Internet of Things equipment identification method based on equipment behavior analysis

Abstract

The invention relates to an Internet of Things equipment identification method based on equipment behavior analysis. The method comprises the following steps: extracting periodic communication features and information entropy features of Internet of Things equipment on distributed nodes; the optimal feature subset is selected through chi-square verification, and the recognition accuracy is further improved; capturing time dependence and dynamics of behavior modeling by using an LSTM network, and aggregating local behavior patterns of each node through federated learning to form a global model; training and evaluating the model to obtain an optimal model and outputting a recognition result; according to the method, original data are not shared, only model updating is shared, user privacy is effectively protected, and compared with the prior art, the method has remarkable advantages in the aspects of privacy protection, recognition accuracy, expandability and robustness, is suitable for a complex and changeable Internet of Things environment, and has wide application prospects. The method can be widely applied to the fields of intelligent home, intelligent wearing, intelligent transportation and the like, and has important practical significance and wide application prospects.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of Internet of Things security, and in particular to an Internet of Things device identification method based on device behavior analysis. BACKGROUND

[0002] With the rapid development of Internet of Things technology, Internet of Things devices are widely used in people's lives, such as smart home, smart wear, smart transportation, etc. Numerous devices frequently interact on local networks, forming a complex and variable ecosystem, which puts higher requirements on device behavior identification and intent judgment to cope with security, forensics and responsibility definition challenges. Traditional device identification methods have many drawbacks: MAC address detection is costly, load checking is easily affected by IP encryption and anonymity measures, and accuracy and reliability are poor. Centralized deep learning models face the risk of data privacy leakage. Feature-based clustering methods have limited ability to identify complex behavior patterns. The Lumos system is a system that can detect and identify hidden Internet of Things (IoT) devices connected to Wi-Fi and display the location of these devices through an augmented reality interface. The Lumos system uses signal features and behavior patterns to distinguish different types of IoT devices, identifies devices through wireless signal analysis, and provides a visual interface that allows users to easily see the distribution of IoT devices in the environment. However, although the existing Lumos system considers privacy protection when designing, there is still a possibility of invading user privacy during device identification and positioning, especially in public or semi-public environments. At the same time, the Lumos system relies on specific signal features, which makes it unreliable when devices use encryption or have highly customized communication protocols. In addition, the effectiveness of the Lumos system is affected by environmental factors such as interference or obstacles that can affect signal reception and analysis. As the diversity and complexity of IoT devices continue to increase, the Lumos system may have difficulty adapting to all types of devices, especially new devices with unusual behavior patterns. New devices and communication protocols are constantly emerging, and the Lumos system needs to regularly update its identification algorithms and databases to maintain its effectiveness, which may incur additional maintenance costs. SUMMARY

[0003] Therefore, the present application provides an Internet of Things device identification method based on device behavior analysis, which can solve the problems of privacy leakage, low identification accuracy, poor scalability and weak environmental adaptability in the prior art Internet of Things device identification method To achieve the above-mentioned purpose, the present application provides an Internet of Things device identification method based on device behavior analysis, comprising the following steps: S1, constructing a federated learning framework, obtaining raw traffic data from Internet of Things devices, and preprocessing the raw traffic data; S2, extracting periodic communication features and information entropy features of traffic data on each distributed node of the federated learning framework, capturing key sequences of IoT device behaviors; S201, converting preprocessed raw traffic data into binary time series signals with a duration of D seconds, and if the traffic passing through within the preset time contains data packets, the value is 1, otherwise the value is 0; S202, converting the binary time series signals into frequency domain signals by discrete Fourier transform (DFT) and obtaining candidate periods ; S203, verifying period accuracy according to autocorrelation functions and updating candidate periods to obtain final traffic period values ; S204, extracting traffic data information entropy features to quantify randomness and unpredictability of the traffic data, expressed as: ; wherein, represents randomness of attribute , represents probability of attribute being , and represents total number of attribute categories; ; wherein, represents scale parameter, and represents translation parameter; S3, aggregating local behavior patterns learned on each node to form a global model by federated learning method; S4, selecting a final key feature set using chi-square verification to construct a device fingerprint matrix for device type identification; ; ; wherein, represents total number of categories, represents probability of category appearing in the data set, represents average CHI value of the feature with respect to each category, The maximum value in the CHI value of each category is selected as the feature, and the final key feature set is formed by sorting the CHI value and selecting a certain number of features to form a feature subset. S402, the obtained traffic data periodic communication features and information entropy features are constructed into a The fingerprint matrix is expressed as: ; S5, the extracted periodic communication features and information entropy features are input into a long short-term memory network (LSTM) structure to model and analyze the behavior of the Internet of Things device. S6, the obtained Internet of Things device behavior recognition model is trained and evaluated, the gradients of each node are aggregated through a central server, the recognition model parameters are optimized, the recognition model is updated, and the model converges until the model converges, thereby realizing accurate recognition and analysis of the behavior of the Internet of Things device.

[0004] Preferably, the original traffic data includes network packets, communication logs, and other forms of network activities produced by the Internet of Things device, and the preprocessing includes filtering duplicate packets, deleting incomplete and incorrectly formatted packets, and processing missing values.

[0005] Preferably, the candidate periodic The expression is: ; Wherein, The time series signal The duration, is The local maximum value satisfies: ; The autocorrelation function The expression is: ; Wherein, The time difference between and is The data point in the th signal sequence; if is a local maximum value and satisfies , update to obtain the final traffic periodic value , that is:

[0006] Preferably, the LSTM stores, modifies, and accesses the learned time patterns through the gating unit to model and sequence predict the behavior of the Internet of Things device.

[0007] Preferably, the chi-square statistic expression is: ; wherein, denotes the total set of data sets for IoT device behavior recognition, denotes the number of data sets with features and belonging to the class , denotes the number of data sets with features but not belonging to the class , denotes the number of data sets belonging to the class but not having features , denotes the number of data sets neither belonging to the class nor having features , and the greater the value of , the more relevant the features and the class are.

[0008] Preferably, training the recognition model comprises the following steps: S601, dividing the training set and the validation set in the data set into independent sub-data sets as the local data set of the client, each sub-data set including the data packet timing sequence of multiple devices to capture the heterogeneous periodic signature; S602, applying a sampling technique to the single client data set, including under / over sampling; S603, training a local conversion copy of the recognition model on each sub-data set; S604, each IoT device trains its local LSTM model using its own partitioned data and aggregates updates on the central server, and the predicted device behavior pattern generates a predicted label sequence; S605, the accuracy and recall rate indicators are used to evaluate the effect of the recognition model, and the predicted label sequence is compared with the real label sequence; S606, the recognition model parameters are optimized and the recognition model is updated until the recognition model converges, realizing accurate recognition and analysis of the behavior of the IoT device.

[0009] Compared with the prior art, the beneficial effects of the present application are: The application realizes privacy protection and improvement of recognition accuracy through federated learning and LSTM network structure, and enhances system performance and scalability, federated learning realizes decentralized model training and updating, saves and processes original data at local nodes, and only shares model updates, effectively preventing user privacy leakage; and the LSTM network structure can capture long-term dependencies in time series, improve the accuracy of Internet of Things device behavior recognition; in addition, the chi-square verification method is used to screen out features to further improve the recognition effect; the method provided by the application enhances the generalization ability and adaptability of the model, so that it can maintain efficient recognition in a changing Internet of Things environment, and has significant advantages in the field of Internet of Things device behavior recognition. BRIEF DESCRIPTION OF DRAWINGS

[0010] Figure 1 is a flowchart of the application; Figure 2 is an LSTM structure diagram of the application; Figure 3 is a flowchart of the application using federated learning to train the model; Figure 4 is an Internet of Things device behavior analysis and recognition flowchart. DETAILED DESCRIPTION

[0011] In order to further illustrate the technical means and effects taken by the application to achieve the predetermined application purpose, the specific embodiments, structures, features and effects of the application are described in detail below in combination with the drawings and preferred embodiments.

[0012] In order to solve the challenge of device behavior and intent recognition in Internet of Things (IoT) environment, especially to improve recognition accuracy while protecting user privacy, the embodiment provides an Internet of Things device recognition method based on device behavior analysis, including the following steps: S1, a federated learning framework is constructed to obtain raw traffic data from Internet of Things devices, including network packets, communication logs and other forms of network activities produced by Internet of Things devices for further analysis and feature extraction; the raw traffic data is preprocessed to filter duplicate packets, delete incomplete, format error packets, and handle missing values; The definition of Internet of Things device behavior is based on the analysis of data collected by sensors and communication interfaces of the device to identify the tasks or actions performed by the device in response to input, specifically, behavior recognition relies on data collected from sensors and communication interfaces on connected devices, each sensor type can provide unique insights into device behavior, for example: a camera captures visual information, a depth sensor provides spatial awareness, an inertial sensor monitors physical movement, and a microphone captures auditory clues; Assume that the target is performing an activity is belonging to a certain predefined action set B, i.e.: Meanwhile, there is a series of preset sensing devices for obtaining behavior-related data: wherein, the behavior recognition-related data collected by the Baidu group at time t; Based on these collected data s, a model is established for predicting the behavior sequence: ; The real behavior sequence data are compared to obtain the evaluation of the accuracy of the behavior model, and the training process of behavior recognition is to obtain the optimal corresponding index.

[0013] S2, extract the periodic communication features and information entropy features of the traffic data on each distributed node in the federated learning framework, and capture the key sequence of the behavior of the Internet of Things device; Detailed analysis of periodic properties such as TCP and ARP periods allows for a detailed characterization of individual Internet of Things devices, and compared to group-based identification, the present embodiment provides a more fine-grained approach; the features extracted from the traffic data of the Internet of Things device in standby mode can be divided into two categories: one is periodic feature, which can be inferred by using two effective signal processing techniques, Fourier transform (DFT) and autocorrelation; the other is information entropy feature; S201, convert the preprocessed raw traffic data into a binary time series signal with a duration of D seconds, and if the traffic passing through within the preset time contains a data packet, the value is 1, otherwise the value is 0; S202, convert the binary time series signal into a frequency domain signal by discrete Fourier transform (DFT), and obtain a candidate period , the expression is: ; wherein, represents the duration of the time series signal , and is the local maximum value of , which satisfies: ; S203, to further improve the accuracy, verify the period accuracy according to the autocorrelation function , update the candidate period to obtain the final traffic period value ; The autocorrelation function The expression is: ; wherein, represents the time difference between , represents the data point in the first signal sequence; if is a local maximum and satisfies , then is updated to obtain the final flow period value , that is: ; Two feature metrics and of each result period are calculated, and the expression is: ; ; wherein, represents the ratio of the period occurrence on the signal with a duration of D seconds, and the expression of the accurately stable period signal , represents the sum of adjacent periods , , , reflects whether there are parallel periods with the same period, and the stable signal with a period value of will satisfy , while the unstable signal exhibits and ; S204, entropy feature of flow data information is extracted to quantify the randomness and unpredictability of the flow data, and the expression is: ; wherein, represents the randomness of the attribute , represents the probability that the attribute is , represents the total number of categories of the attribute, and the expression reflects the variability and fluctuation of the flow pattern, S205, wavelet decomposition method is used to analyze the time-frequency attribute of the flow data, which is helpful to identify devices based on short but meaningful communication bursts, and the expression is: ; wherein, denotes a scale parameter, denotes a translation parameter.

[0014] S3, aggregating the local behavior patterns learned on each node to form a global model through a federated learning method; As Figure 3 shown in the federated learning framework diagram, the Internet of Things device performs localized training to obtain a local model (Local model), and then uploads the trained result to a global model (Global Model); to collaboratively build a robust model for identifying Internet of Things device behavior, while protecting the privacy of participating distributed nodes, the centralized server coordinates iterative learning across heterogeneous nodes without exchanging local raw data.

[0015] S4, using chi-square verification to select a final key feature set for subsequent identification operations, and constructing a device fingerprint matrix for device type identification; Chi-square verification helps identify features that have a significant impact on the target variable. By focusing on relevant features, the model's predictive power is improved, allowing for better generalization to unseen data. Selecting features based on chi-square verification can reduce overfitting by eliminating irrelevant or redundant features that can cause overfitting, which improves the model's ability to generalize to new data. Compared to other feature selection methods, chi-square verification has computational efficiency, making it suitable for large data sets or real-time applications where fast model training and prediction are essential. The chi-square statistic can be used to measure the degree of correlation between features and categories , assuming and follow the CHI distribution with one degree of freedom, the chi-square statistic CHI value of feature for is expressed as: ; where, denotes the total set of data sets for Internet of Things device behavior identification, denotes the number of data sets with feature and belonging to category , denotes the number of data sets with feature but not belonging to category , denotes the number of data sets belonging to category but not having feature , denotes the number of data sets that neither belong to category nor have feature , when feature and category independently, , the greater the value of the feature and the category are related; S401, calculate the chi-square distribution value CHI of each feature and each category, and then test the CHI value of the feature for the entire feature set, expressed as: ; ; wherein, represents the total number of categories, represents the category probability of occurrence in the data set, represents the average CHI value of the feature and each category, represents the maximum value of the CHI value of the selected feature and each category; according to the size of the CHI value, the features are sorted and a certain number of features are selected to form a feature subset, that is, the final key feature set; S402, the obtained periodic communication features and information entropy features of the traffic data are constructed into a fingerprint matrix for the final device type identification, expressed as: ; In this embodiment , therefore, the expression of the fingerprint matrix is: ; At this time, 15 feature vectors are selected from the data packets of the device, and the expression of the th data packet is: The features of each device can be constructed into a 15*n matrix, which contains the periodic features and information entropy features extracted as mentioned above.

[0016] S5, input the extracted periodic communication features and information entropy features into a long short-term memory network (LSTM) structure to model and analyze the behavior of the Internet of Things device; The LSTM algorithm is beneficial for modeling sequence data, enabling the system to adapt to the dynamic evolution of the behavior of the Internet of Things device over time; the core component of the long short-term memory (LSTM) network architecture is the memory unit that stores the context information over time, as shown in Figure 2 The LSTM unit contains a special gate that regulates the flow of information, and the gating unit of the LSTM allows it to store, modify, and access learned temporal patterns for time series modeling and sequence prediction, which makes the LSTM network very suitable for modeling the cyclic traffic signatures commonly found in Internet of Things device data streams.

[0017] ​S6, training and evaluating the obtained IoT device behavior identification model, aggregating the gradients of each node through the central server, optimizing the identification model parameters, updating the identification model, until the model converges, realizing accurate identification and analysis of the behavior of the IoT device; S601, dividing the training set and the validation set in the data set into independent sub-data sets as the local data set of the client, each sub-data set including the data packet timing sequence of multiple devices to capture the heterogeneous periodic signature; S602, applying sampling techniques to the single client data set, including undersampling / oversampling; S603, training the local conversion copy of the identification model on each sub-data set; S604, each IoT device trains its local LSTM model using its own partitioned data and aggregates updates on the central server, the original traffic data is retained at the local node, only the model gradient and feature statistics are transmitted to the central server, protecting user privacy, and the predicted device behavior pattern generates a predicted label sequence; S605, using accuracy and recall rate indicators to evaluate the effect of the identification model, comparing the predicted label sequence with the real label sequence; S606, optimizing the identification model parameters, updating the identification model, until the identification model converges, realizing accurate identification and analysis of the behavior of the IoT device.

[0018] Figure 4 The complete process of IoT device behavior identification is shown, which covers the collection of raw data from IoT devices, the reference of annotated behavior data, the preprocessing steps of data cleaning, normalization and feature extraction by the data processing module; then, the processed data is used to predict the behavior pattern of the device through machine learning or deep learning algorithm, generating a predicted label sequence, which is compared with the real label sequence, the latter is the labeled data based on the actual behavior, used for model accuracy evaluation; in addition, the prediction probability provides the confidence of the predicted behavior, while the real mark data is used for model training and testing, ensuring that the model can accurately learn and predict the device behavior; the whole process forms a closed loop system, which is not only used for evaluating and optimizing the model, but also suitable for various IoT application scenarios such as automation, security monitoring and device maintenance.

[0019] The above merely describes the preferred embodiments of the present application, and is not intended to limit the present application in any form. Although the present application has been disclosed with the preferred embodiments as above, it is not intended to limit the present application. Any person skilled in the art can make some changes or modifications to the above disclosed technical content to obtain equivalent embodiments with equivalent changes, as long as the changes or modifications do not deviate from the technical solution of the present application. Any modification, change, equivalent change and modification of the above embodiments made according to the technical essence of the present application still belong to the scope of the technical solution of the present application.

Claims

1. The IoT device identification method based on device behavior analysis is characterized by: The following steps are involved: S1. Build a federated learning framework, obtain raw traffic data from IoT devices, and preprocess the raw traffic data. S2. Extracting periodic communication features and information entropy features of traffic data at each distributed node in the federated learning framework to capture key sequences of IoT device behaviors; S201, converting the pre-processed raw traffic data into a binary time series signal , the duration is D seconds. If the traffic passing through the preset time contains a data packet, the value is recorded as 1, otherwise the value is recorded as 0; S202, transforming the binary time series signal into Convert to frequency domain signal , and obtain the candidate cycle ; S203, according to the autocorrelation function Verify cycle accuracy and update candidate cycles Get the final flow cycle value ; S204: Extract information entropy features of the traffic data to quantify the randomness and unpredictability of the traffic data. The expression is: ； in, Representation attributes The randomness of Representation attributes for The probability of The total number of categories representing the attribute; S205. Use wavelet decomposition to analyze the time-frequency attributes of the traffic data. The expression is: ； in, represents the scale parameter, represents the translation parameter; S3, aggregate the local behavior patterns learned at each node to form a global model through federated learning; S4. Use chi-square validation to select the final key feature set and construct a device fingerprint matrix for device type identification; S401. Calculate the chi-square distribution value CHI of each feature and each category, and then test the CHI value of each feature for the entire feature set. The expression is: ； ； in, represents the total number of categories, Representation category The probability of appearing in the data set, Represents the average CHI value of the feature and each category, Indicates the maximum value of the selected features and each category CHI value; sorting according to the size of the CHI value and selecting a specific number of features to form a feature subset, that is, the final key feature set; S402, construct the acquired traffic data periodic communication characteristics and information entropy characteristics into a The fingerprint matrix is ​​expressed as: ； S5. Input the extracted periodic communication features and information entropy features into the long short-term memory network (LSTM) structure to model and analyze the behavior of IoT devices. S6. The IoT device behavior recognition model obtained through training and evaluation aggregates the gradients of each node through the central server, optimizes the recognition model parameters, and updates the recognition model until the model converges, thereby achieving accurate recognition and analysis of IoT device behavior.

2. The method for identifying IoT devices based on device behavior analysis according to claim 1, characterized in that: The raw traffic data includes network packets, communication logs, and other forms of network activities generated by IoT devices. Preprocessing includes filtering duplicate packets, deleting incomplete and malformed packets, and processing missing values.

3. The method for identifying IoT devices based on device behavior analysis according to claim 1, characterized in that: The candidate cycle The expression is: ； in, Represents a timing signal duration, for The local maximum of , satisfying: ; The autocorrelation function The expression is: ； in, express and The time difference between Indicates the data points in the signal sequence; if is a local maximum and satisfies , then update , get the final flow cycle value ,Right now: 。 4. The method for identifying IoT devices based on device behavior analysis according to claim 1, characterized in that: LSTM stores, modifies, and accesses learned temporal patterns through gating units to model IoT device behavior and perform sequence prediction.

5. The method for identifying IoT devices based on device behavior analysis according to claim 1, characterized in that: The chi-square statistic expression is: ； in, Represents the total set of data sets for IoT device behavior recognition, Indicates characteristics and belongs to the category The number of data sets, Indicates characteristics But not in the category The number of data sets, Indicates belonging to a category But not characteristic The number of data sets, Indicates that it does not belong to the category No characteristics The number of data sets, when The larger the value of , the more relevant the feature is to the category.

6. The method for identifying IoT devices based on device behavior analysis according to claim 1, characterized in that: Training the recognition model involves the following steps: S601, dividing the training set and the validation set in the data set into independent sub-datasets as local data sets of the client, each sub-dataset includes the data packet timing sequences of multiple devices to capture heterogeneous periodic signatures; S602, applying sampling techniques to a single client data set, including under / over sampling; S603, training a local transformed copy of the recognition model on each sub-dataset; S604, each IoT device trains its local LSTM model using its own partitioned data and aggregates updates on the central server to generate a predicted label sequence based on the predicted device behavior pattern; S605, using the accuracy and recall rate indicators to evaluate the effect of the recognition model, and comparing the predicted label sequence with the true label sequence; S606: Optimize the recognition model parameters and update the recognition model until the recognition model converges to achieve accurate recognition and analysis of the behavior of the IoT device.

Images