Method and system for identifying sustainable Internet of Things equipment based on traffic time sequence characteristics
By using a deep learning model based on traffic time-series features and a continuous comparative learning framework, the problem of insufficient accuracy and efficiency in IoT device identification is solved. It achieves accurate classification of newly added devices and continuous identification of known devices, and is suitable for scenarios where devices are constantly being added.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- HUAZHONG UNIV OF SCI & TECH
- Filing Date
- 2026-03-06
- Publication Date
- 2026-05-01
AI Technical Summary
Existing IoT device identification technologies cannot balance accuracy and efficiency, and perform poorly when devices are added to a given scenario, lacking robustness and resulting in decreased identification accuracy.
We employ a deep learning model based on traffic time-series features, combined with a continuous contrastive learning framework. By capturing device traffic data packets to extract features, we build and update the model to adapt to new devices, and utilize a multi-head attention mechanism to optimize feature representation.
It achieves efficient and accurate IoT device identification, maintains the accuracy of identifying known devices even as more devices are added, and has good scalability and robustness.
Smart Images
Figure CN121967479A_ABST
Abstract
Description
A Sustainable IoT Device Identification Method and System Based on Traffic Time-Series Characteristics Technical Field
[0001] This invention relates to the field of Internet of Things (IoT) technology, and in particular to a sustainable IoT device identification method and system based on traffic time-series characteristics. Background Technology
[0002] IoT device identification, which involves passively analyzing network traffic to extract IoT device characteristics and accurately identify the model of IoT devices, is a prerequisite for realizing IoT device management, resource scheduling, and security protection.
[0003] The shortcomings of existing IoT device identification technologies are mainly reflected in three aspects. First, they cannot balance accuracy and efficiency. To ensure high identification accuracy, existing technologies often use complex statistical features, performing statistical analysis on all data packets within a fixed time window, resulting in significant computational overhead. Some technologies use lightweight features to improve identification efficiency, but the identification accuracy drops significantly. Second, existing technologies lack scalability, performing poorly in scenarios where IoT devices are continuously added. As more IoT devices are added, the identification model suffers from forgetting, failing to identify previously identifiable devices. Third, existing technologies lack robustness. Due to network issues, the network may capture some corrupted data packets, leading to a decrease in the identification accuracy of existing technologies. Therefore, there is an urgent need for an IoT device identification method that balances accuracy and efficiency, and possesses scalability and robustness. Summary of the Invention
[0004] This invention addresses the technical problems existing in the prior art by providing a sustainable IoT device identification method and system based on traffic temporal characteristics. It utilizes the temporal characteristics of traffic and a deep learning model to achieve efficient and accurate identification of IoT devices, and uses a continuous comparative learning framework to achieve sustainable IoT device identification. It accurately classifies newly added device types while maintaining the identification accuracy of known devices, and is applicable to scenarios where new device types are constantly being added to the network.
[0005] According to a first aspect of the present invention, a sustainable Internet of Things (IoT) device identification method based on traffic time-series features is provided, comprising: Step 1, capturing traffic data packets of IoT devices at set time intervals, extracting features from each traffic data packet to obtain time-series features, and constructing a dataset using the time-series features as data samples; Step 2, constructing an IoT device identification model, and training the IoT device identification model using the dataset to obtain an IoT device identification deployment model; Step 3, obtaining the time-series features of newly added IoT devices to obtain new data samples, combining the new data samples and the dataset to obtain a new dataset; using the parameters of the deployment model, continuously comparing and learning based on the new dataset to obtain an updated deployment model; Step 4, inputting the IoT device to be identified into the updated deployment model and outputting the identification result of the IoT device to be identified.
[0006] Based on the above technical solution, the present invention can also be improved as follows.
[0007] Optionally, the process of capturing traffic data packets from IoT devices at set time intervals in step 1 includes: setting the maximum length of the time series feature. And time windows, capture the previous time within each time window The aforementioned traffic data packets.
[0008] Optionally, the time series features are: ;in, This represents the sequence number of traffic data packets within a time window. For the first The traffic data packet and the first The time interval between traffic data packets , , and The first The length in bytes of each traffic data packet, the protocol type used, the source port, and the destination port.
[0009] Optionally, the process of training the IoT device identification model in step 2 includes: step 201, constructing a cross-entropy loss function based on the IoT device prediction results; step 202, after any round of training of the IoT device identification model, optimizing the parameters of the IoT device identification model using the Adam optimizer based on the value of the cross-entropy loss function; step 203, when the IoT device identification model converges or reaches the upper limit of the training rounds, saving the current parameters of the IoT device identification model to generate the deployment model.
[0010] Optionally, the cross-entropy loss function is: ;in, Indicates the first Does each device sample belong to the category? , Indicates the first Each sample belongs to category The probability, Indicates the number of samples. This indicates the number of device types.
[0011] Optionally, the process of obtaining new data samples in step 3 includes: randomly selecting a set number of data samples from each type of IoT device in the dataset as replay samples; and combining the new data samples and the replay samples to generate the new dataset.
[0012] Optionally, the IoT device identification model includes an encoder and a classifier; the process of obtaining the updated deployment model includes: retaining the parameters of the encoder of the deployment model, initializing and generating a new classifier to obtain the updated deployment model, and training the updated deployment model using the new dataset.
[0013] Optionally, step 3 includes: step 301, using data augmentation techniques to augment each batch in the new training set. Sample generate One enhanced sample Step 302: Each enhanced sample is sequentially fed into the encoder and projector to obtain the projected representation as follows: ;in, Let i represent the projected representation of the i-th sample. The parameter is The encoder, The parameter is Projection head; Step 303, construct a loss function by jointly using contrast loss and cross-entropy loss; optimize parameters by minimizing the loss function. and Step 304: After each training round, the Adam optimizer is used to optimize the parameters of the updated deployment model. When the updated deployment model converges or reaches the upper limit of the training rounds, the current parameters are saved to generate the updated deployment model.
[0014] Optionally, the loss function is calculated as follows: ;in, The cross-entropy loss function; For asymmetric supervised contrastive loss function; Indicates weight; The calculation formula is: ;in, This indicates the index of the IoT devices in this batch. It's a temperature over-parameter. Indicates information about anchor point samples The set of positive sample indexes.
[0015] According to a second aspect of the present invention, a sustainable IoT device identification system based on traffic time-series features is provided, comprising: a dataset construction module, a deployment model training module, an updated deployment model training module, and an output module; the dataset construction module is used to capture traffic data packets of IoT devices at set time intervals, extract time-series features from each traffic data packet, and construct a dataset using the time-series features as data samples; the deployment model training module is used to construct an IoT device identification model, and train the IoT device identification model using the dataset to obtain an IoT device identification deployment model; the updated deployment model training module is used to obtain new data samples by acquiring the time-series features of newly added IoT devices, and combine the new data samples and the dataset to obtain a new dataset; using the parameters of the deployment model, continuously compare and learn based on the new dataset to obtain an updated deployment model; the output module is used to input the IoT device to be identified into the updated deployment model and output the identification result of the IoT device to be identified.
[0016] This invention provides a sustainable IoT device identification method and system based on traffic temporal features, with the following advantages: Highly efficient and accurate device identification: This invention only needs to extract a small amount of temporal features from a portion of data packets in the network flow, greatly reducing storage and computational overhead. Identification can begin after capturing a certain number of data packets, improving model identification efficiency. Furthermore, it fully utilizes the contextual relationships of traffic temporal features to characterize device traffic features, improving the accuracy of IoT device identification. Strong model scalability: This invention introduces a continuous contrastive learning framework, using newly added data after model deployment to continuously update the model and optimize device feature representation. It can continuously learn to acquire the ability to identify new devices while maintaining the ability to identify known devices, avoiding catastrophic forgetting. Therefore, it is suitable for scenarios where new devices are continuously added, exhibiting good scalability. High model robustness: This invention utilizes a multi-head attention mechanism to simultaneously capture global and local features, and employs contrastive learning to optimize device feature representation, improving model robustness. Attached Figure Description
[0017] Figure 1 is a flowchart of a sustainable IoT device identification method based on traffic time-series features provided in an embodiment of the present invention; Figure 2 is a schematic diagram of the IoT device classification performance of the identification method provided in an embodiment of the present invention on the UNSW dataset; Figure 3 is a schematic diagram comparing the classification performance of the identification method provided in an embodiment of the present invention with that of existing technologies on the UNSW and Yourthings datasets; Figure 4(a) is a schematic diagram comparing the identification and classification accuracy of the identification method provided in an embodiment of the present invention with that of existing technologies after adding new device types on the UNSW dataset; Figure 4(b) is a schematic diagram comparing the identification and classification accuracy of the identification method provided in an embodiment of the present invention with that of existing technologies after adding new device types. Figure 5(a) is a schematic diagram comparing the recognition accuracy of the model on the Yourthings dataset after each round of updates in the scenario where new devices are continuously added to the network, and the existing technology provided by the embodiment of the present invention. Figure 5(b) is a schematic diagram comparing the recognition accuracy of the model on the newly added devices after each round of updates in the scenario where new devices are continuously added to the network, and the existing technology provided by the embodiment of the present invention. Figure 5(c) is a schematic diagram comparing the recognition accuracy of the model on the overall devices after each round of updates in the scenario where new devices are continuously added to the network, and the existing technology provided by the embodiment of the present invention. Detailed Implementation
[0018] The principles and features of the present invention are described below with reference to the accompanying drawings. The examples given are only for explaining the present invention and are not intended to limit the scope of the present invention.
[0019] The following is an explanation and description of the technical terminology used in this invention: Internet of Things (IoT) Device Identification: In the Internet of Things (IoT) system, this is the technical process of determining and distinguishing the type, model, manufacturer, and functional attributes of devices accessing the network based on their inherent characteristics, communication behavior, or identification information. Its core objective is to achieve accurate perception, identity verification, and full lifecycle management of IoT terminal devices, providing fundamental support for device access control, data security protection, network resource scheduling, and application scenario adaptation.
[0020] Traffic time-series characteristics: refer to the regularity, volatility and correlation of network traffic and other objects in the time dimension. It is the extraction and representation of the inherent attributes of traffic in the process of changing over time. The core characteristic dimensions in this invention include: the time interval between the arrival of the previous data packet, the length of the data packet in bytes, the protocol type used, the source port number, and the destination port number.
[0021] Forgetting phenomenon: After model deployment, as the types of IoT devices continue to increase and new devices continuously connect to the network, the model needs to be retrained or its parameters updated to adapt to the new devices. When learning the feature representations of new devices, the parameters that previously stored the features of old devices are overwritten. In other words, the feature knowledge used to identify old devices is forgotten. This makes it difficult for the model to accurately identify old devices that it could previously identify normally after it has the ability to identify new devices, resulting in a significant decline in recognition accuracy.
[0022] Continuous Comparative Learning Framework: A machine learning architecture that integrates continuous learning and comparative learning paradigms. It aims to enable models to continuously learn from dynamic data streams or incremental tasks, while mitigating the problem of catastrophic forgetting. Its core is to build robust feature representations through comparative learning mechanisms, taking into account both knowledge stability and plasticity for new tasks.
[0023] Sample replay: A core technique in continuous learning used to mitigate catastrophic forgetting. It refers to a strategy of periodically recalling and reusing representative samples from historical tasks when the model is learning new tasks or incremental data, and using them together with new samples for training.
[0024] Encoder: A module that transforms input data (such as text, images, and raw samples) into compact and representative feature vectors or encoded sequences. Its core function is to extract key information from the input data and reduce its dimensionality, providing effective data support for subsequent tasks.
[0025] Projection head: A key component in deep learning self-supervised learning frameworks, typically serially connected after the encoder, it is a non-linear transformation module that performs feature space mapping and alignment. Its core function is to project the high-dimensional representation vector output by the encoder onto a lower-dimensional, more discriminative target feature space to meet the loss calculation requirements of downstream tasks such as comparative learning.
[0026] The flowchart of a sustainable IoT device identification method based on traffic time-series features provided in this embodiment of the invention is shown in Figure 1. The identification method includes: Step 1, capturing traffic data packets of IoT devices at set time intervals, extracting features from each traffic data packet to obtain time-series features, and constructing a dataset using the time-series features as data samples.
[0027] Step 2: Construct an IoT device identification model and train the IoT device identification model using the dataset to obtain an IoT device identification deployment model.
[0028] Step 3: Obtain the time series features of the newly added IoT devices to obtain new data samples. Combine the new data samples and the dataset to obtain a new dataset. Utilize the parameters of the deployment model and continuously compare and learn based on the new dataset to obtain an updated deployment model.
[0029] Step 4: Input the IoT device to be identified into the updated deployment model to obtain the identification result of the IoT device to be identified.
[0030] In practice, the updated deployment model is redeployed after a successful update, so that the updated deployment model has the ability to identify IoT devices, while maintaining the ability to identify known devices.
[0031] This invention provides a sustainable IoT device identification method based on traffic temporal characteristics. It utilizes the temporal characteristics of traffic and a deep learning model to achieve efficient and accurate identification of IoT devices. It also uses a continuous contrastive learning framework to achieve sustainable IoT device identification, accurately classifying newly added device types and maintaining the identification accuracy of known devices. The model can be continuously updated by acquiring data from newly added IoT devices, enabling the model to maintain efficient and accurate identification capabilities in scenarios where devices are constantly joining the network.
[0032] Embodiment 1 provided by the present invention is an embodiment of a sustainable IoT device identification method based on traffic time-series features provided by the present invention. As shown in Figure 1, the embodiment of the identification method includes: Step 1, capturing traffic data packets of IoT devices at set time intervals, extracting features from each traffic data packet to obtain time-series features, and constructing a dataset using the time-series features as data samples.
[0033] In one possible embodiment, step 1, which involves capturing traffic data packets from IoT devices at set time intervals, includes setting the maximum length of the time series feature. And time windows, capture the previous time within each time window Each data packet.
[0034] In practice, the size of the time window The minimum time window can be divided based on network demand. Insufficient traffic data packets within any given time window. If a time window is reached, all data packets within that time window will be captured.
[0035] In one possible implementation, the time series characteristics are: .
[0036] in, This represents the sequence number of traffic data packets within a time window. For the first The traffic data packet and the first The time interval between traffic data packets , , and The first The length in bytes of each traffic data packet, the protocol type used, the source port, and the destination port.
[0037] Among them, the time interval of the first traffic data packet Set it to 0.
[0038] In the specific implementation process, the features of each traffic data packet in the window are extracted in sequence to form time series features, and the time series features of each device type within a time window are used as a sample.
[0039] Step 2: Construct an IoT device identification model and train the IoT device identification model using the dataset to obtain an IoT device identification deployment model.
[0040] In one possible embodiment, the process of training the IoT device identification model in step 2 includes: step 201, constructing a cross-entropy loss function based on the IoT device prediction results.
[0041] Step 202: After any round of training of the IoT device identification model, the parameters of the IoT device identification model are optimized using the Adam optimizer based on the value of the cross-entropy loss function. In specific implementation, the dataset can also be divided into a training set and a test set according to a set ratio, such as 7:3. After optimizing the parameters of the IoT device identification model, the accuracy of the model on the test set is calculated, and the optimization effect can be provided in real time.
[0042] Step 203: When the IoT device identification model converges or reaches the upper limit of the training rounds, save the parameters of the current IoT device identification model to generate a deployment model.
[0043] In practice, after obtaining the optimal model parameters for the IoT device identification deployment model, the optimal model parameters are saved and deployed.
[0044] In one possible implementation, the cross-entropy loss function is: .
[0045] in, Indicates the first Does each device sample belong to the category? ( (Use 0 and 1 to represent yes and no) Indicates the first Each sample belongs to category The probability, Indicates the number of samples. This indicates the number of device types.
[0046] Step 3: Obtain the time series features of the newly added IoT devices to obtain new data samples. Combine the new data samples and the dataset to obtain a new dataset. Utilize the parameters of the deployment model and continuously compare and learn based on the new dataset to obtain an updated deployment model.
[0047] In one possible embodiment, the process of obtaining new data samples in step 3 includes: in a specific implementation, collecting tagged data samples from IoT devices after the deployment model is deployed.
[0048] A predetermined number of data samples are randomly selected from each type of IoT device in the dataset as replay samples; in specific implementations, samples can be drawn from each device type. One sample is used as a replay sample.
[0049] The new dataset is generated by combining the new data samples and the replay samples.
[0050] In one possible embodiment, the IoT device identification model includes an encoder and a classifier; the process of obtaining the updated deployment model includes: retaining the parameters of the encoder of the deployment model, initializing and generating a new classifier, obtaining the updated deployment model, and training the updated deployment model using the new dataset.
[0051] In practice, the output dimension of the newly generated classifier is kept consistent with the added device categories.
[0052] In one possible embodiment, step 3 includes: step 301, using data augmentation techniques to augment each batch in the new training set. Sample generate One enhanced sample .
[0053] In practice, this data augmentation technique includes, but is not limited to, methods such as pruning the beginning and end of a time series, randomly adding perturbations, and adversarial generation.
[0054] For the first in this batch Sample Two enhanced versions were generated. and ,in .
[0055] Step 302: Each enhanced sample is sequentially fed into the encoder and projector to obtain the projected representation as follows: .
[0056] in, Let i represent the projected representation of the i-th sample. The parameter is The encoder, The parameter is Projector head; This represents the feature mapping function.
[0057] Step 303: Construct a loss function by jointly using the contrastive loss and the cross-entropy loss; optimize the parameters by minimizing the loss function. and .
[0058] Step 304: After each training round, the Adam optimizer is used to optimize the parameters of the updated deployment model. When the updated deployment model converges or reaches the upper limit of the training rounds, the current parameters are saved to generate the updated deployment model.
[0059] In one possible implementation, the loss function is calculated as follows: .
[0060] in, The cross-entropy loss function; For asymmetric supervised contrastive loss function; Indicates the weight.
[0061] The calculation formula is: .
[0062] in, This indicates the index of the IoT devices in this batch. It's a temperature over-parameter. Indicates information about anchor point samples The set of positive sample indices is defined as: .
[0063] Step 4: Input the IoT device to be identified into the updated deployment model to obtain the identification result of the IoT device to be identified.
[0064] Example 2 Example 2 provided by the present invention is an embodiment of a sustainable IoT device identification system based on traffic time-series characteristics. Figure 2 is a structural diagram of a sustainable IoT device identification system based on traffic time-series characteristics provided by the present invention. As can be seen from Figure 2, the embodiment of the identification system includes: a dataset construction module, a deployment model training module, an updated deployment model training module, and an output module.
[0065] The dataset construction module is used to capture traffic data packets from IoT devices at set time intervals, extract time series features from each traffic data packet, and construct a dataset using the time series features as data samples.
[0066] The deployment model training module is used to build an IoT device identification model. The IoT device identification model is trained using a dataset to obtain an IoT device identification deployment model.
[0067] The updated deployment model training module is used to obtain the time series features of newly added IoT devices to obtain new data samples. The new data samples and the dataset are combined to obtain a new dataset. Using the parameters of the deployment model, the updated deployment model is obtained by continuous comparative learning based on the new dataset.
[0068] The output module is used to input the IoT device to be identified into the updated deployment model and output the identification result of the IoT device to be identified.
[0069] It is understood that the sustainable IoT device identification system based on traffic time-series characteristics provided by the present invention corresponds to the sustainable IoT device identification method based on traffic time-series characteristics provided in the foregoing embodiments. The relevant technical features of the sustainable IoT device identification system based on traffic time-series characteristics can be referred to the relevant technical features of the sustainable IoT device identification method based on traffic time-series characteristics, and will not be repeated here.
[0070] Figure 2 is a schematic diagram illustrating the IoT device classification performance of the identification method provided in this embodiment of the invention on the UNSW dataset. Figure 3 is a comparative schematic diagram of the classification performance of the identification method provided in this embodiment of the invention and existing technologies on the UNSW and Yourthings datasets, where SeriesIoT represents the identification result of the identification method provided in this embodiment of the invention. Figures 4(a) and 4(b) are schematic diagrams comparing the identification and classification accuracy of the identification method provided in this embodiment of the invention and existing technologies on the UNSW and Yourthings datasets, respectively, after adding new device types. Figure 5(a) is a schematic diagram of the identification accuracy of the model for known devices after each round of updates in the scenario where new devices are continuously added to the network, compared with existing technologies. Figure 5(b) is a schematic diagram of the identification accuracy of the model for new devices after each round of updates in the scenario where new devices are continuously added to the network, compared with existing technologies. Figure 5(c) is a schematic diagram of the identification accuracy of the model for the overall number of devices after each round of updates in the scenario where new devices are continuously added to the network, compared with existing technologies. Figures 2-5(c) demonstrate that the identification method provided by the embodiments of the present invention can achieve efficient and accurate identification of IoT devices, and utilize a continuous contrastive learning framework to achieve sustainable IoT device identification, accurately classify new device types, and maintain the identification accuracy of known devices. It is applicable to scenarios where new device types are constantly being added to the network.
[0071] This invention provides a sustainable IoT device identification method and system based on traffic temporal features. Its purpose is to efficiently and accurately identify IoT devices, maintaining good identification capabilities for both newly added and known devices in scenarios where devices are continuously joining the network. The IoT device identification method uses traffic temporal features to mine device behavior patterns. By analyzing only a portion of data packets within a time window, it extracts a few lightweight features to achieve efficient and accurate identification of IoT devices. It employs a continuous contrastive learning framework, utilizing sample replay and contrastive loss to incrementally update the model with new device data after model deployment, improving model update efficiency and maintaining the model's ability to identify both newly added and known devices. Furthermore, it utilizes a multi-head attention mechanism to simultaneously capture global and local features, and employs contrastive learning to optimize device feature representation, improving model robustness.
[0072] This invention provides a sustainable IoT device identification method and system based on traffic temporal features, with the following advantages: Highly efficient and accurate device identification: This invention only needs to extract a small amount of temporal features from a portion of data packets in the network flow, greatly reducing storage and computational overhead. Identification can begin after capturing a certain number of data packets, improving model identification efficiency. Furthermore, it fully utilizes the contextual relationships of traffic temporal features to characterize device traffic features, improving the accuracy of IoT device identification. Strong model scalability: This invention introduces a continuous contrastive learning framework, using newly added data after model deployment to continuously update the model and optimize device feature representation. It can continuously learn to acquire the ability to identify new devices while maintaining the ability to identify known devices, avoiding catastrophic forgetting. Therefore, it is suitable for scenarios where new devices are continuously added, exhibiting good scalability. High model robustness: This invention utilizes a multi-head attention mechanism to simultaneously capture global and local features, and employs contrastive learning to optimize device feature representation, improving model robustness.
[0073] It should be noted that the descriptions of each embodiment in the above embodiments have different focuses. For parts that are not described in detail in a certain embodiment, please refer to the relevant descriptions in other embodiments.
[0074] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.
[0075] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in one or more blocks of the flowchart illustrations and / or one or more blocks of the block diagrams.
[0076] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means that implement the functions specified in one or more flowcharts and / or one or more block diagrams.
[0077] These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process, such that the instructions, which execute on the computer or other programmable apparatus, provide steps for implementing the functions specified in one or more flowcharts and / or one or more block diagrams.
[0078] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including both the preferred embodiments and all changes and modifications falling within the scope of the invention.
[0079] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.
Claims
1. A sustainable IoT device identification method based on traffic time-series characteristics, characterized in that, The identification method includes: Step 1, capturing traffic data packets of IoT devices at set time intervals, extracting features from each traffic data packet to obtain time-series features, and constructing a dataset using the time-series features as data samples; Step 2, constructing an IoT device identification model, and training the IoT device identification model using the dataset to obtain an IoT device identification deployment model; Step 3, obtaining the time-series features of newly added IoT devices to obtain new data samples, combining the new data samples and the dataset to obtain a new dataset; using the parameters of the deployment model, continuously comparing and learning based on the new dataset to obtain an updated deployment model; Step 4, inputting the IoT device to be identified into the updated deployment model and outputting the identification result of the IoT device to be identified.
2. The identification method according to claim 1, characterized in that, The process of capturing traffic data packets from IoT devices at set time intervals in step 1 includes: setting the maximum length of the time series feature. And time windows, capture the previous time within each time window The aforementioned traffic data packets.
3. The identification method according to claim 2, characterized in that, The time series features are: ;in, This represents the sequence number of traffic data packets within a time window. For the first The traffic data packet and the first The time interval between traffic data packets 、 、 and The first The length in bytes of each traffic data packet, the protocol type used, the source port, and the destination port.
4. The identification method according to claim 1, characterized in that, The process of training the IoT device identification model in step 2 includes: step 201, constructing a cross-entropy loss function; step 202, after training the IoT device identification model in any round, optimizing the parameters of the IoT device identification model using the Adam optimizer based on the value of the cross-entropy loss function; step 203, when the IoT device identification model converges or reaches the upper limit of the training rounds, saving the current parameters of the IoT device identification model to generate the deployment model.
5. The identification method according to claim 4, characterized in that, The cross-entropy loss function is: ;in, Indicates the first Does each device sample belong to the category? ， Indicates the first Each sample belongs to category The probability, Indicates the number of samples. This indicates the number of device types.
6. The identification method according to claim 1, characterized in that, The process of obtaining new data samples in step 3 includes: randomly selecting a set number of data samples from each type of IoT device in the dataset as replay samples; and combining the new data samples and the replay samples to generate the new dataset.
7. The identification method according to claim 1, characterized in that, The IoT device identification model includes an encoder and a classifier; the process of obtaining the updated deployment model includes: retaining the parameters of the encoder of the deployment model, initializing and generating a new classifier to obtain the updated deployment model, and training the updated deployment model using the new dataset.
8. The identification method according to claim 1, characterized in that, Step 3 includes: Step 301, using data augmentation techniques to augment each batch in the new training set. Sample generate One enhanced sample Step 302: Each enhanced sample is sequentially fed into the encoder and projector to obtain the projected representation as follows: ;in, Let i represent the projected representation of the i-th sample. The parameter is The encoder, The parameter is Projection head; Step 303, construct a loss function by jointly using contrast loss and cross-entropy loss; optimize parameters by minimizing the loss function. and Step 304: After each training round, the Adam optimizer is used to optimize the parameters of the updated deployment model. When the updated deployment model converges or reaches the upper limit of the training rounds, the current parameters are saved to generate the updated deployment model.
9. The identification method according to claim 8, characterized in that, The loss function is calculated as follows: ;in, The cross-entropy loss function; For asymmetric supervised contrastive loss function; Indicates weight; The calculation formula is: ;in, This indicates the index of the IoT devices in this batch. It's a temperature over-parameter. Indicates information about anchor point samples The set of positive sample indexes.
10. A sustainable IoT device identification system based on traffic time-series characteristics, characterized in that, The identification system includes: a dataset construction module, a deployment model training module, an updated deployment model training module, and an output module. The dataset construction module is used to capture traffic data packets from IoT devices at set time intervals, extract time-series features from each traffic data packet, and construct a dataset using these time-series features as data samples. The deployment model training module is used to construct an IoT device identification model and train the IoT device identification model using the dataset to obtain an IoT device identification deployment model. The updated deployment model training module is used to obtain new data samples by acquiring the time-series features of newly added IoT devices, and combine the new data samples with the dataset to obtain a new dataset. Using the parameters of the deployment model, an updated deployment model is obtained through continuous comparative learning based on the new dataset. The output module is used to input the IoT device to be identified into the updated deployment model and output the identification result of the IoT device to be identified.