Device type detection method

Abstract

The application relates to the technical field of artificial intelligence, and provides a device type detection method, which can collect device features in a target network based on an eBPF / XDP kernel side shorthand and a triggered sampling mechanism, the obtained aggregated features do not involve plaintext, and the security is improved; a constructed knowledge graph can effectively eliminate duplication, and the detection efficiency is improved; entity analysis is performed on a device identity graph through a phased blocking and matching strategy, stage-by-stage feature matching is realized, and the detection efficiency is further improved; a feature score of each device entity is generated based on an AI model and a Bayesian calibrator, and the accuracy of score calculation is improved; the device type of each device entity is determined based on an ambiguity decision mechanism, ambiguity is avoided from being directly output, and the accuracy of device type detection is effectively improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of artificial intelligence, and particularly relates to a device type detection method. BACKGROUND

[0002] With the rapid development of information infrastructure and Internet of Things, the number of various terminal devices deployed in networks such as Local Area Network (LAN), campus network and industrial control network is also continuously increasing. These devices cover traditional PC (Personal Computer), servers, switches, routers, intelligent cameras, printers, mobile terminals and various special sensors. Different devices have great differences in hardware manufacturers, operating systems, network protocol stack implementation, open port services and naming habits, so that network management and security operation and maintenance urgently need high-precision device type detection technology.

[0003] In the prior art, the following methods are mainly used for device detection:

[0004] 1. Fingerprint identification based on active detection: a special message is sent to the target device through a specified tool, and TTL (Time To Live), window size, TCP (Transmission Control Protocol) options, Banner identification information and other details in the response are observed. Due to the differences in the implementation of different manufacturers and operating systems, the device type can be distinguished to a certain extent through the fingerprint library. However, this method is easily blocked by the firewall, and many network devices will discard or modify the probe message by default, resulting in distorted recognition results, and active scanning will bring additional traffic and potential risks to the production network, which is particularly sensitive in industrial control networks. In addition, the fingerprint library needs to continuously invest a lot of resources and be constantly updated, otherwise the accuracy will decrease significantly when facing new models of devices;

[0005] 2. Protocol or service feature-based identification: such as judging device type by detecting HTTP Server Header (HyperText Transfer Protocol Server Header) of 80 / 443 port, RTSP Banner (Real Time Streaming Protocol Banner) of 554 port, SNMP sysObjectID (Simple Network Management Protocol System Object Identifier) of 161 port, etc. Service fingerprints can intuitively reflect device manufacturers or functions. However, this method depends on the service state, and if the target device is closed or hides the service, the identification fails. At the same time, different devices of the same manufacturer may use the same protocol stack, resulting in insufficient discrimination. This method also has poor anti-confusion ability, and manufacturers can bypass identification by modifying fields;

[0006] 3. Traditional method based on static rule table: such as directly mapping manufacturers according to MAC (Media Access Control Address) address prefixes (such as Organizationally Unique Identifier (OUI)), and then combining limited string matching to judge the type. This method is simple and intuitive, and can quickly give results in some environments. However, this method is prone to rule conflicts, and lacks a unified processing mechanism when multiple rules are hit, which can easily produce conflicting conclusions. Moreover, the static rule table has poor scalability, and when new devices appear, rules need to be manually supplemented one by one, which is inefficient. Static matching also lacks ambiguity handling, and when there is insufficient evidence, it will still force output results, leading to result misjudgment. SUMMARY

[0007] In view of the above, it is necessary to provide a device type detection method to solve the problem of low accuracy of device type detection.

[0008] A device type detection method, the device type detection method comprising:

[0009] In response to a device type detection instruction triggered based on a target network, an eBPF / XDP-based kernel-side shorthand and triggered sampling mechanism collects device features in the target network to obtain initial features;

[0010] Construct a device identity map according to the initial features;

[0011] The device identity graph is entity resolved through a staged blocking and matching strategy to obtain a plurality of device entities;

[0012] An initial score of each device entity is calculated using a rule table generated based on an AI model, and the initial score of each device entity is post-calibrated based on a Bayesian calibrator of topological constraints to obtain a feature score of each device entity.

[0013] Based on an ambiguity decision mechanism, the device type of each device entity is determined according to the feature score of each device entity.

[0014] A device type detection apparatus, comprising:

[0015] A collection unit configured to, in response to a device type detection instruction triggered based on a target network, perform device feature collection in the target network based on an eBPF / XDP kernel-side shorthand and a triggered sampling mechanism to obtain initial features.

[0016] A construction unit configured to construct a device identity graph according to the initial features.

[0017] An analysis unit configured to perform entity resolution on the device identity graph through a staged blocking and matching strategy to obtain a plurality of device entities.

[0018] A calibration unit configured to calculate an initial score of each device entity using a rule table generated based on an AI model, and post-calibrate the initial score of each device entity based on a Bayesian calibrator of topological constraints to obtain a feature score of each device entity.

[0019] A determination unit configured to determine the device type of each device entity according to the feature score of each device entity based on an ambiguity decision mechanism.

[0020] A computer device, comprising:

[0021] A memory storing at least one instruction; and a processor executing the instruction stored in the memory to implement the device type detection method.

[0022] A computer-readable storage medium having at least one instruction stored therein, the at least one instruction being executed by a processor in a computer device to implement the device type detection method.

[0023] From the above technical scheme can be seen, the present application can be based on eBPF / XDP's kernel side shorthand and triggered sampling mechanism in the target network for device feature collection, the aggregated features obtained do not involve plaintext, and the security is improved; the constructed knowledge graph can effectively deduplicate, and the detection efficiency is improved; the device identity graph is parsed by the phased blocking and matching strategy, the phased feature matching is realized, and the detection efficiency is further improved; the feature score of each device entity is generated based on the AI model and the Bayesian calibrator, and the accuracy of the score calculation is improved; the device type of each device entity is determined based on the ambiguity decision mechanism, and the ambiguity is avoided to be directly output, and the accuracy of the device type detection is effectively improved. BRIEF DESCRIPTION OF DRAWINGS

[0024] Figure 1 is a flow chart of a preferred embodiment of the device type detection method of the present application;

[0025] Figure 2 is a functional module diagram of a preferred embodiment of the device type detection apparatus of the present application;

[0026] Figure 3 is a structural schematic diagram of a computer device for implementing a preferred embodiment of the device type detection method of the present application. DETAILED DESCRIPTION

[0027] In order to make the purpose, technical scheme and advantages of the present application clearer, the present application will be described in detail below with reference to the drawings and specific embodiments.

[0028] As shown in Figure 1 is a flow chart of a preferred embodiment of the device type detection method of the present application. According to different needs, the order of steps in the flow chart can be changed, and some steps can be omitted.

[0029] The device type detection method is applied to one or more computer devices, and the computer device is a device capable of automatically performing numerical calculation and / or information processing according to pre-set or stored instructions, the hardware of which includes but is not limited to microprocessors, application specific integrated circuits (ASICs), field programmable gate arrays (FPGAs), digital signal processors (DSPs), embedded devices, etc.

[0030] The computer device can be any electronic product that can interact with a user, such as a personal computer, a tablet computer, a smartphone, a personal digital assistant (PDA), a game console, an interactive Internet Protocol Television (IPTV), a smart wearable device, and the like.

[0031] The computer device can also include a network device and / or a user device. The network device includes, but is not limited to, a single network server, a server group composed of multiple network servers, or a cloud composed of a large number of hosts or network servers based on cloud computing.

[0032] The server can be a standalone server, or a cloud server providing cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDNs), and big data and artificial intelligence platforms, and the like.

[0033] Artificial intelligence (AI) is the use of digital computers or computer-controlled machines to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use knowledge to obtain the best results.

[0034] Artificial intelligence basic technologies generally include technologies such as sensors, special artificial intelligence chips, cloud computing, distributed storage, big data processing technology, operation / interaction systems, mechatronics, and the like. Artificial intelligence software technology mainly includes computer vision technology, robot technology, biometric technology, speech processing technology, natural language processing technology, and machine learning / deep learning, and the like.

[0035] The network in which the computer device is located includes, but is not limited to, the Internet, a wide area network, a metropolitan area network, a local area network, a virtual private network (VPN), and the like.

[0036] S10, in response to a device type detection instruction triggered based on a target network, an eBPF (Extended Berkeley Packet Filter) / XDP (express Data Path) kernel-side shorthand and trigger sampling mechanism based on the target network is used to collect device features, and initial features are obtained.

[0037] In the embodiment, the target network can include a local area network, a campus network, an industrial control network, and the like.

[0038] In the embodiment, the device type detection instruction can be triggered by relevant staff according to actual needs.

[0039] For example, when asset inventory, access control, intrusion detection and tracing, intelligent operation and maintenance, and the like are needed.

[0040] Among them, for asset inventory, accurate identification of device type is the premise of network asset management and compliance check; for access control, accurate differentiation of different device types can implement differentiated security policies (such as prohibiting cameras from accessing sensitive servers); for intrusion detection and tracing, analysis of abnormal traffic must rely on correct classification of source devices; for intelligent operation and maintenance, in a large-scale network environment, automatic identification results directly affect QoS (Quality of Service, service quality) management and fault location.

[0041] In the embodiment, the eBPF / XDP-based kernel-side shorthand and triggered sampling mechanism collects device features in the target network to obtain initial features, including:

[0042] Extracting multi-dimensional feature information of devices in the target network to obtain multi-dimensional device features;

[0043] Calling a lightweight kernel program loaded on an access side or a bypass collection node, aggregating the multi-dimensional device features based on a configured kernel mapping structure (BPF Map) to obtain an aggregation result;

[0044] Reading the aggregation result according to a preset period through a performance ring buffer (perf ring buffer) or a BPF (Berkeley Packet Filter, Berkeley Packet Filter) mapping type-ring buffer (BPF_MAP_TYPE_RINGBUF) in a user mode, and performing time window standardization and abnormal truncation processing on the aggregation result to obtain the initial features;

[0045] Among them, the kernel mapping structure includes a Least Recently Used Map (LRU Map) for high-frequency key value statistics, a Count-Min Sketch for heavy data flow detection, and a stack count structure for short window periodicity.

[0046] Among them, the multi-dimensional device features can include, but are not limited to, one or a combination of the following features: network address, hardware identifier, name information, service feature, and topology attribute, and the like.

[0047] The collection of multi-dimensional features can ensure the integrity and diversity of the input data, and provide a foundation support for subsequent processing.

[0048] The lightweight kernel program can be an eBPF program mounted in an XDP or TC Ingress (Traffic Control Ingress) path.

[0049] The kernel mapping structure is a core data structure in the Linux kernel for managing the mapping relationship between virtual memory and physical memory or files, mainly implemented through vm_area_struct (virtual memory area descriptor) and page table. The role of the kernel mapping structure includes efficient management of memory access, support for file mapping, and inter-process communication.

[0050] The key of the LRU Map can be defined as VLAN (Virtual Local Area Network), switch port, or interface index.

[0051] The dimension of the Count-Min Sketch can be configured as 4x2^16 indexes, and the conflict is handled with the minimum count strategy.

[0052] On the kernel side, only the port histogram within the sliding time window, the first packet arrival interval statistics, the lightweight flow period indicators, and the Top-N port coarse sorting can be maintained.

[0053] The preset period can be configured as 100-250 ms.

[0054] By performing time window standardization, the time dimension of the unified features can be aligned.

[0055] By performing abnormal truncation processing (such as truncating extreme values deviating from the normal range according to certain rule algorithms), the data quality can be effectively improved.

[0056] In the above embodiments, through the eBPF / XDP-based kernel-side shorthand and triggered sampling mechanism, only the minimum statistics required for detection can be recorded online without deep analysis and complete packet storage, thereby significantly reducing the CPU (Central Processing Unit), memory, and I / O (Input / Output) overhead. Moreover, the collected features do not involve plaintext payloads, and only aggregated features are output, which not only meets the low-invasion and privacy constraints, but also provides high-quality input for subsequent rule generation.

[0057] In the embodiment, the initial features include a dynamic host configuration protocol (DHCP) behavior timing and lease policy fingerprint; and the eBPF / XDP-based kernel-side shorthand and triggered sampling mechanism for collecting device features in the target network further includes:

[0058] Collecting dynamic host configuration protocol messages at a forwarding node or a mirror port;

[0059] Obtaining a dynamic host configuration protocol relay log or a server log, and performing time alignment on the dynamic host configuration protocol messages by using the dynamic host configuration protocol relay log or the server log to obtain to-be-processed data;

[0060] Based on a message sequence dimension, round-trip time, timeout retransmission rhythm features and abnormal path features of a specified path are obtained from the to-be-processed data to obtain first features;

[0061] Based on an option sequence dimension, encoding of dynamic host configuration protocol key option features is extracted from the to-be-processed data to obtain second features; wherein anonymization features in a pre-set identifier anonymous profile scenario (RFC7844 scenario) of a dynamic host configuration protocol client are marked;

[0062] Based on a lease parameter dimension, renewal time / binding time (T1 / T2) and lease duration policy are parsed and standardized in the to-be-processed data, and a fingerprint strength factor is generated according to the stability of the parsed and standardized renewal time / binding time and lease duration policy to serve as third features;

[0063] The first features, the second features and the third features are sequentially spliced to obtain initial fingerprint features;

[0064] The initial fingerprint features are mapped into timing and structured features to obtain the dynamic host configuration protocol behavior timing and lease policy fingerprint.

[0065] The specified path can include Discover (discovery) → Offer (proposal) → Request (request) → Ack (confirmation).

[0066] The timeout retransmission rhythm features can include exponential backoff, fixed interval, etc.

[0067] The abnormal path features can include appearance probability of Inform (notification) and Decline (decline), etc.

[0068] The dynamic host configuration protocol key option features can include an ordered sequence of Option 55 (Parameter Request List), Option 60 (Vendor-Class Identifier), Option 12 (Host Name), Option 61 (Client-ID) and the like.

[0069] The anonymization features in the anonymous profile scenario of the dynamic host configuration protocol client are marked with a preset identifier, so that misuse can be avoided.

[0070] The first feature, the second feature and the third feature are mapped to a set of robust time sequence and structured features after cleaning and normalization, such as Option 55 arrangement hash, T1 / T2 ratio interval coding (such as T1 / Lease≈0.5, T2 / Lease≈0.875 binning), retransmission period quantile vector, first renewal distance and jitter coefficient, to serve as the dynamic host configuration protocol behavior time sequence and lease policy fingerprint.

[0071] The dynamic host configuration protocol behavior time sequence and lease policy fingerprint can be input into an AI model together with port, topology and encryption handshake features, and can be used to automatically generate new composite rules and weights.

[0072] Through the above embodiments, the dynamic host configuration protocol behavior time sequence and lease policy fingerprint can be constructed as a new feature source to assist in further improving the ability to characterize terminal network features.

[0073] In this embodiment, when ambiguity processing is performed subsequently, a very low-intrusion DHCP query association can be selectively triggered according to the expected information gain principle (for example, only the lease change log is read on the server side without additional detection of the terminal), to further improve the time sequence evidence.

[0074] In this embodiment, considering that the lease policy may drift overall when the network is maintained, the DHCP fingerprint can also be introduced with "site-time window" version control, and when the rule table is updated subsequently, the consistency check is performed by the prior calibrator, when the site-level policy adjustment (such as shortening the lease period of the whole network) is detected, the scoring channel of the related features is automatically de-weighted until the new distribution converges.

[0075] S11, constructing a device identity map according to the initial features.

[0076] In this embodiment, the device identity map is used for cross-time and cross-source entity merging and deduplication.

[0077] Specifically, the device identity graph is a probabilistic graphical model constructed using device observation segments in the initial features as nodes and behavioral edge features in the initial features as edges.

[0078] The behavioral edge features may include, but are not limited to: co-occurrence features with the same switching port, DHCP Client-ID / Hostname compatibility mapping features, adjacent device relationships and uplink port invariance features, and Ethernet (PoE) power supply port consistency features.

[0079] By constructing the device identity graph, the problems of duplicate records and fragmented device identities caused by real-world factors such as address changes, MAC (Media Access Control Address) randomization, and multiple network ports / addresses can be solved. The device identity graph not only reduces duplicate records and improves the signal-to-noise ratio in the rule matching stage, but also provides clearer object boundaries for AI to perform weakly supervised induction on multi-source heterogeneous data.

[0080] In this embodiment, before constructing the device identity map, the initial features can be unified, standardized, and redundancy eliminated to transform the raw device data into structured, standardized, and AI-usable information, thereby ensuring the accuracy and stability of subsequent identification. Different types of input features can also undergo format unification, error removal, and legality verification to remove redundant and abnormal data, and map various forms of identifiers, addresses, and service information to a consistent representation, thereby reducing ambiguity caused by differences. This embodiment can also unify and ensure compatibility of data involving time, character sets, or different source formats, thereby eliminating inconsistencies caused by different environments. If the collected results contain obvious errors or defects, they will be marked or removed before proceeding to subsequent rule matching. Through the above processing, the information of each device can be organized into standardized input objects, ensuring the uniformity, reliability, and comparability of the input data, thus providing a solid data foundation for the overall identification process.

[0081] S12, the device identity graph is parsed using a phased blocking and matching strategy to obtain multiple device entities.

[0082] In this embodiment, the step of performing entity parsing on the device identity graph using a phased blocking and matching strategy to obtain multiple device entities includes:

[0083] In the first stage, blocking keys are constructed using normalized hostname prefixes, switch interface indexes, and subnet segment summaries as blocking dimensions; nodes with the same blocking key value in the device identity graph are grouped together to obtain each blocking bucket;

[0084] In the second stage, a dual matching is performed on each two nodes in each blocking bucket to obtain a hostname normalized edit distance similarity, a dynamic host configuration protocol client identifier matching degree, a port timing coincidence degree, an Ethernet power port stability, and a switch adjacency Figure 1 corresponding to each two nodes; obtain a weight coefficient of each sub-likelihood score; calculate a weighted sum according to each sub-likelihood score and the weight coefficient of each sub-likelihood score to obtain a total likelihood score corresponding to each two nodes; calibrate the total likelihood score corresponding to each two nodes through a supervised learning model to obtain a merging probability corresponding to each two nodes; obtain a double probability threshold; compare the merging probability corresponding to each two nodes with the double probability threshold to obtain each comparison result; in each blocking bucket, perform node merging according to each comparison result to obtain the plurality of device entities.

[0085] In the first stage, a blocking key is used to reduce the comparison scale; in the second stage, a dual matching is performed in a blocking bucket to further reduce data redundancy.

[0086] The supervised learning model can include a logistic regression or a gradient boosting tree, etc.

[0087] In the embodiment, the node merging according to each comparison result in each blocking bucket to obtain the plurality of device entities includes:

[0088] Each two nodes in each blocking bucket are determined as a dual;

[0089] The first threshold and the second threshold in the double probability threshold are obtained; the first threshold is greater than the second threshold;

[0090] For each dual, when the merging probability corresponding to the dual is greater than or equal to the first threshold, the two nodes in the dual are merged; or when the merging probability corresponding to the dual is less than or equal to the second threshold, the two nodes in the dual are not merged; or when the merging probability corresponding to the dual is greater than the second threshold and less than the first threshold, the dual is added to an upper-layer strategy review queue to determine whether to merge, and the features of the two nodes in the dual are fed back to the AI model for parameter optimization.

[0091] The merging processing results of each dual are integrated to obtain the plurality of device entities.

[0092] In the merging process of each pair of nodes, each pair of nodes corresponding to the merging process is aggregated into one device entity. For example, when node A and node B are merged into device entity X, if node A and node C can also be merged, node C is also merged into device entity X.

[0093] The first threshold and the second threshold can be optimal values selected according to a large number of experiments. For example, the first threshold can be 0.9, and the second threshold can be 0.6.

[0094] The optimized parameters can include various weight coefficients.

[0095] In this embodiment, after obtaining the plurality of device entities, the method further includes:

[0096] For each device entity, it is detected whether there is a persistent dynamic host configuration protocol client identifier of the device entity in the initial features.

[0097] When the persistent dynamic host configuration protocol client identifier of the device entity exists in the initial features, the persistent dynamic host configuration protocol client identifier of the device entity is determined as the normalized device identifier of the device entity; or

[0098] When the persistent dynamic host configuration protocol client identifier of the device entity does not exist in the initial features, a connected component of the device entity is divided in the device identity graph by using a minimum cut algorithm of a graph, and a normalized device identifier of the device entity is generated according to the connected component of the device entity.

[0099] The stable identifier such as a serial number and PoE port binding information can also be used as the normalized device identifier of the device entity.

[0100] The embodiment can effectively ensure data quality and avoid repeated records caused by various collection methods, and can also eliminate invalid or noise information to ensure that the input data is real and effective.

[0101] In this embodiment, to avoid the side effects caused by incorrect merging, a rollbackable merging log and version number can also be maintained, and any subsequent strong conflict based on evidence will trigger “split rollback” and rule reevaluation, to ensure the robustness of entity analysis in long-term operation.

[0102] S13, calculate the initial score of each device entity by using the rule table generated based on the AI model, and perform posterior calibration on the initial score of each device entity based on a topology-aware Bayesian calibrator to obtain the feature score of each device entity.

[0103] In the embodiment, the rule table is a core data set for device detection. Each rule in the table contains data such as a matching field (MATCH_FIELD), a matching pattern (PATTERN), a matching mode (PATTERN_TYPE), a weight coefficient (SCORE), and a device category and final type (CATEGORY, FINAL_TYPE), and assists in calculating the initial score of each device entity by performing weighted calculation.

[0104] In the embodiment, before calculating the initial score of each device entity by using the rule table generated based on the AI model, the method further includes:

[0105] constructing sample data;

[0106] mining potential relationships between device features and device types in the sample data based on the AI model, and generating a first sub-rule according to the potential relationships; continuously optimizing the weight coefficients of each rule item in the first sub-rule according to the feature distribution of the target network, thereby continuously optimizing the performance of the rule table; and / or

[0107] mining host name rules in the sample data based on the AI model (for example, the host name presents a specific repetition pattern, and the AI model can automatically summarize the corresponding rules and classify them into corresponding device categories), and generating a second sub-rule according to the host name rules; and / or

[0108] mining port distribution rules in the sample data based on the AI model (for example, the port distribution shows obvious combination characteristics), and generating a third sub-rule according to the port distribution rules; and / or

[0109] mining subnet and address segment features in the sample data based on the AI model, and identifying the long-term existing device type distribution in the target network according to the subnet and address segment features, and generating a fourth sub-rule according to the device type distribution; and / or

[0110] mining protocol layer feature mapping relationships in the sample data based on the AI model (for example, extracting stable patterns from encrypted handshake, service broadcast or network identification information, and establishing mapping relationships according to the patterns), and generating a fifth sub-rule according to the protocol layer feature mapping relationships;

[0111] generate a composite rule based on the first sub-rule, and / or the second sub-rule, and / or the third sub-rule, and / or the fourth sub-rule, and / or the fifth sub-rule;

[0112] add the composite rule, and / or the first sub-rule, and / or the second sub-rule, and / or the third sub-rule, and / or the fourth sub-rule, and / or the fifth sub-rule to a table to obtain the rule table;

[0113] wherein, in the rule table, a unique identifier is generated for each rule as a normalized key of each rule for maintaining the integrity of the rule table. For example, the normalized key can be a five-tuple composed of MATCH_FIELD (matching field), PATTERN (pattern), PATTERN_TYPE (pattern type), CATEGORY (category), and FINAL_TYPE (final type) for uniquely identifying a rule. Through the key, rule deduplication can be achieved to avoid repeated scoring.

[0114] wherein, when a new rule is generated, the AI model is used to compare and optimize the new rule with the rules in the rule table to generate decision data, so that the rule table can evolve while maintaining consistency; the decision data includes whether to replace similar rules in the rule table with the new rule, and an adjustment method of the new rule. Through this mechanism, the rule table is no longer a static set, but a sustainable evolving knowledge system maintained and driven by human experience and intelligent algorithms. When new sample information is collected and confirmed by human or AI analysis, new rules can be automatically generated and added to the rule table. By automatically checking conflicts during rule updating, the accumulation of redundant or contradictory items can be effectively avoided, so that the system has the ability to evolve in long-term use.

[0115] wherein, when any rule in the rule table is in an invalid state for a preset time period, the AI model is called to generate adjustment suggestions or elimination suggestions for the rule, so as to maintain the accuracy of identification while maintaining the simplicity and efficiency of the rule table, so that the device type detection scheme still has good performance and intelligent level in long-term operation without the need to retrain a large model or modify program logic.

[0116] wherein, the AI model is called to adjust the weight coefficients of each rule item corresponding to each rule in the rule table in different networks to improve the environmental perception ability;

[0117] wherein, when the same device entity hits at least two conflicting rules in the rule table, the AI model is called for root cause analysis and generates an explanation and optimization suggestion.

[0118] Among them, the composite rule (such as combining address features, naming habits and service features to form more discriminant identification conditions) can improve the accuracy and adaptability of the overall identification.

[0119] Among them, the rule table can also support version management and encrypted storage, which can prevent external leakage and implement quick rollback when necessary, thereby enhancing the overall security and controllability.

[0120] In the embodiment, the Bayesian calibrator based on topology constraints performs posterior calibration on the initial score of each device entity to obtain the feature score of each device entity, which includes:

[0121] For the initial score of each device entity, a discount factor is configured according to the evidence strength negative correlation mechanism (such as monotonically decreasing mapping according to the score difference between the original highest score and the second highest score);

[0122] Obtain the topology prior feature mapping table, and query the feature of the port where the device entity is located in the topology prior feature mapping table to obtain the logarithmic prior gain;

[0123] Calculate the product of the discount factor and the logarithmic prior gain to obtain the correction amount of the posterior score by the prior knowledge;

[0124] Calculate the sum of the initial score and the correction amount to obtain the feature score of the device entity.

[0125] Among them, through the discount factor, the prior can be weakened when the evidence is sufficient, and the prior can be moderately amplified when the evidence is insufficient / ambiguous.

[0126] Among them, to prevent prior drift, the prior version can also be maintained according to the site and time window, and the prior update log and rollback point are recorded in the rule table management. When it is detected that the deviation between the prior and the observation distribution exceeds the threshold (such as the KL divergence exceeds the set upper limit), the prior can be automatically down-weighted until the review is completed.

[0127] Through the above embodiment, the prior knowledge such as network structure and port role can be explicitly included in the decision-making process, thereby improving the decision-making accuracy and ensuring the consistency and explainability of the identification conclusion and the network structure. Especially in typical scenarios such as telephone, camera and "port / power / VLAN semantic strong", the false judgment caused by isolated evidence can be significantly reduced.

[0128] S14, based on the ambiguity decision mechanism, determining the device type of each device entity according to the feature score of each device entity.

[0129] In the embodiment, the ambiguity decision mechanism based on the ambiguity decision mechanism includes:

[0130] For each device entity, the highest score and the second highest score are obtained from the feature scores of the device entity;

[0131] When the highest score is greater than or equal to a score threshold, and the difference between the highest score and the second highest score is greater than or equal to a preset score difference, the device type corresponding to the highest score is determined as the device type of the device entity; or

[0132] When the highest score is less than the score threshold, or the difference between the highest score and the second highest score is less than the preset score difference, an ambiguity event is generated, and the ambiguity event is sent to a designated terminal to request confirmation of the device type of the device entity.

[0133] The score threshold and the preset score difference can be optimal values configured through experiments.

[0134] Through the above embodiment, forced conclusions are avoided when the evidence is insufficient, thereby effectively avoiding overconfidence misjudgment and improving recognition reliability.

[0135] In the embodiment, after the device type of each device entity is determined according to the feature scores of each device entity, the method further includes:

[0136] For each device entity, a candidate device type set constructed according to the feature scores of the device entity is obtained, and the highest candidate type and the second highest candidate type of the device entity are obtained from the candidate device type set; feedback data of the device type of the device entity and a score difference threshold are obtained; when the feedback data shows that the score difference between the feature score of the highest candidate type and the feature score of the second highest candidate type is lower than the score difference threshold, and the size of the candidate device type set is greater than a preset value, the sampling frequency of the device entity or the corresponding port is increased by a preset multiple within a preset time range to continue device feature collection, and the sampling frequency of the device entity or the corresponding port is restored after a preset window. For example, when the score difference between the highest candidate type and the second highest candidate type is lower than the threshold τ (when the configuration file is default, τ = 8 minutes) and the size of the candidate device type set is greater than 2, the sampling frequency of the device entity or the port corresponding thereto is increased by 2-3 times within 60-120 seconds, and automatically falls back after a stable window (such as 5 minutes). The short-time increase of the sampling rate triggered by the feedback ambiguity state greatly optimizes the disturbance and resource consumption of the packet capture collection control on the production network.

[0137] When the frequency of the ambiguity event occurring on the device entity of any device type is greater than a preset frequency, the AI model is called for root cause analysis, and an optimization strategy is generated.

[0138] The device type detection scheme in this embodiment can be completed in two forms of hardware devices or software programs. In the hardware deployment scenario, the device recognition detector can be connected to the forwarding node device in the network through wired or wireless means to obtain the required device information and traffic characteristics. In the software deployment scenario, the recognition program can be run on the operation and maintenance terminal or server connected to the forwarding node device to achieve the same recognition function without adding additional hardware. For example: three main devices are mainly involved in the deployment structure of hardware and software. The first type is the detector or operation and maintenance terminal as the execution subject, which runs the recognition program and completes the core processing flow; the second type is the forwarding node device in the network, such as a router or a switch, which provides the necessary operating environment and data source; the third type is the rule table storage device, which can exist in various forms, and is used to safely store and call the rule table file.

[0139] Through the above overall technical solution, a lightweight, transparent and evolvable device recognition mechanism can be realized in an actual network environment. The mechanism relies on the acquisition and standardization processing of multi-dimensional characteristics, the weighted judgment based on rules, the reasonable output of ambiguity, and the dynamic expansion of the rule table, effectively solving the problems of invasiveness, dependency, uninterpretability and unsustainability in the prior art, thereby realizing a network device type detection scheme with high precision, interpretability and maintainability.

[0140] The embodiment can also reserve expansion space to introduce more functions according to the complexity of future network environments and the diversification of devices. For example, in the data acquisition link, intelligent analysis functions can be added to model the performance characteristics of devices in the communication process, so that effective recognition basis can still be obtained when there is a lack of explicit identification. In the data processing link, an AI-driven feature fusion function can be set up to uniformly model multiple data from different sources, automatically mine feature combinations with discrimination, and feed back to the rule table, thereby further improving the comprehensiveness and accuracy of recognition.

[0141] The embodiment can also introduce an AI-assisted risk assessment mechanism at the output level. The mechanism not only quantifies the confidence of the detection result, but also analyzes the reliability of the recognition path through the model, automatically marks high-risk and low-risk devices, and predicts potential misjudgment types, thereby providing auxiliary support for security policies. At the same time, log tracing and auditing can also be assisted by AI to discover abnormal distribution or imbalance in the rule table through automated log analysis and pattern mining, and propose optimization schemes. The embodiment can also use federated learning or collaborative mechanisms to make multiple processing nodes exchange optimization results without directly sharing raw data, aggregate distribution information from different environments by AI, form more general rule tables, and realize cross-network knowledge transfer and rapid adaptation.

[0142] The embodiment can also reserve an interface with the visualization system and combine an AI-driven visualization analysis module to present the recognition result, confidence distribution and device relationship in an intuitive manner, helping the operation and maintenance personnel to understand the recognition basis. For different application environments, an AI-supported policy linkage mechanism can be provided to enable the recognition result to directly trigger access control, isolation or alarm measures, and the AI can automatically select the appropriate policy according to the risk level to realize a management closed loop. Through these extension designs, not only the current recognition problem can be solved, but also the role of AI in pattern discovery, rule optimization and environment adaptation can be fully played, leaving extension space for future more complex scenarios and needs, and guaranteeing the continuous evolution and popularization of the technology.

[0143] The embodiment adopts a rule weighting and multi-feature fusion mechanism, no longer relies on a single protocol fingerprint or MAC prefix, and can significantly improve the accuracy and robustness of recognition in a complex network environment to achieve a more stable and reliable classification result; an ambiguity processing and threshold judgment mechanism is introduced, which will not output an overconfident result when the evidence is insufficient or the candidate score is close, effectively reducing the risk of misjudgment and prompting the system to make further verification; a topological constraint Bayesian calibrator is introduced to fuse the priori such as VLAN, port role and PoE with the AI score posteriori, which can perform robust calibration when the evidence is insufficient and improve the explainability and stability; the AI model automatically generates and optimizes rules, which can continuously expand the rule table according to newly collected data, thus avoiding the inefficiency and lag of traditional manual maintenance, enabling the rule table to adaptively evolve and maintain long-term effectiveness; an eBPF / XDP kernel-side shorthand and trigger sampling mechanism is adopted to only gather port histograms, flow cycles and other statistical values, and to perform short-time increased sampling in an ambiguous state, with low overhead and low disturbance, supporting large-scale real-time recognition; a multi-source device identity graph is constructed to fuse port history, Client-ID and adjacency relationship cross-address deduplication and generate a standardized ID, and superimpose DHCP timing and lease fingerprints to improve continuity and robustness; the standardized key and deduplication update mechanism can automatically detect conflicts and redundancies during rule management, thus ensuring the simplicity and consistency of the rule table, reducing repeated calculations and improving overall operation efficiency.

[0144] From the above technical scheme can be seen, the present application can be based on eBPF / XDP's kernel side shorthand and trigger sampling mechanism in the target network for device feature collection, the obtained aggregated features do not involve plaintext, and the security is improved; the constructed knowledge graph can effectively deduplicate, and the detection efficiency is improved; the device identity graph is entity analyzed through the phased blocking and matching strategy, the phased feature matching is realized, and the detection efficiency is further improved; the feature score of each device entity is generated based on the AI model and the Bayesian calibrator, and the accuracy of the score calculation is improved; the device type of each device entity is determined based on the ambiguity decision mechanism, and the ambiguity is avoided to be directly output, and the accuracy of the device type detection is effectively improved.

[0145] As Figure 2 shown, it is a functional module diagram of the preferred embodiment of the device type detection device of the present application. The device type detection device 11 comprises an acquisition unit 110, a construction unit 111, an analysis unit 112, a calibration unit 113, and a determination unit 114. The module / unit referred to in the present application refers to a series of computer program segments that can be executed by a processor and can complete a fixed function, which is stored in a memory. In the present embodiment, the functions of each module / unit will be described in detail in the subsequent embodiments.

[0146] The acquisition unit 110 is configured to, in response to a device type detection instruction triggered based on a target network, collect device features in the target network based on an eBPF / XDP kernel side shorthand and trigger sampling mechanism, and obtain initial features.

[0147] The construction unit 111 is configured to construct a device identity graph according to the initial features.

[0148] The analysis unit 112 is configured to analyze entities of the device identity graph through a phased blocking and matching strategy, and obtain a plurality of device entities.

[0149] The calibration unit 113 is configured to calculate an initial score of each device entity by using a rule table generated based on an AI model, and perform posterior calibration on the initial score of each device entity based on a Bayesian calibrator of topological constraints, to obtain a feature score of each device entity.

[0150] The determination unit 114 is configured to determine a device type of each device entity based on a feature score of each device entity based on an ambiguity decision mechanism.

[0151] From the above technical scheme can be seen, the present application can be based on eBPF / XDP's kernel side shorthand and triggered sampling mechanism in the target network for device feature collection, the obtained aggregated features do not involve plaintext, and the security is improved; the constructed knowledge graph can effectively deduplicate, and the detection efficiency is improved; the device identity graph is entity analyzed through the phased blocking and matching strategy, and the phased feature matching is realized, and the detection efficiency is further improved; the feature score of each device entity is generated based on the AI model and the Bayesian calibrator, and the accuracy of the score calculation is improved; the device type of each device entity is determined based on the ambiguity decision mechanism, and the ambiguity is avoided to be directly output, and the accuracy of the device type detection is effectively improved.

[0152] As Figure 3 shown, it is a structural schematic diagram of a computer device of a preferred embodiment of the device type detection method of the present application.

[0153] The computer device 1 can include a memory 12, a processor 13 and a bus (the arrow in the figure is the bus), and can further include a computer program stored in the memory 12 and executable on the processor 13, such as a device type detection program.

[0154] Those skilled in the art can understand that the schematic diagram is only an example of the computer device 1, and does not constitute a limitation on the computer device 1, and the computer device 1 can be a bus type structure or a star type structure, and the computer device 1 can further include more or less other hardware or software, or different component arrangements, for example, the computer device 1 can further include an input / output device, a network access device, etc.

[0155] It should be noted that the computer device 1 is only an example, and other existing or future electronic products, such as those adaptable to the present application, should also be included within the protection scope of the present application and included by reference.

[0156] The memory 12 comprises at least one type of readable storage medium, such as flash memory, mobile hard disk, multimedia card, card-type memory (e.g. SD or DX memory, etc.), magnetic memory, disk, optical disk, etc. In some embodiments, the memory 12 can be an internal storage unit of the computer device 1, such as a mobile hard disk of the computer device 1. In other embodiments, the memory 12 can also be an external storage device of the computer device 1, such as a plug-in mobile hard disk, smart media card (SMC), secure digital (SD) card, flash card, etc. equipped on the computer device 1. Further, the memory 12 can comprise both an internal storage unit and an external storage device of the computer device 1. The memory 12 can be used to store application software and various data installed on the computer device 1, such as the code of the device type detection program, etc., and can also be used to temporarily store data that has been output or will be output.

[0157] The processor 13 can be composed of integrated circuits in some embodiments, such as a single packaged integrated circuit, or a plurality of packaged integrated circuits with the same or different functions, including one or more combinations of central processing units (CPU), microprocessors, digital processing chips, graphics processors, and various control chips, etc. The processor 13 is the control core (Control Unit) of the computer device 1, which connects various components of the computer device 1 through various interfaces and lines, and executes various functions and processes data of the computer device 1 by running or executing programs or modules stored in the memory 12 (such as executing the device type detection program, etc.) and calling data stored in the memory 12.

[0158] The processor 13 executes the operating system and various application programs installed on the computer device 1. The processor 13 executes the application programs to implement the steps in each of the above device type detection method embodiments, such as Figure 1 the steps shown.

[0159] For example, the computer program can be divided into one or more modules / units, which are stored in the memory 12 and executed by the processor 13 to complete the present application. The one or more modules / units can be a series of computer readable instruction segments capable of completing a specific function, which are used to describe the execution process of the computer program in the computer device 1. For example, the computer program can be divided into an acquisition unit 110, a construction unit 111, an analysis unit 112, a calibration unit 113, and a determination unit 114.

[0160] The integrated units in the form of software function modules can be stored in a computer readable storage medium. The software function modules are stored in a storage medium and include a plurality of instructions for causing a computer device (which can be a personal computer, a computer device, or a network device, etc.) or a processor to execute part of the device type detection method according to the embodiments of the present application.

[0161] The modules / units integrated in the computer device 1, if realized in the form of software function modules and sold or used as independent products, can be stored in a computer readable storage medium. Based on such understanding, the present application can also be implemented by a computer program to instruct related hardware devices to complete all or part of the processes of the above-mentioned embodiments, and the computer program can be stored in a computer readable storage medium, and the computer program can implement the steps of the above-mentioned method embodiments when executed by a processor.

[0162] The computer program includes computer program code, which can be in the form of source code, object code, executable files, or some intermediate forms, etc. The computer readable medium can include any entity or device capable of carrying the computer program code, recording medium, U disk, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory, etc.

[0163] Further, the computer readable storage medium can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, at least one application required by a function, etc.; and the data storage area can store data created according to the use of the blockchain node, etc.

[0164] The blockchain referred to in the present application is a new application mode of computer technologies such as distributed data storage, point-to-point transmission, consensus mechanism, and encryption algorithm. The blockchain is essentially a decentralized database, which is a series of data blocks associated by using cryptographic methods, each data block contains the information of a batch of network transactions, and is used to verify the validity (anti-fake) of the information and generate the next block. The blockchain can include a blockchain underlying platform, a platform product service layer, and an application service layer, etc.

[0165] The bus can be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one straight line is used in the drawings, but this does not mean that there is only one bus or only one type of bus. The bus is configured to enable connection and communication between the memory 12, the at least one processor 13, etc. Figure 3

[0166] Although not shown, the computer device 1 can also include a power supply (such as a battery) for powering the various components. Preferably, the power supply can be logically connected to the at least one processor 13 through a power management device, so that the power management device can implement functions such as charge management, discharge management, and power consumption management, etc. The power supply can also include one or more direct current or alternating current power supplies, recharging devices, power supply fault detection circuits, power supply converters or inverters, power supply status indicators, etc. The computer device 1 can also include various sensors, Bluetooth modules, Wi-Fi modules, etc., which will not be described here.

[0167] Further, the computer device 1 can also include a network interface, which can optionally include a wired interface and / or a wireless interface (such as a WI-FI interface, a Bluetooth interface, etc.), and is typically used to establish a communication connection between the computer device 1 and other computer devices.

[0168] Optionally, the computer device 1 can also include a user interface, which can be a display (Display), an input unit (such as a keyboard (Keyboard)), and optionally can also be a standard wired interface, a wireless interface. Optionally, in some embodiments, the display can be an LED display, a liquid crystal display, a touch liquid crystal display, an OLED (Organic Light-Emitting Diode) touch, etc. The display can also be appropriately referred to as a display screen or a display unit, and is used to display information processed in the computer device 1 and to display a visualized user interface.

[0169] It should be understood that the embodiments are only for illustration and are not limited in the scope of the patent application by this structure.

[0170] Those skilled in the art can understand that, Figure 3 ​The structure shown does not constitute a limitation on the computer device 1, and can include fewer or more components than shown, or combine certain components, or different component arrangements.

[0171] In combination Figure 1 The memory 12 in the computer device 1 stores a plurality of instructions to implement a device type detection method, and the processor 13 can execute the plurality of instructions to implement:

[0172] In response to a device type detection instruction triggered based on a target network, an eBPF / XDP-based kernel-side shorthand and triggered sampling mechanism collects device features in the target network to obtain initial features;

[0173] Construct a device identity graph according to the initial features;

[0174] Perform entity resolution on the device identity graph through a phased blocking and matching strategy to obtain a plurality of device entities;

[0175] Calculate an initial score of each device entity using a rule table generated based on an AI model, and perform posterior calibration on the initial score of each device entity based on a Bayesian calibrator under topological constraints to obtain a feature score of each device entity;

[0176] Based on an ambiguity decision mechanism, determine the device type of each device entity according to the feature score of each device entity.

[0177] Specifically, the specific implementation method of the processor 13 on the above instructions can refer to the description of related steps in the corresponding embodiments, which will not be repeated here. Figure 1

[0178] It should be noted that the data involved in the case are all legally obtained. The non-company software tools or components appearing in the embodiments of the application are only examples for introduction and do not represent actual use.

[0179] In several embodiments provided by the present application, it should be understood that the disclosed system, device and method can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the modules is only a logical function division. In actual implementation, other division manners can be adopted.

[0180] ​The application is operational with numerous general purpose or special purpose computing system environments or configurations. Examples of well- known computing systems, environments, and / or configurations that can be suitable for use with the application include personal computers, server computers, handheld or laptop devices, tablet devices, multiprocessor systems, microprocessor-based systems, set top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments that include any of the above systems or devices, and the like. The application can be described in the general context of computer-executable instructions, such as program modules, being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, and the like, that perform particular tasks or implement particular abstract data types. The application can also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules can be located in both local and remote computer storage media including memory storage devices.

[0181] The modules described as separate components can or can not be physically separate, and the components shown as modules can or can not be physical units, i.e., can be located in one place, or can be distributed to multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purposes of the embodiments.

[0182] In addition, each functional module in each embodiment of the application can be integrated in one processing unit, or each unit can be physically present separately, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or in the form of hardware plus software functional modules.

[0183] It is obvious to those skilled in the art that the application is not limited to the details of the above exemplary embodiments, and the application can be implemented in other specific forms without departing from the spirit or essential characteristics of the application.

[0184] Therefore, from any point of view, the embodiments should be regarded as exemplary and non-limiting, and the scope of the application is defined by the appended claims rather than the above description, and therefore all changes falling within the meaning and scope of the equivalent elements of the claims are intended to be included in the application. Any additional reference signs in the claims should not be considered as limiting the claims involved.

[0185] Furthermore, it is obvious that the word "comprising" does not exclude other units or steps, and the singular does not exclude the plural. The plurality of units or devices stated in the application can also be implemented by one unit or device through software or hardware. The words first, second, etc. are used to indicate names and not to indicate any particular order.

[0186] Finally, it should be noted that the above examples are merely intended to illustrate the technical solutions of the present application and not to limit the present application. Although the present application has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present application can be modified or equivalently replaced without departing from the spirit and scope of the technical solutions of the present application.

Claims

1. A method for detecting equipment type, characterized in that, The device type detection method includes: In response to a device type detection command triggered by the target network, the kernel-side shorthand and triggered sampling mechanism based on eBPF / XDP collects device features in the target network to obtain initial features; Construct a device identity graph based on the initial features; The device identity graph is parsed using a phased blocking and matching strategy to obtain multiple device entities. The initial score of each device entity is calculated using a rule table generated by an AI model, and the initial score of each device entity is posteriorly calibrated using a Bayesian calibrator based on topological constraints to obtain the feature score of each device entity. Based on the ambiguity decision-making mechanism, the equipment type of each equipment entity is determined according to the feature score of each equipment entity.

2. The equipment type detection method as described in claim 1, characterized in that, The kernel-side shorthand and triggered sampling mechanism based on eBPF / XDP performs device feature acquisition in the target network, obtaining initial features including: Extract multi-dimensional feature information of devices in the target network to obtain multi-dimensional device features; The lightweight kernel program loaded on the access side or bypass acquisition node is invoked to aggregate the multi-dimensional device features based on the configured kernel mapping structure, and the aggregation result is obtained. In user space, the aggregation results are read according to a preset period using a performance circular buffer or a BPF mapping type circular buffer, and the aggregation results are normalized by time window and anomaly truncation are performed to obtain the initial features. The kernel mapping structure includes: a least recently used mapping for high-frequency key-value statistics, a count-minimum sketch for heavy data flow detection, and a stack counting structure for short-window periodicity.

3. The equipment type detection method as described in claim 1, characterized in that, The initial features include the dynamic host configuration protocol behavior sequence and lease policy fingerprint; the kernel-side shorthand and triggered sampling mechanism based on eBPF / XDP for collecting device features in the target network also includes: Collect dynamic host configuration protocol messages at forwarding nodes or mirror ports; Obtain Dynamic Host Configuration Protocol (DHCP) relay logs or server logs, and use the DHCP relay logs or server logs to perform time alignment on the DHCP messages to obtain the data to be processed. The data to be processed is processed based on the message sequence dimension, option order dimension, and lease parameter dimension respectively to obtain the first feature, the second feature, and the third feature; By sequentially concatenating the first feature, the second feature, and the third feature, an initial fingerprint feature is obtained. The initial fingerprint features are mapped to temporal and structured features to obtain the dynamic host configuration protocol behavior temporal and lease policy fingerprints.

4. The equipment type detection method as described in claim 1, characterized in that, The device identity graph is a probabilistic graphical model constructed using device observation segments in the initial features as nodes and behavioral edge features in the initial features as edges. The step of parsing the device identity graph using a phased blocking and matching strategy yields multiple device entities, including: In the first stage, a blocking key is constructed based on a preset blocking dimension; nodes with the same blocking key value in the device identity graph are grouped together to obtain each blocking bucket; In the second stage, dual matching is performed on every two nodes within each blocking bucket to obtain multiple sub-likelihood scores for each pair of nodes; the weight coefficient of each sub-likelihood score is obtained; a weighted sum is calculated based on each sub-likelihood score and its weight coefficient to obtain the total likelihood score for each pair of nodes; the total likelihood score for each pair of nodes is calibrated using a supervised learning model to obtain the merging probability for each pair of nodes; a dual probability threshold is obtained; the merging probability for each pair of nodes is compared with the dual probability threshold to obtain each comparison result; within each blocking bucket, nodes are merged based on each comparison result to obtain the multiple device entities.

5. The equipment type detection method as described in claim 4, characterized in that, Within each blocking bucket, nodes are merged based on each comparison result to obtain the multiple device entities, including: Define every two nodes in each blockage bucket as a pair; Obtain the first threshold and the second threshold in the dual probability threshold; wherein the first threshold is greater than the second threshold; For each pair, if the merging probability corresponding to the pair is greater than or equal to the first threshold, the two nodes in the pair are merged; or, if the merging probability corresponding to the pair is less than or equal to the second threshold, the two nodes in the pair are not merged; or, if the merging probability corresponding to the pair is greater than the second threshold and less than the first threshold, the pair is added to the upper-level policy review queue to determine whether to merge, and the features of the two nodes in the pair are fed back to the AI ​​model for parameter optimization. The merged results of each pair are integrated to obtain the multiple device entities; Specifically, when integrating the merged processing results of each pair, the pairs corresponding to any node that have undergone merged processing are aggregated into a single device entity.

6. The equipment type detection method as described in claim 1, characterized in that, After obtaining multiple device entities, the method further includes: For each device entity, detect whether the initial characteristics contain a persistent Dynamic Host Configuration Protocol (DHCP) client identifier for the device entity. When the persistent Dynamic Host Configuration Protocol (DHCP) client identifier of the device entity exists in the initial characteristics, the persistent DHCP client identifier of the device entity is determined as the normalized device identifier of the device entity; or When the persistent dynamic host configuration protocol client identifier of the device entity is not present in the initial features, the connected components of the device entity are divided in the device identity graph using the minimum cut algorithm of the graph, and the normalized device identifier of the device entity is generated based on the connected components of the device entity.

7. The equipment type detection method as described in claim 1, characterized in that, Before calculating the initial score for each device entity using the rule table generated based on the AI ​​model, the method further includes: Construct sample data, and generate a first sub-rule, a second sub-rule, a third sub-rule, a fourth sub-rule, and a fifth sub-rule based on the AI ​​model and the sample data; A composite rule is generated based on the first sub-rule, and / or the second sub-rule, and / or the third sub-rule, and / or the fourth sub-rule, and / or the fifth sub-rule; Add the composite rule, and / or the first sub-rule, and / or the second sub-rule, and / or the third sub-rule, and / or the fourth sub-rule, and / or the fifth sub-rule to the table to obtain the rule table; In the rule table, a unique identifier is generated for each rule to serve as the normalization key for each rule; When a new rule is generated, the AI ​​model is used to compare and optimize the new rule with the rules in the rule table to generate decision data; the decision data includes whether to use the new rule to replace similar rules in the rule table and the adjustment method of the new rule; Specifically, when any rule in the rule table is in an invalid state for a preset period of time, the AI ​​model is invoked to generate adjustment or elimination suggestions for the arbitrary rule. Specifically, the AI ​​model is invoked to adjust the weight coefficients of each rule item in the rule table in different networks; Specifically, when the same device entity hits at least two conflicting rules in the rule table, the AI ​​model is invoked to perform root cause analysis and generate explanations and optimization suggestions.

8. The equipment type detection method as described in claim 1, characterized in that, The topology-constrained Bayesian calibrator performs posterior calibration on the initial score of each device entity, resulting in the following feature scores for each device entity: For each device entity's initial score, a discount factor is configured according to the negative correlation mechanism of evidence strength; Obtain the topology prior feature mapping table, and query the topology prior feature mapping table according to the characteristics of the port where the device entity is located to obtain the logarithmic prior gain; Calculate the product of the discount factor and the logarithmic prior gain to obtain the correction amount of prior knowledge to the posterior score; The feature score of the device entity is obtained by summing the initial score and the correction amount.

9. The equipment type detection method as described in claim 1, characterized in that, The ambiguous decision-making mechanism, which determines the device type of each device entity based on its feature score, includes: For each device entity, the highest and second-highest scores are obtained from the feature scores of the device entity; When the highest score is greater than or equal to a score threshold, and the difference between the highest score and the second highest score is greater than or equal to a preset score difference, the device type corresponding to the highest score is determined as the device type of the device entity; or When the highest score is less than the score threshold, or the difference between the highest score and the second highest score is less than the preset score difference, an ambiguity event is generated and the ambiguity event is sent to a designated terminal to request confirmation of the device type of the device entity.

10. The equipment type detection method as described in claim 9, characterized in that, After determining the device type of each device entity based on its feature score, the method further includes: For each device entity, a set of candidate device types is obtained based on the feature scores of the device entity, and the highest and second-highest candidate types of the device entity are obtained from the set of candidate device types; feedback data and a difference threshold for the device type of the device entity are obtained; when the feedback data shows that the difference between the feature scores of the highest and second-highest candidate types is lower than the difference threshold, and the size of the set of candidate device types is greater than a preset value, the sampling frequency of the device entity or the corresponding port is increased by a preset multiple within a preset time range to continue device feature acquisition, and the sampling frequency of the device entity or the corresponding port is restored after a preset window. When the frequency of the ambiguous event on a device entity of any device type exceeds a preset frequency, the AI ​​model is invoked to perform root cause analysis and generate an optimization strategy.

Images