Internet of things asset identification method and device for unknown terminal

Abstract

The invention discloses an Internet of Things asset identification method and device for an unknown terminal, and is applied to network equipment. The method comprises the following steps: classifying unknown terminals in a network, selecting a current terminal from the unknown terminals belonging to a terminal category for each terminal category, counting the number of the unknown terminals with the opened ports from the unknown terminals belonging to the terminal category for each opened port of the current terminal, and determining the number of the unknown terminals according to the counting result. And selecting a feature port from the open ports of the current terminal. And if the number of the remaining unknown terminals except the unknown terminals with the open feature ports in the unknown terminals belonging to the terminal category meets the identification condition, selecting a current terminal from the remaining unknown terminals. According to the method, an iterative learning mode is adopted, the selected open port of the current terminal is taken as a reference, and the feature port is selected as fingerprint information of each terminal category in subsequent asset identification, so that the asset identification process is automatically executed, and the asset identification efficiency is improved.

Description

Technical Field

[0001] This specification relates to the field of computer technology, and in particular, to an Internet of Things (IoT) asset identification method and device for unknown terminals. Background Art

[0002] The Internet of Things (IoT) is a network that connects various physical devices and sensors through the Internet, and the various physical devices connected to the IoT are IoT devices. With the continuous development of technologies such as smart grids, smart homes, smart transportation, and smart logistics, the applications of IoT devices such as sensor devices, smart TVs, smart speakers, and smart in-vehicle devices have become increasingly popular. In the IoT, various IoT devices continuously perform data transmission and exchange, and this data may include personal information, device status, location information, and sensor data. Once this data is leaked, serious consequences will occur.

[0003] IoT asset identification refers to the process of classifying and sorting out the exposed physical devices connected to the IoT. Through IoT asset identification, corresponding security measures can be taken for different types of IoT devices to enhance the data security of the IoT.

[0004] Currently, clustering is generally used for IoT asset identification. Specifically, the device fingerprint information such as the type, model, version number, open ports, and running services of IoT devices is obtained, and the devices in the IoT are clustered to determine the categories of the IoT devices. In the clustering method, the fingerprint information of each IoT terminal needs to be extracted according to expert experience before asset identification can be carried out, and the efficiency is low.

[0005] Therefore, this specification provides an IoT asset identification method for unknown terminals. Summary of the Invention

[0006] This specification provides an IoT asset identification method, device, storage medium, and electronic device for unknown terminals to at least partially solve the above problems existing in the prior art.

[0007] This specification adopts the following technical solutions:

[0008] This specification provides an IoT asset identification method for unknown terminals. The method is applied to a network device and includes:

[0009] Classify each unknown terminal in the network to obtain at least one terminal category;

[0010] For each terminal category, select one of the unknown terminals belonging to that terminal category as the current terminal; for each port opened by the current terminal, count the number of unknown terminals belonging to that terminal category that have opened that port; and based on the statistical result, select the characteristic port corresponding to that terminal category from the ports opened by the current terminal.

[0011] If the number of remaining unknown terminals among the unknown terminals belonging to that terminal category, excluding the unknown terminals that have opened the characteristic port, satisfies the identification condition, then select one of the remaining unknown terminals as the current terminal, and return to the step of counting the number of unknown terminals belonging to that terminal category that have opened each port opened by the current terminal.

[0012] Among them, the characteristic port corresponding to each terminal category is used for identifying Internet of Things assets of the terminal.

[0013] Optionally, classifying each unknown terminal in the network to obtain at least one terminal category specifically includes:

[0014] Send a probe message to each unknown terminal in the network and receive the response message of each unknown terminal to the probe message;

[0015] Classify each unknown terminal according to the message information of the response message of each unknown terminal to obtain at least one terminal category.

[0016] Optionally, classifying each unknown terminal according to the message information of the response message of each unknown terminal specifically includes:

[0017] Parse the message information of the response message of each unknown terminal to the probe message, and determine the port through which each unknown terminal responds to the probe message, and / or the initial life cycle of the data packet corresponding to each unknown terminal;

[0018] Classify each unknown terminal according to the port through which each unknown terminal responds to the probe message, and / or the initial life cycle of the data packet corresponding to each unknown terminal.

[0019] Optionally, classifying each unknown terminal according to the port through which each unknown terminal responds to the probe message and the initial life cycle of the data packet corresponding to each unknown terminal specifically includes:

[0020] Regard the unknown terminals with the same port and initial life cycle of the data packet in the response to the probe message as one terminal category.

[0021] Optionally, the current terminal is selected through the following steps:

[0022] Select an unknown terminal from the unknown terminals of the candidate current terminal as the to-be-determined terminal;

[0023] Exclude the specified ports from the open ports of the to-be-determined terminal;

[0024] When the number of remaining open ports of the to-be-determined terminal is not less than the specified threshold, use the to-be-determined terminal as the current terminal.

[0025] Optionally, based on the statistical results, select the characteristic ports corresponding to the terminal category from the open ports of the current terminal, specifically including:

[0026] For each open port of the current terminal, when the number of unknown terminals that have opened this port among the unknown terminals belonging to this terminal category is less than the preset lower limit value, discard the statistical results corresponding to this port;

[0027] Sort the remaining open ports of the current terminal according to the statistical results corresponding to these ports;

[0028] According to the sorting result, select the characteristic ports corresponding to the terminal category from the remaining open ports of the current terminal.

[0029] Optionally, if the number of remaining unknown terminals among the unknown terminals belonging to this terminal category except those that have opened the characteristic ports meets the identification conditions, specifically including:

[0030] When there are other unknown terminals remaining among the unknown terminals belonging to this terminal category except those that have opened the characteristic ports, determine that the number of remaining unknown terminals meets the identification conditions.

[0031] This specification provides an Internet of Things asset identification device for unknown terminals. The device is applied to a network device and includes:

[0032] A classification module that classifies each unknown terminal in the network to obtain at least one terminal category;

[0033] A characteristic port determination module. For each terminal category, select one as the current terminal from the unknown terminals belonging to this terminal category; for each open port of the current terminal, count the number of unknown terminals that have opened this port among the unknown terminals belonging to this terminal category; and based on the statistical results, select the characteristic ports corresponding to this terminal category from the open ports of the current terminal;

[0034] Iterative learning module. If the number of remaining unknown terminals among the unknown terminals belonging to this terminal category, excluding the unknown terminals that have already opened the feature ports, meets the recognition condition, then select one from the remaining unknown terminals as the current terminal, return each port that has been opened for the current terminal, and count the number of unknown terminals that have opened this port among the unknown terminals belonging to this terminal category; wherein, the feature ports corresponding to each terminal category are used for identifying Internet of Things assets of terminals. This specification provides a computer-readable storage medium, and the storage medium stores a computer program, and when the computer program is executed by a processor, it implements the above-mentioned method for identifying Internet of Things assets of unknown terminals.

[0035] This specification provides an electronic device, including a memory, a processor, and a computer program stored on the memory and executable on the processor. When the processor executes the program, it implements the above-mentioned method for identifying Internet of Things assets of unknown terminals.

[0036] The above-mentioned at least one technical solution adopted in this specification can achieve the following beneficial effects:

[0037] In the method for identifying Internet of Things assets of unknown terminals provided in this specification, when applied to a network device, in this method, various unknown terminals in the network are classified to obtain at least one terminal category. For each terminal category, select one from the unknown terminals belonging to this terminal category as the current terminal. For each port that has been opened for the current terminal, count the number of unknown terminals that have opened this port among the unknown terminals belonging to this terminal category, and based on the statistical result, select the feature port corresponding to this terminal category from the ports that have been opened for the current terminal. If the number of remaining unknown terminals among the unknown terminals belonging to this terminal category, excluding the unknown terminals that have already opened the feature ports, meets the recognition condition, then select one from the remaining unknown terminals as the current terminal, and return the step of counting the number of unknown terminals that have opened each port that has been opened for the current terminal among the unknown terminals belonging to this terminal category.

[0038] In this method, the network device can automatically classify unknown terminals, and in each terminal category, adopt an iterative learning method. In each round, taking the ports opened by the selected current terminal as the statistical benchmark, select the feature port among the ports opened by the current terminal, and determine the feature port in each round. Finally, determine the feature port of this terminal category as the fingerprint information of each terminal category in subsequent asset identification. Through the feature port of this method, the asset identification process can be executed automatically without the need for manual determination of device fingerprint information, improving the efficiency of asset identification. Description of the Drawings

[0039] The accompanying drawings described herein are used to provide a further understanding of the present specification, form a part of the present specification, and the illustrative embodiments and descriptions thereof are used to explain the present specification, and do not constitute an improper limitation to the present specification. In the drawings:

[0040] Figure 1 It is a schematic flowchart of a method for identifying Internet of Things assets for unknown terminals in this specification;

[0041] Figure 2 It is a port statistics table for a terminal category provided by an embodiment of this specification;

[0042] Figure 3 It is a process diagram for asset identification provided in an embodiment of this specification;

[0043] Figure 4 It is a schematic diagram of a device for identifying Internet of Things assets for unknown terminals provided by this specification;

[0044] Figure 5 It is provided by this specification corresponding to Figure 1 a schematic diagram of an electronic device. Detailed implementation manners

[0045] To make the purpose, technical solutions, and advantages of this specification clearer, the technical solutions of this specification will be clearly and completely described below in conjunction with specific embodiments of this specification and the corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this specification, rather than all the embodiments. Based on the embodiments in this specification, all other embodiments obtained by those of ordinary skill in the art without creative efforts belong to the scope protected by this application.

[0046] With the popularization of Internet of Things devices and the development of artificial intelligence technology, more and more Internet of Things devices are exposed to the Internet, resulting in increasing attention to the security issues of Internet of Things devices. Internet of Things asset identification is a necessary and crucial part of Internet of Things security. If the exposed Internet of Things devices can be sorted out and analyzed, it is of great significance for discovering the security issues of Internet of Things devices.

[0047] Through asset identification, it is possible to understand the device identity information such as the model and brand of the Internet of Things devices connected within the network scope of an organization, so as to formulate effective security policies, assess risks, and ensure the security of the internal network assets of the organization.

[0048] The method for identifying Internet of Things assets for unknown terminals provided by this specification can be applied to network devices such as firewalls and switches for identifying Internet of Things assets within the network scope of a specific organization to ensure network security.

[0049] The following will, in conjunction with the accompanying drawings, elaborate in detail on the technical solutions provided by each embodiment of this specification.

[0050] Figure 1 The following is a schematic flowchart of an Internet of Things asset identification method for unknown terminals in this specification, which specifically includes the following steps:

[0051] S100: Classify each unknown terminal in the network to obtain at least one terminal category.

[0052] In the asset identification scenario of this specification, the location of the device that needs to be identified is known, that is, the IP address is known. However, due to reasons such as version updates and new device additions, terminal devices that do not belong to known categories may be detected in the network space for asset identification.

[0053] If a certain terminal device belongs to a known category of device, by identifying fingerprint information such as the open ports of the terminal device and matching it with the fingerprint information of each device category stored in the network asset database, it can be further identified that the terminal device belongs to a certain known category, and the identity of the terminal device can be determined through information such as the device model and version number of the known category stored in the database.

[0054] If a certain terminal device does not belong to a known category of device and there is no matching device category stored in the network asset database, the network device defines this device as an unknown device whose identity needs to be identified. Through the method of this specification, the characteristic ports of the unknown device are automatically determined as the fingerprint information of the unknown device and stored in the database for subsequent asset identification.

[0055] The network device continuously monitors in the network according to the asset identification method of this specification and periodically executes the asset identification process. For the network asset identification process of a certain cycle, after the network device determines the unknown terminals that are not matched in the database during this cycle, it is necessary to perform an initial category division on these unknown terminals, and within each divided terminal category, through the subsequent iterative port learning method of this specification, obtain the characteristic ports of each terminal category as the fingerprint information of each terminal category for identifying terminal devices belonging to this terminal category in the next cycle of asset identification.

[0056] That is, applying the asset identification method of this specification, for terminal A whose identity cannot be identified in the current cycle, because the network device automatically classifies terminal A and learns the characteristic ports of the terminal category to which terminal A belongs. The network device can associate the characteristic ports of the terminal category to which terminal A belongs with the category identifier of this terminal category and store them in the database to update the terminal category fingerprint information in the database.

[0057] In the asset identification of the next cycle, if terminal A is detected again, the category of terminal A can be matched in the database according to the characteristic ports of the terminal category to which terminal A belongs determined previously, and the identity of terminal A is no longer unknown.

[0058] In this specification, a network device may send probe messages to each unknown terminal in the network and receive response messages of each unknown terminal to the probe messages.

[0059] Specifically, the network device sends probe messages to each unknown device in the Internet of Things that needs to perform asset identification according to the IP addresses where the unknown devices are located. The probe message can be a SYN scan (TCP half-open scan), TCP full connection scan, UDP scan, ACK scan, etc.

[0060] The network device sends probe messages one by one to each port number in the specified port segment of each unknown device for port scanning. The range of the port number is 0 to 65535. It can be determined according to service requirements that the specified port segment for sending the probe message is the full port segment (0 to 65535), or a port segment in a certain interval of the full port segment.

[0061] Due to differences in their own device signals, configurations, provided services, etc., different unknown devices will respond to the probe message with specific ports, that is, only specific ports in the specified port segment will return response messages to the network device. The specific port may be one or multiple. Subsequently, the network device classifies each unknown terminal according to the message information of the response messages of each unknown terminal to obtain at least one terminal category. This specification does not limit the specific classification method, and classification can be performed according to message fields such as the source port number, network protocol, and packet initial time to live (TTL) in the message information.

[0062] S102: For each terminal category, select one unknown terminal belonging to this terminal category as the current terminal; for each port that is open for the current terminal, count the number of unknown terminals that have opened this port among the unknown terminals belonging to this terminal category; and based on the statistical result, select the characteristic port corresponding to this terminal category from the ports that are open for the current terminal.

[0063] In the asset learning method of this specification, for each initially divided terminal category, the network device uses an iterative learning method to learn the common characteristics of the ports opened by each unknown terminal included in the terminal category to determine the characteristic ports of the terminal category.

[0064] In this specification, the idea of going from a single device to a category of devices is adopted. First, one of the unknown terminals belonging to the terminal category is selected as the current terminal, and based on the ports opened by the current terminal, the ports with a higher opening frequency among the ports opened by the unknown terminals belonging to the terminal category are learned as the characteristic ports of the terminal category.

[0065] The specific learning method is as follows: for each port opened by the current terminal, count the number of unknown terminals that have opened this port among the unknown terminals belonging to the terminal category, and based on the statistical results, select the characteristic port corresponding to the terminal category from the ports opened by the current terminal.

[0066] Among them, there is no limit on the measurement standard for ports with a higher opening frequency in this specification. It can be limited by a specified proportion of the total number included in a terminal category, or directly limited by a quantity threshold, or the selection order of the first N can be limited according to the order of the opening quantities corresponding to each port.

[0067] For example, when there are 8 unknown terminals in the terminal category, if it is limited by a specified proportion of the total number included in a terminal category, the specified proportion can be set to 50%, and it is limited that the proportion of the terminal category that has opened a certain port is greater than 50%, that is, greater than 4, then the candidate port is used as the characteristic port.

[0068] S104: If the number of remaining unknown terminals among the unknown terminals belonging to the terminal category, except for the unknown terminals that have opened the characteristic ports, meets the identification condition, then select one of the remaining unknown terminals as the current terminal, and return to the step of counting the number of unknown terminals that have opened this port among the unknown terminals belonging to the terminal category for each port opened by the current terminal; among them, the characteristic ports corresponding to each terminal category are used for identifying Internet of Things assets of the terminal.

[0069] After determining the characteristic ports based on a current terminal, the network device determines whether the number of remaining unknown terminals among the unknown terminals belonging to the terminal category, except for the unknown terminals that have opened the above-determined characteristic ports, meets the identification condition.

[0070] This specification does not make specific limitations on the identification condition. For example, the identification condition can be to determine whether there are other unknown terminals remaining among the unknown terminals belonging to the terminal category, except for the unknown terminals that have opened the determined characteristic ports. It can also be that the number of remaining opened ports among the unknown terminals belonging to the terminal category, except for the unknown terminals that have opened the determined characteristic ports, is not less than a preset value.

[0071] If so, continue to select one of the remaining unknown terminals as the current terminal, return to the above step S102, and continue to determine the characteristic ports based on the new current terminal. If not, it is determined that the process of determining the characteristic ports of this terminal category is completed, and the determined characteristic ports of this category and the category identifier of this category are stored in the database.

[0072] After the characteristic ports of each terminal category divided by each unknown terminal are determined, in the asset identification of the next cycle, the network device can perform asset identification based on the characteristic ports of each terminal category determined in the current cycle stored in the database.

[0073] Figure 2 This is a port statistics table for a terminal category provided by the embodiments of this specification. Next, based on Figure 2 the example, the characteristic port iterative learning process of this embodiment will be further explained. As Figure 2 shown in the terminal category, it includes a total of 8 unknown terminals from A to H. In the determination of the characteristic ports in the first round, the unknown terminal A is selected as the current terminal.

[0074] Then, based on the ports opened by the unknown terminal A, for each port opened by the unknown terminal A, the network device counts the number of unknown terminals in the terminal category where the unknown terminal A is located that have opened this port, and the statistical result is Figure 2 as shown.

[0075] Figure 2 The first row of lists the ports opened by the unknown terminal A (22, 23, 445, 5000, 49120, 61238). Figure 2 Rows 2 to 9 of respectively show the opening situations of each unknown terminal for the ports opened by the unknown terminal A. Among them, for each cell, the number "1" indicates that the unknown terminal corresponding to this row has opened the port corresponding to this column, and "0" indicates that the unknown terminal corresponding to this row has not opened the port corresponding to this column.

[0076] Figure 2 The last row of is the statistical value of the opening quantity of each port opened by the unknown terminal A. It can be seen that in the Figure 2 shown terminal category, the numbers of terminals that have opened the ports 22, 23, 445, 5000, 49120, 61238 of the unknown terminal A are 5, 5, 6, 6, 7, 7 respectively.

[0077] If the network device limits that the proportion of terminals in this terminal category that have opened a certain port is greater than 50%, and the ports with an opening quantity greater than 5 are used as characteristic ports, then it is determined that the characteristic ports determined by taking the unknown terminal A as the current terminal in the first round are 445, 5000, 49120, 61238.

[0078] Next, the network device starts the second round of characteristic port learning. Among the unknown terminals A - H, determine the unknown terminals with open ports that include the characteristic ports determined in the first round, that is, the unknown terminals that have opened ports 445, 5000, 49120, and 61238 (unknown terminals A, unknown terminal C, unknown terminal E, unknown terminal G). Among the remaining unknown terminals B, unknown terminal D, unknown terminal F, and unknown terminal H, according to the method in step S102 above, re - select the current terminal to determine new characteristic ports until no current terminal that meets the recognition conditions can be determined again.

[0079] According to the above Figure 1 The Internet of Things asset identification method for unknown terminals described above is applied to a network device to classify each unknown terminal in the network and obtain at least one terminal category. For each terminal category, select one of the unknown terminals belonging to this terminal category as the current terminal. For each open port of the current terminal, count the number of unknown terminals that have opened this port among the unknown terminals belonging to this terminal category, and based on the statistical result, select the characteristic port corresponding to this terminal category from the open ports of the current terminal. If the number of remaining unknown terminals among the unknown terminals belonging to this terminal category, excluding the unknown terminals that have opened the characteristic port, meets the recognition conditions, then select one of the remaining unknown terminals as the current terminal, and return to the step of counting the number of unknown terminals that have opened this port among the unknown terminals belonging to this terminal category for each open port of the current terminal.

[0080] In this method, the network device can automatically classify unknown terminals, and in each terminal category, adopt an iterative learning method. In each round, using the ports opened by the selected current terminal as the statistical basis, select characteristic ports from the ports opened by the current terminal, and by determining the characteristic ports in each round, finally determine the characteristic ports of this terminal category as the fingerprint information of each terminal category in subsequent asset identification. Through the characteristic ports of this method, the asset identification process can be automatically executed without the need for manual determination of device fingerprint information, improving the efficiency of asset identification.

[0081] Theoretically, terminal devices with the same initial data packet life cycle generally have the same operating system. For the same type of terminal devices, for the detection packets, the ports they respond to are generally the same.

[0082] Based on this, in one embodiment, when performing the initial classification of unknown terminals in the above step S100, the network device can analyze the message information of the response messages of each unknown terminal to the detection message, and determine the ports through which each unknown terminal responds to the detection message, and / or the initial packet lifetime corresponding to each unknown terminal. Among them, the port through which each unknown terminal responds to the detection message is the source port number in the message information of the response message.

[0083] Then, classify each unknown terminal according to the ports through which each unknown terminal responds to the detection message, and / or the initial packet lifetime corresponding to each unknown terminal.

[0084] When classifying, the network device can only use the port that responds to the detection message, that is, the network device takes the unknown terminals with the same port that responds to the detection message as one terminal category. Or only use the initial packet lifetime as the classification basis, that is, the network device takes the unknown terminals with the same initial packet lifetime as one terminal category.

[0085] Or, the port that responds to the detection message and the initial packet lifetime can also be used together as the classification basis, that is, the network device takes the unknown terminals with the same port that responds to the detection message and the same initial packet lifetime as one terminal category.

[0086] For example, the ports of the response detection messages of terminal A are 2000 and 3000, the ports of the response detection messages of terminal B are also 2000 and 3000, and the port of the response detection message of terminal C is 6000. The initial TTL of terminal A and terminal B is 64, and the initial TTL of terminal C is 128. Then, in this step, terminal A and terminal B are classified into one terminal category, and terminal C is classified into a separate terminal category.

[0087] In the above step S102, the network device can randomly select an unknown terminal from each unknown terminal belonging to this terminal category, and directly use the selected unknown terminal as the current terminal. Or the following method can also be used to determine the current terminal.

[0088] Among the unknown terminals to be selected as the current terminal, select an unknown terminal as the pending terminal. Among the open ports of the pending terminal, excluding the specified ports, determine that the number of remaining open ports of the pending terminal is not less than the specified threshold. If so, select the pending terminal as the current terminal, otherwise reselect the current terminal in this terminal category. The specified threshold can be selected as needed, and this specification does not make specific limitations.

[0089] In this embodiment, there is no specific limitation on which designated ports are removed, and it can be determined according to service requirements. The designated ports to be removed can be the common ports of the terminal devices within the network for asset identification. For example, the Top1000 ports, or the ports within the network for asset identification that are known to provide specific services, can be used as the designated ports to be removed.

[0090] Because for common ports, they are generally common ports known to provide specific services. If most of the ports opened by an unknown terminal are common ports, then when selecting this unknown terminal as the current terminal, the possibility that other terminals in this terminal category open these common ports is very high. That is, in this case, for each port already opened by the current terminal, among the unknown terminals in this terminal category, the number of unknown terminals that have opened this port will be relatively large, resulting in an increase in the computational workload of quantity statistics during subsequent statistical processes and affecting the asset identification efficiency. Therefore, applying the method of this embodiment can improve the asset identification efficiency.

[0091] For example Figure 2 , if the method of this embodiment is used to select the current terminal, the unknown terminal A can be first determined as the pending terminal. Then it is determined that the ports opened by the unknown terminal A are 22, 23, 445, 5000, 49120, 61238. If the designated ports 22, 23, 445 that need to be removed are included, after removing the designated ports, there are still 3 ports left for the unknown terminal A to open: 5000, 49120, 61238. If the number of remaining open ports is not less than 3, the network device determines to select the unknown terminal A as the current terminal.

[0092] In an embodiment of this specification, in order to further improve the selection speed of characteristic ports, the statistical results of some low-frequency open ports can be discarded during statistics.

[0093] Specifically, for each port already opened by the current terminal, among the unknown terminals belonging to this terminal category, it is judged whether the number of unknown terminals that have opened this port is less than a preset lower limit value. The specific value of this preset lower limit value can be selected as needed, such as taking 2, 3, etc. as the preset lower limit value.

[0094] If the number of unknown terminals that have opened this port is less than the preset lower limit value, the statistical result corresponding to this port is discarded. If the number of unknown terminals that have opened this port is not less than the preset lower limit value, the statistical result corresponding to this port is retained.

[0095] Then, according to the statistical results corresponding to the remaining ports already opened by the current terminal, the remaining ports already opened by the current terminal are sorted, and according to the sorting result, among the remaining ports already opened by the current terminal, the characteristic ports corresponding to this terminal category are selected.

[0096] After the above step S104, the network device associates and stores the determined terminal categories and the characteristic ports corresponding to each terminal category in a database.

[0097] In subsequent asset identification, when an Internet of Things (IoT) terminal to be identified is obtained, the ports opened by the IoT terminal are matched with the characteristic ports of each terminal category stored in the database. Among them, in addition to storing the characteristic ports of unknown terminals learned through the above steps S100 - S104, the database can also store the characteristic ports of known terminal categories. When matching, the IoT terminal to be identified is matched with the characteristic ports of the learned terminal categories and the characteristic ports of each known terminal category together.

[0098] In addition, because the characteristic ports of known terminal categories can be obtained through manual marking and are relatively more accurate, the network device can first match the IoT terminal to be identified with the known terminal categories according to the priority. When the match with the known terminal categories fails, it is then matched with the characteristic ports of the terminal categories of the learned unknown terminals.

[0099] If the ports opened by the IoT terminal match the characteristic ports of a certain terminal category stored in the database, it is determined that the IoT terminal belongs to the said certain terminal category, and information such as the brand model of the IoT terminal can be identified according to the category identifier of the terminal category stored in the database.

[0100] If the ports opened by the IoT terminal do not match the characteristic ports of any terminal category stored in the database, the IoT terminal is regarded as an unknown terminal, and the methods of S100 - S104 are executed to determine the characteristic ports of the unknown terminal.

[0101] Figure 3 The figure shows a process diagram of asset identification provided in an embodiment of this specification. As Figure 3 shown, the unknown terminals determined during asset identification are A - D. The network device that performs asset identification classifies each unknown terminal according to the ports of the response of each unknown terminal to the probe message and the initial TTL of each unknown terminal. In Figure 3 the example, unknown terminals B and C belong to document processing devices and are classified into terminal category 1, and unknown terminals A and D belong to camera - type terminals and are classified into terminal category 2. Terminal category 1 and terminal category 2 respectively learn the characteristic ports of each terminal category according to the methods of the above steps S102 - S104. Then, the category identifiers of each terminal category and their characteristic ports are associated and stored in the database.

[0102] For example, if Figure 2For the terminal category shown, if the finally determined characteristic ports are 445, 5000, 49120, 61238, and 61138, the network device can associatively store the identifier of this terminal category and the characteristic ports of this terminal category in the database for the next asset identification. Among them, the identifier of this terminal category can be marked with meaningless unique characters or, through manual summary, determine the product category of this terminal category, such as the ipc camera terminal of P brand, as the category identifier. Then, during the next asset identification, when it is determined that the ports opened by a certain Internet of Things terminal are consistent with the characteristic ports of this terminal category, this Internet of Things terminal can be identified as the ipc camera terminal of P brand.

[0103] The above is the method for identifying Internet of Things assets for unknown terminals provided in this specification. Based on the same idea, this specification also provides a corresponding device for identifying Internet of Things assets for unknown terminals, as Figure 4 shown.

[0104] Figure 4 Schematic diagram of a device for identifying Internet of Things assets for unknown terminals provided in this specification. This device is applied to a network device and includes:

[0105] A classification module 200, configured to classify each unknown terminal in the network to obtain at least one terminal category;

[0106] A characteristic port determination module 202, configured to, for each terminal category, select one from the unknown terminals belonging to this terminal category as the current terminal; for each port opened by the current terminal, count the number of unknown terminals that have opened this port among the unknown terminals belonging to this terminal category; and based on the statistical result, select the characteristic port corresponding to this terminal category from the ports opened by the current terminal;

[0107] An iterative learning module 204, configured to, if the number of remaining unknown terminals among the unknown terminals belonging to this terminal category except for the unknown terminals that have opened the characteristic ports satisfies the identification condition, select one from the remaining unknown terminals as the current terminal, and return to the step of counting the number of unknown terminals that have opened this port among the unknown terminals belonging to this terminal category for each port opened by the current terminal; among them, the characteristic ports corresponding to each terminal category are used to identify the Internet of Things assets of the terminal.

[0108] Optionally, the classification module 200 is specifically configured to send probe messages to each unknown terminal in the network, receive the response messages of each unknown terminal to the probe messages, and classify each unknown terminal according to the message information of the response messages of each unknown terminal to obtain at least one terminal category.

[0109] Optionally, the classification module 200 is specifically used to parse the message information of the response message of each unknown terminal to the detection message, determine the port through which each unknown terminal responds to the detection message, and / or the initial life cycle of the data packet corresponding to each unknown terminal, and classify the unknown terminals according to the port through which each unknown terminal responds to the detection message, and / or the initial life cycle of the data packet corresponding to each unknown terminal.

[0110] Optionally, the classification module 200 is specifically configured to classify unknown terminals having the same port as the probe message response and the same initial life cycle of the data packet as a terminal category.

[0111] Optionally, the characteristic port determination module 202 is specifically used to select an unknown terminal from the unknown terminals to be selected as the current terminal, remove the specified port from the open ports of the pending terminal, and when the number of remaining open ports of the pending terminal is not less than a specified threshold, use the pending terminal as the current terminal.

[0112] Optionally, the iterative learning module 204 is specifically used to discard the statistical results corresponding to each port opened by the current terminal when the number of unknown terminals that have opened the port among the unknown terminals belonging to the terminal category is less than a preset lower limit value, and sort the remaining ports opened by the current terminal according to the statistical results corresponding to the remaining ports opened by the current terminal, and select the characteristic port corresponding to the terminal category from the remaining ports opened by the current terminal according to the sorting results.

[0113] Optionally, the iterative learning module 204 is specifically configured to determine whether the number of remaining unknown terminals meets the identification condition when there are other unknown terminals remaining among the unknown terminals belonging to the terminal category except the unknown terminals with the open characteristic ports.

[0114] This specification also provides a computer-readable storage medium, which stores a computer program that can be used to execute the above Figure 1 Provided is an IoT asset identification method for unknown terminals.

[0115] This manual also provides Figure 5 The schematic structure diagram of the electronic device shown in FIG. Figure 5 As mentioned above, at the hardware level, the electronic device includes a processor, an internal bus, a network interface, a memory and a non-volatile memory, and may also include other hardware required for the business. The processor reads the corresponding computer program from the non-volatile memory into the memory and then runs it to achieve the above Figure 1The method for identifying Internet of Things assets for unknown terminals. Of course, in addition to the software implementation, this specification does not exclude other implementation methods, such as logical devices or a combination of software and hardware, etc. That is to say, the execution subject of the following processing flow is not limited to each logical unit, but can also be hardware or logical devices.

[0116] Improvements to a technology can be clearly distinguished as either hardware improvements (e.g., improvements to circuit structures such as diodes, transistors, switches, etc.) or software improvements (improvements to method flows). However, with the development of technology, many improvements to method flows today can be regarded as direct improvements to hardware circuit structures. Designers almost always obtain the corresponding hardware circuit structure by programming the improved method flow into the hardware circuit. Therefore, it cannot be said that an improvement to a method flow cannot be implemented using a hardware entity module. For example, a programmable logic device (PLD) (e.g., a field programmable gate array (FPGA)) is such an integrated circuit whose logical function is determined by the user programming the device. Designers can program themselves to "integrate" a digital system onto a single PLD, without having to ask a chip manufacturer to design and fabricate a dedicated integrated circuit chip. Moreover, nowadays, instead of manually fabricating integrated circuit chips, this programming is mostly implemented using "logic compiler" software, which is similar to the software compiler used in program development and writing. The original code before compilation also has to be written in a specific programming language, which is called a hardware description language (HDL), and there is not just one kind of HDL, but many kinds, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used ones currently are VHDL (Very-High-Speed Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also be aware that by simply performing a little logical programming on the method flow using the above-mentioned several hardware description languages and programming it into an integrated circuit, it is easy to obtain the hardware circuit that implements the logical method flow.

[0117] The controller can be implemented in any suitable manner. For example, the controller can take the form of, for example, a microprocessor or a processor and a computer-readable medium storing computer-readable program code (such as software or firmware) executable by the (micro)processor, logic gates, switches, an application specific integrated circuit (ASIC), a programmable logic controller, and an embedded microcontroller. Examples of the controller include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320. The memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art also know that, in addition to implementing the controller in the form of pure computer-readable program code, it is entirely possible to logically program the method steps to enable the controller to be implemented in the form of logic gates, switches, application specific integrated circuits, programmable logic controllers, embedded microcontrollers, etc. to achieve the same function. Therefore, such a controller can be considered a hardware component, and the devices included therein for implementing various functions can also be regarded as the structures within the hardware component. Or even, the devices for implementing various functions can be regarded as either software modules for implementing the method or structures within the hardware component.

[0118] The systems, devices, modules, or units illustrated in the above embodiments can be specifically implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer can be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0119] For the convenience of description, when describing the above devices, they are described separately as various units according to their functions. Of course, when implementing this specification, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0120] Those skilled in the art should understand that the embodiments of the present application can be provided as a method, a system, or a computer program product. Therefore, the present application can take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk memories, CD-ROMs, optical memories, etc.) containing computer-usable program code.

[0121] This application is described with reference to the flowcharts and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the present application. It should be understood that each flow and / or block in the flowchart and / or block diagram, and combinations of flows and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to the processors of general-purpose computers, special-purpose computers, embedded processors, or other programmable data processing devices to generate a machine, such that the instructions executed by the processors of the computer or other programmable data processing devices produce means for implementing the functions specified in one or more of the flows Figure 1 one or more of the flows and / or blocks Figure 1 or means for implementing the functions specified in one or more of the blocks.

[0122] These computer program instructions can also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer-readable memory produce a manufacture including instruction means that implement the functions specified in one or more of the flows Figure 1 one or more of the flows and / or blocks Figure 1 or means for implementing the functions specified in one or more of the blocks.

[0123] These computer program instructions can also be loaded onto a computer or other programmable data processing device, such that a series of operational steps are performed on the computer or other programmable device to generate a computer-implemented process, and thus the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in one or more of the flows Figure 1 one or more of the flows and / or blocks Figure 1 or means for implementing the functions specified in one or more of the blocks.

[0124] In a typical configuration, a computing device includes one or more processors (CPUs), an input / output interface, a network interface, and memory.

[0125] The memory may include non-permanent memory in the form of computer-readable media, random access memory (RAM), and / or non-volatile memory, such as read-only memory (ROM) or flash memory (flash RAM). The memory is an example of computer-readable media.

[0126] Computer-readable media includes permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory computer-readable media (transitory media), such as modulated data signals and carrier waves.

[0127] It should also be noted that the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, commodity, or apparatus that includes a series of elements includes not only those elements but also other elements not explicitly listed, or includes elements inherent to such process, method, commodity, or apparatus. In the absence of further limitations, an element defined by the phrase "comprises a ..." does not exclude the presence of other identical elements in the process, method, commodity, or apparatus that includes the element.

[0128] Those skilled in the art will appreciate that the embodiments of this specification may be provided as methods, systems, or computer program products. Thus, this specification may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0129] This specification may be described in the general context of computer-executable instructions, such as program modules, executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, and the like that perform specific tasks or implement specific abstract data types. This specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communications network. In a distributed computing environment, program modules may be located in both local and remote computer storage media, including storage devices.

[0130] The various embodiments in this specification are described in a progressive manner. For the same or similar parts among the various embodiments, reference can be made to each other. Each embodiment focuses on the differences from other embodiments. In particular, for system embodiments, since they are basically similar to method embodiments, the description is relatively simple, and for the relevant parts, reference can be made to the partial description of the method embodiments.

[0131] The above description is only for the embodiments of this specification and is not intended to limit this specification. For those skilled in the art, various changes and modifications can be made to this specification. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of this specification shall be included within the scope of the claims of this application.

Claims

1. An Internet of Things asset identification method for unknown terminals, characterized in that, The method is applied to a network device and includes: Classify each unknown terminal in the network to obtain at least one terminal category; For each terminal category, select one unknown terminal belonging to the terminal category as the current terminal; for each open port of the current terminal, count the number of unknown terminals that have opened the port among the unknown terminals belonging to the terminal category; and based on the statistical result, select the characteristic port corresponding to the terminal category from the open ports of the current terminal; If the number of remaining unknown terminals among the unknown terminals belonging to the terminal category, excluding the unknown terminals that have opened the characteristic port, meets the identification condition, select one of the remaining unknown terminals as the current terminal, and return to the step of counting the number of unknown terminals that have opened the port among the unknown terminals belonging to the terminal category for each open port of the current terminal; Among them, the characteristic ports corresponding to each terminal category are used to identify Internet of Things assets of the terminal.

2. The method according to claim 1, characterized in that, Classify each unknown terminal in the network to obtain at least one terminal category, specifically including: Send a detection message to each unknown terminal in the network, and receive the response message of each unknown terminal to the detection message; Classify each unknown terminal according to the message information of the response message of each unknown terminal to obtain at least one terminal category.

3. The method according to claim 2, wherein Classify each unknown terminal according to the message information of the response message of each unknown terminal, specifically including: Analyze the message information of the response message of each unknown terminal to the detection message, and determine the port through which each unknown terminal responds to the detection message, and / or the initial packet lifetime corresponding to each unknown terminal; Classify each unknown terminal according to the port through which each unknown terminal responds to the detection message, and / or the initial packet lifetime corresponding to each unknown terminal.

4. The method according to claim 3, wherein Classify each unknown terminal according to the port through which each unknown terminal responds to the detection message and the initial packet lifetime corresponding to each unknown terminal, specifically including: Regard the unknown terminals with the same port and initial packet lifetime in the response to the detection message as one terminal category.

5. The method according to claim 1, characterized in that The current terminal is selected through the following steps: Select one unknown terminal from the unknown terminals to be the candidate current terminal as the pending terminal; Exclude the specified ports from the open ports of the pending terminal; When the number of remaining open ports of the pending terminal is not less than the specified threshold, regard the pending terminal as the current terminal.

6. The method according to claim 1, wherein Based on the statistical result, select the characteristic port corresponding to the terminal category from the open ports of the current terminal, specifically including: For each open port of the current terminal, when the number of unknown terminals that have opened the port among the unknown terminals belonging to the terminal category is less than the preset lower limit value, discard the statistical result corresponding to the port; Sort the remaining open ports of the current terminal according to the statistical results corresponding to the remaining open ports of the current terminal; According to the sorting result, select the characteristic port corresponding to the terminal category from the remaining open ports of the current terminal.

7. The method according to claim 1, wherein If the number of remaining unknown terminals among the unknown terminals belonging to this terminal category, excluding the unknown terminals that have already opened the feature ports, meets the recognition condition, specifically including: When there are still other unknown terminals among the unknown terminals belonging to this terminal category, excluding the unknown terminals that have already opened the feature ports, it is determined that the number of remaining unknown terminals meets the recognition condition.

8. An Internet of Things asset identification device for an unknown terminal, characterized in that, The device is applied to a network device and includes: A classification module that classifies each unknown terminal in the network to obtain at least one terminal category; A feature port determination module that, for each terminal category, selects one of the unknown terminals belonging to this terminal category as the current terminal; for each port that has been opened by the current terminal, counts the number of unknown terminals belonging to this terminal category that have opened this port; and based on the statistical results, selects the feature port corresponding to this terminal category from the ports that have been opened by the current terminal; An iterative learning module that, if the number of remaining unknown terminals among the unknown terminals belonging to this terminal category, excluding the unknown terminals that have already opened the feature ports, meets the recognition condition, selects one of the remaining unknown terminals as the current terminal, and returns to the step of counting the number of unknown terminals belonging to this terminal category that have opened each port that has been opened by the current terminal; wherein, the feature ports corresponding to each terminal category are used for identifying Internet of Things assets of the terminals.

9. A computer-readable storage medium, characterized in that, The storage medium stores a computer program, and when the computer program is executed by a processor, it implements the method according to any one of claims 1 to 7 above.

10. An electronic device, comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the method according to any one of claims 1 to 7 above.

Images