Device identification method, device, apparatus and medium

Abstract

The present application relates to the technical field of Internet of Things, and provides a device identification method, device, apparatus and medium, which can start a probe to asynchronously initiate an address resolution protocol broadcast request for a target authorized network segment to generate a list of active devices, can avoid congestion, and thus accurately detects active devices; each device in the list of active devices is subjected to port detection, open ports are subjected to multi-protocol verification according to a port-protocol adaptive matching mechanism, and a media access control address of each device in the list of active devices is subjected to organization unique identifier resolution, solving the problem of missed detection caused by single-protocol broadcast and port changes, and the problem of false positives caused by organization unique identifier resolution alone; and a confidence score of each device is calculated according to fusion features to generate an identification result of each device, so that device identification can be performed step by step and accurately in combination with multiple factors, effectively reducing the false positive rate.

Description

Technical Field

[0001] This invention relates to the field of Internet of Things (IoT) technology, and in particular to a device identification method, apparatus, device, and medium. Background Technology

[0002] With the rapid development of the Internet of Things (IoT), the usage of IoT devices has shown a significant upward trend in both businesses and households.

[0003] Therefore, in order to meet the needs of asset inventory, security compliance, and vulnerability management, network operations and maintenance personnel need to accurately and promptly identify various IoT devices in the intranet.

[0004] However, existing device identification technologies still have the following shortcomings:

[0005] (1) Single protocol broadcast discovery relies on broadcast, which is easily isolated, causing the device to be unable to respond;

[0006] (2) Fixed port detection may fail to detect the port if the user changes the port or uses a gateway for forwarding.

[0007] (3) Using only the OUI (Organizationally Unique Identifier) ​​of the MAC (Media Access Control Address) address for judgment may lead to false alarms due to the wide variety of devices manufactured by different companies. Summary of the Invention

[0008] In view of the above, it is necessary to provide a device identification method, apparatus, equipment and medium to solve the problem of inaccurate device identification.

[0009] A device identification method, the device identification method comprising:

[0010] In response to the device identification command for the target authorized network segment, the probe is activated to initiate segmented asynchronous Address Resolution Protocol (ARP) broadcast requests to the target authorized network segment to obtain ARP responses, and an active device list is generated based on the ARP responses;

[0011] Port probing is performed on each device in the list of active devices to obtain multiple open ports;

[0012] The multiple open ports are subjected to multi-protocol verification according to the port-protocol adaptive matching mechanism to obtain multi-protocol verification results, and an original feature set is constructed based on the multi-protocol verification results;

[0013] The media access control address of each device in the active device list is parsed using an organization-unique identifier to obtain the parsing result;

[0014] The original feature set and the parsing result are merged and concatenated according to Internet Protocol addresses to obtain the target feature set;

[0015] The target feature set is used to perform feature fusion to obtain fused features, and the confidence score of each device is calculated according to the fused features. The recognition result of each device is generated based on the confidence score.

[0016] According to a preferred embodiment of the present invention, the initiation probe asynchronously initiates an Address Resolution Protocol (ARP) broadcast request to the target authorized network segment, receives an ARP response, and generates an active device list based on the ARP response, including:

[0017] Calculate the number of available Internet Protocol addresses based on the subnet mask;

[0018] When the number of available Internet Protocol addresses exceeds a preset threshold, the target authorized network segment is divided according to the configured number to obtain multiple sub-network segments;

[0019] The probes that are started asynchronously initiate the Address Resolution Protocol (ARP) broadcast request to each subnet segment and receive the ARP response.

[0020] Obtain the source media access control address, the target Internet Protocol address, and the timestamp of each address resolution protocol response;

[0021] The list of active devices is constructed based on the source Media Access Control address, the target Internet Protocol address, and the timestamp of each Address Resolution Protocol (ARP) response.

[0022] Wherein, the media access control address of the reply source is the media access control address of the sending device that replied via the address resolution protocol;

[0023] Wherein, the target Internet Protocol address for the response is the Internet Protocol address of the device that sent the Address Resolution Protocol (ARP) response;

[0024] Specifically, when an available Internet Protocol address is detected that does not respond in the first round, the Address Resolution Protocol (IP) broadcast request is resent to the detected available Internet Protocol address within a preset tolerance window.

[0025] According to a preferred embodiment of the present invention, the step of performing port probing on each device in the active device list to obtain multiple open ports includes:

[0026] For probes belonging to the Transmission Control Protocol type, a synchronization packet is sent using the corresponding probe, and the port that returns the synchronization acknowledgment packet is identified as the open port; and / or

[0027] For probes of the User Datagram Protocol type, an empty User Datagram Protocol packet is sent using the corresponding probe, and other ports other than the returned Internet Control Message Protocol packet are identified as the open ports;

[0028] During port detection, if the number of concurrent connections on a single machine is less than or equal to the configured number of connections, and the overall configuration for high-latency links times out.

[0029] According to a preferred embodiment of the present invention, the step of performing multi-protocol verification on the plurality of open ports according to the port-protocol adaptive matching mechanism to obtain multi-protocol verification results includes:

[0030] Identify the fixed port among the plurality of open ports;

[0031] Send a broadcast or multicast probe packet to the fixed port and record the devices that actively respond to the probe packet as candidate devices;

[0032] The device identification command is parsed to obtain the type of device to be identified;

[0033] The protocol importance is determined according to the type of device to be identified, and the protocol priority is configured according to the protocol importance.

[0034] Identify the custom protocol port of the candidate device;

[0035] According to the protocol priority, probe messages of the corresponding protocol are sent to each custom protocol port in sequence;

[0036] Obtain the device information of the device corresponding to the custom protocol port that received the complete handshake message as the multi-protocol verification result;

[0037] Specifically, for custom protocol ports that return a pending authentication status code, the corresponding device information will be marked as pending confirmation.

[0038] According to a preferred embodiment of the present invention, the step of resolving the Media Access Control Address of each device in the active device list to obtain the resolution result includes:

[0039] Start the media access control address identification component; wherein, the media access control address identification component is an independent service and a component that resides in memory after startup;

[0040] The Media Access Control Address Identification Component is used to obtain a pre-built list of organization-unique identifiers assigned by the Institute of Electrical and Electronics Engineers (IEEE) and updated in real time.

[0041] Using the media access control address identification component, the media access control address of each device is mapped to its vendor affiliation based on the organization's unique identifier list, and the parsing result is obtained.

[0042] According to a preferred embodiment of the present invention, the steps of performing feature fusion according to the target feature set to obtain fused features, calculating a confidence score for each device according to the fused features, and generating a recognition result for each device based on the confidence score include:

[0043] The indicators in the target feature set are converted into vectors to obtain multiple confidence factors for each device;

[0044] By sequentially concatenating multiple confidence factors for each device, the fusion feature of each device is obtained;

[0045] The model and target classification strategy are generated from the pre-configured model strategy pool, which are the initial confidence scores corresponding to the type of device to be identified. The target classification strategy includes a first threshold and a second threshold, and the first threshold is greater than the second threshold.

[0046] The device identification command is parsed to obtain real-time scene data, and the initial confidence score generation model is fine-tuned based on the real-time scene data to obtain the target confidence score generation model.

[0047] The fused features of each device are input into the target confidence score generation model to obtain the target confidence score for each device;

[0048] When a device is detected with a target confidence score greater than the first threshold, the detected device is determined to be the type of device to be identified; or

[0049] When a device is detected to have a target confidence score greater than the second threshold and less than or equal to the first threshold, the device type of the detected device is determined and further identification is required.

[0050] Specifically, for the device information marked as being in the pending confirmation state, the corresponding target confidence score is halved before being compared with the first threshold and the second threshold.

[0051] According to a preferred embodiment of the present invention, after generating the recognition result for each device based on the confidence score, the method further includes:

[0052] The recognition results of each device are stored in the target database according to the key-value caching mechanism, and the validity period of the recognition results of each device is configured.

[0053] When performing the next round of device identification, based on the stored identification results of each device, probes that belong to the same Internet Protocol address and whose detection overhead is higher than the overhead threshold and whose change probability is lower than the configuration probability are skipped.

[0054] A device identification device, the device identification device comprising:

[0055] The generation unit is used to respond to the device identification command for the target authorized network segment, start the probe to initiate the Address Resolution Protocol (ARP) broadcast request to the target authorized network segment in a segmented asynchronous manner, obtain the ARP reply, and generate an active device list based on the ARP reply;

[0056] The detection unit is used to perform port detection on each device in the list of active devices to obtain multiple open ports;

[0057] The verification unit is used to perform multi-protocol verification on the multiple open ports according to the port-protocol adaptive matching mechanism to obtain multi-protocol verification results, and to construct an original feature set based on the multi-protocol verification results;

[0058] The parsing unit is used to parse the Media Access Control Address of each device in the list of active devices by resolving the Organization Unique Identifier to obtain the parsing result;

[0059] The splicing unit is used to merge and splice the original feature set and the parsing result according to Internet protocol addresses to obtain the target feature set;

[0060] The generation unit is further configured to perform feature fusion according to the target feature set to obtain fused features, calculate the confidence score of each device according to the fused features, and generate the recognition result of each device based on the confidence score.

[0061] A computer device, the computer device comprising:

[0062] Memory, storing at least one instruction; and

[0063] The processor executes instructions stored in the memory to implement the device identification method.

[0064] A computer-readable storage medium storing at least one instruction, which is executed by a processor in a computer device to implement the device identification method.

[0065] As can be seen from the above technical solutions, this invention can initiate segmented asynchronous Address Resolution Protocol (ARP) broadcast requests to the target authorized network segment to generate an active device list, avoiding congestion and thus accurately detecting active devices. It performs port probing on each device in the active device list, verifies open ports using a port-protocol adaptive matching mechanism, and resolves the organization-unique identifier (IUI) of the Media Access Control (MAC) address of each device in the active device list. This solves the problems of missed detections caused by single-protocol broadcasts and port changes, as well as false alarms caused by only resolving the IUI. Furthermore, it calculates the confidence score of each device based on fusion features to generate the identification result for each device, thereby comprehensively considering multiple factors and accurately identifying devices step by step, effectively reducing the false alarm rate. Attached Figure Description

[0066] Figure 1 This is a flowchart of a preferred embodiment of the device identification method of the present invention;

[0067] Figure 2 This is a functional block diagram of a preferred embodiment of the device identification device of the present invention;

[0068] Figure 3 This is a schematic diagram of the structure of a computer device that implements the device identification method of the present invention. Detailed Implementation

[0069] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be described in detail below with reference to the accompanying drawings and specific embodiments.

[0070] like Figure 1 The diagram shown is a flowchart of a preferred embodiment of the device identification method of the present invention. Depending on different requirements, the order of the steps in this flowchart can be changed, and some steps can be omitted.

[0071] The device identification method is applied to one or more computer devices. The computer device is a device that can automatically perform numerical calculations and / or information processing according to pre-set or stored instructions. Its hardware includes, but is not limited to, microprocessors, application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), digital signal processors (DSPs), embedded devices, etc.

[0072] The computer device can be any electronic product that can interact with the user, such as a personal computer, tablet computer, smartphone, personal digital assistant (PDA), game console, interactive network television (Internet Protocol Television), smart wearable device, etc.

[0073] The computer equipment may also include network equipment and / or user equipment. The network equipment includes, but is not limited to, a single network server, a server group consisting of multiple network servers, or a cloud based on cloud computing consisting of a large number of hosts or network servers.

[0074] The server can be a standalone server or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDN), and big data and artificial intelligence platforms.

[0075] Artificial intelligence (AI) is the theory, method, technology and application system that uses digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results.

[0076] Foundational technologies for artificial intelligence generally include sensors, dedicated AI chips, cloud computing, distributed storage, big data processing, operating / interactive systems, and mechatronics. AI software technologies mainly encompass computer vision, robotics, biometrics, speech processing, natural language processing, and machine learning / deep learning.

[0077] The network in which the computer device is located includes, but is not limited to, the Internet, wide area network, metropolitan area network, local area network, and virtual private network (VPN).

[0078] S10, in response to the device identification command for the target authorized network segment, the probe is started to initiate segmented asynchronous Address Resolution Protocol (ARP) broadcast requests to the target authorized network segment, obtains the ARP reply, and generates an active device list based on the ARP reply.

[0079] In this embodiment, the device identification command can be triggered by relevant operations and maintenance personnel based on actual device identification needs. For example, to meet the needs of asset inventory, security compliance, and vulnerability remediation, network operations and maintenance personnel need to accurately and promptly identify camera devices in the intranet, in which case the device identification command can be triggered.

[0080] In this embodiment, the device to be identified may include, but is not limited to, audio acquisition devices (such as recorders), video acquisition devices (such as cameras), etc.

[0081] In this embodiment, the startup probe initiates segmented asynchronous Address Resolution Protocol (ARP) broadcast requests to the target authorized network segment, receives ARP responses, and generates an active device list based on the ARP responses, including:

[0082] Calculate the number of available Internet Protocol addresses based on the subnet mask;

[0083] When the number of available Internet Protocol addresses exceeds a preset threshold, the target authorized network segment is divided according to the configured number to obtain multiple sub-network segments;

[0084] The probes that are started asynchronously initiate the Address Resolution Protocol (ARP) broadcast request to each subnet segment and receive the ARP response.

[0085] Obtain the source Media Access Control Address (MAC address), the target Internet Protocol Address (IP address), and the response timestamp from each Address Resolution Protocol (ARP) response;

[0086] The list of active devices is constructed based on the source Media Access Control address, the target Internet Protocol address, and the timestamp of each Address Resolution Protocol (ARP) response.

[0087] Wherein, the media access control address of the reply source is the media access control address of the sending device that replied via the address resolution protocol;

[0088] Wherein, the target Internet Protocol address for the response is the Internet Protocol address of the device that sent the Address Resolution Protocol (ARP) response;

[0089] Specifically, when an available Internet Protocol address is detected that does not respond in the first round, the Address Resolution Protocol (IP) broadcast request is resent to the detected available Internet Protocol address within a preset tolerance window.

[0090] The preset threshold can be selected as the optimal value based on the experiment.

[0091] For example, when the number of available Internet Protocol (IP) addresses is 300, exceeding the preset threshold of 256, the target authorized network segment is divided into 3 sub-segments, each containing 128 addresses. Assuming the device identifier's IP is 192.168.1.2, the probed device's IP is 192.168.1.3, and the MAC address is 00:11:22:33:44:55, the device identifier sends a broadcast ARP request to the target IP 192.168.1.3. Upon receiving this request, the probed device sends a corresponding ARP reply message, with the sending device's MAC address as 00:11:22:33:44:55 and the sending device's IP address as 192.168.1.3. If any address does not respond in the first round, a retransmission will be sent within a preset tolerance window (usually ten seconds) to minimize missed detections. Once this step is completed, you can obtain a list of "active devices" on the network and pass it down downstream.

[0092] Within each sub-task corresponding to a sub-network segment, a rate limiter can be used to control the packet sending rate, thereby ensuring that each sub-task sends a maximum of N ARP requests per millisecond (N can be configured to 10 by default and is adjustable).

[0093] In the above embodiments, by sending broadcast requests in segments asynchronously, it is possible to balance coverage and network load, and avoid injecting packets to a large number of addresses simultaneously within the same millisecond, thereby avoiding congestion problems.

[0094] S11, Perform port detection on each device in the active device list to obtain multiple open ports.

[0095] In this embodiment, the process of performing port probing on each device in the active device list to obtain multiple open ports includes:

[0096] For probes belonging to the Transmission Control Protocol (TCP) type, a synchronization packet is sent using the corresponding probe, and the port that returns the synchronization acknowledgment packet is identified as the open port; and / or

[0097] For probes of the User Datagram Protocol (UDP) type, an empty UDP packet is sent using the corresponding probe, and ports other than those returning Internet Control Message Protocol packets are identified as the open ports;

[0098] During port detection, if the number of concurrent connections on a single machine is less than or equal to the configured number of connections, and the overall configuration for high-latency links times out.

[0099] The number of configured connections can be the optimal value selected based on experiments.

[0100] For example, on the Transmission Control Protocol (TCP) side, the probe uses a half-open SYN (Synchronize Sequence Numbers) handshake, sends TCP SYN packets, and probes the target device's ports for openness based on TCP protocol logic. Specifically, waiting for a SYN-ACK (Synchronize Sequence Numbers-Acknowledgment) is sufficient to determine if a port is open. On the User Datagram Protocol (UDP) side, reachability is inferred using zero-load packets combined with ICMP (Internet Control Message Protocol) port unreachability feedback. Specifically, an empty UDP packet is sent to a specific UDP port of the device being probed. If the port is not open, an ICMP packet will be sent in response, indicating that the port is unreachable. If the port is open, there will usually be no response. By eliminating unreachable ports, it is possible to infer which ports are reachable. Furthermore, during port probing, to avoid blocking service flow, the number of concurrent connections per machine is limited to a few dozen by default, and an overall timeout of 800–1000 milliseconds is set for high-latency links. Once the detection is complete, each device will carry a set of "currently open ports" fields to continue downstream.

[0101] The overall timeout refers to the maximum waiting time from the start of sending the probe packet to the end of the wait for a response. If the expected response (such as TCP SYN-ACK or UDP ICMP Port Unreachable) is not received within this time, the port is considered unresponsive, and the probe continues to the next port.

[0102] Through the above embodiments, port detection can be further performed on the basis of generating an active device list, thereby identifying the open ports of each device.

[0103] S12, perform multi-protocol verification on the multiple open ports according to the port-protocol adaptive matching mechanism to obtain multi-protocol verification results, and construct the original feature set based on the multi-protocol verification results.

[0104] In this embodiment, the step of performing multi-protocol verification on the multiple open ports according to the port-protocol adaptive matching mechanism to obtain the multi-protocol verification result includes:

[0105] Identify the fixed port among the plurality of open ports;

[0106] Send a broadcast or multicast probe packet to the fixed port and record the devices that actively respond to the probe packet as candidate devices;

[0107] The device identification command is parsed to obtain the type of device to be identified;

[0108] The protocol importance is determined according to the type of device to be identified, and the protocol priority is configured according to the protocol importance.

[0109] Identify the custom protocol port of the candidate device;

[0110] According to the protocol priority, probe messages of the corresponding protocol are sent to each custom protocol port in sequence;

[0111] Obtain the device information of the device corresponding to the custom protocol port that received the complete handshake message as the multi-protocol verification result;

[0112] Specifically, for custom protocol ports that return a pending authentication status code, the corresponding device information will be marked as pending confirmation.

[0113] By performing protocol probing on all open ports of each device, rather than relying on default ports, it is possible to effectively avoid missed detections caused by port modifications.

[0114] For example, when identifying a camera, the fixed port can include standard and largely unmodifiable protocols such as WS-Discovery (Web Services Dynamic Discovery) (e.g., UDP3702), SSDP (Simple Service Discovery Protocol) (e.g., UDP1900), and mDNS (Multicast DNS) (e.g., UDP5353). The custom protocol port can include RTSP OPTIONS (Real Time Streaming Protocol OPTIONS), ONVIF SOAP (Open Network Video Interface Forum Simple Object Access Protocol), HTTP (Hypertext Transfer Protocol Snapshot), private handshake, SIP OPTIONS (Session Initiation Protocol OPTIONS), and RTMP (Real-Time Messaging Protocol), etc.

[0115] Specifically, probe packets are sent to fixed ports via broadcast or multicast to capture information about devices that actively respond. These actively responding devices are considered to have implemented the corresponding protocol stack and are in an active state, which can preliminarily determine that the device supports a certain type of protocol. Furthermore, protocol priorities are determined according to actual device identification needs (different device types correspond to different protocol priorities; for example, when identifying cameras, the RTSP protocol mainly appears on audio and video protocols, while the HTTP protocol may appear on various protocols, thus RTSP has a higher priority. Because each protocol has its default port, for example, the default port for RTSP is 554, if port 554 is found in the open ports, RTSP can be used first for matching to improve matching efficiency and reduce detection costs). Probe packets for the corresponding protocol are sent sequentially to each custom protocol port. Complete handshake packets that conform to the protocol definition are identified as valid packets (e.g., if RTSP receives a 200 OK response and ONVIF receives a ProbeMatch response containing Xaddr, then a complete handshake packet conforming to the protocol definition is identified). Instead of simply probing according to the protocol's default port, the protocol is first matched against the real-time open port list of the detection device, selecting the protocol probe with the highest probability of a hit and the lowest cost. If a match fails, other protocol probes are called for further probing, balancing identification accuracy and detection efficiency.

[0116] Furthermore, all probe messages are kept at the handshake or query level. If the device returns a status code 401 or 404 due to authentication requirements, this "received a reasonable protocol stack response" is considered a weak positive signal, indicating that the match was not successful, but the device responded compliantly to the protocol, suggesting that the device may have implemented the protocol. For example, if an RTSP OPTION is sent, the device may return a 401 Unauthorized response, indicating that the other party supports RTSP but requires further authentication. This method can effectively reduce the false negative rate.

[0117] In this embodiment, the original feature set may include, but is not limited to, a combination of one or more of the following information:

[0118] IP address, MAC address, protocols used in the response, response port, response summary, timestamp, etc.

[0119] By constructing the original feature set, a comprehensive data foundation can be provided for subsequent verification.

[0120] This embodiment first performs an ARP scan to obtain a complete list of active devices, and then combines port detection and multi-protocol lightweight handshake to achieve comprehensive coverage of devices.

[0121] S13, the Media Access Control Address of each device in the list of active devices is parsed using an Organizationally Unique Identifier (OUI) to obtain the parsing result.

[0122] In this embodiment, the step of resolving the Media Access Control Address of each device in the active device list using an Organizational Unique Identifier to obtain the resolution result includes:

[0123] Start the media access control address identification component; wherein, the media access control address identification component is an independent service and a component that resides in memory after startup;

[0124] The media access control address identification component is used to obtain a pre-built list of organization-unique identifiers that are assigned by the Institute of Electrical and Electronics Engineers (IEEE) and updated in real time.

[0125] Using the media access control address identification component, the media access control address of each device is mapped to its vendor affiliation based on the organization's unique identifier list, and the parsing result is obtained.

[0126] Specifically, vendor attribution mapping can be completed in microseconds by resolving unique identifiers.

[0127] For example, when identifying a camera, if the mapping result belongs to a known camera manufacturer, the device is labeled with a "manufacturer brand"; for unknown or ambiguous manufacturers, the value is left blank, waiting for more information to be provided in the subsequent verification process.

[0128] S14, the original feature set and the parsing result are merged and concatenated according to Internet Protocol addresses to obtain the target feature set.

[0129] In this embodiment, after determining which manufacturer a certain MAC address originates from, the original dataset also contains information such as IP address and MAC address. By combining the two, it can be determined which manufacturer a device with a certain IP address originates from, thus realizing the mutual correlation between information.

[0130] S15, perform feature fusion according to the target feature set to obtain fused features, calculate the confidence score of each device according to the fused features, and generate the recognition result of each device based on the confidence score.

[0131] In this embodiment, the steps of performing feature fusion according to the target feature set to obtain fused features, calculating the confidence score of each device according to the fused features, and generating the recognition result of each device based on the confidence score include:

[0132] The indicators in the target feature set are converted into vectors to obtain multiple confidence factors for each device;

[0133] By sequentially concatenating multiple confidence factors for each device, the fusion feature of each device is obtained;

[0134] The model and target classification strategy are generated from the pre-configured model strategy pool, which are the initial confidence scores corresponding to the type of device to be identified. The target classification strategy includes a first threshold and a second threshold, and the first threshold is greater than the second threshold.

[0135] The device identification command is parsed to obtain real-time scene data, and the initial confidence score generation model is fine-tuned based on the real-time scene data to obtain the target confidence score generation model.

[0136] The fused features of each device are input into the target confidence score generation model to obtain the target confidence score for each device;

[0137] When a device is detected with a target confidence score greater than the first threshold, the detected device is determined to be the type of device to be identified; or

[0138] When a device is detected to have a target confidence score greater than the second threshold and less than or equal to the first threshold, the device type of the detected device is determined and further identification is required.

[0139] Specifically, for the device information marked as being in the pending confirmation state, the corresponding target confidence score is halved before being compared with the first threshold and the second threshold.

[0140] For example, when identifying a camera, several binary or multi-valued indicators such as "manufacturer brand matched", "RTSP handshake successful", "ONVIF information readable", "HTTP snapshot valid", "private protocol handshake successful", and "RTMP handshake successful" can be converted into a unified vector and used as multiple confidence factors for each device.

[0141] Specifically, each indicator in the target feature set can be converted into a vector according to a pre-configured conversion strategy. For example, for OUI, its vector value can be configured to 0 or 1 depending on whether it matches a known camera manufacturer. For RTSP, its vector value can be configured to [0, 0.5, 1] ​​according to the response content [no response, 400, 200].

[0142] The confidence score generation model and hierarchical strategy are stored in the model strategy pool according to the type of device to be identified, which can be quickly called up and supports targeted processing for different device types, thereby improving the recognition accuracy.

[0143] Fine-tuning the initial confidence score generation model based on real-time scene data further ensures the accuracy of identification. For example, if significant characteristics are found in the corresponding network segment, fine-tuning can be made based on these characteristics. For instance, if it is pre-determined that all cameras come from Manufacturer A, the weight of Manufacturer A's MAC address and proprietary protocol can be increased.

[0144] Of course, the threshold can also be adjusted according to the actual environment in this embodiment.

[0145] The confidence score generation model can be an artificial intelligence model (such as a classification model, a prediction model, etc.) or a weighted model, etc.

[0146] For example, when the goal is to identify a camera, and the confidence score generation model is a weighted model, the target confidence score generation model can be represented as follows:

[0147] score = 3*oui + 2*onvif + 3*rtsp + 2*http + 1*sip + 2*private protocol handshake + 1*rtmp + 1*multicast.

[0148] Wherein, score represents the target confidence score, oui represents the manufacturer brand hit factor, onvif represents the ONVIF information readability factor, rtsp represents the RTSP handshake success factor, http represents the HTTP snapshot validity factor, sip represents the session initiation protocol validity factor, private protocol handshake represents the private protocol handshake success factor, rtmp represents the RTMP handshake success factor, and multicast represents the multicast DNS handshake success factor.

[0149] Furthermore, when the score is greater than 6, the corresponding device is identified as a camera; when the score is greater than 2 and less than or equal to 6, the corresponding device is identified as needing further identification for subsequent verification.

[0150] Furthermore, if an RST / 401 is received, the score is halved to prevent strong authentication devices from being missed.

[0151] Through the above embodiments, each model (such as the weights and thresholds of each feature) can be quickly adjusted according to the actual scenario and network environment, so that the model is more adapted to the real-time recognition requirements, thereby improving the accuracy of device recognition.

[0152] In this embodiment, after generating the recognition result for each device based on the confidence score, the method further includes:

[0153] The recognition results of each device are stored in the target database according to the key-value caching mechanism, and the validity period of the recognition results of each device is configured.

[0154] When performing the next round of device identification, based on the stored identification results of each device, probes that belong to the same Internet Protocol address and whose detection overhead is higher than the overhead threshold and whose change probability is lower than the configuration probability are skipped.

[0155] It is understandable that each protocol corresponds to a protocol probe, and the overhead of probing each protocol can be verified experimentally beforehand. The number of probes corresponds to the number of probeable protocols (approximately ten or so). For devices with caching, this embodiment skips the port scanning to obtain open ports, the OUI parsing process, and most protocols in the multi-protocol verification process, retaining only a few of the highest priority protocols. For example, to identify a camera, RTSP is the protocol that best represents a camera. If the RTSP result matches the cached result, it can be assumed that the device type has not changed.

[0156] For example, a time-sensitive key-value cache table can be maintained locally on the probe to store protocol hit information for the last 30 minutes. Using this cache, if the same IP address is encountered again in the next scan, probes with high costs and low change probability can be skipped, and only fast, volatile items such as RTSP or HTTP snapshots can be retained, thus significantly saving network and computing resources.

[0157] This embodiment employs a segmented active probe link, dividing ARP discovery, port probe, and multi-protocol handshake into three progressive layers. Each layer takes the simplified result of the previous layer as input, avoiding blind packet injection in large network segments and significantly reducing network overhead and false alarm rate. Furthermore, it prioritizes the use of broadcast and handshake level packets, triggering full-port probes as needed, and includes timeout and circuit breaker mechanisms to minimize the impact on the production network. Simultaneously, it utilizes the latest OUI database for real-time MAC address parsing, fusing hardware manufacturer brand information with soft features returned from protocol handshakes to generate confidence scores, enabling high-accuracy device identification without requiring device login.

[0158] As can be seen from the above technical solutions, this invention can initiate segmented asynchronous Address Resolution Protocol (ARP) broadcast requests to the target authorized network segment to generate an active device list, avoiding congestion and thus accurately detecting active devices. It performs port probing on each device in the active device list, verifies open ports using a port-protocol adaptive matching mechanism, and resolves the organization-unique identifier (IUI) of the Media Access Control (MAC) address of each device in the active device list. This solves the problems of missed detections caused by single-protocol broadcasts and port changes, as well as false alarms caused by only resolving the IUI. Furthermore, it calculates the confidence score of each device based on fusion features to generate the identification result for each device, thereby comprehensively considering multiple factors and accurately identifying devices step by step, effectively reducing the false alarm rate.

[0159] like Figure 2 The diagram shown is a functional block diagram of a preferred embodiment of the device identification device of the present invention. The device identification device 11 includes a generation unit 110, a detection unit 111, a verification unit 112, a parsing unit 113, and a splicing unit 114. The module / unit referred to in this invention refers to a series of computer program segments that can be executed by a processor and perform a fixed function, and are stored in a memory. In this embodiment, the functions of each module / unit will be described in detail in subsequent embodiments.

[0160] The generation unit 110 is configured to, in response to a device identification command for a target authorized network segment, initiate a segmented asynchronous Address Resolution Protocol (ARP) broadcast request to the target authorized network segment to obtain an ARP response, and generate an active device list based on the ARP response.

[0161] The detection unit 111 is used to perform port detection on each device in the active device list to obtain multiple open ports;

[0162] The verification unit 112 is used to perform multi-protocol verification on the multiple open ports according to the port-protocol adaptive matching mechanism to obtain multi-protocol verification results, and to construct an original feature set based on the multi-protocol verification results;

[0163] The parsing unit 113 is used to parse the Media Access Control Address of each device in the list of active devices by performing Organizational Unique Identifier (OUI) parsing to obtain the parsing result.

[0164] The splicing unit 114 is used to merge and splice the original feature set and the parsing result according to Internet protocol addresses to obtain the target feature set;

[0165] The generation unit 110 is further configured to perform feature fusion according to the target feature set to obtain fused features, calculate the confidence score of each device according to the fused features, and generate the recognition result of each device based on the confidence score.

[0166] As can be seen from the above technical solutions, this invention can initiate segmented asynchronous Address Resolution Protocol (ARP) broadcast requests to the target authorized network segment to generate an active device list, avoiding congestion and thus accurately detecting active devices. It performs port probing on each device in the active device list, verifies open ports using a port-protocol adaptive matching mechanism, and resolves the organization-unique identifier (IUI) of the Media Access Control (MAC) address of each device in the active device list. This solves the problems of missed detections caused by single-protocol broadcasts and port changes, as well as false alarms caused by only resolving the IUI. Furthermore, it calculates the confidence score of each device based on fusion features to generate the identification result for each device, thereby comprehensively considering multiple factors and accurately identifying devices step by step, effectively reducing the false alarm rate.

[0167] like Figure 3 The diagram shown is a structural schematic of a computer device that implements the device identification method of the present invention.

[0168] The computer device 1 may include a memory 12, a processor 13, and a bus (the arrow in the figure represents the bus), and may also include a computer program, such as a device identification program, stored in the memory 12 and executable on the processor 13.

[0169] Those skilled in the art will understand that the schematic diagram is merely an example of computer device 1 and does not constitute a limitation on computer device 1. Computer device 1 can be either a bus topology or a star topology. Computer device 1 may also include more or fewer other hardware or software than shown in the diagram, or different component arrangements. For example, computer device 1 may also include input / output devices, network access devices, etc.

[0170] It should be noted that the computer device 1 described is merely an example. Other existing or future electronic products that are adaptable to this invention should also be included within the scope of protection of this invention and are incorporated herein by reference.

[0171] The memory 12 includes at least one type of readable storage medium, such as flash memory, portable hard drive, multimedia card, card-type memory (e.g., SD or DX memory), magnetic memory, magnetic disk, optical disk, etc. In some embodiments, the memory 12 can be an internal storage unit of the computer device 1, such as a portable hard drive of the computer device 1. In other embodiments, the memory 12 can be an external storage device of the computer device 1, such as a plug-in portable hard drive, smart media card (SMC), secure digital card (SD), flash card, etc., equipped on the computer device 1. Furthermore, the memory 12 can include both internal and external storage units of the computer device 1. The memory 12 can be used not only to store application software and various types of data installed on the computer device 1, such as device identification program code, but also to temporarily store data that has been output or will be output.

[0172] In some embodiments, the processor 13 may be composed of integrated circuits, such as a single packaged integrated circuit or multiple integrated circuits packaged with the same or different functions, including combinations of one or more central processing units (CPUs), microprocessors, digital processing chips, graphics processors, and various control chips. The processor 13 is the control unit of the computer device 1, connecting various components of the computer device 1 via various interfaces and lines. It executes programs or modules stored in the memory 12 (e.g., executing device identification programs) and calls data stored in the memory 12 to perform various functions of the computer device 1 and process data.

[0173] The processor 13 executes the operating system of the computer device 1 and various installed applications. The processor 13 executes the applications to implement the steps in the various device identification method embodiments described above, for example... Figure 1 The steps are shown.

[0174] For example, the computer program may be divided into one or more modules / units, which are stored in the memory 12 and executed by the processor 13 to complete the present invention. The one or more modules / units may be a series of computer-readable instruction segments capable of performing specific functions, which describe the execution process of the computer program in the computer device 1. For example, the computer program may be divided into a generation unit 110, a detection unit 111, a verification unit 112, a parsing unit 113, and a splicing unit 114.

[0175] The integrated unit implemented as a software functional module described above can be stored in a computer-readable storage medium. This software functional module, stored in a storage medium, includes several instructions to cause a computer device (which may be a personal computer, computer equipment, or network device, etc.) or processor to execute portions of the device identification method described in the various embodiments of the present invention.

[0176] If the modules / units integrated in the computer device 1 are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments of the present invention can also be implemented by a computer program instructing related hardware devices. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above.

[0177] The computer program includes computer program code, which may be in the form of source code, object code, executable file, or some intermediate form. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording media, USB flash drive, portable hard drive, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory, etc.

[0178] Furthermore, the computer-readable storage medium may primarily include a stored program area and a stored data area, wherein the stored program area may store the operating system, an application program required for at least one function, etc.; and the stored data area may store data created based on the use of blockchain nodes, etc.

[0179] The blockchain referred to in this invention is a novel application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanisms, and encryption algorithms. Essentially, a blockchain is a decentralized database, a chain of data blocks linked together using cryptographic methods. Each data block contains information about a batch of network transactions, used to verify the validity of the information (anti-counterfeiting) and generate the next block. A blockchain can include an underlying blockchain platform, a platform product service layer, and an application service layer.

[0180] The bus can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. This bus can be divided into address bus, data bus, control bus, etc. For ease of representation, in... Figure 3 The bus is represented by only one straight line, but this does not mean that there is only one bus or one type of bus. The bus is configured to enable communication between the memory 12 and at least one processor 13, etc.

[0181] Although not shown, the computer device 1 may also include a power supply (such as a battery) to power various components. Preferably, the power supply can be logically connected to the at least one processor 13 through a power management device, thereby enabling functions such as charging management, discharging management, and power consumption management. The power supply may also include one or more DC or AC power supplies, recharging devices, power fault detection circuits, power converters or inverters, power status indicators, and other arbitrary components. The computer device 1 may also include various sensors, Bluetooth modules, Wi-Fi modules, etc., which will not be described in detail here.

[0182] Furthermore, the computer device 1 may also include a network interface. Optionally, the network interface may include a wired interface and / or a wireless interface (such as a Wi-Fi interface, a Bluetooth interface, etc.), which is typically used to establish communication connections between the computer device 1 and other computer devices.

[0183] Optionally, the computer device 1 may further include a user interface, which may be a display, an input unit (such as a keyboard), and optionally, a standard wired interface or a wireless interface. Optionally, in some embodiments, the display may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, or an OLED (Organic Light-Emitting Diode) touchscreen, etc. The display may also be appropriately referred to as a screen or display unit, used to display information processed in the computer device 1 and to display a visual user interface.

[0184] It should be understood that the embodiments described are for illustrative purposes only and are not limited to this structure in the scope of the patent application.

[0185] It will be understood by those skilled in the art that Figure 3The structure shown does not constitute a limitation on the computer device 1, and may include fewer or more components than shown, or combine certain components, or have different component arrangements.

[0186] Combination Figure 1 The memory 12 in the computer device 1 stores multiple instructions to implement a device identification method, and the processor 13 can execute the multiple instructions to achieve the following:

[0187] In response to the device identification command for the target authorized network segment, the probe is activated to initiate segmented asynchronous Address Resolution Protocol (ARP) broadcast requests to the target authorized network segment to obtain ARP responses, and an active device list is generated based on the ARP responses;

[0188] Port probing is performed on each device in the list of active devices to obtain multiple open ports;

[0189] The multiple open ports are subjected to multi-protocol verification according to the port-protocol adaptive matching mechanism to obtain multi-protocol verification results, and an original feature set is constructed based on the multi-protocol verification results;

[0190] The media access control address of each device in the active device list is parsed using an organization-unique identifier to obtain the parsing result;

[0191] The original feature set and the parsing result are merged and concatenated according to Internet Protocol addresses to obtain the target feature set;

[0192] The target feature set is used to perform feature fusion to obtain fused features, and the confidence score of each device is calculated according to the fused features. The recognition result of each device is generated based on the confidence score.

[0193] Specifically, the processor 13's implementation method for the above instructions can be found in [reference needed]. Figure 1 The descriptions of the relevant steps in the corresponding embodiments are not repeated here.

[0194] It should be noted that all data involved in this case was legally obtained. Software tools or components not belonging to this company that appear in the embodiments of this application are merely illustrative examples and do not represent actual use.

[0195] In the several embodiments provided by this invention, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of modules is only a logical functional division, and other division methods may be used in actual implementation.

[0196] This invention can be used in a wide variety of general-purpose or special-purpose computer system environments or configurations. Examples include: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, and distributed computing environments including any of the above systems or devices. This invention can be described in the general context of computer-executable instructions, such as program modules, that are executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform specific tasks or implement specific abstract data types. This invention can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0197] The modules described as separate components may or may not be physically separate. The components shown as modules may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0198] Furthermore, the functional modules in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or in the form of hardware plus software functional modules.

[0199] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the present invention can be implemented in other specific forms without departing from the spirit or essential characteristics of the present invention.

[0200] Therefore, the embodiments should be considered exemplary and non-limiting in all respects, and the scope of the invention is defined by the appended claims rather than the foregoing description. Thus, all variations falling within the meaning and scope of equivalents of the claims are intended to be embraced within the invention. No appended diagram markings in the claims should be construed as limiting the scope of the claims.

[0201] Furthermore, it is clear that the word "comprising" does not exclude other units or steps, and the singular does not exclude the plural. Multiple units or devices described in this invention can also be implemented by a single unit or device through software or hardware. Terms such as "first," "second," etc., are used to indicate names and do not indicate any specific order.

[0202] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention.

Claims

1. A device identification method, characterized in that, The device identification method includes: In response to the device identification command for the target authorized network segment, the probe is activated to initiate segmented asynchronous Address Resolution Protocol (ARP) broadcast requests to the target authorized network segment to obtain ARP responses, and an active device list is generated based on the ARP responses; Port probing is performed on each device in the list of active devices to obtain multiple open ports; The multiple open ports are subjected to multi-protocol verification according to the port-protocol adaptive matching mechanism to obtain multi-protocol verification results, and an original feature set is constructed based on the multi-protocol verification results; The media access control address of each device in the active device list is parsed using an organization-unique identifier to obtain the parsing result; The original feature set and the parsing result are merged and concatenated according to Internet Protocol addresses to obtain the target feature set; The target feature set is used to perform feature fusion to obtain fused features, and the confidence score of each device is calculated according to the fused features. The recognition result of each device is generated based on the confidence score.

2. The device identification method as described in claim 1, characterized in that, The startup probe initiates segmented asynchronous Address Resolution Protocol (ARP) broadcast requests to the target authorized network segment, receives ARP responses, and generates an active device list based on the ARP responses, including: Calculate the number of available Internet Protocol addresses based on the subnet mask; When the number of available Internet Protocol addresses exceeds a preset threshold, the target authorized network segment is divided according to the configured number to obtain multiple sub-network segments; The probes that are started asynchronously initiate the Address Resolution Protocol (ARP) broadcast request to each subnet segment and receive the ARP response. Obtain the source media access control address, the target Internet Protocol address, and the timestamp of each address resolution protocol response; The list of active devices is constructed based on the source Media Access Control address, the target Internet Protocol address, and the timestamp of each Address Resolution Protocol (ARP) response. Wherein, the media access control address of the reply source is the media access control address of the sending device that replied via the address resolution protocol; Wherein, the target Internet Protocol address for the response is the Internet Protocol address of the device that sent the Address Resolution Protocol (ARP) response; Specifically, when an available Internet Protocol address is detected that does not respond in the first round, the Address Resolution Protocol (IP) broadcast request is resent to the detected available Internet Protocol address within a preset tolerance window.

3. The device identification method as described in claim 1, characterized in that, The process of port probing for each device in the list of active devices to obtain multiple open ports includes: For probes belonging to the Transmission Control Protocol type, a synchronization packet is sent using the corresponding probe, and the port that returns the synchronization acknowledgment packet is identified as the open port; and / or For probes of the User Datagram Protocol type, an empty User Datagram Protocol packet is sent using the corresponding probe, and other ports other than the returned Internet Control Message Protocol packet are identified as the open ports; During port detection, if the number of concurrent connections on a single machine is less than or equal to the configured number of connections, and the overall configuration for high-latency links times out.

4. The device identification method as described in claim 1, characterized in that, The multi-protocol verification result obtained by performing multi-protocol verification on the multiple open ports according to the port-protocol adaptive matching mechanism includes: Identify the fixed port among the plurality of open ports; Send a broadcast or multicast probe packet to the fixed port and record the devices that actively respond to the probe packet as candidate devices; The device identification command is parsed to obtain the type of device to be identified; The protocol importance is determined according to the type of device to be identified, and the protocol priority is configured according to the protocol importance. Identify the custom protocol port of the candidate device; According to the protocol priority, probe messages of the corresponding protocol are sent to each custom protocol port in sequence; Obtain the device information of the device corresponding to the custom protocol port that received the complete handshake message as the multi-protocol verification result; Specifically, for custom protocol ports that return a pending authentication status code, the corresponding device information will be marked as pending confirmation.

5. The device identification method as described in claim 1, characterized in that, The resolution result obtained by resolving the Media Access Control Address of each device in the active device list to an Organization Unique Identifier includes: Start the media access control address identification component; wherein, the media access control address identification component is an independent service and a component that resides in memory after startup; The Media Access Control Address Identification Component is used to obtain a pre-built list of organization-unique identifiers assigned by the Institute of Electrical and Electronics Engineers (IEEE) and updated in real time. Using the media access control address identification component, the media access control address of each device is mapped to its vendor affiliation based on the organization's unique identifier list, and the parsing result is obtained.

6. The device identification method as described in claim 4, characterized in that, The process of fusing features according to the target feature set to obtain fused features, calculating a confidence score for each device according to the fused features, and generating a recognition result for each device based on the confidence score includes: The indicators in the target feature set are converted into vectors to obtain multiple confidence factors for each device; By sequentially concatenating multiple confidence factors for each device, the fusion feature of each device is obtained; The model and target classification strategy are generated from the pre-configured model strategy pool, which are the initial confidence scores corresponding to the type of device to be identified. The target classification strategy includes a first threshold and a second threshold, and the first threshold is greater than the second threshold. The device identification command is parsed to obtain real-time scene data, and the initial confidence score generation model is fine-tuned based on the real-time scene data to obtain the target confidence score generation model. The fused features of each device are input into the target confidence score generation model to obtain the target confidence score for each device; When a device is detected with a target confidence score greater than the first threshold, the detected device is determined to be the type of device to be identified; or When a device is detected to have a target confidence score greater than the second threshold and less than or equal to the first threshold, the device type of the detected device is determined and further identification is required. Specifically, for the device information marked as being in the pending confirmation state, the corresponding target confidence score is halved before being compared with the first threshold and the second threshold.

7. The device identification method as described in claim 1, characterized in that, After generating the recognition result for each device based on the confidence score, the method further includes: The recognition results of each device are stored in the target database according to the key-value caching mechanism, and the validity period of the recognition results of each device is configured. When performing the next round of device identification, based on the stored identification results of each device, probes that belong to the same Internet Protocol address and whose detection overhead is higher than the overhead threshold and whose change probability is lower than the configuration probability are skipped.

8. A device identification device, characterized in that, The device identification device includes: The generation unit is used to respond to the device identification command for the target authorized network segment, start the probe to initiate the Address Resolution Protocol (ARP) broadcast request to the target authorized network segment in a segmented asynchronous manner, obtain the ARP reply, and generate an active device list based on the ARP reply; The detection unit is used to perform port detection on each device in the list of active devices to obtain multiple open ports; The verification unit is used to perform multi-protocol verification on the multiple open ports according to the port-protocol adaptive matching mechanism to obtain multi-protocol verification results, and to construct an original feature set based on the multi-protocol verification results; The parsing unit is used to parse the Media Access Control Address of each device in the list of active devices by resolving the Organization Unique Identifier to obtain the parsing result; The splicing unit is used to merge and splice the original feature set and the parsing result according to Internet protocol addresses to obtain the target feature set; The generation unit is further configured to perform feature fusion according to the target feature set to obtain fused features, calculate the confidence score of each device according to the fused features, and generate the recognition result of each device based on the confidence score.

9. A computer device, characterized in that, The computer device includes: Memory, storing at least one instruction; and The processor executes instructions stored in the memory to implement the device identification method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores at least one instruction, which is executed by a processor in a computer device to implement the device identification method as described in any one of claims 1 to 7.

Images