Edge device identification method and device based on multilayer evidence fusion

Abstract

The invention relates to the technical field of Internet of Things, and discloses a multi-layer evidence fusion-based edge device identification method, which comprises the following steps of: 1, acquiring electrical power consumption data, network message data and physical layer data of an unknown device, and respectively forming an electrical power consumption feature vector, a network message feature vector and a physical layer feature vector; step 2, according to a judgment rule and an equipment feature template, respectively matching with an electrical power consumption feature vector, a network message feature vector and a physical layer feature vector to respectively obtain an electrical power consumption BPA, a network message BPA and a physical layer BPA; 3, fusing the electrical power consumption BPA, the network message BPA and the physical layer BPA into a final BPA through a D-S evidence theory; and 4, comparing the final BPA with a decision threshold, and if the final BPA is greater than the decision threshold, outputting the equipment type of the unknown equipment. Meanwhile, the invention also discloses an edge device identification device based on multi-layer evidence fusion.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of Internet of Things, and in particular to an edge device identification method and device based on multi-layer evidence fusion. BACKGROUND

[0002] There are various types of Internet of Things terminals, and the number of Internet of Things terminals is much larger than that of traditional network terminals. Different types of Internet of Things terminals face different security threats. Therefore, effective identification and classification of Internet of Things terminal devices can provide important protection for Internet of Things security management.

[0003] However, existing edge device identification methods mostly rely on machine learning, deep learning or attention mechanism, etc. These methods perform excellently in a big data and high computing power environment, but have the following disadvantages: complex algorithm, large resource consumption, not suitable for resource-constrained edge devices; poor interpretability, difficult to trace the cause of identification errors; and a large amount of labeled data is required for training, which is difficult to adapt to new devices and environmental changes.

[0004] The technical problem to be solved by the present application is how to efficiently, transparently and with low resource consumption, fuse multi-source heterogeneous data to identify the device type of an edge device. SUMMARY

[0005] The main purpose of the present application is to provide an edge device identification method based on multi-layer evidence fusion. First, multi-source data is converted into a feature vector. Then, the feature vector is compared with a judgment rule and a device feature template to obtain a plurality of BPA. Then, the plurality of BPA is fused by D-S theory to obtain a final BPA. Finally, the device type is identified by comparing the corresponding threshold value with the final BPA, thereby realizing efficient, transparent and low resource consumption identification of the device type.

[0006] Meanwhile, an edge device identification device based on multi-layer evidence fusion is also provided.

[0007] To achieve the above purpose, the technical solution adopted by the present application is as follows: An edge device identification method based on multi-layer evidence fusion, comprising the following steps: Step 1: Obtain electrical power consumption data, network message data and physical layer data of an unknown device. Process the electrical power consumption data, network message data and physical layer data respectively to obtain electrical power consumption features, network message features and physical layer features. Form electrical power consumption feature vectors, network message feature vectors and physical layer feature vectors according to the electrical power consumption features, network message features and physical layer features. Step 2: According to the judgment rule and the device feature template, the electrical power consumption feature vector, the network message feature vector and the physical layer feature vector are matched respectively, and the electrical power consumption BPA, the network message BPA and the physical layer BPA are obtained respectively; the electrical power consumption BPA, the network message BPA and the physical layer BPA are all used to represent the trust degree of the unknown device pointing to each device type; Step 3: The electrical power consumption BPA, the network message BPA and the physical layer BPA are fused into the final BPA by the D-S evidence theory; Step 4: The final BPA is compared with the decision threshold value, if the final BPA is greater than the decision threshold value, the device type of the unknown device is output, if the final BPA is less than the decision threshold value, the recognition fails or the type is unknown.

[0008] Preferably, in the step 1, the electrical power consumption features include at least two of the following: current effective value, voltage effective value, average power, peak factor, main harmonic component amplitude, total harmonic distortion, surge current peak value and surge current duration; The network message features include at least two of the following: organization unique identifier, protocol fingerprint, protocol distribution, average packet size, packet size variance and average packet interval time; The physical layer features include at least two of the following: RSSI mean value, RSSI variance, mean value of CSI amplitude, standard deviation of CSI amplitude, skewness of CSI amplitude, kurtosis of CSI amplitude and CSI main energy distribution.

[0009] Preferably, in the step 2, the judgment rule is: setting the electrical power consumption feature vector interval, the network message feature vector interval and the physical layer feature vector interval of each device type, and setting the first initial belief value for each electrical power consumption feature vector interval, network message feature vector interval and physical layer feature vector interval, when the input electrical power consumption feature vector, network message feature vector and physical layer feature vector are respectively in the electrical power consumption feature vector interval, network message feature vector interval and physical layer feature vector interval, the corresponding first initial belief value is obtained respectively; The device feature template is: setting the ideal network message feature vector, the ideal physical layer feature vector and the ideal electrical power consumption feature vector of each device type.

[0010] Preferably, the step 2 includes the following sub-steps: Step A1: Establishing a knowledge base containing the judgment rule and the device feature template; Step A2: According to the judgment rule, the electrical power consumption feature vector, the network message feature vector and the physical layer feature vector are matched with the electrical power consumption feature vector interval, the network message feature vector interval and the physical layer feature vector interval respectively, when the electrical power consumption feature vector, the network message feature vector and the physical layer feature vector are in the electrical power consumption feature vector interval, the network message feature vector interval and the physical layer feature vector interval respectively, the corresponding device type and the first initial belief value are obtained respectively; Step A3: According to the device feature template, the similarity of the electrical power consumption feature vector, the network message feature vector and the physical layer feature vector with each ideal electrical power consumption feature vector, ideal network message feature vector and ideal physical layer feature vector is calculated by cosine similarity, and the device type with the highest similarity and the second initial belief value are obtained respectively; Step A4: The first initial belief value and the second initial belief value are processed by taking the maximum value or weighted average, and the electrical power consumption BPA, the network message BPA and the physical layer BPA are obtained respectively.

[0011] Preferably, the step 3 comprises the following sub-steps: Step B1: The conflict coefficients of the electrical power consumption BPA and the network message BPA are calculated, the electrical power consumption BPA and the network message BPA are fused according to the Dempster combination rule, and the fusion BPA is obtained; Step B2: The conflict coefficients of the fusion BPA and the physical layer BPA are calculated, the fusion BPA and the physical layer BPA are fused according to the Dempster combination rule, and the final BPA is obtained.

[0012] Preferably, the Dempster combination rule is: .

[0013] Wherein, is the fusion result, is the conflict coefficient, is the data to be fused, A, B and C are target types.

[0014] Preferably, the step 4 comprises the following sub-steps: Step C1: The decision threshold includes absolute confidence threshold and relative interval threshold, the absolute confidence threshold is set to 0.7-0.9, and the relative interval threshold is set to 0.4-0.6; Step C2: The absolute confidence and the relative interval value of the final BPA pointing to each device type are calculated, and the relative interval value is the difference between the maximum absolute confidence and the second largest absolute confidence; Step C3: Compare the absolute confidence with the absolute confidence threshold. If the absolute confidence is greater than the absolute confidence threshold and the relative interval value is greater than the relative interval threshold, output the unknown device as the device type corresponding to the absolute confidence. If the absolute confidence is less than the absolute confidence threshold and / or the relative interval value is less than the relative interval threshold, output a recognition failure or an unknown type.

[0015] Preferably, it further comprises step 5: if the device type identification of the unknown device is successful, record the electrical power consumption feature vector, network message feature vector and physical layer feature vector of this time, update the device feature template using the moving average method; then increase the first initial belief value of the triggered judgment rule by n to obtain a new first initial belief value and replace it, where n is a natural number.

[0016] It should be noted that: BPA: Basic Probability Assignment (BPA), also known as belief function m().

[0017] D-S evidence theory: D-S evidence theory is a mathematical tool for handling uncertainty and incomplete information, widely used in decision support systems. Its core lies in the fusion and reasoning of multi-source information through basic probability assignment, belief function and likelihood function, with the advantages of no need for prior probability and support for "uncertain" expression.

[0018] RSSI: Received signal strength of the device.

[0019] CSI: Channel State Information, each CSI measurement package can be represented as a complex matrix, and we usually focus on its amplitude part.

[0020] Organization unique identifier: The first 24 bits of the MAC address, directly associated with the device manufacturer.

[0021] Protocol fingerprint: The set of protocols used by the device to announce itself or necessary communication in the network.

[0022] Protocol distribution: Statistics on the proportion of the number of different network protocol (such as TCP, UDP, ICMP, etc.) packets in the total number of packets.

[0023] Average packet size: Packet refers to data packet, reflecting the order of magnitude of data usually transmitted by the device.

[0024] Packet size variance: Measures the stability of the device's transmission packet size. For example, the size of the heartbeat packet is constant, and the size of the web browsing packet varies greatly.

[0025] Average packet interval time: reflects the frequency characteristics of the device sending data packets. The interval time of periodic heartbeat packets is relatively fixed.

[0026] Meanwhile, an edge device identification device based on multi-layer evidence fusion is also provided, which is used to implement the edge device identification method based on multi-layer evidence fusion described above, and includes the following units: Data acquisition unit: used to acquire the electrical power consumption data, network message data and physical layer data of the unknown device, process the electrical power consumption data, network message data and physical layer data respectively to obtain electrical power consumption features, network message features and physical layer features, and form electrical power consumption feature vectors, network message feature vectors and physical layer feature vectors according to the electrical power consumption features, network message features and physical layer features respectively; BPA generation unit: matches the electrical power consumption feature vectors, network message feature vectors and physical layer feature vectors with the electrical power consumption BPA, network message BPA and physical layer BPA respectively according to the judgment rules and device feature templates, and obtains the electrical power consumption BPA, network message BPA and physical layer BPA respectively; the electrical power consumption BPA, network message BPA and physical layer BPA are all used to represent the trust degree of the unknown device pointing to each device type; BPA fusion unit: used to fuse the electrical power consumption BPA, network message BPA and physical layer BPA into a final BPA through the D-S evidence theory; Decision unit: used to compare the final BPA with a decision threshold value, if the final BPA is greater than the decision threshold value, the device type of the unknown device is output, if the final BPA is less than the decision threshold value, the identification fails or the type is unknown is output.

[0027] Compared with the prior art, the present scheme has the following beneficial effects: The identification method of the present scheme first converts the multi-source data into unified, quantifiable and distinguishable feature vectors, then compares the feature vectors with the judgment rules and device feature templates to obtain multiple BPAs, then fuses the multiple BPAs through the D-S theory to obtain a final BPA, and finally compares the final BPA with a corresponding threshold value to identify the device type. In this way, the whole process adopts a lightweight statistical and rule method, requires less resources, is suitable for real-time operation of edge devices, and moreover, each step of decision can be traced back, which is convenient for positioning and correcting identification errors. BRIEF DESCRIPTION OF DRAWINGS

[0028] Figure 1 Flowchart of the edge device identification method based on multi-layer evidence fusion of embodiment 1; Figure 2 Flowchart of the edge device identification device based on multi-layer evidence fusion of embodiment 1. DETAILED DESCRIPTION

[0029] To make the purposes, technical solutions, and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are some but not all of the embodiments of the present application. The components of the present application described and shown in the drawings herein can be arranged and designed in various different configurations.

[0030] Embodiment 1 Reference Figure 1 A multi-layer evidence fusion-based edge device identification method, comprising the following steps: Step 1: Obtain the electrical power consumption data, network message data, and physical layer data of an unknown device, process the electrical power consumption data, network message data, and physical layer data respectively to obtain electrical power consumption features, network message features, and physical layer features, and form electrical power consumption feature vectors, network message feature vectors, and physical layer feature vectors according to the electrical power consumption features, network message features, and physical layer features; Preferably, in the step 1, the electrical power consumption features include at least two of the current effective value, the voltage effective value, the average power, the peak factor, the main harmonic component amplitude, the total harmonic distortion, the surge current peak value, and the surge current duration; The network message features include at least two of the organization unique identifier, the protocol fingerprint, the protocol distribution, the average packet size, the packet size variance, and the average packet interval time; The physical layer features include at least two of the RSSI mean value, the RSSI variance, the mean value of the CSI amplitude, the standard deviation of the CSI amplitude, the skewness of the CSI amplitude, the kurtosis of the CSI amplitude, and the CSI main energy distribution.

[0031] In the embodiment, the electrical power consumption data is first calculated to obtain the electrical power consumption features, and then the electrical power consumption features are combined into the electrical power consumption feature vectors, specifically: The calculation formula of the current effective value is: Wherein, is the current of the nth sampling point; The calculation formula of the voltage effective value is , is the voltage value of the nth sampling point; The calculation formula of the average power is: ; The calculation formula of the peak factor is: Wherein, represents the maximum absolute value of the current signal.

[0032] The calculation formula of the main harmonic component amplitude is: Wherein, This is the frequency index corresponding to the base frequency (such as 50Hz or 60Hz).

[0033] The formula for calculating total harmonic distortion is: ,in The RMS value is the fundamental frequency (first harmonic). For the first RMS value of the subharmonic.

[0034] The formula for calculating the peak surge current is: ; The formula for calculating the duration of surge current is: The length of time.

[0035] Finally, the calculated electrical power consumption characteristics are combined to form an electrical power consumption feature vector, which is: .

[0036] First, network packet data is calculated to obtain network packet features. Then, all network packet features are combined to form a network packet feature vector, specifically:

[0037] The Organization Unique Identifier (OUI) is calculated by converting it into one-hot encoding. For example, assuming a device's MAC address is 00:1A:2B:3C:4D:5E, its OUI is 00:1A:2B. Looking up the table, 00:1A:2B corresponds to the Cisco vendor. If the system supports Cisco, Apple, and Huawei vendors, the one-hot encoding result would be: [Cisco, Apple, Huawei] = [1, 0, 0], indicating that the device belongs to the Cisco vendor.

[0038] Protocol fingerprint calculation method: It is represented as a binary vector F_proto=[b1,b2,…,bk], where k is the total number of protocols we are interested in. bi={1,if protocol i is observed in P, 0,otherwise}.

[0039] Protocol distribution calculation method: The proportion of a certain protocol is: Then all protocols are distributed as follows: in, This represents the percentage of the corresponding agreement relative to the total number of agreements.

[0040] Method for calculating average bag size: ,in, For the first The size of each data packet (in bytes), where N is the total number of packets.

[0041] Method for calculating packet size variance: .

[0042] Method for calculating average packet interval time: wherein, is the arrival timestamp of the ith data packet, and there are N packets in total.

[0043] Finally, the network message feature vector is wherein, is the OUI one-hot encoding feature, is the protocol fingerprint feature.

[0044] In the same way, the physical layer feature vector is specifically: .

[0045] wherein, is the RSSI mean value, is the RSSI variance, is the CSI amplitude mean value, is the CSI amplitude standard deviation, is the CSI amplitude skewness, is the CSI amplitude kurtosis, is the CSI main energy distribution.

[0046] Through calculation and transformation of electrical power consumption data, network message data and physical layer data, the original data streams from different dimensions and formats are converted into unified, quantifiable and distinguishable numerical feature vectors.

[0047] Step 2: According to the judgment rules and the device feature templates, the electrical power consumption feature vector, the network message feature vector and the physical layer feature vector are matched respectively to obtain electrical power consumption BPA, network message BPA and physical layer BPA; the electrical power consumption BPA, the network message BPA and the physical layer BPA are all used to represent the trust degree of the unknown device pointing to each device type. Preferably, the step 2 includes the following sub-steps: Step A1: Establish a knowledge base containing judgment rules and device feature templates; In this embodiment, the judgment rules and the device feature templates are stored by establishing a knowledge base, which facilitates subsequent calling of the judgment rules and the device features, and adaptive updating of the judgment rules and the device features.

[0048] The judgment rule is: setting the electrical power consumption feature vector interval, network message feature vector interval and physical layer feature vector interval of each device type, and setting the first initial belief value for each electrical power consumption feature vector interval, network message feature vector interval and physical layer feature vector interval, when the input electrical power consumption feature vector, network message feature vector and physical layer feature vector are respectively in the electrical power consumption feature vector interval, network message feature vector interval and physical layer feature vector interval, the corresponding first initial belief value is obtained respectively; Specifically, the electrical power consumption feature vector interval of the camera and the first initial belief value when in this interval, the network message feature vector interval and the first initial belief value when in this interval, and the physical layer feature vector interval and the first initial belief value when in this interval are set, and so on. The corresponding electrical power consumption feature vector interval and the first initial belief value when in this interval, the network message feature vector interval and the first initial belief value when in this interval, and the physical layer feature vector interval and the first initial belief value when in this interval are set for different device types.

[0049] It should be noted that different device types and different feature vector intervals can be assigned different values of the first initial belief value.

[0050] Taking setting the electrical power consumption feature vector interval as an example: ; ; .

[0051] It should be noted that the judgment rule is realized by IF-THEN statement, as the above three judgment rules, the first judgment rule means: setting the average power of the electrical power consumption feature vector of the IP camera to be less than 4W, and the surge current peak value to be greater than 1A, if in this range, the unknown device is considered to be an IP camera, and the first initial belief value of this interval is set to 0.7; the rest of the judgment rules can be understood in the same way. Moreover, this embodiment is only an example of the three rules, and does not represent that the judgment rule only has these three rules, which can be set according to the specific situation, and the first initial belief value can be set according to the actual situation, such as 0.7, 0.8, 0.6 in this example, and the first initial belief value is set according to different feature interval combination. The same method is used to set the corresponding judgment rule on the network message and physical layer.

[0052] The device feature template is: setting the ideal network message feature vector, ideal physical layer feature vector and ideal electrical power consumption feature vector of each device type.

[0053] The setting of the device feature template is based on the theoretical values of the feature vectors of various device types at different levels (network message, physical layer, and electrical power consumption) and is used for comparison with the acquired feature vectors. Taking the electrical power consumption feature vector as an example: ; ; .

[0054] Here, the meaning is that the theoretical average power of the camera is 5W, the theoretical surge current peak is 1.2A, and the theoretical total harmonic distortion is 80%; the theoretical average power of the router is 10W, the theoretical surge current peak is 0.2A, and the theoretical total harmonic distortion is 40%; the theoretical average power of the sound box is 2W, the theoretical surge current peak is 0.2A, and the theoretical total harmonic distortion is 55%.

[0055] Step A2: According to the judgment rule, the electrical power consumption feature vector, the network message feature vector, and the physical layer feature vector are respectively matched with the electrical power consumption feature vector interval, the network message feature vector interval, and the physical layer feature vector interval. When the electrical power consumption feature vector, the network message feature vector, and the physical layer feature vector are respectively in the electrical power consumption feature vector interval, the network message feature vector interval, and the physical layer feature vector interval, the corresponding device type and the first initial belief value are respectively acquired; In this embodiment, the electrical power consumption feature vector is matched with all the electrical power consumption feature vector intervals for judgment. When the electrical power consumption feature vector is within the electrical power consumption feature vector interval of a certain device type, the corresponding device type at the electrical power consumption level and the first initial belief value are acquired; Similarly, the network message feature vector is matched with all the network message feature vector intervals for judgment, and the physical layer feature vector is matched with all the physical layer feature vector intervals for judgment, respectively acquiring the corresponding device type at the network message level and the first initial belief value and the corresponding device type at the physical layer level and the first initial belief value.

[0056] Taking the identification of a newly connected IP camera as an example, when the system receives the electrical power consumption feature vector ( ), the complete workflow of the electrical power consumption BPA is obtained.

[0057] Discernment frame (Frame of Discernment, ): The set of device types that the current system can identify is: .

[0058] The input feature vector is: the electrical power consumption feature vector is: .

[0059] Load the judgment rules of the knowledge base: ; ; .

[0060] Matching process: For , there are and , rule 1 is met, and rules 2 and 3 are not met.

[0061] Therefore, the device type is an IP camera and is assigned a first initial belief value of 0.7, and the device types of smart speakers and routers do not meet, so they are discarded.

[0062] In the same way, the network message feature vector and the physical layer feature vector are matched, and the device type for the network message feature vector and the corresponding first initial belief value and the device type for the physical layer feature vector and the corresponding first initial belief value are also obtained.

[0063] Step A3: According to the device feature template, the similarity of the electrical power consumption feature vector, the network message feature vector and the physical layer feature vector with each ideal electrical power consumption feature vector, ideal network message feature vector and ideal physical layer feature vector is calculated by cosine similarity, and the device type with the highest similarity and the second initial belief value are obtained respectively; Load the device feature template: ; ; .

[0064] The similarity of the electrical power consumption feature vector and each ideal electrical power consumption feature vector is calculated by cosine similarity, and the calculation formula of the cosine similarity is: , wherein is the electrical power consumption feature vector, is the ideal electrical power consumption feature vector, and ; ; .

[0065] The device type with the highest similarity is assigned a second initial belief value, and in this embodiment, the IP camera is assigned a second initial belief value at the electrical power consumption level, and the second initial belief value is 0.8.

[0066] At the network message level and the physical layer level, the same method is used for matching, the network message feature vector and the ideal network message feature vector are matched in similarity, and the physical layer feature vector and the ideal physical layer feature vector are matched in similarity, so as to obtain the device type at the network message level and the second initial belief value, and the device type at the physical layer level and the second initial belief value.

[0067] Step A4: The first initial belief value and the second initial belief value are processed by taking the maximum value or weighted average, respectively to obtain the electrical power consumption BPA, the network message BPA and the physical layer BPA.

[0068] The first initial belief value and the second initial belief value are processed by taking the maximum value, and at the electrical power consumption level: , =0, =0.

[0069] It should be noted that the maximum value is processed for the first initial belief and the second initial belief value pointing to the same device type, and the first initial belief value and the second initial belief value of each pointed device type need to be processed by taking the maximum value.

[0070] BPA (basic probability assignment) generation: The belief of is assigned to "IP camera": .

[0071] The remaining device types have no direct evidence support, and the belief is : .

[0072] The remaining uncertainty is assigned to the universal set : .

[0073] The electrical power consumption BPA is: .

[0074] Using the same method, we get: The network message BPA is ; The physical layer BPA is .

[0075] Step 3: By D-S evidence theory, the electrical power consumption BPA, the network message BPA and the physical layer BPA are fused into the final BPA; Preferably, the step 3 comprises the following sub-steps: In this embodiment, in this embodiment, still taking an IP camera as an example, the actual calculation process of D-S evidence theory fusion is described in detail.

[0076] Recognize the universal set : , The electrical power consumption BPA is , The network message BPA is , The physical layer BPA is .

[0077] Step B1: calculate the conflict coefficient of the electrical power consumption BPA and the network message BPA, and fuse the electrical power consumption BPA and the network message BPA according to the Dempster combination rule to obtain the fusion BPA; The electrical power consumption BPA is , and the network message BPA is , Calculate the conflict coefficient of the electrical power consumption BPA and the network message BPA. In the Dempster rule, the conflict coefficient is the sum of the combination probabilities of all intersections being empty sets. In this example, the intersection of all combinations is not empty, so , The Dempster combination rule is: .

[0078] Wherein, is the fusion result, is the conflict coefficient, is the data to be fused, and A, B and C are target types.

[0079] Substitute the electrical power consumption BPA and the network message BPA into the above formula, For : .

[0080] For : .

[0081] The obtained fusion BPA is =0.94, =0.06, after the first fusion, the confidence degree of the "IP camera" is greatly improved to 0.94, and the uncertainty is reduced to 0.06.

[0082] Step B2: Calculate the conflict coefficient of the fusion BPA and the physical layer BPA, and fuse the fusion BPA and the physical layer BPA according to the Dempster combination rule to obtain the final BPA.

[0083] Calculate the conflict coefficient of the fusion BPA and the physical layer BPA, and the conflict item is the combination with an empty set intersection: With , because , .

[0084] The contribution of : , Total: 0.47 + 0.376 = 0.846.

[0085] The contribution of : .

[0086] The contribution of : .

[0087] The contribution of : .

[0088] After normalization processing, the normalization factor is .

[0089] Obtain the final BPA ( ): .

[0090] Verify the normalization condition: 0.934 + 0.033 + 0.007 + 0.026 = 1.000.

[0091] Now the sum is exactly 1, which meets the normalization condition.

[0092] After two times of D-S evidence theory fusion, the belief degree of (IP camera) is very high, reaching 0.934, the fuzzy support of the physical layer to "camera or router" is finally only 0.033, the weak evidence pointing to the smart speaker is greatly weakened, only 0.007, and the uncertainty ( ) is compressed to 0.026.

[0093] Step 4: Compare the final BPA with the decision threshold value. If the final BPA is greater than the decision threshold value, output the device type of the unknown device. If the final BPA is less than the decision threshold value, output the recognition failure or unknown type.

[0094] Preferably, step 4 includes the following sub-steps: Step C1: The decision threshold includes an absolute confidence threshold and a relative interval threshold. Set the absolute confidence threshold to 0.7 to 0.9 and the relative interval threshold to 0.4 to 0.6. In this embodiment, the absolute confidence threshold is 0.8 and the relative interval threshold is 0.5.

[0095] Step C2: Calculate the absolute confidence level and relative interval value of the final BPA for each device type, where the relative interval value is the difference between the largest and second largest absolute confidence levels; Calculate the absolute confidence, likelihood, and relative interval values ​​for the final BPA pointing to each device type. The formula for calculating absolute confidence level is: , The absolute confidence level of the IP camera is: , The absolute confidence level of the smart speaker is: , The absolute confidence level of the router is: (because There is no or contain (but does not include a subset of other elements). The formula for calculating realism is: , The fidelity of the IP camera is: , The realism of the smart speaker is: , The router's fidelity is: , The hypothesis with the highest confidence level Its confidence level Second highest assumption Its confidence level , Relative interval value = - = 0.934-0.007=0.927.

[0096] Step C3: Compare the absolute confidence level with the absolute confidence threshold. If the absolute confidence level is greater than the absolute confidence threshold and the relative interval value is greater than the relative interval threshold, then output the unknown device as the device type corresponding to the absolute confidence level. If the absolute confidence level is less than the absolute confidence threshold and / or the relative interval value is less than the relative interval threshold, then output recognition failure or unknown type.

[0097] The absolute confidence of the IP camera is 0.934>0.8, and the relative interval value is 0.927>0.5, so the unknown device is output as an IP camera.

[0098] Likelihood Further confirmed the high confidence of IP camera, because Formed a very narrow confidence interval, indicating that the evidence is highly consistent.

[0099] Preferably, it further comprises step 5: if the device type identification of the unknown device is successful, record the electrical power consumption feature vector, network message feature vector and physical layer feature vector of this time, update the device feature template by using the moving average method; increase the first initial belief value of the triggered judgment rule by n to obtain a new first initial belief value and replace it, and n is a natural number.

[0100] In this embodiment, after successful identification, the electrical power consumption feature vector of this time is calculated with the ideal electrical power consumption feature vector by using the moving average method to obtain a new ideal electrical power consumption feature vector, and the ideal electrical power consumption feature vector in the device feature template is replaced. Similarly, a new ideal network message feature vector and a new ideal physical layer feature vector can also be obtained, and the corresponding device feature template is replaced.

[0101] Moreover, for the triggered judgment rule, that is, the feature vector (electrical power consumption feature vector, network message feature vector or physical layer feature vector) of this time satisfies the judgment rule, the corresponding first initial belief value is increased by n, n is 0.01, to obtain a new first initial belief value and replace the old first initial belief value.

[0102] Still taking the identification of IP camera as an example, when the unknown device is identified as an IP camera and after the identification, the average power of the "camera power consumption template" in the knowledge base is , the observed value of this time is . Through the moving average method: , is the learning rate, which can be set according to actual needs, to obtain a new average power, which is specifically: If the learning rate is set to , then: .

[0103] In this way, the device feature template will gradually approach the feature vector of the real device.

[0104] Suppose the following judgment rule is triggered: .

[0105] Since the judgment rule is valid for this identification verification, the first initial belief value is replaced by 0.7+0.01=0.71, so as to realize the replacement or modification of the corresponding first initial belief value of the judgment rule in the knowledge base.

[0106] In this way, as the number of recognitions increases, the judgment rules and the device feature templates of the knowledge base are continuously updated adaptively, so that the judgment rules and the device feature templates can be more in line with the actual situation of the device, thereby improving the recognition accuracy.

[0107] Embodiment 2 Reference Figure 2 An edge device identification apparatus based on multi-layer evidence fusion is used to implement the edge device identification method based on multi-layer evidence fusion, and comprises the following units: A data acquisition unit is configured to acquire electrical power consumption data, network message data and physical layer data of an unknown device, process the electrical power consumption data, the network message data and the physical layer data respectively to obtain electrical power consumption features, network message features and physical layer features, and form electrical power consumption feature vectors, network message feature vectors and physical layer feature vectors according to the electrical power consumption features, the network message features and the physical layer features respectively. A BPA generation unit is configured to match the judgment rules and the device feature templates with the electrical power consumption feature vectors, the network message feature vectors and the physical layer feature vectors respectively to obtain electrical power consumption BPA, network message BPA and physical layer BPA respectively; the electrical power consumption BPA, the network message BPA and the physical layer BPA are all used to indicate the trust degree of the unknown device to each device type. A BPA fusion unit is configured to fuse the electrical power consumption BPA, the network message BPA and the physical layer BPA into a final BPA by using the D-S evidence theory. A decision unit is configured to compare the final BPA with a decision threshold value, and if the final BPA is greater than the decision threshold value, output the device type of the unknown device, and if the final BPA is less than the decision threshold value, output an identification failure or an unknown type.

[0108] In this embodiment, the specific working process of the edge device identification apparatus is as follows: the data acquisition unit acquires electrical power consumption data, network message data and physical layer data of an unknown device, processes the electrical power consumption data, the network message data and the physical layer data respectively to obtain electrical power consumption features, network message features and physical layer features, forms electrical power consumption feature vectors by combining all the electrical power consumption features, forms network message feature vectors by combining all the network message features, forms physical layer feature vectors by combining all the physical layer features, and then sends the electrical power consumption feature vectors, the network message feature vectors and the physical layer feature vectors to the BPA generation unit. The BPA generation unit loads a judgment rule and a device feature template, matches the judgment rule and the device feature template with the electrical power consumption feature vector, obtains different device types at the electrical power consumption level and corresponding first initial belief values and second initial belief values, processes all the pointed device types and corresponding first initial belief values and second initial belief values in a maximum value taking manner respectively, obtains the electrical power consumption BPA, obtains network message BPA at the network message level and physical layer BPA at the physical layer level by using the same method, and then delivers the electrical power consumption BPA, the network message BPA and the physical layer BPA to the BPA fusion unit; The BPA fusion unit fuses the electrical power consumption BPA, the network message BPA and the physical layer BPA into a final BPA by using the D-S evidence theory, and sends the final BPA to the decision unit; The decision unit calculates relative interval values and absolute confidence degrees of all the pointed device types according to the final BPA, compares the absolute confidence degrees of all the pointed device types with an absolute confidence degree threshold value, when the absolute confidence degree of a certain pointed device type is greater than the absolute confidence degree threshold value and the relative interval value is greater than a relative interval threshold value, outputs that the unknown device is the pointed device type. If the absolute confidence degrees of all the pointed device types are less than the absolute confidence degree threshold value, or the relative interval values are less than the relative interval threshold value, outputs that the recognition fails or the type is unknown.

[0109] Although the embodiments of the present application have been shown and described, those skilled in the art can understand that various changes, modifications, replacements and variations can be made to the embodiments without departing from the principles and the scope of the present application, and the scope of the present application is defined by the claims and their equivalents.

Claims

1. A method for edge device identification based on multi-layer evidence fusion, characterized in that, The method comprises the following steps: Step 1: obtaining electrical power consumption data, network message data and physical layer data of an unknown device, processing the electrical power consumption data, network message data and physical layer data respectively to obtain electrical power consumption features, network message features and physical layer features, and forming electrical power consumption feature vectors, network message feature vectors and physical layer feature vectors according to the electrical power consumption features, network message features and physical layer features; Step 2: matching the electrical power consumption feature vectors, network message feature vectors and physical layer feature vectors with the judgment rules and device feature templates respectively to obtain electrical power consumption BPA, network message BPA and physical layer BPA; the electrical power consumption BPA, network message BPA and physical layer BPA are all used to represent the trust degree of the unknown device to each device type; Step 3: fusing the electrical power consumption BPA, network message BPA and physical layer BPA into final BPA by D-S evidence theory; Step 4: comparing the final BPA with a decision threshold value, if the final BPA is greater than the decision threshold value, outputting the device type of the unknown device, and if the final BPA is less than the decision threshold value, outputting recognition failure or unknown type.

2. The edge device identification method based on multi-layer evidence fusion according to claim 1, characterized in that, In the step 1, the electrical power consumption features include at least two of current effective value, voltage effective value, average power, peak factor, main harmonic component amplitude, total harmonic distortion, surge current peak value and surge current duration; The network message features include at least two of organization unique identifier, protocol fingerprint, protocol distribution, average packet size, packet size variance and average packet interval time; The physical layer features include at least two of RSSI mean value, RSSI variance, mean value of CSI amplitude, standard deviation of CSI amplitude, skewness of CSI amplitude, kurtosis of CSI amplitude and CSI main energy distribution. 3.The edge device identification method based on multi-layer evidence fusion according to claim 1, characterized in that, In the step 2, the judgment rules are: setting the electrical power consumption feature vector intervals, network message feature vector intervals and physical layer feature vector intervals of each device type, and setting a first initial belief value for each electrical power consumption feature vector interval, network message feature vector interval and physical layer feature vector interval, when the input electrical power consumption feature vector, network message feature vector and physical layer feature vector are respectively in the electrical power consumption feature vector interval, network message feature vector interval and physical layer feature vector interval, the corresponding first initial belief value is obtained; The device feature templates are: setting ideal network message feature vectors, ideal physical layer feature vectors and ideal electrical power consumption feature vectors of each device type.

4. The edge device identification method based on multi-layer evidence fusion according to claim 3, characterized in that, The step 2 comprises the following sub-steps: Step A1: establishing a knowledge base containing the judgment rules and device feature templates; Step A2: According to the judgment rule, the electrical power consumption feature vector, the network message feature vector and the physical layer feature vector are matched with the electrical power consumption feature vector interval, the network message feature vector interval and the physical layer feature vector interval respectively, when the electrical power consumption feature vector, the network message feature vector and the physical layer feature vector are in the electrical power consumption feature vector interval, the network message feature vector interval and the physical layer feature vector interval respectively, the corresponding device type and the corresponding first initial belief value are obtained respectively; Step A3: According to the device feature template, the similarity of the electrical power consumption feature vector, the network message feature vector and the physical layer feature vector with each ideal electrical power consumption feature vector, ideal network message feature vector and ideal physical layer feature vector is calculated by cosine similarity, and the device type with the highest similarity and the second initial belief value are obtained respectively; Step A4: The first initial belief value and the second initial belief value are processed by taking the maximum value or weighted average, and the electrical power consumption BPA, the network message BPA and the physical layer BPA are obtained respectively.

5. The edge device identification method based on multi-layer evidence fusion according to claim 1, characterized in that, The step 3 includes the following sub-steps: Step B1: The conflict coefficient of the electrical power consumption BPA and the network message BPA is calculated, the electrical power consumption BPA and the network message BPA are fused according to the Dempster combination rule, and the fusion BPA is obtained; Step B2: The conflict coefficient of the fusion BPA and the physical layer BPA is calculated, the fusion BPA and the physical layer BPA are fused according to the Dempster combination rule, and the final BPA is obtained.

6. The edge device identification method based on multi-layer evidence fusion according to claim 5, characterized in that, The Dempster combination rule is: ； wherein, is the fusion result, is the conflict coefficient, is the data to be fused, A, B, C are target types.

7. The edge device identification method based on multi-layer evidence fusion according to claim 1, characterized in that, The step 4 includes the following sub-steps: Step C1: The decision threshold includes the absolute confidence threshold and the relative interval threshold, the absolute confidence threshold is set to 0.7-0.9, and the relative interval threshold is set to 0.4-0.6; Step C2: The absolute confidence and the relative interval value of the final BPA pointing to each device type are calculated, and the relative interval value is the difference between the maximum absolute confidence and the second largest absolute confidence; Step C3: The absolute confidence is compared with the absolute confidence threshold, when the absolute confidence is greater than the absolute confidence threshold and the relative interval value is greater than the relative interval threshold, the unknown device is output as the device type corresponding to the absolute confidence; if the absolute confidence is less than the absolute confidence threshold and / or the relative interval value is less than the relative interval threshold, the identification fails or the type is unknown.

8. The edge device identification method based on multi-layer evidence fusion according to claim 3, characterized in that, It also includes step 5: if the device type identification of the unknown device is successful, the electrical power consumption feature vector, the network message feature vector and the physical layer feature vector of this time are recorded, the device feature template is updated by using the moving average method; the first initial belief value of the triggered judgment rule is increased by n to obtain a new first initial belief value and replace it, and n is a natural number.

9. An edge device identification apparatus based on multi-layer evidence fusion, characterized in that, The edge device identification method based on multi-layer evidence fusion is used to realize the method of any one of claims 1-8, comprising the following units: The data acquisition unit is used for acquiring the electrical power consumption data, network message data and physical layer data of the unknown device, processing the electrical power consumption data, network message data and physical layer data respectively to obtain electrical power consumption features, network message features and physical layer features, and forming electrical power consumption feature vectors, network message feature vectors and physical layer feature vectors respectively according to the electrical power consumption features, network message features and physical layer features; The BPA generation unit is used for matching the electrical power consumption feature vectors, network message feature vectors and physical layer feature vectors respectively with the judgment rules and device feature templates to obtain electrical power consumption BPA, network message BPA and physical layer BPA respectively; the electrical power consumption BPA, network message BPA and physical layer BPA are all used for representing the trust degree of the unknown device pointing to each device type; The BPA fusion unit is used for fusing the electrical power consumption BPA, network message BPA and physical layer BPA into final BPA through the D-S evidence theory; The decision unit is used for comparing the final BPA with a decision threshold value, outputting the device type of the unknown device if the final BPA is greater than the decision threshold value, and outputting recognition failure or unknown type if the final BPA is less than the decision threshold value.

Images