Internet of Things equipment identification system and method based on large language model

Abstract

The invention provides an Internet of Things equipment identification system and method based on a large language model, and relates to the technical field of large language models, and the system comprises a feature extraction module which is configured to obtain network traffic training data of Internet of Things equipment; extracting key feature information in a message header of the network traffic training data; the template construction module is configured to construct a structured template; the embedding module is configured to input the structured template into a large language model to generate a target semantic embedding feature; the output module is configured to construct a multi-layer perceptron classifier, and perform training by using the target semantic embedding features to obtain a target multi-layer perceptron classifier; and inputting the network flow data into the target multi-layer perceptron classifier to obtain an equipment type identification result of the to-be-tested Internet of Things equipment, so as to solve the problems that the current Internet of Things equipment identification technology is easily influenced by environmental factors, and the application range is limited; and the problem that key features are easy to omit due to the dependence on manual screening and feature construction is solved.

Description

Technical Field

[0001] This application relates to the field of large language model technology, and in particular to an Internet of Things (IoT) device identification system and method based on a large language model. Background Technology

[0002] In recent years, with the rapid development of IoT technology, the demand for IoT devices in key areas such as smart homes, smart cities, and industrial manufacturing has exploded. However, IoT devices generally suffer from problems such as limited functionality, resource constraints, and weak security mechanisms, leaving a large number of devices exposed to cyberattacks. Attackers can forge legitimate device identities to access the network and carry out malicious acts such as data theft and device hijacking, seriously threatening network security and the stability of device management. Therefore, accurate identification of IoT device identities and real-time monitoring of device behavior have become core requirements for ensuring the secure operation of large-scale IoT environments.

[0003] Currently, IoT device identification technologies are mainly divided into two categories: one is identification methods based on hardware physical characteristics, which achieve identification by extracting the device's hardware fingerprint (such as radio frequency signal characteristics, circuit noise, etc.); the other is identification methods based on network traffic characteristics, which build identification models by analyzing features such as protocol type, data packet size, and timing patterns in device communication traffic. Among these, network traffic-based methods are gradually becoming the mainstream research direction due to their high stability and scalability. These methods typically rely on manual feature selection and construction, combined with machine learning or deep learning models to achieve device classification. Some studies have also introduced features engineering optimization and lightweight model design techniques to improve identification efficiency.

[0004] However, hardware-based methods are susceptible to environmental interference (such as temperature and electromagnetic noise), limiting their applicability. Traffic-based methods rely heavily on manual feature selection, easily overlooking crucial information, and the high-dimensionality of manually selected features leads to high computational complexity, resulting in significantly reduced generalization performance when dealing with heterogeneous devices or emerging protocols. Furthermore, these methods require continuous collection and processing of massive traffic data, and the feature extraction and model inference processes are time-consuming, making it difficult to meet the low-latency requirements for device identification in large-scale IoT environments. Summary of the Invention

[0005] This application provides an IoT device identification system and method based on a large language model to solve the technical problems of existing IoT device identification technologies being susceptible to environmental factors, having limited applicability, and mostly relying on manual screening and feature construction, which easily leads to the omission of key features.

[0006] The first aspect of this application provides an IoT device identification system based on a large language model, comprising: Feature extraction module, template construction module, embedding module, output module; The feature extraction module is configured as follows: Acquire network traffic training data from IoT devices; Extract key feature information from the packet headers of the network traffic training data; the key feature information includes: timestamp, MAC address, IP address, packet length, and protocol type; The template building module is configured as follows: Based on the key feature information, a structured template is constructed and the key feature information is filled into the placeholders corresponding to the structured template; the structured template is an input format that can be processed by a large language model; The embedded module is configured as follows: The filled structured template is input into the large language model to generate the first target semantic embedding feature; The output module is configured as follows: A multilayer perceptron classifier is constructed, and the multilayer perceptron classifier is trained using the first target semantic embedding features to obtain the target multilayer perceptron classifier. The network traffic data of the IoT device under test is input into the target multilayer perceptron classifier to obtain the device type identification result of the IoT device under test.

[0007] In some embodiments, the feature extraction module is further configured to: The network traffic training data was converted from pcapng format to pcap format using a network packet capture tool. Redundant or invalid network traffic training data information is removed from the network traffic training data.

[0008] In some embodiments, the feature extraction module is further configured to: Using a predetermined number of consecutive network traffic training data entries with the same MAC address as a sampling window, the network traffic training data is divided to construct device fingerprint samples; Extract key feature information from the message header within each sampling window of the device fingerprint sample.

[0009] In some embodiments, the feature extraction module is further configured to: The MAC address and IP address are perturbed using a hash salting mechanism.

[0010] In some embodiments, the structured template includes: a basic network feature template, a static network feature template, a network behavior feature template, an address identifier feature template, and a time-series traffic feature template; The basic network features include: timestamp, MAC address, IP address, packet length, and protocol type; the static network feature template includes: MAC address, IP address, packet length, and protocol type; the network behavior feature template includes: timestamp, packet length, and protocol type; the address identifier feature template includes: MAC address and IP address; and the time-series traffic feature template includes: timestamp and packet length.

[0011] In some embodiments, the embedding module is further configured to: The filled structured template is input into a large language model to generate semantic embedding features; Based on the semantic embedding features, the large language model is lightly fine-tuned using low-rank adaptation techniques to generate the first target semantic embedding features.

[0012] In some embodiments, the embedding module is further configured to: Obtain the weight matrix coefficients in the large language model; the weight matrix coefficients include: input feature dimension and output feature dimension; Based on the coefficients of the weight matrix, determine the rank constraint coefficients; Based on the weight matrix coefficients and the rank constraint coefficients, the low-rank update term is determined; Based on the aforementioned low-rank update term, determine the low-rank supplement term; Based on the low-rank complement and the semantic embedding feature, a first target semantic embedding feature is generated.

[0013] In some embodiments, the multilayer perceptron classifier is configured with an input layer, two hidden layers, and an output layer; the dimension of the input layer is consistent with the dimension of the output vector of the large language model; the dimension of the output layer is consistent with the number of IoT device categories; an activation function is applied after the hidden layer, and a Dropout layer with a preset dropout rate is added. The output module is further configured as follows: The first target semantic embedding feature is input into the multilayer perceptron classifier for training using the cross-entropy loss function to obtain the target multilayer perceptron classifier.

[0014] In some embodiments, the output module is further configured to: The network traffic data of the IoT device under test is input into the large language model to generate the second target semantic embedding feature; The second target semantic embedding feature is input into the target multilayer perceptron classifier to classify the second target semantic embedding feature and obtain the device type identification result of the IoT device under test.

[0015] The second aspect of this application provides a method for identifying IoT devices based on a large language model, applied to an IoT device identification system based on a large language model as described in any one of the first aspects above, comprising: Acquire network traffic training data from IoT devices; Extract key feature information from the packet headers of the network traffic training data; the key feature information includes: timestamp, MAC address, IP address, packet length, and protocol type; Based on the key feature information, a structured template is constructed and the key feature information is filled into the placeholders corresponding to the structured template; the structured template is an input format that can be processed by a large language model; The filled structured template is input into the large language model to generate the first target semantic embedding feature; A multilayer perceptron classifier is constructed, and the multilayer perceptron classifier is trained using the first target semantic embedding features to obtain the target multilayer perceptron classifier. The network traffic data of the IoT device under test is input into the target multilayer perceptron classifier to obtain the device type identification result of the IoT device under test.

[0016] This application provides an IoT device identification system and method based on a large language model. The system includes: a feature extraction module, a template construction module, an embedding module, and an output module. The feature extraction module is configured to: acquire network traffic training data of IoT devices; extract key feature information from the packet header of the network traffic training data; the key feature information includes: timestamp, MAC address, IP address, packet length, and protocol type. The template construction module is configured to: construct a structured template based on the key feature information and fill the key feature information into placeholders corresponding to the structured template; the structured template is an input format that can be processed by the large language model. The embedding module... The block is configured to: input the filled structured template into a large language model to generate a first target semantic embedding feature; the output module is configured to: construct a multilayer perceptron classifier and train the multilayer perceptron classifier using the first target semantic embedding feature to obtain a target multilayer perceptron classifier; input the network traffic data of the IoT device under test into the target multilayer perceptron classifier to obtain the device type identification result of the IoT device under test, so as to achieve the elimination of the need for manually designing complex traffic features, effectively reducing the dependence on domain knowledge; and only extracting the header information of the data packets, without the need for deep parsing of the payload content, reducing computational overhead and reducing the risk of privacy leakage. Attached Figure Description

[0017] To more clearly illustrate the technical solution of this application, the drawings used in the embodiments will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 This is a flowchart illustrating the runtime of the IoT device identification system based on a large language model in this application.

[0019] Explanation of reference numerals in the attached figures: 1-Feature extraction module; 2-Template construction module; 3-Embedding module; 4-Output module. Detailed Implementation

[0020] To enable those skilled in the art to better understand the technical solutions in this application, the technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this application.

[0021] For example, accurate identification of IoT devices is a crucial prerequisite for ensuring network security. Existing device identification methods are mainly divided into two categories: those based on hardware physical characteristics and those based on network traffic characteristics. Methods based on hardware physical characteristics are easily affected by environmental factors and have limited applicability. While methods based on network traffic characteristics are more stable and scalable, they mostly rely on manual feature selection and construction, heavily depending on researchers' domain prior knowledge. This makes them prone to missing key features, and high-dimensional manual features increase model computational complexity. They are also significantly affected by "feature drift" and lack generalization ability when facing heterogeneous devices and emerging protocols, making it difficult to meet the efficient identification needs in large-scale IoT environments. Processing massive amounts of traffic data and adjusting strategies consumes significant manpower and time, severely restricting the scalability and practical application effectiveness of related identification methods. Therefore, the current key lies in designing IoT device identification methods with strong generalization and high real-time performance.

[0022] To address the technical problems of IoT device identification technologies being susceptible to environmental factors and having limited applicability, and largely relying on manual feature selection and construction, which can easily lead to the omission of key features, this application provides an IoT device identification system and method based on a large language model. The IoT device identification system and method based on a large language model are described below: like Figure 1 The diagram shown is a flowchart of the IoT device identification system based on a large language model in this application during operation.

[0023] The first aspect of this application provides an IoT device identification system based on a large language model, comprising: Feature extraction module 1, template construction module 2, embedding module 3, output module 4.

[0024] The feature extraction module 1 is configured as follows: Acquire network traffic training data from IoT devices. A passive identification strategy is employed to collect network traffic training data from IoT devices in a non-intrusive manner.

[0025] Extract key feature information from the packet header of the network traffic training data; the key feature information includes: timestamp, MAC address, IP address, packet length, and protocol type.

[0026] For example, a timestamp records the specific point in time when a network event (such as packet sending, receiving, or capturing) occurs. A MAC address is the physical address of an IoT device, uniquely programmed into its network interface card (NIC). An IP address is the logical address of an IoT device, used to locate the device on the internet. Packet length is the size of the entire data packet (or frame) in bytes. The protocol type assists the receiver in parsing the data.

[0027] The feature extraction module 1 is further configured to: The network traffic training data was converted from pcapng format to pcap format using a network packet capture tool.

[0028] Specifically, the WireShark tool can be used to convert the original pcapng format network traffic training data into the standard pcap format, so that the large language model can parse the network traffic training data.

[0029] Redundant or invalid network traffic training data is removed from the network traffic training data. By removing redundant or invalid traffic information from the pcap format network traffic training data, communication data with practical analytical value is retained, laying the groundwork for subsequent training of the multilayer perceptron classifier and improving model training efficiency.

[0030] The feature extraction module 1 is further configured as follows: Using a preset number of consecutive network traffic training data entries with the same MAC address as a sampling window, the network traffic training data is divided to construct device fingerprint samples.

[0031] Extract key feature information from the message header within each sampling window of the device fingerprint sample.

[0032] Specifically, using the device's MAC address as a unique identifier, and taking 20 consecutive network traffic training data entries with the same MAC address as a sampling window, a device fingerprint is constructed. Five basic features—timestamp, MAC address, IP address, packet length, and protocol type—are extracted from the packet headers within this sampling window.

[0033] The feature extraction module 1 is further configured to: By using a hash salting mechanism to perturb the MAC address and the IP address, the truth value is prevented from being leaked during model training, address obfuscation is achieved, data privacy is improved, and data leakage is prevented during model training.

[0034] The template construction module 2 is configured as follows: Based on the key feature information, structured templates are constructed, and the key feature information is filled into the placeholders corresponding to the structured templates. The structured templates are input formats that can be processed by large language models. The structured templates include: basic network feature templates, static network feature templates, network behavior feature templates, address identifier feature templates, and time-series traffic feature templates. By filling the key feature information into the placeholders corresponding to the structured templates, five types of structured templates are constructed. Based on the extracted key feature information, structured text templates are designed to transform device network behavior features into an input format that can be processed by large language models.

[0035] The basic network features include: timestamp, MAC address, IP address, packet length, and protocol type; the static network feature template includes: MAC address, IP address, packet length, and protocol type; the network behavior feature template includes: timestamp, packet length, and protocol type; the address identifier feature template includes: MAC address and IP address; and the time-series traffic feature template includes: timestamp and packet length.

[0036] The embedded module 3 is configured as follows: The padded structured template is input into the large language model to generate the first target semantic embedding feature; the padded structured template is input into the large language model to generate the first semantic embedding feature, and the large language model is lightly fine-tuned by zero-shot embedding and low-rank adaptation (LoRA) technique.

[0037] The embedded module 3 is further configured as follows: The filled structured template is input into a large language model to generate semantic embedding features.

[0038] In this embodiment, the Qwen3-Embedding-0.6B model is selected as the large language model. This model adds the [EOS] tag to the end of the input sequence and uses the hidden state vector corresponding to the tag in the last layer of the model as the semantic representation of the overall input sequence. The final output embedding vector (semantic embedding feature) has a dimension of 512.

[0039] First, a zero-shot strategy is used to test the natural adaptability of the pre-trained model to the IoT device identification task without additional adaptation. Based on the semantic embedding features, the large language model is lightly fine-tuned using low-rank adaptation technology to generate the first target semantic embedding features.

[0040] For example, a zero-shot strategy is adopted, that is, without updating any parameters of the pre-trained model, the semantic embedding of its output is directly used as the feature representation to test the natural adaptability of the pre-trained model to the IoT device identification task, and low-rank adaptation (LoRA) technique is introduced to perform lightweight fine-tuning of the embedding model.

[0041] The embedded module 3 is further configured as follows: Obtain the weight matrix coefficients in the large language model; the weight matrix coefficients include: input feature dimension and output feature dimension; determine the rank constraint coefficients based on the weight matrix coefficients; determine the low-rank update term based on the weight matrix coefficients and the rank constraint coefficients; determine the low-rank supplement term based on the low-rank update term; generate the first target semantic embedding feature based on the low-rank supplement term and the semantic embedding feature.

[0042] Specifically, the steps of low-rank adaptation technology are as follows: While keeping the parameters of the original pre-trained model (multilayer perceptron classifier) ​​frozen, a trainable low-rank matrix is ​​inserted into the partial linear transformation inside the model to minimize the amount of parameter updates while achieving task-specific performance adaptation of the model, thereby significantly reducing training overhead and the risk of overfitting.

[0043] Specifically, let a certain weight matrix in the pre-trained model be... .in, k The dimension of the input feature. d The dimension of the output feature. This represents one d OK k A real matrix of columns. When the input feature vector... When passed to this layer, the output result is equal to LoRA introduces a low-rank update term on this basis. ,in , and satisfy the rank constraint . B This represents the upprojection matrix in the low-rank update matrix, responsible for mapping low-dimensional features back to the original output dimension embedded by the IoT device. d ; A This represents the downprojection matrix in the low-rank update matrix, responsible for transforming the high-dimensional input features (dimensions) of the IoT device. k Compressing to a low dimension r is equivalent to dimensionality reduction to extract key features; r Then it is much smaller than d and k The rank of the low-rank matrix. During training, Remain unchanged, only for and The parameters in the table are updated. The corresponding forward propagation results are then updated. h It can be represented as: ; In the formula, LoRA will output the original data. (Semantic embedding features) and low-rank complements Element-by-element summation is performed to adjust and enhance the input.

[0044] The output module 4 is configured as follows: A multilayer perceptron classifier is constructed and trained using the first target semantic embedding feature to obtain a target multilayer perceptron classifier. The multilayer perceptron classifier is configured with one input layer, two hidden layers, and one output layer. The dimension of the input layer is consistent with the dimension of the output vector of the large language model; the dimension of the output layer is consistent with the number of IoT device categories; an activation function is applied after each hidden layer, and a Dropout layer with a preset dropout rate is added. By constructing a lightweight multilayer perceptron classifier, the optimized embedding feature (the first target semantic embedding feature) is used for model training and device type discrimination.

[0045] In this embodiment, a lightweight multilayer perceptron containing two hidden layers and one output layer is constructed. The input is a 512-dimensional embedded feature. The output dimension of the first hidden layer is 256, and that of the second layer is 128. The output dimension is consistent with the number of device categories. A ReLU activation function is applied after each hidden layer, and a Dropout layer with a dropout rate of 0.1 is added to alleviate overfitting.

[0046] The network traffic data of the IoT device under test is input into the target multilayer perceptron classifier to obtain the device type identification result of the IoT device under test.

[0047] For example, IoT device types include: Sensor devices: used to collect environmental or status data, such as temperature sensors, humidity sensors, light sensors, motion sensors, etc. Actuator devices: perform physical operations according to instructions, such as smart light bulbs, smart sockets, electronic locks, valve controllers, etc., enabling remote control of the equipment. Embedded smart devices: have built-in processors and operating systems, can connect to networks and run applications, including consumer electronics products such as smartphones, smart TVs, smart speakers, and smart refrigerators. In-vehicle devices: used in transportation vehicles, such as smart vehicles, in-vehicle navigation systems, in-vehicle diagnostic terminals, etc., to realize vehicle monitoring, navigation, and autonomous driving assistance functions. Industrial Internet of Things (IIoT) devices: specifically designed for industrial scenarios, such as factory machine sensors, industrial robots, smart meters, high-precision temperature tags, etc., used for monitoring production processes, predictive maintenance, and automated control.

[0048] The output module 4 is further configured as follows: The first target semantic embedding features are input into the multilayer perceptron classifier for training using the cross-entropy loss function to obtain the target multilayer perceptron classifier. The formula for the cross-entropy loss function is as follows: ; In the formula, N Indicates the number of samples; C Indicates the number of equipment categories; Indicates the first The true category of the nth sample is the nth Class, the rest are 0; For the model to determine if a sample belongs to the first... The predicted probability of a class.

[0049] The output module 4 is further configured as follows: The network traffic data of the IoT device under test is input into the large language model to generate a second target semantic embedding feature. This second target semantic embedding feature is then input into the target multilayer perceptron classifier to classify it, thereby obtaining the device type identification result of the IoT device under test. The second target semantic embedding feature is generated through the above steps; the generation process of the first target semantic embedding feature can be referred to, and will not be repeated here.

[0050] This application provides an IoT device identification system based on a large language model. It extracts packet header information from network traffic, constructs structured text templates, utilizes a large language model for semantic embedding representation, and combines fine-tuning techniques with a lightweight classifier to achieve device identification. This system, based on a large language model and machine learning techniques, eliminates the need for deep packet loading analysis, resulting in low computational overhead, high recognition accuracy, and strong generalization ability.

[0051] This application provides an IoT device identification system based on a large language model, which has the following advantages: 1. This application is based on the semantic modeling capability of a large language model, which eliminates the need for manual design of complex traffic features, effectively reduces the dependence on prior domain knowledge, avoids the performance degradation problem caused by "feature drift", and has stronger generalization ability.

[0052] 2. This application only extracts the header information of the data packet, without the need for deep parsing of the payload content, which reduces computational overhead and can reduce the risk of privacy leakage.

[0053] 3. This application has designed a variety of structured templates that can be flexibly adapted to different scenario requirements.

[0054] 4. This application uses a lightweight multilayer perceptron as the classifier, which has low computational cost and is relatively easy to deploy.

[0055] A second aspect of this application provides a method for identifying IoT devices based on a large language model, applied to an IoT device identification system based on a large language model as described in any of the above embodiments, comprising: Acquire network traffic training data from IoT devices; Extract key feature information from the packet headers of the network traffic training data; the key feature information includes: timestamp, MAC address, IP address, packet length, and protocol type; Based on the key feature information, a structured template is constructed and the key feature information is filled into the placeholders corresponding to the structured template; the structured template is an input format that can be processed by a large language model; The filled structured template is input into the large language model to generate the first target semantic embedding feature; A multilayer perceptron classifier is constructed, and the multilayer perceptron classifier is trained using the first target semantic embedding features to obtain the target multilayer perceptron classifier. The network traffic data of the IoT device under test is input into the target multilayer perceptron classifier to obtain the device type identification result of the IoT device under test.

[0056] It is worth noting that the effects of the above method embodiments can be found in the effects of the above system embodiments, and will not be repeated here.

[0057] The above detailed embodiments further illustrate the purpose, technical solution, and beneficial effects of the embodiments of this application. It should be understood that the above are merely specific embodiments of the embodiments of this application and are not intended to limit the protection scope of the embodiments of this application. Any modifications, equivalent substitutions, improvements, etc., made on the basis of the technical solutions of the embodiments of this application should be included within the protection scope of the embodiments of this application.

Claims

1. An IoT device identification system based on a large language model, characterized in that, include: Feature extraction module (1), template construction module (2), embedding module (3), output module (4); The feature extraction module (1) is configured as follows: Acquire network traffic training data from IoT devices; Extract key feature information from the packet headers of the network traffic training data; the key feature information includes: timestamp, MAC address, IP address, packet length, and protocol type; The template building module (2) is configured as follows: Based on the key feature information, a structured template is constructed and the key feature information is filled into the placeholders corresponding to the structured template; the structured template is an input format that can be processed by a large language model; The embedded module (3) is configured as follows: The filled structured template is input into the large language model to generate the first target semantic embedding feature; The output module (4) is configured as follows: A multilayer perceptron classifier is constructed, and the multilayer perceptron classifier is trained using the first target semantic embedding features to obtain the target multilayer perceptron classifier. The network traffic data of the IoT device under test is input into the target multilayer perceptron classifier to obtain the device type identification result of the IoT device under test.

2. The IoT device identification system based on a large language model according to claim 1, characterized in that, The feature extraction module (1) is further configured as follows: Using a predetermined number of consecutive network traffic training data entries with the same MAC address as a sampling window, the network traffic training data is divided to construct device fingerprint samples; Extract key feature information from the message header within each sampling window of the device fingerprint sample; The MAC address and IP address are perturbed using a hash salting mechanism.

3. The IoT device identification system based on a large language model according to claim 1, characterized in that, The structured templates include: basic network feature templates, static network feature templates, network behavior feature templates, address identifier feature templates, and time-series traffic feature templates; The basic network features include: timestamp, MAC address, IP address, packet length, and protocol type; the static network feature template includes: MAC address, IP address, packet length, and protocol type; the network behavior feature template includes: timestamp, packet length, and protocol type; the address identifier feature template includes: MAC address and IP address; and the time-series traffic feature template includes: timestamp and packet length.

4. The IoT device identification system based on a large language model according to claim 1, characterized in that, The embedded module (3) is further configured as follows: The filled structured template is input into a large language model to generate semantic embedding features; Based on the semantic embedding features, the large language model is lightly fine-tuned using low-rank adaptation techniques to generate the first target semantic embedding features.

5. The IoT device identification system based on a large language model according to claim 4, characterized in that, The embedded module (3) is further configured as follows: Obtain the weight matrix coefficients in the large language model; the weight matrix coefficients include: input feature dimension and output feature dimension; Based on the coefficients of the weight matrix, determine the rank constraint coefficients; Based on the weight matrix coefficients and the rank constraint coefficients, the low-rank update term is determined; Based on the aforementioned low-rank update term, determine the low-rank supplement term; Based on the low-rank complement and the semantic embedding feature, a first target semantic embedding feature is generated.

6. The IoT device identification system based on a large language model according to claim 1, characterized in that, The output module (4) is further configured as follows: The network traffic data of the IoT device under test is input into the large language model to generate the second target semantic embedding feature; The second target semantic embedding feature is input into the target multilayer perceptron classifier to classify the second target semantic embedding feature and obtain the device type identification result of the IoT device under test.

7. A method for identifying IoT devices based on a large language model, applied to an IoT device identification system based on a large language model as described in any one of claims 1 to 6, characterized in that, include: Acquire network traffic training data from IoT devices; Extract key feature information from the packet headers of the network traffic training data; The Key characteristic information includes: timestamp, MAC address, IP address, packet length, and protocol type; Based on the key feature information, a structured template is constructed and the key feature information is filled into the placeholders corresponding to the structured template; the structured template is an input format that can be processed by a large language model; The filled structured template is input into the large language model to generate the first target semantic embedding feature; A multilayer perceptron classifier is constructed, and the multilayer perceptron classifier is trained using the first target semantic embedding features to obtain the target multilayer perceptron classifier. The network traffic data of the IoT device under test is input into the target multilayer perceptron classifier to obtain the device type identification result of the IoT device under test.

Images