Equipment classification method and device, chip and computer readable storage medium

Abstract

The invention discloses an equipment classification method and device, a chip and a computer readable storage medium, and relates to the technical field of Internet of Things. The method comprises the following steps: acquiring a device fingerprint of the Internet of Things device based on a message related to the Internet of Things device; identifying the device fingerprint by using the reference classification model to obtain the type of the Internet of Things device; wherein the reference classification model is obtained by adjusting parameters of the random forest model by using a grey wolf optimization algorithm and a genetic optimization algorithm, the grey wolf optimization algorithm and the genetic optimization algorithm are used for controlling the complexity of the random forest model, and the grey wolf optimization algorithm is also used for controlling the type identification accuracy of the random forest model. By controlling the complexity of the random forest model, the conditions of over-fitting and under-fitting of the obtained reference classification model can be avoided, and by controlling the type identification accuracy of the random forest model, the type identification accuracy of the obtained reference classification model can be relatively high.

Description

Technical Field

[0001] The present application relates to the technical field of Internet of Things, and in particular to a device classification method, device, chip and computer-readable storage medium. Background Art

[0002] IoT spatial asset mapping includes the operation of classifying and managing IoT devices in the IoT. As the scale and complexity of IoT devices continue to increase, the difficulty of classifying IoT devices continues to increase, which makes it increasingly difficult to conduct IoT spatial asset mapping. Therefore, a device classification method is urgently needed to achieve more accurate identification of IoT devices. Summary of the invention

[0003] The present application provides a device classification method, apparatus, chip and computer-readable storage medium for classifying IoT devices. The technical solution is as follows:

[0004] In a first aspect, a device classification method is provided, the method comprising: obtaining a device fingerprint of an IoT device based on messages related to the IoT device; identifying the device fingerprint by using a reference classification model to obtain the type of the IoT device; wherein the reference classification model is obtained by adjusting the parameters of a random forest model by using a gray wolf optimization algorithm and a genetic optimization algorithm, the gray wolf optimization algorithm and the genetic optimization algorithm are used to control the complexity of the random forest model, and the gray wolf optimization algorithm is also used to control the type recognition accuracy of the random forest model.

[0005] In some embodiments, the parameters of the random forest model include the total number of decision trees, the maximum depth of the decision tree, the minimum number of samples required for node splitting, and the minimum number of samples required for leaf nodes, wherein the total number of decision trees is related to the type recognition accuracy of the random forest model, and the maximum depth of the decision tree, the minimum number of samples required for node splitting, and the minimum number of samples required for leaf nodes are related to the complexity of the random forest model; before using the reference classification model to identify the device fingerprint and obtain the type of the IoT device, it also includes: using the gray wolf optimization algorithm to iterate the total number of decision trees and the minimum number of samples required for node splitting M times, and using the total number of decision trees and the minimum number of samples required for node splitting after M iterations as the total number of decision trees and the minimum number of samples required for node splitting used by the reference classification model, M is a positive integer; using the genetic optimization algorithm to iterate the maximum depth of the decision tree and the minimum number of samples required for leaf nodes N times, and using the maximum depth of the decision tree and the minimum number of samples required for leaf nodes after N iterations as the maximum depth of the decision tree and the minimum number of samples required for leaf nodes used by the reference classification model, N is a positive integer.

[0006] In some embodiments, a gray wolf optimization algorithm is used to iterate the total number of decision trees and the minimum number of samples required for node splitting M times, including: using the gray wolf optimization algorithm, based on the total number of decision trees and the minimum number of samples required for node splitting, a gray wolf group is created, the gray wolf group including a first gray wolf, a second gray wolf, a third gray wolf and a fourth gray wolf; according to the calculation method of the gray wolf optimization algorithm, the positions of the first gray wolf, the second gray wolf, the third gray wolf and the fourth gray wolf are iterated M times, wherein the position of the fourth gray wolf is obtained based on the position of the first gray wolf, a first weight corresponding to the first gray wolf, the position of the second gray wolf, the second weight corresponding to the second gray wolf, the position of the third gray wolf and the third weight corresponding to the third gray wolf, wherein the first weight, the second weight and the third weight are all determined based on the position of the first gray wolf, the position of the second gray wolf and the position of the third gray wolf; based on the positions of the first gray wolf, the second gray wolf, the third gray wolf and the fourth gray wolf after M iterations, the total number of decision trees after M iterations and the minimum number of samples required for node splitting are obtained.

[0007] In some embodiments, the value of the reference parameter used by the gray wolf optimization algorithm is determined based on the number of iterations executed in the M iterations, and the value of the reference parameter represents the degree of influence of the gray wolf group behavior.

[0008] In some embodiments, the value of the reference parameter is determined according to a reference formula, which includes an exponential function part and a random number part. The value of the exponential function part is determined according to the number of iterations executed, and the value of the exponential function part decreases as the number of iterations executed increases. The value of the random number part is determined according to the number of iterations executed.

[0009] In some embodiments, after the type of the IoT device is obtained by identifying the device fingerprint using a reference classification model, it also includes: when the type of the IoT device is a known type, determining the network isolation level of the IoT device to be a trusted network level, and the network communication of the IoT device at the trusted network level is not restricted; when the type of the IoT device is an unknown type, determining the network isolation level of the IoT device to be a restricted network level, and the network communication of the IoT device at the restricted network level is restricted.

[0010] In a second aspect, a device classification device is provided, which includes: an acquisition module for acquiring a device fingerprint of an IoT device based on a message related to the IoT device; a classification module for identifying the device fingerprint by using a reference classification model to obtain the type of the IoT device; wherein the reference classification model is obtained by adjusting the parameters of a random forest model by using a gray wolf optimization algorithm and a genetic optimization algorithm, the gray wolf optimization algorithm and the genetic optimization algorithm are used to control the complexity of the random forest model, and the gray wolf optimization algorithm is also used to control the type recognition accuracy of the random forest model.

[0011] In some embodiments, the parameters of the random forest model include the total number of decision trees, the maximum depth of the decision tree, the minimum number of samples required for node splitting, and the minimum number of samples required for leaf nodes, wherein the total number of decision trees is related to the type recognition accuracy of the random forest model, and the maximum depth of the decision tree, the minimum number of samples required for node splitting, and the minimum number of samples required for leaf nodes are related to the complexity of the random forest model; the acquisition module is also used to use the gray wolf optimization algorithm to iterate the total number of decision trees and the minimum number of samples required for node splitting M times, and use the total number of decision trees and the minimum number of samples required for node splitting after M iterations as the total number of decision trees and the minimum number of samples required for node splitting used by the reference classification model, M is a positive integer; use the genetic optimization algorithm to iterate the maximum depth of the decision tree and the minimum number of samples required for leaf nodes N times, and use the maximum depth of the decision tree and the minimum number of samples required for leaf nodes after N iterations as the maximum depth of the decision tree and the minimum number of samples required for leaf nodes used by the reference classification model, N is a positive integer.

[0012] In some embodiments, an acquisition module is used to use a gray wolf optimization algorithm to create a gray wolf group based on the total number of decision trees and the minimum number of samples required for node splitting, the gray wolf group including a first gray wolf, a second gray wolf, a third gray wolf and a fourth gray wolf; according to the calculation method of the gray wolf optimization algorithm, the positions of the first gray wolf, the second gray wolf, the third gray wolf and the fourth gray wolf are iterated M times, wherein the position of the fourth gray wolf is obtained based on the position of the first gray wolf, the first weight corresponding to the first gray wolf, the position of the second gray wolf, the second weight corresponding to the second gray wolf, the position of the third gray wolf and the third weight corresponding to the third gray wolf, wherein the first weight, the second weight and the third weight are all determined based on the position of the first gray wolf, the second gray wolf and the third gray wolf; based on the positions of the first gray wolf, the second gray wolf, the third gray wolf and the fourth gray wolf after M iterations, the total number of decision trees after M iterations and the minimum number of samples required for node splitting are obtained.

[0013] In some embodiments, the value of the reference parameter used by the gray wolf optimization algorithm is determined based on the number of iterations executed in the M iterations, and the value of the reference parameter represents the degree of influence of the gray wolf group behavior.

[0014] In some embodiments, the value of the reference parameter is determined according to a reference formula, which includes an exponential function part and a random number part. The value of the exponential function part is determined according to the number of iterations executed, and the value of the exponential function part decreases as the number of iterations executed increases. The value of the random number part is determined according to the number of iterations executed.

[0015] In some embodiments, the classification module is also used to determine that the network isolation level of the IoT device is a trusted network level when the type of the IoT device is a known type, and the network communication of the IoT device at the trusted network level is not restricted; and to determine that the network isolation level of the IoT device is a restricted network level when the type of the IoT device is an unknown type, and the network communication of the IoT device at the restricted network level is restricted.

[0016] In a third aspect, a chip is provided, the chip including a processor, the processor being used to call and execute instructions stored in a memory from the memory, so that a device equipped with the chip executes any device classification method in the first aspect.

[0017] According to a fourth aspect, an electronic device is provided, wherein the electronic device comprises the chip according to the third aspect.

[0018] In a fifth aspect, a computer-readable storage medium is provided, in which at least one computer program is stored. The at least one computer program is loaded and executed by a processor of an electronic device so that the electronic device implements any device classification method in the above-mentioned first aspect.

[0019] In a sixth aspect, a computer program product or a computer program is provided, wherein the computer program product or the computer program includes computer instructions, and the computer instructions are stored in a computer-readable storage medium. A processor of an electronic device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the electronic device performs any device classification method in the first aspect.

[0020] The technical solution provided by this application brings at least the following beneficial effects:

[0021] In the method provided in the embodiment of the present application, by using the gray wolf optimization algorithm and the genetic optimization algorithm to control the complexity of the random forest model, it is possible to avoid overfitting and underfitting of the obtained reference classification model, and by using the gray wolf optimization algorithm to control the type recognition accuracy of the random forest model, it is possible to make the type recognition accuracy of the obtained reference classification model higher. Thus, the classification performance of the obtained reference classification model is better. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0023] Figure 1It is a schematic diagram of an implementation environment provided by an embodiment of the present application;

[0024] Figure 2 is a flow chart of a device classification method provided in an embodiment of the present application;

[0025] Figure 3 is a schematic diagram of a device fingerprint provided in an embodiment of the present application;

[0026] Figure 4 It is a schematic diagram of the accuracy of multiple classification models provided in an embodiment of the present application for classifying multiple IoT devices;

[0027] Figure 5 This is a schematic diagram of a process for identifying an IoT device provided by an embodiment of the present application;

[0028] Figure 6 It is a flow chart of parameter optimization provided by an embodiment of the present application;

[0029] Figure 7 It is a schematic diagram of another parameter optimization process provided in an embodiment of the present application;

[0030] Figure 8 It is a schematic diagram of the overall change trend of a reference parameter C provided in an embodiment of the present application;

[0031] Fig. 9 is a schematic diagram of a type recognition accuracy rate provided in an embodiment of the present application;

[0032] Fig.10 is a schematic diagram of another type of recognition accuracy provided by an embodiment of the present application;

[0033] Fig.11 is a schematic diagram of a device classification report provided in an embodiment of the present application;

[0034] Fig.12 It is a schematic diagram of a classification prediction confusion matrix provided in an embodiment of the present application;

[0035] Fig.13 It is a structural schematic diagram of a device classification apparatus provided in an embodiment of the present application;

[0036] Fig.14 It is a structural schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0037] In order to make the objectives, technical solutions and advantages of the present application clearer, the implementation methods of the present application will be further described in detail below in conjunction with the accompanying drawings.

[0038] In recent years, the Internet of Things (IoT) technology has developed rapidly around the world and has become one of the important landmark technologies of the industrial revolution. However, due to the wide variety of IoT devices, different communication protocol standards, and the wide and complex distribution of devices, it is difficult to identify the types of IoT devices. In addition, IoT devices are vulnerable to network attacks and security vulnerabilities. Therefore, IoT devices need to be managed from a security perspective. In addition, as the scale and complexity of IoT devices continue to grow, traditional asset mapping methods have limitations in the performance of classifying IoT devices based on device fingerprint recognition, especially when faced with high-dimensional data and large-scale device networks. The accuracy of traditional asset mapping methods in identifying device types is low.

[0039] This application proposes a device classification method for identifying the type of IoT devices. Figure 1 Schematic diagram of an implementation environment provided by the embodiment of the present application. Figure 1 As shown, the implementation environment includes a security gateway 101 and multiple IoT devices 102. The multiple IoT devices 102 are located in the IoT, and the security gateway 101 is located between the IoT and the external network. The security gateway 101 can manage the multiple IoT devices 102 and obtain messages sent or received by the multiple IoT devices 102. Figure 1 The number of IoT devices 102 shown is for example only, and the security gateway 101 can be connected to more IoT devices 102, which is not limited in the embodiments of the present application. The IoT device 102 can be a smart coffee machine, a smart surveillance camera, or a smart lighting system. Those skilled in the art should understand that the types of the above-mentioned IoT devices 102 are for example only, and other existing or future IoT devices that are applicable to the present application should also be included in the scope of protection of the present application and are included here by reference.

[0040] The device classification method provided in the embodiment of the present application can be as follows Figure 2 This method can be applied to Figure 1 As shown in the security gateway 101 , the method includes but is not limited to step 201 and step 202 .

[0041] Step 201, based on messages related to the IoT device, obtain the device fingerprint of the IoT device.

[0042] In some embodiments, based on messages related to the IoT devices, obtaining a device fingerprint of the IoT device includes: extracting communication protocol features and field features of the messages of the IoT devices, and generating a device fingerprint of the IoT device based on the communication protocol features and field features. In an embodiment of the present application, the device fingerprint of the IoT device can be embodied in a device fingerprint feature matrix. The device fingerprint of the IoT device includes independent identity information of the IoT device.

[0043] The embodiments of the present application do not limit the method for obtaining messages related to IoT devices. Messages related to IoT devices include: messages received and / or sent by IoT devices. Exemplarily, obtaining messages related to IoT devices includes: capturing network data messages from the IoT network space, filtering messages based on the media access control (MAC) address of the network data messages, and obtaining messages related to IoT devices. Among them, the network data messages can be obtained from the IoT network space by using non-intrusive network monitoring technology, and the obtained messages related to the IoT devices can be stored in a .pcap format file. Exemplarily, the type of IoT device is used as a data tag of the IoT device, and the types of IoT devices are shown in Table 1.

[0044] Table 1

[0045]

[0046]

[0047] In some embodiments, the extracted communication protocol features include: protocol features of the network layer, protocol features of the transport layer, and protocol features of the application layer; the extracted field features include: Internet protocol (IP) options, data packet length, data load, IP address, and port type. Among them, the data load can be called raw data. Exemplarily, the security gateway 101 obtains the network data message in the Internet of Things network space, extracts the communication protocol features and field features of the network message, and constructs an Internet of Things space asset feature pool. The Internet of Things space asset feature pool may include 23 features, as shown in Table 2.

[0048] Table 2

[0049]

[0050]

[0051] By extracting multiple features from network data packets, the extracted feature types are relatively rich and comprehensive, so that the device fingerprint generated based on the extracted multiple features has a high accuracy in identifying the device type.

[0052] In one possible implementation, after the communication protocol features and field features are extracted, the extracted communication protocol features and field features are encoded according to the IoT space asset feature pool shown in Table 2 to obtain a coding result, and the device fingerprint of the IoT device is obtained based on the coding result. The coding result can be used to indicate whether the message related to the IoT device includes the 23 features in Table 2. The embodiment of the present application does not limit the specific coding method and the specific form of the coding result. For example, the coding result of each communication protocol feature is represented by a single digit, and the coding result of other field features in the field feature except the data packet length is represented by a single digit, and the coding result of the data packet length is the same as the specific value of the data packet length. That is, the data packet length remains unchanged.

[0053] Taking the Aria type IoT device as an example, the encoding results obtained based on the messages related to this type of IoT device are shown in Table 3.

[0054] Table 3

[0055]

[0056]

[0057] In a possible implementation, after obtaining the encoding result, the device fingerprint of the IoT device is obtained based on multiple encoding results. For example, a feature matrix of the device fingerprint of the IoT device is constructed based on multiple encoding results, and the feature matrix is ​​expanded horizontally to obtain a one-dimensional fingerprint vector containing multiple dimensions, and the one-dimensional fingerprint vector is used as the obtained device fingerprint. By obtaining the device fingerprint of the IoT device based on multiple encoding results, the reliability of the device fingerprint uniquely identifying the IoT device is high.

[0058] Exemplarily, based on 12 consecutive messages of the IoT device, communication protocol feature extraction, field feature extraction, and encoding of the extracted communication protocol features and field features are respectively performed to obtain encoding results, and the device fingerprint of the IoT device is obtained based on the obtained 12 encoding results. By obtaining the device fingerprint of the IoT device based on the 12 encoding results, it is ensured that the reliability of the device fingerprint uniquely identifying the IoT device is high, and it is avoided that too many encoding results cause the device fingerprint to be too large, which in turn leads to excessive time complexity for identifying the device fingerprint.

[0059] Still taking the Aria type IoT device as an example, the feature matrix F1 of the device fingerprint of this IoT device is a 12*23 dimensional matrix, as shown below:

[0060]

[0061] The feature matrix F1 is expanded horizontally by row vectors to obtain a one-dimensional vector with 276 dimensions, which is used as a feature fingerprint to identify the Aria type IoT device. For other types of IoT devices in Table 1, the generation method of the device fingerprint of the IoT device is the same as the generation principle of the device fingerprint of the Aria type IoT device, which will not be repeated here.

[0062] Exemplarily, the number of device fingerprints of each type of IoT device is one or more. For example, for the same type of IoT device, multiple operations of obtaining relevant messages of the IoT device are performed, and based on the relevant messages of the IoT device, the device fingerprint of the IoT device is obtained to obtain multiple device fingerprints of the same type of IoT device. The device fingerprints of each type of IoT device can be as follows: Figure 3 shown.

[0063] Step 202, by using a reference classification model, the device fingerprint is identified to obtain the type of the IoT device; wherein the reference classification model is obtained by adjusting the parameters of the random forest model by using a grey wolf optimization algorithm and a genetic optimization algorithm, the grey wolf optimizer (GWO) algorithm and the genetic optimization algorithm (GA) are used to control the complexity of the random forest model, and the grey wolf optimization algorithm is also used to control the type recognition accuracy of the random forest model.

[0064] For example, the device fingerprint is input into the reference classification model, and the type of the IoT device output by the reference classification model is used as the type of the IoT device obtained. In the method provided in the embodiment of the present application, by using the gray wolf optimization algorithm and the genetic optimization algorithm to control the complexity of the random forest model, it is possible to avoid overfitting and underfitting of the obtained reference classification model, and by using the gray wolf optimization algorithm to control the type recognition accuracy of the random forest model, it is possible to make the type recognition accuracy of the obtained reference classification model higher. Thus, the classification performance of the obtained reference classification model is better.

[0065] In a possible implementation, the reference classification model is stored in a device-classifier dictionary. The device-classifier dictionary may include multiple classification models, and may also include corresponding relationships between various classification models and device types. For any pair of classification models and device types that have corresponding relationships, this classification model is the classification model with the highest accuracy in identifying this device type among multiple classification models.

[0066] Next, the algorithms corresponding to the various classification models and the parameter values ​​related to the algorithms are described. The algorithms corresponding to the various classification models and the parameter values ​​related to the algorithms can be shown in Table 4.

[0067] Table 4

[0068]

[0069]

[0070] The meanings of the parameters shown in Table 4 can be found in the relevant technology and will not be further described here.

[0071] Exemplarily, the classification models corresponding to the algorithms in Table 4 are obtained to identify the device fingerprints of various types of IoT devices, and the classification accuracy of each classification model for each type of IoT device is obtained, so as to compare the performance of each classification model in classifying IoT devices. Figure 4 It is a schematic diagram of the accuracy of classifying multiple IoT devices using multiple classification models provided in an embodiment of the present application. Figure 4 It is a three-dimensional bar chart, in which, for each IoT device among multiple IoT devices, the accuracy of various classification models in classifying this IoT device is arranged in the order of RF algorithm, MLP algorithm, KNN algorithm, SVM algorithm, GNB algorithm and XGBoost algorithm from front to back. For each type of IoT device, Figure 4 The algorithm corresponding to the classification model with the highest classification accuracy among the six classification models is marked in.

[0072] according to Figure 4 The three-dimensional bar chart shows that for most types of IoT devices, the classification model based on the RF algorithm or the XGBoost algorithm has a higher recognition accuracy for the type of IoT devices. After comparative analysis, the main reason why the classification model based on these two algorithms has a better recognition effect is that both algorithms belong to the category of ensemble learning algorithms. The main idea is to combine multiple different machine learning models to integrate multiple weak learners into a strong learner for learning and training, thereby improving the classification prediction accuracy and stability of the algorithm. Therefore, it is more suitable for processing high-dimensional data and data sets with a large number of discrete features, while maintaining good scalability. Therefore, among the six algorithms shown in Table 4, the type recognition accuracy of IoT devices is higher.

[0073] Therefore, for any IoT device, the classification model with the highest type recognition accuracy can be selected from the multiple classification models obtained based on multiple algorithms as the classification model corresponding to this IoT device, and this IoT device and its corresponding classification model are saved in the device-classifier dictionary in the form of a corresponding relationship. For example, the device type, the algorithm used by the classification model corresponding to the device type, and the accuracy of identifying the device type using the corresponding classification model are shown in Table 5.

[0074] Table 5

[0075]

[0076]

[0077] Therefore, by establishing a device-classifier dictionary with corresponding relationships, each IoT device corresponds to a classification model with high recognition accuracy, and the average classification accuracy of the dictionary can reach 93.12%. Based on the device-classifier dictionary, whenever a new type of IoT device is connected to the IoT space, by obtaining the message related to this IoT device, the device fingerprint of the IoT device is obtained based on the message related to the IoT device, and a classification model can be trained specifically for this device type without affecting any existing classification model in the device-classifier dictionary, thereby avoiding the classification model re-learning process and reducing the classification model training cost.

[0078] Furthermore, by constructing a device-classifier dictionary, when identifying the device fingerprint of an unknown IoT device, the IoT device can be discovered, identified, and managed more effectively. Figure 5 This is a schematic diagram of a process for identifying an IoT device provided by an embodiment of the present application. Figure 5 As shown, when a new IoT device is connected to the IoT, the security gateway will obtain the device fingerprint of the IoT device based on the message related to the IoT device, and then identify the device fingerprint based on the classification model included in the device-classifier dictionary.

[0079] Based on the type of IoT device identified, the security gateway can determine the network isolation level of this IoT device. For example, when the type of the IoT device is determined to be a known type, the network isolation level of the IoT device is a trusted network level. In the case where the type of the IoT device is not determined to be a known type based on a classification model included in the device-classifier dictionary, continue to use other classification models included in the device-classifier dictionary to identify the device fingerprint of the IoT device until the type of the IoT device is determined to be a known type or all classification models in the device-classifier dictionary are used. In the case where all classification models in the device-classifier field are used and the device type of the IoT device is determined to be an unknown type, the network isolation level of the IoT device is determined to be a restricted network level.

[0080] The network communications of IoT devices at the trusted network level are not restricted. For example, IoT devices at the trusted network level are able to freely communicate with other IoT devices in the IoT and have unrestricted access to the Internet. The network communications of IoT devices at the restricted network level are restricted. For example, IoT devices at the restricted network level cannot communicate with other IoT devices in the IoT and cannot access the Internet.

[0081] based on Figure 5 The content shown, in some embodiments, by using a reference classification model, the device fingerprint is identified to obtain the type of the Internet of Things device, the method also includes: when the type of the Internet of Things device is a known type, determining the network isolation level of the Internet of Things device to be a trusted network level, and the network communication of the Internet of Things device at the trusted network level is not restricted; when the type of the Internet of Things device is an unknown type, determining the network isolation level of the Internet of Things device to be a restricted network level, and the network communication of the Internet of Things device at the restricted network level is restricted.

[0082] By restricting the communication of unknown types of IoT devices, it is possible to prevent unknown types of IoT devices from causing harm to existing devices in the IoT, thereby ensuring the security of existing devices in the IoT.

[0083] Next, adjusting the parameters of the random forest model to obtain a reference classification model is described, wherein the random forest model refers to a classification model obtained based on the random forest algorithm. Since the reference classification model is obtained by adjusting the parameters of the random forest model using the grey wolf optimization algorithm and the genetic optimization algorithm, the reference classification model can be called a genetic grey wolf random forest (GGWRF) classification model.

[0084] In some embodiments, the parameters of the random forest model include the total number of decision trees, the maximum depth of the decision tree, the minimum number of samples required for node splitting, and the minimum number of samples required for leaf nodes, wherein the total number of decision trees is related to the type recognition accuracy of the random forest model, and the maximum depth of the decision tree, the minimum number of samples required for node splitting, and the minimum number of samples required for leaf nodes are related to the complexity of the random forest model.

[0085] The total number of decision trees can be represented by n_estimators. Generally speaking, the more decision trees there are, the better the classification performance of the random forest model will be, and the higher the recognition accuracy will be, but the training time cost will also increase, and overfitting may occur.

[0086] The maximum depth of the decision tree can be expressed by max_depth. Controlling the maximum depth of the decision tree can avoid overfitting. In addition, if the maximum depth of the decision tree is too small, underfitting may occur.

[0087] The minimum number of samples required for node splitting can be represented by min_samples_split. If the number of samples contained in a node is less than the minimum number of samples required for node splitting, the node will not split. By adjusting this parameter, the overall complexity of the decision tree can be controlled to prevent overfitting.

[0088] The minimum number of samples required for a leaf node can be expressed by min_samples_leaf. If a leaf node contains fewer samples than the minimum number of samples required for a leaf node, the leaf node will be pruned along with its sibling nodes. By adjusting this parameter, the complexity of the decision tree can also be controlled to avoid overfitting.

[0089] Exemplarily, by using the reference classification model, the device fingerprint is identified, and before the type of the IoT device is obtained, the method also includes: using the gray wolf optimization algorithm to iterate the total number of decision trees and the minimum number of samples required for node splitting M times, and using the total number of decision trees and the minimum number of samples required for node splitting after M iterations as the total number of decision trees and the minimum number of samples required for node splitting used by the reference classification model, M is a positive integer; using the genetic optimization algorithm to iterate the maximum depth of the decision tree and the minimum number of samples required for leaf nodes N times, and using the maximum depth of the decision tree and the minimum number of samples required for leaf nodes after N iterations as the maximum depth of the decision tree and the minimum number of samples required for leaf nodes used by the reference classification model, N is a positive integer. The specific values ​​of M and N can be determined based on experience or actual needs, and the values ​​of M and N can be the same. For example, M is 5 and N is 10.

[0090] Figure 6 Schematic diagram of a parameter optimization process provided by the embodiment of the present application. Figure 6 As shown, after the algorithm starts, the parameters of the reference classification model are initialized, wherein the parameters of the initialized reference classification model are the parameters of the random forest model to be adjusted. Then, the gray wolf optimization algorithm is used to optimize the overall number of decision trees and the minimum number of samples required for node splitting, and the optimization process is repeated until M iterations are completed. After that, the genetic optimization algorithm is used to optimize the parameter values ​​of the maximum depth of the decision tree and the minimum number of samples required for the leaf node, and the optimization process is repeated until N iterations are completed. After that, the final parameters of the reference classification model are obtained, the algorithm ends, and the parameters of the reference classification model are output.

[0091] Figure 6 The description is only given by taking the example of using the gray wolf optimization algorithm first and then the genetic optimization algorithm. In some embodiments, the genetic optimization algorithm may be used first and then the gray wolf optimization algorithm. For example, Figure 7 FIG. 1 is another flow chart of parameter optimization provided by an embodiment of the present application. Figure 7As shown, after the algorithm starts, the parameters of the reference classification model are initialized, wherein the parameters of the initialized reference classification model are the parameters of the random forest model to be adjusted. Then, the genetic optimization algorithm is used to optimize the parameter values ​​of the maximum depth of the decision tree and the minimum number of samples required for the leaf node, and the optimization process is repeated until N iterations are completed. After that, the gray wolf optimization algorithm is used to optimize the overall number of decision trees and the minimum number of samples required for node splitting, and the optimization process is repeated until M iterations are completed. After that, the final parameters of the reference classification model are obtained, the algorithm ends, and the parameters of the reference classification model are output.

[0092] In the embodiment of the present application, the gray wolf optimization algorithm for optimizing the parameters of the random forest model can be obtained by adjusting the traditional gray wolf optimization algorithm. As a swarm intelligence algorithm, the gray wolf optimization algorithm naturally has the problems of slow convergence speed and easy to fall into local optimality. Therefore, the embodiment of the present application can improve the traditional gray wolf optimization algorithm based on dynamic weights and time-varying acceleration constants, so as to improve the overall convergence speed of the gray wolf optimization algorithm while maintaining the strong global search capability of the gray wolf optimization algorithm.

[0093] Exemplarily, the gray wolf optimization algorithm is used to iterate the total number of decision trees and the minimum number of samples required for node splitting M times, including: using the gray wolf optimization algorithm, based on the total number of decision trees and the minimum number of samples required for node splitting, a gray wolf group is created, the gray wolf group includes a first gray wolf, a second gray wolf, a third gray wolf and a fourth gray wolf; according to the calculation method of the gray wolf optimization algorithm, the positions of the first gray wolf, the second gray wolf, the third gray wolf and the fourth gray wolf are iterated M times, wherein the position of the fourth gray wolf is obtained based on the position of the first gray wolf, a first weight corresponding to the first gray wolf, the position of the second gray wolf, the second weight corresponding to the second gray wolf, the position of the third gray wolf and the third weight corresponding to the third gray wolf, wherein the first weight, the second weight and the third weight are all determined based on the position of the first gray wolf, the position of the second gray wolf and the position of the third gray wolf; based on the positions of the first gray wolf, the second gray wolf, the third gray wolf and the fourth gray wolf after M iterations, the total number of decision trees after M iterations and the minimum number of samples required for node splitting are obtained.

[0094] The method for creating a gray wolf group based on the total number of decision trees and the minimum number of samples required for node splitting can refer to the method in the relevant technology, and the embodiment of the present application is not limited to this. In each iteration of the M iterations, the iteration goal is to improve the classification accuracy of the classification model obtained based on this iteration, wherein the classification model obtained based on this iteration refers to a random forest model using the total number of decision trees obtained in this iteration and the minimum number of samples required for node splitting.

[0095] Similar to the traditional gray wolf optimization algorithm, the first gray wolf can be called α wolf, the second gray wolf can be called β wolf, the third gray wolf can be called δ wolf, and the fourth gray wolf can be called ω wolf, wherein α wolf, β wolf, δ wolf and ω wolf have different social hierarchy status. In each iteration, the calculation method of the traditional gray wolf optimization algorithm includes: after obtaining the current position x1 of α wolf, the current position x2 of β wolf and the current position x3 of δ wolf, directly calculating the average value of x1, x2 and x3 to obtain the current position of ω wolf. However, since in the gray wolf optimization algorithm, α wolf, β wolf and δ wolf have different social hierarchy status, the method of directly calculating the average value ignores the difference in the degree of influence between α wolf, β wolf and δ wolf.

[0096] In the embodiment of the present application, in each iteration, the calculation process of the gray wolf optimization algorithm includes: calculating the weights corresponding to the α wolf, β wolf and δ wolf based on the current positions of the α wolf, β wolf and δ wolf, and then calculating the position of the ω wolf based on the current positions of the α wolf, β wolf and δ wolf and their corresponding weights. Exemplarily, the weight w1 corresponding to the α wolf, the weight w2 corresponding to the β wolf, the weight w3 corresponding to the δ wolf, and the current position X of the ω wolf are shown in the following formula:

[0097]

[0098] X=(w1*x1+w2*x2+w3*x3) / 3.

[0099] By introducing the weight factors corresponding to α wolf, β wolf and δ wolf, the embodiment of the present application takes into account the difference in the degree of influence between α wolf, β wolf and δ wolf when calculating the position of ω wolf, and gives the gray wolf different team influences by weight, which is more in line with the actual natural situation, improves the model accuracy of the iterative process, and also enhances the adjustability and flexibility of the algorithm, and can make corresponding upgrade changes according to different scene requirements. This method of calculating the position of ω wolf can greatly improve the convergence speed of the gray wolf optimization algorithm, thereby improving the overall optimization performance of the algorithm.

[0100] In some embodiments, the calculation process of the gray wolf optimization algorithm also involves the calculation of reference parameters, and the value of the reference parameter represents the degree of influence of the gray wolf group behavior. In the traditional gray wolf optimization algorithm, the calculation formula of the reference parameter is fixed, and the value is equal to twice the distance between the current gray wolf and its neighboring gray wolf. Therefore, the coefficient value of the reference parameter is any value in the interval [0,2]. When the value of the reference parameter is greater than 1, it means that the current location of the gray wolf has a greater impact on the hunting target. When the value of the reference parameter is less than 11, it means that its influence weight is relatively small. This parameter calculation ensures the global search randomness of the gray wolf optimization algorithm.

[0101] In an embodiment of the present application, the calculation method of the reference parameter refers to the idea of ​​differential mean perturbation in the particle swarm optimization algorithm, and the value of the reference parameter is determined based on the number of iterations executed in the M iterations. By determining the value of the reference parameter based on the number of iterations executed, the Gray Wolf Optimization Algorithm can better adapt to changes in the function. Exemplarily, the value of the reference parameter is determined according to a reference formula, and the reference formula includes an exponential function part and a random number part. The value of the exponential function part is determined according to the number of iterations executed, and the value of the exponential function part decreases as the number of iterations executed increases. The value of the random number part is determined according to the number of iterations executed. For example, the reference parameter C is calculated according to the following formula:

[0102] C=0.5+0.5*(exp(-iter / 500))+1.4*(sin(iter) / 30);

[0103] Where iter represents the number of iterations executed. The first part of the formula is a constant term of 0.5; the second part is an exponential function, whose function value gradually approaches the value of 0 from 0.5 as the number of iterations executed increases; the third part is a sine function, whose function value fluctuates continuously between the interval [-1,1], making the value change of the reference parameter C random. In the embodiment of the present application, the reference parameter C can be called a time-varying acceleration coefficient, and the overall change trend of the reference parameter C is as follows: Figure 8 shown.

[0104] The embodiment of the present application uses a time-varying acceleration coefficient to make the Gray Wolf Optimization Algorithm better adapt to changes in functions: when multiple local optimal solutions appear in the optimization process of the Gray Wolf Optimization Algorithm, the time-varying acceleration coefficient can assist the algorithm to jump out of the current local optimal solution more quickly, thereby expanding the search range of the optimal solution. In addition, the calculation method of the reference parameter C used in the embodiment of the present application can also speed up the convergence speed of the algorithm, avoiding long-term oscillation or stagnation of the coefficient value during the calculation process, thereby improving the reliability and overall stability of the Gray Wolf Optimization Algorithm. The Gray Wolf Optimization Algorithm provided in the embodiment of the present application shows higher robustness and flexibility on complex data sets.

[0105] Exemplarily, the calculation process of the genetic optimization algorithm can refer to the content in the relevant technology. For example, using the genetic optimization algorithm, based on the maximum depth of the decision tree and the minimum number of samples required for the leaf node, a population is created, and the population is iterated N times according to the calculation method of the genetic optimization algorithm. For example, in each iteration process, two elite individuals are retained, and the probability of genetic mutation is 5%. In each iteration of the N iterations, the iteration goal is to improve the classification accuracy of the classification model obtained based on this iteration, wherein the classification model obtained based on this iteration refers to a random forest model using the maximum depth of the decision tree obtained in this iteration and the minimum number of samples required for the leaf node.

[0106] By optimizing the total number of decision trees, the maximum depth of decision trees, the minimum number of samples required for node splitting, and the minimum number of samples required for leaf nodes, the number of parameters of the random forest model that need to be adjusted is reduced, thereby reducing the time to obtain a reference classification model.

[0107] In addition, by using the reference classification model for type recognition, the accuracy of the types of IoT devices obtained is high, with an average classification accuracy of 93.12%. The present application embodiment tested the type recognition accuracy of the reference classification model and compared it with the type recognition accuracy of the random forest model obtained based on the random forest classification algorithm in Table 4. The comparison results are shown in Figure 4. Fig. 9 As shown. Fig. 9 Among the two type recognition accuracy rates corresponding to various types of IoT devices shown, the type recognition accuracy rate on the left is obtained by using the random forest model, and the type recognition accuracy rate on the right is obtained by using the reference classification model.

[0108] refer to Fig. 9 Compared with the random forest model, the type recognition accuracy of the reference classification model has been significantly improved on various devices, with the overall performance improvement ranging from 0.43% to 18.73%, and the average type recognition accuracy has increased by 4.59%. This shows that the reference classification model has better type recognition performance in the type recognition of IoT devices than the original random forest model, which verifies the classification efficiency and performance advantages of the reference classification model.

[0109] Fig.10 It is a schematic diagram of another type of recognition accuracy provided in an embodiment of the present application. Fig.10Among the three types of recognition accuracy corresponding to various types of IoT devices shown, the type recognition accuracy on the left is obtained by using the first classification model, which is obtained by adjusting the parameters of the random forest model using the particle swarm algorithm, the type recognition accuracy in the middle is obtained by using the second classification model, which is obtained by adjusting the parameters of the random forest model using the simulated annealing algorithm, and the type recognition accuracy on the right is obtained by using the reference classification model. Fig.10 The comparative data shown shows that: compared with the effect of adjusting the parameters of the random forest model through the simulated annealing algorithm or the particle swarm algorithm, the GGWRF algorithm uses the genetic optimization algorithm and the gray wolf optimization algorithm to jointly adjust the parameters of the random forest model, and the type recognition ability of the reference classification model has a significant performance improvement on all types of IoT devices. This shows that the GGWRF algorithm often has better feature performance in the type recognition of IoT devices than other traditional global optimization algorithms, which verifies the classification efficiency of the reference classification model.

[0110] In addition, during the experiment, we printed out the classification reports of various types of IoT devices, checked the overfitting of data training, and generated the binary confusion matrix of the classification results. Taking the D-LinkCam type IoT device as an example, after obtaining the recognition accuracy (precision), recall rate (recall) and F1 score (f1-score) of the device type, the device classification report is as follows: Fig.11 shown. Fig.11 Precision, recall, f1-score, number of supported samples (support), accuracy (accuracy), maximum average (macroaverage, macro avg) and weighted average (weighted average, weighted avg) are shown.

[0111] The classification prediction confusion matrix of IoT devices of type D-LinkCam is as follows Fig.12 See Fig.12 , the number of false negative samples is 6, the number of false positive samples is 8, and the overall prediction accuracy is good. Among them, the false negative samples are samples predicted to be 0 and the actual value is 1, and the false positive samples are samples predicted to be 1 and the actual value is 0.

[0112] For example, when the reference classification model is used to identify the type of IoT devices, the type recognition accuracy scores of the reference classification model on the training set and the test set are shown in Table 6.

[0113] Table 6

[0114] Type recognition accuracy score on the training set 0.9204 Type recognition accuracy score on the test set 0.9388

[0115] As shown in Table 6, the type recognition accuracy scores of the reference classification model on the training set and the test set are comparable, indicating that no overfitting occurs in the process of using the reference classification model for type recognition.

[0116] See also Fig.13 The present application embodiment provides a device classification device, which can be applied to Figure 1 The security gateway 101 is shown. The device includes but is not limited to: an acquisition module 1301 and a classification module 1302.

[0117] An acquisition module 1301 is used to acquire a device fingerprint of an IoT device based on a message related to the IoT device;

[0118] The classification module 1302 is used to identify the device fingerprint by using a reference classification model to obtain the type of the IoT device; wherein the reference classification model is obtained by adjusting the parameters of the random forest model by using the gray wolf optimization algorithm and the genetic optimization algorithm, the gray wolf optimization algorithm and the genetic optimization algorithm are used to control the complexity of the random forest model, and the gray wolf optimization algorithm is also used to control the type recognition accuracy of the random forest model.

[0119] In some embodiments, the parameters of the random forest model include the total number of decision trees, the maximum depth of the decision tree, the minimum number of samples required for node splitting, and the minimum number of samples required for leaf nodes, wherein the total number of decision trees is related to the type recognition accuracy of the random forest model, and the maximum depth of the decision tree, the minimum number of samples required for node splitting, and the minimum number of samples required for leaf nodes are related to the complexity of the random forest model; the acquisition module 1301 is also used to use the gray wolf optimization algorithm to iterate the total number of decision trees and the minimum number of samples required for node splitting M times, and use the total number of decision trees and the minimum number of samples required for node splitting after M iterations as the total number of decision trees and the minimum number of samples required for node splitting used by the reference classification model, M is a positive integer; use the genetic optimization algorithm to iterate the maximum depth of the decision tree and the minimum number of samples required for leaf nodes N times, and use the maximum depth of the decision tree and the minimum number of samples required for leaf nodes after N iterations as the maximum depth of the decision tree and the minimum number of samples required for leaf nodes used by the reference classification model, N is a positive integer.

[0120] In some embodiments, an acquisition module 1301 is used to use a gray wolf optimization algorithm to create a gray wolf group based on the total number of decision trees and the minimum number of samples required for node splitting, the gray wolf group including a first gray wolf, a second gray wolf, a third gray wolf and a fourth gray wolf; according to the calculation method of the gray wolf optimization algorithm, the positions of the first gray wolf, the second gray wolf, the third gray wolf and the fourth gray wolf are iterated M times, wherein the position of the fourth gray wolf is obtained based on the position of the first gray wolf, the first weight corresponding to the first gray wolf, the position of the second gray wolf, the second weight corresponding to the second gray wolf, the position of the third gray wolf and the third weight corresponding to the third gray wolf, wherein the first weight, the second weight and the third weight are all determined based on the position of the first gray wolf, the position of the second gray wolf and the position of the third gray wolf; based on the positions of the first gray wolf, the second gray wolf, the third gray wolf and the fourth gray wolf after M iterations, the total number of decision trees after M iterations and the minimum number of samples required for node splitting are obtained.

[0121] In some embodiments, the value of the reference parameter used by the gray wolf optimization algorithm is determined based on the number of iterations executed in the M iterations, and the value of the reference parameter represents the degree of influence of the gray wolf group behavior.

[0122] In some embodiments, the value of the reference parameter is determined according to a reference formula, which includes an exponential function part and a random number part. The value of the exponential function part is determined according to the number of iterations executed, and the value of the exponential function part decreases as the number of iterations executed increases. The value of the random number part is determined according to the number of iterations executed.

[0123] In some embodiments, the classification module 1302 is also used to determine that the network isolation level of the IoT device is a trusted network level when the type of the IoT device is a known type, and the network communication of the IoT device at the trusted network level is not restricted; and to determine that the network isolation level of the IoT device is a restricted network level when the type of the IoT device is an unknown type, and the network communication of the IoT device at the restricted network level is restricted.

[0124] In the device provided in the embodiment of the present application, by using the gray wolf optimization algorithm and the genetic optimization algorithm to control the complexity of the random forest model, it is possible to avoid overfitting and underfitting of the obtained reference classification model, and by using the gray wolf optimization algorithm to control the type recognition accuracy of the random forest model, it is possible to make the type recognition accuracy of the obtained reference classification model higher. Thus, the classification performance of the obtained reference classification model is better.

[0125] Fig.14 is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. The electronic device can be Figure 1The security gateway 101 shown. Electronic devices may have relatively large differences due to different configurations or performances. For example, the electronic device includes one or more processors 1401 and one or more memories 1402, wherein the processor 1401 may be a central processing unit (CPU), and at least one computer program is stored in one or more memories 1402, and at least one computer program is loaded and executed by one or more processors 1401, so that the electronic device implements the device classification method provided by the above-mentioned various method embodiments. The electronic device may also have components such as a wired or wireless network interface, a keyboard, and an input and output interface for input and output. The electronic device may also include other components for implementing device functions, which will not be described in detail here.

[0126] In an exemplary embodiment, a chip is also provided. The chip includes a processor, and the processor is used to call and execute instructions stored in the memory from the memory, so that a device equipped with the chip executes any of the above-mentioned device classification methods.

[0127] In an exemplary embodiment, an electronic device is also provided, the electronic device includes the above chip. In an exemplary embodiment, an electronic device is also provided, the electronic device includes a processor and a memory, and at least one computer program is stored in the memory. The at least one computer program is loaded and executed by one or more processors to enable the electronic device to implement any of the above device classification methods.

[0128] In an exemplary embodiment, a computer-readable storage medium is further provided, in which at least one computer program is stored. The at least one computer program is loaded and executed by a processor of an electronic device to enable the electronic device to implement any of the above-mentioned device classification methods.

[0129] In one possible implementation, the computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a compact disc (CD-ROM), a magnetic tape, a floppy disk, an optical data storage device, etc.

[0130] In an exemplary embodiment, a computer program product or a computer program is also provided, the computer program product or the computer program includes computer instructions, and the computer instructions are stored in a computer-readable storage medium. A processor of an electronic device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the electronic device performs any of the above-mentioned device classification methods.

[0131] It should be noted that the information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data used for analysis, stored data, displayed data, etc.) and signals involved in this application are all authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards of relevant countries and regions.

[0132] It should be understood that the "plurality" mentioned in this article refers to two or more. "And / or" describes the association relationship of the associated objects, indicating that there can be three relationships. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the associated objects are in an "or" relationship.

[0133] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the terms used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein.

[0134] The embodiments described in the above exemplary embodiments do not represent all embodiments consistent with the present application. Instead, they are only examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0135] The above are merely exemplary embodiments of the present application and are not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the principles of the present application shall be included in the protection scope of the present application.

Claims

1. A device classification method, characterized in that: The method comprises: Based on messages related to the IoT device, obtain a device fingerprint of the IoT device; The device fingerprint is identified by using a reference classification model to obtain the type of the Internet of Things device; wherein the reference classification model is obtained by adjusting the parameters of the random forest model by using a gray wolf optimization algorithm and a genetic optimization algorithm, the gray wolf optimization algorithm and the genetic optimization algorithm are used to control the complexity of the random forest model, and the gray wolf optimization algorithm is also used to control the type recognition accuracy of the random forest model.

2. The method according to claim 1, characterized in that The parameters of the random forest model include the total number of decision trees, the maximum depth of the decision tree, the minimum number of samples required for node splitting, and the minimum number of samples required for leaf nodes, wherein the total number of decision trees is related to the type recognition accuracy of the random forest model, and the maximum depth of the decision tree, the minimum number of samples required for node splitting, and the minimum number of samples required for leaf nodes are related to the complexity of the random forest model; Before the device fingerprint is identified by using a reference classification model to obtain the type of the IoT device, the method further includes: Using the gray wolf optimization algorithm to iterate the total number of decision trees and the minimum number of samples required for node splitting M times, and using the total number of decision trees and the minimum number of samples required for node splitting after M iterations as the total number of decision trees and the minimum number of samples required for node splitting used by the reference classification model, where M is a positive integer; The genetic optimization algorithm is used to iterate the maximum depth of the decision tree and the minimum number of samples required for the leaf nodes N times, and the maximum depth of the decision tree and the minimum number of samples required for the leaf nodes after N iterations are used as the maximum depth of the decision tree and the minimum number of samples required for the leaf nodes used by the reference classification model, where N is a positive integer.

3. The method according to claim 2, characterized in that The gray wolf optimization algorithm is used to iterate the total number of the decision tree and the minimum number of samples required for node splitting M times, including: Using the gray wolf optimization algorithm, based on the total number of the decision tree and the minimum number of samples required for node splitting, a gray wolf group is created, wherein the gray wolf group includes a first gray wolf, a second gray wolf, a third gray wolf, and a fourth gray wolf; According to the calculation method of the gray wolf optimization algorithm, the positions of the first gray wolf, the second gray wolf, the third gray wolf and the fourth gray wolf are iterated M times, wherein the position of the fourth gray wolf is obtained based on the position of the first gray wolf, the first weight corresponding to the first gray wolf, the position of the second gray wolf, the second weight corresponding to the second gray wolf, the position of the third gray wolf and the third weight corresponding to the third gray wolf, wherein the first weight, the second weight and the third weight are all determined based on the position of the first gray wolf, the position of the second gray wolf and the position of the third gray wolf; Based on the positions of the first gray wolf, the second gray wolf, the third gray wolf and the fourth gray wolf after M iterations, the total number of the decision tree after M iterations and the minimum number of samples required for node splitting are obtained.

4. The method according to claim 2 or 3, characterized in that: The value of the reference parameter used in the gray wolf optimization algorithm is determined based on the number of iterations executed in the M iterations, and the value of the reference parameter represents the degree of influence of the gray wolf group behavior.

5. The method according to claim 4, characterized in that: The value of the reference parameter is determined according to a reference formula, which includes an exponential function part and a random number part. The value of the exponential function part is determined according to the number of iterations executed, and the value of the exponential function part decreases as the number of iterations executed increases. The value of the random number part is determined according to the number of iterations executed.

6. The method according to any one of claims 1 to 3 and 5, characterized in that: After the device fingerprint is identified by using a reference classification model to obtain the type of the IoT device, the method further includes: In the case where the type of the IoT device is a known type, determining that the network isolation level of the IoT device is a trusted network level, and the network communication of the IoT device at the trusted network level is not restricted; In a case where the type of the Internet of Things device is an unknown type, the network isolation level of the Internet of Things device is determined to be a restricted network level, and the network communication of the Internet of Things device at the restricted network level is restricted.

7. A device classification device, characterized in that: The device comprises: An acquisition module, used to acquire a device fingerprint of the IoT device based on a message related to the IoT device; A classification module is used to identify the device fingerprint by using a reference classification model to obtain the type of the Internet of Things device; wherein the reference classification model is obtained by adjusting the parameters of the random forest model by using a gray wolf optimization algorithm and a genetic optimization algorithm, the gray wolf optimization algorithm and the genetic optimization algorithm are used to control the complexity of the random forest model, and the gray wolf optimization algorithm is also used to control the type recognition accuracy of the random forest model.

8. A chip, characterized in that: The chip includes a processor, and the processor is used to call and execute instructions stored in the memory from the memory, so that a device equipped with the chip executes the device classification method as described in any one of claims 1-6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores at least one computer program, and the at least one computer program is loaded and executed by a processor of a computer, so that the computer implements the device classification method according to any one of claims 1 to 6.

10. A computer program product, characterized in that The computer program product includes computer instructions, which are stored in a computer-readable storage medium. The processor of the electronic device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the electronic device executes the device classification method as described in any one of claims 1-6.

Images