A multi-probe collaborative network detection method and system

Abstract

The present application is about a multi-probe collaborative network detection method and system, wherein the method includes: combining the border gateway protocol with existing IoT device information to obtain multiple autonomous system subsystems, calculating the IoT coverage probability of each autonomous system subsystem, and determining the deployment location of the probe group through the integer linear programming method; defining the local state of each probe, obtaining the probability distribution of each subnet, and obtaining the subnet index that the probe is about to scan; after the probe executes the action, it updates the local state, calculates the global reward through the instant reward function, and stores the experience tuple in the replay cache, and updates the Critic network and Actor network of the MADDPG algorithm. The technical solution of the present application can ensure the detection accuracy and real-time performance that are difficult to guarantee under limited resource conditions, reduce redundancy and improve resource utilization, while ensuring the timeliness of the fingerprint database and the effectiveness of vulnerability warnings.

Description

Technical Field

[0001] The present application relates to the field of Internet of Things security technology, and in particular to a multi-probe collaborative network detection method and system. Background Art

[0002] As the number of Internet of Things (IoT) devices worldwide exceeds 30 billion and continues to surge, cyberspace mapping technology has become a core pillar of network security situational awareness. Its core task is to dynamically capture and accurately identify device fingerprint features through detection systems, providing real-time data support for vulnerability warnings and security protection.

[0003] In existing technologies, traditional single-node detection systems and distributed detection systems are typically used to dynamically capture and accurately identify device fingerprint features. However, traditional single-node architectures are subject to rigid constraints on local computing power and network bandwidth. A single probe can only maintain a detection rate of approximately 2,000 devices per second. However, the device access density of current mainstream 5G base stations has reached tens of thousands. Therefore, faced with the high-frequency changes in device status and massive protocol interaction data streams in dynamic network environments, the contradiction between the computationally intensive fingerprint matching algorithm of traditional single-node architectures and hardware resources will be exacerbated, causing device identification delays to exceed reasonable thresholds. Furthermore, traditional single-node architectures lack a dynamic resource allocation mechanism, resulting in the coexistence of CPU overload and idle network bandwidth during the detection cycle. At the same time, to avoid resource overload, a downsampling strategy is required, which can cause missed detection of key device statuses, directly affecting detection quality. Therefore, in summary, traditional single-node detection systems cannot guarantee detection accuracy and real-time detection under limited resource conditions.

[0004] The distributed architecture of a distributed detection system can theoretically break through the resource limitations of a single node through horizontal expansion. However, in actual deployment, the static task slicing mechanism of the distributed architecture may lead to an imbalance in resource utilization. In a large-scale detection system, the use of a static task slicing mechanism may cause some nodes to be overloaded and some nodes to be idle. In addition, there may be significant overlap in the detection targets between adjacent probes, resulting in a high proportion of redundant data generated by repeated detections. At the same time, the existing polling heartbeat synchronization mechanism of the distributed detection system usually has a fixed interval time, but in scenarios where the device status changes rapidly, this fixed interval may be difficult to adapt to, resulting in a timeliness deviation in the target device fingerprint database, which directly affects the effectiveness of vulnerability warnings. Therefore, in summary, distributed detection systems are prone to technical problems such as inefficient distributed node collaboration, high redundancy rate, timeliness deviation in the fingerprint database, and reduced effectiveness of vulnerability warnings.

[0005] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore may include information that does not constitute prior art known to ordinary technicians in the field. Summary of the Invention

[0006] To address the above problems, the present application provides a multi-probe collaborative network detection method and system, which can ensure detection accuracy and real-time performance under limited resource conditions, reduce redundancy and improve resource utilization, while ensuring the timeliness of the fingerprint database and the effectiveness of vulnerability warnings.

[0007] To achieve the purpose of this application, this application provides the following technical solutions:

[0008] In a first aspect, the present application provides a multi-probe collaborative network detection method, comprising:

[0009] Combining the Border Gateway Protocol with existing IoT device information, we obtain multiple autonomous system (AS) subsystems. We use a linear regression model to calculate the IoT coverage probability of each AS subsystem, and determine the deployment location of the probe cluster using an integer linear programming method.

[0010] Define the local state of each probe, use the MADDPG algorithm to obtain the probability distribution of each subnet, and obtain the subnet index that the probe is about to scan;

[0011] After the probe performs an action, it updates the local state, calculates the global reward through the immediate reward function, stores the experience tuple in the replay cache, and updates the Critic network and Actor network of the MADDPG algorithm.

[0012] In one possible implementation, the steps of combining the border gateway protocol with existing IoT device information to obtain multiple autonomous system subsystems, using a linear regression model to calculate the IoT coverage probability of each autonomous system subsystem, and determining the deployment location of the probe group using an integer linear programming method include:

[0013] Extract autonomous system features based on the border gateway protocol and existing IoT device information, construct a graph based on the autonomous system features to obtain the autonomous system, and split the autonomous system into x subsystems;

[0014] Constructing a linear regression model to predict the IoT device coverage density probability of each autonomous system subsystem, and establishing a mean square error loss function to train the linear regression model;

[0015] According to the IoT device coverage density probability of each autonomous system subsystem, the deployment location of the probe group is determined by the integer linear programming method.

[0016] In a possible implementation, the autonomous system feature vector is , for The number of managed IP addresses, For regional location, Indicates the traffic pattern, Indicates the known distribution of IoT devices;

[0017] The graph is constructed as ,in, For graph construction, is a set of autonomous systems, is a peer relationship; the autonomous system is represented by .

[0018] In one possible implementation, the linear regression model is ;in, To predict IoT device density, is the autonomous system eigenvector, is the transpose of the vector, is the first optimization parameter, is the second optimization parameter;

[0019] The mean square error loss function is ;in, is the mean square error loss function, is the actual IoT device density, is the number of autonomous system subsystems;

[0020] The specific training formula for training the linear regression model is: and ;in, Represents the learning rate.

[0021] In one possible implementation, the steps of defining the local state of each probe, obtaining the probability distribution of each subnet using the MADDPG algorithm, and obtaining the subnet index that the probe is about to scan include:

[0022] Define the local state of the probe and build an Actor network based on the MADDPG algorithm;

[0023] Input the local state of the probe into the Actor network to obtain the scanning probability distribution of each subnet;

[0024] According to the scanning probability distribution of each subnet, -The greedy strategy performs action selection in stages to obtain the subnet index that the probe is about to scan.

[0025] In a possible implementation, the local state of the probe is:

[0026] ;

[0027] in, is the local state of the i-th probe, To represent the scanned subnet using a binary vector, To respond to feature dimensions, It is the global statistical dimension;

[0028] The scanning probability distribution of each subnet is:

[0029] ;

[0030] in, is the scanning probability distribution of each subnet, Represents the Actor network, and softmax is the action score of each subnetwork.

[0031] In a possible implementation, the -The greedy strategy performs action selection in stages as follows:

[0032] During the training phase, the probability The subnet index is sampled from the scan probability distribution of each subnet through multinomial distribution, with probability The subnet index is randomly selected from a uniform distribution; during the evaluation phase, the subnet index with the highest probability is selected.

[0033] In one possible implementation, after the probe performs an action, it updates the local state, calculates the global reward using the immediate reward function, stores the experience tuple in the replay cache, and updates the Critic network and Actor network of the MADDPG algorithm, including the following steps:

[0034] The probe executes the selected action based on the subnet index to be scanned, receives environmental feedback, updates the state and experience data, and obtains the global reward value through the immediate reward function;

[0035] After updating the local state and the global state, the experience element is recovered. The experience element includes: the current state, the action, the global reward value and the next state;

[0036] Based on the recovered experience tuples, the Critic and Actor networks in the MADDPG algorithm are updated.

[0037] In one possible implementation, the immediate reward function is:

[0038] ;

[0039] in, is the immediate reward function, is an indicator function with Boolean characteristics. is the total number of probes, is the reward factor when a new device is detected, is the penalty factor for taking each detection action, is the penalty factor for the probe to be detected or blocked, is the newly discovered device in the i-th scanning action, The event of the probe being detected or blocked in the i-th scanning action. If the scan is detected or blocked, the value of I(detected_i) is 1, otherwise it is 0;

[0040] The local status update method is:

[0041] ;

[0042] ;

[0043] in, is a vector of length 1000, is a bitwise OR operation;

[0044] The global state update method is:

[0045] ;

[0046] The update strategy of the Actor network is:

[0047] ;

[0048] The update strategy of the Critic network is:

[0049] ;

[0050] in, is the parameter gradient of the Actor network, For the expectation of experience replay, is the gradient of the Actor to its own parameters, is the gradient of the Critic to the action, Indicates action By Strategy generate, is the Q value of the Critic network, , Refers to a batch of samples randomly sampled from the experience replay pool, are network parameters, are the target network parameters, is the current state, For the next state, For the current action, For the next action, is the discount factor, is the mean square error loss of the Critic network, For The sampled state transition tuple, For the target Critic network All possible The maximum Q value.

[0051] In a second aspect, the present application further provides a multi-probe collaborative network detection system for executing the multi-probe collaborative network detection method described above, the system comprising:

[0052] The probe deployment module is used to combine the border gateway protocol with existing IoT device information to obtain multiple autonomous system subsystems, use a linear regression model to calculate the IoT coverage probability of each autonomous system subsystem, and determine the deployment location of the probe group through an integer linear programming method;

[0053] The action acquisition module is used to define the local state of each probe, obtain the probability distribution of each subnet through the MADDPG algorithm, and obtain the subnet index that the probe is about to scan;

[0054] The algorithm update module is used to update the local state after the probe performs an action, calculate the global reward through the immediate reward function, store the experience tuple in the replay cache, and update the Critic network and Actor network of the MADDPG algorithm.

[0055] The technical solution provided by this application may have the following beneficial effects:

[0056] The multi-probe collaborative network detection method and system provided in this application can optimize probe deployment through linear regression model and integer linear programming, maximize coverage probability under limited resources, and ensure accuracy and real-time performance; and adopt the MADDPG algorithm to realize multi-probe intelligent collaboration, dynamically adjust the detection strategy, reduce redundancy and improve resource utilization; at the same time, introduce dynamic resource perception and instant reward function, comprehensively consider detection rate, number of actions and concealment, enhance system adaptability, reduce redundancy and improve resource utilization, and at the same time ensure the timeliness of fingerprint database and the effectiveness of vulnerability warning.

[0057] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not limit the present invention. Obviously, the drawings described below are only some embodiments of the present disclosure. Those skilled in the art can also derive other drawings based on these drawings without inventive effort.

[0059] Figure 1 A flowchart of a multi-probe collaborative network detection method provided in an embodiment of the present application;

[0060] Figure 2 A flowchart of step S100 of a multi-probe collaborative network detection method provided in an embodiment of the present application;

[0061] Figure 3 A flowchart of step S200 of a multi-probe collaborative network detection method provided in an embodiment of the present application;

[0062] Figure 4 A flowchart of step S300 of a multi-probe collaborative network detection method provided in an embodiment of the present application;

[0063] Figure 5 A schematic diagram of the MADDPG algorithm framework for a multi-probe collaborative network detection method provided in an embodiment of the present application;

[0064] Figure 6 A schematic diagram of the structure of a multi-probe collaborative network detection system provided in an embodiment of the present application. DETAILED DESCRIPTION

[0065] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be embodied in many forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that this disclosure will be thorough and complete and will fully convey the concepts of the example embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0066] This example embodiment first provides a multi-probe collaborative network detection method. Figure 1 As shown in , the multi-probe collaborative network detection method may include the following steps:

[0067] Step S100: Combine the border gateway protocol with existing IoT device information to obtain multiple autonomous system subsystems, use a linear regression model to calculate the IoT coverage probability of each autonomous system subsystem, and determine the deployment location of the probe group through an integer linear programming method.

[0068] Step S200: define the local state of each probe, and obtain the subnet index that the probe is about to scan through the probability distribution of each subnet.

[0069] Step S300: After the probe performs the action, it updates the local state, calculates the global reward through the immediate reward function, stores the experience tuple in the replay cache, and updates the Critic network and Actor network of the MADDPG algorithm.

[0070] The above-mentioned multi-probe collaborative network detection method can combine the Border Gateway Protocol (BGP) and existing IoT device information, use a linear regression model to construct the IoT coverage probability of the autonomous system subsystem, and rationally select the probe group deployment location through the integer linear programming method to maximize the coverage probability under limited resources and optimize the probe deployment cost. In addition, the MADDPG algorithm adopts a centralized training and distributed execution architecture. Through the collaborative work of joint state observation, policy network and value network, it optimizes the cooperative relationship between multiple probes, adjusts the probe detection strategy in real time, improves detection efficiency, reduces redundant scanning, and enhances the intelligence of the system. At the same time, by constructing a multi-probe collaborative strategy, it can dynamically respond to changes in the IoT environment, improving the flexibility and intelligence of IoT device detection. The adopted immediate reward function takes into account the detection rate, the total number of detection actions, the detection efficiency and concealment, further promoting system optimization. By optimizing the probe deployment location and dynamic detection strategy, it can maximize the coverage of IoT devices under limited resources and improve the detection efficiency and detection capability of IoT devices.

[0071] Below, we will refer to Figures 2 to 5 Each step of the multi-probe collaborative network detection method in this example embodiment is described in more detail.

[0072] In step S100, a plurality of autonomous system subsystems are obtained by combining the border gateway protocol with the existing IoT device information, a linear regression model is used to calculate the IoT coverage probability of each autonomous system subsystem, and the deployment location of the probe group is determined by the integer linear programming method.

[0073] In a possible implementation, step S100 may further include the following sub-steps:

[0074] In step S110, autonomous system features are extracted based on the border gateway protocol and existing IoT device information, a graph is constructed based on the autonomous system features to obtain an autonomous system, and the autonomous system is split into x subsystems.

[0075] Among them, the autonomous system eigenvector is , for The number of managed IP addresses, For regional location, Indicates the traffic pattern, Represents the known distribution of IoT devices; the graph is constructed as ,in, is a set of autonomous systems, is a peer relationship; the autonomous system is represented by .

[0076] It is understandable that the encoding of regional locations is a one-hot vector; traffic patterns can be quantified as scalars, such as the proportion of HTTP traffic, which can be estimated through traffic sniffing or public datasets; the known distribution of IoT devices can be the number of devices recorded using Shodan; the graph is constructed in mathematical representation, and the adjacency matrix of the graph is ,in is the number of autonomous systems, express and There are edges connecting them. , Autonomous System The degree of The number of other directly connected autonomous systems, reflecting Autonomous system topology information can be used to assist inference. For example, highly connected autonomous systems (such as tier-1 ISPs) may serve more end users, indirectly affecting IoT device density.

[0077] In step S120, a linear regression model is constructed to predict the IoT device coverage density probability of each autonomous system subsystem, and a mean square error loss function is established to train the linear regression model.

[0078] Among them, the linear regression model is ;in, To predict IoT device density, is the autonomous system eigenvector, is the transpose of the vector, is the first optimization parameter, is the second optimization parameter;

[0079] The mean square error loss function is ;in, is the mean square error loss function, is the actual IoT device density, is the number of autonomous system subsystems;

[0080] The specific training formula for training the linear regression model is: and ;in, Represents the learning rate.

[0081] It is understandable that after obtaining multiple autonomous system subsystems, each The IoT device density is estimated to be , assuming that the upper limit of probe deployment is k, the optimization goal is to select several subsets of autonomous systems to maximize the objective function:

[0082] ;

[0083] At this time for The estimation of is particularly critical, so linear regression is used to predict , that is, for the eigenvector , find a linear function Correspondingly, for probability prediction, that is, through To express , and use the gradient descent algorithm to train and ,The learning rate in the specific training formula can be modified according to the ,number of autonomous system subsystems.

[0084] Optional, trained The range may be negative or greater than 1, and needs to be normalized using the normalization formula, which is: .

[0085] In step S130 , the deployment location of the probe group is determined by an integer linear programming method according to the IoT device coverage density probability of each autonomous system subsystem.

[0086] It is understandable that after obtaining the IoT device density probability of an autonomous system subsystem In this case, the integer linear programming method is selected to solve the selection of the autonomous system subsystem, and the calculation method is:

[0087] ;

[0088] This method can select subsystems with the highest possible density in the case of a maximum of k subsystems in order to maximize coverage.

[0089] In step S200, the local state of each probe is defined, and the subnet index that the probe is about to scan is obtained through the probability distribution of each subnet.

[0090] In a possible implementation, step S200 may further include the following sub-steps:

[0091] In step S210 , the local state of the probe is defined, and an Actor network based on the MADDPG algorithm is constructed.

[0092] The local status of the probe is:

[0093] ;

[0094] in, is the local state of the i-th probe, To represent the scanned subnet using a binary vector, To respond to feature dimensions, It is the global statistical dimension.

[0095] It should be noted that ,in, is the number of subnets, 1 means scanned, 0 means not scanned; ,in, ; ,in, .

[0096] It is understandable that if Figure 5 As shown in the figure, the framework of the MADDPG algorithm of this application includes a training layer and a decision layer, which is composed of multiple intelligent agent probes. Each intelligent agent probe is composed of a Critic network and an Actor network.

[0097] In step S220, the local state of the probe is input into the Actor network to obtain the scanning probability distribution of each subnet.

[0098] The scanning probability distribution of each subnet is:

[0099] ;

[0100] in, is the scanning probability distribution of each subnet, Represents the Actor network, and softmax is the action score of each subnetwork.

[0101] It should be noted that the Actor network has two fully connected layers, each with 128 units; the softmax function uses ReLU, and its specific calculation method is , output dimensional vector, the specific mathematical calculation is:

[0102] ;

[0103] ;

[0104] ;

[0105] in, is the weight matrix of the first fully connected layer, , is the weight matrix of the second fully connected layer, , is the weight matrix of the third fully connected layer, , is the first layer bias vector, is the second layer bias vector, is the third layer bias vector, is the output of the first hidden layer, is the output of the second hidden layer, is the score vector;

[0106] Its probability distribution .

[0107] In step S230, according to the scanning probability distribution of each subnet, -The greedy strategy performs action selection in stages to obtain the subnet index that the probe is about to scan.

[0108] Among them, the use of -The greedy strategy performs action selection in stages as follows:

[0109] During the training phase, the probability The subnet index is sampled from the scan probability distribution of each subnet through multinomial distribution, with probability The subnet index is randomly selected from a uniform distribution; during the evaluation phase, the subnet index with the highest probability is selected.

[0110] It is understood that the probe selects actions from the probability distribution , from the discrete set , Decide which subnet to probe. The exploration strategy is - Greedy strategy, incorporating randomness during training and selecting the best action during evaluation, implemented as , the number of decay steps is 1000.

[0111] During the training phase, from sampling: , with probability Randomly select an action: , that is, during training, a random number generator is used, according to Determine whether to sample. When sampling, extract a subnetwork index from a 1000-dimensional probability distribution, such as using multinomial distribution sampling.

[0112] During evaluation, the subnet index with the highest probability can be directly selected: .

[0113] In step S300, after executing the action, the probe updates the local state, calculates the global reward through the immediate reward function, stores the experience tuple in the replay cache, and updates the Critic network and Actor network of the MADDPG algorithm.

[0114] In one possible implementation, step S300 may include the following sub-steps:

[0115] In step S310 , the probe performs the selected action according to the subnet index to be scanned, receives environmental feedback, updates the state and experience data, and obtains the global reward value through the immediate reward function.

[0116] Wherein, the instant reward function is:

[0117] ;

[0118] in, is the immediate reward function, is an indicator function with Boolean characteristics. is the total number of probes, is the reward factor when a new device is detected, is the penalty factor for taking each detection action, is the penalty factor for the probe to be detected or blocked, is the newly discovered device in the i-th scanning action, The event of the probe being detected or blocked in the i-th scanning action. If the scan is detected or blocked, the value of I(detected_i) is 1, otherwise it is 0.

[0119] It should be noted that the indicator function is used to determine the authenticity of the event. Indicates that a new device is detected, otherwise it is 0, similar to If detected, it is 0 otherwise; and the penalty factor for each detection action is used to encourage detection efficiency. The reward factor when a new device is detected and the penalty factor for each detection action are both 1; the penalty factor for the probe being detected or blocked is 10, which is used to encourage the stealth of the probe.

[0120] In step S320, after updating the local state and the global state, the experience element is recovered. The experience element includes: the current state, the action, the global reward value and the next state.

[0121] Wherein, the local status update method is:

[0122] ;

[0123] ;

[0124] in, is a vector of length 1000, For bitwise OR operation, The response returned for the environment.

[0125] It should be noted that Middle bit is 1, the rest are 0; Update functions based on specific feature extraction (such as HTTP headers).

[0126] The global state update method is:

[0127] .

[0128] It should be noted that the global status update is completed by the central server, which broadcasts the , the probe receives and splices into a complete state.

[0129] In step S330, the Critic and Actor networks in the MADDPG algorithm are updated based on the recovered experience tuples.

[0130] Among them, the update strategy of the Actor network is:

[0131] ;

[0132] The update strategy of the Critic network is:

[0133] ;

[0134] in, is the parameter gradient of the Actor network, For the expectation of experience replay, is the gradient of the Actor to its own parameters, is the gradient of the Critic to the action, Indicates action By Strategy generate, is the Q value of the Critic network, , Refers to a batch of samples randomly sampled from the experience replay pool, are network parameters, are the target network parameters, is the current state, For the next state, For the current action, For the next action, is the discount factor, is the mean square error loss of the Critic network, For The sampled state transition tuple, For the target Critic network All possible The maximum Q value.

[0135] It should be noted that the update of the Critic network determines the scanning efficiency and intelligence between the probe groups. The Critic network input combines the state and action, which brings about the update rules of the Actor network and the Critic network. For the update strategy of the Actor network and the Critic network, in this application, the MADDPG parameters used in the present invention are as follows:

[0136] Actor Network Input Status , the hidden layer is a two-layer 128 neural network, the output Dimensional softmax, the Critic network inputs all states and actions, the hidden layer is a three-layer structure, each layer dimension is 512, 256, 128, the output is 1 dimension, and the discount factor is , buffer The size is 10000, the network update frequency is every 100 steps, the soft update coefficient is 0.01, and the - Greedy strategy, Decay from 1.0 to 0.1 in 1000 steps.

[0137] Furthermore, in this exemplary embodiment, a multi-probe collaborative network detection system is provided for executing the multi-probe collaborative network detection method described above. Figure 6 As shown in , the system may include: a probe deployment module, an action acquisition module and an algorithm update module.

[0138] The probe deployment module is used to combine the border gateway protocol with existing IoT device information to obtain multiple autonomous system subsystems, use a linear regression model to calculate the IoT coverage probability of each autonomous system subsystem, and determine the deployment location of the probe group through an integer linear programming method.

[0139] The action acquisition module is used to define the local state of each probe, obtain the probability distribution of each subnet through the MADDPG algorithm, and obtain the subnet index that the probe is about to scan.

[0140] The algorithm update module is used to update the local state after the probe performs an action, calculate the global reward through the immediate reward function, store the experience tuple in the replay cache, and update the Critic network and Actor network of the MADDPG algorithm.

[0141] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary techniques in the art not disclosed herein. The description and examples are to be considered as exemplary only, with the true scope and spirit of the present disclosure being indicated by the appended claims.

[0142] The above embodiments are intended only to illustrate the technical solutions of the present application and are not intended to limit them. The present application is not limited to the precise structures described above and illustrated in the accompanying drawings, and it cannot be assumed that the specific implementation of the present application is limited to these descriptions. For those skilled in the art of the present application, any changes and modifications made without departing from the concept of the present application should be deemed to fall within the scope of protection of the present application.

Claims

1. A multi-probe collaborative network detection method, characterized in that: include: Combining the Border Gateway Protocol with existing IoT device information, we obtain multiple autonomous system subsystems. We use a linear regression model to calculate the IoT coverage probability of each autonomous system subsystem, and determine the deployment location of the probe group through an integer linear programming method. The method includes: extracting autonomous system features based on the border gateway protocol and existing IoT device information, constructing a graph based on the autonomous system features to obtain the autonomous system, and splitting the autonomous system into x subsystems; constructing a linear regression model to predict the IoT device coverage density probability of each autonomous system subsystem, and establishing a mean square error loss function to train the linear regression model; and determining the deployment location of the probe group through an integer linear programming method based on the IoT device coverage density probability of each autonomous system subsystem; The autonomous system feature vector is , is the autonomous system eigenvector, for The number of managed IP addresses, For regional location, Indicates the traffic pattern, Represents the known distribution of IoT devices; the graph is constructed as ,in, For graph construction, is a set of autonomous systems, is a peer relationship; the autonomous system is represented by ; The linear regression model is ;in, To predict IoT device density, is the transpose of the vector, is the first optimization parameter, is the second optimization parameter; the mean square error loss function is ;in, is the mean square error loss function, is the actual IoT device density, is the number of autonomous system subsystems; the specific training formula for training the linear regression model is and ;in, represents the learning rate; Define the local state of each probe, obtain the probability distribution of each subnet through the MADDPG algorithm, and obtain the subnet index that the probe is about to scan; which includes: defining the local state of the probe and building an Actor network based on the MADDPG algorithm; inputting the local state of the probe into the Actor network to obtain the scanning probability distribution of each subnet; according to the scanning probability distribution of each subnet, adopt -The greedy strategy selects actions in stages to obtain the subnet index that the probe is about to scan; The local status of the probe is: in, is the local state of the i-th probe, To represent the scanned subnet using a binary vector, To respond to feature dimensions, It is the global statistical dimension; The scanning probability distribution of each subnet is: in, is the scanning probability distribution of each subnet, Represents the Actor network, and softmax is the action score of each subnet; After the probe performs an action, it updates the local state, calculates the global reward through the immediate reward function, stores the experience tuple in the replay cache, and updates the Critic network and Actor network of the MADDPG algorithm.

2. The multi-probe collaborative network detection method according to claim 1, characterized in that: The adoption -The greedy strategy performs action selection in stages as follows: During the training phase, the probability The subnet index is sampled from the scan probability distribution of each subnet through multinomial distribution, with probability The subnet index is randomly selected from a uniform distribution; during the evaluation phase, the subnet index with the highest probability is selected.

3. The multi-probe collaborative network detection method according to claim 1, characterized in that: After the probe performs an action, it updates the local state, calculates the global reward through the immediate reward function, stores the experience tuple in the replay cache, and updates the Critic network and Actor network of the MADDPG algorithm, including the following steps: The probe executes the selected action based on the subnet index to be scanned, receives environmental feedback, updates the state and experience data, and obtains the global reward value through the immediate reward function; After updating the local state and the global state, the experience element is recovered. The experience element includes: the current state, the action, the global reward value and the next state; Based on the recovered experience tuples, the Critic and Actor networks in the MADDPG algorithm are updated.

4. The multi-probe collaborative network detection method according to claim 3, characterized in that: The immediate reward function is: ； in, is the immediate reward function, is an indicator function with Boolean characteristics. is the total number of probes, is the reward factor when a new device is detected, is the penalty factor for taking each detection action, is the penalty factor for the probe to be detected or blocked, is the newly discovered device in the i-th scanning action, The event of the probe being detected or blocked in the i-th scanning action. If the scan is detected or blocked, the value of I(detected_i) is 1, otherwise it is 0; The local status update method is: ； ； in, is a vector of length 1000, It is a bitwise OR operation; The global state update method is: ； The update strategy of the Actor network is: ； The update strategy of the Critic network is: ； in, is the parameter gradient of the Actor network, For the expectation of experience replay, is the gradient of the Actor to its own parameters, is the gradient of the Critic to the action, Indicates action By Strategy generate, is the Q value of the Critic network, , Refers to a batch of samples randomly sampled from the experience replay pool, are network parameters, are the target network parameters, is the current state, For the next state, For the current action, For the next action, is the discount factor, is the mean square error loss of the Critic network, For The sampled state transition tuple, For the target Critic network All possible The maximum Q value.

5. A multi-probe collaborative network detection system, characterized in that: The system is used to execute the multi-probe collaborative network detection method according to any one of claims 1 to 4, and the system includes: The probe deployment module is used to combine the border gateway protocol with existing IoT device information to obtain multiple autonomous system subsystems, use a linear regression model to calculate the IoT coverage probability of each autonomous system subsystem, and determine the deployment location of the probe group through an integer linear programming method; The action acquisition module is used to define the local state of each probe, obtain the probability distribution of each subnet through the MADDPG algorithm, and obtain the subnet index that the probe is about to scan; The algorithm update module is used to update the local state after the probe performs an action, calculate the global reward through the immediate reward function, store the experience tuple in the replay cache, and update the Critic network and Actor network of the MADDPG algorithm.

Images