An edge device identification method and device based on multi-layer evidence fusion

Abstract

The application relates to the technical field of Internet of Things, and discloses an edge device identification method based on multi-layer evidence fusion, which comprises the following steps: step 1: acquiring electrical power consumption data, network message data and physical layer data of an unknown device to form electrical power consumption feature vectors, network message feature vectors and physical layer feature vectors respectively; step 2: respectively matching the electrical power consumption feature vectors, the network message feature vectors and the physical layer feature vectors with judgment rules and device feature templates to obtain electrical power consumption BPA, network message BPA and physical layer BPA respectively; step 3: fusing the electrical power consumption BPA, the network message BPA and the physical layer BPA into final BPA through D-S evidence theory; and step 4: comparing the final BPA with a decision threshold value, and outputting the device type of the unknown device if the final BPA is greater than the decision threshold value. Meanwhile, an edge device identification device based on multi-layer evidence fusion is disclosed.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of Internet of Things, and in particular to an edge device identification method and device based on multi-layer evidence fusion. BACKGROUND

[0002] There are various types of Internet of Things terminals, and the number of Internet of Things terminals is much larger than that of traditional network terminals. Different types of Internet of Things terminals face different security threats. Therefore, effective identification and classification of Internet of Things terminal devices can provide important protection for Internet of Things security management.

[0003] However, existing edge device identification methods mostly rely on "black box" models such as machine learning, deep learning or attention mechanism. Although these methods perform well in a big data and high computing power environment, they have the following disadvantages: complex algorithms, high resource consumption, not suitable for resource-constrained edge devices; poor interpretability, difficult to trace the cause of identification errors; and a large amount of labeled data is required for training, which is difficult to adapt to new devices and environmental changes.

[0004] The technical problem to be solved by the present application is how to efficiently, transparently and with low resource consumption, fuse multi-source heterogeneous data to identify the device type of an edge device. SUMMARY

[0005] The main purpose of the present application is to provide an edge device identification method based on multi-layer evidence fusion. First, multi-source data is converted into a feature vector. Then, the feature vector is compared with a judgment rule and a device feature template to obtain multiple BPA. Then, the multiple BPA is fused by D-S theory to obtain a final BPA. Finally, the device type is identified by comparing the corresponding threshold value with the final BPA, thereby achieving efficient, transparent and low resource consumption identification of the device type.

[0006] Meanwhile, an edge device identification device based on multi-layer evidence fusion is also provided.

[0007] To achieve the above purpose, the technical solution adopted by the present application is as follows:

[0008] An edge device identification method based on multi-layer evidence fusion comprises the following steps:

[0009] Step 1: Obtain the electrical power consumption data, network message data and physical layer data of an unknown device. Process the electrical power consumption data, network message data and physical layer data respectively to obtain electrical power consumption features, network message features and physical layer features. Form electrical power consumption feature vectors, network message feature vectors and physical layer feature vectors according to the electrical power consumption features, network message features and physical layer features.

[0010] Step 2: According to the judgment rule and the device feature template, the electrical power consumption feature vector, the network message feature vector and the physical layer feature vector are matched respectively, and the electrical power consumption BPA, the network message BPA and the physical layer BPA are obtained respectively; the electrical power consumption BPA, the network message BPA and the physical layer BPA are all used to represent the trust degree of the unknown device pointing to each device type;

[0011] Step 3: The electrical power consumption BPA, the network message BPA and the physical layer BPA are fused into the final BPA by the D-S evidence theory;

[0012] Step 4: The final BPA is compared with the decision threshold value, if the final BPA is greater than the decision threshold value, the device type of the unknown device is output, if the final BPA is less than the decision threshold value, the recognition fails or the type is unknown is output.

[0013] Preferably, in the step 1, the electrical power consumption features include at least two of the following: current effective value, voltage effective value, average power, peak factor, main harmonic component amplitude, total harmonic distortion, surge current peak value and surge current duration;

[0014] The network message features include at least two of the following: organization unique identifier, protocol fingerprint, protocol distribution, average packet size, packet size variance and average packet interval time;

[0015] The physical layer features include at least two of the following: RSSI mean value, RSSI variance, mean value of CSI amplitude, standard deviation of CSI amplitude, skewness of CSI amplitude, kurtosis of CSI amplitude and CSI main energy distribution.

[0016] Preferably, in the step 2, the judgment rule is: setting the electrical power consumption feature vector interval, the network message feature vector interval and the physical layer feature vector interval of each device type, and setting the first initial belief value for each electrical power consumption feature vector interval, network message feature vector interval and physical layer feature vector interval, when the input electrical power consumption feature vector, network message feature vector and physical layer feature vector are respectively in the electrical power consumption feature vector interval, network message feature vector interval and physical layer feature vector interval, the corresponding first initial belief value is obtained respectively;

[0017] The device feature template is: setting the ideal network message feature vector, the ideal physical layer feature vector and the ideal electrical power consumption feature vector of each device type.

[0018] Preferably, the step 2 includes the following sub-steps:

[0019] Step A1: establishing a knowledge base containing the judgment rule and the device feature template;

[0020] Step A2: According to the judgment rule, the electrical power consumption feature vector, the network message feature vector and the physical layer feature vector are matched with the electrical power consumption feature vector interval, the network message feature vector interval and the physical layer feature vector interval respectively, when the electrical power consumption feature vector, the network message feature vector and the physical layer feature vector are in the electrical power consumption feature vector interval, the network message feature vector interval and the physical layer feature vector interval respectively, the corresponding device type and the first initial belief value are obtained respectively;

[0021] Step A3: According to the device feature template, the similarity of the electrical power consumption feature vector, the network message feature vector and the physical layer feature vector with each ideal electrical power consumption feature vector, ideal network message feature vector and ideal physical layer feature vector is calculated by cosine similarity, and the device type with the highest similarity and the second initial belief value are obtained respectively;

[0022] Step A4: The first initial belief value and the second initial belief value are processed by taking the maximum value or weighted average, and the electrical power consumption BPA, the network message BPA and the physical layer BPA are obtained respectively.

[0023] Preferably, the step 3 comprises the following sub-steps:

[0024] Step B1: The conflict coefficients of the electrical power consumption BPA and the network message BPA are calculated, the electrical power consumption BPA and the network message BPA are fused according to the Dempster combination rule, and the fusion BPA is obtained;

[0025] Step B2: The conflict coefficients of the fusion BPA and the physical layer BPA are calculated, the fusion BPA and the physical layer BPA are fused according to the Dempster combination rule, and the final BPA is obtained.

[0026] Preferably, the Dempster combination rule is:

[0027] .

[0028] Wherein, is the fusion result, is the conflict coefficient, is the data to be fused, A, B and C are target types.

[0029] Preferably, the step 4 comprises the following sub-steps:

[0030] Step C1: The decision threshold includes absolute confidence threshold and relative interval threshold, the absolute confidence threshold is set to 0.7-0.9, and the relative interval threshold is set to 0.4-0.6;

[0031] Step C2: Calculate the absolute confidence and relative interval value of the final BPA pointing to each device type, the relative interval value is the difference between the maximum absolute confidence and the second largest absolute confidence.

[0032] Step C3: Compare the absolute confidence with the absolute confidence threshold, when the absolute confidence is greater than the absolute confidence threshold and the relative interval value is greater than the relative interval threshold, output the unknown device as the device type corresponding to the absolute confidence; if the absolute confidence is less than the absolute confidence threshold and / or the relative interval value is less than the relative interval threshold, output the identification failure or unknown type.

[0033] Preferably, it further comprises step 5: if the device type identification of the unknown device is successful, record the electrical power consumption feature vector, network message feature vector and physical layer feature vector of this time, update the device feature template by using the moving average method; then increase the first initial belief value of the triggered judgment rule by n to obtain a new first initial belief value and replace it, n is a natural number.

[0034] It should be noted that:

[0035] BPA: Basic Probability Assignment (BPA), also known as belief function m ().

[0036] D-S evidence theory: D-S evidence theory is a mathematical tool for handling uncertainty and incomplete information, widely used in decision support systems. Its core is to realize the fusion and reasoning of multi-source information through basic probability assignment, belief function and likelihood function, with the advantages of no prior probability and supporting "uncertain" expression.

[0037] RSSI: Received signal strength of the device.

[0038] CSI: Channel State Information, each CSI measurement packet can be represented as a complex matrix, and we usually focus on its amplitude part.

[0039] Organization unique identifier: The first 24 bits of the MAC address, directly associated with the device manufacturer.

[0040] Protocol fingerprint: The set of protocols used by the device to announce itself or necessary communication in the network.

[0041] Protocol distribution: Statistics of the proportion of the number of different network protocol (such as TCP, UDP, ICMP, etc.) packets in the total number of packets.

[0042] Average packet size: Packet refers to data packet, reflecting the order of magnitude of data usually transmitted by the device.

[0043] Packet size variance: measure the stability of the device transmitting packet size. For example, the heartbeat packet size is constant, and the web browsing packet size varies greatly.

[0044] Average packet interval time: reflects the frequency characteristics of the device sending data packets. The interval time of periodic heartbeat packets is relatively fixed.

[0045] Also provided is an edge device identification device based on multi-layer evidence fusion, for implementing the above-mentioned edge device identification method based on multi-layer evidence fusion, comprising the following units:

[0046] Data acquisition unit: for acquiring electrical power consumption data, network message data and physical layer data of an unknown device, processing the electrical power consumption data, network message data and physical layer data respectively to obtain electrical power consumption features, network message features and physical layer features, and forming electrical power consumption feature vectors, network message feature vectors and physical layer feature vectors according to the electrical power consumption features, network message features and physical layer features respectively;

[0047] BPA generation unit: matching the electrical power consumption BPA, network message BPA and physical layer BPA with the electrical power consumption feature vectors, network message feature vectors and physical layer feature vectors respectively according to the judgment rules and device feature templates, and obtaining the electrical power consumption BPA, network message BPA and physical layer BPA respectively; the electrical power consumption BPA, network message BPA and physical layer BPA are all used to represent the trust degree of the unknown device pointing to each device type;

[0048] BPA fusion unit: for fusing the electrical power consumption BPA, network message BPA and physical layer BPA into a final BPA through D-S evidence theory;

[0049] Decision unit: for comparing the final BPA with a decision threshold value, if the final BPA is greater than the decision threshold value, outputting the device type of the unknown device, if the final BPA is less than the decision threshold value, outputting recognition failure or unknown type.

[0050] Compared with the prior art, the present scheme has the following beneficial effects:

[0051] The identification method of the present scheme first converts multi-source data into unified, quantifiable and distinguishable feature vectors, then compares the feature vectors with the judgment rules and device feature templates to obtain multiple BPAs, fuses the multiple BPAs through D-S theory to obtain a final BPA, and finally compares the final BPA with a corresponding threshold value to identify the device type. In this way, the whole process adopts a lightweight statistical and rule method, requiring less resources, suitable for real-time operation of edge devices, and each step of decision can be traced back, facilitating positioning and correcting identification errors. BRIEF DESCRIPTION OF DRAWINGS

[0052] Figure 1 A flow chart of the edge device identification method based on multi-layer evidence fusion of embodiment 1;

[0053] Figure 2 A flow chart of the edge device identification device based on multi-layer evidence fusion of embodiment 1. DETAILED DESCRIPTION

[0054] In order to make the objects, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, not all. The components of the embodiments of the present application described and shown in the drawings herein can be arranged and designed in various different configurations.

[0055] Embodiment 1

[0056] Reference Figure 1 A method for identifying edge devices based on multi-layer evidence fusion, comprising the following steps:

[0057] Step 1: Obtain the electrical power consumption data, network message data and physical layer data of the unknown device, process the electrical power consumption data, network message data and physical layer data respectively to obtain electrical power consumption features, network message features and physical layer features, and form electrical power consumption feature vectors, network message feature vectors and physical layer feature vectors according to the electrical power consumption features, network message features and physical layer features;

[0058] Preferably, in step 1, the electrical power consumption features include at least two of the following: current effective value, voltage effective value, average power, peak factor, main harmonic component amplitude, total harmonic distortion, surge current peak value and surge current duration;

[0059] The network message features include at least two of the following: organization unique identifier, protocol fingerprint, protocol distribution, average packet size, packet size variance and average packet interval time;

[0060] The physical layer features include at least two of the following: RSSI mean, RSSI variance, mean of CSI amplitude, standard deviation of CSI amplitude, skewness of CSI amplitude, kurtosis of CSI amplitude and CSI main energy distribution.

[0061] In this embodiment, the electrical power consumption data is first calculated to obtain the electrical power consumption features, and then the electrical power consumption features are combined into the electrical power consumption feature vector, specifically:

[0062] The calculation formula of the current effective value is: wherein is the current of the nth sampling point.

[0063] The formula for calculating the voltage effective value is , is the voltage value of the nth sampling point;

[0064] The formula for calculating the average power is: ;

[0065] The formula for calculating the peak factor is: , where represents the maximum absolute value of the current signal.

[0066] The formula for calculating the main harmonic component amplitude is: , where is the frequency index corresponding to the fundamental frequency (such as 50Hz or 60Hz).

[0067] The formula for calculating the total harmonic distortion is: , where is the RMS value of the fundamental wave (1st harmonic), is the RMS value of the nth harmonic.

[0068] The formula for calculating the surge current peak value is: ;

[0069] The formula for calculating the surge current duration is: the time length.

[0070] Finally, the calculated electrical power consumption features are combined into an electrical power consumption feature vector, and the electrical power consumption feature vector is:

[0071] .

[0072] First, calculate the network message data to obtain network message features, and then combine all the network message features into a network message feature vector, which is:

[0073] The calculation method of the organization unique identifier (OUI) is to convert the organization unique identifier into one-hot encoding, for example: assuming that the MAC address of a device is 00:1A:2B:3C:4D:5E, and its OUI is 00:1A:2B. After looking up the table, it is found that the manufacturer corresponding to 00:1A:2B is Cisco. If the system supports manufacturers such as Cisco, Apple, and Huawei, then the one-hot encoding result is: [Cisco, Apple, Huawei] = [1, 0, 0] indicates that the device belongs to the Cisco manufacturer.

[0074] ​Protocol fingerprint calculation method: It is represented as a binary vector F_proto=[b1,b2,…,bk], where k is the total number of protocols we are interested in. bi={1,if protocol i is observed in P, 0,otherwise}.

[0075] Protocol distribution calculation method: The proportion of a certain protocol is: Then all protocols are distributed as follows: in, This represents the percentage of the corresponding agreement relative to the total number of agreements.

[0076] Method for calculating average bag size: ,in, For the first The size of each data packet (in bytes), where N is the total number of packets.

[0077] Methods for calculating the variance of package size: .

[0078] Method for calculating average package interval time: ,in, Let be the arrival timestamp of the i-th data packet, and there are a total of N packets.

[0079] Finally, the network packet feature vector is ,in, This is a feature of one-hot encoding for OUI. This is a protocol fingerprint feature.

[0080] Using the same method, the physical layer feature vector is obtained as follows:

[0081] .

[0082] in, The mean of RSSI For RSSI variance, The mean of the CSI amplitude. The standard deviation of the CSI amplitude. The skewness of the CSI amplitude. The kurtosis of the CSI amplitude. This represents the main energy distribution of CSI.

[0083] By calculating and transforming electrical power consumption data, network packet data, and physical layer data, the raw data streams from different dimensions and formats are transformed into unified, quantifiable, and discriminative numerical feature vectors.

[0084] Step 2: According to the judgment rule and the device feature template, the electrical power consumption feature vector, the network message feature vector and the physical layer feature vector are matched respectively to obtain the electrical power consumption BPA, the network message BPA and the physical layer BPA; the electrical power consumption BPA, the network message BPA and the physical layer BPA are used to represent the trust degree of the unknown device pointing to each device type;

[0085] Preferably, the step 2 comprises the following sub-steps:

[0086] Step A1: Establishing a knowledge base containing the judgment rule and the device feature template;

[0087] In the embodiment, the judgment rule and the device feature template are stored by establishing the knowledge base, which facilitates the subsequent calling of the judgment rule and the device feature, and the adaptive updating of the judgment rule and the device feature.

[0088] The judgment rule is that the electrical power consumption feature vector interval, the network message feature vector interval and the physical layer feature vector interval of each device type are set, and the first initial belief value is set for each electrical power consumption feature vector interval, network message feature vector interval and physical layer feature vector interval, and when the input electrical power consumption feature vector, network message feature vector and physical layer feature vector are respectively in the electrical power consumption feature vector interval, network message feature vector interval and physical layer feature vector interval, the corresponding first initial belief value is obtained respectively.

[0089] Specifically, the electrical power consumption feature vector interval of the camera and the first initial belief value when in the interval, the network message feature vector interval and the first initial belief value when in the interval, and the physical layer feature vector interval and the first initial belief value when in the interval are set, and so on. The corresponding electrical power consumption feature vector interval and the first initial belief value when in the interval, the network message feature vector interval and the first initial belief value when in the interval, and the physical layer feature vector interval and the first initial belief value when in the interval are set for different device types.

[0090] It should be noted that different device types and different feature vector intervals can be assigned different values of the first initial belief value.

[0091] Taking the setting of the electrical power consumption feature vector interval as an example:

[0092] ;

[0093] ;

[0094] .

[0095] It should be noted that the judgment rule is implemented by IF-THEN statement, as the above 3 judgment rules, the first judgment rule means: set the average power in the electrical power consumption feature vector of the IP camera to be less than 4W, and the surge current peak value to be greater than 1A, if in this range, it is considered that the unknown device is an IP camera, and the first initial belief value of the interval is set to 0.7; the rest of the judgment rules can be understood in the same way. Moreover, this embodiment is only an example of the three rules, and does not represent that the judgment rule is only these three rules, which can be set according to the specific situation, and the first initial belief value can be set according to the actual situation, such as 0.7, 0.8, 0.6 in this example, and the first initial belief value is set according to different feature interval combination. The same method is used to set the corresponding judgment rules on the network message and the physical layer.

[0096] The device feature template is: set the ideal network message feature vector, the ideal physical layer feature vector and the ideal electrical power consumption feature vector of each device type.

[0097] The setting of the device feature template is based on the theoretical value of the feature vector of each device type at different levels (network message, physical layer and electrical power consumption), which is used for comparison with the obtained feature vector. Still taking the electrical power consumption feature vector as an example:

[0098]

[0099]

[0100]

[0101] Here, the meaning is that the theoretical average power of the camera is 5W, the theoretical surge current peak value is 1.2A, and the theoretical total harmonic distortion is 80%; the theoretical average power of the router is 10W, the theoretical surge current peak value is 0.2A, and the theoretical total harmonic distortion is 40%; the theoretical average power of the sound box is 2W, the theoretical surge current peak value is 0.2A, and the theoretical total harmonic distortion is 55%.

[0102] Step A2: according to the judgment rule, match the electrical power consumption feature vector, the network message feature vector and the physical layer feature vector with the electrical power consumption feature vector interval, the network message feature vector interval and the physical layer feature vector interval respectively, when the electrical power consumption feature vector, the network message feature vector and the physical layer feature vector are in the electrical power consumption feature vector interval, the network message feature vector interval and the physical layer feature vector interval respectively, the corresponding device type and the first initial belief value are obtained respectively;

[0103] ​​​In this embodiment, the electrical power consumption feature vector is matched with all electrical power consumption feature vector intervals. When the electrical power consumption feature vector is within the range of electrical power consumption feature vectors of a certain device type, the corresponding device type and the first initial belief value at the electrical power consumption level are obtained.

[0104] Similarly, the network packet feature vector is matched with all network packet feature vector intervals, and the physical layer feature vector is matched with all physical layer feature vector intervals to obtain the corresponding device type and the first initial belief value at the network packet level and the corresponding device type and the first initial belief value at the physical layer level, respectively.

[0105] Taking the identification of a newly connected IP camera as an example, this explains when the system receives the electrical power consumption feature vector ( When the electrical power consumption (BPA) is obtained, the complete workflow is obtained.

[0106] Frame of Discernment The current system can recognize the following set of device types:

[0107] .

[0108] Input feature vector: The electrical power consumption feature vector is:

[0109] .

[0110] The rules for determining when to load the knowledge base are as follows:

[0111] ;

[0112] ;

[0113] .

[0114] Matching process:

[0115] for ,have and It satisfies rule 1, but does not satisfy rules 2 and 3.

[0116] Therefore, devices of type IP camera are assigned an initial belief value of 0.7, while devices of type smart speaker and router are not satisfied and are discarded.

[0117] The network message feature vector and the physical layer feature vector are matched in the same way, and the device type for the network message feature vector and the corresponding first initial belief value and the device type for the physical layer feature vector and the corresponding first initial belief value are also obtained.

[0118] Step A3: According to the device feature template, the similarity of the electrical power consumption feature vector, the network message feature vector and the physical layer feature vector with each ideal electrical power consumption feature vector, ideal network message feature vector and ideal physical layer feature vector is calculated by cosine similarity, and the device type with the highest similarity and the second initial belief value are obtained respectively.

[0119] Load the device feature template:

[0120] ;

[0121] ;

[0122] .

[0123] The similarity of the electrical power consumption feature vector and each ideal electrical power consumption feature vector is calculated by cosine similarity, and the calculation formula of the cosine similarity is: , wherein, is the electrical power consumption feature vector, is the ideal electrical power consumption feature vector, and

[0124] ;

[0125] ;

[0126] .

[0127] The device type with the highest similarity is assigned to the second initial belief value. In this embodiment, the IP camera is assigned to the second initial belief value at the electrical power consumption level, and the second initial belief value is 0.8.

[0128] At the network message level and the physical layer level, the same method is used for matching. The network message feature vector and the ideal network message feature vector are matched in terms of similarity, and the physical layer feature vector and the ideal physical layer feature vector are matched in terms of similarity, so as to obtain the device type and the second initial belief value at the network message level and the device type and the second initial belief value at the physical layer level.

[0129] Step A4: The first initial belief value and the second initial belief value are processed by taking the maximum value or weighted average, and the electrical power consumption BPA, the network message BPA and the physical layer BPA are obtained respectively.

[0130] The first initial belief value and the second initial belief value are processed by taking the maximum value, and at the electrical power consumption level: , =0, =0.

[0131] It should be noted that the maximum value is processed for the first initial belief and the second initial belief value pointing to the same device type, and the first initial belief value and the second initial belief value of each pointed device type need to be processed by taking the maximum value.

[0132] BPA (basic probability assignment) generation:

[0133] The belief of is assigned to the "IP camera": .

[0134] The remaining device types have no direct evidence support, and the belief is :

[0135] .

[0136] The remaining uncertainty is assigned to the universal set : .

[0137] The electrical power consumption BPA is:

[0138] .

[0139] Using the same method, we get:

[0140] The network message BPA is

[0141] ;

[0142] The physical layer BPA is

[0143] .

[0144] Step 3: By D-S evidence theory, the electrical power consumption BPA, network message BPA and physical layer BPA are fused into the final BPA;

[0145] Preferably, the step 3 includes the following sub-steps:

[0146] In this embodiment, still taking an IP camera as an example, the actual calculation process of fusion by D-S evidence theory is described in detail.

[0147] The universal set is identified: : ,

[0148] The electrical power consumption BPA is ,

[0149] The network message BPA is ,

[0150] The physical layer BPA is .

[0151] Step B1: calculate the conflict coefficient of the electrical power consumption BPA and the network message BPA, fuse the electrical power consumption BPA and the network message BPA according to the Dempster combination rule to obtain a fused BPA;

[0152] The electrical power consumption BPA is , and the network message BPA is ,

[0153] The conflict coefficient of the electrical power consumption BPA and the network message BPA is calculated, and in the Dempster rule, the conflict coefficient is the sum of the combination probabilities of all intersections being empty sets. In this example, the intersection of all combinations is not empty, so ,

[0154] The Dempster combination rule is:

[0155] .

[0156] Wherein, is the fusion result, is the conflict coefficient, is the data to be fused, and A, B and C are target types.

[0157] Substitute the electrical power consumption BPA and the network message BPA into the above formula,

[0158] For :

[0159] .

[0160] For : .

[0161] The obtained fused BPA is =0.94, =0.06, after the first fusion, the confidence degree of the “IP camera” is greatly improved to 0.94, and the uncertainty is reduced to 0.06.

[0162] Step B2: calculate the conflict coefficient of the fused BPA and the physical layer BPA, fuse the fused BPA and the physical layer BPA according to the Dempster combination rule to obtain a final BPA.

[0163] Calculate the conflict coefficient of the fusion BPA and the physical layer BPA, and the conflict term is the combination with an empty intersection: With , because , .

[0164] The contribution of :

[0165] ,

[0166] Total: 0.47 + 0.376 = 0.846.

[0167] The contribution of : .

[0168] The contribution of : .

[0169] The contribution of : .

[0170] After normalization processing, the normalization factor is .

[0171] Get the final BPA ( ):

[0172] .

[0173] Verify the normalization condition: 0.934 + 0.033 + 0.007 + 0.026 = 1.000.

[0174] Now the sum is exactly 1, which meets the normalization condition.

[0175] After two times of D-S evidence theory fusion, the belief degree of (IP camera) is very high, reaching 0.934, the physical layer's fuzzy support for "camera or router" is finally left with only 0.033 of belief, the weak evidence pointing to the smart speaker is greatly weakened, only remaining 0.007, and the uncertainty ( ) is also compressed to 0.026.

[0176] Step 4: Compare the final BPA with the decision threshold. If the final BPA is greater than the decision threshold, output the device type of the unknown device. If the final BPA is less than the decision threshold, output the recognition failure or unknown type.

[0177] Preferably, the step 4 includes the following sub-steps:

[0178] Step C1: The decision threshold includes an absolute confidence threshold and a relative interval threshold. Set the absolute confidence threshold to 0.7 to 0.9 and the relative interval threshold to 0.4 to 0.6.

[0179] In this embodiment, the absolute confidence threshold is 0.8 and the relative interval threshold is 0.5.

[0180] Step C2: Calculate the absolute confidence level and relative interval value of the final BPA for each device type, where the relative interval value is the difference between the largest and second largest absolute confidence levels;

[0181] Calculate the absolute confidence, likelihood, and relative interval values ​​for the final BPA pointing to each device type.

[0182] The formula for calculating absolute confidence level is: ,

[0183] The absolute confidence level of the IP camera is: ,

[0184] The absolute confidence level of the smart speaker is: ,

[0185] The absolute confidence level of the router is: (because There is no or contain (but does not include a subset of other elements).

[0186] The formula for calculating realism is: ,

[0187] The fidelity of the IP camera is: ,

[0188] The realism of the smart speaker is: ,

[0189] The router's fidelity is: ,

[0190] The hypothesis with the highest confidence level Its confidence level Second highest assumption Its confidence level ,

[0191] Relative interval value = - = 0.934-0.007=0.927.

[0192] Step C3: Compare the absolute confidence level with the absolute confidence threshold. If the absolute confidence level is greater than the absolute confidence threshold and the relative interval value is greater than the relative interval threshold, then output the unknown device as the device type corresponding to the absolute confidence level. If the absolute confidence level is less than the absolute confidence threshold and / or the relative interval value is less than the relative interval threshold, then output recognition failure or unknown type.

[0193] If the absolute confidence level of the IP camera is 0.934 > 0.8 and the relative interval value is 0.927 > 0.5, then the output "unknown device" is the IP camera.

[0194] Realism This further confirms the high confidence level regarding IP cameras, because This forms a very narrow confidence interval, indicating a high degree of consistency in the evidence.

[0195] Preferably, the method further includes step 5: if the device type of the unknown device is successfully identified, the electrical power consumption feature vector, network packet feature vector and physical layer feature vector are recorded, and the device feature template is updated using the moving average method; then the first initial belief value of the triggered judgment rule is increased by n to obtain a new first initial belief value and replaced, where n is a natural number.

[0196] In this embodiment, after successful identification, the current electrical power consumption feature vector and the ideal electrical power consumption feature vector are calculated using the moving average method to obtain a new ideal electrical power consumption feature vector, and the ideal electrical power consumption feature vector in the device feature template is replaced. Similarly, a new ideal network packet feature vector and a new ideal physical layer feature vector can also be obtained, and the corresponding device feature templates are replaced.

[0197] Furthermore, for the triggered judgment rule, that is, if the current feature vector (electrical power consumption feature vector, network packet feature vector or physical layer feature vector) satisfies the judgment rule, the corresponding first initial belief value is increased by n, where n is 0.01, to obtain a new first initial belief value and replace the old first initial belief value.

[0198] Taking IP camera identification as an example again, once an unknown device is identified as an IP camera, the "Camera Power Consumption Template" in the knowledge base... The average power is This observation value Using the moving average method: , The learning rate can be set according to actual needs to obtain a new average power, specifically:

[0199] Let the learning rate be... ,but:

[0200] .

[0201] In this way, the device feature template gradually approaches the feature vector of the real device.

[0202] Suppose the following judgment rule is triggered:

[0203] .

[0204] Since the judgment rule is valid for this identification verification, the first initial belief value is replaced by 0.7+0.01=0.71, thereby realizing the replacement or modification of the corresponding first initial belief value of the judgment rule in the knowledge base.

[0205] In this way, as the number of recognitions increases, the judgment rules and device feature templates of the knowledge base are constantly updated adaptively, so that the judgment rules and device feature templates can better fit the actual situation of the device, thereby improving the recognition accuracy.

[0206] Embodiment 2

[0207] Reference Figure 2 An edge device recognition apparatus based on multi-layer evidence fusion is used to implement the edge device recognition method based on multi-layer evidence fusion, and includes the following units:

[0208] A data acquisition unit is configured to acquire electrical power consumption data, network message data, and physical layer data of an unknown device, process the electrical power consumption data, network message data, and physical layer data to obtain electrical power consumption features, network message features, and physical layer features, and form electrical power consumption feature vectors, network message feature vectors, and physical layer feature vectors based on the electrical power consumption features, network message features, and physical layer features, respectively.

[0209] A BPA generation unit is configured to match the judgment rules and device feature templates with the electrical power consumption feature vectors, network message feature vectors, and physical layer feature vectors, respectively, to obtain electrical power consumption BPA, network message BPA, and physical layer BPA, respectively; and the electrical power consumption BPA, network message BPA, and physical layer BPA are all used to indicate the trust degree of the unknown device to each device type.

[0210] A BPA fusion unit is configured to fuse the electrical power consumption BPA, network message BPA, and physical layer BPA into a final BPA by using the D-S evidence theory.

[0211] A decision unit is configured to compare the final BPA with a decision threshold value, and if the final BPA is greater than the decision threshold value, output the device type of the unknown device, and if the final BPA is less than the decision threshold value, output a recognition failure or an unknown type.

[0212] In the embodiment, the specific working procedure of the edge device identification apparatus is as follows: the data acquisition unit acquires the electrical power consumption data, network message data and physical layer data of the unknown device, processes the electrical power consumption data, network message data and physical layer data respectively to obtain electrical power consumption features, network message features and physical layer features, groups all the electrical power consumption features into an electrical power consumption feature vector, groups all the network message features into a network message feature vector, groups all the physical layer features into a physical layer feature vector, and then sends the electrical power consumption feature vector, network message feature vector and physical layer feature vector to the BPA generation unit;

[0213] The BPA generation unit loads the judgment rule and device feature template, matches the judgment rule and device feature template with the electrical power consumption feature vector, acquires different device types at the electrical power consumption level and corresponding first initial belief values and second initial belief values, processes all the pointed device types and corresponding first initial belief values and second initial belief values respectively by using the maximum value method to obtain the electrical power consumption BPA, obtains the network message BPA at the network message level and the physical layer BPA at the physical layer level by using the same method, and then sends the electrical power consumption BPA, network message BPA and physical layer BPA to the BPA fusion unit;

[0214] The BPA fusion unit fuses the electrical power consumption BPA, network message BPA and physical layer BPA into the final BPA by using the D-S evidence theory, and sends the final BPA to the decision unit;

[0215] The decision unit calculates the relative interval value and the absolute confidence of each pointed device type according to the final BPA, compares the absolute confidence of each pointed device type with the absolute confidence threshold value, when the absolute confidence of a certain pointed device type is greater than the absolute confidence threshold value and the relative interval value is greater than the relative interval threshold value, the unknown device is output as the pointed device type. If the absolute confidence of all the pointed device types is less than the absolute confidence threshold value, or the relative interval value is less than the relative interval threshold value, the identification fails or the type is unknown.

[0216] Although the embodiments of the present application have been shown and described, those skilled in the art can understand that various changes, modifications, replacements and deformations can be made to the embodiments without departing from the principles and purposes of the present application, and the scope of the present application is defined by the claims and their equivalents.

Claims

1. A method for edge device identification based on multi-layer evidence fusion, characterized in that, The method comprises the following steps: Step 1: obtaining electrical power consumption data, network message data and physical layer data of an unknown device, processing the electrical power consumption data, network message data and physical layer data respectively to obtain electrical power consumption features, network message features and physical layer features, and forming electrical power consumption feature vectors, network message feature vectors and physical layer feature vectors according to the electrical power consumption features, network message features and physical layer features; Step 2: matching the electrical power consumption feature vectors, network message feature vectors and physical layer feature vectors with judgment rules and device feature templates respectively to obtain electrical power consumption BPA, network message BPA and physical layer BPA; the electrical power consumption BPA, network message BPA and physical layer BPA are all used to represent the trust degree of the unknown device to each device type; Step 3: fusing the electrical power consumption BPA, network message BPA and physical layer BPA into final BPA by D-S evidence theory; Step 4: comparing the final BPA with a decision threshold value, if the final BPA is greater than the decision threshold value, outputting the device type of the unknown device, if the final BPA is less than the decision threshold value, outputting recognition failure or unknown type; The step 2 comprises the following sub-steps: Step A1: establishing a knowledge base comprising judgment rules and device feature templates; Step A2: matching the electrical power consumption feature vectors, network message feature vectors and physical layer feature vectors with electrical power consumption feature vector intervals, network message feature vector intervals and physical layer feature vector intervals respectively according to the judgment rules, when the electrical power consumption feature vectors, network message feature vectors and physical layer feature vectors are respectively in the electrical power consumption feature vector intervals, network message feature vector intervals and physical layer feature vector intervals, obtaining corresponding device types and corresponding first initial belief values respectively; Step A3: calculating the similarity of the electrical power consumption feature vectors, network message feature vectors and physical layer feature vectors with each ideal electrical power consumption feature vector, ideal network message feature vector and ideal physical layer feature vector by cosine similarity according to the device feature templates, and obtaining device types with the highest similarity and second initial belief values respectively; Step A4: processing the first initial belief values and the second initial belief values by taking the maximum value or weighted average to obtain the electrical power consumption BPA, network message BPA and physical layer BPA respectively; The step 4 comprises the following sub-steps: Step C1: the decision threshold value comprises an absolute confidence threshold value and a relative interval threshold value, the absolute confidence threshold value is set to 0.7-0.9, and the relative interval threshold value is set to 0.4-0.6; Step C2: calculating the absolute confidence and relative interval value of the final BPA to each device type, the relative interval value being the difference between the maximum absolute confidence and the second largest absolute confidence; Step C3: comparing the absolute confidence with an absolute confidence threshold value, when the absolute confidence is greater than the absolute confidence threshold value and the relative interval value is greater than the relative interval threshold value, outputting the unknown device as the device type corresponding to the absolute confidence; if the absolute confidence is less than the absolute confidence threshold value and / or the relative interval value is less than the relative interval threshold value, outputting a recognition failure or an unknown type.

2. The edge device identification method based on multi-layer evidence fusion according to claim 1, characterized in that, In the step 1, the electrical power consumption features include at least two of the following: current effective value, voltage effective value, average power, peak factor, main harmonic component amplitude, total harmonic distortion, surge current peak value and surge current duration; The network message features include at least two of the following: organization unique identifier, protocol fingerprint, protocol distribution, average packet size, packet size variance and average packet interval time; The physical layer features include at least two of the following: RSSI mean value, RSSI variance, CSI amplitude mean value, CSI amplitude standard deviation, CSI amplitude skewness, CSI amplitude kurtosis and CSI main energy distribution. 3.The edge device identification method based on multi-layer evidence fusion according to claim 1, characterized in that, In the step 2, the judgment rule is: setting the electrical power consumption feature vector interval, network message feature vector interval and physical layer feature vector interval of each device type, and setting a first initial belief value for each electrical power consumption feature vector interval, network message feature vector interval and physical layer feature vector interval, when the input electrical power consumption feature vector, network message feature vector and physical layer feature vector are respectively in the electrical power consumption feature vector interval, network message feature vector interval and physical layer feature vector interval, the corresponding first initial belief value is obtained respectively; The device feature template is: setting the ideal network message feature vector, ideal physical layer feature vector and ideal electrical power consumption feature vector of each device type.

4. The edge device identification method based on multi-layer evidence fusion according to claim 1, characterized in that, The step 3 includes the following sub-steps: Step B1: calculating the conflict coefficient of the electrical power consumption BPA and the network message BPA, fusing the electrical power consumption BPA and the network message BPA according to the Dempster combination rule to obtain a fused BPA; Step B2: calculating the conflict coefficient of the fused BPA and the physical layer BPA, fusing the fused BPA and the physical layer BPA according to the Dempster combination rule to obtain a final BPA.

5. The edge device identification method based on multi-layer evidence fusion according to claim 4, characterized in that, The Dempster combination rule is: wherein, is a fusion result, is a conflict coefficient, is data requiring fusion, and A, B, and C are target types.

6. The edge device identification method based on multi-layer evidence fusion according to claim 3, characterized in that, Further comprising a step 5: if the device type identification of the unknown device is successful, recording the electrical power consumption feature vector, network message feature vector and physical layer feature vector of this time, updating the device feature template by using the moving average method; then increasing the first initial belief value of the triggered judgment rule by n to obtain a new first initial belief value and replace it, n is a natural number.

7. An edge device identification apparatus based on multi-layer evidence fusion, characterized in that, The method for implementing the edge device identification based on multi-layer evidence fusion according to any one of claims 1-6 comprises the following units: The data acquisition unit is used for acquiring the electrical power consumption data, network message data and physical layer data of the unknown device, processing the electrical power consumption data, network message data and physical layer data respectively to obtain electrical power consumption features, network message features and physical layer features, and forming electrical power consumption feature vectors, network message feature vectors and physical layer feature vectors respectively according to the electrical power consumption features, network message features and physical layer features; The BPA generation unit is used for matching the electrical power consumption feature vectors, network message feature vectors and physical layer feature vectors respectively with the judgment rules and device feature templates to obtain electrical power consumption BPA, network message BPA and physical layer BPA respectively; the electrical power consumption BPA, network message BPA and physical layer BPA are all used for representing the trust degree of the unknown device pointing to each device type; The BPA fusion unit is used for fusing the electrical power consumption BPA, network message BPA and physical layer BPA into final BPA through the D-S evidence theory; The decision unit is used for comparing the final BPA with a decision threshold value, outputting the device type of the unknown device if the final BPA is greater than the decision threshold value, and outputting recognition failure or unknown type if the final BPA is less than the decision threshold value.

Images