Deep learning assisted GOIP model automatic identification and data extraction method

Abstract

The invention discloses a deep learning-assisted GOIP model automatic identification and data extraction method, and the method specifically comprises the steps: obtaining a login page of a management page of GOIP equipment through a webpage downloading technology, enabling the GOIP equipment to be in a power-on networking state, and building a connection through a network interface; inputting the HTML code of the login page into a trained deep neural network model, wherein the deep neural network model automatically analyzes and extracts features according to the HTML code; and the deep neural network model outputs the model of the GOIP equipment, and calls a preset webpage downloading template to perform data extraction on the model. According to the method, the HTML code features of the login page are analyzed through the deep neural network model, accurate identification of the equipment model is realized, then data extraction is performed by adopting a customization strategy, and the efficiency and accuracy of electronic data evidence obtaining are effectively improved.

Description

Technical Field

[0001] The present invention relates to the field of Internet of Things forensic security, and in particular, to a method for automatic GOIP model identification and data extraction assisted by deep learning in dealing with complex, unlabeled GOIP device model identification and data extraction problems. Background Art

[0002] With the rapid advancement of network communication technology, GOIP devices, as a key component of modern communication architecture, have become the preferred solution for efficient and flexible communication by converting traditional telephone signals into network signals. However, this device is also used by criminals due to its powerful functions to carry out various illegal activities. The model identification and data extraction of GOIP devices are of great significance in the field of electronic data forensics, especially when faced with the challenge of maliciously damaged device labels, which renders traditional identification methods ineffective.

[0003] As a device that plays an important role in communication, how to obtain data in the device will become a hot topic with the development of Internet technology. At present, there is no universal method for determining the model of unlabeled GOIP. Therefore, finding a universal model automatic identification method is of great significance to electronic data forensics. Summary of the invention

[0004] In view of the above shortcomings, the present invention proposes a method for automatic identification and data extraction of GOIP models assisted by deep learning. The HTML code features of the login page are analyzed by a deep neural network model to achieve accurate identification of the device model, and then a customized strategy is used for data extraction, which effectively improves the efficiency and accuracy of electronic data forensics. The specific steps are as follows:

[0005] The login page of the management page of the GOIP device is obtained by using web page download technology, the device status of the GOIP device is powered on and connected to the network, and a connection is established through the network port;

[0006] Inputting the HTML code of the login page into a trained deep neural network model, wherein the deep neural network model automatically analyzes and extracts features based on the HTML code;

[0007] The deep neural network model outputs the model of the GOIP device and calls a pre-set web page download template to extract data from the model.

[0008] Furthermore, the web page downloading technology is specifically represented by obtaining the specified web page content by sending an HTTP request, and saving the specified network content to a local device, wherein the specific steps of obtaining the specified web page content by sending an HTTP request include: using Python's requests library to send various types of HTTP requests, processing server responses, and using an HTML parser to parse and extract required information, wherein a network crawler or framework is used to automate the web page downloading and data extraction process.

[0009] Furthermore, the specific steps of training the deep neural network model are to input the vector x i Mapped to GOIP device model y i The specific formula of the model is expressed as follows:

[0010] f(x i ,θ)=y i

[0011] Among them, θ represents the parameter set of the neural network, f represents the trained deep neural network model, and x i represents the input vector, y i Indicates the GOIP device model.

[0012] During the training process, it is necessary to minimize the gap between the predicted value and the true value. The loss function L(θ) is usually used to measure this gap:

[0013]

[0014] Among them, l represents the loss function of a single sample, N represents the total number of all samples, f(x i ,θ) represents the model output of a single sample, y i Indicates the GOIP device model.

[0015] In order to find the parameter θ that minimizes L(θ), the stochastic gradient descent (SGD) method is used for iterative updates:

[0016]

[0017] Among them, γ represents the learning rate, represents the gradient of the loss function with respect to θ, and t represents the number of iterations.

[0018] Furthermore, considering the complexity and heterogeneity of HTML code, it is necessary to extract multi-level features, which can be achieved by building a multi-layer neural network model, where the output h of the mth layer is m (x) is expressed as:

[0019] h m (x) = σ(Wm h m-1 (x)+b m )

[0020] Among them, σ represents the activation function, W m represents the weight of the mth layer, b m Represents the bias term of the mth layer.

[0021] Through such a multi-layer model, features from low-level to high-level can be gradually extracted to more comprehensively understand the structure and pattern of HTML code.

[0022] According to a second aspect of the present invention, a computer program product is provided, on which one or more computer programs are stored. When the one or more computer programs are executed by a computer processor, the above method is implemented.

[0023] The above one or more technical solutions in the embodiments of the present application have at least one of the following technical effects:

[0024] The deep learning-assisted GOIP model identification method proposed in this invention constructs a deep neural network model to automatically learn and identify complex HTML features, effectively overcoming the limitations of traditional methods in dealing with label-free device identification. Compared with the method based on feature value comparison, it has the following technical effects:

[0025] 1) High accuracy: The deep learning model can process complex HTML features and improve recognition accuracy.

[0026] 2) High robustness: The model is highly resistant to variations and noise in HTML code.

[0027] 3) High degree of automation: The entire identification process is automated, reducing manual involvement and improving efficiency.

[0028] 4) Wide adaptability: It can adapt to different types of GOIP devices and has good versatility and scalability.

[0029] In addition, the present invention also proposes a GOIP data extraction optimization strategy based on deep learning, which selects the most suitable webpage download template according to the automatically identified device model, realizes high-efficiency and high-precision data extraction, and provides strong technical support for the field of electronic data forensics. This method not only provides a new idea for model identification of GOIP devices, but also opens up a new path for the automated and intelligent processing of electronic data forensics in complex network environments. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] The accompanying drawings are included to provide a further understanding of the embodiments and are incorporated into and constitute a part of this specification. The accompanying drawings illustrate the embodiments and are used together with the description to explain the principles of the present invention. It will be easy to recognize other embodiments and many expected advantages of the embodiments because they become better understood by reference to the following detailed description. The elements of the drawings are not necessarily to scale with each other. The same reference numerals refer to corresponding similar parts.

[0031] Figure 1 A flow chart of a method for automatic GOIP model identification and data extraction assisted by deep learning according to an embodiment of the present invention is shown.

[0032] Figure 2 It is a structural diagram of a computer system suitable for implementing an electronic device of an embodiment of the present application. DETAILED DESCRIPTION

[0033] The present application will be further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are only used to explain the relevant invention, rather than to limit the invention. It should also be noted that, for ease of description, only the parts related to the relevant invention are shown in the accompanying drawings.

[0034] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0035] Figure 1 A flowchart of a method for automatic GOIP model identification and data extraction assisted by deep learning according to an embodiment of the present invention is shown, as shown in FIG. Figure 1 As shown:

[0036] The login page of the management page of the GOIP device is obtained by using web page download technology, the device status of the GOIP device is powered on and connected to the network, and a connection is established through the network port;

[0037] The specific process of web page downloading technology is to obtain the specified web page content by sending HTTP requests and save it to the local device. Python's requests library is used to send various types of HTTP requests and process server responses. At the same time, HTML parsers such as Beautiful Soup or lxml are used to parse and extract the required information. In addition, specialized web crawling tools or frameworks such as Scrapy are used to automate the web page downloading and data extraction process. These technologies support data mining, offline browsing, and the establishment of complete website mirrors or archives.

[0038] In order to overcome the limitations of traditional feature value comparison, the present invention introduces deep learning technology, and uses the powerful pattern recognition ability of deep neural networks to perform multi-level, high-dimensional feature learning and analysis on the HTML code of the login page. First, by collecting a large number of GOIP device login page samples, an HTML code feature database is constructed, covering the login page features of different models of devices. Furthermore, these data are used to train a deep neural network model, which can automatically extract and learn key features in HTML code, such as specific structural patterns, coding habits, annotation information, etc., to achieve high-precision identification of device models. Compared with traditional rule-based feature comparison methods, deep learning models can handle more complex and variable features, improve recognition accuracy and robustness, and the specific steps are as follows:

[0039] Inputting the HTML code of the login page into a trained deep neural network model, wherein the deep neural network model automatically analyzes and extracts features based on the HTML code;

[0040] In this embodiment, the experiment has N login page samples. The HTML code of each sample i can be represented as a vector, where i = 1, 2, ..., N. The purpose is to learn a mapping through a deep neural network model f to map the input to the predicted value of the device model. The deep neural network is represented as follows:

[0041] f(x i ,θ)=y i

[0042] Among them, θ represents the parameter set of the neural network, f represents the trained deep neural network model, and x i represents the input vector, y i Indicates the GOIP device model.

[0043] During the training process, it is necessary to minimize the gap between the predicted value and the true value. The loss function L(θ) is usually used to measure this gap:

[0044]

[0045] Among them, l represents the loss function of a single sample, which may use cross entropy loss, mean square error, etc., N represents the total number of all samples, f(x i ,θ) represents the model output of a single sample, y i Indicates the GOIP device model.

[0046] In order to find the minimum parameter, the gradient descent method or its variants are usually used for iterative update. In this embodiment, stochastic gradient descent (SGD) is used:

[0047]

[0048] Among them, γ represents the learning rate, represents the gradient of the loss function with respect to θ, and t represents the number of iterations.

[0049] In order to meet the complexity and heterogeneity of HTML code, it is necessary to extract multi-level features. This is achieved by building a multi-layer neural network model, where the output h of the mth layer is m (x) is expressed as:

[0050] h m (x) = σ(W m h m-1 (x)+b m )

[0051] Among them, σ represents the activation function, W m represents the weight of the mth layer, b m Represents the m-th layer bias term. Through the above multi-layer model, we can gradually extract features from low-level to high-level to more comprehensively understand the structure and pattern of HTML code.

[0052] The deep neural network model outputs the model of the GOIP device and calls a pre-set web page download template to extract data from the model.

[0053] After data extraction, the data is stored and the trained model is deployed to the production environment. It can be deployed through cloud services (such as AWS SageMaker), local servers or edge devices. When new GOIP device images or videos are input, the deployed model is used for real-time reasoning and outputs the device model.

[0054] A corresponding webpage download template is created for each known GOIP device model. The template should include how to access the target website, login method, navigation path, and specific data extraction rules (such as XPath expressions, CSS selectors, etc.).

[0055] In some business embodiments, data storage also includes data monitoring and maintenance: regularly checking the prediction accuracy of the model and the response time of the service to ensure the stable operation of the system; updating the template library in a timely manner with the emergence of new equipment models to ensure that the system can adapt to changes, and establishing a feedback mechanism to allow users to report problems or make suggestions for improvements to continuously optimize system functions.

[0056] In summary, the deep learning-assisted GOIP model automatic identification and data extraction method proposed in the present invention effectively improves the efficiency and accuracy of electronic data forensics through automatic learning and identification of HTML features by deep neural networks and customized data extraction strategies based on device models, and has important theoretical value and application prospects.

[0057] Reference below Figure 2 , which shows a schematic diagram of the structure of a computer system 200 suitable for implementing an electronic device of an embodiment of the present application. Figure 2 The electronic device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0058] like Figure 2 As shown, the computer system 200 includes a central processing unit (CPU) 201, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 202 or a program loaded from a storage part 208 into a random access memory (RAM) 203. In the RAM 203, various programs and data required for the operation of the system 200 are also stored. The CPU 201, the ROM 202, and the RAM 203 are connected to each other via a bus 204. An input / output (I / O) interface 205 is also connected to the bus 204.

[0059] The following components are connected to the I / O interface 205: an input section 206 including a keyboard, a mouse, etc.; an output section 207 including a liquid crystal display (LCD), etc. and a speaker, etc.; a storage section 208 including a hard disk, etc.; and a communication section 209 including a network interface card such as a LAN card, a modem, etc. The communication section 209 performs communication processing via a network such as the Internet. A drive 210 is also connected to the I / O interface 205 as needed. A removable medium 211, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 210 as needed, so that a computer program read therefrom is installed into the storage section 208 as needed.

[0060] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a computer-readable storage medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 209, and / or installed from the removable medium 211. When the computer program is executed by the central processing unit (CPU) 201, the above functions defined in the method of the present application are executed. It should be noted that the computer-readable storage medium of the present application can be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium can be, for example, - but not limited to - an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to, an electrical connection with one or more conductors, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, device, or device. In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, in which a computer-readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A computer-readable signal medium may also be any computer-readable storage medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, device, or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wireless, wireline, optical cable, RF, etc., or any suitable combination of the foregoing.

[0061] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0062] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0063] The modules involved in the embodiments of the present application may be implemented by software or by hardware.

[0064] As another aspect, the present application also provides a computer-readable storage medium, which may be included in the electronic device described in the above embodiment; or it may exist independently without being assembled into the electronic device. The above computer-readable storage medium carries one or more programs. When the above one or more programs are executed by the electronic device, the electronic device: obtains the login page of the management page of the GOIP device using web page download technology, the device status of the GOIP device is powered on and connected to the network, and a connection is established through a network port; the HTML code of the login page is input into a trained deep neural network model, and the deep neural network model automatically analyzes and extracts features according to the HTML code; the deep neural network model outputs the model of the GOIP device, and calls a pre-set web page download template to extract data from the model.

[0065] The above description is only a preferred embodiment of the present application and an explanation of the technical principles used. Those skilled in the art should understand that the scope of the invention involved in the present application is not limited to the technical solution formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above invention concept. For example, the above features are replaced with the technical features with similar functions disclosed in this application (but not limited to) by each other to form a technical solution.

Claims

1. A deep learning-assisted GOIP model automatic identification and data extraction method, characterized in that: include: The login page of the management page of the GOIP device is obtained by using web page download technology, the device status of the GOIP device is powered on and connected to the network, and a connection is established through the network port; Inputting the HTML code of the login page into a trained deep neural network model, wherein the deep neural network model automatically analyzes and extracts features based on the HTML code; The deep neural network model outputs the model of the GOIP device and calls a pre-set web page download template to extract data from the model.

2. The method according to claim 1, characterized in that The web page downloading technology is specifically represented by obtaining the specified web page content by sending an HTTP request, and saving the specified web page content to a local device.

3. The method according to claim 2, characterized in that The specific steps of obtaining the specified web page content by sending HTTP requests include: using Python's requests library to send various types of HTTP requests, processing server responses, and using an HTML parser to parse and extract required information, wherein a network crawler or framework is used to automate the web page download and data extraction process.

4. The method according to claim 1, characterized in that: The specific steps of training the deep neural network model are to transform the input vector x i Mapped to GOIP device model y i The specific formula of the model is expressed as follows: f(x i ,θ)=y i Among them, θ represents the parameter set of the neural network, f represents the trained deep neural network model, and x i represents the input vector, y i Indicates the GOIP device model.

5. The method according to claim 4, characterized in that The specific steps of the deep neural network model in the training process are to minimize the predicted value f(x i ,θ) and the true value y i The gap between them is calculated, and the loss function L(θ) is used to measure the gap, wherein the specific formula of the loss function L(θ) is expressed as: Among them, l represents the loss function of a single sample, N represents the total number of all samples, f(x i ,θ) represents the model output of a single sample, y i Indicates the GOIP device model.

6. The method according to claim 5, characterized in that The loss function L(θ) uses the stochastic gradient descent method to find the minimum parameter θ, wherein the specific formula of the stochastic gradient descent method is as follows: Among them, γ represents the learning rate, represents the gradient of the loss function with respect to θ, and t represents the number of iterations.

7. The method according to claim 4, characterized in that The deep neural network model constructs a multi-level deep neural network model based on the extracted multi-level features, wherein the output h of the mth layer m (x) is expressed as: h m (x)=σ(W m h m-1 (x)+b m ) Among them, σ represents the activation function, W m represents the weight of the mth layer, b m Represents the bias term of the mth layer.

8. The method according to claim 7, characterized in that The specific process of extracting the multi-level features is to gradually extract features from low-level to high-level.

9. A computer program product, characterized in that A computer program is stored thereon, and when the computer program is executed by a processor, the method according to any one of claims 1 to 8 is implemented.

10. A computing system, characterized in that: The method comprises a processor and a memory, wherein the processor is configured to execute the method according to any one of claims 1 to 8.

Images