Identification method and device of terminal equipment, equipment, medium and product

Abstract

The invention discloses a terminal equipment identification method and device, equipment, a medium and a product. The method comprises the following steps: acquiring a target file matched with target equipment; processing the target file through a pre-configured network detection module to obtain a target terminal feature matched with target equipment; and processing the target terminal features by using a pre-trained equipment identification model to obtain a target type matched with the target equipment. Through the technical scheme of the invention, the type identification of the terminal equipment can be realized, and the accuracy of the identification result and the identification efficiency of the identification work of the terminal equipment are improved.

Description

Technical Field

[0001] This invention relates to the field of the Internet of Things (IoT), specifically to the application of IoT in the field of financial technology, and particularly to a method, apparatus, device, medium, and product for identifying terminal devices. Background Technology

[0002] In the digital operation architecture of large groups and financial institutions, terminal devices are the key peripheral nodes in the vast and complex IT asset system. Taking large financial institutions as an example, their IT assets are extremely large, and the types of terminal devices are diverse, ranging from desktop computers and laptops used for daily office work to professional financial transaction terminals and smart teller machines.

[0003] With the rapid expansion of business and the deepening of informatization, large organizations are increasingly demanding asset security visualization, unified management, and compliance. Asset security visualization provides real-time insight into the security status of terminal devices, unified management optimizes resource allocation, and compliance ensures that operations meet industry standards and regulatory requirements. However, traditional asset management models are severely inadequate in meeting these needs, especially in the terminal device identification stage, where they face numerous challenges. Traditional methods rely heavily on manual data entry or configuration management database maintenance. When manually entering data, frequent dynamic changes in assets, such as the addition, replacement, and relocation of equipment, often result in untimely information updates and errors. Moreover, for a large number of complex terminal devices, manual identification is inefficient and inaccurate. The characteristics of different models and uses of terminal devices are complex, making it difficult for humans to quickly and accurately determine their detailed attributes, business modules, and usage status.

[0004] While maintenance based on configuration management databases offers some standardization, the sheer number and constant updates of terminal devices make it difficult to synchronize database data with actual assets in real time. Furthermore, configuration management databases struggle to handle subtle differences in device configurations and complex situations such as identifying unauthorized access devices. In addition, traditional methods lack effective control measures for security risks arising from inaccurate terminal device identification. For example, they may fail to promptly detect unauthorized terminals masquerading as legitimate devices accessing the network, or fail to detect misconfigurations of security policies due to incorrect terminal device identification, thus posing serious threats to asset security.

[0005] In summary, traditional terminal device identification methods suffer from low identification efficiency and poor accuracy of identification results. Summary of the Invention

[0006] This invention provides a method, apparatus, device, medium, and product for identifying terminal devices, which can solve the problems of low identification efficiency and poor accuracy of identification results in existing terminal device identification methods.

[0007] In a first aspect, embodiments of the present invention provide a method for identifying a terminal device, the method comprising:

[0008] Obtain the target file that matches the target device;

[0009] The target file is processed by a pre-configured network detection module to obtain target terminal characteristics that match the target device;

[0010] The target terminal features are processed using a pre-trained device recognition model to obtain the target type that matches the target device.

[0011] In a second aspect, embodiments of the present invention provide an identification device for a terminal device, the device comprising:

[0012] The file acquisition module is used to acquire target files that match the target device.

[0013] The feature calculation module is used to process the target file through a pre-configured network detection module to obtain target terminal features that match the target device;

[0014] The device identification module is used to process the features of the target terminal using a pre-trained device identification model to obtain the target type that matches the target device.

[0015] Thirdly, embodiments of the present invention provide an electronic device, the electronic device comprising:

[0016] At least one processor; and

[0017] A memory communicatively connected to the at least one processor; wherein,

[0018] The memory stores a computer program that can be executed by the at least one processor, which enables the at least one processor to perform a terminal device identification method according to any embodiment of the present invention.

[0019] Fourthly, embodiments of the present invention provide a computer-readable storage medium storing computer instructions, which are used to cause a processor to execute and implement a terminal device identification method according to any embodiment of the present invention.

[0020] Fifthly, embodiments of the present invention provide a computer program product, the computer program product including a computer program, which, when executed by a processor, implements a terminal device identification method according to any embodiment of the present invention.

[0021] The technical solution of this invention first obtains a target file matching the target device, then processes the target file using a pre-configured network detection module to obtain target terminal features matching the target device, and finally processes the target terminal features using a pre-trained device recognition model to obtain the target type matching the target device. This solves the problems of low recognition efficiency and poor accuracy of existing terminal device recognition methods, realizes terminal device type recognition, and improves the accuracy of recognition results and the recognition efficiency of terminal device recognition work.

[0022] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0023] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0024] Figure 1 This is a flowchart of a terminal device identification method provided in Embodiment 1 of the present invention;

[0025] Figure 2 This is a flowchart of a terminal device identification method provided in Embodiment 2 of the present invention;

[0026] Figure 3 This is a schematic diagram of the structure of an identification device for a terminal device according to Embodiment 3 of the present invention;

[0027] Figure 4 This is a schematic diagram of the structure of an electronic device that implements a terminal device identification method according to an embodiment of the present invention. Detailed Implementation

[0028] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0029] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, any variations of the terms "comprising" and "having" are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0030] Example 1

[0031] Figure 1 This is a flowchart of a terminal device identification method provided in Embodiment 1 of the present invention. This embodiment can be applied to the case of identifying the type of terminal device. The method can be executed by a terminal device identification device, which can be implemented in hardware and / or software. The terminal device identification device can be configured in a terminal or server with terminal device identification function.

[0032] like Figure 1 As shown, the method includes:

[0033] S110. Obtain the target file that matches the target device.

[0034] The target file includes: the IP address of the target device or the network information of the target device.

[0035] Furthermore, the IP address refers to the Internet Protocol address, which is a digital identifier assigned to every network interface on the Internet, enabling precise location of a specific target device within the network; the network information includes the subnet information and gateway address of the target device.

[0036] S120. The target file is processed by a pre-configured network detection module to obtain target terminal characteristics that match the target device.

[0037] S130. The target terminal features are processed using a pre-trained device recognition model to obtain a target type that matches the target device.

[0038] In this embodiment, optionally, the training process of the device identification model includes: acquiring a sample dataset and various structured features, wherein the sample data includes at least one sample device feature and a sample device type that matches each sample device feature; using the sample dataset and various structured features to train a preset random forest model to obtain the device identification model, wherein the sample device type is used as annotation data in the sample data.

[0039] Furthermore, before acquiring the sample dataset and each structured feature, the process includes: acquiring a template dataset, which includes at least one template type and at least one template file matching the template device type; processing each template file based on a pre-configured network detection module to obtain each template terminal feature matching each template device; grouping each template terminal feature based on each template type to obtain each template feature set; and performing an aggregation operation on each template terminal feature in the template feature set to obtain structured features matching the template feature set.

[0040] In one specific implementation of this embodiment, the training process of the device identification model is as follows: First, a sample dataset and various structured features are acquired. The sample dataset needs to cover common terminal device types to ensure that the model can learn the characteristic patterns of different devices. Each sample data contains two parts of information: one is at least one sample device feature, which covers the device's port information, service information, operating system information, and device fingerprint in the form of feature key-value pairs, facilitating subsequent model reading and analysis; the other is the sample device type that matches each sample device feature one-to-one. These sample device types will serve as annotation data in the sample data, providing clear target guidance for model training, allowing the model to clearly know which type a device with a certain feature should be classified into. The structured features mentioned are the result of aggregating the features of all samples of the same type of device. For example, if we collect the features of 100 printers and find that 95% of them have port 9100 open, 88% are running printing services, and most have an initial TCP window size of 1460, then we integrate port 9100 open, running printing services, and an initial TCP window size of 1460 into the structured features of printers. This process is repeated to create unique structured features for each type of device, ensuring that the model can clearly distinguish the core feature differences between different devices. Next, we train a random forest model using the sample dataset and the structured features to obtain the device recognition model. During training, we first associate the structured features of each type of device with the corresponding sample data. For example, we let the random forest model know that samples with printer structured features are printers. Then, through the ensemble learning logic of the random forest, we sample the data with replacement to generate multiple training subsets. Each subset trains a decision tree, and each tree only uses a portion of the structured features to split nodes. Finally, all decision trees determine the sample type through "majority voting." The model memorizes the structured feature patterns of various types of devices through repeated iterations, completing the training.

[0041] Furthermore, based on the above steps, before obtaining the sample dataset and each structured feature, it is necessary to construct the structured features: First, collect the template dataset and multiple template files corresponding to each type (such as the IP addresses and network information of multiple printers). Then, use a network detection module to scan these template files to obtain the original features of each template device (such as the port information, service information, operating system information, and device fingerprint of a printer). Then, group them according to the template type. For example, group the original features of all printers into the printer template feature set, and the original features of all physical machines into the physical machine template feature set. Finally, perform aggregation operations. For example, statistically analyze all the original features in the printer template feature set and extract the features common to most printers, such as opening port 9100 and running printing services. Organize these common features into standardized printer structured features. Similarly, generate structured features for other device types.

[0042] The technical solution of this invention first obtains a target file matching the target device, then processes the target file using a pre-configured network detection module to obtain target terminal features matching the target device, and finally processes the target terminal features using a pre-trained device recognition model to obtain the target type matching the target device. This solves the problems of low recognition efficiency and poor accuracy of existing terminal device recognition methods, realizes terminal device type recognition, and improves the accuracy of recognition results and the recognition efficiency of terminal device recognition work.

[0043] Example 2

[0044] Figure 2 This is a flowchart of a terminal device identification method provided in Embodiment 2 of the present invention. This embodiment is a refinement based on the above embodiment. In this embodiment, the method of processing the target file through a pre-configured network detection module to obtain target terminal features that match the target device is specifically refined.

[0045] like Figure 2 As shown, the method includes:

[0046] S210. Obtain the target file that matches the target device.

[0047] S220. The target file is processed using a pre-configured network detection module to obtain feature key-value pairs that match the target device and a target nested dictionary.

[0048] The network detection module is a multi-dimensional feature detection and data output module for network devices. It can be used to obtain port information, service information, operating system information, and device fingerprint of the target device based on the target file. Further, the port information is used to mark the open, closed, or filtered status of each port of the target device; the service information is used to indicate the service type and specific version running on each open port; the operating system information includes the name and version details of the operating system running on the device; and the device fingerprint is key data reflecting the TCP / IP protocol stack characteristics of the target device. Specifically, when the target file is input into the network detection module, the module first extracts the IP address or network information of the target device from the target file to identify the target. Then, it initiates target device reachability detection, determining whether the device is online by sending echo requests, etc. Subsequently, it performs port and service information collection, scanning all ports of the target device and identifying their open status, then sending specific probe packets to the open ports to match the built-in service feature library to determine the running service type and version. Afterward, it extracts the operating system and protocol stack fingerprint, using the TCP / IP protocol stack to achieve differences, and collects the device's port information, service information, operating system information, and device fingerprint. Those skilled in the art should understand that obtaining port information, service information, operating system information, and device fingerprints matching the target device through a network detection module when the IP address or network information of the target device is known is a mature existing technology. The principle and specific steps of this embodiment will not be described in detail here.

[0049] Furthermore, the target file is processed using a pre-configured network detection module to obtain feature key-value pairs matching the target device and a target nested dictionary. This includes: processing the target file using the pre-configured network detection module to obtain port information, service information, operating system information, and device fingerprint matching the target device; processing the port information, service information, and operating system information using regular expressions to obtain feature key-value pairs matching the target device; merging the device fingerprints to obtain a target string; and processing the target string using regular expressions to obtain a target nested dictionary matching the target device.

[0050] The regular expression is a string pattern used to match, search, and process text, composed of ordinary and special characters. By defining specific rules, it can quickly and accurately extract content that meets format requirements from complex text. In this embodiment, the regular expression is specifically used to extract port key-value pairs matching port information, service information key-value pairs matching service information, system information key-value pairs matching operating system information, and string key-value pairs matching the target string (i.e., a nested dictionary of targets) from port information, service information, operating system information, and the target string.

[0051] Furthermore, for device fingerprints, since the raw data is usually displayed in separate lines by field, these separate lines first need to be merged into a continuous string to eliminate interference caused by the scattered format, resulting in the target string. Then, layered regular expressions are used to parse the merged target string to form a nested dictionary that reflects the implicit protocol stack characteristics of the device.

[0052] S230. Associate and store each feature key-value pair with the target nested dictionary based on the IP address to obtain the target terminal features.

[0053] In a practical implementation scenario of this embodiment, the associated storage uses the IP address as the index key to construct a structured data storage structure. For example, using "IP1" as the index, all feature key-value pairs corresponding to that IP are integrated into the basic feature field, and the target nested dictionary is used as the protocol stack fingerprint feature field, together forming a complete target terminal feature record. This storage method not only ensures that all feature data of the same device is highly aggregated, avoiding feature confusion between multiple devices, but also facilitates subsequent feature tracing and data updates. If the IP device is re-probing later, the original record can be located directly based on the IP address, and the old data can be overwritten or supplemented with the newly acquired feature key-value pairs and nested dictionary, ensuring the timeliness and accuracy of the target terminal features. At the same time, the structured associated storage also allows the device identification model to quickly read the full-dimensional features of the device by IP address when calling features, without having to match scattered feature data one by one, thus improving the model processing efficiency.

[0054] S240. The target terminal features are processed using a pre-trained device recognition model to obtain a target type that matches the target device.

[0055] The process of processing the target terminal features using a pre-trained device recognition model to obtain target types matching the target device includes: processing each feature key-value pair and target nested dictionary of the target terminal features using the pre-trained device recognition model to obtain at least one target dimension score that matches each feature key-value pair and target nested dictionary, wherein the target dimension score includes a predicted type and a target score that matches the predicted type; summing the target scores of the same predicted type in each target dimension score to obtain a total target score that matches each predicted type; and sorting each predicted type in descending order based on the total target score of each predicted type to obtain a target type table that matches the target device.

[0056] Furthermore, when processing target terminal features using a pre-trained device recognition model, the model first performs dimensional score calculations for each feature key-value pair and the target nested dictionary within the target terminal features, generating corresponding target dimensional scores. Specifically, for feature key-value pairs, the device recognition model calls its built-in feature template library for matching. For example, the key-value pair "port_9100 / tcp: open" will be compared with the feature template for printer types. Since port 9100 is a typical open port for printers, the device recognition model will assign a high target score (e.g., 8 points) to "predicted type: printer". It will also match with other type templates such as physical machines or access control systems, assigning lower scores (e.g., 1 point, 0 points) due to low matching degree. For target nested dictionaries, the device recognition model will analyze them using the branching rules of the random forest model. For example, in a device nested dictionary, "initial window size = 1460" highly matches the protocol stack features of an embedded access control system, and the model will assign a target score (e.g., 7 points) to "predicted type: embedded access control system". In summary, each feature key-value pair and the subdivided fields of the nested dictionary will generate at least one set of target dimension scores containing the predicted type and the target score, enabling a preliminary multi-dimensional judgment of the device type. After obtaining all target dimension scores, the device identification model will sum the target scores for the same predicted type to calculate the total target score for each predicted type. For example, if a device scores 8 points for the printer type and 9 points for the key-value pair "Port_9100 Open" and "Running Printing Service," and scores 6 points for the printer type in the protocol stack feature of the nested dictionary, then the total target score for the printer is 8 + 9 + 6 = 23 points; while the physical machine type scores 1 point, 2 points, and 3 points in each dimension, with a total score of only 6 points. Finally, the model will sort the total target scores of each predicted type in descending order to generate a target type table. After sorting, the predicted type with the highest score will be ranked first. For example, the target type table for a device might be "Printer (23 points) > Physical Machine (6 points) > Access Control System (3 points)." After generating the target type table, relevant personnel will select the results according to actual business needs.

[0057] The technical solution of this invention first obtains a target file matching the target device, then processes the target file using a pre-configured network detection module to obtain feature key-value pairs matching the target device and a target nested dictionary. The feature key-value pairs and the target nested dictionary are then associated and stored based on the IP address to obtain target terminal features. Finally, a pre-trained device recognition model is used to process the target terminal features to obtain the target type matching the target device. This solves the problems of low recognition efficiency and poor accuracy in existing terminal device recognition methods, achieving terminal device type recognition and improving the accuracy and efficiency of terminal device recognition.

[0058] Example 3

[0059] Figure 3 This is a schematic diagram of the structure of an identification device for a terminal device provided in Embodiment 3 of the present invention. Figure 3 As shown, the device includes:

[0060] The file acquisition module 310 is used to acquire a target file that matches the target device.

[0061] The feature calculation module 320 is used to process the target file through a pre-configured network detection module to obtain target terminal features that match the target device;

[0062] The device identification module 330 is used to process the features of the target terminal using a pre-trained device identification model to obtain the target type that matches the target device.

[0063] The technical solution of this invention first obtains a target file matching the target device, then processes the target file using a pre-configured network detection module to obtain target terminal features matching the target device, and finally processes the target terminal features using a pre-trained device recognition model to obtain the target type matching the target device. This solves the problems of low recognition efficiency and poor accuracy of existing terminal device recognition methods, realizes terminal device type recognition, and improves the accuracy of recognition results and the recognition efficiency of terminal device recognition work.

[0064] Based on the above embodiments, the feature calculation module 320 includes:

[0065] A network detection unit is used to process the target file using a pre-configured network detection module to obtain feature key-value pairs that match the target device and a target nested dictionary;

[0066] An associated storage unit is used to associate and store each feature key-value pair and the target nested dictionary based on the IP address to obtain the target terminal features.

[0067] Based on the above embodiments, the network detection unit includes:

[0068] The information acquisition unit is used to process the target file using a pre-configured network detection module to obtain port information, service information, operating system information, and device fingerprint that match the target device.

[0069] The first regular expression unit is used to process the port information, service information and operating system information using regular expressions to obtain feature key-value pairs that match the target device.

[0070] The merging unit is used to merge the device fingerprints to obtain the target string;

[0071] The second regular expression unit is used to process the target string using regular expressions to obtain a target nested dictionary that matches the target device.

[0072] Based on the above embodiments, the device identification module 330 includes:

[0073] The scoring unit is used to process each feature key-value pair and the target nested dictionary of the target terminal features using a pre-trained device recognition model, and to obtain at least one target dimension score that matches each feature key-value pair and the target nested dictionary, wherein the target dimension score includes a prediction type and a target score that matches the prediction type.

[0074] The summation unit is used to sum the scores of targets with the same prediction type in each target dimension to obtain the total target score that matches each prediction type;

[0075] The sorting unit is used to sort each prediction type in descending order based on the total target score of each prediction type to obtain a target type table that matches the target device.

[0076] Based on the above embodiments, the terminal device identification device further includes: a model training module, used to: acquire a sample dataset and various structured features, wherein the sample data includes at least one sample device feature and a sample device type that matches each sample device feature respectively; train a preset random forest model using the sample dataset and various structured features to obtain the device identification model, wherein the sample device type is used as annotation data in the sample data.

[0077] Based on the above embodiments, the model training module is further configured to: obtain a template dataset before obtaining the sample dataset and each structured feature, the template dataset including at least one template type and at least one template file matching the template device type; process each template file based on a pre-configured network detection module to obtain each template terminal feature matching each template device; group each template terminal feature based on each template type to obtain each template feature set; and perform an aggregation operation on each template terminal feature in the template feature set to obtain structured features matching the template feature set.

[0078] The terminal device identification device provided in this embodiment of the invention can execute the terminal device identification method provided in any embodiment of the invention, and has the corresponding functional modules and beneficial effects of the method.

[0079] Example 4

[0080] Figure 4 A schematic diagram of an electronic device 10, which can be used to implement embodiments of the present invention, is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0081] like Figure 4 As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory 12 and an access memory 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the read-only memory 12 or loaded from the storage unit 18 into the access memory 13. The access memory 13 may also store various programs and data required for the operation of the electronic device 10. The processor 11, read-only memory 12, and access memory 13 are interconnected via a bus 14. An input / output interface 15 is also connected to the bus 14.

[0082] Multiple components in electronic device 10 are connected to input / output interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of monitors, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0083] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, central processing units, graphics processing units, various special-purpose artificial intelligence computing chips, various processors running machine learning model algorithms, digital signal processors, and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as a terminal device identification method.

[0084] Accordingly, the method includes:

[0085] Obtain the target file that matches the target device;

[0086] The target file is processed by a pre-configured network detection module to obtain target terminal characteristics that match the target device;

[0087] The target terminal features are processed using a pre-trained device recognition model to obtain the target type that matches the target device.

[0088] In some embodiments, a terminal device identification method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 10 via read-only memory 12 and / or communication unit 19. When the computer program is loaded into access memory 13 and executed by processor 11, one or more steps of the terminal device identification method described above may be performed. Alternatively, in other embodiments, processor 11 may be configured to perform a terminal device identification method by any other suitable means (e.g., by means of firmware).

[0089] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays, application-specific integrated circuits (ASICs), application-specific standard products (ASICs), systems-on-a-chip (SoCs), payload programmable logic devices, computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0090] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0091] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory, read-only memory, erasable programmable read-only memory, optical fibers, portable compact disk read-only memory, optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0092] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a cathode ray tube or liquid crystal display) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0093] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or computing systems that include middleware components (e.g., application servers), or computing systems that include frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0094] A computing system can include clients and servers. Clients and servers are generally geographically separated and typically interact via communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a host product within the cloud computing service system to address the shortcomings of traditional physical hosts, such as high management difficulty and weak business scalability.

[0095] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

Claims

1. A method for identifying a terminal device, characterized in that, include: Obtain the target file that matches the target device; The target file is processed by a pre-configured network detection module to obtain target terminal characteristics that match the target device; The target terminal features are processed using a pre-trained device recognition model to obtain the target type that matches the target device.

2. The method according to claim 1, characterized in that, The target file includes: the IP address of the target device or the network information of the target device.

3. The method according to claim 1, characterized in that, The target file is processed by a pre-configured network detection module to obtain target terminal characteristics that match the target device, including: The target file is processed using a pre-configured network detection module to obtain feature key-value pairs that match the target device and a target nested dictionary; Each feature key-value pair and the target nested dictionary are associated and stored based on the IP address to obtain the target terminal features.

4. The method according to claim 3, characterized in that, The target file is processed using a pre-configured network detection module to obtain feature key-value pairs matching the target device and a target nested dictionary, including: The target file is processed using a pre-configured network detection module to obtain port information, service information, operating system information, and device fingerprint that match the target device. The port information, service information, and operating system information are processed using regular expressions to obtain feature key-value pairs that match the target device. The device fingerprints are merged to obtain the target string; The target string is processed using regular expressions to obtain a target nested dictionary that matches the target device.

5. The method according to any one of claims 1-4, characterized in that, The target terminal features are processed using a pre-trained device recognition model to obtain the target type matching the target device, including: The pre-trained device recognition model is used to process each feature key-value pair of the target terminal features and the target nested dictionary to obtain at least one target dimension score that matches each feature key-value pair and the target nested dictionary. The target dimension score includes the prediction type and the target score that matches the prediction type. Sum the scores of targets with the same prediction type in each target dimension to obtain the total target score that matches each prediction type; Based on the total target score of each prediction type, the prediction types are sorted in descending order to obtain a target type table that matches the target device.

6. The method according to claim 1, characterized in that, The training process of the device recognition model includes: Obtain a sample dataset and various structured features, wherein the sample data includes at least one sample device feature and a sample device type that matches each sample device feature; The device identification model is obtained by training a preset random forest model using the sample dataset and various structured features, wherein the sample device type is used as annotation data in the sample data.

7. The method according to claim 6, characterized in that, Before obtaining the sample dataset and each structured feature, the following steps are included: Obtain a template dataset, which includes at least one template type and at least one template file matching the template device type; The pre-configured network detection module processes each template file to obtain the characteristics of each template terminal that match each template device. Based on each template type, the terminal features of each template are grouped and processed to obtain the feature set of each template; Aggregate the terminal features of each template in the template feature set to obtain structured features that match the template feature set.

8. An electronic device, characterized in that, The electronic device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform a terminal device identification method according to any one of claims 1-7.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that cause a processor to execute a method for generating an office schedule according to any one of claims 1-7.

10. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements a terminal device identification method according to any one of claims 1-7.

Images