threshold, the device identification result of the device to be identified is determined to be a safe result and the data hazard parameter is determined.

[0059] As an optional implementation, in a second aspect of the invention, the specific method by which the identification module filters out a stable traffic set from all the traffic data based on similarity clustering includes:

[0060] For any two time points in the traffic change data, calculate the second similarity between the two traffic data points;

[0061] Based on the second similarity and clustering algorithm, all the traffic data are clustered to obtain a stable traffic set; wherein, the second similarity between any two traffic data in the stable traffic set is greater than the second similarity threshold, and the second similarity between any traffic data in the stable traffic set and any traffic data not in the stable traffic set is less than the third similarity threshold; the third similarity threshold is less than the second similarity threshold.

[0062] As an optional implementation, in a second aspect of the invention, the execution module determines the specific method of the access strategy for the device to be identified based on the device identification result and the preset correspondence between the result and the strategy, including:

[0063] When the device identification result is a safe result, the access policy of the device to be identified is determined to be direct access to the target local area network;

[0064] When the device identification result is a dangerous result, it is determined whether the data danger parameter is greater than the second parameter threshold, and a judgment result is obtained; the second parameter threshold is greater than the first parameter threshold.

[0065] When the determination result is yes, the access policy of the device to be identified is determined to be to refuse access to the target local area network;

[0066] If the judgment result is negative, calculate the difference between the device firewall performance parameter and the data danger parameter of each candidate relay device to obtain the device priority corresponding to each candidate relay device;

[0067] The candidate relay device with the highest priority is identified as the target relay device, and the access policy for the device to be identified is to access the target local area network via the target relay device.

[0068] A third aspect of this invention discloses another local area network (LAN) device identification system based on machine learning, the system comprising:

[0069] Memory containing executable program code;

[0070] A processor coupled to the memory;

[0071] The processor calls the executable program code stored in the memory to execute some or all of the steps in the machine learning-based local area network device identification method disclosed in the first aspect of the present invention.

[0072] The fourth aspect of the present invention discloses a computer storage medium storing computer instructions, which, when invoked, are used to execute some or all of the steps in the machine learning-based local area network device identification method disclosed in the first aspect of the present invention.

[0073] Compared with the prior art, the embodiments of the present invention have the following beneficial effects:

[0074] This invention can preprocess the device traffic data of the device to be identified to obtain processed data, and then input the processed data into a trained MLP recognition model to obtain the device recognition result. Based on the device recognition result and the correspondence between the preset result and strategy, a reasonable and accurate access strategy is determined. This allows for full integration of device traffic data to identify devices, thereby achieving more accurate and secure device identification and access. Attached Figure Description

[0075] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0076] Figure 1 This is a flowchart illustrating a machine learning-based method for identifying local area network devices, as disclosed in an embodiment of the present invention.

[0077] Figure 2This is a schematic diagram of the structure of a local area network device identification system based on machine learning disclosed in an embodiment of the present invention.

[0078] Figure 3 This is a schematic diagram of another local area network device identification system based on machine learning disclosed in an embodiment of the present invention. Detailed Implementation

[0079] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0080] The terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this invention are used to distinguish different objects, not to describe a specific order. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion. For example, a process, method, apparatus, product, or device that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to these processes, methods, products, or devices.

[0081] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of the invention. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0082] This invention discloses a machine learning-based method and system for identifying local area network (LAN) devices. It preprocesses device traffic data of the devices to be identified to obtain processed data, then inputs the processed data into a trained MLP (Machine Learning Platform) identification model to obtain device identification results. Based on the device identification results and the pre-defined correspondence between results and strategies, a reasonable and accurate access strategy is determined. This allows for comprehensive device identification by fully integrating device traffic data, achieving more accurate and secure device identification and access. Detailed explanations follow.

[0083] Example 1

[0084] Please see Figure 1 , Figure 1This is a flowchart illustrating a machine learning-based local area network (LAN) device identification method disclosed in an embodiment of the present invention. Wherein, Figure 1 The described machine learning-based LAN device identification method can be applied to data processing systems / data processing devices / data processing servers (wherein, the server includes a local processing server or a cloud processing server). For example... Figure 1 As shown, this machine learning-based local area network device identification method may include the following operations:

[0085] 101. In response to the access request from the device to be identified, obtain the device traffic data of the device to be identified.

[0086] 102. Preprocess the equipment flow data to obtain processed data.

[0087] 103. Input the processed data into the trained MLP recognition model to obtain the device recognition result of the device to be recognized.

[0088] Optionally, the MLP recognition model is trained using a training dataset that includes multiple training device parameters, training traffic data, and corresponding device recognition result annotations.

[0089] 104. Based on the device identification results and the pre-defined correspondence between results and policies, determine the access policy for the device to be identified and execute the access policy.

[0090] As can be seen, the above-described embodiments of the invention can preprocess the device traffic data of the device to be identified to obtain processed data, and then input the processed data into the trained MLP recognition model to obtain the device recognition result. Based on the device recognition result and the correspondence between the preset result and strategy, a reasonable and accurate access strategy is determined, thereby fully combining the device traffic data to identify the device, so as to achieve more accurate and secure device identification and access.

[0091] As an optional embodiment, the device traffic data in the above steps includes IP address, MAC address, device type, protocol type, traffic volume, device performance parameters, and historical device transmission data.

[0092] As can be seen, the above optional embodiments define the content of the device parameters to comprehensively characterize the features of the device to be identified, and assist in fully combining device traffic data to identify the device, so as to achieve more accurate and secure device identification and access.

[0093] As an optional embodiment, the above steps of preprocessing the device traffic data to obtain processed data include:

[0094] For any part of the device traffic data, determine the data type corresponding to that part of the data; optionally, the data type can be numeric data or text data.

[0095] Based on the predefined correspondence between data types and preprocessing methods, the data preprocessing method corresponding to this part of the data is determined according to the data type; optionally, the data preprocessing method is a normalization method or a word representation processing method; the normalization method is a z-score normalization method or a min-max normalization method; the word representation processing method is a bag-of-words model processing method or a word vector model processing method.

[0096] Based on the corresponding data preprocessing method, all parts of the device traffic data are processed to obtain the processed data.

[0097] As can be seen, the above optional embodiments define the content of the preprocessing steps, enabling comprehensive data preprocessing of device traffic data based on the preprocessing method corresponding to the data type. This facilitates subsequent device identification and helps to fully integrate device traffic data for device identification, thereby achieving more accurate and secure device identification and access.

[0098] As an optional embodiment, in the above steps, the MLP recognition model adopts a three-layer fully connected MLP model structure, the activation function is the ReLU function, the output layer uses the softmax function for classification, the cross-entropy loss function and the Adam optimizer are used in the training and optimization of the model, and the L2 regularization algorithm is used to prevent overfitting.

[0099] As can be seen, the structure and training details of the MLP recognition model are defined through the above optional embodiments, which can achieve more accurate device recognition and help to fully combine device traffic data to identify devices, so as to achieve more accurate and secure device recognition and access.

[0100] As an optional embodiment, the step described above, inputting the processed data into a trained MLP recognition model to obtain the device recognition result for the device to be recognized, includes:

[0101] The processed data is input into the trained MLP recognition model to obtain the first recognition result corresponding to the device to be recognized;

[0102] When the first identification result is a known device, the device identification result of the device to be identified is determined to be a security result and the device type of the known device is determined;

[0103] When the first identification result is an unknown device, acquire the traffic change data corresponding to the device to be identified;

[0104] Based on traffic flow change data, determine the device identification result corresponding to the device to be identified.

[0105] As can be seen, through the above optional embodiments, it is possible to first determine whether the device to be identified is a known device and the device type based on the MLP identification model, and then determine the identification result of the device based on traffic change data after identifying it as an unknown device. This can achieve more accurate device identification and help to fully combine device traffic data to identify the device, so as to achieve more accurate and secure device identification and access.

[0106] As an optional embodiment, the step of determining the device identification result corresponding to the device to be identified based on the traffic change data in the above steps includes:

[0107] Based on similarity clustering, a stable traffic set is selected from all traffic data;

[0108] The stable traffic set is input into the MLP identification model to obtain the device information of the closest known device;

[0109] Determine the historical traffic data corresponding to the device information from the preset device traffic database;

[0110] Calculate the first similarity between the stable traffic set and the historical traffic data;

[0111] Determine whether the first similarity is greater than the first similarity threshold. If so, determine that the device identification result of the device to be identified is a safe result and the device type corresponding to the device information.

[0112] If not, the stable traffic set is input into the trained data risk identification neural network to obtain the data hazard parameters corresponding to the stable traffic set. When the data hazard parameters are greater than the first parameter threshold, the device identification result of the device to be identified is determined to be a dangerous result and the data hazard parameters are determined to be safe. When the data hazard parameters are less than the first parameter threshold, the device identification result of the device to be identified is determined to be safe result and the data hazard parameters are determined to be safe.

[0113] As can be seen, through the above optional embodiments, the device identification result can be determined based on traffic change data based on similarity clustering and similarity calculation and judgment, which can achieve more accurate device identification and help to fully combine device traffic data to identify devices, so as to achieve more accurate and secure device identification and access.

[0114] As an optional embodiment, the step above, filtering out a stable traffic set from all traffic data based on similarity clustering, includes:

[0115] For any two time points in the traffic change data, calculate the second similarity between the two traffic data points.

[0116] Based on the second similarity and clustering algorithm, all traffic data are clustered to obtain a stable traffic set; optionally, the second similarity between any two traffic data in the stable traffic set is greater than the second similarity threshold, and the second similarity between any traffic data in the stable traffic set and any traffic data in the unstable traffic set is less than the third similarity threshold; the third similarity threshold is less than the second similarity threshold.

[0117] As can be seen, through the above optional embodiments, a set of stable traffic can be determined based on the similarity calculation and clustering algorithm between traffic data, so as to achieve more accurate device identification in the future, and assist in fully combining device traffic data to identify devices, so as to achieve more accurate and secure device identification and access.

[0118] As an optional embodiment, the step above, determining the access policy of the device to be identified based on the device identification result and the preset correspondence between the result and the policy, includes:

[0119] When the device identification result is a safe result, the access policy of the device to be identified is determined to be direct access to the target local area network;

[0120] When the device identification result is a dangerous result, it is determined whether the data danger parameter is greater than the second parameter threshold to obtain the judgment result; optionally, the second parameter threshold is greater than the first parameter threshold.

[0121] If the judgment result is yes, the access policy of the device to be identified is determined to be to deny access to the target local area network;

[0122] If the judgment result is negative, calculate the difference between the device firewall performance parameters and data danger parameters of each candidate relay device to obtain the device priority corresponding to each candidate relay device;

[0123] The candidate relay device with the highest device priority is identified as the target relay device, and the access policy for the device to be identified is to access the target local area network via the target relay device.

[0124] As can be seen, through the above optional embodiments, a more secure access strategy can be determined based on multiple judgments of device identification results and the intervention of relay devices, so as to achieve more accurate and secure device identification and access by fully combining device traffic data.

[0125] Example 2

[0126] Please see Figure 2 , Figure 2 This is a schematic diagram of the structure of a local area network device identification system based on machine learning, as disclosed in an embodiment of the present invention. Figure 2The described machine learning-based LAN device identification system can be applied to data processing systems / data processing devices / data processing servers (wherein, the server includes a local processing server or a cloud processing server). For example... Figure 2 As shown, the machine learning-based local area network device identification system may include:

[0127] The acquisition module 201 is used to acquire device traffic data of the device to be identified in response to the access request of the device to be identified.

[0128] The preprocessing module 202 is used to preprocess the device flow data to obtain processed data.

[0129] The recognition module 203 is used to input the processed data into the trained MLP recognition model to obtain the device recognition result of the device to be recognized.

[0130] Optionally, the MLP recognition model is trained using a training dataset that includes multiple training device parameters, training traffic data, and corresponding device recognition result annotations.

[0131] The execution module 204 is used to determine the access policy of the device to be identified based on the device identification result and the preset correspondence between the result and the policy, and to execute the access policy.

[0132] As can be seen, the above-described embodiments of the invention can preprocess the device traffic data of the device to be identified to obtain processed data, and then input the processed data into the trained MLP recognition model to obtain the device recognition result. Based on the device recognition result and the correspondence between the preset result and strategy, a reasonable and accurate access strategy is determined, thereby fully combining the device traffic data to identify the device, so as to achieve more accurate and secure device identification and access.

[0133] As an optional embodiment, device traffic data includes IP address, MAC address, device type, protocol type, traffic volume, device performance parameters, and historical device transmission data.

[0134] As can be seen, the above optional embodiments define the content of the device parameters to comprehensively characterize the features of the device to be identified, and assist in fully combining device traffic data to identify the device, so as to achieve more accurate and secure device identification and access.

[0135] As an optional embodiment, the preprocessing module preprocesses the device traffic data to obtain the processed data in the following specific ways:

[0136] For any part of the device traffic data, determine the data type corresponding to that part of the data; optionally, the data type can be numeric data or text data.

[0137] Based on the predefined correspondence between data types and preprocessing methods, the data preprocessing method corresponding to this part of the data is determined according to the data type; optionally, the data preprocessing method is a normalization method or a word representation processing method; the normalization method is a z-score normalization method or a min-max normalization method; the word representation processing method is a bag-of-words model processing method or a word vector model processing method.

[0138] Based on the corresponding data preprocessing method, all parts of the device traffic data are processed to obtain the processed data.

[0139] As can be seen, the above optional embodiments define the content of the preprocessing steps, enabling comprehensive data preprocessing of device traffic data based on the preprocessing method corresponding to the data type. This facilitates subsequent device identification and helps to fully integrate device traffic data for device identification, thereby achieving more accurate and secure device identification and access.

[0140] As an optional embodiment, the MLP recognition model adopts a three-layer fully connected MLP model structure, uses the ReLU function as the activation function, and uses the softmax function for classification in the output layer. In the training and optimization of the model, the cross-entropy loss function and the Adam optimizer are used, and the L2 regularization algorithm is used to prevent overfitting.

[0141] As can be seen, the structure and training details of the MLP recognition model are defined through the above optional embodiments, which can achieve more accurate device recognition and help to fully combine device traffic data to identify devices, so as to achieve more accurate and secure device recognition and access.

[0142] As an optional embodiment, the specific method by which the recognition module inputs the processed data into the trained MLP recognition model to obtain the device recognition result of the device to be recognized includes:

[0143] The processed data is input into the trained MLP recognition model to obtain the first recognition result corresponding to the device to be recognized;

[0144] When the first identification result is a known device, the device identification result of the device to be identified is determined to be a security result and the device type of the known device is determined;

[0145] When the first identification result is an unknown device, acquire the traffic change data corresponding to the device to be identified;

[0146] Based on traffic flow change data, determine the device identification result corresponding to the device to be identified.

[0147] As can be seen, through the above optional embodiments, it is possible to first determine whether the device to be identified is a known device and the device type based on the MLP identification model, and then determine the identification result of the device based on traffic change data after identifying it as an unknown device. This can achieve more accurate device identification and help to fully combine device traffic data to identify the device, so as to achieve more accurate and secure device identification and access.

[0148] As an optional embodiment, the identification module determines the specific method of the device identification result corresponding to the device to be identified based on traffic change data, including:

[0149] Based on similarity clustering, a stable traffic set is selected from all traffic data;

[0150] The stable traffic set is input into the MLP identification model to obtain the device information of the closest known device;

[0151] Determine the historical traffic data corresponding to the device information from the preset device traffic database;

[0152] Calculate the first similarity between the stable traffic set and the historical traffic data;

[0153] Determine whether the first similarity is greater than the first similarity threshold. If so, determine that the device identification result of the device to be identified is a safe result and the device type corresponding to the device information.

[0154] If not, the stable traffic set is input into the trained data risk identification neural network to obtain the data hazard parameters corresponding to the stable traffic set. When the data hazard parameters are greater than the first parameter threshold, the device identification result of the device to be identified is determined to be a dangerous result and the data hazard parameters are determined to be safe. When the data hazard parameters are less than the first parameter threshold, the device identification result of the device to be identified is determined to be safe result and the data hazard parameters are determined to be safe.

[0155] As can be seen, through the above optional embodiments, the device identification result can be determined based on traffic change data based on similarity clustering and similarity calculation and judgment, which can achieve more accurate device identification and help to fully combine device traffic data to identify devices, so as to achieve more accurate and secure device identification and access.

[0156] As an optional embodiment, the identification module uses similarity clustering to filter out a stable set of traffic from all traffic data in the following ways:

[0157] For any two time points in the traffic change data, calculate the second similarity between the two traffic data points.

[0158] Based on the second similarity and clustering algorithm, all traffic data are clustered to obtain a stable traffic set; optionally, the second similarity between any two traffic data in the stable traffic set is greater than the second similarity threshold, and the second similarity between any traffic data in the stable traffic set and any traffic data in the unstable traffic set is less than the third similarity threshold; the third similarity threshold is less than the second similarity threshold.

[0159] As can be seen, through the above optional embodiments, a set of stable traffic can be determined based on the similarity calculation and clustering algorithm between traffic data, so as to achieve more accurate device identification in the future, and assist in fully combining device traffic data to identify devices, so as to achieve more accurate and secure device identification and access.

[0160] As an optional embodiment, the execution module determines the specific method of the access policy for the device to be identified based on the device identification result and the preset correspondence between the result and the policy, including:

[0161] When the device identification result is a safe result, the access policy of the device to be identified is determined to be direct access to the target local area network;

[0162] When the device identification result is a dangerous result, it is determined whether the data danger parameter is greater than the second parameter threshold to obtain the judgment result; optionally, the second parameter threshold is greater than the first parameter threshold.

[0163] If the judgment result is yes, the access policy of the device to be identified is determined to be to deny access to the target local area network;

[0164] If the judgment result is negative, calculate the difference between the device firewall performance parameters and data danger parameters of each candidate relay device to obtain the device priority corresponding to each candidate relay device;

[0165] The candidate relay device with the highest device priority is identified as the target relay device, and the access policy for the device to be identified is to access the target local area network via the target relay device.

[0166] As can be seen, through the above optional embodiments, a more secure access strategy can be determined based on multiple judgments of device identification results and the intervention of relay devices, so as to achieve more accurate and secure device identification and access by fully combining device traffic data.

[0167] Example 3

[0168] Please see Figure 3 , Figure 3 This is another local area network device identification system based on machine learning disclosed in the embodiments of the present invention. Figure 3The described machine learning-based LAN device identification system is applied to data processing systems / data processing devices / data processing servers (wherein, the server includes a local processing server or a cloud processing server). For example... Figure 3 As shown, the machine learning-based local area network device identification system may include:

[0169] Memory 301 storing executable program code;

[0170] Processor 302 coupled to memory 301;

[0171] The processor 302 calls the executable program code stored in the memory 301 to execute the steps of the machine learning-based local area network device identification method described in Embodiment 1.

[0172] Example 4

[0173] This invention discloses a computer read storage medium that stores a computer program for electronic data interchange, wherein the computer program causes a computer to execute the steps of the machine learning-based local area network device identification method described in Embodiment 1.

[0174] Example 5

[0175] This invention discloses a computer program product, which includes a non-transitory computer-readable storage medium storing a computer program, and the computer program is operable to cause a computer to perform the steps of the machine learning-based local area network device identification method described in Embodiment 1.

[0176] The foregoing has described specific embodiments of this specification; other embodiments are within the scope of the appended claims. In some cases, the actions or steps described in the claims may be performed in a different order than those shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily have to follow the specific or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0177] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, a computer can be, for example, a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email device, game console, tablet computer, wearable device, or any combination of these devices.

[0178] For ease of description, the above devices are described in terms of function, divided into various units. Of course, in implementing this specification, the functions of each unit can be implemented in one or more software and / or hardware components.

[0179] Those skilled in the art will understand that the embodiments of this specification can be provided as methods, systems, or computer program products. Therefore, the embodiments of this specification can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the embodiments of this specification can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0180] This specification is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this specification. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create a machine for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0181] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0182] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0183] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0184] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0185] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0186] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0187] This specification can be described in the general context of computer-executable instructions that are executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform a specific task or implement a specific abstract data type. This specification can also be practiced in distributed computing environments, where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0188] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

[0189] Finally, it should be noted that the machine learning-based local area network device identification method and system disclosed in the embodiments of the present invention are merely preferred embodiments of the present invention and are only used to illustrate the technical solutions of the present invention, not to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for identifying local area network devices based on machine learning, characterized in that, The method includes: In response to an access request from a device to be identified, obtain the device traffic data of the device to be identified; The device flow data is preprocessed to obtain processed data; The processed data is input into the trained MLP recognition model to obtain the device recognition result of the device to be recognized, including: The processed data is input into the trained MLP recognition model to obtain the first recognition result corresponding to the device to be recognized; When the first identification result is a known device, the device identification result of the device to be identified is determined to be a security result and the device type of the known device is determined; When the first identification result is an unknown device, obtain the traffic change data corresponding to the device to be identified; Based on similarity clustering, a stable traffic set is selected from all the traffic data; The stable traffic set is input into the MLP identification model to obtain the device information of the closest known device; Determine the historical traffic data corresponding to the device information from a preset device traffic database; Calculate the first similarity between the stable traffic set and the historical traffic data; Determine whether the first similarity is greater than the first similarity threshold. If so, determine that the device identification result of the device to be identified is a security result and the device type corresponding to the device information. If not, the stable traffic set is input into the trained data risk identification neural network to obtain the data hazard parameter corresponding to the stable traffic set. When the data hazard parameter is greater than a first parameter threshold, the device identification result of the device to be identified is determined to be a dangerous result and the data hazard parameter is determined. When the data hazard parameter is less than the first parameter threshold, the device identification result of the device to be identified is determined to be a safe result and the data hazard parameter is determined. The MLP identification model is trained using a training dataset that includes multiple training device parameters, training traffic data, and corresponding device identification result annotations. Based on the device identification results and the preset correspondence between results and policies, the access policy for the device to be identified is determined and the access policy is executed.

2. The machine learning-based local area network device identification method according to claim 1, characterized in that, The device traffic data includes IP address, MAC address, device type, protocol type, traffic volume, device performance parameters, and historical transmission data.

3. The machine learning-based local area network device identification method according to claim 1, characterized in that, The preprocessing of the device traffic data to obtain processed data includes: For any portion of the device traffic data, determine the data type corresponding to that portion of data; the data type is either numerical data or text data. Based on the predefined correspondence between data types and preprocessing methods, the data preprocessing method corresponding to this part of the data is determined according to the data type; the data preprocessing method is a normalization method or a word representation processing method; the normalization method is a z-score normalization method or a min-max normalization method; the word representation processing method is a bag-of-words model processing method or a word vector model processing method. Based on the corresponding data preprocessing method, all parts of the device traffic data are processed to obtain processed data.

4. The machine learning-based local area network device identification method according to claim 1, characterized in that, The MLP recognition model adopts a three-layer fully connected MLP model structure, uses the ReLU function as the activation function, and uses the softmax function for classification in the output layer. In the training and optimization of the model, the cross-entropy loss function and the Adam optimizer are used, and the L2 regularization algorithm is used to prevent overfitting.

5. The machine learning-based local area network device identification method according to claim 1, characterized in that, The step of selecting a stable traffic set from all the traffic data based on similarity clustering includes: For any two time points in the traffic change data, calculate the second similarity between the two traffic data points; Based on the second similarity and clustering algorithm, all the traffic data are clustered to obtain a stable traffic set; wherein, the second similarity between any two traffic data in the stable traffic set is greater than the second similarity threshold, and the second similarity between any traffic data in the stable traffic set and any traffic data not in the stable traffic set is less than the third similarity threshold; the third similarity threshold is less than the second similarity threshold.

6. The machine learning-based local area network device identification method according to claim 1, characterized in that, The step of determining the access strategy for the device to be identified based on the device identification result and the preset correspondence between the result and the strategy includes: When the device identification result is a safe result, the access policy of the device to be identified is determined to be direct access to the target local area network; When the device identification result is a dangerous result, it is determined whether the data danger parameter is greater than the second parameter threshold, and a judgment result is obtained; the second parameter threshold is greater than the first parameter threshold. When the determination result is yes, the access policy of the device to be identified is determined to be to refuse access to the target local area network; If the judgment result is negative, calculate the difference between the device firewall performance parameter and the data danger parameter of each candidate relay device to obtain the device priority corresponding to each candidate relay device; The candidate relay device with the highest priority is identified as the target relay device, and the access policy for the device to be identified is to access the target local area network via the target relay device.

7. A local area network device identification system based on machine learning, characterized in that, The system includes: The acquisition module is used to acquire device traffic data of the device to be identified in response to the access request of the device to be identified; The preprocessing module is used to preprocess the device flow data to obtain processed data; The recognition module is used to input the processed data into the trained MLP recognition model to obtain the device recognition result of the device to be recognized, including: The processed data is input into the trained MLP recognition model to obtain the first recognition result corresponding to the device to be recognized; When the first identification result is a known device, the device identification result of the device to be identified is determined to be a security result and the device type of the known device is determined; When the first identification result is an unknown device, obtain the traffic change data corresponding to the device to be identified; Based on similarity clustering, a stable traffic set is selected from all the traffic data; The stable traffic set is input into the MLP identification model to obtain the device information of the closest known device; Determine the historical traffic data corresponding to the device information from a preset device traffic database; Calculate the first similarity between the stable traffic set and the historical traffic data; Determine whether the first similarity is greater than the first similarity threshold. If so, determine that the device identification result of the device to be identified is a security result and the device type corresponding to the device information. If not, the stable traffic set is input into the trained data risk identification neural network to obtain the data hazard parameter corresponding to the stable traffic set. When the data hazard parameter is greater than a first parameter threshold, the device identification result of the device to be identified is determined to be a dangerous result and the data hazard parameter is determined. When the data hazard parameter is less than the first parameter threshold, the device identification result of the device to be identified is determined to be a safe result and the data hazard parameter is determined. The MLP identification model is trained using a training dataset that includes multiple training device parameters, training traffic data, and corresponding device identification result annotations. The execution module is used to determine the access policy of the device to be identified based on the device identification result and the preset correspondence between the result and the policy, and to execute the access policy.

8. A local area network device identification system based on machine learning, characterized in that, The system includes: Memory containing executable program code; A processor coupled to the memory; The processor calls the executable program code stored in the memory to execute the machine learning-based local area network device identification method as described in any one of claims 1-6.

Images