Equipment identification method and device, equipment and medium

Abstract

The invention relates to the technical field of Internet of Things, and provides an equipment identification method and device, equipment and a medium, which can start a probe to asynchronously initiate an address resolution protocol broadcast request for a target authorized network segment in a sectional manner to generate an active equipment list, and can avoid congestion, thereby accurately detecting active equipment. Performing port detection on each device in the active device list, performing multi-protocol verification on an open port according to a port-protocol adaptive matching mechanism, and performing organization unique identifier analysis on a media access control address of each device in the active device list; the problem of missing detection caused by single protocol broadcasting and port change and the problem of false alarm caused by only organizing unique identifier analysis are solved; and calculating a confidence score of each device according to the fusion features to generate an identification result of each device, so that device identification can be accurately carried out step by step by integrating multi-dimensional factors, and the false alarm rate is effectively reduced.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of Internet of Things, and in particular to a device identification method and device, apparatus and medium. BACKGROUND

[0002] With the rapid development of Internet of Things, the use of Internet of Things devices is showing a significant growth trend in enterprises and families.

[0003] Therefore, in order to meet the needs of asset inventory, security compliance, vulnerability management, etc., network operation personnel need to accurately and timely identify various Internet of Things devices in the internal network.

[0004] However, the existing device identification technology mainly has the following deficiencies: (1) Single-protocol broadcast discovery relies on broadcast, which is easy to be isolated, resulting in the device being unable to respond; (2) Fixed port detection will be unable to detect due to user modification of the port or use of a gateway to forward; (3) Using only the OUI (Organizationally Unique Identifier) of the MAC (Media Access Control Address) address for judgment will result in false positives due to the large variety of devices produced by manufacturers. SUMMARY

[0005] In view of the above, it is necessary to provide a device identification method, apparatus, device and medium, aiming to solve the problem of being unable to accurately identify devices.

[0006] A device identification method, the device identification method comprising: In response to a device identification instruction for a target authorized network segment, starting a probe to asynchronously initiate an address resolution protocol broadcast request for the target authorized network segment to obtain an address resolution protocol reply, and generating an active device list according to the address resolution protocol reply; Performing port detection on each device in the active device list to obtain a plurality of open ports; According to a port-protocol adaptive matching mechanism, performing multi-protocol verification on the plurality of open ports to obtain a multi-protocol verification result, and constructing an original feature set according to the multi-protocol verification result; Performing organizationally unique identifier analysis on the media access control address of each device in the active device list to obtain an analysis result; Merging and splicing the original feature set and the analysis result according to the Internet protocol address to obtain a target feature set; The target feature set is fused to obtain a fusion feature, and a confidence score of each device is calculated according to the fusion feature, and an identification result of each device is generated according to the confidence score.

[0007] According to the preferred embodiment of the present application, the address resolution protocol reply is obtained by starting the probe to asynchronously initiate an address resolution protocol broadcast request for the target authorized network segment, and the active device list is generated according to the address resolution protocol reply, which includes: The number of available Internet protocol addresses is calculated according to the subnet mask; When the number of available Internet protocol addresses is greater than a preset threshold, the target authorized network segment is divided into a plurality of subnet segments according to a configured number; The address resolution protocol broadcast request is initiated asynchronously for each subnet segment by using the started probe, and the address resolution protocol reply is obtained; The reply source media access control address, the reply target Internet protocol address, and the reply timestamp in each address resolution protocol reply are obtained; The active device list is constructed according to the reply source media access control address, the reply target Internet protocol address, and the reply timestamp in each address resolution protocol reply; The reply source media access control address is the media access control address of the sending device of the address resolution protocol reply; The reply target Internet protocol address is the Internet protocol address of the sending device of the address resolution protocol reply; When it is detected that there is an available Internet protocol address that does not respond in the first round, the address resolution protocol broadcast request is re-sent to the detected available Internet protocol address within a preset tolerance window.

[0008] According to the preferred embodiment of the present application, the port detection is performed on each device in the active device list to obtain a plurality of open ports, which includes: For a probe belonging to a transmission control protocol type, a synchronous message packet is sent by using the corresponding probe, and the port returning a synchronous acknowledgement message packet is determined as the open port; and / or For a probe belonging to a user datagram protocol type, an empty user datagram protocol message packet is sent by using the corresponding probe, and other ports except the internet control message protocol message packet are determined as the open port; In the port detection process, the number of single machine concurrent connections is less than or equal to the configured connection number, and the overall timeout is configured for a high-latency link.

[0009] According to the preferred embodiment of the present application, the multiple protocol verification is performed on the plurality of open ports according to the port-protocol adaptive matching mechanism to obtain a multiple protocol verification result, which includes: identifying a fixed port among the plurality of open ports; Sending a broadcast or multicast probe packet to the fixed port, and recording a device that actively responds to the probe packet as a candidate device; Parsing the device identification instruction to obtain the type of device to be identified; Determine the protocol importance according to the type of device to be identified, and configure the protocol priority according to the protocol importance; Identifying a custom protocol port of the candidate device; Sending a detection message of the corresponding protocol to each custom protocol port in sequence according to the protocol priority; Obtaining device information of a device corresponding to the custom protocol port that received the complete handshake message as the multi-protocol verification result; Among them, for the custom protocol port that returns the pending authentication status code, the corresponding device information will be marked as pending confirmation status.

[0010] According to a preferred embodiment of the present invention, performing organizational unique identifier resolution on the media access control address of each device in the active device list to obtain a resolution result includes: Starting a media access control address identification component; wherein the media access control address identification component is an independent service and a component that resides in the memory after starting; Using the media access control address identification component, obtain a pre-built list of organization unique identifiers that is updated in real time along with the organization unique identifiers assigned by the Institute of Electrical and Electronics Engineers; The media access control address identification component is used to perform vendor attribution mapping on the media access control address of each device based on the organization unique identifier list to obtain the parsing result.

[0011] According to a preferred embodiment of the present invention, the step of fusing features according to the target feature set to obtain fused features, calculating a confidence score for each device according to the fused features, and generating an identification result for each device according to the confidence score includes: Convert each indicator in the target feature set into a vector to obtain multiple confidence factors for each device; Sequentially concatenating multiple confidence factors of each device to obtain the fusion feature of each device; Obtaining an initial confidence score generation model and a target classification strategy corresponding to the device type to be identified from a pre-configured model strategy pool; wherein the target classification strategy includes a first threshold and a second threshold, and the first threshold is greater than the second threshold; The device identification instruction is parsed to obtain real-time scene data, and the initial confidence score generation model is fine-tuned according to the real-time scene data to obtain a target confidence score generation model. The fusion features of each device are input into the target confidence score generation model to obtain a target confidence score of each device. When it is detected that the target confidence score of a device is greater than the first threshold value, the detected device is determined to be the to-be-identified device type; or When it is detected that the target confidence score of a device is greater than the second threshold value and less than or equal to the first threshold value, it is determined that the device type of the detected device needs to be continuously identified. For the device corresponding to the device information marked as the to-be-confirmed state, the corresponding target confidence score is halved and then compared with the first threshold value and the second threshold value.

[0012] According to the preferred embodiment of the present application, after the identification result of each device is generated according to the confidence score, the method further comprises: According to the key-value cache mechanism, the identification result of each device is stored in a target database, and the effective time length of the identification result of each device is configured. When the next round of device identification is performed, according to the stored identification result of each device, a probe belonging to the same Internet protocol address, having a detection overhead higher than an overhead threshold value, and having a change probability lower than a configured probability is skipped.

[0013] A device identification apparatus, comprising: A generation unit configured to, in response to a device identification instruction for a target authorized network segment, initiate an address resolution protocol broadcast request for the target authorized network segment in a segmented and asynchronous manner to obtain an address resolution protocol reply, and generate a list of active devices according to the address resolution protocol reply. A detection unit configured to perform port detection on each device in the list of active devices to obtain a plurality of open ports. A verification unit configured to perform multi-protocol verification on the plurality of open ports according to a port-protocol adaptive matching mechanism to obtain a multi-protocol verification result, and construct an original feature set according to the multi-protocol verification result. An analysis unit configured to perform organization unique identifier analysis on a media access control address of each device in the list of active devices to obtain an analysis result. A splicing unit configured to merge and splice the original feature set and the analysis result according to an Internet protocol address to obtain a target feature set. The generating unit is further configured to fuse features according to the target feature set to obtain fused features, calculate a confidence score of each device according to the fused features, and generate a recognition result of each device according to the confidence score.

[0014] A computer device, comprising: a memory storing at least one instruction; and a processor executing the instruction stored in the memory to implement the device recognition method.

[0015] A computer readable storage medium storing at least one instruction, which is executed by a processor in a computer device to implement the device recognition method.

[0016] As can be seen from the above technical solutions, the present application can start the probe to asynchronously initiate an address resolution protocol broadcast request to a target authorized network segment in a segmented manner to generate a list of active devices, so as to avoid congestion and accurately detect active devices; port detection is performed on each device in the list of active devices, a multi-protocol verification is performed on an open port according to a port-protocol adaptive matching mechanism, and a media access control address of each device in the list of active devices is parsed according to an organization unique identifier, so as to solve the problem of missed detection caused by single-protocol broadcast and port change, and the problem of false positives caused by organization unique identifier parsing only; a confidence score of each device is calculated according to fused features to generate a recognition result of each device, so that device recognition can be performed step by step and accurately by comprehensively considering multiple factors, and the false positive rate is effectively reduced. BRIEF DESCRIPTION OF DRAWINGS

[0017] Figure 1 is a flowchart of a preferred embodiment of the device recognition method of the present application; Figure 2 is a functional module diagram of a preferred embodiment of the device recognition apparatus of the present application; Figure 3 is a structural schematic diagram of a computer device of a preferred embodiment of the present application for implementing the device recognition method. DETAILED DESCRIPTION

[0018] In order to make the objects, technical solutions, and advantages of the present application clearer, the present application will be described in detail below with reference to the drawings and specific embodiments.

[0019] As Figure 1 shown, is a flowchart of a preferred embodiment of the device recognition method of the present application. The order of steps in the flowchart can be changed according to different needs, and some steps can be omitted.

[0020] The device recognition method is applied to one or more computer devices, which is a device capable of automatically performing numerical calculation and / or information processing according to pre-set or stored instructions. The hardware thereof includes but is not limited to microprocessors, application specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), digital signal processors (DSPs), embedded devices, etc.

[0021] The computer device can be any electronic product that can interact with the user, such as a personal computer, a tablet computer, a smart phone, a personal digital assistant (PDA), a game console, an interactive Internet Protocol Television (IPTV), a smart wearable device, etc.

[0022] The computer device can also include network devices and / or user devices. The network devices include, but are not limited to, single network servers, server groups composed of multiple network servers, or clouds composed of a large number of hosts or network servers based on cloud computing.

[0023] The server can be a standalone server, or a cloud server providing cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDNs), and big data and artificial intelligence platforms, etc. basic cloud computing services.

[0024] Among them, artificial intelligence (AI) is to use digital computers or digital computer controlled machines to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results. Theory, method, technology and application system.

[0025] The basic technology of artificial intelligence generally includes technologies such as sensors, special artificial intelligence chips, cloud computing, distributed storage, big data processing technology, operation / interaction system, mechatronics, etc. The software technology of artificial intelligence mainly includes computer vision technology, robot technology, biometric technology, speech processing technology, natural language processing technology, and machine learning / deep learning, etc. Several major directions.

[0026] The network where the computer device is located includes but is not limited to the Internet, wide area network, metropolitan area network, local area network, virtual private network (VPN), etc.

[0027] S10, in response to a device identification instruction for a target authorized network segment, starting a probe to asynchronously initiate an Address Resolution Protocol (ARP) broadcast request for the target authorized network segment in a segmented manner to obtain an ARP reply, and generating an active device list according to the ARP reply.

[0028] In this embodiment, the device identification instruction can be triggered by relevant operation and maintenance personnel based on actual device identification needs. For example, to meet requirements such as asset inventory, security compliance, and vulnerability management, network operation and maintenance personnel need to accurately and promptly identify camera devices on the intranet. In this case, the device identification instruction can be triggered.

[0029] In this embodiment, the devices to be identified may include, but are not limited to: audio acquisition devices (such as a recorder), video acquisition devices (such as a camera), etc.

[0030] In this embodiment, the start probe asynchronously initiates an ARP broadcast request to the target authorized network segment in a segmented manner to obtain an ARP reply, and generates an active device list according to the ARP reply, including: Calculate the number of available Internet Protocol addresses based on the subnet mask; When the number of available Internet Protocol addresses is greater than a preset threshold, dividing the target authorized network segment according to a configured number to obtain multiple sub-network segments; Using the started probe, asynchronously initiate the address resolution protocol broadcast request to each subnet segment, and obtain the address resolution protocol reply; Obtain the reply source Media Access Control Address (MAC address), reply destination Internet Protocol Address (IP address), and reply timestamp from each Address Resolution Protocol reply; constructing the active device list based on the reply source media access control address, the reply target internet protocol address and the reply timestamp in each address resolution protocol reply; The reply source media access control address is the media access control address of the sending device of the address resolution protocol reply; wherein the reply target Internet Protocol address is the Internet Protocol address of the sending device of the Address Resolution Protocol reply; When it is detected that there is an available Internet protocol address that does not respond in the first round, the address resolution protocol broadcast request is re-sent to the detected available Internet protocol address within a preset tolerance window.

[0031] The preset threshold value can be selected as an optimal value according to experiments.

[0032] For example, when the number of available Internet protocol addresses is 300, and the number exceeds the preset threshold value 256, the target authorization network segment is divided into three sub-network segments according to the manner that each sub-network segment contains 128 addresses. Assuming that the IP of the device identification party is 192.168.1.2, and the IP and MAC of the detected device are 192.168.1.3 and 00:11:22:33:44:55 respectively, the device identification party sends a broadcast ARP request, and the target IP of the detection is 192.168.1.3. When the detected device receives the message, the corresponding ARP reply message is sent, in which the sending device MAC is 00:11:22:33:44:55, and the sending device IP is 192.168.1.3. If an individual address does not respond in the first round, it will be re-sent within a preset tolerance window (usually ten seconds) to minimize missed sampling. After this step, the list of “active devices” in the network can be mastered, and it is passed to the downstream.

[0033] The sending rate of each sub-task can be controlled by a rate limiter, so that each sub-task sends at most N ARP requests per millisecond (N can be configured as 10 by default and can be adjusted).

[0034] In the above embodiment, by sending broadcast requests in a segmented and asynchronous manner, the coverage rate and network load can be considered, and the problem of congestion can be avoided by avoiding sending packets to a large number of addresses at the same time within one millisecond.

[0035] S11, port detection is performed on each device in the active device list to obtain a plurality of open ports.

[0036] In this embodiment, the port detection performed on each device in the active device list to obtain a plurality of open ports includes: For a probe of a transmission control protocol (TCP) type, a synchronous message packet is sent by using the corresponding probe, and a port that returns a synchronous acknowledgement message packet is determined as the open port; and / or For the probes belonging to the User Datagram Protocol (UDP) type, an empty User Datagram Protocol packet is sent by using the corresponding probe, and other ports outside the return Internet Control Message Protocol packet are determined as the open ports; In the port detection process, the single machine concurrent connection number is less than or equal to the configured connection number, and the overall timeout is configured for the high latency link.

[0037] The configured connection number can be an optimal value selected according to experiments.

[0038] For example: for the Transmission Control Protocol side, the probe is based on a half-open SYN (Synchronize Sequence Numbers) handshake, sends a TCP SYN packet, and detects whether the port of the target device is open based on the TCP protocol logic. Specifically, only waiting for SYN-ACK (Synchronize Sequence Numbers-Acknowledgment) can determine that the port is open; for the User Datagram Protocol side, a zero-load message is used to infer reachability in combination with an ICMP (Internet Control Message Protocol) port unreachable feedback. Specifically, an empty UDP packet is sent to a certain UDP port of the device to be detected. If the port is not open, an ICMP message will be returned, and its content means that the port is unreachable. If the port is open, there will usually be no response, and by excluding the unreachable ports, it can be inferred which ports are reachable. In the port detection process, in order to avoid blocking business flow, the single machine concurrent connection number is limited to tens by default, and the overall timeout of 800-1000 milliseconds is set for high latency links. After detection, each device carries a set of "current open port" fields to continue to flow downstream.

[0039] The overall timeout refers to the maximum waiting time from sending the detection packet to the end of waiting for the response. If the expected response (such as TCP SYN-ACK or UDP ICMP Port Unreachable) is not received within this time, it is considered that the port has no response, and the next port is continued to be detected.

[0040] Through the above embodiment, port detection can be further performed on the basis of generating the active device list, so as to identify the open ports of each device.

[0041] S12, multiple protocol verification results are obtained by performing multiple protocol verification on the multiple open ports according to a port-protocol adaptive matching mechanism, and an original feature set is constructed according to the multiple protocol verification results.

[0042] In the embodiment, the multi-protocol verification of the multiple open ports according to the port-protocol adaptive matching mechanism comprises: identifying fixed ports in the multiple open ports; sending a broadcast or groupcast probe packet to the fixed ports and recording a device actively responding to the probe packet as a candidate device; analyzing the device identification instruction to obtain a to-be-identified device type; determining protocol importance according to the to-be-identified device type and configuring protocol priority according to the protocol importance; identifying a custom protocol port of the candidate device; sending a corresponding protocol probe message to each custom protocol port in turn according to the protocol priority; obtaining device information of a device corresponding to a custom protocol port receiving a complete handshake message as the multi-protocol verification result; wherein, for a custom protocol port returning a to-be-authenticated status code, the corresponding device information is marked as a to-be-confirmed state.

[0043] Wherein, protocol detection is performed on all open ports of each device instead of relying on default ports, which can effectively avoid missing detection caused by port modification.

[0044] For example, when a camera is to be identified, the fixed ports can include standard and substantially unmodifiable WS-Discovery (Web Services Dynamic Discovery, a device discovery protocol) (e.g., UDP 3702), SSDP (Simple Service Discovery Protocol) (e.g., UDP 1900), and mDNS (Multicast DNS) (e.g., UDP 5353). The custom protocol ports can include RTSP OPTIONS (Real Time Streaming Protocol OPTIONS), ONVIF SOAP (Open Network Video Interface Forum Simple Object Access Protocol), HTTP (Hypertext Transfer Protocol Snapshot), private handshake, SIP OPTIONS (Session Initiation Protocol OPTIONS), RTMP (Real-Time Messaging Protocol), etc.

[0045] Specifically, probe packets are sent to fixed ports to capture actively responding device information, which is considered to implement the corresponding protocol stack and is in an active state, which can preliminarily determine that the device supports a certain type of protocol. Further, according to the actual device identification requirements, the protocol priority is determined (different device types correspond to different protocol priorities, such as when a camera is to be identified, the RTSP protocol basically only appears on the audio and video protocol, and the HTTP protocol can appear on various protocols, so the priority of the RTSP protocol is higher. Because each protocol has its default port, such as the default port of the RTSP protocol is 554, if the 554 port is found in the open port, the RTSP protocol can be used to match preferentially to improve the matching efficiency and reduce the detection cost), and the detection packets of the corresponding protocol are sent to the respective defined protocol ports in turn, and the complete handshake message that meets the protocol definition is determined as a valid message (such as the RTSP receives 200OK, the ONVIF receives the ProbeMatch response and contains the Xaddr, and then the complete handshake message that meets the protocol definition is determined), instead of only detecting according to the default port of the protocol, but first matching the protocol according to the real-time open port list of the detection device, selecting the most likely hit and the lowest cost protocol probe, and matching fails, then calling other protocol probes for detection, which takes into account the identification accuracy and detection efficiency.

[0046] In addition, the detection packet is retained at the handshake or query level, such as the device returns a status code 401 or 404 for authentication, which is regarded as a weak positive signal that the matching is not successful, but the device responds to the protocol in compliance, and the device can implement the protocol. For example, if an RTSP OPTION is sent, the device can return 401 Unauthorized, indicating that the opponent supports RTSP, but further authentication is required, which can effectively reduce the missed detection rate.

[0047] In the embodiment, the original feature set can include, but is not limited to, one or a combination of the following information: IP address, MAC address, which protocols are responded, response port, response content digest, timestamp, etc.

[0048] By constructing the original feature set, a comprehensive data basis can be provided for subsequent verification.

[0049] The embodiment performs ARP scanning to obtain a complete active device list, and then combines port detection and multi-protocol lightweight handshake to achieve comprehensive coverage of the device.

[0050] S13, performing organizationally unique identifier (OUI) parsing on the media access control address of each device in the active device list to obtain a parsing result.

[0051] In this embodiment, the OUI parsing on the media access control address of each device in the active device list to obtain a parsing result comprises: starting a media access control address identification component; wherein the media access control address identification component is an independent service and a component that resides in the memory after being started; using the media access control address identification component to obtain an OUI list that is pre-constructed and updated in real time by the OUI assigned by the Institute of Electrical and Electronics Engineers (IEEE) organization; using the media access control address identification component to perform manufacturer mapping on the media access control address of each device based on the OUI list to obtain the parsing result.

[0052] Specifically, the manufacturer mapping can be completed in microseconds through OUI parsing.

[0053] For example, when identifying a camera, if the mapping result belongs to a manufacturer that is known to produce cameras, the device is labeled with a “manufacturer brand” tag; for unknown or ambiguous manufacturers, the value is kept empty to provide more information in the subsequent verification process.

[0054] S14, merging and splicing the original feature set and the parsing result according to the Internet protocol address to obtain a target feature set.

[0055] In this embodiment, after determining the manufacturer of a certain MAC address, there is also information such as IP address and MAC address in the original data set. After combining the two, it can be known that the device of a certain IP address is from which manufacturer, so as to realize the mutual correlation between information.

[0056] S15, performing feature fusion according to the target feature set to obtain a fusion feature, calculating a confidence score of each device according to the fusion feature, and generating an identification result of each device according to the confidence score.

[0057] In this embodiment, the feature fusion according to the target feature set to obtain a fusion feature, the calculation of a confidence score of each device according to the fusion feature, and the generation of an identification result of each device according to the confidence score comprises: convert each index in the target feature set into a vector to obtain a plurality of confidence factors of each device; sequentially splice the plurality of confidence factors of each device to obtain the fusion feature of each device; obtain an initial confidence score generation model corresponding to the to-be-identified device type and a target grading strategy from a pre-configured model strategy pool; wherein the target grading strategy includes a first threshold and a second threshold, and the first threshold is greater than the second threshold; parse the device identification instruction to obtain real-time scene data, and fine-tune the initial confidence score generation model according to the real-time scene data to obtain a target confidence score generation model; input the fusion feature of each device into the target confidence score generation model to obtain a target confidence score of each device; when it is detected that the target confidence score of a device is greater than the first threshold, determine that the detected device is of the to-be-identified device type; or when it is detected that the target confidence score of a device is greater than the second threshold and less than or equal to the first threshold, determine that the device type of the detected device needs to be continuously identified; wherein, for the device corresponding to the device information marked as the to-be-confirmed state, the corresponding target confidence score is halved and then compared with the first threshold and the second threshold.

[0058] For example, when identifying a camera, a number of binary or multi-value indexes such as “manufacturer hit”, “RTSP handshake success”, “ONVIF information readable”, “HTTP snapshot valid”, “private protocol handshake success”, “RTMP handshake success”, etc. can be converted into a unified vector as a plurality of confidence factors of each device.

[0059] wherein, each index in the target feature set can be converted into a vector according to a pre-configured conversion strategy. For example, for OUI, its vector value can be configured as 0 or 1 according to whether it hits a known camera manufacturer. For RTSP, its vector value can be correspondingly configured as [0, 0.5, 1] according to the reply content [no reply, 400, 200].

[0060] wherein, storing the confidence score generation model and the grading strategy in the model strategy pool according to the to-be-identified device type can facilitate quick calling, and can support targeted processing of different device types, thereby improving identification accuracy.

[0061] The initial confidence score generation model is fine-tuned according to real-time scene data, which can further ensure the accuracy of the identification. For example, if significant features are found in the corresponding network segment, the model can be fine-tuned according to these features. For example, if it is determined in advance that all cameras come from manufacturer A, the weights of the MAC address and private protocol corresponding to manufacturer A can be increased.

[0062] Of course, the threshold value can also be adjusted according to the actual environment.

[0063] The confidence score generation model can be an artificial intelligence model (such as a classification model, a prediction model, etc.), or a weighted model, etc.

[0064] For example, when a camera is to be identified, and the confidence score generation model is a weighted model, the target confidence score generation model can be represented as follows: score = 3*oui + 2*onvif + 3*rtsp + 2*http + 1*sip + 2*private protocol handshake +1*rtmp+1*multicast.

[0065] Wherein, score represents the target confidence score, oui represents the manufacturer brand hit factor, onvif represents the ONVIF information readable factor, rtsp represents the RTSP handshake success factor, http represents the HTTP snapshot effective factor, sip represents the session initiation protocol effective factor, private protocol handshake represents the private protocol handshake success factor, rtmp represents the RTMP handshake success factor, and multicast represents the multicast DNS handshake success factor.

[0066] Further, when the score is greater than 6, the corresponding device is determined to be a camera; when the score is greater than 2 and less than or equal to 6, the corresponding device is determined to be to be identified for subsequent verification.

[0067] And if RST / 401 is received, the score is halved to avoid missing strong authentication devices.

[0068] Through the above embodiments, the models (such as feature weights and threshold values) can be quickly adjusted according to the actual scene and network environment, so that the models are more suitable for real-time identification requirements, thereby improving the accuracy of device identification.

[0069] In this embodiment, after the identification result of each device is generated according to the confidence score, the method further comprises: According to the key-value cache mechanism, the identification result of each device is stored in the target database, and the effective time length of the identification result of each device is configured; When the next round of device identification is performed, the probes with the same Internet protocol address, the detection overhead higher than the overhead threshold, and the change probability lower than the configured probability are skipped according to the stored identification result of each device.

[0070] It can be understood that each protocol corresponds to a protocol probe, and the high and low overheads of each protocol detection can be verified by prior experimental measurement, and the number of probes corresponds to the number of detectable protocols (about more than ten). For the device with the cache, the embodiment skips the steps of obtaining the open port by port scanning, OUI analysis, and most of the protocols in the multi-protocol verification link, and only retains a few protocols with the highest priority. For example, if a camera is to be identified, RTSP is the protocol that best represents the camera, and if the RTSP result is consistent with the cache, it can be considered that the type of the device has not changed.

[0071] For example, a time-limited key-value cache table can be maintained locally in the probe to store the protocol hit situation in the last thirty minutes. With the help of this cache, if the same IP address is encountered again in the next round of scanning, the probes with high cost and low change probability can be skipped, and only RTSP or HTTP snapshot and other fast and variable items are retained, thereby significantly saving network and computing resources.

[0072] The embodiment adopts a segmented active detection link, and divides ARP discovery, port detection, and multi-protocol handshake into three progressive layers, each layer taking the simplified result of the previous layer as input, which can avoid blind packet injection in a large network segment, and significantly reduce network overhead and false positive rate. Preferably, broadcast and handshake level messages are used, full port probes are triggered on demand, and a timeout and fuse mechanism is provided to minimize the impact on the production network. At the same time, the MAC address is analyzed in real time by using the latest OUI database, the hardware manufacturer's brand information is fused with the soft features returned by the protocol handshake to generate a confidence score, and high-accuracy device identification can be realized without logging into the device.

[0073] As can be seen from the above technical solutions, the present application can start the probe to initiate a segmental asynchronous address resolution protocol broadcast request to the target authorized network segment to generate an active device list, which can avoid congestion and accurately detect active devices; each device in the active device list is subjected to port detection, multi-protocol verification of the open port according to a port-protocol adaptive matching mechanism, and organization unique identifier analysis of the media access control address of each device in the active device list, which solves the problems of missed detection caused by single-protocol broadcast and port change, and false positives caused by organization unique identifier analysis alone; and the confidence score of each device is calculated according to the fused features to generate the identification result of each device, thereby enabling comprehensive multi-dimensional factors to be used for device identification step by step and accurately, and effectively reducing the false positive rate.

[0074] AsFigure 2 Fig. 2 is a function module diagram of a preferred embodiment of the device identification apparatus of the present application. The device identification apparatus 11 comprises a generating unit 110, a detecting unit 111, a verifying unit 112, an analyzing unit 113, and a splicing unit 114. The modules / units of the present application refer to a series of computer program segments capable of being executed by a processor and capable of completing a fixed function, which are stored in a memory. In this embodiment, the functions of the modules / units will be described in detail in subsequent embodiments.

[0075] The generating unit 110 is configured to, in response to a device identification instruction for a target authorized network segment, initiate a probe to asynchronously initiate an address resolution protocol broadcast request for the target authorized network segment to obtain an address resolution protocol reply, and generate a list of active devices according to the address resolution protocol reply. The detecting unit 111 is configured to perform port detection on each device in the list of active devices to obtain a plurality of open ports. The verifying unit 112 is configured to perform multi-protocol verification on the plurality of open ports according to a port-protocol adaptive matching mechanism to obtain a multi-protocol verification result, and construct an original feature set according to the multi-protocol verification result. The analyzing unit 113 is configured to perform organization unique identifier analysis on a media access control address of each device in the list of active devices to obtain an analysis result. The splicing unit 114 is configured to merge and splice the original feature set and the analysis result according to an Internet protocol address to obtain a target feature set. The generating unit 110 is further configured to perform feature fusion according to the target feature set to obtain a fused feature, calculate a confidence score of each device according to the fused feature, and generate an identification result of each device according to the confidence score.

[0076] As can be seen from the above technical solutions, the present application can initiate a probe to asynchronously initiate an address resolution protocol broadcast request for a target authorized network segment to generate a list of active devices, thereby avoiding congestion and accurately detecting active devices. The port detection is performed on each device in the list of active devices, the multi-protocol verification is performed on the open ports according to a port-protocol adaptive matching mechanism, and the organization unique identifier analysis is performed on the media access control address of each device in the list of active devices, thereby solving the problem of missed detection caused by single-protocol broadcast and port changes, and the problem of false positives caused by only organization unique identifier analysis. The confidence score of each device is calculated according to the fused feature to generate an identification result of each device, thereby comprehensively considering multiple factors to accurately perform device identification, and effectively reducing the false positive rate.

[0077] As Figure 3As shown is a structural schematic diagram of a computer device of a preferred embodiment of the device identification method of the present application.

[0078] The computer device 1 can include a memory 12, a processor 13 and a bus (the arrow in the figure is the bus), and can further include a computer program, such as a device identification program, stored in the memory 12 and executable on the processor 13.

[0079] Those skilled in the art can understand that the schematic diagram is only an example of the computer device 1 and does not constitute a limitation on the computer device 1, which can be a bus type structure or a star type structure, and can further include more or less other hardware or software or different component arrangement, such as an input / output device, a network access device, etc.

[0080] It should be noted that the computer device 1 is only an example, and other existing or future electronic products can also be applicable to the present application and should be included in the protection scope of the present application by reference.

[0081] The memory 12 includes at least one type of readable storage medium, such as a flash memory, a mobile hard disk, a multimedia card, a card type memory (such as an SD or DX memory, etc.), a magnetic memory, a magnetic disk, an optical disk, etc. The memory 12 can be an internal storage unit of the computer device 1 in some embodiments, such as a mobile hard disk of the computer device 1. The memory 12 can also be an external storage device of the computer device 1 in other embodiments, such as a plug-in mobile hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. Further, the memory 12 can include both an internal storage unit and an external storage device of the computer device 1. The memory 12 can be used not only to store application software and various data installed in the computer device 1, such as the code of the device identification program, but also to temporarily store data that has been output or will be output.

[0082] The processor 13 can be composed of integrated circuits in some embodiments, for example, can be composed of a single packaged integrated circuit, or can be composed of multiple packaged integrated circuits of the same function or different functions, including one or more central processing units (CPU), microprocessors, digital processing chips, graphics processors, and combinations of various control chips, etc. The processor 13 is the control core (Control Unit) of the computer device 1, which connects various components of the entire computer device 1 through various interfaces and lines, executes programs or modules stored in the memory 12 (such as executing device identification programs, etc.), and calls data stored in the memory 12 to execute various functions and process data of the computer device 1.

[0083] The processor 13 executes the operating system of the computer device 1 and various installed application programs. The processor 13 executes the application programs to implement the steps in the above-mentioned various device identification method embodiments, for example Figure 1 The steps shown.

[0084] For example, the computer program can be divided into one or more modules / units, which are stored in the memory 12 and executed by the processor 13 to complete the present application. The one or more modules / units can be a series of computer-readable instruction segments capable of completing a specific function, which are used to describe the execution process of the computer program in the computer device 1. For example, the computer program can be divided into a generation unit 110, a detection unit 111, a verification unit 112, an analysis unit 113, and a splicing unit 114.

[0085] The integrated units implemented in the form of software function modules described above can be stored in a computer-readable storage medium. The software function modules described above are stored in a storage medium, including a number of instructions for causing a computer device (which can be a personal computer, a computer device, or a network device, etc.) or a processor to execute part of the device identification method described in each embodiment of the present application.

[0086] The integrated modules / units of the computer device 1, if implemented in the form of software function units and sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the present application implements all or part of the processes in the above-mentioned embodiments, which can also be completed by instructing related hardware devices through a computer program. The computer program can be stored in a computer-readable storage medium, and when the processor executes the computer program, the steps of each method embodiment described above can be implemented.

[0087] The computer program includes computer program code in the form of source code, object code, executable files, or some intermediate form, etc. The computer readable medium can include any entity or device capable of carrying the computer program code, recording medium, U disk, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory, etc.

[0088] Further, the computer readable storage medium can mainly include a storage program area and a storage data area, wherein the storage program area can store an operating system, an application required by at least one function, etc.; and the storage data area can store data created according to the use of the blockchain node, etc.

[0089] The blockchain referred to in the present application is a new application mode of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanism, and encryption algorithm. The blockchain is essentially a decentralized database, which is a series of data blocks associated by using cryptographic methods, each data block contains the information of a batch of network transactions, and is used to verify the validity (anti-fake) of the information and generate the next block. The blockchain can include a blockchain underlying platform, a platform product service layer, and an application service layer, etc.

[0090] The bus can be a peripheral component interconnect (per internet protocol address heral component interconnect, abbreviated as PCI) bus or an extended industry standard architecture (extended industry standard architecture, abbreviated as EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For convenience of representation, only one straight line is used in the Figure 3 The bus is provided to realize the connection and communication between the memory 12, the at least one processor 13, etc.

[0091] Although not shown, the computer device 1 can also include a power supply (such as a battery) for powering each component. Preferably, the power supply can be logically connected to the at least one processor 13 through a power management device, so as to realize functions such as charge management, discharge management, and power consumption management through the power management device. The power supply can also include one or more direct current or alternating current power supplies, recharging devices, power failure detection circuits, power converters or inverters, power status indicators, etc. The computer device 1 can also include various sensors, Bluetooth modules, Wi-Fi modules, etc., which will not be described here.

[0092] Further, the computer device 1 can further comprise a network interface, which can optionally comprise a wired interface and / or a wireless interface (such as a WI-FI interface, a Bluetooth interface, etc.), and is generally used to establish a communication connection between the computer device 1 and other computer devices.

[0093] Optionally, the computer device 1 can further comprise a user interface, which can be a display, an input unit (such as a keyboard), and optionally can be a standard wired interface, a wireless interface. Optionally, in some embodiments, the display can be an LED display, a liquid crystal display, a touch liquid crystal display, an OLED (Organic Light-Emitting Diode) touch, etc. The display can also be appropriately referred to as a display screen or a display unit, and is used to display information processed in the computer device 1 and to display a visualized user interface.

[0094] It should be understood that the embodiments are only for illustration and are not limited in the scope of the patent application by the structure.

[0095] Those skilled in the art can understand that, Figure 3 The structure shown does not constitute a limitation on the computer device 1, and can comprise fewer or more components than shown, or combine certain components, or different component arrangements.

[0096] In combination Figure 1 The memory 12 in the computer device 1 stores a plurality of instructions to implement a device identification method, and the processor 13 can execute the plurality of instructions to implement: In response to a device identification instruction for a target authorized network segment, starting a probe to asynchronously initiate an address resolution protocol broadcast request for the target authorized network segment to obtain an address resolution protocol reply, and generating a list of active devices according to the address resolution protocol reply; Performing port detection on each device in the list of active devices to obtain a plurality of open ports; According to a port-protocol adaptive matching mechanism, performing multi-protocol verification on the plurality of open ports to obtain a multi-protocol verification result, and constructing an original feature set according to the multi-protocol verification result; Performing organization unique identifier resolution on the media access control address of each device in the list of active devices to obtain a resolution result; Merging and splicing the original feature set and the resolution result according to an Internet protocol address to obtain a target feature set; The feature fusion is performed according to the target feature set, a confidence score of each device is calculated according to the fusion feature, and an identification result of each device is generated according to the confidence score.

[0097] Specifically, the specific implementation method of the processor 13 to the above instructions can refer to Figure 1 The description of related steps in the corresponding embodiments will not be repeated here.

[0098] It should be noted that the data involved in the case are all legally obtained. The non-company software tools or components appearing in the embodiments of the application are only examples for introduction and do not represent actual use.

[0099] In several embodiments provided by the present application, it should be understood that the disclosed system, device and method can be implemented by other manners. For example, the device embodiments described above are only schematic, for example, the division of the modules is only a logical function division, and actual implementation can have another division manner.

[0100] The present application can be used in many general or special computer system environments or configurations. For example: personal computers, server computers, handheld devices or portable devices, tablet devices, multi-processor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, etc. The present application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present application can also be practiced in a distributed computing environment, in which tasks are performed by remote processing devices connected by a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media, including storage devices.

[0101] The modules described as separate components can or can not be physically separated, and the components shown as modules can or can not be physical units, i.e. they can be located in one place or distributed to multiple network units. Part or all of the modules can be selected according to actual needs to achieve the purpose of the present embodiment.

[0102] In addition, the functional modules in each embodiment of the present application can be integrated in one processing unit, or each unit can exist physically independently, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or in the form of hardware plus software functional modules.

[0103] It will be obvious to a person skilled in the art that the application is not limited to the details of the above-described exemplary embodiments but can be implemented in other embodiments without departing from the scope of the application.

[0104] The embodiments are therefore to be considered in all respects as illustrative and not restrictive, the scope of the application being indicated by the appended claims rather than by the above description, and all changes which come within the meaning and range of equivalency of the claims are therefore intended to be embraced therein. No single feature or combination of features should be considered limiting to the claims unless expressly stated in the claims.

[0105] Furthermore, the word "comprising" does not exclude other elements or steps, and the singular does not exclude the plural and vice-versa, unless expressly stated otherwise. The description is not intended to limit the application. The application resides in each and every novel characteristic feature and each combination of characteristic features.

[0106] Finally, it should be noted that the above-mentioned embodiments illustrate rather than limit the application, since the application is susceptible to various modifications and alternative forms of embodiment which will become apparent to those skilled in the art without departing from the scope of the application in its spirit or essential characteristics. The sole and exclusive judge of the adequacy of any proposed modification or alternative form of embodiment is the patent and copyright laws.

Claims

1. A device identification method, characterized by, The device identification method comprises: In response to a device identification instruction of a target authorized network segment, a probe is started to asynchronously initiate an address resolution protocol broadcast request to the target authorized network segment to obtain an address resolution protocol reply, and an active device list is generated according to the address resolution protocol reply; Port probing is performed on each device in the active device list to obtain a plurality of open ports; According to a port-protocol adaptive matching mechanism, multi-protocol verification is performed on the plurality of open ports to obtain a multi-protocol verification result, and an original feature set is constructed according to the multi-protocol verification result; Organization unique identifier analysis is performed on the media access control address of each device in the active device list to obtain an analysis result; The original feature set and the analysis result are merged and spliced according to the Internet protocol address to obtain a target feature set; According to the target feature set, a fusion feature is obtained, and a confidence score of each device is calculated according to the fusion feature, and an identification result of each device is generated according to the confidence score.

2. The device identification method according to claim 1, wherein: The starting of the probe to asynchronously initiate the address resolution protocol broadcast request to the target authorized network segment to obtain the address resolution protocol reply, and the generation of the active device list according to the address resolution protocol reply comprises: According to the subnet mask, the number of available Internet protocol addresses is calculated; When the number of available Internet protocol addresses is greater than a preset threshold, the target authorized network segment is divided according to the configured number to obtain a plurality of subnet segments; The address resolution protocol broadcast request is asynchronously initiated to each subnet segment by the started probe to obtain the address resolution protocol reply; The reply source media access control address, the reply target Internet protocol address and the reply timestamp in each address resolution protocol reply are obtained; The active device list is constructed according to the reply source media access control address, the reply target Internet protocol address and the reply timestamp in each address resolution protocol reply; The reply source media access control address is the media access control address of the sending device of the address resolution protocol reply; The reply target Internet protocol address is the Internet protocol address of the sending device of the address resolution protocol reply; When it is detected that there is an available Internet protocol address that does not respond in the first round, the address resolution protocol broadcast request is re-sent to the detected available Internet protocol address within a preset tolerance window.

3. The device identification method of claim 1, wherein, The port probing of each device in the active device list to obtain a plurality of open ports comprises: For a probe belonging to the transmission control protocol type, a synchronous message packet is sent by the corresponding probe, and the port returning a synchronous acknowledgement message packet is determined as the open port; and / or For a probe belonging to the user datagram protocol type, an empty user datagram protocol message packet is sent by the corresponding probe, and other ports outside the internet control message protocol message packet are determined as the open port; In the port probing process, the number of single machine concurrent connections is less than or equal to the configured connection number, and the overall timeout is configured for high latency links.

4. The device identification method of claim 1, wherein, The multi-protocol verification of the multiple open ports according to the port-protocol adaptive matching mechanism comprises: identifying fixed ports in the multiple open ports; sending a broadcast or groupcast probe packet to the fixed ports and recording a device actively responding to the probe packet as a candidate device; parsing the device identification instruction to obtain a to-be-identified device type; determining protocol importance according to the to-be-identified device type and configuring protocol priority according to the protocol importance; identifying a custom protocol port of the candidate device; sending a corresponding protocol probe message to each custom protocol port in turn according to the protocol priority; obtaining device information of a device corresponding to a custom protocol port receiving a complete handshake message as the multi-protocol verification result; wherein, for a custom protocol port returning a to-be-authenticated status code, the corresponding device information is marked as a to-be-confirmed state.

5. The device identification method of claim 1, wherein, The organization unique identifier parsing of the media access control address of each device in the active device list comprises: starting a media access control address identification component; wherein the media access control address identification component is an independent service and a component that resides in memory after being started; obtaining an organization unique identifier list pre-constructed and updated in real time with an organization unique identifier allocated by the Institute of Electrical and Electronics Engineers using the media access control address identification component; mapping the manufacturer of each device based on the organization unique identifier list using the media access control address identification component to obtain the parsing result.

6. The device identification method of claim 4, wherein, The feature fusion according to the target feature set to obtain a fusion feature, and the calculation of the confidence score of each device according to the fusion feature, and the generation of the identification result of each device according to the confidence score comprises: converting each index in the target feature set into a vector to obtain a plurality of confidence factors of each device; splicing the plurality of confidence factors of each device in turn to obtain the fusion feature of each device; obtaining an initial confidence score generation model corresponding to the to-be-identified device type and a target grading strategy from a pre-configured model strategy pool; wherein the target grading strategy comprises a first threshold and a second threshold, and the first threshold is greater than the second threshold; parsing the device identification instruction to obtain real-time scene data, and fine-tuning the initial confidence score generation model according to the real-time scene data to obtain a target confidence score generation model; inputting the fusion feature of each device into the target confidence score generation model to obtain the target confidence score of each device; when it is detected that the target confidence score of a device is greater than the first threshold, determining that the detected device is of the to-be-identified device type; or when it is detected that the target confidence score of a device is greater than the second threshold and less than or equal to the first threshold, determining that the device type of the detected device needs to be continuously identified; Wherein, for the device corresponding to the device information marked as the to-be-confirmed state, the corresponding target confidence score is halved and then compared with the first threshold and the second threshold.

7. The device identification method of claim 1, wherein, After generating the identification result of each device according to the confidence score, the method further comprises: storing the identification result of each device into a target database according to a key-value cache mechanism, and configuring the valid time length of the identification result of each device; when performing the next round of device identification, skipping the probe belonging to the same internet protocol address, and having a detection overhead higher than an overhead threshold and a change probability lower than a configured probability, according to the stored identification result of each device.

8. An apparatus identification device, characterized by The device identification apparatus comprises: a generating unit configured to, in response to a device identification instruction of a target authorized network segment, start a probe to asynchronously initiate an address resolution protocol broadcast request for the target authorized network segment to obtain an address resolution protocol reply, and generate a list of active devices according to the address resolution protocol reply; a detecting unit configured to perform port detection on each device in the list of active devices to obtain a plurality of open ports; a verifying unit configured to perform multi-protocol verification on the plurality of open ports according to a port-protocol adaptive matching mechanism to obtain a multi-protocol verification result, and construct an original feature set according to the multi-protocol verification result; a resolving unit configured to perform organization unique identifier resolution on the media access control address of each device in the list of active devices to obtain a resolution result; a splicing unit configured to merge and splice the original feature set and the resolution result according to an internet protocol address to obtain a target feature set; the generating unit is further configured to perform feature fusion according to the target feature set to obtain fused features, calculate a confidence score of each device according to the fused features, and generate an identification result of each device according to the confidence score.

9. A computer device, comprising: The computer device comprises: a memory storing at least one instruction; and a processor executing the instruction stored in the memory to implement the device identification method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores at least one instruction, and the at least one instruction is executed by the processor in the computer device to implement the device identification method according to any one of claims 1 to 7.

Images