An internet of things asset identification method and device for unknown terminals

Abstract

The specification discloses an Internet of Things asset identification method and device for unknown terminals, and is applied to network equipment. Each unknown terminal in the network is classified, for each terminal category, a current terminal is selected from each unknown terminal belonging to the terminal category, for each port opened by the current terminal, the number of unknown terminals opening the port is counted from each unknown terminal belonging to the terminal category, and based on the counting result, a feature port is selected from the ports opened by the current terminal. If the number of remaining unknown terminals belonging to the terminal category, except for the unknown terminal opening the feature port, meets the identification condition, a current terminal is selected from the remaining unknown terminals. The method adopts an iterative learning mode, takes the ports opened by the selected current terminal as a reference, selects the feature port as the fingerprint information of each terminal category in subsequent asset identification, and enables the asset identification process to be automatically executed, thereby improving the asset identification efficiency.

Description

Technical Field

[0001] This specification relates to the field of computer technology, and in particular to a method and apparatus for identifying Internet of Things (IoT) assets for unknown terminals. Background Technology

[0002] The Internet of Things (IoT) is a network that connects and interacts with various physical devices and sensors via the internet. The physical devices connected to the IoT are called IoT devices. With the continuous development of technologies such as smart grids, smart homes, smart transportation, and smart logistics, the application of IoT devices, such as sensor devices, smart TVs, smart speakers, and smart vehicle equipment, is becoming increasingly widespread. In the IoT, various IoT devices constantly transmit and exchange data. This data may include personal information, device status, location information, and sensor data. If this data is leaked, it will have serious consequences.

[0003] IoT asset identification refers to the process of classifying and organizing the various physical devices exposed by IoT connections. Through IoT asset identification, corresponding security measures can be taken for different categories of IoT devices, thereby enhancing IoT data security.

[0004] Currently, clustering is generally used for IoT asset identification. Specifically, this involves obtaining device fingerprint information such as the type, model, version number, open ports, and running services of IoT devices, and then clustering these devices to determine their category. However, this clustering method requires extracting fingerprint information from each IoT terminal based on expert experience before asset identification can proceed, resulting in relatively low efficiency.

[0005] Therefore, this specification provides a method for identifying IoT assets for unknown terminals. Summary of the Invention

[0006] This specification provides a method, apparatus, storage medium, and electronic device for identifying IoT assets for unknown terminals, in order to at least partially solve the aforementioned problems existing in the prior art.

[0007] The following technical solution is adopted in this specification:

[0008] This specification provides a method for identifying IoT assets for unknown terminals. This method is applied to network devices and includes:

[0009] Classify the unknown terminals in the network to obtain at least one terminal category;

[0010] For each terminal category, select one unknown terminal belonging to that category as the current terminal; for each port that the current terminal has opened, count the number of unknown terminals that have opened that port from the unknown terminals belonging to that category; and based on the statistical results, select the feature port corresponding to that terminal category from the ports that the current terminal has opened.

[0011] If the number of remaining unknown terminals in each unknown terminal category other than those that have opened the feature port meets the identification condition, then select one of the remaining unknown terminals as the current terminal, and return the step of counting the number of unknown terminals that have opened the port for each port that has been opened for the current terminal from each unknown terminal in the terminal category.

[0012] Among them, the feature ports corresponding to each terminal category are used to identify IoT assets of the terminal.

[0013] Optionally, the unknown terminals in the network are classified to obtain at least one terminal category, specifically including:

[0014] Send probe messages to each unknown terminal in the network, and receive response messages from each unknown terminal to the probe messages;

[0015] Based on the message information of the response messages of each unknown terminal, the unknown terminals are classified to obtain at least one terminal category.

[0016] Optionally, the unknown terminals are classified according to the message information of their response messages, specifically including:

[0017] Analyze the message information of the response messages of each unknown terminal to the probe message, determine the port of each unknown terminal responding to the probe message, and / or the initial lifecycle of the data packet corresponding to each unknown terminal;

[0018] The unknown terminals are classified according to the port on which they respond to the probe message and / or the initial lifecycle of the data packets corresponding to each unknown terminal.

[0019] Optionally, the unknown terminals are classified according to the port on which they respond to the probe message and the initial lifecycle of the data packet corresponding to each unknown terminal, specifically including:

[0020] Unknown terminals whose port and data packet initial lifecycle are the same as those responding to the probe message are classified as a single terminal category.

[0021] Optionally, the current terminal selects through the following steps:

[0022] From the unknown terminals that are currently being selected as the candidate terminals, select one unknown terminal as the candidate terminal;

[0023] Remove the specified ports from the ports open by the pending terminals;

[0024] When the number of remaining open ports of the pending terminal is not less than a specified threshold, the pending terminal is designated as the current terminal.

[0025] Optionally, based on the statistical results, select the characteristic port corresponding to the terminal category from the currently open ports of the terminal, specifically including:

[0026] For each port that is currently open on the terminal, if the number of unknown terminals that have opened the port among all unknown terminals belonging to that terminal category is less than a preset lower limit, the statistical results corresponding to that port are discarded.

[0027] Based on the statistical results corresponding to the remaining currently open ports of the terminal, sort the remaining currently open ports of the terminal.

[0028] Based on the sorting results, select the feature port corresponding to the terminal category from the remaining currently open ports of the terminal.

[0029] Optionally, if the number of remaining unknown terminals among the unknown terminals belonging to this terminal category, excluding those that have already opened the characteristic port, meets the identification criteria, specifically including:

[0030] When there are other unknown terminals remaining among the unknown terminals belonging to this terminal category, besides those that have opened the aforementioned feature ports, the number of remaining unknown terminals is determined to meet the identification conditions.

[0031] This specification provides an IoT asset identification device for unknown terminals. The device is applied to network equipment and includes:

[0032] The classification module classifies each unknown terminal in the network to obtain at least one terminal category;

[0033] The feature port determination module selects one unknown terminal from all unknown terminals belonging to that terminal category as the current terminal for each terminal category; for each port that the current terminal has opened, it counts the number of unknown terminals that have opened that port from all unknown terminals belonging to that terminal category; and based on the statistical results, it selects the feature port corresponding to that terminal category from all the ports that the current terminal has opened.

[0034] The iterative learning module, if the number of remaining unknown terminals (excluding those with the specified characteristic ports already open) among all unknown terminals belonging to that terminal category meets the identification criteria, selects one of the remaining unknown terminals as the current terminal and returns the step of counting the number of unknown terminals with the specified port already open for each port of the current terminal from all unknown terminals belonging to that terminal category; wherein, the characteristic ports corresponding to each terminal category are used for IoT asset identification of the terminal. This specification provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the above-described method for IoT asset identification of unknown terminals.

[0035] This specification provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the above-described method for identifying IoT assets for unknown terminals.

[0036] The above-mentioned technical solutions adopted in this specification can achieve the following beneficial effects:

[0037] The IoT asset identification method for unknown terminals provided in this specification is applied to network devices. In this method, unknown terminals in the network are classified to obtain at least one terminal category. For each terminal category, one unknown terminal belonging to that category is selected as the current terminal. For each port that the current terminal has opened, the number of unknown terminals belonging to that terminal category that have opened that port is counted. Based on the statistical results, a feature port corresponding to that terminal category is selected from the ports that the current terminal has opened. If the number of remaining unknown terminals belonging to that terminal category, excluding those that have opened the feature port, meets the identification criteria, one of the remaining unknown terminals is selected as the current terminal, and the process returns to the step of counting the number of unknown terminals belonging to that terminal category that have opened each port that the current terminal has opened.

[0038] In this method, network devices can automatically classify unknown terminals. Within each terminal category, an iterative learning approach is used. In each round, based on the selected open ports of the currently used terminal, feature ports are selected from the currently open ports. By determining the feature ports in each round, the feature ports of that terminal category are finally determined, serving as the fingerprint information for each terminal category in subsequent asset identification. Through the feature ports of this method, the asset identification process can be automated, eliminating the need for manual determination of device fingerprint information and improving the efficiency of asset identification. Attached Figure Description

[0039] The accompanying drawings, which are included to provide a further understanding of this specification and form part of this specification, illustrate exemplary embodiments and are used to explain this specification, but do not constitute an undue limitation thereof. In the drawings:

[0040] Figure 1 This is a flowchart illustrating an IoT asset identification method for an unknown terminal as described in this specification.

[0041] Figure 2 A port statistics table for a terminal category provided for embodiments of this specification;

[0042] Figure 3 This is a diagram illustrating an asset identification process provided in the embodiments of this specification;

[0043] Figure 4 This specification provides a schematic diagram of an IoT asset identification device for an unknown terminal.

[0044] Figure 5 The corresponding information provided in this specification Figure 1 A schematic diagram of an electronic device. Detailed Implementation

[0045] To make the objectives, technical solutions, and advantages of this specification clearer, the technical solutions of this specification will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this specification, and not all of them. All other embodiments obtained by those skilled in the art based on the embodiments in this specification without creative effort are within the scope of protection of this application.

[0046] With the widespread adoption of IoT devices and the development of artificial intelligence technology, an increasing number of IoT devices are being exposed to the internet, leading to heightened concerns about their security. IoT asset identification is a necessary and crucial aspect of IoT security. Summarizing, organizing, and analyzing exposed IoT devices is of great significance in identifying security vulnerabilities.

[0047] Asset identification allows organizations to identify the models, brands, and other device identities of IoT devices connected within their network, enabling them to develop effective security strategies, assess risks, and ensure the security of their internal network assets.

[0048] The IoT asset identification method for unknown terminals provided in this manual can be applied to network devices such as firewalls and switches to identify IoT assets within a specific organization's network and ensure network security.

[0049] The technical solutions provided in the various embodiments of this specification are described in detail below with reference to the accompanying drawings.

[0050] Figure 1 This is a flowchart illustrating an IoT asset identification method for unknown terminals as described in this specification, specifically including the following steps:

[0051] S100: Classify the unknown terminals in the network to obtain at least one terminal category.

[0052] In the asset identification scenario described in this manual, the location of the device that needs to be identified is known, i.e., its IP address is known. However, due to version updates, the addition of new devices, or other reasons, terminal devices that do not belong to the known category may be detected in the network space for asset identification.

[0053] If a terminal device belongs to a known category, its fingerprint information, such as open ports, can be identified and matched with the fingerprint information of each device category stored in the network asset database. This allows the terminal device to be identified as belonging to a known category, and its identity can be determined by using the device model, version number, and other information of that known category stored in the database.

[0054] If a terminal device does not belong to a known category and there is no matching device category stored in the network asset database, the network device defines the device as an unknown device whose identity is yet to be identified. Using the method described in this specification, the characteristic ports of the unknown device are automatically determined and stored in the database as the fingerprint information of the unknown device for subsequent asset identification.

[0055] The network device continuously monitors the network and periodically executes the asset identification process according to the asset identification method described in this manual. For a given period of network asset identification, after the network device identifies the unknown terminals whose identities are unknown and matched in the database within that period, it needs to perform an initial category classification of these unknown terminals. Within each terminal category, the feature ports of each terminal category are obtained through the iterative port learning method described in this manual. These feature ports serve as fingerprint information for each terminal category and are used to identify terminal devices belonging to that terminal category in the next period of asset identification.

[0056] In other words, applying the asset identification method described in this specification, for terminal A whose identity cannot be identified in the current period, the network device automatically classifies terminal A and learns the characteristic ports of the terminal category to which terminal A belongs. The network device can associate the characteristic ports of the terminal category to which terminal A belongs with the category identifier of that terminal category and store them in the database, updating the terminal category fingerprint information in the database.

[0057] In the next asset identification cycle, if terminal A is detected again, the category of terminal A can be matched in the database based on the feature port of the terminal category to which terminal A belongs, and the identity of terminal A will no longer be unknown.

[0058] In this specification, the network device can send probe messages to unknown terminals in the network and receive response messages from unknown terminals to the probe messages.

[0059] Specifically, network devices send probe messages to the unknown devices within the IoT network that require asset identification, based on the IP addresses of each unknown device. These probe messages can be SYN scans (TCP half-open scans), TCP full-connection scans, UDP scans, ACK scans, etc.

[0060] For each unknown device, the network device sends probe packets to each port number of a specified port segment of that unknown device to perform a port scan. The port number range is 0 to 65535. The specified port for sending probe packets can be determined according to service requirements as either a full port segment (0 to 65535) or a port segment within a certain range of the full port segment.

[0061] Different unknown devices, due to differences in their signals, configurations, and services provided, will respond to the probe message via specific ports. That is, only specific ports within a designated port segment will return a response message to the network device. This specific port may be one or multiple. Subsequently, the network device classifies the unknown terminals based on the message information in their response messages, obtaining at least one terminal category. This specification does not restrict the specific classification method; classification can be based on message fields such as the source port number, network protocol, and Time To Live (TTL).

[0062] S102: For each terminal category, select one unknown terminal belonging to that terminal category as the current terminal; for each port that the current terminal has opened, count the number of unknown terminals that have opened that port from the unknown terminals belonging to that terminal category; and based on the statistical results, select the feature port corresponding to that terminal category from the ports that the current terminal has opened.

[0063] In the asset learning method described in this specification, the network device uses an iterative learning approach for each initially defined terminal category to learn the common characteristics of the open ports of each unknown terminal included in the terminal category, in order to determine the characteristic ports of the terminal category.

[0064] In this specification, we adopt the approach of moving from a single device to a class of devices. First, we select one of the unknown terminals belonging to this terminal category as the current terminal. Then, based on the open ports of the current terminal, we learn the ports with higher opening frequencies among the open ports of the unknown terminals belonging to this terminal category, and use them as the characteristic ports of this terminal category.

[0065] The specific learning method is as follows: for each port that is currently open on the terminal, count the number of unknown terminals that have opened the port from among the unknown terminals belonging to that terminal category, and based on the statistical results, select the feature port corresponding to that terminal category from among the ports that are currently open on the terminal.

[0066] This specification does not impose restrictions on the criteria for measuring ports with high opening frequency. It can be limited by a specified proportion of the total number of ports within a terminal category, by a direct quantity threshold, or by selecting the top N ports based on the sorted order of their corresponding opening frequencies.

[0067] For example, when there are 8 unknown terminals in the terminal category, if a specified percentage of the total number of terminals in a terminal category is used as a limit, the specified percentage can be set to 50%. If the percentage of a certain port that is open in the terminal category is greater than 50%, that is, greater than 4, then the candidate port will be used as the feature port.

[0068] S104: If the number of remaining unknown terminals in each unknown terminal category other than those that have opened the feature port meets the identification condition, then select one of the remaining unknown terminals as the current terminal, and return the step of counting the number of unknown terminals that have opened each port for the current terminal from each unknown terminal in the terminal category; wherein, the feature port corresponding to each terminal category is used to identify IoT assets of the terminal.

[0069] After identifying a characteristic port based on a current terminal, the network device determines the number of remaining unknown terminals among the unknown terminals belonging to that terminal category, excluding those unknown terminals that have opened the aforementioned identified characteristic ports, and whether this meets the identification criteria.

[0070] This manual does not specifically limit the identification conditions. For example, the identification condition could be to determine whether there are any other unknown terminals remaining among the unknown terminals belonging to this terminal category, besides those that have opened the identified characteristic ports. Alternatively, it could be to determine whether the number of remaining open ports among the unknown terminals belonging to this terminal category, besides those that have opened the identified characteristic ports, is not less than a preset value.

[0071] If yes, select one of the remaining unknown terminals as the current terminal, return to step S102 above, and continue to determine the characteristic port based on the new current terminal. If no, the characteristic port determination process for this terminal category is complete, and the determined characteristic port for this category, as well as the category identifier, is stored in the database.

[0072] After the characteristic ports of each terminal category in each unknown terminal are determined, in the next cycle of asset identification, the network device can perform asset identification based on the characteristic ports of each terminal category determined in the current cycle stored in the database.

[0073] Figure 2 A port statistics table for a terminal category is provided for embodiments of this specification. The following will be based on... Figure 2 The example further explains the feature port iterative learning process of this embodiment. For example... Figure 2 The terminal categories shown include 8 unknown terminals, from A to H. In the first round of feature port determination, unknown terminal A is selected as the current terminal.

[0074] Then, using the ports opened by unknown terminal A as a baseline, the network device counts the number of unknown terminals in the terminal category to which unknown terminal A has opened each port. The result of this count is... Figure 2 As shown.

[0075] Figure 2 The first line lists the open ports of the unknown terminal A (22, 23, 445, 5000, 49120, 61238). Figure 2 Rows 2 through 9 show the port opening status of each unknown terminal for unknown terminal A. For each cell, "1" indicates that the unknown terminal in the corresponding row has opened the port in the corresponding column of that cell, and "0" indicates that the unknown terminal in the corresponding row has not opened the port in the corresponding column of that cell.

[0076] Figure 2 The last line is a statistical value showing the number of ports opened for the unknown terminal A. It can be seen that... Figure 2 Among the terminal categories shown, the number of terminals that have opened ports 22, 23, 445, 5000, 49120, and 61238 of the unknown terminal A are 5, 5, 6, 6, 7, and 7, respectively.

[0077] If the network device limits the proportion of open ports in the terminal category to more than 50%, and uses ports with more than 5 open ports as characteristic ports, then the characteristic ports determined for unknown terminal A in the first round are 445, 5000, 49120, and 61238.

[0078] Next, the network device begins the second round of characteristic port learning. Among the unknown terminals A to H, the unknown terminals whose open ports include the characteristic ports identified in the first round are determined, namely the unknown terminals that have opened ports 445, 5000, 49120, and 61238 (unknown terminal A, unknown terminal C, unknown terminal E, and unknown terminal G). Among the remaining unknown terminals B, D, F, and H, the current terminal is reselected according to the method in step S102 above, and new characteristic ports are determined, until no current terminal that meets the identification conditions can be determined again.

[0079] According to the above Figure 1 The method for identifying IoT assets for unknown terminals is applied to network devices. It classifies unknown terminals in the network to obtain at least one terminal category. For each terminal category, one unknown terminal belonging to that category is selected as the current terminal. For each open port of the current terminal, the number of unknown terminals belonging to that category that have opened that port is counted. Based on the count, a feature port corresponding to that terminal category is selected from the open ports of the current terminal. If the number of remaining unknown terminals belonging to that terminal category, excluding those with the feature port open, meets the identification criteria, one of the remaining unknown terminals is selected as the current terminal, and the process returns to the step of counting the number of unknown terminals belonging to that terminal category that have opened that port for each open port of the current terminal.

[0080] In this method, network devices can automatically classify unknown terminals. Within each terminal category, an iterative learning approach is used. In each round, based on the selected open ports of the currently used terminal, feature ports are selected from the currently open ports. By determining the feature ports in each round, the feature ports of that terminal category are finally determined, serving as the fingerprint information for each terminal category in subsequent asset identification. Through the feature ports of this method, the asset identification process can be automated, eliminating the need for manual determination of device fingerprint information and improving the efficiency of asset identification.

[0081] Theoretically, terminal devices with the same initial lifecycle of data packets generally have the same operating system. Furthermore, terminal devices of the same type typically respond to probe packets using the same port.

[0082] Based on this, in one embodiment, when performing the initial classification of unknown terminals in step S100, the network device can parse the message information of the response messages of each unknown terminal to the probe messages, determine the port of each unknown terminal responding to the probe messages, and / or the initial lifecycle of the data packets corresponding to each unknown terminal. The port of each unknown terminal responding to the probe messages is the source port number in the message information of the response messages.

[0083] Then, based on the port of each unknown terminal's response to the probe message and / or the initial lifecycle of the data packet corresponding to each unknown terminal, each unknown terminal is classified.

[0084] When classifying, network devices can either classify only the port responding to probe messages—that is, unknown terminals that respond to probe messages from the same port as the network device—as a single terminal category; or they can classify only the initial lifetime of the data packet—that is, unknown terminals with the same initial lifetime of data packets as a single terminal category.

[0085] Alternatively, the port of the probe response and the initial lifespan of the data packet can be used as the classification criteria. That is, the network device can classify unknown terminals with the same port of the probe response and the same initial lifespan of the data packet as a single terminal category.

[0086] For example, terminal A responds to probe messages using ports 2000 and 3000, terminal B responds to probe messages using ports 2000 and 3000, and terminal C responds to probe messages using port 6000. Terminals A and B both have an initial TTL of 64, while terminal C has an initial TTL of 128. Therefore, in this step, terminals A and B are grouped into one terminal category, while terminal C is grouped into a separate terminal category.

[0087] In step S102 above, the network device may randomly select one unknown terminal from among all unknown terminals belonging to that terminal category, and directly use the selected unknown terminal as the current terminal. Alternatively, the current terminal may be determined using the following method.

[0088] Among the unknown terminals in the candidate current terminal list, select one unknown terminal as the pending terminal. Excluding the specified ports, determine if the number of remaining open ports of the pending terminal is not less than a specified threshold. If so, select the pending terminal as the current terminal; otherwise, reselect the current terminal from this terminal category. This specified threshold can be selected as needed; this specification does not impose specific restrictions.

[0089] In this embodiment, there is no restriction on the specific ports to be removed; they can be determined based on business requirements. The ports to be removed can be commonly used ports of terminal devices within the network used for asset identification. For example, the Top 1000 ports, or ports within the network known to provide specific services for asset identification, can be used as the ports to be removed.

[0090] Because commonly used ports are generally known ports that provide specific services. If an unknown terminal opens most of its ports as commonly used ports, then when that unknown terminal is selected as the current terminal, other terminals in that terminal category are very likely to have these commonly used ports open as well. In other words, for each port that the current terminal has opened, the number of unknown terminals in that terminal category that have opened that port will be relatively large, leading to an increased computational burden in subsequent statistical analysis and affecting asset identification efficiency. Therefore, applying the method of this embodiment can improve asset identification efficiency.

[0091] like Figure 2 If the method of this embodiment is used to select the current terminal, unknown terminal A can be determined as the pending terminal first. Then, the open ports of unknown terminal A are determined to be 22, 23, 445, 5000, 49120, and 61238. If these include the specified ports 22, 23, and 445 that need to be removed, and after removing the specified ports, unknown terminal A still has 3 open ports remaining: 5000, 49120, and 61238, and the number of remaining open ports is not less than 3, then the network device determines to select unknown terminal A as the current terminal.

[0092] In one embodiment of this specification, in order to further improve the selection speed of feature ports, the statistical results of some low-frequency open ports can be discarded during the statistical process.

[0093] Specifically, for each port that is currently open on the terminal, among all unknown terminals belonging to that terminal category, it is determined whether the number of unknown terminals that have opened that port is less than a preset lower limit. The specific value of this preset lower limit can be selected as needed, such as 2 or 3.

[0094] If the number of unknown terminals with the port open is less than a preset lower limit, the statistical results for that port are discarded. If the number of unknown terminals with the port open is not less than the preset lower limit, the statistical results for that port are retained.

[0095] Then, based on the statistical results of the remaining open ports of the current terminals, the remaining open ports of the current terminals are sorted, and based on the sorting results, the feature port corresponding to the terminal category is selected from the remaining open ports of the current terminals.

[0096] After step S104 above, the network device associates and stores the determined terminal categories and the corresponding characteristic ports in the database.

[0097] In subsequent asset identification, when an IoT terminal to be identified is acquired, the open ports of the IoT terminal are matched with the feature ports of each terminal category stored in the database. The database can store not only the feature ports of unknown terminals learned through steps S100-S104, but also the feature ports of known terminal categories. During matching, the IoT terminal to be identified is matched together with the learned feature ports of the terminal category and the known feature ports of each terminal category.

[0098] Furthermore, since the characteristic ports of known terminal categories can be obtained through manual labeling, which is relatively more accurate, network devices can prioritize matching the IoT terminal to be identified with known terminal categories first. When a matching of known terminal categories fails, the device will then match the characteristic ports of the learned unknown terminal categories.

[0099] If the open port of an IoT terminal matches the characteristic port of a certain terminal category stored in the database, then the IoT terminal is determined to belong to that terminal category. Based on the category identifier of that terminal category stored in the database, the brand, model and other information of the IoT terminal can be identified.

[0100] If the open port of the IoT terminal does not match the characteristic port of any terminal category stored in the database, then the IoT terminal is regarded as an unknown terminal, and the above methods S100 to S104 are executed to determine the characteristic port of the unknown terminal.

[0101] Figure 3 This is a diagram illustrating an asset identification process provided in the embodiments of this specification, such as... Figure 3 As shown, the unknown terminals identified during asset identification are designated A through D. The network device performing asset identification classifies the unknown terminals based on their port responses to probe packets and their initial TTL. Figure 3 In the example, unknown terminals B and C belong to document processing devices and are classified as terminal category 1, while unknown terminals A and D belong to camera terminals and are classified as terminal category 2. Terminal categories 1 and 2 learn their characteristic ports according to steps S102-S104 described above. Then, the category identifier and characteristic ports of each terminal category are associated and stored in the database.

[0102] For example, if Figure 2The terminal categories shown are ultimately identified by their characteristic ports: 445, 5000, 49120, 61238, and 61138. Network devices can then associate and store the identifier of this terminal category with its characteristic ports in a database for future asset identification. The identifier for this terminal category can be a meaningless unique character or a manually determined product category, such as "P brand IPC camera terminal," as the category identifier. Therefore, during the next asset identification, if an IoT terminal's open port matches the characteristic port of this terminal category, the IoT terminal can be identified as a P brand IPC camera terminal.

[0103] The above describes the IoT asset identification method for unknown terminals provided in this manual. Based on the same approach, this manual also provides corresponding IoT asset identification devices for unknown terminals, such as... Figure 4 As shown.

[0104] Figure 4 This specification provides a schematic diagram of an IoT asset identification device for an unknown terminal. The device is applied to network equipment and includes:

[0105] The classification module 200 is used to classify each unknown terminal in the network to obtain at least one terminal category;

[0106] The feature port determination module 202 is used to select one unknown terminal belonging to the terminal category as the current terminal for each terminal category; for each port that the current terminal has opened, count the number of unknown terminals that have opened the port from the unknown terminals belonging to the terminal category; and based on the statistical results, select the feature port corresponding to the terminal category from the ports that the current terminal has opened.

[0107] The iterative learning module 204 is used to select one of the remaining unknown terminals as the current terminal if the number of the remaining unknown terminals (excluding those that have opened the feature port) among the unknown terminals belonging to the terminal category meets the identification condition, and return the step of counting the number of unknown terminals that have opened each port for the current terminal from the unknown terminals belonging to the terminal category; wherein, the feature port corresponding to each terminal category is used to identify IoT assets of the terminal.

[0108] Optionally, the classification module 200 is specifically used to send probe messages to each unknown terminal in the network, receive response messages from each unknown terminal to the probe messages, and classify each unknown terminal according to the message information of the response messages of each unknown terminal to obtain at least one terminal category.

[0109] Optionally, the classification module 200 is specifically used to parse the message information of the response messages of each unknown terminal to the probe message, determine the port of each unknown terminal responding to the probe message, and / or the initial life cycle of the data packet corresponding to each unknown terminal, and classify each unknown terminal according to the port of each unknown terminal responding to the probe message, and / or the initial life cycle of the data packet corresponding to each unknown terminal.

[0110] Optionally, the classification module 200 is specifically used to classify unknown terminals whose port and data packet initial lifecycle are the same as those responding to the probe message as a terminal category.

[0111] Optionally, the feature port determination module 202 is specifically used to select an unknown terminal from the unknown terminals of the candidate current terminal as a pending terminal, remove a specified port from the open ports of the pending terminal, and when the number of remaining open ports of the pending terminal is not less than a specified threshold, the pending terminal is selected as the current terminal.

[0112] Optionally, the iterative learning module 204 is specifically used to, for each port that is currently open on the terminal, when the number of unknown terminals that have opened the port among the unknown terminals belonging to that terminal category is less than a preset lower limit, discard the statistical results corresponding to that port, sort the remaining ports that are currently open on the terminal according to the statistical results corresponding to the remaining ports that are currently open on the terminal, and select the feature port corresponding to that terminal category among the remaining ports that are currently open on the terminal according to the sorting results.

[0113] Optionally, the iterative learning module 204 is specifically used to determine the number of remaining unknown terminals that meet the identification conditions when there are other unknown terminals remaining among the unknown terminals belonging to the terminal category, in addition to the unknown terminals that have opened the feature ports.

[0114] This specification also provides a computer-readable storage medium storing a computer program that can be used to execute the above-described... Figure 1 A method for identifying IoT assets for unknown terminals is provided.

[0115] This instruction manual also provides Figure 5 The diagram shows a schematic structural representation of the electronic device. Figure 5 At the hardware level, the electronic device includes a processor, internal bus, network interface, memory, and non-volatile memory, and may also include other hardware required for the business operations. The processor reads the corresponding computer program from the non-volatile memory into memory and then runs it to achieve the above-mentioned functions. Figure 1The method for identifying IoT assets for unknown terminals is described above. Of course, besides software implementation, this specification does not exclude other implementation methods, such as logic devices or a combination of hardware and software, etc. That is to say, the execution entity of the following processing flow is not limited to individual logic units, but can also be hardware or logic devices.

[0116] Improvements in a technology can be clearly distinguished as either hardware improvements (e.g., improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the methodology). However, with technological advancements, many improvements to the methodology can now be considered direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved methodology into the hardware circuit. Therefore, it cannot be said that an improvement in methodology cannot be implemented using hardware physical modules. For example, a Programmable Logic Device (PLD) (such as a Field Programmable Gate Array (FPGA)) is such an integrated circuit whose logic function is determined by the user programming the device. Designers can program and "integrate" a digital system onto a PLD themselves, without needing chip manufacturers to design and manufacture dedicated integrated circuit chips. Furthermore, nowadays, instead of manually manufacturing integrated circuit chips, this programming is mostly implemented using "logic compiler" software. Similar to the software compiler used in program development, the original code before compilation must be written in a specific programming language, called a Hardware Description Language (HDL). There are many HDLs, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, and RHDL (Ruby Hardware Description Language). Currently, VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog are the most commonly used. Those skilled in the art should understand that by simply performing some logic programming on the method flow using one of these hardware description languages ​​and programming it into an integrated circuit, the hardware circuit implementing the logical method flow can be easily obtained.

[0117] The controller can be implemented in any suitable manner. For example, it can take the form of a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro)processor, logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicon Labs C8051F320. A memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also recognize that, in addition to implementing the controller in purely computer-readable program code form, the same functionality can be achieved by logically programming the method steps to make the controller take the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers. Therefore, such a controller can be considered a hardware component, and the means included therein for implementing various functions can also be considered as structures within the hardware component. Alternatively, the means for implementing various functions can be considered as both software modules implementing the method and structures within the hardware component.

[0118] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, a computer can be, for example, a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email device, game console, tablet computer, wearable device, or any combination of these devices.

[0119] For ease of description, the above devices are described in terms of function, divided into various units. Of course, in implementing this specification, the functions of each unit can be implemented in one or more software and / or hardware.

[0120] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0121] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0122] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0123] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0124] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0125] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0126] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0127] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0128] Those skilled in the art will understand that the embodiments of this specification can be provided as methods, systems, or computer program products. Therefore, this specification may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this specification may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0129] This specification can be described in the general context of computer-executable instructions that are executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform a specific task or implement a specific abstract data type. This specification can also be practiced in distributed computing environments, where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0130] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

[0131] The above description is merely an embodiment of this specification and is not intended to limit this specification. Various modifications and variations can be made to this specification by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this specification should be included within the scope of the claims of this application.

Claims

1. A method for identifying IoT assets for unknown terminals, characterized in that, This method is applied to network devices, including: Classify the unknown terminals in the network to obtain at least one terminal category; For each terminal category, select one unknown terminal from all unknown terminals belonging to that category as the current terminal; for each port that the current terminal has opened, count the number of unknown terminals that have opened that port from all unknown terminals belonging to that category; for each port that the current terminal has opened, if the number of unknown terminals that have opened that port from all unknown terminals belonging to that category is less than a preset lower limit, discard the statistical result corresponding to that port; based on the statistical results corresponding to the remaining ports that the current terminal has opened, sort the remaining ports that the current terminal has opened; based on the sorting result, select the feature port corresponding to that terminal category from the remaining ports that the current terminal has opened. If the number of remaining unknown terminals in each unknown terminal category other than those that have opened the feature port meets the identification condition, then select one of the remaining unknown terminals as the current terminal, and return the step of counting the number of unknown terminals that have opened the port for each port that has been opened for the current terminal from each unknown terminal in the terminal category. Among them, the feature ports corresponding to each terminal category are used to identify IoT assets of the terminal.

2. The method as described in claim 1, characterized in that, Classify the unknown terminals in the network to obtain at least one terminal category, specifically including: Send probe messages to each unknown terminal in the network, and receive response messages from each unknown terminal to the probe messages; Based on the message information of the response messages of each unknown terminal, the unknown terminals are classified to obtain at least one terminal category.

3. The method as described in claim 2, characterized in that, Based on the message information of the response messages from each unknown terminal, the unknown terminals are classified, specifically including: Analyze the message information of the response messages of each unknown terminal to the probe message, determine the port of each unknown terminal responding to the probe message, and / or the initial lifecycle of the data packet corresponding to each unknown terminal; The unknown terminals are classified according to the port on which they respond to the probe message and / or the initial lifecycle of the data packets corresponding to each unknown terminal.

4. The method as described in claim 3, characterized in that, Based on the port used by each unknown terminal to respond to the probe message and the initial lifecycle of the data packet corresponding to each unknown terminal, the unknown terminals are classified, specifically including: Unknown terminals whose port and data packet initial lifecycle are the same as those responding to the probe message are classified as a single terminal category.

5. The method as described in claim 1, characterized in that, The current terminal selects through the following steps: From the unknown terminals that are currently being selected as the candidate terminals, select one unknown terminal as the candidate terminal; Remove the specified ports from the ports open by the pending terminals; When the number of remaining open ports of the pending terminal is not less than a specified threshold, the pending terminal is designated as the current terminal.

6. The method as described in claim 1, characterized in that, If the number of remaining unknown terminals among all unknown terminals belonging to this terminal category, excluding those that have already opened the aforementioned feature ports, meets the identification criteria, specifically including: When there are other unknown terminals remaining among the unknown terminals belonging to this terminal category, besides those that have opened the aforementioned feature ports, the number of remaining unknown terminals is determined to meet the identification conditions.

7. An IoT asset identification device for unknown terminals, characterized in that, This device is used in network equipment, including: The classification module classifies each unknown terminal in the network to obtain at least one terminal category; The feature port determination module, for each terminal category, selects one unknown terminal belonging to that terminal category as the current terminal; for each port that the current terminal has opened, counts the number of unknown terminals belonging to that terminal category that have opened that port; for each port that the current terminal has opened, if the number of unknown terminals belonging to that terminal category that have opened that port is less than a preset lower limit, discards the statistical result corresponding to that port; based on the statistical results corresponding to the remaining ports that the current terminal has opened, sorts the remaining ports that the current terminal has opened; based on the sorting result, selects the feature port corresponding to that terminal category from the remaining ports that the current terminal has opened. The iterative learning module, if the number of remaining unknown terminals (excluding those with the specified feature ports already open) among the unknown terminals belonging to this terminal category meets the identification criteria, selects one of the remaining unknown terminals as the current terminal and returns the step of counting the number of unknown terminals with the specified port already open from among the unknown terminals belonging to this terminal category for each port already open for the current terminal; wherein, the feature ports corresponding to each terminal category are used to identify IoT assets of the terminal.

8. A computer-readable storage medium, characterized in that, The storage medium stores a computer program, which, when executed by a processor, implements the method described in any one of claims 1 to 6.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the method described in any one of claims 1 to 6.

Images