Iot device identification method and system based on flag implicit features

Abstract

The present application relates to the technical field of Internet of Things device identification, and particularly relates to an Internet of Things device identification method and system based on flag implicit features, which comprises a fingerprint library construction stage and a device identification stage; in the fingerprint library construction stage, a fingerprint library is constructed by preprocessing, feature vector construction, feature vector extraction and feature weight calculation of a set of HTTP / HTTPS response message headers collected with manufacturer and type labels; in the device identification stage, the manufacturer and type of a target device are obtained by calculating the similarity between the header of the HTTP / HTTPS response message of the target device and the entries in the fingerprint library. The present application automatically constructs a fingerprint library by taking the combination, value and distinguishability of the HTTP response message header as the implicit features of the device. The present application can automatically construct a fingerprint library for devices without obvious features in the service flag, filling the gap of traditional methods. Compared with the method based on artificial intelligence classification, the present application has better interpretability and scalability.

Description

Technical Field

[0001] This invention relates to the field of Internet of Things (IoT) device identification technology, and in particular to an IoT device identification method and system based on flag latent features. Background Technology

[0002] With the rapid development of IoT technology, the number of IoT devices in cyberspace is exploding, impacting all aspects of human society. Statista predicts that by 2025, the number of IoT devices will reach approximately 75.44 billion, playing a vital role in industrial production, home life, and intelligent transportation. However, limited by computing resources and working environments, IoT devices generally lack security protection technologies and management methods, leading to frequent security incidents targeting them. Malware specifically targeting IoT device vulnerabilities is constantly emerging, and large numbers of these devices are even controlled by attackers and used as springboards for large-scale DDoS attacks. Accurate identification of IoT devices is fundamental to security activities such as risk assessment, threat awareness, and vulnerability protection, and is crucial for improving the security level of the IoT.

[0003] Currently, IoT device identification primarily employs two methods: precise pattern matching and artificial intelligence-based classification. Precise pattern matching methods, such as Nmap and SinFP, identify devices by comparing information obtained through port scanning with entries in a fingerprint database. This method sends request messages following specific application protocols (such as HTTP, FTP, POP3, etc.) to specific IP addresses and ports, extracts flags containing distinctive information from the received response messages, and performs precise pattern matching with entries in a pre-established fingerprint database. The final identification result is based on the device attributes (such as manufacturer, type, model, etc.) carried in the matched fingerprint entries. Artificial intelligence-based classification methods generally learn classification models from features in device network traffic to identify devices. This method can be further divided into machine learning-based and deep learning-based methods. Machine learning-based methods require manual selection of traffic features based on expert experience and use algorithms such as Random Forest, KNN, and SVM to classify devices. Deep learning-based methods use neural networks (NN), CNNs, etc., eliminating the manual feature extraction work of machine learning methods and automatically learning features from the device's raw network traffic to classify devices.

[0004] While IoT device identification methods based on precise pattern matching boast high matching accuracy, they lack flexibility. On one hand, this method requires explicit features to be included in the target device's network service flag, allowing the flag's features to be defined in the fingerprint using regular expressions. However, due to device characteristics or security requirements, many devices do not include clearly identifiable information in their service flags, rendering this method unsuitable for identifying such devices. On the other hand, even if the flag contains explicit features, the method still requires experts familiar with the device's characteristics to manually extract the feature patterns. Given the large and ever-evolving number of IoT devices, this task is extremely labor-intensive and unsustainable. AI-based classification methods for IoT device identification, while achieving high matching accuracy, lack interpretability and scalability. First, various machine learning and deep learning algorithms are black-boxes, making it impossible to understand the causal relationship between training data and prediction results, or predict when the model might err, thus hindering complete trust in the model. Second, once identification of a device from a manufacturer or type not previously present in the label dataset is required, significant time must be spent retraining and validating the classification model, resulting in poor scalability.

[0005] Existing methods for identifying IoT devices using network attributes as a data source mainly fall into two categories: precise pattern matching and artificial intelligence-based classification. The main drawbacks of these two methods are summarized below:

[0006] Device identification based on precise pattern matching relies on distinctive strings (also known as protocol flags or tags) present in the device's protocol response messages. These strings are typically captured using regular expressions to form an explicit device fingerprint. The drawback of this explicit fingerprint-based method is the tedious manual work required to design matching rules, and it demands that the flag data contain clear device characteristics. In the real world, many IoT devices do not carry distinctive strings in their response messages. When the flag data lacks explicit characteristics, the method will fail. Explicit characteristics are readily available and directly exposed identifying information about the device.

[0007] Artificial intelligence-based classification methods typically identify devices by learning implicit features from network traffic. These methods are mostly based on a "closed world," meaning they can only classify data within a limited dataset. In an "open world," these AI-based classifiers require updating the dataset and retraining to support the identification of new types of devices, resulting in poor scalability. Implicit features are characteristics indirectly exhibited by devices and can be obtained through analysis and computation. Summary of the Invention

[0008] This invention aims to address the problems of low analysis efficiency and high human intervention associated with methods based on precise pattern matching, which rely on explicit features of device flags; and the lack of interpretability and scalability associated with methods based on artificial intelligence, which rely on AI to mine implicit features of devices. This invention proposes an IoT device identification method and system based on implicit flag features. It uses the combination, values, and distinguishability of HTTP protocol response message headers as implicit features of devices. This allows for the construction of a device fingerprint database based on remotely detected device response data without human intervention. It employs a device identification criterion based on similarity calculation and can flexibly expand the fingerprint database, thus enabling the identification of IoT devices even when service flags do not contain obvious feature information.

[0009] To achieve the above objectives, the technical solution adopted is:

[0010] This invention provides an IoT device identification method based on flag latent features, which consists of two stages: a fingerprint database construction stage and a device identification stage.

[0011] In the fingerprint database construction phase, the fingerprint database is constructed by preprocessing, constructing feature vectors, extracting representation vectors, and calculating feature weights on a set of collected HTTP / HTTPS response headers with vendor and type tags.

[0012] During the device identification phase, the manufacturer and type of the target device are obtained by calculating the similarity between the header of the target device's HTTP / HTTPS response message and the entries in the fingerprint database.

[0013] According to the IoT device identification method based on flag latent features of the present invention, the step of constructing the fingerprint database further includes:

[0014] Feature space construction: A feature space is built using common HTTP response headers that reflect device differences. The i-th head in the sequence is denoted as h. i ;

[0015] Initial data acquisition and labeling: Send HTTP requests to IoT devices of known manufacturers and types; generate a record R = (D, V, T) in the form of a triplet for the response message from each device and form a label dataset Ω1, where D is the header information of the response message, V is the manufacturer of the device, and T is the type of the device;

[0016] Data preprocessing involves splitting the header information D of the response message into a set of triples, converting the types of the header values, and removing duplicates to form a tag dataset represented in key-value pair format.

[0017] Construct feature vectors based on the feature space Generate a feature vector for each record;

[0018] Extract the representation vector and generate a representation vector based on the feature vector;

[0019] Calculate feature weights, determine the importance of each feature based on the representation vector and feature vector, generate a weight vector, and construct fingerprint entries.

[0020] According to the IoT device identification method based on flag latent features of the present invention, the header information D of the response message is further split into a set S consisting of triples (k,v,c), where k is a certain header string, v is the value of the header, and c is the type of the value of the header; the obtained triple set S is used to replace D in the record R to form a tag dataset Ω2 represented in key-value pair form, and each record is in the form R = (S,V,T).

[0021] According to the IoT device identification method based on flag latent features of the present invention, further, based on the feature space The feature vector generated for each record includes: if the device's HTTP response message contains the header h i Then the i-th component f of the eigenvector F i retrieve h from the response message i The corresponding value v and type c, otherwise f i The value is (Null, Null); replace S in record R with the obtained feature vector F to form a labeled dataset Ω3 represented in the form of feature vectors, and each record is in the form of R = (F, V, T).

[0022] According to the IoT device identification method based on flag latent features of the present invention, the generation of the representation vector based on the feature vector further includes: if the i-th component f of the device's feature vector... i If f ≠ (Null, Null), then f repri =1, otherwise f repri =0, thus constructing the device's representation vector F. repr Then add F to record R. repr This forms a labeled dataset Ω4 represented by feature vectors and representation vectors, where each record is in the form R = (F, F repr ,V,T).

[0023] According to the IoT device identification method based on flag latent features of the present invention, the process of generating weight vectors and constructing fingerprint entries is further as follows: For multiple devices with the same representation vector, for each feature vector F, calculate its i-th component f. i Importance θ i Importance θ of all features iNormalization is performed to generate a weight vector W; finally, (F, F) is used. repr A fingerprint entry FP = (F,F) is formed by V,T) and W. repr (,W,V,T), and add it to the fingerprint database.

[0024] According to the IoT device identification method based on flag latent features of the present invention, further, for the components f of the feature vector i Calculate its importance θ i The importance θ of a feature is calculated as the reciprocal of the number of feature vectors that have the same value as the current feature vector on the i-th feature. i .

[0025] According to the IoT device identification method based on flag latent features of the present invention, the device identification steps further include:

[0026] Target data acquisition and preparation: Send an HTTP request to the device to be identified, obtain the header information of the response message, and generate target feature vector and target representation vector;

[0027] Candidate fingerprint screening: Based on the target representation vector, candidate fingerprints related to the target device are selected;

[0028] Target device manufacturer and type identification: The manufacturer and type of the target device are determined by calculating the similarity between the target feature vector and the candidate fingerprint feature vector.

[0029] According to the IoT device identification method based on flag latent features of the present invention, the process of calculating similarity is further as follows:

[0030] For each candidate fingerprint FP, calculate the target feature vector F. T Similarity between fingerprint feature vector FP.F and fingerprint feature vector Similarity The calculation formula is:

[0031]

[0032] in, For the similarity of feature components, w i For weighted components;

[0033] For feature components whose data type is string, the similarity is calculated using the ratio of edit distance to the maximum string length;

[0034] For feature components whose data type is integer, the similarity is calculated using the ratio of the absolute value of the difference to the maximum value of the feature.

[0035] For feature components whose data type is an enumeration type, the maximum value of the enumeration is used to calculate the similarity.

[0036] Furthermore, the present invention also provides an IoT device identification system based on flag latent features, used to implement the above-mentioned IoT device identification method based on flag latent features, comprising a fingerprint database construction module and a device identification module, wherein:

[0037] The fingerprint database construction module is used to build a fingerprint database by preprocessing, constructing feature vectors, extracting representation vectors, and calculating feature weights from a set of collected HTTP / HTTPS response headers with vendor and type tags.

[0038] The device identification module is used to calculate the similarity between the header of the target device's HTTP / HTTPS response message and the entries in the fingerprint database to obtain the manufacturer and type of the target device.

[0039] The beneficial effects achieved by adopting the above technical solution are:

[0040] 1. No need to rely on expert experience, reducing human intervention.

[0041] This invention eliminates the need for expert experience in extracting features from HTTP response headers during fingerprint database construction, requiring only minimal manual processing in the data tagging step. While some header values ​​require type and encoding conversions during preprocessing, these conversion and encoding rules can be pre-implemented as plugins. When the corresponding header is encountered, the plugin code is invoked to complete the preprocessing. Other steps, such as feature vector construction, representation vector extraction, and feature weight calculation, can be automated, effectively reducing manual intervention and workload, and offering excellent flexibility.

[0042] 2. Applicable to equipment without obvious features in the service flag.

[0043] Traditional methods based on precise pattern matching rely on obvious features in device flags. However, this invention, by analyzing the combination, values, and distinguishability of HTTP response headers, can identify devices that do not have obvious features in service flags, thus filling the gap in traditional methods.

[0044] 3. It has good scalability.

[0045] First, the feature space is expandable; it can be added to the new HTTP headers that reflect device differences. It will not affect existing fingerprints.

[0046] Secondly, the fingerprint database is scalable; if the representation vector of a particular fingerprint FP' to be introduced is unique, that is... FP.F repr ≠FP'.F repr If the fingerprint is not found in the database, it can be directly added to the fingerprint database without affecting existing fingerprints. If the representation vector of FP' already exists in the fingerprint database, FP' can be added to the database, and the feature weights of fingerprints with the same representation vector as FP' can be recalculated by referring to the feature weight calculation steps, without affecting other fingerprints in the database. Overall, the fingerprint constructed by this invention has high independence and can be easily expanded into the fingerprint database, thus exhibiting good scalability.

[0047] 4. Improve device recognition efficiency

[0048] Since different types of devices are highly likely to have different HTTP header combinations, this invention incorporates a candidate fingerprint screening step into the device identification stage, which can significantly accelerate the efficiency of device identification. Assuming the total number of fingerprint entries in the database is m, without the candidate fingerprint screening step, m similarity calculations are required to identify the manufacturer and type of the target device. After introducing the candidate screening step, assuming the number of candidate fingerprints is n, only n similarity calculations are needed to identify the manufacturer and type of the target device. Since the HTTP header combinations of different types of devices often vary greatly, it is very likely that n << m; therefore, candidate fingerprint screening is expected to significantly reduce computational intensity and improve identification efficiency.

[0049] 5. Robustness and interpretability

[0050] This invention measures the degree of matching between a target device and a fingerprint based on similarity calculation. Compared to device identification methods based on explicit fingerprints, it has better robustness, and compared to device identification methods based on implicit fingerprints, it has better interpretability. For example, a newly manufactured device may modify the web server version number given in the Server header of the HTTP response message, or make minor changes to the content of the web homepage, resulting in a slight change in the value of the Content-Length header. However, these changes will not significantly alter the similarity calculation results, and therefore may still yield correct device identification results. Attached Figure Description

[0051] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings of the embodiments of the present invention will be briefly described below. The drawings are merely illustrative of some embodiments of the present invention and are not intended to limit the scope of the present invention to all embodiments.

[0052] Figure 1This is a flowchart of the fingerprint database construction stage in the IoT device identification method based on flag latent features according to an embodiment of the present invention;

[0053] Figure 2 This is a flowchart of the device identification stage of the IoT device identification method based on flag latent features according to an embodiment of the present invention;

[0054] Figure 3 These are three HTTP response header examples of IoT devices according to embodiments of the present invention. Detailed Implementation

[0055] The exemplary solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Unless otherwise defined, the technical or scientific terms used in this invention should have the ordinary meaning understood by one of ordinary skill in the art.

[0056] HTTP / HTTPS is a widely supported service protocol for IoT devices. Its response information mainly includes three parts: a status line, response headers, and a response body. The response headers are represented in key-value pairs and have a relatively simple format. In addition to using the response headers specified in the HTTP / HTTPS standard (such as Server, WWW-Authenticate, etc.), web servers can also define custom response headers (often prefixed with "X-", such as X-Powered-By, X-Frame-Options, etc.). Similarities have been observed in the combination and values ​​of HTTP protocol response headers among similar types of IoT devices.

[0057] First, although manufacturers can arbitrarily modify the combination and values ​​of response headers returned by web servers, this information is stored in the device firmware once the device leaves the factory. Since most IoT device firmware is rarely updated, this information remains almost unchanged throughout the device's lifecycle and can therefore be considered an inherent characteristic of the device. Second, when authentication mechanisms are enabled for the web services of IoT devices, we generally cannot obtain a meaningful response body, but we can still obtain a relatively complete response header. Finally, and most importantly, there is the issue of distinguishability. Observations of the HTTP response headers of IoT devices reveal that IoT devices from the same manufacturer and of the same type generally have similar header combinations and values, while IoT devices from different manufacturers or of different types exhibit significant differences in header combinations and values. For example, Figure 3The HTTP response headers of two D-Link routers and one ASUS router are presented. The two D-Link routers have the same HTTP header combination, and their header values ​​are identical except for a slight difference in the value of the Server header. However, the ASUS router has a significantly different HTTP header combination from the D-Link router. Based on the above analysis, this scheme argues that the HTTP response header information of IoT devices possesses properties such as long-term immutability, easy availability, and clear differentiation, making it suitable as a feature for IoT device identification.

[0058] Based on the above findings, this embodiment discloses an IoT device identification method based on flag latent features, which includes a fingerprint database construction step and a device identification step.

[0059] Step S1 involves constructing a fingerprint database by preprocessing, feature vector construction, representation vector extraction, and feature weight calculation of a set of collected HTTP / HTTPS response headers with vendor and type tags. This step specifically includes sub-steps S101-S106, such as... Figure 1 As shown.

[0060] Step S101: Feature Space Construction

[0061] A feature space is constructed using common HTTP response headers that reflect device differences. These headers include Server, Connection, Content-type, Content-encoding, Transfer-encoding, Content-length, Last-modified, etc. The feature space size n is set to 64. Unspecified headers are marked as Null. Newly discovered headers that reflect device differences can be added during subsequent fingerprint database construction. middle.

[0062] The following explains the symbols that appear in the text:

[0063] The feature space consisting of n HTTP headers is denoted as The i-th head in the sequence is denoted as h. i In this scheme, HTTP headers and HTTP features have the same meaning.

[0064] F: The feature vector of the device is denoted as F = [f1, f2, ..., f n If the device's HTTP response message contains the h header... i Then f iretrieve h from the response message i The corresponding value and type, otherwise f i The value can be (Null, Null).

[0065] F repr The device's representation vector is denoted as The i-th component of the representation vector If and only if the i-th component f of the device's feature vector is... i ≠(Null,Null), otherwise

[0066] FP: The device's fingerprint is represented as a 5-tuple FP = (F, F repr (W, V, T), where F is the feature vector of the device, F repr Let V be the device's representation vector, W be the weight vector, V be the device's manufacturer, and T be the device's type.

[0067] Let R be a record, then let X be an element X in R.

[0068] Step S102: Initial data acquisition and labeling

[0069] Select devices that support HTTP / HTTPS protocols to build the initial dataset. Send HTTP requests to a batch of IoT devices of known manufacturers and types using common HTTP / HTTPS service port numbers such as 80 / 8080 / 443 / 8443. For each device's response message with a status code of "200 OK", generate records in the form of triples (D,V,T) to form a labeled dataset Ω1, where D is the header information of the response message, V is the manufacturer of the device, and T is the type of the device.

[0070] Step S103, Data Preprocessing

[0071] First, for each record R = (D, V, T) in dataset Ω1, RD is split into a set S consisting of triples (k, v, c), where k is a header string, v is the value of that header, and c is the type of that value. In HTTP headers, values ​​are presented as strings. To facilitate subsequent similarity measurement, the value types are converted to integer (int), enumeration (enum), and string (str) data types based on the semantics of each header. Next, duplicate records are removed; for multiple identical records, only one is retained. Finally, the resulting set of triples S replaces D in record R, forming the labeled dataset Ω2, represented as key-value pairs, where each record is a triple (S, V, T).

[0072] Step S104: Construct feature vectors

[0073] Generate a feature vector for each record R = (S, V, T) in the dataset Ω2, given... The i-th head h i The i-th component f of the eigenvector F i The value selection rules are shown in formula (1). Replace S in record R with the obtained feature vector F to form a label dataset Ω3 represented in the form of feature vectors, where each record is a triple (F, V, T). Note that due to differences in firmware versions, there may be multiple header combinations in the HTTP responses of different instances of the same type of device, and the same header may also have multiple values, resulting in multiple feature vectors. Therefore, a type of device may have multiple corresponding records in the dataset.

[0074]

[0075] Step S105: Extract the representation vector

[0076] For each record R = (F, V, T) in dataset Ω3, extract the representation vector F. repr Given the i-th component f of the eigenvector RF i F repr The i-th component The rules for determining the value of are shown in formula (2). Then, using R = (F, V, T) and F... repr The four-tuple record (F, F) is formed repr ,V,T), forming a labeled dataset Ω4 represented by feature vectors and representation vectors.

[0077]

[0078] Step S106: Calculate the feature weights

[0079] Multiple devices may have the same representation vector. Let the set of feature vectors of all devices with representation vector X in dataset Ω4 be denoted as . if The value of a certain eigenvector F at the i-th eigencomponent is unique to it. The value of other feature vectors in the i-th feature component can be considered to be of greater importance in identifying the device manufacturer and type to which feature vector F belongs.

[0080] For each Let its value on the i-th feature be f. i ,remember for The value of f on the i-th feature is i The set of eigenvectors can be defined using formula (3). Any head h in i Importance of device identification (θ) i This means that when feature f is used alone... i The probability of obtaining a correct identification result when performing device identification. Specifically, when... When, it means f i It has unique values, θ i Take the maximum value of 1. When f i When = (Null, Null), it means f i It has no effect on device identification, θ i Take the maximum value of 0.

[0081]

[0082] By comprehensively considering various features and normalizing them, the weight vector W = [w1, w2, ..., w] can be obtained. n ], where w i express The head h in i The weights for identifying devices are calculated according to formula (4). The larger the value of a certain weight component, the better the distinguishability of that feature for different devices.

[0083]

[0084] Then, using (F,F) repr A fingerprint entry FP = (F,F) is formed by V,T) and W. repr ,W,V,T), and add them to the fingerprint database Ω5.

[0085] Step S2: By calculating the similarity between the header of the target device's HTTP / HTTPS response message and entries in the fingerprint database, the manufacturer and type of the target device are obtained. This step specifically includes sub-steps S201-S203, such as... Figure 2 As shown.

[0086] Step S201: Acquisition and Preparation of Target Data

[0087] Send HTTP requests to commonly used HTTP / HTTPS service ports such as 80 / 8080 / 443 / 8443 of the device to be identified. For each response message with a status code of "200 OK" from the device, save the header information D of the response message. T For D T The values ​​in D are preprocessed. T Decompose into a set S consisting of triples (k, v, c). TWhere k is a header string, v is the value of that header string, and c is the type of the value of that header string. Then, the target feature vector F is obtained by referring to formula (1). T Meanwhile, the target representation vector is obtained by referring to formula (2).

[0088] Step S202: Candidate fingerprint screening

[0089] The header combination in the HTTP response message can reflect the characteristics of the device; therefore, this scheme uses the representation vector as the basis for filtering candidate fingerprints. Considering that the header combination in the HTTP response messages of various devices may be the same, given a representation vector, multiple associated candidate fingerprints may be obtained. This step can filter out fingerprint entries in the fingerprint database that are irrelevant to the target device, improving the efficiency of device identification. Let the initial candidate fingerprint set be... For each fingerprint entry FP in the fingerprint database Ω5, if Then there is

[0090] Step S203: Identification of target device manufacturer and type

[0091] For candidate fingerprint set For each FP, the target feature vector F of the target device is defined by formula (5). T Similarity between the feature vectors FP and F of the fingerprint entries in, and f i F respectively T and the i-th component of FP.F, When defining the data type of the feature components as string, integer, and enumeration using formulas (6), (7), and (8) respectively, and f i The similarity between them, w i Let be the i-th weight component of FP.W. Take the fingerprint set Ω5 such that... The smallest fingerprint Right now but That is, the manufacturer of the target equipment. This refers to the type of the target device.

[0092]

[0093] In formula (6), express and f i Edit distance between and |f i .v| represents the length of the feature value string. In formula (7), express and f i The absolute value of the difference between them express and f i The maximum value of f. In formula (8), max(f) i .v) represents the maximum value that the enumeration can take.

[0094] Corresponding to the above method, this embodiment also discloses an IoT device identification system based on flag latent features, comprising a fingerprint database construction module and a device identification module, wherein:

[0095] The fingerprint database construction module is used to build a fingerprint database by preprocessing, constructing feature vectors, extracting representation vectors, and calculating feature weights from a set of collected HTTP / HTTPS response headers with vendor and type tags.

[0096] The device identification module is used to calculate the similarity between the header of the target device's HTTP / HTTPS response message and the entries in the fingerprint database to obtain the manufacturer and type of the target device.

[0097] This invention proposes an IoT device identification method and system based on flag-based implicit features. The invention automatically constructs a fingerprint database using the combination, values, and distinguishability of HTTP protocol response headers as overall features. Device identification is achieved by calculating the similarity between service flags and fingerprints. Compared to device identification methods based on explicit fingerprints, the proposed method can automatically construct a fingerprint database for devices that do not possess obvious features in service flags, effectively filling the gaps in the identification capabilities of traditional fingerprint databases. Compared to device identification methods based on implicit fingerprints, it has better interpretability and scalability.

[0098] Finally, it should be noted that the above-described embodiments are merely specific implementations of the present invention, used to illustrate the technical solutions of the present invention, and not to limit it. The scope of protection of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify the technical solutions described in the foregoing embodiments or make equivalent substitutions for some of the technical features within the technical scope disclosed in the present invention; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1.A method for identifying an Internet of Things (IoT) device based on a flag implicit feature, the method comprising: The method includes a fingerprint library construction stage and a device identification stage. S1: In the fingerprint library construction stage, a fingerprint library is constructed by preprocessing, feature vector construction, feature vector extraction, and feature weight calculation processing on a set of HTTP / HTTPS response message headers collected with manufacturer and type labels; this step specifically includes: S11: Feature space construction: using the headers in the HTTP response message that are common and can reflect the device differences to construct the feature space , The first header in the ;​​ S12: Initial data acquisition and labeling: sending HTTP requests to IoT devices of known manufacturers and types, and generating records in the form of triplets from the response messages from each device and forming a label data set wherein is the header information of the response message, is the manufacturer of the device, is the type of the device; S13: Data Preprocessing: First, process the header information of the response message... Split into triples The set ,in For a certain header string, The value of this header. The type of the header value is determined; then, the header value is type-casted and deduplicated; finally, the resulting set of triples is used. Replace Record In This forms a labeled dataset represented in key-value pair format. Each record is in the form of ; S14: Constructing Feature Vectors: Based on the feature space Generate a feature vector for each record, specifically including: if the device's HTTP response message contains headers. Then the eigenvector The Each component Retrieve response message The corresponding value and type ,otherwise Values ; use the obtained eigenvectors Replace Record In This forms a labeled dataset represented in the form of feature vectors. Each record is in the form of ; S15: Extracting a representation vector: generating a representation vector according to the feature vector, specifically comprising: if the first component of the feature vector of the device is , , , otherwise , thereby constructing the representation vector of the device ; then adding to the record , forming a label data set represented by the feature vector and the representation vector , and the form of each record is ; S16: Calculate feature weights: Calculate the importance of each feature based on the representation vector and feature vector, generate a weight vector, and construct fingerprint entries. Specifically, this includes: for multiple devices with the same representation vector, for each feature vector... Calculate its first Each component Importance Importance of all features Perform normalization to generate a weight vector. Finally utilize and Constitutes a fingerprint entry And add it to the fingerprint database; S2: In the device identification stage, the manufacturer and type of the target device are obtained by calculating the similarity between the header of the HTTP / HTTPS response message of the target device and the entries in the fingerprint library. 2.The IoT device identification method based on flag implicit feature according to claim 1, wherein, For the components of the feature vector , the importance is calculated including: in all feature vectors, the number of feature vectors with the same value as the current feature vector on the first feature, the inverse of the number is the importance of the feature . 3.The IoT device identification method based on flag implicit feature according to claim 1, wherein, The steps of device identification include: Target data acquisition and preparation, sending an HTTP request to the device to be identified, obtaining the header information of the response message, and generating a target feature vector and a target feature vector; Candidate fingerprint screening, screening candidate fingerprints related to the target device according to the target feature vector; Target device manufacturer and type identification, the similarity between the target feature vector and the candidate fingerprint feature vector is calculated to determine the manufacturer and type of the target device. 4.The IoT device identification method based on flag implicit feature according to claim 3, wherein, The process of calculating the similarity is: For each candidate fingerprint Calculate the target feature vector fingerprint feature vector similarity between Similarity The calculation formula is: ,in, The similarity of the feature components. For weighted components; For the data type of the feature component, the similarity is calculated using the ratio of the edit distance to the maximum string length; For the data type of the feature component, the similarity is calculated using the ratio of the absolute value of the difference to the maximum value of the feature value; For the data type of the feature component, the maximum value of the enumeration value is used to calculate the similarity. 5.A system for identifying an Internet of Things (IoT) device based on a flag implicit feature, the system comprising: The method for identifying IoT devices based on flag implicit features according to any one of claims 1-4 includes a fingerprint library construction module and a device identification module, wherein: The fingerprint library construction module is used to construct a fingerprint library by preprocessing, feature vector construction, feature vector extraction, and feature weight calculation processing on a set of HTTP / HTTPS response message headers collected with manufacturer and type labels; The device identification module is used to calculate the similarity between the header of the HTTP / HTTPS response message of the target device and the entries in the fingerprint library to obtain the manufacturer and type of the target device.

Images