Configuration file identification method and system

Abstract

The invention provides a configuration file identification method and system. The method comprises the following steps: acquiring a configuration file of target equipment; feature extraction is conducted on the configuration file to obtain an N-dimensional feature vector, and the dimensions of the N-dimensional feature vector comprise at least one of the structure dimension, the manufacturer identification dimension, the configuration logic dimension and the semantic dimension of the configuration file; performing classification processing on the N-dimensional feature vector through a target classification model based on a multi-level classification mechanism to obtain a plurality of classification results, the plurality of classification results respectively corresponding to one of the plurality of levels, and the plurality of levels being respectively used for brand classification, model classification and equipment type classification; obtaining a target confidence coefficient according to the plurality of classification results; obtaining target equipment information of the target equipment according to the target confidence and the equipment information corresponding to the plurality of classification results; the target classification model is obtained by training sample feature vectors of the sample configuration file and sample tags which correspond to the sample feature vectors and have a hierarchical relationship.

Description

Technical Field

[0001] This application relates to the field of computer network management technology, specifically to a method and system for identifying configuration files. Background Technology

[0002] Network device configuration files determine the device's operating mode, interface settings, security policies, and connectivity capabilities. Identifying network device configuration files and storing them in a database is a core task in modern network operations and maintenance.

[0003] Identifying network device configuration files is the core of this task. Currently, methods such as rule templates, keyword matching, or statistical features are commonly used. However, with the rapid evolution of network devices, the limitations of these traditional methods are becoming increasingly apparent. Rule template matching suffers from high template maintenance costs, poor adaptability to new devices, and poor brand compatibility. Keyword matching accuracy drops significantly when dealing with new devices. Statistical features have limited feature dimensions and generalization ability. Summary of the Invention

[0004] This application provides a method and system for identifying configuration files to solve the problem of low accuracy in configuration file identification.

[0005] To achieve the above objectives, in a first aspect, embodiments of this application provide a method for identifying configuration files, including:

[0006] Obtain the configuration file of the target device; extract features from the configuration file to obtain an N-dimensional feature vector, the dimensions of which include at least one of the following: configuration file structure dimension, manufacturer identification dimension, configuration logic dimension, and semantic dimension; classify the N-dimensional feature vector using a target classification model based on a multi-level classification mechanism to obtain multiple classification results, each corresponding to a level in the multi-level classification, which are used for brand classification, model classification, and device type classification; obtain the target confidence score based on the multiple classification results; and obtain the target device information based on the target confidence score and the device information corresponding to the multiple classification results. The target classification model is trained using the sample feature vectors of the sample configuration files and the hierarchical labels of the samples corresponding to the sample feature vectors.

[0007] In one possible implementation of the first aspect, the target device information of the target device is obtained based on the target confidence level and the device information corresponding to multiple classification results, including: when the target confidence level is greater than or equal to a first preset threshold, the device information corresponding to multiple classification results is used as the target device information of the target device.

[0008] In one possible implementation of the first aspect, after obtaining the target confidence level based on multiple classification results, the method further includes: if the target confidence level is less than a first preset threshold and greater than or equal to a second preset threshold, and if multiple classification results satisfy preset conditions, the device information corresponding to the multiple classification results is used as the target device information of the target device, wherein the first preset threshold is greater than the second preset threshold.

[0009] In one possible implementation of the first aspect, after obtaining the target confidence score based on multiple classification results, the method further includes: if the target confidence score is less than a second preset threshold, updating the weights of features in the preset dimension of the N-dimensional feature vector according to historical calibration parameters corresponding to the preset dimension to obtain a new N-dimensional feature vector; wherein the new N-dimensional feature vector has been labeled with labels at each level, and the historical calibration parameters are determined based on the sample feature vector; and training a target classification model according to the new N-dimensional feature vector and the labels at each level corresponding to the new N-dimensional feature vector to obtain a new classification model suitable for identifying the configuration file of the target device.

[0010] In one possible implementation of the first aspect, feature extraction is performed on the configuration file to obtain an N-dimensional feature vector, including: extracting features from the configuration file to obtain structural features, vendor identification features, configuration logic features, and semantic features; and obtaining the N-dimensional feature vector based on the structural features, vendor identification features, configuration logic features, and semantic features.

[0011] In one possible implementation of the first aspect, before classifying the N-dimensional feature vectors using a target classification model based on a multi-level classification mechanism to obtain multiple classification results, the method further includes: training an initial classification model to obtain a target classification model, specifically including: obtaining sample feature vectors from a sample configuration file and each sample label corresponding to the sample feature vectors in a hierarchical relationship; processing the sample feature vectors using the initial classification model to be trained to obtain each sample classification result of the sample feature vectors; adjusting the model parameters of the initial classification model based on the differences between each sample classification result of the sample feature vectors and the corresponding sample labels and continuing training until the training conditions are met, at which point training stops, and the trained target classification model is obtained.

[0012] In one possible implementation of the first aspect, before classifying the N-dimensional feature vector using a target classification model based on a multi-level classification mechanism to obtain multiple classification results, the method further includes: standardizing the N-dimensional feature vector using the feature mean and feature standard deviation corresponding to each feature component in the N-dimensional feature vector to obtain a standardized N-dimensional feature vector, wherein the feature mean and feature standard deviation are determined based on the sample feature vector; classifying the N-dimensional feature vector using a target classification model based on a multi-level classification mechanism to obtain multiple classification results, including: classifying the standardized N-dimensional feature vector using a target classification model based on a multi-level classification mechanism to obtain multiple classification results.

[0013] In one possible implementation of the first aspect, before performing feature extraction on the configuration file to obtain an N-dimensional feature vector, the method further includes: performing a preprocessing operation on the configuration file to obtain a target configuration file, wherein the preprocessing operation includes converting an unstructured or heterogeneous configuration file into a standardized and normalized target configuration file; and performing feature extraction on the configuration file to obtain an N-dimensional feature vector, which includes: performing feature extraction on the target configuration file to obtain an N-dimensional feature vector.

[0014] In one possible implementation of the first aspect, obtaining a target confidence score based on multiple classification results includes: mapping multiple classification results to corresponding confidence scores, and fusing multiple confidence scores to obtain the target confidence score.

[0015] Secondly, embodiments of this application also provide a configuration file recognition system, comprising: a configuration file acquisition module for acquiring the configuration file of a target device; a feature extraction module for extracting features from the configuration file to obtain an N-dimensional feature vector, wherein the dimensions of the N-dimensional feature vector include at least one of the following: configuration file structure dimension, manufacturer identification dimension, configuration logic dimension, and semantic dimension; a classification result acquisition module for classifying the N-dimensional feature vector using a target classification model based on a multi-level classification mechanism to obtain multiple classification results, wherein the multiple classification results correspond to a level in the multi-level classification, and the multi-level classification is used for brand classification, model classification, and device type classification; a target confidence acquisition module for obtaining a target confidence based on the multiple classification results; and a target device information acquisition module for obtaining target device information based on the target confidence and the device information corresponding to the multiple classification results; wherein the target classification model is trained by the sample feature vector of the sample configuration file and the sample labels corresponding to the sample feature vector that have a hierarchical relationship.

[0016] The technical solution of this application embodiment extracts features from the acquired configuration file to obtain an N-dimensional feature vector, achieving multi-dimensional feature fusion. By learning a target classification model of the logical relationships of device information, the N-dimensional feature vector is processed to obtain classification results at each level, thereby obtaining the target confidence score. Based on the confidence score and the classification results, the target device information is obtained. By combining multi-dimensional feature fusion with a hierarchical classification model in configuration file recognition, end-to-end automation is achieved to obtain complete device information from the original configuration file. This effectively identifies heterogeneous configuration files and improves the accuracy of configuration file recognition. Attached Figure Description

[0017] To more clearly illustrate the technical solution of this application, the drawings used in the embodiments will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 A flowchart illustrating a configuration file identification method provided in one embodiment of this application;

[0019] Figure 2 A flowchart illustrating a configuration file identification method provided in another embodiment of this application;

[0020] Figure 3 A flowchart illustrating a configuration file identification method provided in another embodiment of this application;

[0021] Figure 4 This is a schematic diagram of the structure of a configuration file recognition system provided in one embodiment of this application. Detailed Implementation

[0022] To make the objectives and implementation methods of this application clearer, the exemplary implementation methods of this application will be clearly and completely described below with reference to the accompanying drawings of the exemplary embodiments of this application. Obviously, the exemplary embodiments described are only some embodiments of this application, and not all embodiments.

[0023] It should be noted that the brief descriptions of terms in this application are only for the convenience of understanding the embodiments described below, and are not intended to limit the embodiments of this application. Unless otherwise stated, these terms should be understood in their ordinary and common meaning.

[0024] The terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this application are used to distinguish similar or related objects or entities, and do not necessarily imply a specific order or sequence, unless otherwise specified. It should be understood that such terms can be used interchangeably where appropriate.

[0025] The terms “comprising” and “having”, and any variations thereof, are intended to cover but not exclude inclusion, for example, a product or device that includes a range of components is not necessarily limited to all of the components that are clearly listed, but may include other components that are not clearly listed or that are inherent to such product or device.

[0026] In the embodiments of this application, the words "exemplary" or "for example" are used to indicate that they are examples, illustrations, or descriptions. Any embodiment or design that is described as "exemplary" or "for example" should not be construed as being more preferred or advantageous than other embodiments or designs. The use of the words "exemplary" or "for example" is intended to present the relevant concepts in a specific manner.

[0027] In the description of the embodiments in this application, unless otherwise stated, "multiple" means two or more. For example, multiple processing units means two or more processing units; multiple systems means two or more systems.

[0028] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. Rather, they are merely examples of apparatuses and methods consistent with some aspects of the invention as detailed in the appended claims.

[0029] The following is an exemplary description of the application scenarios of the embodiments of this application:

[0030] Network devices serve as the connection hub between terminal devices (computers, mobile phones, servers) and networks. They are hardware or software components used to realize data transmission, connection management, and security control functions in networks (such as local area networks, enterprise networks, or the Internet). Their core role is to build, maintain, and ensure network communication.

[0031] A network device's configuration file is a text file containing all the device's software configuration parameters, determining its operating mode, interface settings, security policies, and connectivity capabilities. Configuration file identification is a core requirement in network management. Traditional methods for configuration file identification typically involve rule-based template identification or keyword matching. However, these methods have limitations when dealing with different network device configuration files. When the configuration file structure is not fixed, the matching accuracy is low, and the rule base requires manual maintenance, making it prone to rule vulnerabilities, conflicts, and outdated rules, resulting in high maintenance costs. Furthermore, there are issues such as long adaptation periods for new devices.

[0032] To address the aforementioned technical problems, one embodiment of this application proposes a method for identifying configuration files. For example... Figure 1 As shown, the methods for identifying configuration files include:

[0033] Step S101: Obtain the configuration file of the target device.

[0034] The method for obtaining the configuration file can retrieve the file from a server, terminal, or local storage medium. The target device refers to the device whose configuration file needs to be obtained. In this application embodiment, the target device includes network devices, such as firewalls, routers, switches, and cloud devices. For example, the technical solution of this application embodiment can be applied to the identification of configuration files for Cisco (ASA series, ISR series, Catalyst series), Huawei (AR series, USG series, CE series), H3C (MSR series, F series, S series), Juniper (SRX series, EX series), Hillstone (E series, X series), and other virtualization devices.

[0035] Before recognizing the configuration file, the configuration file of the target device is first obtained to establish the data foundation for the recognition process. This ensures compatibility with original configuration files from any source, so that the configuration file recognition operation can be performed subsequently.

[0036] Step S102: Extract features from the configuration file to obtain an N-dimensional feature vector.

[0037] The N-dimensional feature vector can include at least one of the following dimensions: configuration file structure dimension, vendor identifier dimension, configuration logic dimension, and semantic dimension. Considering the structural characteristics of the configuration file and device information, four dimensions are set. Of course, the preset dimensions mentioned in this embodiment are only an example, and specific dimensions can be set according to the specific information of the device. For example, when the configuration file structure is uniform, including vendor identifier, configuration logic, and semantic dimensions in the N-dimensional feature vector can reduce the dimension of the feature vector, thereby speeding up subsequent feature vector processing.

[0038] Structural features can refer to the blocks, hierarchical relationships, and format of the configuration file. Vendor identification features can refer to brand-specific keywords and identifiers. Configuration logic features can refer to configuration rules and binding relationships, while semantic features can refer to natural language descriptions or meanings.

[0039] By simultaneously extracting comprehensive features from the configuration file in terms of structure, manufacturer identification, configuration logic, and semantics, a highly representative N-dimensional feature vector is constructed. This solves the problem of poor generalization caused by relying on a single feature. The multi-dimensional features cover device differences (such as new and old manufacturers, different models, etc.), making it particularly suitable for the recognition of new devices or non-standard configuration files.

[0040] Step S103: Using the target classification model, based on a multi-level classification mechanism, classify the N-dimensional feature vector to obtain multiple classification results.

[0041] The target classification model can be trained using the sample feature vectors from the sample configuration file and the hierarchical labels of the samples corresponding to these feature vectors. The target classification model can be a decision tree model, a Support Vector Machine (SVM) model, etc. Multiple classification results correspond to a level within a multi-level system, with each level used for brand, model, and device type classification. The specific levels can be set according to actual needs. The target classification result can refer to the classification probability or classification index of the device information at each level.

[0042] Because the target classification model learns the logical relationships between device information during training, it models the logical connections between device information through the dependencies of hierarchical labels, significantly improving the accuracy of classification results. It also provides structured parsing of complex configuration information, avoiding the output of messy, flat results.

[0043] For example, the target classification model outputs classification results in a hierarchical manner. For instance, the first layer outputs the classification results of the manufacturers, the second layer outputs the classification results of the models, and the third layer outputs the classification results of the software versions.

[0044] Step S104: Obtain the target confidence score based on multiple classification results.

[0045] The target confidence score is generated based on the multi-level classification results, which prepares the groundwork for subsequent steps.

[0046] Step S105: Based on the target confidence level and the device information corresponding to multiple classification results, obtain the target device information.

[0047] Among them, equipment information refers to information describing the equipment. Since the equipment information included in the configuration file has a hierarchical relationship, the next level after brand information is model information, and the next level after model information is equipment type information. Therefore, there is a superior-subordinate relationship between the levels set according to the equipment information.

[0048] Based on the target confidence level and the device information corresponding to multiple classification results, the target device information is obtained. For example, if the target confidence level is within a preset range, the device information corresponding to multiple classification results is used as the target device information.

[0049] The technical solution of this application embodiment obtains the configuration file of the target device, extracts features from the configuration file to obtain an N-dimensional feature vector, and achieves multi-dimensional feature fusion. By learning a target classification model of the logical relationships of device information, the N-dimensional feature vector is processed to obtain classification results at each level, thereby obtaining the target confidence score. Based on the target confidence score and the classification results, the target device information is obtained. This application embodiment combines multi-dimensional feature fusion with a hierarchical classification model for configuration file recognition, achieving end-to-end automation of obtaining complete device information from the original configuration file. It can effectively identify heterogeneous configuration files, improving the accuracy of configuration file recognition.

[0050] In another embodiment of the application, the target device information of the target device is obtained based on the target confidence level and the device information corresponding to multiple classification results, including: when the target confidence level is greater than or equal to a first preset threshold, the device information corresponding to multiple classification results is used as the target device information of the target device.

[0051] The first preset threshold can be set according to the actual situation; for example, the first preset threshold is 0.8.

[0052] In this embodiment, when the target confidence level is greater than or equal to a first preset threshold, the device information corresponding to multiple classification results is directly adopted as the target device information, avoiding manual intervention and ensuring that the recognition results in high-confidence scenarios can be directly used for network management operations. Optionally, the obtained target device information is directly stored in a database.

[0053] For example, by using the device information corresponding to multiple classification results as the target device information of the target device, the device information corresponding to the classification results at each level can be combined sequentially to obtain the target device information of the target device.

[0054] In another embodiment of the application, after obtaining the target confidence level based on multiple classification results, the method further includes: if the target confidence level is less than a first preset threshold and greater than or equal to a second preset threshold, and if multiple classification results meet preset conditions, the device information corresponding to the multiple classification results is used as the target device information of the target device.

[0055] The first preset threshold is greater than the second preset threshold, which is the medium-risk range. For example, if the first preset threshold is 0.8 and the second preset threshold is 0.6, then the medium-risk range is [0.6, 0.8]. Of course, the first and second preset thresholds can be set according to actual conditions. The classification result includes classification probabilities, and the preset conditions include, but are not limited to, the classification probability of each level being within the preset probability range corresponding to the level, and the classification probability of each level being greater than the preset probability threshold corresponding to the level.

[0056] In this embodiment, when the target confidence level is in the medium-risk range, logical verification is performed on each classification result using preset conditions. The dynamic definability and flexible operation of the preset conditions allow the final target device information to be determined based on the preset conditions when the target confidence level is in the medium-risk range, thereby improving the accuracy of the target device information. New devices are often initially identified within the medium-confidence range; preset conditions allow for their safe inclusion, accelerating the process of adding new devices to the knowledge base, generating new training data, and continuously feeding back into model optimization.

[0057] For example, the preset conditions include manual review. If the target confidence level falls into the intermediate risk range, a prompt message is issued to remind the user to conduct manual review. Based on the results of the manual review, the final target device information is determined.

[0058] Figure 2 Another embodiment of this application provides a method for identifying configuration files, which is a preferred method proposed based on the foregoing embodiments. Technical terms that are the same as or similar to those in the foregoing examples will not be repeated. For example... Figure 2 As shown, after obtaining the target confidence score based on multiple classification results, the method also includes:

[0059] Step S201: Obtain the configuration file of the target device.

[0060] Step S202: Extract features from the configuration file to obtain an N-dimensional feature vector.

[0061] Step S203: Using the target classification model, based on a multi-level classification mechanism, classify the N-dimensional feature vector to obtain multiple classification results.

[0062] Step S204: Obtain the target confidence score based on multiple classification results.

[0063] Step S205: When the target confidence level is less than the second preset threshold, update the weights of the features in the preset dimension in the N-dimensional feature vector according to the historical calibration parameters corresponding to the preset dimension, so as to obtain a new N-dimensional feature vector.

[0064] Step S206: Based on the new N-dimensional feature vector and the labels of each level corresponding to the new N-dimensional feature vector, train the target classification model to obtain a new classification model suitable for identifying the configuration file of the target device.

[0065] The new N-dimensional feature vectors are labeled with tags for each level, and the historical calibration parameters are determined based on the sample feature vectors. The historical calibration parameters include, but are not limited to, historical accuracy bias and historical accuracy gradient.

[0066] In this embodiment, when the target confidence level is less than a second preset threshold, the feature weights are dynamically adjusted based on historical calibration parameters. This allows the system to autonomously adapt to unfamiliar new devices, correct feature offsets, and train a target classification model using a new N-dimensional feature vector and corresponding labels at each level. This results in a new classification model suitable for identifying configuration files of the target device. Updating the preset dimension weights enhances the influence of differentiated features and suppresses interference from noisy features, making the new classification model applicable to the identification of configuration files of the target device. Since only feature weights need to be updated instead of the model being reconstructed, the training time for the target classification model can be reduced. Triggering model training with a single sample and dynamically adjusting feature weights provides a solution for network management to address the low accuracy of configuration file identification when devices are rapidly updated.

[0067] In another embodiment of this application, feature weights are adjusted based on historical recognition accuracy to adaptively adjust the N-dimensional feature vector of the target device's configuration file, optimize the N-dimensional feature vector construction process, and improve recognition accuracy. Feature weights can be dynamically adjusted based on historical recognition accuracy according to formula (1).

[0068]

[0069] Among them, w i (t): The weight value of the i-th feature in round t, α: learning rate, controlling the weight adjustment magnitude (set to 0.01), δ i Accuracy deviation = accuracy i threshold_target (target threshold 0.8) Accuracy gradient = (accuracy i _current, accuracy i _previous) / Δt.

[0070] Weighting method: Feature vector weighting: F_weighted=[w1×f1,w2×f2,...,w 31 ×f 31 Weight normalization: ensures Σw i =1, weight update cycle: weight adjustment is performed once every 100 samples processed.

[0071] For example, feature dimensions include vendor identification, configuration logic, and semantic dimensions. Initial weight allocation:

[0072] Manufacturer identification feature weight: w1 = 0.3, configuration logic feature weight: w2 = 0.4, semantic feature weight: w3 = 0.3.

[0073] Statistics after 100 training sessions:

[0074] Manufacturer identification accuracy: 95%, gradient: +0.02; configuration logic accuracy: 75%, gradient: -0.05; semantic feature accuracy: 85%, gradient: +0.01.

[0075] Weight update calculation:

[0076] w1(new)=0.3+0.01×(0.95-0.8)×0.02=0.303,

[0077] w2(new)=0.4+0.01×(0.75-0.8)×(-0.05)=0.4025,

[0078] w3(new)=0.3+0.01×(0.85-0.8)×0.01=0.3005,

[0079] After normalization: w1 = 0.301, w2 = 0.400, w3 = 0.299.

[0080] In another embodiment of the application, feature extraction is performed on the configuration file to obtain an N-dimensional feature vector, including: extracting features from the configuration file to obtain structural features, vendor identification features, configuration logic features, and semantic features; and obtaining an N-dimensional feature vector based on the structural features, vendor identification features, configuration logic features, and semantic features.

[0081] In this embodiment, features are extracted independently in each dimension, and the N-dimensional feature vector formed by the fusion of four-dimensional features improves the feature discrimination index and solves the problem of limited generalization ability caused by a single feature dimension.

[0082] For example, a 31-dimensional feature vector is extracted from the configuration file to comprehensively characterize the device configuration features. The following provides an illustrative explanation of the feature vector for each dimension, where f... iThis represents the feature of the i-th dimension in an N-dimensional feature vector.

[0083] The structural features include five dimensions: f1: number of configuration paragraphs, reflecting configuration complexity; f2: percentage of comment lines, reflecting configuration standardization; f3: indentation depth, representing configuration hierarchy; f4: total number of configuration lines, representing device functionality richness; and f5: average line length, reflecting the level of detail in the configuration description.

[0084] Manufacturer identification features include eight dimensions: f6: Device serial number format matching degree, f7: Frequency of occurrence of proprietary configuration keywords, f8: Command syntax pattern similarity, f9: Manufacturer-specific prefix recognition degree, f 10 Version information format conformity, f 11 : Consistency in interface naming rules, f 12 The protocol supports feature integrity, f 13 Clarity of management mode identification.

[0085] The configuration logic features include 12 dimensions: f 14 : Degree of correlation between configuration items, assess configuration consistency, f 15 : Check the reasonableness of parameter values ​​and the validity of parameters, f 16 Logical consistency scoring, analysis of configuration logic, f 17 Security policy integrity, assess security configuration, f 18 : Rationality of routing configuration, analysis of routing logic, f 19 Interface configuration correlation, check interface consistency, f 20 Access control logic, evaluating the reasonableness of ACLs, f 21 Network topology consistency, analyzing network structure, f 22 Service configuration correlation, check service configuration, f 23 Protocol compatibility assessment, protocol configuration analysis, f 24 Load balancing logic, evaluating load configuration, f 25 : Rationality of redundant configuration, analysis of redundant design.

[0086] Semantic features include 6 dimensions: f 26 : Configure the semantic richness of the description, f 27 Functional module integrity assessment, f 28 Business logic correlation analysis, f 29 : Configure naming conventions check, f 30 : Describe the level of detail in the information, f 31 : Evaluation of the professionalism of the configuration annotations.

[0087] If the feature vector has too few dimensions, key features will be missing, leading to a decrease in recognition accuracy. For example, if the dimension is less than 20, the recognition accuracy will be below 85%. If the feature vector has too many dimensions, redundant features will be introduced, increasing computational complexity, but the improvement in accuracy will be small. For example, if the dimension is greater than 40, computational complexity will increase, but the accuracy improvement will be less than 1%.

[0088] The feature vector is designed to be 31-dimensional, covering all key recognition features, achieving an optimal balance between accuracy and computational efficiency. Of course, the dimension of the feature vector is not unique and can be adjusted according to the specific brand and configuration.

[0089] In another embodiment of the application, before performing feature extraction on the configuration file to obtain an N-dimensional feature vector, the method further includes: performing a preprocessing operation on the configuration file to obtain a target configuration file, wherein the preprocessing operation includes converting an unstructured or heterogeneous configuration file into a standardized and normalized target configuration file; and performing feature extraction on the configuration file to obtain an N-dimensional feature vector, which includes: performing feature extraction on the target configuration file to obtain an N-dimensional feature vector.

[0090] The configuration file can be in formats including, but not limited to, plain text, XML, and JSON.

[0091] Because the original formats of configuration files can vary significantly, and different vendors have vastly different configuration syntax, indentation logic, and comment styles, a preprocessing operation is performed on the configuration files before feature extraction to obtain N-dimensional feature vectors. This preprocessing converts the configuration files into a standardized and normalized intermediate representation, eliminating the interference of format noise on feature extraction. This ensures that feature extraction always receives input in a consistent format, avoiding errors caused by format differences.

[0092] For example, configuration file preprocessing includes file format detection, encoding conversion to a preset structure encoding to resolve issues such as garbled Chinese characters, removal of redundant spaces and tabs from the configuration file, and standardization of line break formatting.

[0093] For example, the preprocessing operation also includes module segmentation, which automatically divides the configuration into logical segments such as interface configuration, routing configuration, and security policy based on the configuration type.

[0094] Module segments can include: basic configuration segments, such as hostnames and domain names; interface configuration segments, such as physical interfaces and virtual LANs; routing configuration segments, such as static routes and dynamic routing protocols; security policy segments, such as access control lists and firewall rules; and service configuration segments, such as Dynamic Host Configuration Protocol (DHCP) and Domain Name System (DNS).

[0095] In another embodiment of the application, before classifying the N-dimensional feature vector using a target classification model based on a multi-level classification mechanism to obtain multiple classification results, the method further includes: standardizing the N-dimensional feature vector using the feature mean and feature standard deviation corresponding to each feature component in the N-dimensional feature vector to obtain a standardized N-dimensional feature vector, wherein the feature mean and feature standard deviation are determined based on the sample feature vector; classifying the N-dimensional feature vector using a target classification model based on a multi-level classification mechanism to obtain multiple classification results, including: classifying the standardized N-dimensional feature vector using a target classification model based on a multi-level classification mechanism to obtain multiple classification results.

[0096] The N-dimensional feature vector is standardized using the feature mean and standard deviation of the sample feature vector. Even if the target device feature values ​​deviate from their historical range—for example, if the feature values ​​in the structural dimension suddenly increase—the standardized values ​​will still fall within a reasonable range. This addresses the issue of subsequent target classification models being affected by large-valued feature components, which can lead to a decrease in the accuracy of the classification results output by the target classification model. It can be understood that the sample feature vector includes multiple features.

[0097] For example, the original feature vector is F = [f1, f2, ..., f 31 For each feature component, Z-score standardization is performed, as shown in formula (2):

[0098] f' i =(f i ,μ i ) / σ i (2)

[0099] Where: μ i Feature f i The eigenvalue mean of the feature vectors of each sample, σ i Feature f i The characteristic standard deviation of each sample feature vector, f' i Standardized eigenvalues, standardized eigenvectors: F' = [f'1, f'2, ..., f'] 31 ].

[0100] In another embodiment of the application, before classifying the N-dimensional feature vectors using a target classification model based on a multi-level classification mechanism to obtain multiple classification results, the method further includes: training an initial classification model to obtain a target classification model, specifically including: obtaining sample feature vectors from a sample configuration file and each sample label corresponding to the sample feature vectors and having a hierarchical relationship; processing the sample feature vectors using the initial classification model to be trained to obtain each sample classification result of the sample feature vectors; adjusting the model parameters of the initial classification model based on the differences between each sample classification result of the sample feature vectors and the corresponding sample labels and continuing training until the training conditions are met, at which point training stops, and the trained target classification model is obtained.

[0101] In this system, sample labels are assigned hierarchically, and the initial classification model learns the constraints between brand, model, and device type during training. The loss function is optimized through hierarchical labels, lower-level classifiers inherit feature abstractions from upper-level classifiers, and backpropagation synchronously adjusts all hierarchical parameters.

[0102] For example, training conditions include, but are not limited to, the number of training iterations reaching a preset number of training iterations, or the fluctuation of model parameters within a preset fluctuation range.

[0103] For example, sample labels can be organized in a tree structure, such as brand, model, and type. The initial classification model autonomously learns the constraint relationship between brand and model. Manufacturer identification features can be used for both brand and model classification, improving training efficiency.

[0104] For example, a composite loss function is constructed, such as a weighted sum of the loss functions at each level, resulting in a three-level loss function. Model-level classification errors are backpropagated to the brand feature extraction layer. When a model-level misclassification occurs, the brand-level feature extraction is simultaneously optimized, significantly reducing similar errors after iterations. The initial classification model automatically strengthens the feature weights of key levels; for example, the feature weights of the brand layer are automatically strengthened.

[0105] For example, SVM separating hyperplanes at different levels can use the same feature space, or allow different weights to be assigned to features at specific levels. This can be solved using multi-kernel learning or specific optimization algorithms. After the SVM model is trained, for each sample feature vector, the SVM model can output an independent label prediction (which class it belongs to) for each level (or each node).

[0106] For example, the initial model is an SVM model, and the kernel function can be a radial basis function, which maps low-dimensional feature vectors to a high-dimensional space to solve the nonlinear problem of configuration files.

[0107] Kernel function formula (3):

[0108] K(x i ,x)=exp(-γ||x i -x|| 2 (3)

[0109] x i : The feature vector of the i-th support vector, x: The feature vector of the sample to be classified, γ: The kernel function bandwidth parameter, which controls the influence range of the support vector.

[0110] ||x i -x|| 2 :x i The squared Euclidean distance between x and the parameter optimization: a smaller γ value results in a smooth decision boundary, strong generalization ability, and is suitable for cases with few training samples; a larger γ value results in a complex decision boundary, high fit to the training data, and is suitable for cases with sufficient samples. The optimal γ value is determined through grid search and cross-validation.

[0111] Decision function formula (4):

[0112]

[0113] Calculate the directed distance from the input sample feature vector to the classification hyperplane, make a classification judgment based on the distance sign, and obtain the classification result through continuous numerical values.

[0114] Where, α i y: The Lagrange multipliers (weight coefficients) of the i-th support vector. i : The class label of the i-th support vector (+1 indicates positive class, -1 indicates negative class), K(x) i (x, ) : Support vectors x i Similarity to the sample to be classified x, b: bias term, adjusts the position of the decision boundary, n: total number of support vectors.

[0115] Classification decision: f(x)>0: classify as positive, f(x)<0: classify as negative.

[0116] In another embodiment of the application, the target confidence level is obtained based on multiple classification results, including: mapping multiple classification results to corresponding confidence levels, and fusing multiple confidence levels to obtain the target confidence level.

[0117] In this embodiment, the classification results of each level are converted into independent confidence values, and the multi-level confidence values ​​are integrated by weighted average, geometric average or neural network fusion.

[0118] For example, based on the decision function distance mapping to probability values, the confidence level C is given by formula (5):

[0119] C=1 / (1+exp(-α×|f(x)|+β)) (5)

[0120] |f(x)|: The absolute value of the decision function, representing the distance from the feature vector to the decision boundary; α: The confidence mapping slope parameter, controlling the rate of change of confidence; β: The confidence mapping offset parameter, adjusting the baseline confidence value. The larger |f(x)| is, the higher the classification confidence. The confidence level at each level is obtained, thus yielding the target confidence level corresponding to the classification results across multiple levels.

[0121] For example, the target confidence level grading strategy is as follows: high confidence (≥0.8): automatically accepted and directly stored in the database; medium confidence (0.6-0.8): marked for review and pushed for manual confirmation; low confidence (<0.6): automatically rejected and triggered retraining. The retraining process can refer to the aforementioned embodiments.

[0122] For example, the initial model training can also be as follows: At the brand level, train an SVM classifier to distinguish all brands within that brand level; at the type level, for each brand in the brand level, find a subset of all training samples input to that brand, and train an SVM classifier on this subset to distinguish the model numbers of that brand node in the model level. Similarly, the device type level can be obtained.

[0123] It should be noted that the training process of the initial classification model in this embodiment is only an example and is not specifically limited.

[0124] To more clearly illustrate the technical solutions of the embodiments of this application, the technical solutions of the embodiments of this application will be described below using specific examples. Specifically:

[0125] The target device's configuration file includes: hostname ASA-FW01 domain-name company.com interface GigabitEthernet0 / 0 nameif outside, security-level 0 ip address 192.168.1.1 255.255.255.0 access-list OUTSIDE_IN extended permit tcpany host 192.168.1.100eq 80.

[0126] Feature extraction: Structural features: number of paragraphs = 4, indentation level = 2, vendor identifier: Cisco ASA-specific keywords such as "nameif" and "security-level" were detected, logical features: interface configuration and access control list have a high degree of correlation.

[0127] Eigenvector: F = [4, 2, 0.1, ..., 1, 1, 0, ..., 0.85, 0.92].

[0128] SVM classification results: Brand recognition: P(Cisco) = 0.96, Model recognition: P(ASA5525) = 0.89, Device type: P(firewall) = 0.94.

[0129] The preprocessing stage yields the following results: 6 valid configuration lines, 0 comment lines, 4 configuration paragraphs (host configuration, interface configuration, security configuration, access control), 2 indentation levels, and an average line length of 45 characters.

[0130] The feature extraction stage yields the following:

[0131] Structural feature vector: [4,0,2,6,45]

[0132] Manufacturer identification features: [1,1,0,1,0,1,1,1], meaning 6 out of 8 manufacturer features were detected.

[0133] Configuration logic characteristics: [0.85,0.92,0.88,0.90,0.87,0.94,0.89,0.91,0.86,0.88,0.83,0.90]

[0134] Semantic features: [0.78, 0.85, 0.90, 0.82, 0.75, 0.88].

[0135] The standardization stage yields: Original vector: F = [4,0,2,6,45,1,1,0,1,0,1,1,1,0.85,...], Standardized vector: F_norm = [(4-3.2) / 1.5,(0-0.15) / 0.8,...] = [0.53,-0.19,...].

[0136] SVM classification yields the following results: Decision function value: f(x) = 2.3, Decision distance: distance = |2.3| / ||w|| = 2.3 / 1.0 = 2.3, Confidence: confidence = 1 / (1+exp(-1.2×2.3)) = 1 / (1+0.054) = 0.949 ≈ 0.95, and the final identification result of the target device is: Cisco ASA5525 firewall (confidence 0.95).

[0137] In another embodiment of this application, an alternative solution is proposed based on the foregoing embodiments. Technical terms that are the same as or similar to those in the foregoing embodiments will not be repeated. For example... Figure 3 As shown, the configuration file identification method in this application embodiment includes:

[0138] Step S301: Obtain the configuration file of the target device.

[0139] Step S302: Perform preprocessing operations on the configuration file to obtain the target configuration file.

[0140] Step S303: Extract features from the target configuration file to obtain an N-dimensional feature vector.

[0141] Step S304: Standardize the N-dimensional feature vector by using the feature mean and feature standard deviation corresponding to each feature component in the N-dimensional feature vector to obtain a standardized N-dimensional feature vector.

[0142] Step S305: Using the target classification model, based on a multi-level classification mechanism, the standardized N-dimensional feature vector is classified to obtain multiple classification results.

[0143] Step S306: Obtain the target confidence score based on multiple classification results.

[0144] Step S307: Based on the target confidence level and the device information corresponding to multiple classification results, obtain the target device information.

[0145] The system obtains the target device's configuration file, preprocesses it to obtain the target configuration file, and then performs feature standardization to obtain a standardized N-dimensional feature vector. Using a target classification model with a multi-level classification mechanism, the standardized N-dimensional feature vector is classified to obtain multiple classification results. The target confidence score is obtained based on the classification results. Finally, based on the target confidence score and the device information corresponding to the multiple classification results, the target device information is obtained, thus improving the accuracy of target device information acquisition.

[0146] In another embodiment of this application, a configuration file identification system is provided, which can implement the configuration file identification method of any of the above embodiments. The same or similar technical terms as in the foregoing embodiments will not be repeated. This device is implemented through software and / or hardware and is specifically configured in an electronic device. This electronic device may be a server device or a computer device, etc. Figure 4 As shown, the configuration file recognition system 200 includes:

[0147] The configuration file acquisition module 210 is used to acquire the configuration file of the target device; the feature extraction module 220 is used to extract features from the configuration file to obtain an N-dimensional feature vector, wherein the dimensions of the N-dimensional feature vector include at least one of the structural dimension, manufacturer identification dimension, configuration logic dimension, and semantic dimension of the configuration file; the classification result acquisition module 230 is used to classify the N-dimensional feature vector through a target classification model based on a multi-level classification mechanism to obtain multiple classification results, wherein the multiple classification results correspond to one level in the multi-level classification, and the multi-level classification is used for brand classification, model classification, and device type classification; the target confidence acquisition module 240 is used to obtain the target confidence based on the multiple classification results; the target device information acquisition module 250 is used to obtain the target device information of the target device based on the target confidence and the device information corresponding to the multiple classification results; wherein, the target classification model is trained by the sample feature vector of the sample configuration file and the sample labels with hierarchical relationship corresponding to the sample feature vector.

[0148] This application combines multi-dimensional feature fusion with a hierarchical classification model for configuration file recognition, enabling the input of the original configuration file to obtain complete device information and improving the accuracy of configuration file recognition.

[0149] Through the above description of the embodiments, those skilled in the art can clearly understand that, for the sake of convenience and brevity, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0150] The systems and methods disclosed in the embodiments provided in this application can be implemented in other ways. For example, the system embodiments described above are merely illustrative. For instance, the division of modules is only a logical functional division, and there may be other division methods in actual implementation. For example, multiple modules may be combined or integrated into another device, or some features may be ignored or not executed.

[0151] Furthermore, the functional modules in the various embodiments of this application can be integrated into one processing module, or each module can exist physically separately, or two or more modules can be integrated into one module. The integrated modules described above can be implemented in hardware or as software functional modules.

[0152] If an integrated module is implemented as a software functional module and sold or used as an independent product, it can be stored in a readable storage medium. Based on this understanding, the technical solutions of the embodiments of this application, essentially, or the parts that contribute to the prior art, or all or part of the technical solutions, can be embodied in the form of a software product. This software product is stored in a storage medium and includes several instructions to cause a device (which may be a microcontroller, chip, etc.) or processor to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0153] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for identifying configuration files, characterized in that, include: Obtain the configuration file of the target device; Feature extraction is performed on the configuration file to obtain an N-dimensional feature vector. The dimensions of the N-dimensional feature vector include at least one of the following: structural dimension, vendor identification dimension, configuration logic dimension, and semantic dimension of the configuration file. The target classification model, based on a multi-level classification mechanism, classifies the N-dimensional feature vector to obtain multiple classification results. Each of the multiple classification results corresponds to a level in the multi-level classification, which is used for brand classification, model classification, and equipment type classification, respectively. Based on the multiple classification results, the target confidence level is obtained; Based on the target confidence level and the device information corresponding to the multiple classification results, the target device information is obtained; The target classification model is trained using the sample feature vectors in the sample configuration file and the hierarchical labels of the samples corresponding to the sample feature vectors.

2. The configuration file identification method according to claim 1, characterized in that, The step of obtaining the target device information based on the target confidence score and the device information corresponding to the multiple classification results includes: If the target confidence level is greater than or equal to the first preset threshold, the device information corresponding to the multiple classification results is used as the target device information.

3. The configuration file identification method according to claim 1, characterized in that, After obtaining the target confidence score based on the multiple classification results, the method further includes: If the target confidence level is less than a first preset threshold and greater than or equal to a second preset threshold, and if the multiple classification results meet preset conditions, the device information corresponding to the multiple classification results is used as the target device information of the target device, wherein the first preset threshold is greater than the second preset threshold.

4. The configuration file identification method according to claim 3, characterized in that, After obtaining the target confidence score based on the multiple classification results, the method further includes: If the target confidence level is less than the second preset threshold, the weights of the features in the preset dimension of the N-dimensional feature vector are updated according to the historical calibration parameters corresponding to the preset dimension to obtain a new N-dimensional feature vector; wherein, the new N-dimensional feature vector has been labeled with labels at each level, and the historical calibration parameters are determined based on the sample feature vector; The target classification model is trained based on the new N-dimensional feature vector and the labels at each level corresponding to the new N-dimensional feature vector to obtain a new classification model suitable for identifying the configuration file of the target device.

5. The configuration file identification method according to claim 1, characterized in that, The step of extracting features from the configuration file to obtain an N-dimensional feature vector includes: Feature extraction is performed on the configuration file to obtain structural features, vendor identification features, configuration logic features, and semantic features; The N-dimensional feature vector is obtained based on the structural features, the manufacturer identification features, the configuration logic features, and the semantic features.

6. The configuration file identification method according to claim 1, characterized in that, Before classifying the N-dimensional feature vector using a target classification model based on a multi-level classification mechanism to obtain multiple classification results, the method further includes: The initial classification model is trained to obtain the target classification model, including: Obtain the sample feature vector of the sample configuration file and the sample labels with hierarchical relationship corresponding to the sample feature vector; The sample feature vector is processed by the initial classification model to be trained to obtain the classification result of each sample feature vector; Based on the difference between the classification results of each sample and the corresponding sample label in the sample feature vector, the model parameters of the initial classification model are adjusted and training continues until the training conditions are met, at which point training stops, and the trained target classification model is obtained.

7. The configuration file identification method according to claim 1, characterized in that, Before classifying the N-dimensional feature vector using a target classification model based on a multi-level classification mechanism to obtain multiple classification results, the method further includes: The N-dimensional feature vector is standardized by using the feature mean and feature standard deviation corresponding to each feature component in the N-dimensional feature vector to obtain a standardized N-dimensional feature vector, wherein the feature mean and feature standard deviation are determined based on the sample feature vector; The target classification model, based on a multi-level classification mechanism, classifies the N-dimensional feature vector to obtain multiple classification results, including: Using a target classification model and a multi-level classification mechanism, the standardized N-dimensional feature vector is classified to obtain multiple classification results.

8. The configuration file identification method according to claim 1, characterized in that, Before performing feature extraction on the configuration file to obtain an N-dimensional feature vector, the method further includes: The configuration file is preprocessed to obtain a target configuration file, wherein the preprocessing operation includes converting unstructured or heterogeneous configuration files into standardized and normalized target configuration files. The step of extracting features from the configuration file to obtain an N-dimensional feature vector includes: Feature extraction is performed on the target configuration file to obtain an N-dimensional feature vector.

9. The method for identifying configuration files according to any one of claims 1-8, characterized in that, The step of obtaining the target confidence score based on the multiple classification results includes: The multiple classification results are mapped to their corresponding confidence levels, and the multiple confidence levels are fused to obtain the target confidence level.

10. A configuration file recognition system, characterized in that, The identification system includes: The configuration file retrieval module is used to retrieve the configuration file of the target device; The feature extraction module is used to extract features from the configuration file to obtain an N-dimensional feature vector. The dimensions of the N-dimensional feature vector include at least one of the structural dimension, vendor identification dimension, configuration logic dimension, and semantic dimension of the configuration file. The classification result acquisition module is used to classify the N-dimensional feature vector through the target classification model based on a multi-level classification mechanism to obtain multiple classification results. The multiple classification results correspond to one level of the multi-level classification, and the multi-level classification is used for brand classification, model classification and equipment type classification, respectively. The target confidence acquisition module is used to obtain the target confidence based on the multiple classification results; The target device information acquisition module is used to obtain the target device information of the target device based on the target confidence level and the device information corresponding to the multiple classification results; The target classification model is trained using the sample feature vectors in the sample configuration file and the hierarchical labels of the samples corresponding to the sample feature vectors.

Images