Method and system for detecting Internet of Things devices

Abstract

This application relates to a method and system for detecting IoT devices, including: modeling the mapping change process of scanning IP devices as a partially observable Markov decision process, defining states, actions, observations, state transitions, observation probabilities, and rewards, and optimizing the scanning strategy; using a clustering algorithm to initially partition the IP address space based on static or semi-static IP features to form a manageable IP pool; constructing a hierarchical action selection mechanism, scheduling IP pool detection priorities through an upper-level meta-scheduler based on information gain and time-weighted strategies, and selecting detection actions in lower-level action decisions based on historical sequences and reward functions; establishing a dynamic IP pool management mechanism, triggering re-clustering in conjunction with network state changes, and adjusting IP pool partitioning by updating static and dynamic features. The technical solution of this application can maximize the number of captured IP device mapping mutations within a limited scanning budget, improving the timeliness, effectiveness, and resource utilization of detection.

Description

Technical Field

[0001] The present application relates to the field of Internet of Things security technology, and in particular to an Internet of Things device detection method and system. Background Art

[0002] With the popularity of Internet of Things (IoT) devices, the number of devices on the Internet is growing exponentially. These devices communicate with the network through IP addresses. As an important tool for Internet information retrieval, one of the core tasks of Internet search engines is to mine and track the mapping relationship between IP devices and physical devices through active scanning and fingerprint recognition technology. However, the Internet address space is extremely large (IPv4 address space is , the IPv6 address space is ), and IP device mappings are highly dynamic and variable. For example, devices may change their IP addresses due to network configuration changes, device migration, or failures, or some devices may only be online during specific time periods. Therefore, in real-world network monitoring scenarios, efficiently tracking the evolution of IP device mappings within a limited scanning budget becomes a key factor in building a timely and accurate network search engine.

[0003] In the existing technology, traditional network scanning methods include sequential scanning strategies that detect IP addresses in order, and random scanning strategies that randomly select IP addresses for detection. However, both of these traditional network scanning methods have significant limitations in complex network scenarios. First, traditional network scanning methods lack intelligent perception of the dynamic characteristics of IP devices, and are prone to repeated detection of expired or long-term static IP addresses, resulting in a high redundant detection rate and wasted computing resources and bandwidth. Second, traditional network scanning methods typically classify network protocols into different categories and manually define the scanning frequency of each protocol. This fails to fully consider the dynamic changes in IP-device mapping in different networks, making it impossible to optimize scanning strategies based on the real-time status of the network, making it difficult to fully utilize limited scanning budgets.

[0004] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore may include information that does not constitute prior art known to ordinary technicians in the field. Summary of the Invention

[0005] To address the above issues, the present application provides an IoT device detection method and system that can maximize the number of captured IP-device mapping mutations within a limited scanning budget, thereby improving the timeliness, effectiveness, and resource utilization of detection.

[0006] To achieve the purpose of this application, this application provides the following technical solutions:

[0007] In a first aspect, the present application provides an IoT device detection method, comprising:

[0008] The scanning IP-device mapping change process is modeled as a partially observable Markov decision process (POMDP), defining states, actions, observations, state transitions, observation probabilities, and rewards to optimize the scanning strategy.

[0009] Based on the static or semi-static characteristics of IP addresses, a clustering algorithm is used to initially divide the IP address space to form a manageable IP pool;

[0010] Construct a hierarchical action selection mechanism. The upper-level meta-scheduler schedules the IP pool detection priority based on information gain and time weighting strategy. The lower-level action decision selects the detection action based on the historical sequence and reward function.

[0011] Establish a dynamic management mechanism for IP pools, trigger re-clustering based on changes in network status, and adjust IP pool divisions by updating static and dynamic features.

[0012] In one possible implementation, the steps of modeling the scanning IP-device mapping change process as a partially observable Markov decision process, defining states, actions, observations, state transitions, observation probabilities, and rewards, and optimizing the scanning strategy include:

[0013] Define the state as the underlying real state of the IP pool, including IP activity, device type distribution, and mapping stability;

[0014] Actions are defined as a collection of discrete actions that can be performed on an IP pool;

[0015] An observation is defined as the observed result obtained after performing an action;

[0016] Define state transition as the probability of true state evolution;

[0017] The observation probability is defined as the probability of obtaining a predetermined observation result after performing a specified action in the target's true state;

[0018] Reward is defined as an immediate feedback signal based on the results of actions and observations;

[0019] The scanning strategy is optimized by updating the belief state through observation results, calculating the expected reward of each action, and selecting the action sequence that maximizes the long-term cumulative reward.

[0020] In one possible implementation, the steps of updating the belief state based on observation results, calculating the expected reward of each action, and selecting an action sequence that maximizes the long-term cumulative reward to optimize the scanning strategy include:

[0021] Based on the observation results and actions, the belief estimate of the IP pool state is iteratively revised through the observation probability and state transition probability;

[0022] Calculate the expected reward of each action and select the action sequence that maximizes the long-term cumulative reward as the scanning strategy.

[0023] In one possible implementation, the step of initially dividing the IP address space using a clustering algorithm based on static or semi-static IP characteristics to form a manageable IP pool includes:

[0024] Selecting IP address features and representing them as a feature vector containing the selected features, wherein the IP address features include IP geographic location, autonomous system number, and subnet prefix;

[0025] The IP pool is divided by the Density-Based Spatial Clustering of Applications with Noise (DBSCAN) algorithm. Density-connected IP addresses are grouped into the same IP pool. Noise points are processed individually or merged into the nearest cluster to obtain multiple IP pools.

[0026] Assign a unique ID to each IP pool, complete the initial static clustering, and form a manageable IP pool.

[0027] In a possible implementation, before the step of dividing the IP pool by the DBSCAN algorithm, dividing the densely connected IP addresses into the same IP pool, and processing the noise points separately or merging them into the nearest cluster to obtain multiple IP pools, the step further includes:

[0028] Represent each IP address as a feature vector;

[0029] Set the key parameters of the DBSCAN algorithm, which are the neighborhood radius and the minimum number of neighbors.

[0030] In one possible implementation, the steps of constructing a hierarchical action selection mechanism, scheduling IP pool detection priorities based on information gain and time weighting strategies by an upper-layer meta-scheduler, and selecting detection actions by combining historical sequences and reward functions in a lower-layer action decision-making process, include:

[0031] The information gain metric is obtained by calculating the uncertainty of the belief state before IP pool detection and the expected uncertainty of the posterior belief state after detection through Shannon entropy;

[0032] Record the last detection time of each IP pool and calculate the time interval with the current time;

[0033] By integrating information gain and time interval through a priority formula, the IP pool with the highest priority is selected for the next step of detection.

[0034] Extract the fixed-length history sequence of observations and actions from the IP pool;

[0035] Set a reward function for the selected action, reward the desired behavior, punish invalid detection and high cost, and iteratively update the agent;

[0036] The historical sequence is input into the agent to obtain the hidden state of the last time step, and the hidden state is input into the subsequent fully connected layer to obtain the Q value of each action, and the optimal action is selected according to the Q value of each action.

[0037] In one possible implementation, the information gain metric is calculated as follows:

[0038] ;

[0039] in, is the information gain, is the IP address pool divided by clustering, is the Shannon entropy, For a simplified belief state, is the updated simplified belief state, is the mathematical expectation;

[0040] The calculation formula of the time interval is:

[0041] ;

[0042] in, is the time interval, is the current detection time, The last detection time of the IP pool;

[0043] The calculation formula of the priority formula is:

[0044] ;

[0045] in, For priority, is the third weight, is the information gain, is the fourth weight, is the time interval.

[0046] In a possible implementation, the historical sequence is:

[0047] ;

[0048] in, is the observation result, a is the action taken in the previous step, is the current time step, is the length of the history window;

[0049] The reward function is: ;

[0050] in, is the reward function, According to the observed change type Assign different reward values. is the first weight coefficient, is the second weight coefficient, The cost associated with performing action a.

[0051] In one possible implementation, the steps of establishing a dynamic IP pool management mechanism, triggering re-clustering in conjunction with changes in network status, and adjusting IP pool partitioning by updating static and dynamic features include:

[0052] Setting dynamic re-clustering conditions, and performing re-clustering when the dynamic re-clustering conditions are met, wherein the dynamic re-clustering conditions include periodic triggering and event triggering;

[0053] Introducing dynamic features based on the initial static features to form an updated feature vector;

[0054] Use a clustering algorithm to re-cluster IP addresses containing dynamic features and adjust the division of the IP pool accordingly.

[0055] In a second aspect, the present application further provides an IoT device detection system for executing the aforementioned IoT device detection method, the system comprising:

[0056] The scanning modeling module is used to model the mapping change process of scanning IP-devices as a partially observable Markov decision process, define states, actions, observations, state transitions, observation probabilities, and rewards, and optimize the scanning strategy;

[0057] The initial clustering module is used to initially divide the IP address space based on the static or semi-static characteristics of the IP addresses using a clustering algorithm to form a manageable IP pool;

[0058] The hierarchical selection module is used to build a hierarchical action selection mechanism. The upper-level meta-scheduler schedules the IP pool detection priority based on information gain and time weighting strategy. The lower-level action decision combines historical sequence and reward function to select detection actions.

[0059] The dynamic re-clustering module is used to establish a dynamic management mechanism for the IP pool, trigger re-clustering based on changes in network status, and adjust the IP pool division by updating static and dynamic features.

[0060] The technical solution provided by this application may have the following beneficial effects:

[0061] The IoT device detection method and system provided in this application can efficiently detect and identify IP-device mapping changes of IoT devices by dynamically adjusting scanning strategies, reduce redundant detection rates, reduce computing resources and bandwidth waste, and adapt to dynamic changes in the network, thereby maximizing the number of captured mutations within a limited scanning budget, and improving the timeliness, effectiveness and resource utilization of detection.

[0062] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not limit the present invention. Obviously, the drawings described below are only some embodiments of the present disclosure. Those skilled in the art can also derive other drawings based on these drawings without inventive effort.

[0064] Figure 1 A flowchart of a method for detecting IoT devices provided in an embodiment of the present application;

[0065] Figure 2 A flowchart of step S100 of an IoT device detection method provided in an embodiment of the present application;

[0066] Figure 3 A flowchart of step S200 of an IoT device detection method provided in an embodiment of the present application;

[0067] Figure 4 A flowchart of step S300 of an IoT device detection method provided in an embodiment of the present application;

[0068] Figure 5 A flowchart of step S400 of an IoT device detection method provided in an embodiment of the present application;

[0069] Figure 6 A schematic diagram of the structure of an Internet of Things device detection system provided in an embodiment of the present application. DETAILED DESCRIPTION

[0070] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be embodied in many forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that this disclosure will be thorough and complete and will fully convey the concepts of the example embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0071] This example embodiment first provides a method for detecting IoT devices with dynamic interference power management under conditions of sparse feedback and missing observations. Figure 1 As shown in , the IoT device detection method may include the following steps:

[0072] Step S100: Model the scanning IP-device mapping change process as a partially observable Markov decision process, define states, actions, observations, state transitions, observation probabilities, and rewards, and optimize the scanning strategy.

[0073] Step S200: Based on the static or semi-static characteristics of IP addresses, a clustering algorithm is used to initially divide the IP address space to form a manageable IP pool.

[0074] Step S300: Construct a hierarchical action selection mechanism, schedule the IP pool detection priority based on information gain and time weighted strategy through the upper-level meta-scheduler, and select the detection action in the lower-level action decision-making based on the historical sequence and reward function.

[0075] Step S400: Establishing a dynamic management mechanism for the IP pool, triggering re-clustering in conjunction with changes in network status, and adjusting the IP pool division by updating static and dynamic features.

[0076] Through the above-mentioned IoT device detection method, the scanning process is modeled as a partially observable Markov decision process, the decision complexity is reduced by the IP address range clustering algorithm, a hierarchical action selection mechanism including information gain measurement and time weighting strategy is constructed to achieve efficient detection scheduling, and an IP dynamic management mechanism is established to adapt to the evolution of the network environment; thereby, scanning tasks are intelligently scheduled under a limited scanning budget, the scanning frequency and target selection are dynamically adjusted, the redundant detection rate is significantly reduced, the waste of computing resources and bandwidth is reduced, the dynamic changes of the network are adapted to in real time, the number of captured IP device mapping mutations is maximized, and the timeliness, accuracy and resource utilization efficiency of network search engine detection are effectively improved.

[0077] Below, we will refer to Figures 2 to 5 Each step of the above-mentioned IoT device detection method in this example implementation is described in more detail.

[0078] In step S100 , the mapping change process of scanning IPs and devices is modeled as a partially observable Markov decision process, and states, actions, observations, state transitions, observation probabilities, and rewards are defined to optimize the scanning strategy.

[0079] It can be understood that the process of scanning IP-device mapping changes is regarded as a continuous decision process and modeled as a partially observable Markov decision process, with the goal of optimizing the scanning strategy to capture as many IP address changes as possible.

[0080] In a possible implementation, step S100 may further include the following sub-steps:

[0081] In step S110 , the status is defined as the potential real status of the IP pool, including IP activity, device type distribution, and mapping stability.

[0082] It is understood that the state S is defined as the potential true state of each IP pool. This state is partially observable and includes information such as the activity of IP addresses in the pool, the distribution of device types, the stability of IP-device mappings, and the frequency of changes.

[0083] In step S120 , an action is defined as a collection of discrete actions that can be executed on the IP pool.

[0084] It should be noted that the action mainly involves adjusting the detection frequency:

[0085]

[0086] in, For action, To increase the detection frequency to a preset level, To reduce a preset level, To maintain the current frequency.

[0087] In step S130 , observation is defined as the observation result obtained after performing the action.

[0088] It should be noted that after the detection action is defined, the set of observation information obtained by the agent from the environment ; These observations are partial reflections of the true state. Can be a combination of the following discrete values or a single value:

[0089] : A high priority change was detected.

[0090] : A general change was detected.

[0091] : No significant changes were found compared to the last detection.

[0092] : The probe request to the target IP timed out.

[0093] : The destination IP refused the connection (for example, a TCP RST packet was received).

[0094] : Other detection errors occurred (for example, the network is unreachable).

[0095] : Based on the results of this detection sampling, it is estimated that the proportion of active IP addresses in the pool exceeds or falls below the threshold.

[0096] In step S140 , the state transition is defined as the probability of the real state evolution.

[0097] It should be noted that the probability of the true state evolution is .

[0098] In step S150, the observation probability is defined as the probability of obtaining a predetermined observation result after performing a specified action in the target's real state.

[0099] It can be understood that, for example, the observation probability O represents the probability of Next action Later observed Probability .

[0100] In step S160 , a reward is defined as an immediate feedback signal based on an action and an observation result.

[0101] It should be noted that the immediate feedback signal is , the reward expression can be ;

[0102] in, Assign different reward values according to the observed change type ω, is the first weight coefficient, is the second weight coefficient, The cost associated with performing action a;

[0103] Weight coefficient and Need to be adjusted according to the actual scanning budget and goals, initially =1, =1.

[0104] In step S170, the belief state is updated based on the observation results, the expected reward of each action is calculated, and the action sequence that maximizes the long-term cumulative reward is selected to optimize the scanning strategy.

[0105] It is understandable that since the true state cannot be fully known, by maintaining a belief state , indicating the true state The probability distribution of is estimated, and this belief state is implicitly represented by the agent's hidden state.

[0106] Furthermore, the steps of updating the belief state through observation results, calculating the expected reward of each action, and selecting the action sequence that maximizes the long-term cumulative reward to optimize the scanning strategy include:

[0107] Based on the observation results and actions, the belief estimate of the IP pool state is iteratively revised through the observation probability and state transition probability;

[0108] Calculate the expected reward of each action and select the action sequence that maximizes the long-term cumulative reward as the scanning strategy.

[0109] It is understandable that by maintaining a belief state (Real status of IP pool The probability distribution estimate of , which is implicitly represented by the agent's hidden state), combined with the observations after each detection Based on the Bayesian principle, the belief state is updated, and the expected reward of each action is calculated, selecting the action sequence that maximizes the long-term cumulative reward. The benefits and costs of actions are quantified, driving the agent to prioritize high-benefit, low-cost detection actions.

[0110] In step S200, a clustering algorithm is used to initially divide the IP address space according to the static or semi-static characteristics of the IP addresses to form a manageable IP pool.

[0111] It is understandable that step S200 divides the massive IP address space into manageable units, reducing decision complexity. An IP address range clustering algorithm is used to estimate the IP address pool, reducing the complexity of subsequent decisions. The distribution of different device types is calculated by scanning records, and the DBSCAN method is used for initial static clustering.

[0112] In a possible implementation, step S200 may further include the following sub-steps:

[0113] In step S210, IP address features are selected and represented as feature vectors containing the selected features, where the IP address features include the IP geographic location, the autonomous system number, and the subnet prefix.

[0114] It is understandable that the initial static clustering is mainly performed based on static or semi-static features such as IP geographical location, autonomous system number (ASN), and subnet prefix.

[0115] In step S220, the IP pool is divided by the DBSCAN algorithm, and the densely connected IP addresses are divided into the same IP pool. The noise points are processed separately or merged into the nearest cluster to obtain multiple IP pools.

[0116] It can be understood that since the DBSCAN algorithm does not require the number of clusters to be specified in advance, the initial clustering is performed using the DBSCAN method by scanning the IP distribution of different device types.

[0117] In step S230 , a unique ID is assigned to each IP pool, completing the initial static clustering to form a manageable IP pool.

[0118] It should be noted that the result of clustering is to generate a series of IP pools, each of which contains a group of IP addresses with similar characteristics or close geographical / network locations.

[0119] Furthermore, before step S220, the method further includes:

[0120] In step S2201, each IP address is represented as a feature vector.

[0121] In step S2202, key parameters of the DBSCAN algorithm are set, wherein the key parameters are the neighborhood radius and the minimum number of neighbors.

[0122] It can be understood that step S2201 is to process the selected IP feature data and prepare the data; step S2202 is to set the DBSCAN algorithm parameters, the neighborhood radius eps and the minimum number of neighbors .

[0123] In step S300, a hierarchical action selection mechanism is constructed, in which the upper-level meta-scheduler schedules the IP pool detection priority based on information gain and time weighted strategy, and the lower-level action decision selects the detection action in combination with the historical sequence and reward function.

[0124] It should be noted that the action selection mechanism is divided into two layers, the upper-layer meta-scheduler is responsible for macro-scheduling among multiple IP pools and deciding which IP pool to prioritize for detection or policy adjustment at the next decision time point. The lower-layer action decision is responsible for selecting specific detection actions for the IP pool selected by the upper-layer meta-scheduler. The upper-layer meta-scheduler makes decisions based on the information gain metric and time-weighted strategy of the IP pool. In order to estimate which IP pool to detect to minimize the uncertainty about the pool's state, thereby helping the meta-scheduler decide the next detection target, information gain calculation is introduced. At the same time, by maintaining a simplified Bayesian belief model, it is used to approximately track the state uncertainty of the IP pool.

[0125] In one possible implementation, step S300 may include the following sub-steps:

[0126] In step S310, the uncertainty of the belief state before IP pool detection and the expected uncertainty of the posterior belief state after detection are calculated by Shannon entropy to obtain an information gain metric.

[0127] Furthermore, the information gain metric is calculated as follows:

[0128] ;

[0129] in, is the information gain, is the IP address pool divided by clustering, is the Shannon entropy, For a simplified belief state, is the updated simplified belief state, is the mathematical expectation.

[0130] It should be noted that Shannon entropy represents the uncertainty contained in the current belief state of the IP pool before detection; mathematical expectation represents the updated posterior belief state after a specific observation ω is obtained after detection. Information gain represents how much uncertainty can be reduced through detection. After each detection, the belief state is updated according to the observation ω. .

[0131] In step S320, the last detection time of each IP pool is recorded, and the time interval with the current time is calculated.

[0132] Furthermore, the calculation formula of the time interval is:

[0133] ;

[0134] in, is the time interval, is the current detection time, The last detection time of the IP pool.

[0135] It should be noted that the time-weighted strategy gives priority to the IP pool with the longest interval since the last detection to ensure the coverage of the detection.

[0136] In step S330, the information gain and the time interval are integrated through a priority formula to select the IP pool with the highest priority for the next detection step.

[0137] Furthermore, the calculation formula of the priority formula is:

[0138] ;

[0139] in, For priority, is the third weight, is the information gain, is the fourth weight, is the time interval.

[0140] It should be noted that when performing decision fusion, information gain and time weighting are combined to select the next IP pool for detection.

[0141] It can be understood that steps S310 to S330 are the upper-layer meta-scheduler scheduling the IP pool detection priority based on the information gain and time weighting strategy.

[0142] In step S340 , a fixed-length history sequence of observations and actions is extracted from the IP pool.

[0143] Furthermore, the historical sequence is:

[0144] ;

[0145] in, is the observation result, a is the action taken in the previous step, is the current time step, is the length of the history window.

[0146] It is understandable that the lower-level action decision is responsible for selecting specific detection actions for the IP pool selected by the upper-level meta-scheduler. .

[0147] In step S350, a reward function is set for the selected action, which rewards the desired behavior and penalizes invalid detection and high cost, and the agent is iteratively updated.

[0148] Furthermore, the reward function is:

[0149] ;

[0150] in, is the reward function, Assign different reward values according to the observed change type ω, is the first weight coefficient, is the second weight coefficient, The cost associated with performing action a.

[0151] It is understandable that is the first weight coefficient, The second weight coefficient is adjusted according to the actual scanning budget and target, and the initial value is =1, =1.

[0152] In step S360, the historical sequence is input into the intelligent agent to obtain the hidden state of the last time step, and the hidden state is input into the subsequent fully connected layer to obtain the Q value of each action, and the optimal action is selected for execution based on the Q value of each action.

[0153] Among them, the Q value is an indicator output by the decision network to measure the value of each possible action.

[0154] It is understandable that the constructed sequence is input into the agent, and the agent outputs the hidden state of the last time step ; The hidden state Input to the subsequent fully connected layer, the final output corresponds to each possible action Q value ; Input the historical sequence of IP pool i into the decision network, introduce the exploration and utilization strategy, and finally select the action to be executed .

[0155] It can be understood that steps S340-S360 are lower-level action decisions that combine historical sequences and reward functions to select detection actions.

[0156] In step S400, a dynamic management mechanism for the IP pool is established, re-clustering is triggered in conjunction with changes in network status, and the IP pool division is adjusted by updating static and dynamic features.

[0157] It should be noted that a dynamic IP pool management mechanism is established. This mechanism triggers re-clustering periodically or when significant network topology changes are detected, combining static IP characteristics and the frequency of IP-device mapping mutations to adapt to the evolving network environment. The number and size of IP pools are optional configuration parameters.

[0158] In one possible implementation, step S400 may include the following sub-steps:

[0159] In step S410, dynamic re-clustering conditions are set, and re-clustering is performed when the dynamic re-clustering conditions are met. The dynamic re-clustering conditions include periodic triggering and event triggering.

[0160] It should be noted that the periodic trigger can be set to re-cluster at a fixed time interval, such as weekly or monthly; the event trigger can be triggered when a major event that may affect the distribution or behavior of IP addresses is detected, such as the IP-device mapping mutation frequency in a certain IP pool increases or decreases significantly, exceeding the preset threshold, where the mutation frequency is calculated by statistically analyzing the recent observations. and large-scale network topology changes are detected; the overall activity of a certain IP pool changes dramatically.

[0161] In step S420, dynamic features are introduced based on the initial static features to form an updated feature vector.

[0162] In step S430, a clustering algorithm is used to re-cluster the IP addresses containing dynamic features, and the division of the IP pool is adjusted accordingly.

[0163] It is understandable that the division of the IP pool is finally adjusted according to the new clustering result, and the IP pool list managed by the meta-scheduler and its related status information are updated.

[0164] Furthermore, in this exemplary embodiment, an Internet of Things device detection system is also provided, which is used to execute the above-mentioned Internet of Things device detection method. Figure 6 As shown in , the system may include a scanning modeling module, an initial clustering module, a hierarchical selection module and a dynamic re-clustering module.

[0165] The scanning modeling module is used to model the mapping change process of scanning IP-devices as a partially observable Markov decision process, define states, actions, observations, state transitions, observation probabilities and rewards, and optimize the scanning strategy.

[0166] The initial clustering module is used to initially divide the IP address space according to the static or semi-static characteristics of the IP and use a clustering algorithm to form a manageable IP pool.

[0167] The hierarchical selection module is used to build a hierarchical action selection mechanism. The upper-level meta-scheduler schedules the IP pool detection priority based on information gain and time weighted strategy. The lower-level action decision combines historical sequence and reward function to select detection actions.

[0168] The dynamic re-clustering module is used to establish a dynamic management mechanism for the IP pool, trigger re-clustering based on changes in network status, and adjust the IP pool division by updating static and dynamic features.

[0169] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary techniques in the art not disclosed herein. The description and examples are to be considered as exemplary only, with the true scope and spirit of the present disclosure being indicated by the appended claims.

[0170] The above embodiments are intended only to illustrate the technical solutions of the present application and are not intended to limit them. The present application is not limited to the precise structures described above and illustrated in the accompanying drawings, and it cannot be assumed that the specific implementation of the present application is limited to these descriptions. For those skilled in the art of the present application, any changes and modifications made without departing from the concept of the present application should be deemed to fall within the scope of protection of the present application.

Claims

1. A method for detecting an Internet of Things device, characterized in that: include: The scanning IP-device mapping change process is modeled as a partially observable Markov decision process, defining states, actions, observations, state transitions, observation probabilities, and rewards to optimize the scanning strategy. Based on the static or semi-static characteristics of IP addresses, a clustering algorithm is used to initially divide the IP address space to form a manageable IP pool; Construct a hierarchical action selection mechanism. The upper-level meta-scheduler schedules the IP pool detection priority based on information gain and time weighting strategy. The lower-level action decision selects the detection action based on the historical sequence and reward function. This includes: The information gain metric is obtained by calculating the uncertainty of the belief state before IP pool detection and the expected uncertainty of the posterior belief state after detection through Shannon entropy; Record the last detection time of each IP pool and calculate the time interval with the current time; By integrating information gain and time interval through a priority formula, the IP pool with the highest priority is selected for the next step of detection. Extract the fixed-length historical sequence of observations and actions from the IP pool; Set a reward function for the selected action, reward the desired behavior, punish invalid detection and high cost, and iteratively update the agent; The historical sequence is input into the agent to obtain the hidden state of the last time step, and the hidden state is input into the subsequent fully connected layer to obtain the Q value of each action. The optimal action is selected based on the Q value of each action. The Q value is an indicator output by the decision network to measure the value of each possible action. The calculation formula of the information gain metric is: ； in, is the information gain, is the IP address pool divided by clustering, is the Shannon entropy, For a simplified belief state, is the updated simplified belief state, is the mathematical expectation; The calculation formula of the time interval is: ； in, is the time interval, is the current detection time, The last detection time of the IP pool; The calculation formula of the priority formula is: ； in, For priority, is the third weight, is the information gain, is the fourth weight, is the time interval; Establish a dynamic management mechanism for IP pools, trigger re-clustering based on changes in network status, and adjust IP pool divisions by updating static and dynamic features.

2. The method for detecting IoT devices according to claim 1, wherein: The steps of modeling the scanning IP-device mapping change process as a partially observable Markov decision process, defining states, actions, observations, state transitions, observation probabilities, and rewards, and optimizing the scanning strategy include: Define the state as the underlying real state of the IP pool, including IP activity, device type distribution, and mapping stability; Actions are defined as a collection of discrete actions that can be performed on an IP pool; An observation is defined as the observed result obtained after performing an action; Define state transition as the probability of true state evolution; The observation probability is defined as the probability of obtaining a predetermined observation result after performing a specified action in the target's true state; Reward is defined as an immediate feedback signal based on the results of actions and observations; The scanning strategy is optimized by updating the belief state through observation results, calculating the expected reward of each action, and selecting the action sequence that maximizes the long-term cumulative reward.

3. The method for detecting IoT devices according to claim 2, wherein: The steps of updating the belief state through observation results, calculating the expected reward of each action, and selecting the action sequence that maximizes the long-term cumulative reward to optimize the scanning strategy include: Based on the observation results and actions, the belief estimate of the IP pool state is iteratively revised through the observation probability and state transition probability; Calculate the expected reward of each action and select the action sequence that maximizes the long-term cumulative reward as the scanning strategy.

4. The method for detecting IoT devices according to claim 1, wherein: The step of initially dividing the IP address space using a clustering algorithm based on the static or semi-static characteristics of the IP addresses to form a manageable IP pool includes: Selecting IP address features and representing them as a feature vector containing the selected features, wherein the IP address features include IP geographic location, autonomous system number, and subnet prefix; The IP pool is divided by the DBSCAN algorithm, and densely connected IP addresses are divided into the same IP pool. Noise points are processed separately or merged into the nearest cluster to obtain multiple IP pools; Assign a unique ID to each IP pool, complete the initial static clustering, and form a manageable IP pool.

5. The method for detecting IoT devices according to claim 4, wherein: Before the step of dividing the IP pool by the DBSCAN algorithm, dividing the densely connected IP addresses into the same IP pool, and processing the noise points separately or merging them into the nearest cluster to obtain multiple IP pools, the method further includes: Represent each IP address as a feature vector; Set the key parameters of the DBSCAN algorithm, which are the neighborhood radius and the minimum number of neighbors.

6. The method for detecting IoT devices according to claim 1, wherein: The historical sequence is: ； in, is the observation result, a is the action taken in the previous step, is the current time step, is the length of the history window; The reward function is: ; in, is the reward function, According to the observed change type Assign different reward values. is the first weight coefficient, is the second weight coefficient, The cost associated with performing action a.

7. The method for detecting IoT devices according to claim 1, wherein: The steps of establishing a dynamic IP pool management mechanism, triggering re-clustering in conjunction with changes in network status, and adjusting IP pool division by updating static and dynamic features include: Setting dynamic re-clustering conditions, and performing re-clustering when the dynamic re-clustering conditions are met, wherein the dynamic re-clustering conditions include periodic triggering and event triggering; Introducing dynamic features based on the initial static features to form an updated feature vector; Use a clustering algorithm to re-cluster IP addresses containing dynamic features and adjust the division of the IP pool accordingly.

8. An Internet of Things device detection system, characterized in that: The system is used to execute the method for detecting an IoT device according to any one of claims 1 to 7, and the system includes: The scanning modeling module is used to model the mapping change process of scanning IP-devices as a partially observable Markov decision process, define states, actions, observations, state transitions, observation probabilities, and rewards, and optimize the scanning strategy; The initial clustering module is used to initially divide the IP address space based on the static or semi-static characteristics of the IP addresses using a clustering algorithm to form a manageable IP pool; The hierarchical selection module is used to build a hierarchical action selection mechanism. The upper-level meta-scheduler schedules the IP pool detection priority based on information gain and time weighting strategy. The lower-level action decision combines historical sequence and reward function to select detection actions. The dynamic re-clustering module is used to establish a dynamic management mechanism for the IP pool, trigger re-clustering based on changes in network status, and adjust the IP pool division by updating static and dynamic features.

Images