IP address management method and device, storage medium and electronic equipment

Abstract

The embodiment of the invention discloses an IP address management method and device, a storage medium and electronic equipment, and belongs to the technical field of communication. According to the embodiment of the invention, by obtaining the protocol layer data and the application layer data of the target device, the device fingerprint of the target device can be generated based on the protocol layer data and the application layer data, the device fingerprint represents the identity label of the target device, and then IP address management is performed on the target device based on the device fingerprint. Therefore, by comprehensively considering the protocol layer data and the application layer data of the target equipment, the unique equipment fingerprint can be generated for the target equipment without depending on sensitive information of the target equipment, so that accurate identification of the target equipment and efficient management of the IP address are realized while user privacy is protected.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of communication technology, and specifically to an IP address management method, device, storage medium, and electronic device. Background Art

[0002] With the popularization of privacy protection technology, modern devices generally adopt random MAC (Media Access Control Address) technology. Although this technology improves user privacy protection, it also makes traditional device identification and IP (Internet Protocol) address allocation methods based on MAC addresses ineffective, resulting in network administrators being unable to accurately identify devices and, therefore, unable to allocate appropriate IP resources to them. Summary of the Invention

[0003] The embodiments of the present application provide an IP address management method, apparatus, storage medium, and electronic device, which can generate a unique device fingerprint for a target device without relying on sensitive information, thereby achieving accurate identification of the target device and efficient management of IP addresses.

[0004] In a first aspect, an embodiment of the present application provides an IP address management method, including:

[0005] Obtain protocol layer data and application layer data of the target device;

[0006] Generating a device fingerprint of the target device based on the protocol layer data and the application layer data; wherein the device fingerprint represents an identity of the target device;

[0007] Based on the device fingerprint, IP address management is performed on the target device.

[0008] In one embodiment, generating a device fingerprint of the target device based on the protocol layer data and the application layer data includes:

[0009] Performing feature extraction on the protocol layer data to obtain protocol layer behavior features of the target device;

[0010] Performing feature extraction on the application layer data to obtain application layer behavior features of the target device;

[0011] The protocol layer behavior characteristics and the application layer behavior characteristics are calculated and processed to obtain a device fingerprint of the target device.

[0012] In one embodiment, the protocol layer behavior characteristics include a first protocol characteristic, a second protocol characteristic, and a third protocol characteristic, and the protocol layer data includes a parameter request list, a vendor identifier, a synchronization flag SYN message, and a client hello message;

[0013] The extracting features of the protocol layer data to obtain protocol layer behavior features of the target device includes:

[0014] Extracting parameter combination sequence information from the parameter request list, and extracting a first preset number of target bytes from the vendor identifier;

[0015] determining the parameter combination sequence information and the first preset number of target bytes as the first protocol feature;

[0016] extracting initial window size information from the SYN message, and determining the initial window size information as the second protocol feature;

[0017] A second preset number of cipher suite information is extracted from the Client Hello message, and the second preset number of cipher suite information is determined as the third protocol feature.

[0018] In one embodiment, the application layer behavior characteristics include query behavior characteristics and traffic characteristics, and the application layer data includes domain name system DNS query logs, traffic cycle data, and the number of data packets in two adjacent statistical periods;

[0019] The extracting features of the application layer data to obtain application layer behavior features of the target device includes:

[0020] Extracting a target record type from the DNS query log, and determining the target record type as the query behavior feature; the target record type is a record type whose corresponding query ratio in the DNS query log meets the first condition;

[0021] Based on the number of data packets in the two adjacent statistical periods, a traffic change rate is determined, and the traffic change rate and the traffic period data are determined as the traffic feature.

[0022] In one embodiment, the calculating and processing the protocol layer behavior characteristics and the application layer behavior characteristics to obtain the device fingerprint of the target device includes:

[0023] Performing feature fusion on the protocol layer behavior features and the application layer behavior features to obtain a comprehensive feature vector;

[0024] Based on a preset hash algorithm, a hash operation is performed on the feature vector to obtain a device fingerprint of the target device.

[0025] In one embodiment, the fusing the protocol layer behavior features and the application layer behavior features to obtain a comprehensive feature vector includes:

[0026] Performing privacy processing on the protocol layer behavior characteristics and the application layer behavior characteristics to obtain privacy-processed feature data; the privacy processing includes one or more of fuzzification processing, generalization processing, and randomization processing;

[0027] Feature fusion is performed on the privacy-processed feature data to obtain the comprehensive feature vector.

[0028] In one embodiment, the performing IP address management on the target device based on the device fingerprint includes:

[0029] Determining the activity of the target device based on the application layer data;

[0030] An IP address is assigned to the target device based on the activity and the device fingerprint.

[0031] In one embodiment, the application layer data includes traffic data and DNS query logs;

[0032] The determining the activity of the target device based on the application layer data includes:

[0033] Determining a flow period and a flow change rate of the target device based on the flow data;

[0034] Determining a DNS query frequency of the target device based on the DNS query log;

[0035] The activity of the target device is determined based on the traffic cycle, the traffic change rate, and the DNS query frequency.

[0036] In one embodiment, allocating an IP address to the target device based on the activity and the device fingerprint includes:

[0037] Determining a target activity range to which the activity belongs among a plurality of preset activity ranges;

[0038] Determine a target IP address pool corresponding to the target activity range from a plurality of preset IP address pools; wherein different activity ranges correspond to different IP address pools;

[0039] Based on the device fingerprint, an IP address is allocated to the target device in the target IP address pool.

[0040] In a second aspect, an embodiment of the present application provides an IP address management device, the device comprising:

[0041] Data acquisition module, used to obtain protocol layer data and application layer data of the target device;

[0042] A fingerprint generation module, configured to generate a device fingerprint of the target device based on the protocol layer data and the application layer data; the device fingerprint represents an identity of the target device;

[0043] The address management module is used to manage the IP address of the target device based on the device fingerprint.

[0044] In one embodiment, the fingerprint generation module includes:

[0045] A protocol layer feature determination submodule, configured to extract features from the protocol layer data to obtain protocol layer behavior features of the target device;

[0046] An application layer feature submodule, configured to extract features from the application layer data to obtain application layer behavior features of the target device;

[0047] The device fingerprint generation submodule is used to calculate and process the protocol layer behavior characteristics and the application layer behavior characteristics to obtain the device fingerprint of the target device.

[0048] In one embodiment, the protocol layer behavior characteristics include a first protocol characteristic, a second protocol characteristic, and a third protocol characteristic, and the protocol layer data includes a parameter request list, a vendor identifier, a synchronization flag SYN message, and a client hello message;

[0049] The protocol layer feature determination submodule includes:

[0050] a first data extraction subunit, configured to extract parameter combination sequence information from the parameter request list and extract a first preset number of target bytes from the vendor identifier;

[0051] a first protocol feature determining unit, configured to determine the parameter combination sequence information and the first preset number of target bytes as the first protocol feature;

[0052] a second protocol feature determining unit, configured to extract initial window size information from the SYN message, and determine the initial window size information as the second protocol feature;

[0053] The third protocol feature determining unit is configured to extract a second preset number of cipher suite information from the client hello message, and determine the second preset number of cipher suite information as the third protocol feature.

[0054] In one embodiment, the application layer behavior characteristics include query behavior characteristics and traffic characteristics, the application layer data includes domain name system (DNS) query logs, traffic cycle data, and the number of data packets in two adjacent statistical cycles; the application layer characteristics submodule includes:

[0055] a query feature determination unit, configured to extract a target record type from the DNS query log and determine the target record type as the query behavior feature; the target record type is a record type whose corresponding query ratio in the DNS query log satisfies a first condition;

[0056] The traffic feature determination unit is used to determine the traffic change rate based on the number of data packets in the two adjacent statistical periods, and determine the traffic change rate and the traffic period data as the traffic feature.

[0057] In one embodiment, the device fingerprint generation submodule includes:

[0058] a feature fusion unit, configured to fuse the protocol layer behavior features and the application layer behavior features to obtain a comprehensive feature vector;

[0059] The device fingerprint generating unit is configured to perform a hash operation on the feature vector based on a preset hash algorithm to obtain the device fingerprint of the target device.

[0060] In one embodiment, the feature fusion unit includes:

[0061] a privacy processing subunit, configured to perform privacy processing on the protocol layer behavior characteristics and the application layer behavior characteristics to obtain privacy-processed feature data; the privacy processing includes one or more of fuzzification processing, generalization processing, and randomization processing;

[0062] The feature vector obtaining subunit is used to perform feature fusion on the privacy-processed feature data to obtain the comprehensive feature vector.

[0063] In one embodiment, the address management module includes:

[0064] an activity determination submodule, configured to determine the activity of the target device based on the application layer data;

[0065] An IP address allocation submodule is configured to allocate an IP address to the target device based on the activity and the device fingerprint.

[0066] In one embodiment, the application layer data includes traffic data and DNS query logs; and the activity determination submodule includes:

[0067] a first determining unit, configured to determine a flow period and a flow change rate of the target device based on the flow data;

[0068] a second determining unit, configured to determine a DNS query frequency of the target device based on the DNS query log;

[0069] An activity determination unit is used to determine the activity of the target device based on the traffic cycle, the traffic change rate and the DNS query frequency.

[0070] In one embodiment, the IP address allocation submodule includes:

[0071] an activity range determining unit, configured to determine a target activity range to which the activity belongs from among a plurality of preset activity ranges;

[0072] An IP address pool determining unit, configured to determine a target IP address pool corresponding to the target activity range from among a plurality of preset IP address pools; wherein different activity ranges correspond to different IP address pools;

[0073] An IP address allocating unit is configured to allocate an IP address to the target device from the target IP address pool based on the device fingerprint.

[0074] In a third aspect, an embodiment of the present application further provides an electronic device, which includes a memory, a processor, and a computer program stored in the memory and runnable on the processor. When the computer program is executed by the processor, the steps in the above-mentioned IP address management method are implemented.

[0075] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps in the above-mentioned IP address management method are implemented.

[0076] In a fifth aspect, an embodiment of the present application further provides a computer program product or a computer program, which includes computer instructions, which are stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the methods provided in the various optional implementations described in the embodiments of the present application.

[0077] In summary, in the embodiments of the present application, the protocol layer data and application layer data of the target device are first obtained; then, based on the protocol layer data and application layer data, a device fingerprint of the target device is generated, and the device fingerprint represents the identity of the target device; finally, based on the device fingerprint, the IP address of the target device is managed. In this way, by comprehensively considering the protocol layer data and application layer data of the target device, a unique device fingerprint can be generated for the target device without relying on the sensitive information of the target device, thereby achieving accurate identification of the target device and efficient management of the IP address while protecting the user's privacy. BRIEF DESCRIPTION OF THE DRAWINGS

[0078] In order to more clearly illustrate the technical solutions in this application, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0079] Figure 1 This is a schematic diagram of the steps of an IP address management method provided by an embodiment of the present application;

[0080] Figure 2 This is a schematic diagram of the steps of another IP address management method provided by an embodiment of the present application;

[0081] Figure 3 This is a schematic diagram of the structure of an IP address management device provided in one embodiment of the present application;

[0082] Figure 4 This is a structural diagram of an electronic device provided in one embodiment of the present application. DETAILED DESCRIPTION

[0083] The following will be combined with the drawings in this application to clearly and completely describe the technical solutions in this application. Obviously, the embodiments described are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without making creative efforts shall fall within the scope of protection of the present invention.

[0084] It's important to note that with the rapid increase in the number of smart devices and the increasing complexity of network access environments, traditional IP address management models are facing significant challenges. In densely populated scenarios like smart homes and enterprise networks, with diverse device types and complex behavior patterns, the traditional Dynamic Host Configuration Protocol (DHCP) system, due to its static and single-minded allocation logic, is struggling to adapt to the demands of modern networks. The limitations of traditional solutions are particularly evident in key areas such as device identification, resource allocation, and privacy protection.

[0085] With the widespread adoption of privacy-preserving technologies, modern smart devices, such as iOS (iPhone Operating System) 14 and above and Android (Android Operating System) 10 and above, generally adopt randomized MAC address technology. While this technology effectively improves user privacy, it also renders traditional MAC address-based device identification and IP address allocation methods inoperable. As a result, network administrators are unable to accurately identify connected devices and, consequently, allocate appropriate IP resources to them.

[0086] Furthermore, traditional device identification methods often rely on collecting sensitive information such as the device's host name and MAC address. This approach may violate relevant privacy regulations and pose certain privacy risks. With increasing user awareness of privacy protection, there is an urgent need for a device identification and IP address management method that does not rely on sensitive information.

[0087] In response to the problem that current IP address management methods rely on sensitive device information and are difficult to accurately identify devices, the embodiments of the present application aim to provide an IP address management method. By comprehensively considering the protocol layer data and application layer data of the target device, a unique device fingerprint can be generated for the target device without relying on the sensitive information of the target device, thereby achieving accurate identification of the target device and efficient management of IP addresses while protecting user privacy.

[0088] The following explains the terms involved in the embodiments of this application.

[0089] DHCP stands for Dynamic Host Configuration Protocol. DHCP is used to automatically assign and manage IP addresses and other network configuration parameters (such as subnet masks, default gateways, and DNS server addresses) to network devices. It dynamically assigns IP addresses to devices through communication between a server and clients, simplifying network management and eliminating the tedious process of manually configuring IP addresses.

[0090] TCP stands for Transmission Control Protocol. TCP is a connection-oriented, reliable transport layer protocol used to transmit data over a network. It ensures that data is transmitted completely and accurately from sender to receiver through mechanisms such as connection establishment, data transmission confirmation, and error detection.

[0091] TLS stands for Transport Layer Security. TLS is a security protocol used to provide encryption and data integrity protection in network communications. It is the successor to SSL (Secure Sockets Layer). It is primarily used to protect data transmission between clients and servers, preventing data from being eavesdropped, tampered with, or forged.

[0092] Option 55: Parameter Request List in a DHCP request. Option 55 is used by the DHCP client to specify the network configuration parameters it needs to obtain from the DHCP server. When sending a DHCP request message, the client lists the parameter option codes it requires in Option 55. The server then returns the corresponding configuration information based on these codes.

[0093] Option 60: Vendor Identifier. Option 60 is used by the client to identify its vendor or device type. It allows the client to provide information about its hardware or software configuration to the DHCP server, which can then assign a specific IP address or configuration to the client based on this information.

[0094] SYN: Synchronization flag. SYN is a flag used to synchronize the sequence numbers between the client and server during the TCP three-way handshake.

[0095] IW: Initial Window Size. The initial window size is the receive window size advertised by the device in the SYN packet when a TCP connection is established. It is used to control the data transmission rate.

[0096] ClientHello: Client Hello message. This is the first message in the TLS handshake process, sent by the client to the server. It marks the beginning of the TLS handshake and provides the server with the client's supported encryption parameters and version information, allowing both parties to negotiate and establish a secure connection.

[0097] DNS: Domain Name System. DNS is the Internet's system for translating domain names into corresponding IP addresses, allowing users to access network resources through easy-to-remember domain names instead of complex numeric IP addresses.

[0098] A record: Address Record. A records are used to map domain names to IPv4 addresses. When you enter a domain name in a browser, the DNS server queries the A record for that domain name to obtain the corresponding IPv4 address, allowing you to access the target website or network service.

[0099] AAAA record: IPv6 Address Record. Similar to an A record, it maps domain names to IPv6 addresses. With the widespread adoption of IPv6, AAAA records play a vital role in IPv6-enabled networks, enabling devices to access domain-based network resources using IPv6 addresses.

[0100] PTR record: Pointer Record. PTR records are primarily used for reverse resolution, which involves finding the corresponding domain name based on an IP address. For example, a mail server might use a PTR record to verify that the sender's IP address matches the domain name to prevent spam and online fraud.

[0101] Figure 1 A flowchart of an IP address management method according to an embodiment of the present application is schematically shown. Although a logical order is shown in the step diagram, in some cases, the steps shown or described may be performed in a different order than shown in the figure. Specifically, the execution subject of the IP address management method can be any computing service device with data processing, network communication, and program execution functions, such as a network management device, or other electronic device that needs to manage the IP address of the target device.

[0102] Reference Figure 1 , shows an IP address management method of the present application, which may specifically include the following steps:

[0103] S101: Acquire protocol layer data and application layer data of a target device.

[0104] In this embodiment, the target device refers to a device that requires an IP address when accessing the network. Specifically, the target device can be a terminal device with data processing, network communication, and program execution capabilities, such as an IoT device, a network device, a smart home device, and a wearable device. IoT devices can include sensors and actuators, network devices can include personal computers, laptops, mobile phones, switches, video conferencing equipment, and game consoles, smart home devices can include smart TVs, smart speakers, and smart light bulbs, and wearable devices can include smart watches and smart glasses.

[0105] It should be noted that protocol layer data refers to the data involved in various protocols used by the target device to implement communication between other network devices during network communication; application layer data is data directly used and processed by network applications. It is located at the top layer of the network protocol stack and directly serves user needs.

[0106] In this embodiment, by acquiring the protocol layer data and application layer data of the target device, the behavioral characteristics of the target device can be comprehensively analyzed from two dimensions: the protocol layer and the application layer.

[0107] S102: Generate a device fingerprint of the target device based on the protocol layer data and the application layer data.

[0108] In this embodiment, considering that different devices usually have different device types and different service functions, so that they usually have different behavioral characteristics during network communication, therefore, by comprehensively analyzing the protocol layer data and application layer data, it is possible to effectively identify the various behavioral characteristics of the target device during network communication, and then generate a unique device fingerprint for the target device.

[0109] In this embodiment, the device fingerprint represents the identity of the target device, and different devices have different device fingerprints. In other words, the network management device can accurately identify the target device among multiple devices based on the device fingerprint.

[0110] S103: Perform IP address management on the target device based on the device fingerprint.

[0111] In this embodiment, after generating a unique device fingerprint of the target device, when the target device accesses the network and needs to be assigned an IP address, the network management device can directly assign an appropriate IP address to the target device based on the device fingerprint.

[0112] In this embodiment, after assigning an IP address to a target device, the device fingerprint can be associated with the target device's current IP address to construct an address mapping table between the device fingerprint and the IP address. This address mapping table can be stored in a dedicated encrypted database or a configuration file of a network management system. When the target device reconnects to the network, the address mapping table can be searched based on the target device's device fingerprint, quickly matching the corresponding target IP address, and assigning the target IP address to the target device. This avoids frequent adjustments to the target device's IP address allocation policy, thereby reducing network fluctuations and improving allocation efficiency.

[0113] In this embodiment, based on the device fingerprint of the target device, the target device can be accurately identified, avoiding the possible erroneous allocation of IP addresses based on information that is easy to forge or change, such as MAC addresses, so that the target device can obtain a suitable and relatively fixed IP address each time it accesses the network, reducing network connection problems caused by IP address conflicts or improper allocation, and ensuring the stability of network communications.

[0114] In this embodiment, by comprehensively considering the protocol layer data and application layer data of the target device, a unique device fingerprint can be generated for the target device without relying on sensitive information such as the host name and MAC address of the target device, thereby protecting user privacy while achieving accurate identification of the target device and efficient management of the IP address.

[0115] In a feasible implementation, S102 may specifically include the following sub-steps:

[0116] S102-1: Extract features from the protocol layer data to obtain protocol layer behavior features of the target device.

[0117] It should be noted that protocol-layer behavioral characteristics represent the target device's behavior at the protocol layer. Specifically, protocol-layer behavioral characteristics are the behavioral patterns and characteristics exhibited by the target device when following various network protocols during network communications. They can reflect the device's behavioral tendencies within the underlying network communication mechanisms.

[0118] In this embodiment, the protocol layer behavior characteristics may specifically include a first protocol characteristic, a second protocol characteristic, and a third protocol characteristic; wherein the first protocol characteristic may represent a DHCP protocol characteristic, the second protocol characteristic may represent a TCP protocol characteristic, and the third protocol characteristic may represent a TLS protocol characteristic. The protocol layer data may specifically include DHCP data, TCP data, and TLS data. In this way, by performing in-depth analysis of the DHCP data, TCP data, and TLS data of the target device, comprehensive and accurate extraction of protocol layer behavior characteristics can be achieved across the three protocol dimensions.

[0119] S102-2: Extract features from the application layer data to obtain application layer behavior features of the target device.

[0120] It should be noted that application-layer behavioral characteristics represent the target device's behavior at the application layer. Specifically, application-layer behavioral characteristics are the behavioral patterns and characteristics exhibited by the target device when running various applications. They can reflect the device's usage habits, functional requirements, and interaction with the network at the application level.

[0121] In this embodiment, application layer behavior features may specifically include query behavior features and traffic features, and application layer data may specifically include traffic data and Domain Name System (DNS) query logs. Thus, by deeply analyzing the traffic data and DNS query logs of the target device, comprehensive and accurate extraction of application layer behavior features can be achieved.

[0122] S102-3: Generate a device fingerprint of the target device based on the protocol layer behavior characteristics and the application layer behavior characteristics.

[0123] In a specific implementation, the protocol layer behavior features and the application layer behavior features can be combined into a feature vector, and then the feature vector is encoded and encrypted to obtain the device fingerprint of the target device.

[0124] In this embodiment, since both the protocol layer behavior characteristics and the application layer behavior characteristics are obtained by feature extraction of multi-dimensional data, by comprehensively considering the protocol layer behavior characteristics and the application layer behavior characteristics, a stable and unique device fingerprint can be generated for the target device.

[0125] In one feasible embodiment, to achieve comprehensive and accurate extraction of protocol layer behavior features, the protocol layer data may include a parameter request list, a vendor identifier, a synchronization flag SYN message, and a client hello message. S102-1 may specifically include the following sub-steps:

[0126] S102-1-1: Extract parameter combination sequence information from the parameter request list, and extract a first preset number of target bytes from the vendor identifier.

[0127] S102-1-2: Determine the parameter combination sequence information and the first preset number of target bytes as a first protocol feature.

[0128] In this embodiment, the protocol layer data may specifically include a parameter request list and a vendor identifier in the DHCP data.

[0129] It should be noted that DHCP is a key protocol for devices to request IP addresses when accessing a network. Different types of devices typically exhibit different behavioral characteristics when sending DHCP requests. Therefore, by extracting features from the parameter request list and vendor identifier in the DHCP data, it is possible to accurately extract the first protocol feature of the target device within the DHCP protocol dimension. The parameter combination sequence information in the parameter request list and the first preset number of target bytes in the vendor identifier both reflect the target device's device type. Therefore, the first protocol feature can be used to characterize the target device's device type.

[0130] In this embodiment, the Option 55 field is the parameter request list in the DHCP request. The device uses this field to request the required network configuration parameters from the DHCP server. Due to differences in operating systems or network protocol stack implementations across devices, the order of Option 55 parameter combinations is device-specific. For example, [1, 3, 6] represents the requested subnet mask, router, and DNS server, respectively.

[0131] In this embodiment, the device types can be effectively distinguished by analyzing the parameter request list. For example, a smart speaker may request [1, 3, 6], while a smart light bulb may request [1, 6, 15].

[0132] In this embodiment, the Option 60 field is the Vendor Class Identifier (Vendor Class Identifier) ​​in the DHCP request, which identifies the device's manufacturer or operating system. Given the long field length of the Vendor Class Identifier, the Vendor Class Identifier can be simplified by extracting a first predetermined number of target bytes from the Vendor Class Identifier while retaining the device's identification information. For example, if the Option 60 field of an Android device is "android-dhcp-9," the first three bytes of the Option 60 field can be extracted to obtain the three target bytes "and."

[0133] In this embodiment, by comprehensively considering the parameter request list and the vendor identifier, accurate extraction of the first protocol feature can be achieved.

[0134] S102-1-3: Extract initial window size information from the SYN message, and determine the initial window size information as the second protocol feature.

[0135] In this embodiment, the protocol layer data may further specifically include a SYN message in the TCP data.

[0136] It's important to note that TCP is a core protocol for network communications, and different devices exhibit distinct behavioral characteristics when establishing TCP connections. Therefore, by extracting features from SYN packets within TCP data, we can accurately extract the second protocol feature within the TCP protocol. The initial window size information in the SYN packet accurately reflects the target device's data transmission rate, and thus, the second protocol feature can be used to characterize the target device's data transmission rate.

[0137] It's important to note that the initial window size information is the receive window size advertised by the device in the SYN packet when a TCP connection is established. It is used to control the data transmission rate. Different devices have different operating systems or network protocol stack implementations, resulting in device-specific initial window size information. For example, video conferencing equipment may use a larger initial window size, such as 64KB, while low-power devices may use a smaller initial window size, such as 16KB.

[0138] In this embodiment, by extracting the initial window size information from the SYN message, the second protocol feature can be accurately extracted.

[0139] S102-1-4: Extract a second preset number of cipher suite information from the Client Hello message, and determine the second preset number of cipher suite information as a third protocol feature.

[0140] In this embodiment, the protocol layer data may further include a client hello message in the TLS data.

[0141] It should be noted that TLS is an encryption protocol for network communications, and different devices exhibit different behavioral characteristics when establishing a TLS connection. Therefore, by extracting features from the client hello message within the TLS data, it is possible to extract a third protocol feature of the target device within the TLS protocol dimension. The second preset number of cipher suite information accurately reflects the cipher suite types supported by the target device. Therefore, the third protocol feature can be used to characterize the cipher suite types supported by the target device.

[0142] It's important to note that when sending a Client Hello message, different devices list the cipher suites they support in order of priority. A cipher suite is a combination of algorithms used to encrypt communications in a TLS connection. The order in which cipher suites are supported varies across devices, depending on their operating system or application.

[0143] In this embodiment, the second preset number can be set to 3, and the third protocol characteristic of the target device can be obtained by extracting the first three cipher suites in the Client Hello message. For example, the first three cipher suites [0x1301, 0x1303, 0x1305] in the Client Hello message can be used as the third protocol characteristic of the target device.

[0144] In this embodiment, by extracting the initial window size information from the client hello message, accurate extraction of the second protocol feature can be achieved.

[0145] In this embodiment, the protocol layer behavior characteristics of the target device can be obtained by combining the first protocol characteristics, the second protocol characteristics, and the third protocol characteristics.

[0146] In this embodiment, since the protocol layer behavior characteristics are determined by multiple factors such as the device's hardware, operating system, and network protocol stack implementation, they have high stability and uniqueness, and can provide a solid data foundation for the generation of device fingerprints.

[0147] In one feasible embodiment, to achieve comprehensive and accurate extraction of application layer behavior features, the application layer data may include domain name system (DNS) query logs, traffic cycle data, and the number of data packets in two adjacent statistical cycles. S102-2 may specifically include the following sub-steps:

[0148] S102-2-1: Determine a traffic change rate based on the number of data packets in two adjacent statistical periods, and determine the traffic change rate and traffic period data as traffic characteristics.

[0149] It should be noted that the target device will continuously generate traffic data during network communication, and different devices typically have different traffic characteristics. For example, high-frequency interactive devices frequently exchange data, resulting in faster communication frequency and more obvious traffic changes.

[0150] In this embodiment, in order to accurately identify traffic characteristics, the traffic data may specifically include traffic cycle data of the target device and the number of data packets in two adjacent statistical periods.

[0151] In a specific implementation, the traffic cycle data can be determined as the traffic cycle characteristics of the target device; based on the number of data packets in two adjacent statistical periods, the traffic change rate is determined, and the traffic change rate is determined as the burst traffic characteristics of the target device; based on the traffic cycle characteristics and the burst traffic characteristics, the traffic characteristics of the target device are determined.

[0152] It should be noted that the traffic period feature characterizes the communication frequency of the target device. For example, a smart speaker may perform a heartbeat communication with the cloud server every 3600 seconds (1 hour); a smart light bulb may perform a heartbeat communication with the cloud server every 86400 seconds (1 day). Devices with shorter periods, such as smart speakers, can be classified as high-frequency interaction devices, while devices with longer periods, such as smart light bulbs, may be classified as low-frequency interaction devices. The traffic period feature can also effectively reflect whether the network traffic of the target device has periodic characteristics. For example, smart home devices may generate traffic within a fixed time period.

[0153] It should be noted that burst traffic characteristics represent the traffic changes of the target device. Specifically, the device's network traffic can be monitored, the number of packets in two adjacent statistical periods can be recorded, and the traffic change rate can be determined as the ratio of the difference in the number of packets in the two adjacent statistical periods to the difference between the two statistical periods.

[0154] For example, when the statistical period is set to 60 seconds, the target device sends 100 data packets in one minute, and the target device sends 300 data packets in the next minute, then the traffic change rate can be calculated as (300-100) / 60=3.33 packets / s.

[0155] In this embodiment, the burst traffic feature can effectively characterize the traffic changes of the target device in a short period of time. For example, a video conferencing device may generate a large amount of burst traffic during a call, while the traffic change rate of the smart light bulb is significantly smaller than the traffic change rate of the video conferencing device.

[0156] In this embodiment, by comprehensively considering the traffic cycle data of the target device and the number of data packets in two adjacent statistical periods, accurate extraction of traffic features can be achieved.

[0157] S102-2-2: Extract the target record type from the DNS query log, and determine the target record type as the query behavior feature.

[0158] In this embodiment, by deeply analyzing the DNS query log, it is possible to analyze the target device's usage pattern of domain name resolution in network communication. For example, smart home devices may frequently query specific cloud service domain names.

[0159] In this embodiment, the target record type can be the record type whose corresponding query ratio in the DNS query log meets the first condition. In a specific implementation, the first condition can be set to the record type with the highest query ratio. Specifically, the query ratio of each record type can be determined based on the DNS query log, and the record type with the highest query ratio can be determined as the target record type.

[0160] For example, by analyzing DNS query logs, we can obtain the record types queried by the target device, such as A, AAAA, and PTR. We can then calculate the query ratios for A records, AAAA records, and PTR records, and determine the record type with the highest ratio as the query behavior characteristic of the target device. Specifically, the query behavior characteristic can reflect the network communication pattern of the device. For example, devices with a high ratio of A records are typically those that actively initiate communication, such as smart speakers, while devices with a high ratio of PTR records are typically those that passively respond, such as smart light bulbs.

[0161] In this embodiment, by analyzing the query proportions of each record type in the DNS query log, accurate extraction of query behavior features can be achieved.

[0162] In this embodiment, by combining traffic characteristics and query behavior characteristics, we can obtain the application layer behavior characteristics of the target device. In this way, by comprehensively considering the application layer behavior characteristics on top of the protocol layer behavior characteristics, we can fully ensure the stability and uniqueness of the target device's device fingerprint.

[0163] In a feasible implementation, S102-3 may specifically include the following sub-steps:

[0164] S102-3-1: Calculate and process the protocol layer behavior characteristics and the application layer behavior characteristics to obtain a comprehensive feature vector.

[0165] In this embodiment, the protocol layer behavior features and the application layer behavior features may be directly combined and arranged to generate a comprehensive feature vector.

[0166] In this embodiment, considering that the protocol layer behavior characteristics and application layer behavior characteristics usually contain sensitive data of the target device, in order to achieve privacy protection of the target device, the protocol layer behavior characteristics and application layer behavior characteristics can also be privacy processed to obtain privacy-processed feature data; the privacy-processed feature data can be feature fused to obtain a comprehensive feature vector.

[0167] In this embodiment, privacy processing is used to convert protocol layer behavior features and application layer behavior features to hide the original feature data. Specifically, privacy processing can include one or more of fuzzification, generalization, and randomization.

[0168] It should be noted that the fuzzy processing refers to normalizing or discretizing the numerical fields in the protocol layer behavior characteristics and the application layer behavior characteristics.

[0169] Specifically, taking the normalization of the initial window size information as an example, the initial window size information can be normalized into levels, such as divided into levels 1 to 8, and then 16KB can be normalized to level 2, and 64KB can be normalized to level 5.

[0170] Specifically, taking the traffic rate of change as an example, the traffic rate of change can be discretized into five levels. For example, a traffic rate of change < 1 packet / s corresponds to level 1; 1 packet / s ≤ change rate < 5 packets / s corresponds to level 2; 5 packets / s ≤ change rate < 10 packets / s corresponds to level 3; and so on. For example, the traffic rate of a video conferencing device is 8 packets / s, which is discretized to level 3. The traffic rate of a smart light bulb is 0.5 packets / s, which is discretized to level 1.

[0171] It should be noted that randomization refers to the random reordering of fields with parameter sequences in the protocol layer and application layer behavior characteristics. For example, if the parameter sequence of Option 55 is [1, 3, 6], it will be converted to [3, 6, 1] after randomization; and if the cipher suite is [0x1301, 0x1303], it will be converted to [0x1303, 0x1301] after randomization.

[0172] It should be noted that generalization is used to generalize the character data in protocol-layer and application-layer behavioral features into categories. For example, we can count the query percentages for A records, AAAA records, and PTR records, and generalize the target record type with the highest query percentage into a category. For example, "A-dominant" indicates that A records account for ≥ 80%.

[0173] In this embodiment, by performing privacy processing on the protocol layer behavior characteristics and the application layer behavior characteristics, the privacy security of the target device can be effectively protected.

[0174] S102-3-2: Based on a preset hash algorithm, perform a hash operation on the feature vector to obtain the device fingerprint of the target device.

[0175] It's important to note that a hash algorithm is an algorithm that converts input data of arbitrary length (often called a message or key) into a fixed-length output (called a hash value, digest, or hash value) using a hash function. Hash algorithms are generally irreversible, meaning that the output of a hash function (hash value) cannot be reversed to the original input data. In other words, given a hash value, it's impossible to directly derive the original input data from it using a specific computational method or algorithm.

[0176] In a specific implementation, the SHA-3 algorithm can be used to perform hash calculation on the salted feature vector to obtain the device fingerprint of the target device.

[0177] In an example, taking a smart light bulb as an example, the device fingerprint of the smart light bulb can be generated by following the steps below:

[0178] S1. Extract features from the protocol layer data to obtain protocol layer behavior features of the smart bulb. The protocol layer behavior features include:

[0179] DHCP behavior characteristics: Use the parameter combination sequence information in Option 55, for example, [1, 6, 15];

[0180] TCP behavior characteristics: using the initial window size information in the SYN message, for example, 32KB;

[0181] TLS behavior characteristics: Use the first three cipher suite information in the client hello message, for example, [0x1301, 0x1302, 0x1303].

[0182] S2. Privacy processing of protocol layer behavior characteristics:

[0183] S2.1. Randomize the parameter combination sequence information:

[0184] Original order: [1, 6, 15];

[0185] Randomization: Randomly disrupt the order, and the parameter combination information order obtained by randomization is [6, 15, 1];

[0186] S2.2. Normalize the initial window size information:

[0187] Original value: 32KB;

[0188] Normalized to level (assuming the level range is 1-8): 32KB corresponds to level 3, that is, the normalized initial window size information is 3;

[0189] S2.3. Randomize the cipher suite information:

[0190] Original cipher suite information: [0x1301, 0x1302, 0x1303];

[0191] Randomized cipher suite information: [0x1303, 0x1302, 0x1301].

[0192] S3. Extract features from the application layer data to obtain application layer behavior features of the target device. The application layer behavior features include:

[0193] Traffic cycle characteristics: 86400 seconds (i.e., one communication per day);

[0194] Burst traffic characteristics: Traffic change rate is 0.5 packets / s.

[0195] S4. Serialize the privacy-processed feature data into a string to obtain the comprehensive feature vector: V = "6, 15, 1, 3, 0x1303, 0x1301, 0x1302, 86400, 1, A-dominant, Low-variance".

[0196] S5. Use an irreversible hash algorithm (such as SHA-3) to hash the salted comprehensive feature vector to generate a device fingerprint:

[0197] "a3f5c9d8e7b6a1c4d2f3e9b8a7d6c5e4f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5".

[0198] In this embodiment, by performing multi-dimensional feature extraction on protocol layer data and application layer data, and using a hash algorithm to perform hash operations on the feature vectors, a stable and unique device fingerprint can be generated for the target device. Even if the target device uses a random MAC address, accurate identification of the target device can still be achieved based on the device fingerprint.

[0199] In a feasible implementation, to achieve efficient utilization of IP resources, S103 may specifically include the following sub-steps:

[0200] S103-1: Determine the activity of the target device based on the application layer data.

[0201] In this implementation, traditional DHCP systems fail to perceive actual device needs and employ a first-come, first-served allocation system, leading to irrational resource allocation. For example, video conferencing equipment may be assigned to high-latency IP address segments, severely impacting user experience. Meanwhile, smart home devices may occupy high-quality IP resources for extended periods, wasting network bandwidth and low-latency resources. Therefore, to achieve efficient utilization of IP resources, the activity level of target devices is determined based on application-layer data. This activity level represents the target device's level of network communication activity.

[0202] In this embodiment, the application layer data may specifically include traffic data and DNS query logs. Specifically, the traffic cycle and traffic change rate of the target device can be determined based on the traffic data; the DNS query frequency of the target device can be determined based on the DNS query log; and the activity of the target device can be determined based on the traffic cycle, traffic change rate, and DNS query frequency.

[0203] It should be noted that the shorter the traffic cycle of the target device, the higher the traffic change rate, and the higher the DNS query frequency, the higher the activity of the target device.

[0204] In a specific implementation, the first weight corresponding to the traffic period, the second weight corresponding to the traffic change rate, and the third weight corresponding to the DNS query frequency can be obtained. Then, based on the first weight, the second weight, and the third weight, the normalized traffic period, traffic change rate, and DNS query frequency are weighted averaged to obtain the activity of the target device. Specifically, the activity of the target device can be calculated using the following formula:

[0205] Sapp=w1*Pc+w2*Pb+w3*Pd (1);

[0206] w1+w2+w3=1 (2);

[0207] Among them, Sapp represents the activity of the target device; w1 represents the first weight; Pc represents the communication cycle after normalization; w2 represents the second weight; Pb represents the traffic change rate after normalization; w3 represents the third weight; Pd represents the DNS query frequency after normalization.

[0208] In this embodiment, by comprehensively considering the traffic period, traffic change rate and DNS query frequency and performing weighted summation on the traffic period, traffic change rate and DNS query frequency, the activity of the target device can be accurately calculated.

[0209] S103-2: Based on activity and device fingerprint, an IP address is assigned to the target device.

[0210] In this implementation, the higher the activity of a target device, the higher its interaction frequency and intensity. Therefore, based on the device fingerprint, a higher-quality IP address can be assigned to a device with high interaction frequency. This enables on-demand allocation, improving IP address allocation efficiency while meeting device needs.

[0211] In this embodiment, all assignable IP addresses can be divided into multiple IP address pools, with different IP address pools having different priorities. For example, they can be divided into hot pools, warm pools, and cold pools. The hot pool contains high-quality IP addresses with low latency and high bandwidth, suitable for high-frequency interactive devices such as video conferencing equipment and game consoles; the warm pool contains IP addresses with medium latency and bandwidth, suitable for medium-frequency interactive devices, such as ordinary PCs and smartphones; and the cold pool contains ordinary IP addresses with high latency and low bandwidth, suitable for low-frequency interactive devices, such as smart light bulbs and smart sockets.

[0212] In this embodiment, by pre-dividing multiple IP address pools, a suitable IP address can be allocated to the target device based on activity.

[0213] In a specific implementation, the target activity range to which the activity belongs can be determined among multiple preset activity ranges; the target IP address pool corresponding to the target activity range can be determined among multiple preset IP address pools; and an IP address can be allocated to the target device in the target IP address pool based on the device fingerprint.

[0214] In this embodiment, different activity ranges correspond to different IP address pools, wherein multiple activity ranges correspond one-to-one to multiple IP address pools.

[0215] In one example, multiple activity ranges can be set to [0, 0.4), [0.4, 0.7), and [0.7, 1]. The multiple IP addresses include the aforementioned hot pool, warm pool, and cold pool. When the activity Sapp∈[0, 0.4), the target device is assigned to the cold pool; when Sapp∈[0.4, 0.7), the target device is assigned to the warm pool; and when Sapp∈[0.7, 1], the target device is assigned to the hot pool.

[0216] In this embodiment, by dividing IP addresses into IP address pools of different priorities, a suitable target IP address pool can be allocated to the target device according to the target activity range to which the activity belongs, thereby improving the allocation efficiency while meeting the performance requirements of the device.

[0217] Reference Figure 2 , shows a schematic diagram of the steps of another IP address management method provided by an embodiment of the present application. Figure 2 As shown in the figure, when a device connects to the network, it will first determine whether there is a historical IP allocation record for the device. If the device has a historical IP allocation record, it will directly inherit the previous historical IP allocation policy and be assigned to the previous IP address pool based on the device fingerprint and historical application activity Sapp. This can avoid frequent adjustments to the device's IP address allocation policy, reduce network fluctuations, and improve allocation efficiency. For example, if a smart speaker was assigned to the hot pool when it was last connected, the system will prioritize assigning it an IP address in the hot pool to ensure a consistent user experience across the device. For new devices without historical IP allocation records, the protocol layer behavior characteristics (such as the first protocol characteristics, the second protocol characteristics, and the third protocol characteristics) and application layer behavior characteristics (such as traffic characteristics and query behavior characteristics) of the device will be extracted first, and then a unique device fingerprint will be generated based on the protocol layer behavior characteristics and application layer behavior characteristics. Subsequently, the application layer behavior of the device will be analyzed (such as traffic cycle, traffic change rate, and DNS query frequency), and the device's activity Sapp will be calculated and saved. According to the size relationship between the activity Sapp and multiple activity ranges (such as [0, 0.4), [0.4, 0.7), and [0.7, 1]), the device will be assigned to the corresponding address pool (such as hot pool, warm pool, or cold pool).

[0218] In this embodiment, by accurately analyzing the application layer behavior of the device (such as traffic cycle, traffic change rate, DNS query frequency), the IP address is dynamically allocated according to the activity Sapp, thereby avoiding the long-term occupation of high-quality resources by low-frequency use devices, thereby greatly improving the utilization efficiency of network resources. In addition, for devices with historical records, their historical IP allocation strategy is directly inherited to avoid network fluctuations caused by frequent adjustments to IP addresses, thereby improving the stability and reliability of the system. For new devices without historical records, this embodiment can efficiently determine the device priority and allocate it to the appropriate address pool by quickly analyzing its application layer activity, ensuring that the new device quickly accesses the network while meeting the network needs of the device. The embodiment of the present application is suitable for a variety of scenarios such as smart homes and enterprise networks, and has high efficiency, dynamic adaptability and wide application value.

[0219] To facilitate better implementation of the IP address management method of this application, this application also provides an IP address management device based on the above IP address management method. The meanings of the terms are the same as those in the above IP address management method, and the specific implementation details can be referred to the description in the method embodiment.

[0220] Based on the same inventive concept, Figure 3 The embodiment of the present application provides an IP address management device 300, which includes:

[0221] Data acquisition module 301, used to acquire protocol layer data and application layer data of the target device;

[0222] Fingerprint generation module 302, for generating a device fingerprint of the target device based on the protocol layer data and the application layer data; the device fingerprint represents the identity of the target device;

[0223] The address management module 303 is used to manage the IP address of the target device based on the device fingerprint.

[0224] In one embodiment, the fingerprint generation module 302 includes:

[0225] The protocol layer feature determination submodule is used to extract features from the protocol layer data and obtain the protocol layer behavior features of the target device;

[0226] The application layer feature submodule is used to extract features from application layer data and obtain the application layer behavior features of the target device;

[0227] The device fingerprint generation submodule is used to calculate and process the protocol layer behavior characteristics and application layer behavior characteristics to obtain the device fingerprint of the target device.

[0228] In one embodiment, the protocol layer behavior feature includes a first protocol feature, a second protocol feature, and a third protocol feature, and the protocol layer data includes a parameter request list, a vendor identifier, a synchronization flag SYN message, and a client hello message;

[0229] The protocol layer feature determination submodule includes:

[0230] a first data extraction subunit, configured to extract parameter combination sequence information from the parameter request list and extract a first preset number of target bytes from the manufacturer identifier;

[0231] a first protocol feature determining unit, configured to determine the parameter combination sequence information and a first preset number of target bytes as a first protocol feature;

[0232] a second protocol feature determining unit, configured to extract initial window size information from the SYN message and determine the initial window size information as a second protocol feature;

[0233] The third protocol feature determining unit is configured to extract a second preset number of cipher suite information from the client hello message, and determine the second preset number of cipher suite information as a third protocol feature.

[0234] In one embodiment, the application layer behavior features include query behavior features and traffic features, and the application layer data includes domain name system (DNS) query logs, traffic cycle data, and the number of data packets in two adjacent statistical cycles; the application layer feature submodule includes:

[0235] A query feature determination unit is configured to extract a target record type from the DNS query log and determine the target record type as a query behavior feature; the target record type is a record type whose corresponding query ratio in the DNS query log satisfies the first condition;

[0236] The traffic characteristic determination unit is used to determine the traffic change rate based on the number of data packets in two adjacent statistical periods, and determine the traffic change rate and traffic period data as traffic characteristics.

[0237] In one embodiment, the device fingerprint generation submodule includes:

[0238] A feature fusion unit is used to fuse the protocol layer behavior features and the application layer behavior features to obtain a comprehensive feature vector;

[0239] The device fingerprint generation unit is used to perform a hash operation on the feature vector based on a preset hash algorithm to obtain the device fingerprint of the target device.

[0240] In one embodiment, the feature fusion unit includes:

[0241] A privacy processing subunit is used to perform privacy processing on the protocol layer behavior characteristics and the application layer behavior characteristics to obtain privacy-processed feature data; the privacy processing includes one or more of fuzzification processing, generalization processing and randomization processing;

[0242] The feature vector acquisition subunit is used to perform feature fusion on the privacy-processed feature data to obtain a comprehensive feature vector.

[0243] In one embodiment, the address management module 303 includes:

[0244] An activity determination submodule, used to determine the activity of a target device based on application layer data;

[0245] The IP address allocation submodule is used to allocate IP addresses to target devices based on activity and device fingerprints.

[0246] In one embodiment, the application layer data includes traffic data and DNS query logs; and the activity determination submodule includes:

[0247] a first determining unit, configured to determine a flow period and a flow change rate of a target device based on the flow data;

[0248] a second determining unit, configured to determine a DNS query frequency of the target device based on the DNS query log;

[0249] The activity determination unit is used to determine the activity of the target device based on the traffic cycle, traffic change rate and DNS query frequency.

[0250] In one embodiment, the IP address allocation submodule includes:

[0251] an activity range determining unit, configured to determine a target activity range to which the activity belongs from among a plurality of preset activity ranges;

[0252] An IP address pool determining unit, configured to determine a target IP address pool corresponding to a target activity range from among a plurality of preset IP address pools; wherein different activity ranges correspond to different IP address pools;

[0253] The IP address allocation unit is used to allocate an IP address to the target device in the target IP address pool based on the device fingerprint.

[0254] By adopting the technical solution of the embodiment of the present application, by comprehensively considering the protocol layer data and application layer data of the target device, a unique device fingerprint can be generated for the target device without relying on sensitive information such as the host name and MAC address of the target device, thereby protecting user privacy while achieving accurate identification of the target device and efficient management of the IP address.

[0255] For the specific definition of the IP address management device 300, please refer to the definition of the IP address management method above and will not be repeated here. Each module in the above-mentioned IP address management device can be implemented in whole or in part through software, hardware, or a combination thereof. Each of the above-mentioned modules can be embedded in or independent of the processor in the computer device in hardware form, or can be stored in the memory of the computer device in software form, so that the processor can call and execute the corresponding operations of each of the above modules.

[0256] In addition, the present application also provides an electronic device, such as Figure 4 As shown, it shows a schematic diagram of the structure of the electronic device involved in this application, specifically:

[0257] The electronic device may include one or more processing core processors 401 and one or more computer readable storage media memories 402 and other components. It will be understood by those skilled in the art that Figure 4 The electronic device structure shown in the figure does not constitute a limitation of the electronic device, and may include more or fewer components than shown in the figure, or combine certain components, or arrange components differently.

[0258] Processor 401 is the control center of the electronic device, connecting the various components of the entire electronic device using various interfaces and lines. By running or executing software programs and modules stored in memory 402 and accessing data stored in memory 402, it performs various functions of the electronic device and processes data, thereby monitoring the electronic device as a whole. Optionally, processor 401 may include one or more processing cores; preferably, processor 401 may integrate an application processor and a modem processor, wherein the application processor primarily processes the operating system, user interface, and application programs, while the modem processor primarily handles wireless communications. It is understood that the modem processor may not be integrated into processor 401.

[0259] The memory 402 can be used to store software programs and modules. The processor 401 executes various functional applications and data processing by running the software programs and modules stored in the memory 402. The memory 402 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc.; the data storage area may store data created according to the use of the electronic device, etc. In addition, the memory 402 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other volatile solid-state storage device. Accordingly, the memory 402 may also include a memory controller to provide the processor 401 with access to the memory 402.

[0260] In one feasible embodiment, the electronic device further includes a power supply 403 for supplying power to various components. Preferably, the power supply 403 can be logically connected to the processor 401 via a power management system, thereby enabling the power management system to manage charging, discharging, and power consumption. The power supply 403 can also include one or more DC or AC power supplies, a recharging system, a power supply device debugging circuit, a power converter or inverter, a power status indicator, and other arbitrary components.

[0261] In a feasible embodiment, the electronic device may further include an input unit 404, which can be used to receive input digital or character information and generate keyboard, mouse, joystick, optical or trackball signal input related to user settings and function control.

[0262] Although not shown, the electronic device may further include a display unit, etc., which will not be described in detail herein. Specifically, in this embodiment, the processor 401 in the electronic device loads the executable files corresponding to the processes of one or more application programs into the memory 402 according to the following instructions, and the processor 401 runs the application programs stored in the memory 402, thereby implementing the steps of any of the IP address management methods provided in the embodiments of the present application.

[0263] Those skilled in the art will understand that Figure 4 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the electronic device to which the solution of the present application is applied. The specific electronic device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0264] In a feasible embodiment, an electronic device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the method described in any embodiment of the present application is implemented.

[0265] In one feasible embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the method described in any embodiment of the present application is implemented.

[0266] In a feasible implementation, a computer program product is also proposed, including a computer program or instructions, which implement the method described in any embodiment of the present application when executed by a processor.

[0267] The specific implementation of the above operations can be found in the previous embodiments and will not be repeated here.

[0268] Those skilled in the art will appreciate that all or part of the steps in the various methods of the above embodiments may be accomplished by instructions, or by controlling related hardware through instructions. The instructions may be stored in a computer-readable storage medium and loaded and executed by a processor.

[0269] To this end, the present application provides a computer-readable storage medium having a computer program stored thereon. The computer program can be loaded by a processor to execute the steps in any one of the IP address management methods provided in the present application.

[0270] The specific implementation of the above operations can be found in the previous embodiments and will not be repeated here.

[0271] The computer-readable storage medium may include a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0272] Since the instructions stored in the computer-readable storage medium can execute the steps in any IP address management method provided in this application, the beneficial effects that can be achieved by any IP address management method provided in this application can be achieved. Please refer to the previous embodiments for details and will not be repeated here.

[0273] Finally, it should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "includes," or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article, or terminal device that includes a series of elements includes not only those elements, but also other elements not explicitly listed, or elements that are inherent to such process, method, article, or terminal device. In the absence of further restrictions, an element defined by the phrase "comprises a ..." does not exclude the presence of additional identical elements in the process, method, article, or terminal device that includes the element.

[0274] The above is a detailed introduction to the IP address management method, device, storage medium and electronic device provided by this application. Specific examples are used herein to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core ideas. At the same time, for those skilled in the art, according to the ideas of the present invention, there will be changes in the specific implementation methods and application scopes. In summary, the content of this specification should not be understood as limiting the present invention.

Claims

1. A method for managing an IP address, characterized in that: The method comprises: Obtain protocol layer data and application layer data of the target device; Generating a device fingerprint of the target device based on the protocol layer data and the application layer data; wherein the device fingerprint represents an identity of the target device; Based on the device fingerprint, IP address management is performed on the target device.

2. The IP address management method according to claim 1, wherein: Generating a device fingerprint of the target device based on the protocol layer data and the application layer data includes: Performing feature extraction on the protocol layer data to obtain protocol layer behavior features of the target device; Performing feature extraction on the application layer data to obtain application layer behavior features of the target device; The protocol layer behavior characteristics and the application layer behavior characteristics are calculated and processed to obtain a device fingerprint of the target device.

3. The IP address management method according to claim 2, wherein: The protocol layer behavior characteristics include a first protocol characteristic, a second protocol characteristic, and a third protocol characteristic, and the protocol layer data include a parameter request list, a vendor identifier, a synchronization flag SYN message, and a client hello message; The extracting features of the protocol layer data to obtain protocol layer behavior features of the target device includes: Extracting parameter combination sequence information from the parameter request list, and extracting a first preset number of target bytes from the vendor identifier; determining the parameter combination sequence information and the first preset number of target bytes as the first protocol feature; extracting initial window size information from the SYN message, and determining the initial window size information as the second protocol feature; A second preset number of cipher suite information is extracted from the Client Hello message, and the second preset number of cipher suite information is determined as the third protocol feature.

4. The IP address management method according to claim 2, wherein: The application layer behavior characteristics include query behavior characteristics and traffic characteristics, and the application layer data includes domain name system DNS query logs, traffic cycle data and the number of data packets in two adjacent statistical periods; The extracting features of the application layer data to obtain application layer behavior features of the target device includes: Determining a traffic change rate based on the number of data packets in the two adjacent statistical periods, and determining the traffic change rate and the traffic period data as the traffic feature; A target record type is extracted from the DNS query log, and the target record type is determined as the query behavior feature; the target record type is a record type whose corresponding query ratio in the DNS query log meets the first condition.

5. The IP address management method according to claim 2, wherein: The calculating and processing the protocol layer behavior characteristics and the application layer behavior characteristics to obtain the device fingerprint of the target device includes: Performing feature fusion on the protocol layer behavior features and the application layer behavior features to obtain a comprehensive feature vector; Based on a preset hash algorithm, a hash operation is performed on the feature vector to obtain a device fingerprint of the target device.

6. The IP address management method according to claim 1, wherein: The performing IP address management on the target device based on the device fingerprint includes: Determining the activity of the target device based on the application layer data; An IP address is assigned to the target device based on the activity and the device fingerprint.

7. The IP address management method according to claim 6, characterized in that: The allocating an IP address to the target device based on the activity and the device fingerprint includes: Determining a target activity range to which the activity belongs among a plurality of preset activity ranges; Determine a target IP address pool corresponding to the target activity range from a plurality of preset IP address pools; wherein different activity ranges correspond to different IP address pools; Based on the device fingerprint, an IP address is allocated to the target device in the target IP address pool.

8. An IP address management device, characterized in that: The device comprises: Data acquisition module, used to obtain protocol layer data and application layer data of the target device; A fingerprint generation module, configured to generate a device fingerprint of the target device based on the protocol layer data and the application layer data; the device fingerprint represents an identity of the target device; The address management module is used to manage the IP address of the target device based on the device fingerprint.

9. An electronic device, characterized in that: The method comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the IP address management method according to any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps in the IP address management method according to any one of claims 1 to 7 are implemented.

Images