Suspicious device determination method and system, medium and product

Abstract

The invention discloses a suspicious device determination method and system, a medium and a product, and relates to the technical field of data processing. The method comprises the following steps: acquiring network traffic data of hotel terminal equipment, including an MAC address, uplink and downlink traffic and connection duration; screening out candidate equipment meeting a preset threshold value based on the flow ratio and the connection duration; acquiring hotel room state data including room numbers and check-out time; establishing binding between the MAC address of the candidate equipment and the room number through a network topological relation; aiming at the bound candidate equipment, extracting a session record according to the check-out time of the corresponding room and acquiring accumulated uplink flow; and when the accumulated uplink flow exceeds a preset threshold value, marking the device as a suspicious device and outputting the MAC address and the room number of the suspicious device. By implementing the technical scheme provided by the invention, the positioning precision of the suspicious equipment can be improved.

Description

Technical Field

[0001] This application relates to the field of data processing technology, specifically to a method, system, medium, and product for identifying suspicious devices. Background Technology

[0002] With the development of society and the economy and the growth of people's travel needs, hotel accommodation has become an indispensable part of people's business, tourism and other activities. As a place that provides accommodation services, hotels bear a great responsibility for protecting the privacy and security of their guests. Once a privacy breach occurs, it will not only cause great psychological harm to guests, but also seriously damage the hotel's reputation and brand image.

[0003] Currently, hotel security personnel primarily use handheld detection devices to conduct security checks on guest rooms. These devices typically operate on infrared sensing or electromagnetic wave detection principles, scanning the room to detect potential pinhole cameras and other devices. This detection method, as a basic security measure, is widely used in hotel security management.

[0004] However, in practical applications, this physical detection-based method requires security personnel to check each room one by one, which is not only costly in terms of manpower and time, but also makes it difficult to guarantee the accuracy of the detection. Especially in the context of the rapid development of smart devices, due to the lack of analysis of room usage status, this isolated detection method is prone to false alarms and often fails to accurately locate the specific location of suspicious devices. Summary of the Invention

[0005] This application provides a method, system, medium, and product for identifying suspicious devices, which can improve the positioning accuracy of suspicious devices.

[0006] The first aspect of this application provides a method for identifying suspicious devices, comprising: The network traffic data of each terminal device connected to the hotel within a preset time period is obtained. The network traffic data includes media access control address, uplink byte count, downlink byte count, and connection duration. Based on the uplink and downlink byte counts of each terminal device, the uplink and downlink traffic ratio is calculated, and candidate devices with a traffic ratio greater than a preset first threshold and a connection duration greater than a preset second threshold are selected from each terminal device to construct a candidate device set. Obtain status data of each room in the hotel within the preset time period, the status data including room number and check-out timestamp; By establishing the network topology relationship between each terminal device and each room, a binding relationship is established between the media access control address of each candidate device in the candidate device set and the room number where it is located; For each candidate device with an established binding relationship, extract the session record based on the check-out timestamp of the room corresponding to the candidate device, and obtain the cumulative uplink bytes in the session record; When the cumulative number of uplink bytes exceeds a preset third threshold, the corresponding candidate device is marked as a suspicious device, and the media access control address and the room number bound to the suspicious device are output.

[0007] By employing the aforementioned technical solution, firstly, by acquiring network traffic data from terminal devices and analyzing the uplink / downlink traffic ratio and connection duration, candidate devices with abnormal network behavior characteristics can be initially screened. Secondly, by combining hotel room status data and network topology relationships to establish a binding relationship between devices and rooms, the specific room location of each suspicious device can be accurately pinpointed. Finally, by analyzing the cumulative uplink traffic in the session records of candidate devices before and after the room check-out time, the suspiciousness of the devices can be further verified, thereby achieving precise location of suspicious devices. This determination method based on multi-dimensional data analysis avoids the problems of traditional physical detection methods being time-consuming, labor-intensive, and prone to false alarms, and improves the accuracy of suspicious device identification through the correlation analysis of network behavior characteristics and room usage status.

[0008] Optionally, the start and end times of the preset time period are obtained; for each terminal device, based on the uplink byte count and the downlink byte count, the initial values ​​of the uplink byte count and the initial values ​​of the downlink byte count at the start time, and the final values ​​of the uplink byte count and the final values ​​of the downlink byte count at the end time are calculated respectively; the uplink byte count increment is determined based on the difference between the final value of the uplink byte count and the initial value of the uplink byte count; the downlink byte count increment is determined based on the difference between the final value of the downlink byte count and the initial value of the downlink byte count; the uplink byte count increment is divided by the downlink byte count increment to obtain the uplink and downlink traffic ratio of the corresponding terminal device.

[0009] Optionally, the system receives signal strength data from each network access point within the hotel, the signal strength data including access point identifiers and signal coverage areas; obtains room distribution information for the hotel, the room distribution information including room numbers and network access point deployment locations; constructs an association mapping table between network access points and rooms based on the mapping relationship between signal coverage areas and network access point deployment locations; detects the signal strength of candidate devices in the candidate device set when they access the network; compares the signal strength with the signal coverage area to determine the network access point connected to the candidate device; and, based on the association mapping table, matches the target room corresponding to the network access point connected to the candidate device, and binds the media access control address of the candidate device to the room number of the target room, thus determining the binding relationship between the media access control address and the room number of each candidate device in the candidate device set.

[0010] Optionally, based on the signal strength, signal strength samples of each network access point received by the corresponding candidate device at different time points are extracted to construct a signal strength matrix; a fast Fourier transform is performed on the signal strength matrix to obtain signal spectrum features, and based on the spectrum features, the signal fluctuation period and amplitude features of each network access point are extracted; the signal fluctuation period and amplitude features of each network access point are weighted and fused to obtain the stability coefficient of the signal of each network access point; and network access points with stability coefficients greater than a preset stability threshold are selected as network access points connected to the candidate device.

[0011] Optionally, the check-out timestamp corresponding to the candidate device is obtained from the binding relationship; the network traffic data is traversed to filter out multiple session segments whose media access control addresses match the candidate device and whose session timestamps are later than the check-out timestamps, and each session segment is combined into a session record according to a preset time sequence; the uplink byte count of each session segment is extracted from the session record; the uplink byte count of each session segment is summed to obtain the cumulative uplink byte count of the session record.

[0012] Optionally, generate security alert information including the media access control address of the suspicious device, the bound room number, the cumulative uplink byte count, and the detection time, and push the security alert information to the hotel's security management platform; receive the handling instructions returned by the hotel's security management platform; according to the handling instructions, obtain a list of target network addresses accessed by the suspicious device within the preset time period; perform security analysis on the target network address list to obtain security analysis results; when the security analysis result indicates that a suspicious external server address has been identified, trigger a network isolation operation to disconnect the network connection between the suspicious device and the hotel.

[0013] Optionally, the IP address and domain name information of the target network address are extracted from the target network address list; a preset threat intelligence database interface is called to query the behavior records corresponding to the IP address and the domain name information, and the behavior records are compared with a preset malicious behavior template library; when malicious behavior is detected in the behavior records, the IP address and the domain name information are marked as suspicious external server addresses; the number of communication times and the total amount of data transmission between the suspicious device and the suspicious external server address are counted, and a security analysis result is generated.

[0014] In a second aspect, embodiments of this application provide a suspicious device determination system, which includes: one or more processors and a memory; the memory is coupled to the one or more processors, and the memory is used to store computer program code, which includes computer instructions, and the one or more processors call the computer instructions to cause the suspicious device determination system to perform the method described in the first aspect and any possible implementation thereof.

[0015] Thirdly, embodiments of this application provide a computer-readable storage medium including instructions that, when executed on a suspicious device determination system, cause the suspicious device determination system to perform the method described in the first aspect and any possible implementation thereof.

[0016] Fourthly, embodiments of this application provide a computer program product containing instructions that, when the computer program product is run on a suspicious device determination system, cause the suspicious device determination system to perform the method described in the first aspect and any possible implementation thereof.

[0017] In summary, one or more technical solutions provided in this application have at least the following technical effects or advantages: By employing the aforementioned technical solution, firstly, by acquiring network traffic data from terminal devices and analyzing the uplink / downlink traffic ratio and connection duration, candidate devices with abnormal network behavior characteristics can be initially screened. Secondly, by combining hotel room status data and network topology relationships to establish a binding relationship between devices and rooms, the specific room location of each suspicious device can be accurately pinpointed. Finally, by analyzing the cumulative uplink traffic in the session records of candidate devices before and after the room check-out time, the suspiciousness of the devices can be further verified, thereby achieving precise location of suspicious devices. This determination method based on multi-dimensional data analysis avoids the problems of traditional physical detection methods being time-consuming, labor-intensive, and prone to false alarms, and improves the accuracy of suspicious device identification through the correlation analysis of network behavior characteristics and room usage status. Attached Figure Description

[0018] Figure 1This is a flowchart illustrating a method for determining a suspicious device disclosed in an embodiment of this application; Figure 2 This is another flowchart illustrating a method for determining a suspicious device disclosed in an embodiment of this application; Figure 3 This is a schematic diagram of the structure of a system provided in an embodiment of this application.

[0019] Explanation of reference numerals in the attached drawings: 301, Central Processing Unit; 302, Read-Only Memory; 303, Random Access Memory; 304, Bus; 305, Input / Output Interface; 306, Input Section; 307, Output Section; 308, Storage Section; 309, Communication Section; 310, Driver; 311, Removable Media. Detailed Implementation

[0020] To enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments.

[0021] In the description of the embodiments of this application, the words "for example" or "for instance" are used to indicate examples, illustrations, or explanations. Any embodiment or design that is described as "for example" or "for instance" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or design options. Rather, the use of the words "for example" or "for instance" is intended to present the relevant concepts in a specific manner.

[0022] In the description of the embodiments of this application, the term "multiple" means two or more. For example, multiple systems means two or more systems, and multiple screen terminals means two or more screen terminals. Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the indicated technical features. Thus, a feature defined with "first" or "second" may explicitly or implicitly include one or more of that feature. The terms "comprising," "including," "having," and variations thereof all mean "including but not limited to," unless otherwise specifically emphasized.

[0023] This application provides a radio prediction analysis method, referring to... Figure 1 , Figure 1 This is a flowchart illustrating a method for determining a suspicious device according to an embodiment of this application. The method is applied to a system, which refers to a hardware and software integrated platform capable of executing a suspicious device determination program. The system can execute a suspicious device determination program, and the method includes steps 101 to 106, as follows: Step 101: Obtain network traffic data of each terminal device connected to the hotel within a preset time period. The network traffic data includes media access control address, uplink bytes, downlink bytes, and connection duration.

[0024] Terminal devices refer to various electronic devices connected to the hotel network, including mobile phones, tablets, laptops, and other devices with network communication capabilities. Preset time period refers to a predetermined fixed time interval, such as hourly, daily, or weekly. Network traffic data refers to the data transmission records generated by the device during network communication. Among these, the Media Access Control Address (MAC address) is the unique identifier of the device's network card, consisting of a 48-bit binary number; the uplink byte count indicates the amount of data the device sends to the network; the downlink byte count indicates the amount of data the device receives from the network; and the connection duration records the duration for which the device maintains a connection with the network.

[0025] Specifically, firstly, traffic monitoring functionality is configured on the hotel's network access equipment (such as routers and switches), setting the data collection interval (e.g., once every 5 minutes). During collection, the network devices record traffic statistics for each MAC address, including: start time, end time, cumulative uplink traffic (in bytes), and cumulative downlink traffic (in bytes) within that time period. For example, for a device with MAC addresses 00:1A:2B:3C:4D:5E, the records for the hour 9:00-10:00 might be: 100MB uplink traffic, 500MB downlink traffic, and a connection duration of 3600 seconds. This data is stored in the network monitoring database for subsequent analysis. The data collection process uses standard SNMP or NetFlow protocols to ensure data accuracy and real-time performance. The system preprocesses the collected raw data, including data format standardization, outlier filtering, and timestamp alignment, forming standardized traffic data records.

[0026] Step 102: Calculate the uplink and downlink traffic ratio based on the uplink and downlink byte counts of each terminal device, and select candidate devices from each terminal device whose traffic ratio is greater than a preset first threshold and whose connection duration is greater than a preset second threshold to construct a candidate device set.

[0027] The traffic ratio refers to the ratio of uplink traffic to downlink traffic on a device, reflecting the device's data transmission characteristics. The preset first threshold is a criterion set for the traffic ratio, typically set to a value greater than 1, indicating that uplink traffic significantly exceeds downlink traffic. The preset second threshold is a criterion set for connection duration, measured in seconds. The candidate device set refers to a list of devices that meet the above two threshold conditions, and its relevant information is stored in a data structure.

[0028] Specifically, the acquired network traffic data is first read, and the following calculations and judgments are performed on each terminal device. When calculating the traffic ratio, the total number of uplink bytes for that device within the monitoring period is divided by the total number of downlink bytes. For example, if a terminal device generates 1,000,000 bytes of uplink traffic and 100,000 bytes of downlink traffic in one hour, its traffic ratio is 10. A first threshold of 5 (meaning uplink traffic is 5 times downlink traffic) and a second threshold of 1800 seconds (meaning a continuous connection of 30 minutes) are set. The device is then judged: because the traffic ratio of 10 is greater than the threshold of 5, and assuming its connection duration of 2400 seconds is greater than the threshold of 1800 seconds, the device is added to the candidate device set. Each candidate device record includes: device MAC address, traffic ratio value, and connection duration value. Through this dual-threshold filtering mechanism, devices exhibiting abnormal uplink traffic for extended periods are identified. This filtering method specifically identifies devices with suspicious data transmission characteristics because normal devices typically have more downlink traffic than uplink traffic, and the continuous large-scale data upload behavior often indicates abnormal data transmission activity.

[0029] In one possible implementation, the uplink and downlink traffic ratio is calculated based on the uplink and downlink byte counts of each terminal device, specifically including steps 1021-1022, as follows: Step 1021: Obtain the start and end times of the preset time period; for each terminal device, based on the number of uplink bytes and downlink bytes, calculate the initial values ​​of the number of uplink bytes and downlink bytes at the start time, and the final values ​​of the number of uplink bytes and downlink bytes at the end time.

[0030] The start and end times of the preset time period refer to the beginning and end times of the monitoring interval, recorded in timestamp format. The initial values ​​of the uplink and downlink byte counts refer to the cumulative uplink and downlink data volume of the device at the start time, recording the baseline data volume when the device begins monitoring. The final values ​​of the uplink and downlink byte counts refer to the cumulative uplink and downlink data volume of the device at the end time, recording the final data volume when the device ends monitoring. The timestamps use Unix timestamp format, accurate to the second, such as 1638547200 representing 2021-12-04 00:00:00.

[0031] Specifically, first, a monitoring time window is set, determining the start time T1 and the end time T2. For example, if the monitoring period is set from 8:00 AM to 8:00 PM, then T1 = 1638547200 (8:00:00 timestamp) and T2 = 1638576000 (20:00:00 timestamp). For each terminal device, the cumulative traffic data at the two time points is queried from the network traffic record database. The query uses the SQL statement: SELECT upload_bytes, download_bytes FROM traffic_log WHERE mac_address='00:1A:2B:3C:4D:5E' AND timestamp=T1, to obtain the initial value; similarly, the data at timestamp=T2 is queried to obtain the final value. Taking a terminal device as an example, the initial value of the uplink byte count at time T1 is 1000 bytes, and the initial value of the downlink byte count is 2000 bytes; at time T2, the final value of the uplink byte count is 11000 bytes, and the final value of the downlink byte count is 4000 bytes. These four values ​​are recorded in the device's traffic statistics record. For newly connected devices during the monitoring period, the initial value is recorded as the cumulative traffic value at the time of initial connection; for devices offline during the monitoring period, the final value is recorded as the cumulative traffic value at the time of last online connection. This time window-based data collection method provides accurate basic data for subsequent calculations of traffic changes.

[0032] Step 1022: Determine the uplink byte count increment based on the difference between the final uplink byte count and the initial uplink byte count; determine the downlink byte count increment based on the difference between the final downlink byte count and the initial downlink byte count; divide the uplink byte count increment by the downlink byte count increment to obtain the uplink and downlink traffic ratio for the corresponding terminal device.

[0033] The uplink byte increment represents the total uplink traffic actually generated by the device during the monitoring period, calculated by subtracting the initial value from the final value. The downlink byte increment represents the total downlink traffic actually received by the device during the monitoring period, also calculated by subtracting the initial value from the final value. The traffic ratio is the ratio of the uplink increment to the downlink increment, reflecting the data transmission direction characteristics of the device during that time period. For example, if a device has an uplink increment of 100MB and a downlink increment of 20MB per hour, its traffic ratio is 5, indicating that the device's uplink data volume is 5 times its downlink data volume.

[0034] Specifically, first, the incremental value of the uplink byte count is calculated by subtracting the initial value of the uplink byte count from the final value. For example, if the final uplink byte count at time T2 is 11,000 bytes and the initial uplink byte count at time T1 is 1,000 bytes, then the incremental uplink byte count is 11,000 - 1,000 = 10,000 bytes. Similarly, the incremental downlink byte count is calculated. If the final downlink byte count at time T2 is 4,000 bytes and the initial downlink byte count at time T1 is 2,000 bytes, then the incremental downlink byte count is 4,000 - 2,000 = 2,000 bytes. Finally, the flow ratio is calculated by dividing the incremental uplink byte count by the incremental downlink byte count, i.e., 10,000 / 2,000 = 5. This incremental calculation method eliminates the influence of historical accumulated flow and accurately reflects the actual flow changes within the monitoring period. If the incremental downlink byte count is 0, to avoid division by zero errors, the flow ratio is set to a sufficiently large value to mark this abnormal situation. The calculated flow rate is rounded to two decimal places and stored in the device's flow statistics record for subsequent threshold determination.

[0035] Step 103: Obtain the status data of each room in the hotel within a preset time period. The status data includes the room number and check-out timestamp.

[0036] Room status data refers to room occupancy information recorded in the hotel's room management system. The room number is a unique identifier for each room, typically composed of the floor number and room sequence number, such as "0601" representing room 01 on the 6th floor. The check-out timestamp records the exact time the guest completed the check-out process, using a Unix timestamp format accurate to the second. For example, timestamp 1638547200 corresponds to 2021-12-04 00:00:00, indicating that the room was checked out at that time. Status data is maintained and updated through the hotel's Property Management System (PMS).

[0037] Specifically, the system first connects to the hotel's property management system via a data interface to read room status records for a preset time period. Data acquisition uses an SQL query: `SELECT room_number, checkout_time FROM room_status WHERE checkout_time BETWEEN T1 AND T2`, where T1 and T2 are the start and end timestamps of the monitoring period, respectively. For each room, its room number and most recent check-out time are recorded. Example data record: Room 0601's check-out time is 1638547200 (2021-12-04 00:00:00). The retrieved room status data is stored in a temporary data table containing the fields: room number (varchar type) and check-out timestamp (bigint type). For rooms that have multiple check-ins and check-outs during the monitoring period, only the last check-out record is retained. Invalid data is filtered during data acquisition; for example, rooms that have not yet checked out (check-out time is empty) or records with abnormal check-out times (earlier than the monitoring start time or later than the monitoring end time) are excluded. This room status data provides important time references for subsequent analysis of the activity time of suspicious devices.

[0038] Step 104: Based on the network topology relationship between each terminal device and each room, establish the binding relationship between the media access control address of each candidate device in the candidate device set and the room number where it is located.

[0039] Network topology describes the physical connection structure of network devices and rooms within a hotel. Each room typically has a fixed network access point, which is connected to the floor switch via Ethernet cable or wirelessly, forming a hierarchical network structure. The binding relationship between media access control addresses and room numbers refers to a mapping record that establishes a correspondence between the MAC address of a specific device and its room location. For example, binding the MAC address "00:1A:2B:3C:4D:5E" to room number "0601" indicates that the device is located in room 01 on the 6th floor.

[0040] Specifically, the first step is to read the wiring diagram and configuration information of the hotel's network equipment to establish a network topology database. The database contains the following table structures: Access Point Table (AP_ID, AP Location, Coverage Area), Switch Table (Switch_ID, Floor, List of Connected AP_IDs), and Room Table (Room Number, Corresponding AP_ID). For each device in the candidate device set, the following location process is performed: 1. Query the switch via SNMP protocol to obtain the port information currently connected to the MAC address; 2. Determine the access point ID connected to the device based on the port information; 3. Query the room table to find the room number within the coverage area of ​​the access point. For devices connected to the wireless network, signal strength is used for location: 1. Obtain the list of WiFi access points connected to the device and their corresponding signal strengths; 2. Select the access point with the strongest signal as the device's location; 3. Query the room number covered by that access point. After location is completed, the mapping relationship is recorded in the binding relationship table: MAC address, room number, binding time, signal strength / port number. For locations at the boundary of multiple access point coverage areas, the room number with the highest signal strength or the highest physical connection certainty is selected as the binding result. This network topology-based localization method has higher accuracy compared to simple signal strength localization.

[0041] Step 105: For each candidate device with an established binding relationship, extract the session record based on the check-out timestamp of the room corresponding to the candidate device, and obtain the cumulative uplink bytes in the session record.

[0042] Session logs refer to the data communication records after a terminal device establishes a connection with the network. They record the device's activity in the network, including detailed information such as connection start time, end time, and data transmission volume. Cumulative uplink bytes represent the total amount of data sent to the network by the device within a statistical period, measured in bytes, reflecting the device's data upload behavior characteristics. For example, a device with MAC address "00:1A:2B:3C:4D:5E" generated a total of 1,000,000 bytes of uplink traffic data in all sessions after checkout time 1638547200 (2021-12-04 00:00:00). Each session log details the start and end times of the session and the specific traffic statistics for that time period.

[0043] Specifically, the execution process first reads the binding relationship table to obtain the mapping relationship between the MAC address and room number of the candidate device, and simultaneously queries the check-out timestamp of the corresponding room. Then, it extracts session data that meets the conditions from the traffic record database using the query statement: `SELECT session_start_time, session_end_time, upload_bytes FROM traffic_sessions WHERE mac_address='device MAC address' AND session_start_time > check-out timestamp`. The session records returned by the query are processed using time series analysis, merging adjacent sessions with a time interval of less than 60 seconds as a single continuous session. After the session records are determined, the uplink traffic of all sessions is cumulatively calculated. For example, a suspicious device recorded three sessions after check-out: 100,000 bytes uploaded between 10:00-10:30, 150,000 bytes uploaded between 10:31-11:00, and 200,000 bytes uploaded between 11:30-12:00. The summation operation yields a cumulative uplink traffic of 450,000 bytes after check-out. The statistical results were recorded in the device monitoring log, which included information such as the device's MAC address, room number, room check-out time, total number of sessions, cumulative uplink traffic, and the start and end times of the statistics. This traffic statistics method based on check-out time accurately captured abnormal data transmission behavior of devices when the room was unoccupied, providing important evidence for subsequent identification of suspicious devices.

[0044] In one possible implementation, the session record is extracted based on the check-out timestamp of the room corresponding to the candidate device, and the cumulative uplink byte count in the session record is obtained. Specifically, this includes steps 1051-1052, which are as follows: Step 1051: Obtain the check-out timestamp corresponding to the candidate device from the binding relationship; traverse the network traffic data, filter out multiple session segments whose media access control addresses match the candidate devices and whose session timestamps are later than the check-out timestamps, and combine each session segment into a session record according to a preset time sequence.

[0045] A session segment refers to a single, continuous communication record during a device's connection to the network, including the start and end times and traffic data for that period. A session timestamp is the start time of each session segment, recorded in Unix timestamp format. A preset time series is a time interval standard used to determine whether multiple session segments belong to the same complete session. For example, if a device MAC address "00:1A:2B:3C:4D:5E" has three session segments after checkout time 1638547200: 1638547500-1638548400, 1638548500-1638549400, and 1638549500-1638550400, and the time intervals are all less than the preset threshold, these segments will be combined into a complete session record.

[0046] Specifically, the process begins by retrieving the MAC addresses of candidate devices and the corresponding room check-out timestamps from the binding relationship database. Next, a query is executed on the network traffic database: `SELECT session_id, start_time, end_time, upload_bytes FROM session_fragments WHERE mac_address = 'target MAC address' AND start_time > check-out timestamp ORDER BY start_time ASC`. The returned session fragments are arranged chronologically and then processed for session merging: a session interval threshold of 300 seconds (5 minutes) is set, and all session fragments are iterated through. When the time interval between two adjacent fragments is less than 300 seconds, they are merged into a single session. The merging operation includes: the start time of the new session is taken from the start time of the first fragment, the end time is taken from the end time of the last fragment, and various data metrics are accumulated. For example, three session segments with times of 10:00:00-10:15:00, 10:17:00-10:30:00, and 10:32:00-10:45:00 are merged into a single session record because the interval between each segment is less than 5 minutes. The merged session record includes information such as session ID, start time, end time, number of merged segments, and cumulative uplink traffic. This time-series-based session merging method accurately reconstructs the device's continuous communication behavior, avoiding the impact of session fragmentation caused by network fluctuations.

[0047] Step 1052: Extract the number of uplink bytes for each session segment from the session record; sum the uplink byte counts for each session segment to obtain the total number of uplink bytes for the session record.

[0048] The uplink byte count of a session segment refers to the total amount of data sent to the network by a device in a single communication segment, measured in bytes. The cumulative uplink byte count is the arithmetic sum of the uplink data volumes of all related session segments. For example, a complete session record may contain three session segments, generating 100,000 bytes, 150,000 bytes, and 200,000 bytes of uplink traffic respectively; the cumulative uplink byte count of these segments, when summed, is 450,000 bytes. The uplink byte count for each session segment is a precise value recorded by the network device's traffic counter.

[0049] Specifically, the identified session records are extracted from the database, and the following processing is performed on each session record: First, all fragment information contained in the session is read by executing the SQL query: SELECT fragment_id, upload_bytes FROM session_fragments WHERE session_id='target session ID' ORDER BY start_timeASC. After obtaining the fragment list, an accumulator variable total_upload_bytes is created and initialized to 0. The number of upload bytes for each fragment is read sequentially and added to the accumulator. For example, if a session contains three fragments: the first fragment is from 10:00 to 10:15 with an upload of 100,000 bytes; the second fragment is from 10:17 to 10:30 with an upload of 150,000 bytes; and the third fragment is from 10:32 to 10:45 with an upload of 200,000 bytes. The following cumulative calculations are performed: total_upload_bytes = 0 + 100000 = 100000 (first accumulation), total_upload_bytes = 100000 + 150000 = 250000 (second accumulation), total_upload_bytes = 250000 + 200000 = 450000 (third accumulation). The final cumulative uplink bytes for this session record are 450000 bytes. After calculation, the cumulative value is updated in the session record table: UPDATE session_records SET total_upload_bytes = 450000 WHERE session_id = 'target session ID'. This segment-based cumulative statistical method ensures the completeness and accuracy of traffic calculation.

[0050] Step 106: When the cumulative number of uplink bytes exceeds the preset third threshold, mark the corresponding candidate device as a suspicious device and output the media access control address and the room number bound to the suspicious device.

[0051] The preset third threshold is a criterion set for the cumulative uplink traffic after a device checks out. It is used to identify abnormal data upload behavior and is usually set to a large byte value, such as 10MB (10,485,760 bytes). Suspicious devices refer to terminal devices that continue to generate a large amount of uplink traffic after checkout, and this behavior is significantly different from the network behavior pattern of devices that have checked out normally. The marking process involves adding the information of devices that meet the judgment criteria to the list of suspicious devices and recording their complete identification information. For example, if device "00:1A:2B:3C:4D:5E" generated 15MB of uplink traffic after checking out of room 0601, exceeding the 10MB threshold, the device will be marked as a suspicious device.

[0052] Specifically, the process begins by reading the statistical session log data and performing a threshold check on each candidate device. This involves executing the SQL query: `SELECT mac_address, room_number, total_upload_bytes FROM device_sessions WHERE checkout_flag = 1`. For each record, the query is then performed: `IF total_upload_bytes > 10485760 THEN`. The device is then marked as suspicious. This is implemented by creating a table named `suspicious_devices` containing the following fields: device MAC address, room number, check-out time, cumulative uplink traffic, and discovery time. When a device that meets the criteria is detected, an INSERT statement is executed to insert the device information into the table: INSERT INTO suspicious_devices (mac_address, room_number, checkout_time, total_upload, detect_time) VALUES ('00:1A:2B:3C:4D:5E', '0601', 1638547200, 15728640, CURRENT_TIMESTAMP). Simultaneously, an alarm message is generated, containing key fields: suspicious device MAC address, room number, checkout time, total upload traffic, and detection time. The output format uses structured JSON: {"alert_type": "suspicious_device", "mac_address": "00:1A:2B:3C:4D:5E", "room_number": "0601", "checkout_time": "2021-12-04 00:00:00", "total_upload": "15MB", "detect_time": "2021-12-04 12:00:00"}. This traffic threshold-based judgment method combines device location information and behavioral characteristics, providing a reliable basis for identifying abnormal devices.

[0053] In the above embodiments, a basic device location framework was implemented through signal strength analysis and network topology mapping. To further improve the accuracy of device location identification and reduce the impact of overlapping coverage of multiple access points on location judgment, this application also provides a method for determining suspicious devices. This method collects signal strength change characteristics during device access, analyzes signal fluctuation patterns, and performs stability-weighted processing, enabling the system to more accurately handle device location needs in complex network environments. The following section combines... Figure 2Another method for determining suspicious devices in the embodiments of this application is described below: Please see Figure 2 This is a flowchart illustrating a method for determining a suspicious device in an embodiment of this application.

[0054] Step 201: Receive signal strength data from each network access point within the hotel. The signal strength data includes the access point identifier and signal coverage area. Obtain the hotel's room distribution information, which includes the room number and the location of the network access point deployment.

[0055] Signal strength data records the wireless signal propagation characteristics of network access points. The access point identifier is a unique code for each wireless access point, typically containing the device's MAC address and location number, such as "AP-0601-001" indicating the first access point in room 01 on the 6th floor. Signal coverage is the signal propagation radius centered on the access point, expressed as a signal strength threshold (dBm) and physical distance (meters). Room distribution information describes the physical layout of the hotel rooms, including room numbers and the coordinates of the network device installation locations. Network access point deployment locations are represented using three-dimensional coordinates (x, y, z), for example, coordinates (10, 20, 18) represent an installation point located at 10 meters on the x-axis, 20 meters on the y-axis, and 18 meters on the z-axis.

[0056] Specifically, data is collected through the network management system to establish the correspondence between rooms and network devices. First, the working status of all access points is queried via the SNMP protocol, and data collection is performed: a data request is sent to each access point to obtain its basic configuration information (AP_INFO) and real-time working parameters (AP_STATUS). AP_INFO includes: access point MAC address, device model, installation location coordinates, antenna gain, transmit power, etc.; AP_STATUS includes: channel, bandwidth, current number of connections, signal strength, noise floor, etc. The collected data is stored in the access point information table: INSERTINTOap_info(ap_id, model, location_x, location_y, location_z, antenna_gain, tx_power)VALUES('AP-0601-001', 'AP-200', 10, 20, 18, 6, 20). Simultaneously, room layout data, including: floor number, room number, room type, area, relative coordinates, etc., is imported from the hotel management system. Room data is stored in a room information table: `INSERT INTO room_info(room_number, floor, type, area, corner_coordinates) VALUES('0601', 6, 'Standard', 25, '[(10, 15, 18), (10, 25, 18), (15, 25, 18), (15, 15, 18)]'`. Based on the access point location and room coordinates, a coverage mapping table is established: `INSERT INTO coverage_mapping(ap_id, room_number, signal_strength) VALUES('AP-0601-001', '0601', -35)`. This mapping records the signal coverage strength of each access point in each room, providing basic data support for subsequent device positioning.

[0057] Step 202: Based on the mapping relationship between signal coverage and network access point deployment location, construct an association mapping table between network access points and rooms.

[0058] The mapping relationship between signal coverage and network access point deployment location describes the spatial correspondence between the access point's signal coverage area and its physical installation location, defined by signal strength and distance parameters. The association mapping table is a data structure that records all rooms covered by each network access point and their corresponding signal strength values. For example, access point AP-0601-001 is installed at coordinates (10, 20, 18), with a signal coverage radius of 10 meters and signal strength ranging from -35dBm to -75dBm. This access point forms a signal coverage mapping relationship with rooms 0601, 0602, and 0603 within its coverage area, recording the received signal strength values ​​of -35dBm, -45dBm, and -55dBm for the corresponding rooms, respectively.

[0059] Specifically, first, create an associated mapping table `ap_room_mapping`, containing fields: mapping ID, access point ID, room number, signal strength, coverage type (primary coverage / secondary coverage), and update time. Perform coverage analysis for each access point AP-0601-001: 1. Obtain the access point coordinates (10, 20, 18) and transmission parameters (power 20dBm, antenna gain 6dBi); 2. Calculate the theoretical coverage area: using the access point as the center, calculate a 10-meter effective coverage radius based on the transmission power; 3. Extract the room list within this range: `SELECT room_number, corner_coordinates FROM room_info WHERE (at least one point in corner_coordinates is less than or equal to 10 meters from the access point); 4. Calculate the actual signal strength for each room: Signal strength = Transmit power + Antenna gain - Path loss, where path loss... The signal loss is calculated based on distance and attenuation due to obstacles. For example, room 0601 has a signal strength of -35dBm at a distance of 5 meters, room 0602 has a signal strength of -45dBm at a distance of 7 meters with a wall obstructing the signal, and room 0603 has a signal strength of -55dBm at a distance of 9 meters with two walls obstructing the signal. 5. Write the calculation results into the mapping table: INSERT INTOap_room_mapping(ap_id, room_number, signal_strength, coverage_type, update_time) VALUES('AP-0601-001', '0601', -35, 'primary', CURRENT_TIMESTAMP). Repeat the above steps for all access points to ultimately form a complete coverage relationship database. This mapping method based on actual signal propagation characteristics accurately reflects the coverage status of the hotel's wireless network.

[0060] Step 203: Detect the signal strength of the candidate devices in the candidate device set when they access the network; compare the signal strength with the signal coverage area to determine the network access point connected to the candidate devices.

[0061] The signal strength when a device connects to a network refers to the Received Signal Strength Indication (RSSI) value measured when the terminal device establishes a connection with a wireless access point, expressed in dBm. For example, -35dBm indicates a strong signal, and -75dBm indicates a weak signal. Signal strength comparison involves comparing the device's measured RSSI value with the access point's nominal coverage area to determine if the device is within the access point's effective coverage range. The network access point to which the device connects refers to the access point that actually establishes a wireless connection with the device, determined by its MAC address and signal strength. For example, if device "00:1A:2B:3C:4D:5E" measures a signal strength of -45dBm at access point AP-0601-001, this value falls within the access point's effective coverage range of -35dBm to -75dBm, confirming that the device has established a connection with that access point.

[0062] Specifically, first, configure the wireless controller to enable RSSI monitoring to collect signal strength data from all access points in real time. When a candidate device MAC address "00:1A:2B:3C:4D:5E" is detected accessing the network, perform signal measurement: 1. Obtain the associated status data of the device through the wireless controller API: GET / api / v1 / client / 00:1A:2B:3C:4D:5E / status, the returned data includes: device MAC address, currently connected access point ID, measured signal strength, connection time, etc.; 2. Simultaneously obtain the signal measurement data of the device from surrounding access points: GET / api / v1 / client / 00:1A:2B:3C:4D:5E / neighbors, the returned data... The data includes: 1. A list of access point IDs and their corresponding signal strength values; 2. Recording the measurement data into the device location table: INSERT INTO device_location(mac_address, primary_ap, primary_rssi, neighbor_aps, detection_time) VALUES('00:1A:2B:3C:4D:5E', 'AP-0601-001', -45, 'AP-0602-001: -65; AP-0603-001: -75', CURRENT_TIMESTAMP). The device location is determined based on signal data: the primary access point signal strength is -45dBm, the neighboring access points AP-0602-001 signal strength is -65dBm, and AP-0603-001 signal strength is -75dBm. Based on the signal strength, the device is determined to be within the main coverage area of ​​AP-0601-001. This multi-point signal measurement-based positioning method improves the accuracy of device location determination.

[0063] In one possible implementation, the signal strength is compared with the signal coverage to determine the network access point to which the candidate device is connected, specifically including steps 2031-2033, as follows: Step 2031: Based on the signal strength, extract the signal strength samples of each network access point received by the corresponding candidate device at different time points, and construct a signal strength matrix.

[0064] Signal strength samples are signal strength values ​​measured between a device and an access point at a specific time point, recorded in dBm. The signal strength matrix is ​​a two-dimensional data structure where rows represent different time points, columns represent different access points, and matrix elements represent the signal strength received at the corresponding time point. For example, the device "00:1A:2B:3C:4D:5E" receives signal strengths of -45dBm, -65dBm, and -75dBm from the three access points at time t1, and -43dBm, -67dBm, and -73dBm at time t2. These data constitute a 2×3 signal strength matrix used to analyze the device's positional stability.

[0065] Specifically, first configure the data acquisition parameters of the wireless controller: the sampling interval is set to 30 seconds, and the signal strength of the target device and all visible access points is acquired simultaneously in each sampling period. Perform data acquisition: obtain signal data once every 30 seconds through the wireless controller API: GET / api / v1 / client / 00:1A:2B:3C:4D:5E / signal_strength, the returned data includes timestamps and signal strength values ​​of all access points. Store the acquired data in the signal sampling table: CREATETABLE signal_samples(sample_idBIGINT, mac_addressVARCHAR(17), timestampBIGINT, ap_idVARCHAR(20), signal_strengthINT). Sampling is performed continuously for 5 minutes, resulting in 10 sets of sampled data, each set containing signal strength values ​​of 3 access points. Construct the signal strength matrix: SELECT timestamp, ap_id, signal_strength FROM signal_samples WHERE mac_address='00:1A:2B:3C:4D:5E' ORDER BY timestamp, ap_id. This generates a 10×3 matrix. Matrix example: time t1 [-45, -65, -75], time t2 [-43, -67, -73], time t3 [-44, -66, -74], and so on up to time t10. Write the matrix data to the device location record: INSERT INTO location_matrix(mac_address, matrix_data, start_time, end_time) VALUES('00:1A:2B:3C:4D:5E', '{[-45, -65, -75], [-43, -67, -73], ...}', t1, t10). This multi-time-point signal sampling method eliminates the influence of instantaneous fluctuations in signal strength and improves the stability of equipment location determination.

[0066] Step 2032: Perform a fast Fourier transform on the signal strength matrix to obtain the signal spectrum features, and extract the signal fluctuation period and amplitude features of each network access point based on the spectrum features.

[0067] The Fast Fourier Transform (FFT) is a mathematical operation that converts a time-domain signal into a frequency-domain representation. The signal's spectral characteristics describe the frequency composition of signal strength variations, including the amplitude and phase information of each frequency component. The signal fluctuation period represents the temporal regularity of signal strength changes; the main periodic component is obtained through spectral analysis. The amplitude characteristics describe the severity of signal strength changes, including the maximum fluctuation range and root mean square deviation. For example, performing FFT analysis on 10 signal strength samples [-45, -43, -44, -46, -43, -45, -44, -43, -45, -44] from device "00:1A:2B:3C:4D:5E" and access point AP-0601-001 yields a main fluctuation period of 150 seconds and an amplitude characteristic of ±1.5 dBm.

[0068] Specifically, firstly, FFT processing is performed on the data sequence of each access point in the signal strength matrix: 1. Data preprocessing: The original signal sequence is normalized, converting the signal strength into fluctuation values ​​centered on the mean. For example, the mean of the sequence [-45, -43, -44, -46, -43, -45, -44, -43, -45, -44] is -44.2, and the converted sequence is [-0.8, 1.2, 0.2, -1.8, 1.2, -0.8, 0.2, 1.2, -0.8, 0.2]; 2. Perform FFT operation: The spectrum is calculated using the fft function of the NumPy library, fft_result = numpy.fft.fft(normalized_signal); 3. Calculate the frequency components: freq = numpy.fft.fftfreq(n_samples, d=sampling_interval), where n_samples is the number of samples (10) and sampling_interval is the sampling interval (30 seconds); 4. Extract the main frequency components: calculate the spectrum amplitude (magnitude = numpy.abs(fft_result), find the frequency component with the largest amplitude (max_freq = freq[numpy.argmax(magnitude[1:n_samples / / 2])]), and the reciprocal of this frequency is the main fluctuation period; 5. Calculate the amplitude characteristics: calculate the standard deviation of the original sequence (std_dev = numpy.std(signal_strength)) as the fluctuation amplitude index. The analysis results are stored in the spectral feature table: `INSERT INTO spectral_features (mac_address, ap_id, main_period, amplitude, std_deviation, analysis_time) VALUES ('00:1A:2B:3C:4D:5E', 'AP-0601-001', 150, 1.5, 0.98, CURRENT_TIMESTAMP)`. This analysis process is repeated for each access point in the signal strength matrix to obtain a complete signal feature dataset. This spectral analysis-based method can accurately identify the regular characteristics of signal changes.

[0069] Step 2033: Perform weighted fusion of the signal fluctuation period and amplitude characteristics of each network access point to obtain the stability coefficient of the signal of each network access point; select network access points with stability coefficients greater than the preset stability threshold as candidate network access points to which the device is connected.

[0070] The stability coefficient is a comprehensive indicator of the signal quality of an access point, ranging from 0 to 1. A higher value indicates a more stable signal. The preset stability threshold is a standard value for judging whether the access point signal is stable enough, usually set to 0.8. For example, the signal fluctuation period of access point AP-0601-001 is 150 seconds, and the amplitude characteristic is ±1.5dBm. After weighted calculation, the stability coefficient is 0.85, which is higher than the preset threshold of 0.8. Therefore, it is determined to be the connection access point for the device.

[0071] Specifically, first, feature weights are defined: periodic feature weight w1 = 0.6, amplitude feature weight w2 = 0.4. Stability calculations are performed for each access point: 1. Period score calculation: period_score = min(1, wave_period / 300), standardizing the fluctuation period to the range of 0-1; the longer the period, the higher the score, with a maximum of 1; 2. Amplitude score calculation: amplitude_score = max(0, 1-amplitude / 10), converting the amplitude feature into a score; the smaller the fluctuation amplitude, the higher the score; 3. Stability coefficient calculation: stability = w1 × period_score + w2 × amplitude_score. Taking access point AP-0601-001 as an example: wave_period = 150 seconds, period_score = 150 / 300 = 0.5; amplitude = 1.5dBm, amplitude_score = 1 - 1.5 / 10 = 0.85; stability coefficient = 0.6 × 0.5 + 0.4 × 0.85 = 0.64. The stability coefficients are calculated for all access points: AP-0601-001 is 0.64, AP-0602-001 is 0.85, and AP-0603-001 is 0.72. The calculation results are recorded in the access point evaluation table: `INSERT INTO ap_stability(mac_address, ap_id, period_score, amplitude_score, stability_coefficient, evaluation_time) VALUES('00:1A:2B:3C:4D:5E', 'AP-0602-001', 0.80, 0.92, 0.85, CURRENT_TIMESTAMP)`. Access points with a stability coefficient greater than 0.8 are selected for connection selection: `SELECT ap_id FROM ap_stability WHERE mac_address='00:1A:2B:3C:4D:5E' AND stability_coefficient>0.8`. In this example, AP-0602-001 has a stability coefficient of 0.85, which exceeds the threshold of 0.8, and is therefore selected as the device's connection access point. This multi-feature weighted evaluation method comprehensively considers the signal stability characteristics.

[0072] Step 204: Based on the association mapping table, match the target room corresponding to the network access point connected to the candidate device, and bind the media access control address of the candidate device to the room number of the target room to determine the binding relationship between the media access control address and the room number of each candidate device in the candidate device set.

[0073] The association mapping table is a database that records the correspondence between network access points and rooms, including access point ID, covered room number, signal strength, and other information. The target room refers to the room where the device is located, determined by signal strength matching, and is jointly determined by the access point's coverage area and signal strength. The binding relationship is a record corresponding to the device's MAC address and room number, used to determine the device's physical location. For example, when device "00:1A:2B:3C:4D:5E" connects to access point AP-0601-001 (signal strength -45dBm), and the association mapping table determines that the access point mainly covers room 0601, then a binding relationship is established between the device's MAC address and room number 0601.

[0074] Specifically, firstly, based on the acquired device connection data, the room location is determined by querying the associated mapping table: `SELECT room_number, signal_strength FROM ap_room_mapping WHERE ap_id='AP-0601-001' ORDER BY signal_strength DESC`. The query results are then analyzed: when the access point AP-0601-001 covers multiple rooms (0601: -35dBm, 0602: -45dBm, 0603: -55dBm), the measured signal strength of the device (-45dBm) is compared with the theoretical signal strength of each room. The best-matching room is determined by calculating the signal strength matching degree: the minimum value of `abs(measured signal strength + 45) - abs(theoretical signal strength + 45)`. In the example, the signal strength difference in room 0601 is 10, the signal strength difference in room 0602 is 0, and the signal strength difference in room 0603 is 10; therefore, the device is determined to be located in room 0602. Perform the binding operation: `INSERT INTO device_room_binding(mac_address, room_number, ap_id, signal_strength, binding_time) VALUES('00:1A:2B:3C:4D:5E', '0602', 'AP-0601-001', -45, CURRENT_TIMESTAMP)`. Repeat the above process for each device in the candidate device set to form a complete device location binding database. When a device is located at the coverage boundary of multiple access points, the room with the best signal strength match is selected as the binding target. This signal strength-based precise positioning method improves the accuracy of device location determination.

[0075] In the above embodiments, a basic security monitoring framework was established through the preliminary identification and location of suspicious devices. To further enhance the ability to analyze the behavior of suspicious devices and handle threats, and to improve the system's proactive defense level, this application also provides a method for identifying suspicious devices. This method constructs a complete device behavior profile, combines it with threat intelligence analysis, and implements an automated security handling process, enabling the system to promptly detect and block potential cybersecurity threats.

[0076] Step 301: Generate security alert information containing the media access control address of the suspicious device, the bound room number, the cumulative number of uplink bytes, and the detection time, and push the security alert information to the hotel's security management platform.

[0077] A security alert is a structured alarm data record containing complete identification and behavioral characteristics of a suspicious device. The detection time is recorded in a standard time format, specifying the exact moment the suspicious behavior was detected. The security management platform is the hotel's security monitoring system, used to receive, store, and display various security alert information. For example, a security alert might include: device MAC address "00:1A:2B:3C:4D:5E", room number "0601", cumulative uplink traffic of 15,728,640 bytes, and detection time "2021-12-04 12:00:00". This information is organized in standard formats such as JSON or XML for easy system processing and display.

[0078] Specifically, the JSON data structure for the alert information is first constructed as follows: {"alert_type": "suspicious_device", "alert_level": "high", "device_info": {"mac_address": "00:1A:2B:3C:4D:5E", "room_number": "0601"}, "traffic_data": {"upload_bytes": 15728640, "human_readable": "15MB"}, "detection_time": "2021-12-04 12:00:00", "alert_id": "ALT202112041200001"}. Record alert information to the alert database: `INSERT INTO security_alerts(alert_id, alert_type, mac_address, room_number, upload_bytes, detection_time, alert_status) VALUES('ALT202112041200001', 'suspicious_device', '00:1A:2B:3C:4D:5E', '0601', 15728640, '2021-12-0412:00:00', 'new')`. Perform alert push: Send alert data via the REST API provided by the security management platform: `POST / api / v1 / alerts`, with the request headers set to `Content-Type: application / json` and `Authorization: Bearer{access_token}`, and the request body containing the constructed JSON data. After receiving the alert, the platform returns confirmation information, including the alert ID and processing status. Update the alarm status: `UPDATE security_alertsSET alert_status='pushed', push_time=CURRENT_TIMESTAMPWHERE alert_id='ALT202112041200001'`. Alarm pushes employ a failure retry mechanism: when a push fails, it retryes three times at intervals of 30 seconds, 60 seconds, and 120 seconds to ensure reliable alarm delivery. This standardized alarm handling process ensures timely delivery and effective tracking of security information.

[0079] Step 302: Receive the handling instructions returned by the hotel's security management platform; according to the handling instructions, obtain the list of target network addresses accessed by the suspicious device within a preset time period.

[0080] Disposal instructions are standard format commands issued by the security management platform to instruct the system to perform specific security actions. The target network address list records all IP addresses and domain names accessed by suspicious devices, including detailed information such as access time, number of accesses, and data transmission volume. For example, device "00:1A:2B:3C:4D:5E" accessed IP address "203.0.113.1" and domain name "example.com" during monitoring; each record includes a timestamp of the access occurrence "1638547200", the number of accesses "5", and the upstream data volume "1000000" bytes. Disposal instructions use a standard command format and include fields such as command type, device identifier, and time range.

[0081] Specifically, the received processing instruction data is first parsed to extract the command type and query parameters. A traffic query task is created: a new task is recorded in the `traffic_analysis_tasks` table, including task ID, command type, target device MAC address, query time range, and task status. Traffic analysis is performed: the network traffic database is queried for the target device's communication records, with query conditions including source MAC address and time range. The returned data includes the target IP address, domain name, timestamp, and number of bytes transmitted. The query results are then aggregated and statistically analyzed: grouped by target address, the number of visits, total traffic, first access time, and last access time for each target address are calculated. For example, if a device accesses 5 different target addresses within one hour, the statistics for each address are as follows: the target address "203.0.113.1" was accessed 5 times, with a total uplink traffic of 1,000,000 bytes, and the access time period was from 10:15:00 to 10:45:00. The statistical results are recorded in the `traffic_analysis_results` table, including analysis ID, task ID, analysis data, and statistical time. The entire analysis process was executed asynchronously, with progress tracked via task status. This detailed traffic analysis provided crucial information for subsequent security assessments.

[0082] Step 303: Perform security analysis on the target network address list to obtain the security analysis results; when the security analysis results indicate that a suspicious external server address has been identified, trigger network isolation operation to disconnect the suspicious device from the hotel's network connection.

[0083] Suspicious external server addresses refer to IP addresses or domain names marked as having security risks. These addresses are typically associated with threats such as malware control centers and data-stealing servers. Network isolation is a network-level security control measure that restricts access to specific terminals by configuring network devices. For example, if a device frequently accesses the IP address "203.0.113.1," which has been flagged as a malware control server by multiple security intelligence sources, the system will trigger network isolation for that device.

[0084] Specifically, the first step is to perform a security check on the target address list: a batch query task is created to submit all target addresses to the security intelligence platform via an API interface. The query covers multiple security data sources: `threat_intelligence_check(address_list)` checks if the address is in the known threat intelligence database; `domain_reputation_check(domain_list)` assesses the domain's reputation score; and `behavior_pattern_analysis(traffic_pattern)` analyzes access behavior characteristics. Example of comprehensive analysis: The target address "203.0.113.1" is marked as a malware communication node in the threat intelligence database, with a reputation score of 10 (high risk), and the access pattern shows periodic connections at fixed intervals. When a high-risk address is detected, network isolation is performed: First, the isolation event is recorded: `INSERT INTO isolation_events(device_mac, reason, threat_addresses, event_time) VALUES('00:1A:2B:3C:4D:5E', 'malicious_server_detected', '203.0.113.1', CURRENT_TIMESTAMP)`. Isolation is then performed via the network control interface: An isolation command is sent to the network controller: `network_controller.isolate_device(mac='00:1A:2B:3C:4D:5E', vlan='quarantine')`. Isolation operations include: transferring the device to the isolated VLAN, adding blocking rules to the firewall, and closing the device's network ports. Finally, the isolation is confirmed to be effective: The device's network status is checked to confirm that it cannot access normal network resources. Update device status: UPDATE device_status SET network_status='isolated', isolation_time=CURRENT_TIMESTAMPWHERE mac_address='00:1A:2B:3C:4D:5E'. This automated response mechanism based on security analysis can quickly block potential security threats.

[0085] In one possible implementation, a security analysis is performed on the target network address list to obtain the security analysis results, specifically including steps 3031-3033, as follows: Step 3031: Extract the IP address and domain name information of the target network address from the target network address list; call the preset threat intelligence database interface to query the behavior records corresponding to the IP address and domain name information, and compare the behavior records with the preset malicious behavior template library.

[0086] The IP address and domain name information of the target network address serve as addressing identifiers for network communication. IP addresses use IPv4 or IPv6 format, and domain names use FQDN format. The threat intelligence database interface is a standardized API for accessing security intelligence services and querying the security attributes of an address. Behavioral records contain the address's historical security events, communication characteristics, and risk ratings. A pre-defined malicious behavior template library stores known threat behavior characteristics, including communication patterns, data transmission characteristics, and attack signatures. For example, the behavioral records for the IP address "203.0.113.1" and the domain name "malicious.example.com" show that this address has participated in data theft activities and exhibits typical command-and-control communication patterns: fixed-interval heartbeat connections, encrypted small packet transmissions, and an unusually high data transmission rate.

[0087] Specifically, the address list is first parsed: DNS resolution and address format standardization are performed on each record, and the IP address and domain name are stored in two separate query lists. A batch query task is created: `batch_id = create_batch_query()`, setting the query parameters: `query_params = {"ip_list": ["203.0.113.1", "203.0.113.2"], "domain_list": ["domain1.com", "domain2.com"]}`. The threat intelligence API is called to execute the query: `threat_intel_response = threat_intel_api.query(batch_id, query_params)`. The API returns detailed information for each address: historical security events, geographical location, ASN information, registration information, and security rating. Behavioral features are extracted from the query results: communication pattern features (connection frequency, packet size distribution, transmission direction features), service features (open ports, service types provided, certificate information), and historical threat features (attack activities participated in, malware associations, data breaches) are extracted from the returned data. The extracted features are matched against malicious behavior templates: `foreach behavior_pattern in malicious_patterns { calculate the similarity between the current behavior and the template score = calculate_pattern_similarity(current_behavior, behavior_pattern)}`. For example, if the target address is found to have the following characteristics: periodic connections at fixed intervals of 300 seconds, all uplink packets are 512 bytes, non-standard SSL encryption is used, and it is associated with multiple data theft events, these features match the data theft template with a 90% match rate. The analysis results are recorded in the behavior evaluation table: `INSERT INTO behavior_analysis (batch_id, address, behavior_features, matched_patterns, similarity_scores, analysis_time) VALUES(batch_id, '203.0.113.1', '{feature_json}', '{pattern_json}', '{score_json}', CURRENT_TIMESTAMP)`. This feature-matching-based analysis method can accurately identify network addresses with threatening characteristics.

[0088] Step 3032: When malicious behavior is detected in the behavior log, mark the IP address and domain name information as suspicious external server addresses.

[0089] Malicious behavior refers to the threatening characteristics exhibited by a network address, including activities such as command and control communication, data theft, and malware propagation. The marking operation involves adding network addresses with threatening characteristics to the system's blacklist database, recording their threat type, discovery time, and supporting evidence. For example, if the IP address "203.0.113.1" is detected to have data theft behavior characteristics: periodic connection intervals of 300 seconds, fixed-size encrypted data packets, and an abnormal uplink traffic ratio of 90%, the system will mark this address as a data theft threat, recording the marking time as "2021-12-04 12:00:00," and the associated behavioral evidence includes traffic characteristics, threat intelligence matching results, and other data.

[0090] Specifically, threat assessment data is first extracted from the behavioral analysis results: SELECT address, behavior_features, matched_patterns, similarity_scores FROM behavior_analysis WHERE batch_id='BAT202112041200001' AND similarity_scores>0.8. Threat assessment is then performed on each record: behavioral feature data is read, and key indicators are extracted: connection patterns, data transmission characteristics, protocol anomalies, etc. The threat level is calculated: threat_level=calculate_threat_level(behavior_features), and the various feature indicators are weighted to obtain a comprehensive threat score. When a high-threat address is detected, perform the following marking operation: Create a threat address record: INSERTINTOsuspicious_servers(address, threat_type, threat_level, detection_time, evidence_data)VALUES('203.0.113.1', 'data_theft', 0.95, CURRENT_TIMESTAMP, '{behavior_json}'). Update the address blacklist: INSERTINTOaddress_blacklist(address, blacklist_type, add_time, expire_time)VALUES('203.0.113.1', 'high_risk', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP+INTERVAL'7DAY'). Linking threat evidence: `INSERT INTOthreat_evidence(address, evidence_type, evidence_data, collection_time) VALUES('203.0.113.1', 'traffic_pattern', '{pattern_json}', CURRENT_TIMESTAMP)`. The tagged address information is used for subsequent security responses, including triggering network isolation, generating security alerts, and updating protection policies. This behavior-based address tagging mechanism provides accurate threat identification for network security protection.

[0091] Step 3033: Count the number of communications and the total amount of data transmission between the suspicious device and the suspicious external server address, and generate security analysis results.

[0092] The number of communications refers to the total number of network connections established between the device and the suspicious server. Each TCP session or UDP data exchange is counted as one communication. The total data transmission includes the sum of uplink and downlink data bytes, recorded in bytes. The security analysis result is a comprehensive statistical report that records detailed data on communication behavior. For example, device "00:1A:2B:3C:4D:5E" established 100 communication connections with the suspicious server "203.0.113.1" during the monitoring period, generating 10,000,000 bytes of uplink data and 1,000,000 bytes of downlink data. These data are recorded as specific statistical values ​​to assess the degree of anomaly in the communication behavior.

[0093] Specifically, first extract communication data from the traffic log table: SELECT connection_id, start_time, end_time, bytes_sent, bytes_received FROM traffic_logs WHERE source_mac='00:1A:2B:3C:4D:5E' AND destination_ip='203.0.113.1' AND timestamp BETWEEN start_time AND end_time. Perform the following statistical calculations: 1. Communication count statistics: SELECT COUNT(DISTINCT connection_id) as connection_count, which returns a total of 100 connections; 2. Data volume statistics: SELECT SUM(bytes_sent) as total_upload, SUM(bytes_received) as total_download, which returns a total of 10,000,000 bytes for uplink and 1,000,000 bytes for downlink; 3. Time distribution statistics: SELECT EXTRACT(HOURFROM start_time) as our, COUNT(*) as ourly_connectionsFROM traffic_logs GROUPBYhour ORDER BY hour, which returns the hourly distribution of connections; 4. Packet characteristic statistics: SELECT AVG(packet_size) as avg_size, STDDEV(packet_size) as size_deviationFROM packet_logs, which returns the average and standard deviation of packet size. The statistical results are written to the analysis record table: INSERT INTO analysis_results(device_mac, suspected_server, connection_count, upload_bytes, download_bytes, time_distribution, packet_statistics, analysis_time) VALUES('00:1A:2B:3C:4D:5E', '203.0.113.1', 100, 10000000, 1000000, '{time_json}', '{packet_json}', CURRENT_TIMESTAMP). This detailed communication statistical analysis provides a quantitative basis for security response decisions.

[0094] The following describes a suspicious device identification system from the perspective of hardware processing in an embodiment of this invention. Please refer to [link / reference needed]. Figure 3 This is a schematic diagram of the structure of a suspicious device identification system in an embodiment of this application.

[0095] It should be noted that, Figure 3 The structure of the suspected device identification system shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments of the present invention.

[0096] like Figure 3 As shown, a suspicious device identification system includes a Central Processing Unit (CPU) 301, which can perform various appropriate actions and processes, such as executing the methods described in the above embodiments, based on a program stored in Read-Only Memory (ROM) 302 or a program loaded from storage portion 308 into Random Access Memory (RAM) 303. The RAM 303 also stores various programs and data required for system operation. The CPU 301, ROM 302, and RAM 303 are interconnected via a bus 304. An Input / Output (I / O) interface 305 is also connected to the bus 304.

[0097] The following components are connected to I / O interface 305: input section 306 including audio input devices, push-button switches, etc.; output section 307 including a liquid crystal display (LCD) and audio output devices, indicator lights, etc.; storage section 308 including a hard disk, etc.; and communication section 309 including a network interface card such as a LAN (Local Area Network) card, modem, etc. Communication section 309 performs communication processing via a network such as the Internet. Drive 310 is also connected to I / O interface 305 as needed. Removable media 311, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., are installed on drive 310 as needed so that computer programs read from them can be installed into storage section 308 as needed.

[0098] In particular, according to embodiments of the present invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of the present invention include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing computer programs for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 309, and / or installed from removable medium 311. When the computer program is executed by central processing unit (CPU) 301, it performs the various functions defined in the present invention.

[0099] It should be noted that specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), flash memory, optical fiber, portable compact disc read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this invention, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0100] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. Each block in a flowchart or block diagram may represent a module, segment, or portion of code, which contains one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those shown in the drawings.

[0101] Specifically, a suspicious device identification system according to this embodiment includes a processor and a memory. The memory stores a computer program. When the computer program is executed by the processor, it implements a suspicious device identification method provided in the above embodiment.

[0102] In another aspect, the present invention also provides a computer-readable storage medium, which may be included in a suspicious device identification system described in the above embodiments; or it may exist independently and not assembled into the suspicious device identification system. The storage medium carries one or more computer programs, which, when executed by a processor of the suspicious device identification system, cause the suspicious device identification system to implement the suspicious device identification method based on encrypted data transmission of the Internet of Things provided in the above embodiments.

Claims

1. A suspicious device determination method characterized by comprising: The method comprises: obtaining network traffic data of each terminal device accessing the hotel within a preset time period, the network traffic data comprising a media access control address, an uplink byte number, a downlink byte number and a connection duration; calculating a traffic ratio between uplink and downlink according to the uplink byte number and the downlink byte number of each terminal device, and screening candidate devices from each terminal device, the traffic ratio of which is greater than a preset first threshold value and the connection duration of which is greater than a preset second threshold value, to construct a candidate device set; obtaining state data of each room in the hotel within the preset time period, the state data comprising a room number and a check-out timestamp; establishing a binding relationship between the media access control address of each candidate device in the candidate device set and the room number thereof through the network topology relationship between each terminal device and each room; for each candidate device for which the binding relationship has been established, extracting a session record according to the check-out timestamp of the room corresponding to the candidate device, and obtaining an accumulated uplink byte number in the session record; when the accumulated uplink byte number is greater than a preset third threshold value, marking the corresponding candidate device as a suspicious device, and outputting the media access control address of the suspicious device and the bound room number.

2. The method of claim 1, wherein, The calculation of the traffic ratio between uplink and downlink according to the uplink byte number and the downlink byte number of each terminal device comprises: obtaining a start time and an end time of the preset time period; for each terminal device, calculating an initial uplink byte number and an initial downlink byte number at the start time and a final uplink byte number and a final downlink byte number at the end time based on the uplink byte number and the downlink byte number; determining an uplink byte number increment value according to the difference between the final uplink byte number and the initial uplink byte number; determining a downlink byte number increment value according to the difference between the final downlink byte number and the initial downlink byte number; dividing the uplink byte number increment value by the downlink byte number increment value to obtain the traffic ratio between uplink and downlink of the corresponding terminal device.

3. The method of claim 1, wherein, The establishment of the binding relationship between the media access control address of each candidate device in the candidate device set and the room number thereof through the network topology relationship between each terminal device and each room comprises: receiving signal strength data of each network access point in the hotel, the signal strength data comprising an access point identifier and a signal coverage range; obtaining room distribution information of the hotel, the room distribution information comprising a room number and a network access point deployment position of each room; constructing an association mapping table of network access points and rooms according to the mapping relationship between the signal coverage range and the network access point deployment position; detecting the signal strength when a candidate device in the candidate device set accesses a network; comparing the signal strength with the signal coverage range to determine the network access point to which the candidate device is connected; Based on the association mapping table, a target room corresponding to a network access point connected by the candidate device is matched, and a media access control address of the candidate device is bound with a room number of the target room, so as to determine a binding relationship between the media access control address of each candidate device in the candidate device set and a room number.

4. The method of claim 3, wherein, The comparison of the signal strength and the signal coverage range to determine the network access point connected by the candidate device comprises: According to the signal strength, signal strength samples of each network access point received by the corresponding candidate device at different time points are extracted to construct a signal strength matrix; Fast Fourier transform is performed on the signal strength matrix to obtain signal spectrum characteristics, and based on the spectrum characteristics, signal fluctuation period and amplitude characteristics of each network access point are extracted; The signal fluctuation period and amplitude characteristics of each network access point are weighted and fused to obtain a stability coefficient of the signal of each network access point; The network access point with a stability coefficient greater than a preset stability threshold is taken as the network access point connected by the candidate device.

5. The method of claim 1, wherein, The extraction of the session record according to the check-out timestamp of the room corresponding to the candidate device, and the obtaining of the cumulative uplink byte number in the session record comprise: The check-out timestamp corresponding to the candidate device is obtained from the binding relationship; The network traffic data is traversed to filter out a plurality of session segments with a media access control address matching the candidate device and a session timestamp later than the check-out timestamp, and each session segment is combined into a session record according to a preset time sequence; The uplink byte number of each session segment is extracted from the session record; The uplink byte numbers of each session segment are accumulated and summed to obtain the cumulative uplink byte number of the session record.

6. The method of claim 1, wherein, After outputting the media access control address of the suspicious device and the bound room number, the method further comprises: Generating security warning information containing the media access control address of the suspicious device, the bound room number, the cumulative uplink byte number and the detection time, and pushing the security warning information to the security management platform of the hotel; Receiving a disposal instruction returned by the security management platform of the hotel; According to the disposal instruction, obtaining a target network address list accessed by the suspicious device within the preset time period; Performing security analysis on the target network address list to obtain a security analysis result; When the security analysis result is to identify a suspicious external server address, triggering a network isolation operation to disconnect the network connection between the suspicious device and the hotel.

7. The method of claim 6, wherein, The security analysis on the target network address list to obtain a security analysis result comprises: Extracting IP address and domain name information of the target network address from the target network address list; Calling a preset threat intelligence database interface to query behavior records corresponding to the IP address and the domain name information, and comparing the behavior records with a preset malicious behavior template library; When malicious behavior is detected in the behavior records, marking the IP address and the domain name information as a suspicious external server address; Count the number of communications and the total amount of data transmission between the suspicious device and the suspicious external server address, and generate a security analysis result.

8. A suspicious device determination system, characterized by, The suspicious device determination system comprises one or more processors and a memory; the memory is coupled with the one or more processors; the memory is configured to store computer program codes, the computer program codes comprise computer instructions, and the one or more processors invoke the computer instructions to enable the suspicious device determination system to perform the method according to any one of claims 1-7.

9. A computer-readable storage medium comprising instructions, characterized in that, When the instructions run on the suspicious device determination system, the suspicious device determination system is enabled to perform the method according to any one of claims 1-7.

10. A computer program product, characterised in that, When the computer program product runs on the suspicious device determination system, the suspicious device determination system is enabled to perform the method according to any one of claims 1-7. When the computer program product runs on the suspicious device determination system, the suspicious device determination system is enabled to perform the method according to any one of claims 1-7.

Images