Router attribute identification method, device and equipment based on large language model

Abstract

The application relates to a router attribute identification method, device and equipment based on a large language model. The method comprises the following steps: obtaining normalized observation records formed by cleaning and standardizing service workpieces; calculating information quantity scores and performing sorting and screening; inputting selected high-information-quantity records into multiple identification intelligent agents for reasoning, outputting a structured result with an explicit evidence set, and generating a candidate record after fusion; constructing a retrieval query according to input data, obtaining relevant authoritative paragraphs from an external knowledge base as retrieval context, splicing to form an enhanced input, and integrating retrieval sources and time into an evidence space; performing multiple condition checks on the candidate record by a verification intelligent agent, and outputting a target structured record; constructing a data set according to the target record to train a student model, deploying the student model to perform large-scale reasoning, and upgrading to a teacher process for processing when the confidence is insufficient or the check fails. The method can reduce the large-scale reasoning cost and the router maintenance cost.

Description

Technical Field

[0001] This application relates to the field of Internet measurement and router identification technology, and in particular to a method, apparatus and device for router attribute identification based on a large language model. Background Technology

[0002] As a critical infrastructure of the Internet, routers' attributes, such as manufacturer, model, platform / operating system, and firmware version, are crucial for vulnerability management, attack surface monitoring, network operation and maintenance, and topology management. Although existing technologies include identification schemes based on active probing and fingerprint database matching—for example, obtaining service banners or handshake artifacts through port scanning and combining them with rule parsers to output tags—the following prominent problems remain: First, current identification processes generally rely on manually maintained fingerprint databases and rule templates. When faced with the rapid evolution of router manufacturers, models, and firmware versions, updates are lagging, maintenance costs are high, and coverage of long-tail devices is insufficient. Second, multi-port artifacts returned from Internet probing are often incomplete and noisy, frequently exhibiting inconsistencies across ports, missing fields, garbled characters, and a mix of templated redundant content, leading to unstable inferences based solely on single-port clues or fixed rules. Third, while large language models have been introduced in recent years for semantic inference of multi-port artifacts, directly performing one-time inference on the original artifacts easily produces outputs that "seem reasonable but lack observational evidence," and it is difficult to provide traceable evidence for each field, thus hindering engineering verification, long-term maintenance, and risk control. Summary of the Invention

[0003] Therefore, it is necessary to provide a router attribute identification method, apparatus, and device based on a large language model that can reduce the cost of large-scale inference and router maintenance, in order to address the above-mentioned technical problems.

[0004] A router attribute recognition method based on a large language model, the method comprising:

[0005] Actively probe the target address set using multiple ports to obtain service artifacts with multiple protocols or ports, clean and normalize the service artifacts, and generate normalized observation records.

[0006] Information content scores are calculated based on normalized observation records and then sorted and filtered to prioritize the observation records with high information content scores for in-depth identification within a given computational budget.

[0007] The selected observation records are normalized and compressed and used as input data for the large language model. Multiple recognition agents with different functions are invoked to reason about the router attribute fields and output a partially structured result containing candidate attribute values ​​and explicit evidence sets. The outputs of multiple recognition agents are merged to generate candidate structured records to trigger abstention when there is insufficient evidence.

[0008] Based on the input data, a retrieval query is constructed. Authoritative technical paragraphs related to the target device are retrieved from an external knowledge base as the retrieval context. The retrieval context is then concatenated with the input data to obtain augmented data. The retrieval source and collection time of the augmented data are incorporated into the evidence space to achieve evidence anchoring.

[0009] The verification agent performs pattern validity verification, evidence sufficiency verification, and cross-field consistency verification on the candidate structured records. For fields that do not meet the verification conditions, conservative correction or emptying is performed, and the target structured record is output.

[0010] A distillation training dataset is constructed based on the target structured records to train the student model. The student model learns the structured output and abstention behavior of the teacher process. During the deployment phase, the student model performs large-scale inference. When the confidence is insufficient or the consistency check fails, it triggers an upgrade to the teacher process to complete the identification and deployment of the router.

[0011] A router attribute recognition device based on a large language model, the device comprising:

[0012] The observation record generation module is used to actively probe the target address set through multiple ports to obtain service artifacts with multiple protocols or multiple ports, clean and normalize the service artifacts, and generate normalized observation records.

[0013] The record identification module is used to calculate information content scores based on normalized observation records and sort and filter them to prioritize the observation records with high information content scores for in-depth identification within a given calculation budget.

[0014] The reasoning module takes the selected observation records, after normalization and compression, as input data for the large language model, calls multiple functionally divided recognition agents to reason about the router attribute fields, and outputs a partially structured result containing candidate attribute values ​​and explicit evidence sets. It then merges the outputs of multiple recognition agents to generate candidate structured records, which can trigger abstention when there is insufficient evidence.

[0015] The data feature enhancement module is used to construct retrieval queries based on input data, retrieve authoritative technical paragraphs related to the target device from an external knowledge base as retrieval context, concatenate the retrieval context with the input data to obtain enhanced data, and incorporate the retrieval source and collection time of the enhanced data into the evidence space to achieve evidence anchoring.

[0016] The verification module is used by the verification agent to perform pattern validity verification, evidence sufficiency verification, and cross-field consistency verification on the candidate structured records. For fields that do not meet the verification conditions, conservative correction or emptying is performed, and the target structured record is output.

[0017] The identification and deployment module is used to construct a distillation training dataset based on the target structured records to train the student model. The student model learns the structured output and abstention behavior of the teacher process, and performs large-scale inference by the student model during the deployment phase. When the confidence is insufficient or the consistency check fails, it triggers an upgrade to the teacher process processing to complete the identification and deployment of the router.

[0018] A computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program performing the following steps:

[0019] Actively probe the target address set using multiple ports to obtain service artifacts with multiple protocols or ports, clean and normalize the service artifacts, and generate normalized observation records.

[0020] Information content scores are calculated based on normalized observation records and then sorted and filtered to prioritize the observation records with high information content scores for in-depth identification within a given computational budget.

[0021] The selected observation records are normalized and compressed and used as input data for the large language model. Multiple recognition agents with different functions are invoked to reason about the router attribute fields and output a partially structured result containing candidate attribute values ​​and explicit evidence sets. The outputs of multiple recognition agents are merged to generate candidate structured records to trigger abstention when there is insufficient evidence.

[0022] Based on the input data, a retrieval query is constructed. Authoritative technical paragraphs related to the target device are retrieved from an external knowledge base as the retrieval context. The retrieval context is then concatenated with the input data to obtain augmented data. The retrieval source and collection time of the augmented data are incorporated into the evidence space to achieve evidence anchoring.

[0023] The verification agent performs pattern validity verification, evidence sufficiency verification, and cross-field consistency verification on the candidate structured records. For fields that do not meet the verification conditions, conservative correction or emptying is performed, and the target structured record is output.

[0024] A distillation training dataset is constructed based on the target structured records to train the student model. The student model learns the structured output and abstention behavior of the teacher process. During the deployment phase, the student model performs large-scale inference. When the confidence is insufficient or the consistency check fails, it triggers an upgrade to the teacher process to complete the identification and deployment of the router.

[0025] The aforementioned router attribute recognition method, apparatus, and device based on a large language model first perform multi-port active probing on the target address to obtain the original service artifacts. Then, these responses, which contain garbled characters and redundancy, are cleaned and normalized to form a unified, normalized observation record. To address the computational efficiency issue at the internet scale, an information content scoring mechanism based on information entropy, text length, and field weights is introduced to sort and filter massive records, ensuring that high-information-content targets are prioritized for in-depth analysis within a limited budget, thus optimizing resource allocation. Next, the filtered high-value observation records are input into a reasoning module composed of multiple functionally differentiated recognition agents. Each agent works in parallel, parsing the text from different perspectives and forcibly outputting a partially structured result containing candidate attribute values ​​and an explicit evidence set. This evidence set explicitly records the source of supporting fragments (specific ports or external knowledge base retrieved segments) and reliability weights. Subsequently, the system performs evidence fusion and arbitration on the outputs of the multiple agents. When evidence is insufficient or conflicting, an abstention mechanism is proactively triggered to avoid generating unfounded speculative results, thereby effectively suppressing the "illusion" risk while utilizing the semantic capabilities of the large language model. Then, the candidate structured records generated from the initial fusion must be submitted to a dedicated verification agent for rigorous review. Verification includes pattern validity verification (conforming to a predefined format), evidence sufficiency verification (key fields have sufficient supporting evidence), and cross-field consistency verification (such as logical self-consistency in manufacturer, model, and version). For any field that fails verification, the system performs conservative correction or emptying to ensure a critical closed loop of auditability and engineering usability, ultimately outputting high-quality, trustworthy target structured records. Finally, to balance recognition quality and large-scale deployment costs, the solution employs a knowledge distillation and dynamic upgrade strategy. The high-quality target structured records produced are used to train a lightweight student model, enabling it to learn the reasoning and abstention patterns of complex teacher processes. During deployment, routine recognition tasks are efficiently handled by the student model; only when the student model outputs insufficient confidence or triggers preset risk rules does the system automatically upgrade the task to a complete teacher process for review. In summary, this achieves a balance between highly reliable recognition, auditable results, and controllable operating costs in internet-scale scenarios. Attached Figure Description

[0026] Figure 1 This is a diagram illustrating the overall architecture of a router attribute recognition method based on a large language model in one embodiment.

[0027] Figure 2 This is a flowchart illustrating a router attribute recognition method based on a large language model in one embodiment.

[0028] Figure 3 This is a flowchart illustrating a router fingerprinting method based on a large language model in one embodiment.

[0029] Figure 4 This is a structural diagram of an Internet-scale router attribute recognition device based on an evidence-center multi-agent teacher-student architecture in one embodiment.

[0030] Figure 5 This is a structural block diagram of a router attribute recognition device based on a large language model in one embodiment;

[0031] Figure 6 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0032] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0033] The router attribute recognition method based on a large language model provided in this application can be applied to, for example... Figure 1 The illustrated router attribute recognition system is based on a large language model. The overall system architecture includes an online recognition link and an offline construction link. The online recognition link handles real-time or batch target address inputs, including multi-port probing, cleaning and normalization, information content scoring and filtering, student model inference and upgrade determination, teacher-side multi-agent analysis, retrieval enhancement generation, and verification output. The student model is used to handle large-scale routine inference tasks to reduce costs. When the student model's confidence is insufficient, key field consistency checks fail, or preset risk rules are hit, the upgrade determination module upgrades the corresponding input to the teacher process to obtain more sufficient evidence and more rigorously verified outputs, thus achieving a balance between recognition quality and deployment cost. The offline construction link provides reproducible knowledge and model support for online recognition, including the collection and snapshot construction of publicly available external knowledge bases, paragraph indexing and source information management, distillation training data construction, student model distillation training, and release updates. External knowledge base snapshots provide authoritative paragraph sources for enhanced retrieval and support tracing and verification through information such as source identifiers and collection time; verified structured records can be used to build distillation datasets and update student models, enabling the system to have better coverage and lower inference costs over time.

[0034] In one embodiment, such as Figure 2 As shown, a router attribute recognition method based on a large language model is provided, which can be applied to... Figure 1 Taking the overall architecture of [the system] as an example, the following steps are included:

[0035] Step 202: Perform multi-port active probing on the target address set to obtain multi-protocol or multi-port service artifacts, clean and normalize the service artifacts, and generate normalized observation records.

[0036] Specifically, multi-port active probing is performed on the target address set to obtain multi-protocol / multi-port service artifacts, and the service artifacts are cleaned and normalized to form normalized observation records.

[0037] Furthermore, normalized observation records are used to uniformly describe the response content of the target address on different ports / protocols, and are bound to source identifiers such as port, protocol type, or service type to support subsequent evidence verification and auditing; a stable content digest is calculated for the text artifact corresponding to each response service for deduplication and cache reuse. The stable content digest is obtained by performing deterministic hash calculation on the text artifact, while retaining the original content of the text artifact, so as to provide verifiable evidence fragments when outputting structured records.

[0038] Step 204: Calculate the information content score based on the normalized observation records and sort and filter them to prioritize the observation records with high information content scores for in-depth identification within a given calculation budget.

[0039] Furthermore, information content scores are calculated and sorted based on normalized observation records to prioritize observation records with higher information content for in-depth analysis within a given computational budget. The information content score is calculated comprehensively based at least on the Shannon entropy, text length factor, and field type weight of the cleaned text. The Shannon entropy is used to characterize the information density of the text content, the text length factor is used to suppress the unstable contribution of excessively short texts, and the field type weight is used to increase the contribution of high semantic fields and reduce the contribution of low semantic fields.

[0040] Furthermore, the information content score combines the number of response services and the number of valid fields to reflect the richness of multi-port and multi-field observations, and makes the number of response services and the number of valid fields participate in the information content score calculation in a logarithmic scaling manner, thereby avoiding linear expansion of the score due to scale expansion and improving the ranking stability.

[0041] Step 206: The selected observation records are normalized and compressed and used as input data for the large language model. Multiple recognition agents with different functions are called to reason about the router attribute fields and output a partially structured result containing candidate attribute values ​​and explicit evidence sets. The outputs of multiple recognition agents are fused to generate candidate structured records to trigger abstention when there is insufficient evidence.

[0042] Specifically, the selected observation records are normalized and compressed to obtain the model input. Multiple analytical agents with different functions are invoked to reason about the router attribute fields and output a partially structured result containing candidate attribute values ​​and explicit evidence sets.

[0043] Furthermore, the explicit evidence set consists of multiple evidence records. Each evidence record includes at least an evidence source channel identifier, supporting fragments, and a reliability weight. The evidence source channel identifier is used to indicate that the evidence comes from a specific port / protocol artifact or retrieval segment. The supporting fragments are text fragments that can be directly verified. The reliability weight ranges from 0 to 1 and is used to characterize the credibility of the evidence.

[0044] Furthermore, the outputs of multiple analytical agents are integrated to form candidate structured records, and a comprehensive selection is made based on candidate confidence and evidence support. When a candidate value lacks sufficient evidence support or there is a significant conflict, a coarser label is output for the corresponding field or the field is abstained, in order to avoid generating speculative field values ​​without evidence support. The abstained field uses at least one set of confidence thresholds to control the output behavior, so that the field output meets the constraint of "sufficient evidence takes precedence, and insufficient evidence is conservative".

[0045] Step 208: Construct a retrieval query based on the input data, retrieve authoritative technical paragraphs related to the target device from an external knowledge base as the retrieval context, concatenate the retrieval context with the input data to obtain enhanced data, and incorporate the retrieval source and collection time of the enhanced data into the evidence space to achieve evidence anchoring.

[0046] Specifically, the model input constructs a retrieval query, retrieves authoritative technical paragraphs related to the target device from an external knowledge base as the retrieval context, concatenates the retrieval context with the model input to form an enhanced input, and incorporates traceability information such as the retrieval source and collection time into the evidence space to achieve evidence anchoring.

[0047] Furthermore, the external knowledge base is constructed from publicly available sources and forms a fixed snapshot. The publicly available sources include at least router manuals, configuration guides, version release notes, model support pages, and publicly available descriptive information from Internet measurement platforms. The source identifier, collection time, and content summary information are saved for each paragraph in the knowledge base to support the tracing, verification, and reproducibility of retrieved evidence.

[0048] Furthermore, to improve the scale of Internet reuse and reduce retrieval overhead, a stable signature is constructed based on the stable content digests of multiple port artifacts. The stable signature is obtained by sorting the digest set according to deterministic rules and then calculating the overall hash. The stable signature is used as the key to cache the retrieval output or intermediate results so that they can be directly reused when the same artifact set appears again.

[0049] Step 210: The verification agent performs pattern validity verification, evidence sufficiency verification, and cross-field consistency verification on the candidate structured records. For fields that do not meet the verification conditions, conservative correction or emptying is performed, and the target structured record is output.

[0050] Specifically, the verification agent performs pattern validity verification, evidence sufficiency verification, and cross-field consistency verification on the fused candidate structured records. Fields that do not meet the verification conditions are conservatively corrected or set to null to output the verified final structured record. Cross-field consistency verification includes at least reviewing the logical consistency between fields such as manufacturer, model, platform / operating system, and firmware / version. When inconsistencies are found, field-level editing rules are generated, and conflicting fields are corrected by overwriting or set to null before outputting the verified final structured record.

[0051] Step 212: Construct a distillation training dataset based on the target structured records to train the student model. The student model learns the structured output and abstention behavior of the teacher process. During the deployment phase, the student model performs large-scale inference. When the confidence is insufficient or the consistency check fails, it triggers an upgrade to the teacher process to complete the identification and deployment of the router.

[0052] Specifically, a distillation training dataset is built based on the validated final structured records to train the student model, enabling the student model to learn the structured outputs and abstention behaviors of the teacher process, and to perform large-scale inference by the student model during the deployment phase.

[0053] Furthermore, the analysis strategy in the deployment phase is based on the confidence level of the structured output by the student model, the evidence consistency check results of key fields, or preset risk rules. When the upgrade trigger conditions are met, the corresponding input is upgraded to the teacher process to complete multi-agent analysis, retrieval enhancement, and verification correction, so as to ensure the reliability of the output in key scenarios, thereby balancing recognition quality and deployment cost.

[0054] In the aforementioned router attribute recognition method based on a large language model, firstly, multi-port active probing is performed on the target address to obtain the original service artifacts. Then, these responses, which contain garbled characters and redundancy, are cleaned and normalized to form a unified, normalized observation record. To address the computational efficiency issue at the internet scale, an information content scoring mechanism based on information entropy, text length, and field weights is introduced to sort and filter massive records, ensuring that high-information-content targets are prioritized for in-depth analysis within a limited budget, thus optimizing resource allocation. Secondly, the filtered high-value observation records are input into a reasoning module composed of multiple functionally differentiated recognition agents. Each agent works in parallel, parsing the text from different perspectives and forcibly outputting a partially structured result containing candidate attribute values ​​and an explicit evidence set. This evidence set explicitly records the source of supporting fragments (specific ports or external knowledge base retrieved segments) and reliability weights. Subsequently, the system performs evidence fusion and arbitration on the outputs of the multiple agents. When evidence is insufficient or conflicting, an abstention mechanism is proactively triggered to avoid generating unfounded speculative results, thereby effectively suppressing the "illusion" risk while utilizing the semantic capabilities of the large language model. Then, the candidate structured records generated from the initial fusion must be submitted to a dedicated verification agent for rigorous review. Verification includes pattern validity verification (conforming to a predefined format), evidence sufficiency verification (key fields have sufficient supporting evidence), and cross-field consistency verification (such as logical self-consistency in manufacturer, model, and version). For any field that fails verification, the system performs conservative correction or emptying to ensure a critical closed loop of auditability and engineering usability, ultimately outputting high-quality, trustworthy target structured records. Finally, to balance recognition quality and large-scale deployment costs, the solution employs a knowledge distillation and dynamic upgrade strategy. The high-quality target structured records produced are used to train a lightweight student model, enabling it to learn the reasoning and abstention patterns of complex teacher processes. During deployment, routine recognition tasks are efficiently handled by the student model; only when the student model outputs insufficient confidence or triggers preset risk rules does the system automatically upgrade the task to a complete teacher process for review. In summary, this achieves a balance between highly reliable recognition, auditable results, and controllable operating costs in internet-scale scenarios.

[0055] In one embodiment, multi-port active probing is performed on the target address set to obtain multi-protocol or multi-port service artifacts, and the service artifacts are cleaned and normalized to remove garbled characters and templated redundant fragments.

[0056] The cleaned multi-port artifacts are aggregated according to a unified field format to generate normalized observation records containing context metadata and a set of response service artifacts. A stable content summary is calculated for each text artifact to support deduplication and cache reuse, while the original text artifacts are retained to provide verifiable evidence fragments.

[0057] In one embodiment, Shannon entropy is calculated based on the clarified text to characterize the text information density. A length factor is calculated based on the text length to account for the unstable contribution of excessively short text. Weights are assigned based on field type to increase the contribution of high-semantic fields and decrease the contribution of low-semantic fields. Combining the corresponding number of services and the number of effective fields, a logarithmic scaling method is used to calculate an information content score based on the Shannon entropy, the length factor, and the weights.

[0058] In one embodiment, an evidence source channel representation is assigned to each piece of evidence. Supporting fragments are extracted from the original text artifact or retrieved paragraphs, and these supporting fragments are used as textual evidence for direct verification. All evidence records are classified and represented according to the assigned evidence source channel representation, the textual evidence, and a preset reliability weight, thus constructing an explicit evidence set.

[0059] In one embodiment, a candidate confidence score is calculated for each candidate attribute value output by the identification agent. Based on the reliability weights in the displayed evidence set, an evidence support score is calculated for each candidate attribute value. A comprehensive selection is made based on the candidate confidence score and the evidence support score. If the evidence support score is lower than a preset threshold, abstention is triggered. For fields triggering abstention, a coarser-grained label is output or the field is left blank, generating candidate structured records.

[0060] In one embodiment, the manufacturer, model, operating system and version fields in the candidate structured record are subjected to logical consistency review. If logical inconsistencies are found between fields, field-level editing rules are generated based on the evidence support of each field. According to the editing rules, the conflicting fields are overwritten or set to null.

[0061] In one embodiment, a distillation dataset for model training is constructed based on the target structured record. The student model is trained using this distillation dataset, enabling it to learn the structured output and abstention behavior of the teacher's workflow. During deployment, the student model infers from the input and outputs structured results and corresponding confidence scores. If the confidence score of the student model's output is lower than a preset threshold, or if the consistency check of key fields fails, an upgrade is triggered. The input triggering the upgrade is then processed by the teacher's workflow to complete multi-agent recognition, retrieval enhancement, and verification.

[0062] In one embodiment, a router attribute identification step based on a large language model is provided, the specific steps of which are as follows:

[0063] S12, Multi-port Active Probing and Service Artifact Acquisition. Multi-port active probing is performed on the target address set to acquire service artifacts for each target address on multiple protocols / ports and receive corresponding response content. The service artifacts include, but are not limited to, service banners, handshake information, response headers, and response bodies. Each service artifact is bound to a source identifier such as its port, protocol type, or service type to ensure that subsequent inference conclusions can be traced back to the specific observation source.

[0064] It is worth noting that the probing host (denoted as A) performs active probing on a preset set of ports toward the target address set (denoted as V) to obtain a set of cross-port service artifacts (denoted as X(v)). The port set can be selected from common service ports used in Internet measurements, so as to collect lightweight information that can be used for identification without altering the normal operation of network devices. To reduce the impact on the network, the probing host can limit the packet sending rate and record timeouts, no responses, or abnormal responses; however, this invention does not necessarily limit the number of packet sending attempts or the specific port set.

[0065] S13, Cleaning, Standardization, and Normalization of Observation Records. The service artifacts are cleaned and normalized to remove garbled characters, templated redundant fragments, and low semantic noise, while retaining key fragments reflecting differences in manufacturer, model, platform / operating system, or firmware / version. Multi-port artifacts are aggregated into normalized observation records using a unified field format. A stable content summary is calculated for each text artifact for deduplication and cache reuse, while the original text artifact is retained for outputting verifiable evidence fragments. It is understood that artifacts returned from internet scanning often contain duplication and noise; directly using them as model input would increase inference costs and lead to unstable results. By cleaning and normalizing the artifacts, artifacts from different ports and protocols can be unified into a comparable observation structure. The stable content summary can be obtained through deterministic hash calculation and used to determine whether artifacts are approximately identical and for cache reuse; retaining the original content provides verifiable supporting fragments in the output results, facilitating auditing and review.

[0066] S14, Information Content Scoring and Entropy-Guided Filtering. Information content scores are calculated and sorted based on the normalized observation records to prioritize observation records with higher information content for in-depth analysis within a given computational budget. The information content score comprehensively considers the information entropy of the cleaned text, text length factor, field type weight, and multi-port observation scale information. Logarithmic scaling is applied to the scale term to improve ranking stability, thereby reducing the computational overhead caused by low-value samples. It is understood that in internet-scale scenarios, the number of addresses to be analyzed is enormous, and many addresses return extremely sparse or highly templated artifacts. Using information content scoring allows for prioritizing samples more likely to contain identification clues within budget constraints. The information entropy is used to characterize text information density, the text length factor is used to suppress the unstable effects of excessively short texts, and the field type weight is used to increase the contribution of high-semantic fields and decrease the contribution of low-semantic fields. Logarithmic scaling of the scale term ensures that the score marginally decreases with the increase in the number of ports and fields, thus achieving a more stable ranking effect. The above scoring method can be adjusted according to actual deployment, but it does not affect the core idea of ​​this invention.

[0067] S15, Multi-agent Teacher Inference and Evidence Chain Generation. The filtered observation records are normalized and compressed to obtain the model input. Multiple analytical agents with different functions are invoked to infer the router attribute fields and output partially structured results. These partially structured results include candidate attribute values ​​and explicit evidence sets. The explicit evidence sets include at least the evidence source channel identifier, supporting fragments, and reliability weights. The outputs of multiple analytical agents are fused to form candidate structured records, and abstention is triggered when evidence is insufficient or conflicts are significant to avoid speculative outputs without supporting evidence. It is understood that this invention does not merely output a "final label," but rather organizes the output in an "evidence center" manner. An "evidence center" means that the output of each attribute field needs to be associated with verifiable evidence records. These evidence records at least include the source channel identifier of which port / protocol or retrieval segment the evidence originates from, contain directly verifiable supporting fragments, and describe the credibility of the evidence with reliability weights. Through multi-agent inference, clues can be extracted from different perspectives and mutually verified. The fusion stage selects the conclusion based on a comprehensive consideration of candidate confidence and evidence support. When there is insufficient evidence or significant conflict, abstaining or outputting coarser-grained labels can effectively reduce the risk of speculative outputs from models that "seem reasonable but lack supporting evidence."

[0068] S16, Retrieval Enhancement Generation and Evidence Anchoring. A retrieval query is constructed based on the model input. Authoritative technical paragraphs related to the target device are retrieved from an external knowledge base as retrieval context. This retrieval context is concatenated with the model input to form enhanced input. Source information such as the retrieval source and collection time are incorporated into the evidence space to achieve evidence anchoring. A stable signature is constructed based on stable content summaries of multiple port artifacts, and the retrieval output or intermediate results are cached for direct reuse when the same artifact set reappears, reducing retrieval and inference costs. It is understood that in long-tail devices or weak evidence scenarios, relying solely on scanned artifacts may be insufficient to determine model or platform information. This invention introduces a retrieval enhancement generation mechanism, using authoritative paragraphs retrieved from an external knowledge base as auxiliary context, enabling inference to be "anchored" by referencing authoritative documents. The external knowledge base can be constructed from publicly available sources and form a fixed snapshot. Public sources may include router manuals, configuration guides, version release instructions, model support pages, and publicly available descriptions of internet measurement platforms. For each paragraph, source identifiers, collection times, and content summary information are saved to support traceability and reproducibility. Furthermore, to reduce the cost of large-scale internet searches, this invention constructs a stable signature as a cache key. When the same set of workpieces appears repeatedly at different target addresses, the search output or intermediate results can be directly reused.

[0069] S17, Verification, Conservative Error Correction, and Distillation Deployment. A verification agent performs pattern validity verification, evidence sufficiency verification, and cross-field consistency verification on candidate structured records. When inconsistencies or insufficient evidence are found, field-level editing rules are generated. Conflicting fields are corrected by overwriting or being set to null before outputting the verified final structured record. Based on the verified final structured record, a distillation training dataset is constructed to train a student model. The student model learns the structured output and abstention behavior of the teacher's process. During the deployment phase, the student model performs large-scale inference. When confidence is insufficient or consistency checks fail, the process escalates to the teacher's process, thereby achieving auditable, highly reliable identification and cost-controlled internet-scale deployment. It is understood that verification is a crucial step in achieving auditable output in this invention. Pattern validity verification ensures that field formats, types, or enumeration ranges conform to preset patterns; evidence sufficiency verification ensures that key fields have sufficient verifiable evidence; and cross-field consistency verification examines the logical consistency between fields such as manufacturer, model, platform / operating system, firmware / version. When verification fails, this invention adopts a conservative error correction strategy, prioritizing emptying or reverting to a coarser-grained output to ensure that the final record can be audited and reviewed. The verified output is further used for distillation training of the student model, enabling the student model to have low-cost inference capabilities during large-scale deployment, and ensuring reliability in key scenarios through an upgrade strategy.

[0070] It is worth noting that the above steps, through mechanisms such as multi-port artifact acquisition, entropy-guided filtering, multi-agent evidence chain reasoning, enhanced retrieval anchoring, and verification and distillation deployment, can output verifiable, traceable, and maintainable structured router attribute results in Internet-scale scenarios. Compared with traditional methods that rely on manual rules and fingerprint database maintenance, this invention can reduce maintenance costs and improve adaptability to long-tail devices; compared with directly inputting the original artifacts into a single model for reasoning, this invention significantly reduces the risk of inference without evidence and improves audit availability through evidence chains and verification mechanisms.

[0071] In one embodiment, such as Figure 3 As shown, a router fingerprinting method based on a large language model is provided, and the specific steps are as follows:

[0072] S32. The probe host, using its own address as the source address, performs a Traceroute probe on the dataset to the IPv6 router seed address and sends other probe packets, and receives a series of response messages corresponding to the target address. The probe packets include ICMPv6 Echo Requests, TCP, and UDP packets.

[0073] S33: Parse the traceroute path, find highly similar paths, and filter paths that differ only in one hop as candidate alias pairs. Construct a candidate set based on the broad similarity of the path structure.

[0074] S34: Train the collected feature data, use benchmark datasets for supervised learning, establish the mapping relationship between feature vectors and alias address pairs, and use classification algorithms such as decision trees to build an alias recognition model.

[0075] S35: Probe the potential alias address pairs specified in the above steps, process the returned feature data, and determine the alias using the constructed alias recognition model.

[0076] In one embodiment, targeting a publicly available IPv6 router address dataset, 10 ICMPv6 Echo Requests, TCP, UDP, and SNMPv3 Requests packets are sent to the target address. A benchmark set is built for training by obtaining accurate vendor labels of some routers in the address set using EUI-64 addresses present in SNMPv3 and IPv6, thereby establishing a fingerprint database to determine the vendor type of the target router. Compared to traditional techniques, this technology can detect IPv6 router addresses across the Internet, accurately and efficiently classify network router address types, and provide effective technical and data support for network mapping and network security research.

[0077] In one embodiment, such as Figure 4 As shown, an Internet-scale router attribute identification device based on an evidence-centric multi-agent teacher-student architecture is provided. The device may include: a detection and cleaning module, an entropy-guided filtering module, a multi-agent analysis module, a retrieval enhancement generation module, a verification and validation module, a distillation and deployment module, and a result output and storage module.

[0078] The module comprises several sub-modules: The Probe and Cleaning module performs multi-port active probing on the target address set to obtain multi-protocol / multi-port service artifacts. It then cleans and normalizes these artifacts to form normalized observation records. Simultaneously, it calculates stable content summaries for text artifacts for deduplication and cache reuse, while retaining the original artifact content to provide verifiable evidence fragments. The Entropy-Guided Filtering module calculates information content scores based on normalized observation records and sorts and filters them to prioritize observation records with higher information content for in-depth analysis within budget constraints. The Multi-Agent Analysis module converts the filtered observation records into model input, calls multiple functionally divided analysis agents to output candidate attribute values ​​and explicit evidence sets, and fuses them. It triggers abstention when evidence is insufficient or conflicts are significant to avoid speculative output. The Retrieval Enhancement Generation module constructs retrieval queries and retrieves authoritative technical passages from external knowledge bases to form a retrieval context. It concatenates the retrieval context with the model input to form enhanced input and incorporates source information such as retrieval source and collection time into the evidence space. It also caches and reuses retrieval outputs or intermediate results based on stable signatures to reduce scaling overhead. The verification module performs pattern validity checks, evidence sufficiency checks, and cross-field consistency checks. When inconsistencies or insufficient evidence are found, it generates field-level editing rules, performs overwrite corrections or nullification on conflicting fields, and outputs verified structured records. The distillation and deployment module builds a distillation training dataset based on the verified structured records and trains a student model. This allows the student model to learn the structured output and abstention behavior of the teacher's workflow. During the deployment phase, it determines whether to upgrade based on confidence and consistency check results, and if necessary, upgrades to the teacher's workflow to ensure reliability in critical scenarios. The results output and storage module stores the final structured records, their evidence chain, and traceability information for subsequent auditing, review, and maintenance.

[0079] It should be understood that, although Figures 2-3 The steps in the flowchart are shown sequentially as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order in which these steps are executed, and they can be performed in other orders. Figures 2-3At least some of the steps in the process may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least some of the sub-steps or stages of other steps.

[0080] In one embodiment, such as Figure 5 As shown, a router attribute recognition device based on a large language model is provided, including: an observation record generation module 502, a record recognition module 504, an inference module 506, a data feature enhancement module 508, a verification module 510, and a recognition and deployment module 512, wherein:

[0081] The observation record generation module 502 is used to actively probe the target address set through multiple ports to obtain service artifacts with multiple protocols or multiple ports, clean and normalize the service artifacts, and generate normalized observation records.

[0082] The record identification module 504 is used to calculate the information content score based on the normalized observation records and sort and filter them so as to prioritize the observation records with high information content scores for in-depth identification under a given calculation budget.

[0083] The reasoning module 506 is used to take the selected observation records after normalization and compression as input data for the large language model, call multiple functional recognition agents to reason about the router attribute fields, output a partially structured result containing candidate attribute values ​​and explicit evidence sets, and fuse the outputs of multiple recognition agents to generate candidate structured records to trigger abstention when evidence is insufficient.

[0084] The data feature enhancement module 508 is used to construct a retrieval query based on the input data, retrieve authoritative technical paragraphs related to the target device from an external knowledge base as the retrieval context, concatenate the retrieval context with the input data to obtain enhanced data, and incorporate the retrieval source and collection time of the enhanced data into the evidence space to achieve evidence anchoring.

[0085] The verification module 510 is used by the verification agent to perform pattern validity verification, evidence sufficiency verification and cross-field consistency verification on the candidate structured records respectively, and to perform conservative correction or empty processing on fields that do not meet the verification conditions, and output the target structured record.

[0086] The identification and deployment module 512 is used to construct a distillation training dataset based on the target structured record to train the student model, enabling the student model to learn the structured output and abstention behavior of the teacher process, and to perform large-scale inference by the student model during the deployment phase. When the confidence is insufficient or the consistency check fails, it triggers an upgrade to the teacher process processing to complete the identification and deployment of the router.

[0087] Specific limitations regarding the router attribute recognition device based on large language models can be found in the limitations of the router attribute recognition method based on large language models mentioned above, and will not be repeated here. Each module in the aforementioned router attribute recognition device based on large language models can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device in hardware form, or stored in the memory of a computer device in software form, so that the processor can call and execute the corresponding operations of each module.

[0088] In one embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 6 As shown, the computer device includes a processor, memory, network interface, display screen, and input devices connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The network interface is used to communicate with external terminals via a network connection. When executed by the processor, the computer program implements a router attribute recognition method based on a large language model. The display screen can be an LCD screen or an e-ink screen. The input devices can be a touch layer covering the display screen, buttons, a trackball, or a touchpad mounted on the computer device casing, or an external keyboard, touchpad, or mouse.

[0089] Those skilled in the art will understand that Figures 4-5 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0090] In one embodiment, a computer device is provided, including a memory and a processor, the memory storing a computer program, the processor executing the computer program to perform the following steps:

[0091] Actively probe the target address set using multiple ports to obtain service artifacts with multiple protocols or ports, clean and normalize the service artifacts, and generate normalized observation records.

[0092] Information content scores are calculated based on normalized observation records and then sorted and filtered to prioritize the observation records with high information content scores for in-depth identification within a given computational budget.

[0093] The selected observation records are normalized and compressed and used as input data for the large language model. Multiple recognition agents with different functions are invoked to reason about the router attribute fields and output a partially structured result containing candidate attribute values ​​and explicit evidence sets. The outputs of multiple recognition agents are merged to generate candidate structured records to trigger abstention when there is insufficient evidence.

[0094] Based on the input data, a retrieval query is constructed. Authoritative technical paragraphs related to the target device are retrieved from an external knowledge base as the retrieval context. The retrieval context is then concatenated with the input data to obtain augmented data. The retrieval source and collection time of the augmented data are incorporated into the evidence space to achieve evidence anchoring.

[0095] The verification agent performs pattern validity verification, evidence sufficiency verification, and cross-field consistency verification on the candidate structured records. For fields that do not meet the verification conditions, conservative correction or emptying is performed, and the target structured record is output.

[0096] A distillation training dataset is constructed based on the target structured records to train the student model. The student model learns the structured output and abstention behavior of the teacher process. During the deployment phase, the student model performs large-scale inference. When the confidence is insufficient or the consistency check fails, it triggers an upgrade to the teacher process to complete the identification and deployment of the router.

[0097] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments described above. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), Synchlink, DRAM (SLDRAM), RAMbus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and RAMbus dynamic RAM (RDRAM), etc.

[0098] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0099] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of the invention. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A router attribute recognition method based on a large language model, characterized in that, The method includes: Actively probe the target address set using multiple ports to obtain service artifacts with multiple protocols or multiple ports, clean and normalize the service artifacts, and generate normalized observation records. Information content scores are calculated and sorted based on the normalized observation records, so that observation records with high information content scores are selected for in-depth identification under a given computational budget. The selected observation records are normalized and compressed and used as input data for the large language model. Multiple functionally divided identification agents are invoked to reason about the router attribute fields and output a partially structured result containing candidate attribute values ​​and explicit evidence sets. The outputs of multiple identification agents are fused to generate candidate structured records to trigger abstention when evidence is insufficient. Based on the input data, a retrieval query is constructed, and authoritative technical paragraphs related to the target device are retrieved from an external knowledge base as the retrieval context. The retrieval context is then concatenated with the input data to obtain enhanced data. The retrieval source and collection time of the enhanced data are incorporated into the evidence space to achieve evidence anchoring. The verification agent performs pattern validity verification, evidence sufficiency verification, and cross-field consistency verification on the candidate structured records. For fields that do not meet the verification conditions, conservative correction or emptying is performed, and the target structured record is output. A distillation training dataset is constructed based on the target structured records to train the student model. The student model learns the structured output and abstention behavior of the teacher process. During the deployment phase, the student model performs large-scale inference. When the confidence is insufficient or the consistency check fails, it triggers an upgrade to the teacher process to complete the identification and deployment of the router.

2. The method according to claim 1, characterized in that, Active multi-port probing is performed on the target address set to obtain multi-protocol or multi-port service artifacts. These service artifacts are then cleaned and normalized to generate normalized observation records, including: Actively probe the target address set using multiple ports to obtain service artifacts with multiple protocols or multiple ports, and clean and normalize the service artifacts to remove garbled characters and templated redundant fragments. The cleaned multi-port artifacts are aggregated according to a unified field format to generate normalized observation records containing context metadata and a set of response service artifacts; For each text artifact, a stable content summary is computed to support deduplication and cache reuse, while the original text artifact is preserved to provide verifiable evidence fragments.

3. The method according to claim 2, characterized in that, The information content score is calculated based on the normalized observation records, including: Shannon entropy is calculated from the cleared text to characterize the text information density. The length factor is calculated based on the text length to account for the unstable contribution of consistently short texts; Weights are assigned based on field type to increase the contribution of high-semantic fields and decrease the contribution of low-semantic fields. By combining the number of services and the number of valid fields, a logarithmic scaling method is used to calculate the information content score based on the Shannon entropy, the length factor, and the weight.

4. The method according to any one of claims 1 to 3, characterized in that, Assign an evidence source channel to each piece of evidence; Supporting fragments are extracted from the original text artifact or the retrieved paragraphs. These supporting fragments are used as textual evidence for direct verification. All evidence records are classified and represented according to the assigned evidence source channel representation, the textual evidence, and the preset reliability weights to construct an explicit evidence set.

5. The method according to claim 4, characterized in that, By fusing the outputs of multiple identification agents, candidate structured records are generated to trigger abstention when evidence is insufficient, including: Calculate the candidate confidence score for each candidate attribute value output by the identification agent; Calculate the evidence support for each candidate attribute value based on the reliability weights in the displayed evidence set; The selection is based on a combination of candidate confidence and evidence support. If the evidence support is lower than a preset threshold, the candidate is abstaining. For fields that trigger abstention, coarser-grained labels are output or the fields are left blank to generate candidate structured records.

6. The method according to claim 5, characterized in that, The verification agent performs cross-field consistency checks on the candidate structured records, including: The manufacturer, model, operating system and version fields in the candidate structured records are subjected to logical consistency review. If logical inconsistencies are found between fields, field-level editing rules are generated based on the evidence support of each field. According to the editing rules, the conflicting fields are overwritten or set to null.

7. The method according to claim 6, characterized in that, A distillation training dataset is constructed based on the target structured records to train the student model, triggering an upgrade during the deployment phase, including: Based on the target structured record, a distillation dataset is constructed for model training. The student model is trained using the distillation dataset so that the student model learns the structured output and abstention behavior of the teacher's process. During the deployment phase, the student model infers from the input and outputs structured results and corresponding confidence scores. If the confidence score output by the student model is lower than a preset threshold, or if the consistency check of key fields fails, an upgrade is triggered. The input that triggers the upgrade is then processed by the teacher process to complete multi-agent recognition, retrieval enhancement, and verification.

8. A router attribute recognition device based on a large language model, characterized in that, The device includes: The observation record generation module is used to perform multi-port active probing on the target address set to obtain multi-protocol or multi-port service artifacts, clean and normalize the service artifacts, and generate normalized observation records. The record identification module is used to calculate the information content score based on the normalized observation records and sort and filter them so as to prioritize the observation records corresponding to high information content scores for in-depth identification under a given calculation budget. The reasoning module is used to take the selected observation records after normalization and compression as input data for the large language model, call multiple functionally divided recognition agents to reason about the router attribute fields, output a partially structured result containing candidate attribute values ​​and explicit evidence sets, and fuse the outputs of multiple recognition agents to generate candidate structured records to trigger abstention when evidence is insufficient. The data feature enhancement module is used to construct a retrieval query based on the input data, retrieve authoritative technical paragraphs related to the target device from an external knowledge base as the retrieval context, concatenate the retrieval context with the input data to obtain enhanced data, and incorporate the retrieval source and collection time of the enhanced data into the evidence space to achieve evidence anchoring. The verification module is used by the verification agent to perform pattern validity verification, evidence sufficiency verification and cross-field consistency verification on the candidate structured records respectively, and to perform conservative correction or empty processing on fields that do not meet the verification conditions, and output the target structured record. The identification and deployment module is used to construct a distillation training dataset based on the target structured records to train the student model. The student model learns the structured output and abstention behavior of the teacher process, and performs large-scale inference by the student model during the deployment phase. When the confidence is insufficient or the consistency check fails, it triggers an upgrade to the teacher process processing to complete the identification and deployment of the router.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 7.

Images