Internet of Things equipment identification method based on frequency domain depth spatial-temporal characteristic self-adaption

Abstract

The invention discloses an Internet of Things equipment identification method based on frequency domain depth spatial-temporal characteristic self-adaption, and belongs to the technical field of Internet of Things equipment identification. The method comprises the following steps: firstly, carrying out preprocessing and frequency domain conversion on network traffic to generate a frequency domain amplitude spectrum; secondly, constructing an end-to-end depth recognition model which integrates a one-dimensional convolutional neural network, a Fourier neural operator, a self-attention mechanism and a residual bidirectional long and short time memory network and is used for multi-level automatic extraction of local frequency domain textures, global frequency domain modals and long time sequence dependence features; thirdly, training the network model by using the prepared training data set until a preset threshold value is reached; and performing fine tuning optimization on the model by using the verification data set to obtain a final model. And finally, the network model is solidified and deployed, and online adaptive updating is carried out through a data drift detection mechanism. The method gets rid of the dependence of manual feature engineering, improves the precision and robustness of the model in a dynamic environment through the fusion of laboratory and real scene data, and achieves the adaptive optimization of data drift.

Description

Technical Field

[0001] This invention relates to the field of IoT device identification technology, and in particular to an IoT device identification method based on frequency domain depth spatiotemporal feature adaptation. Background Technology

[0002] With the rapid development of IoT technology, massive numbers of heterogeneous IoT devices are being deployed across various critical sectors. However, this surge in the number of IoT devices is accompanied by significant security risks. Resource-constrained and outdated devices are vulnerable to becoming springboards for cyberattacks; therefore, accurate device identification is a prerequisite for effective security control. Device fingerprinting technology, as a passive authentication method, achieves reliable identification by analyzing device communication behavior, overcoming the limitations of traditional identifiers that are easily tampered with.

[0003] Early methods primarily relied on time-domain features, but these features proved insufficiently stable under network jitter, packet loss, and encrypted traffic conditions. To overcome these limitations, frequency-domain analysis emerged. By converting network traffic to the frequency domain, it is possible to effectively capture the inherent periodic communication patterns of devices, significantly improving the robustness and accuracy of fingerprints and providing a new technical approach for IoT security.

[0004] Chinese patent publication number "CN119646630A", entitled "Method and Apparatus for IoT Device Type Identification Based on LSTM Algorithm", describes a method that manually divides data packets into control and user classes according to protocol type, and extracts temporal statistical features such as the number of data packets and average length, which are then input into a two-layer LSTM network for training. While this method utilizes LSTM to mine some temporal information, it still heavily relies on shallow temporal statistical features based on manually defined rules, making it difficult to fully characterize deep semantic patterns under encrypted traffic. Furthermore, the analysis perspective limited to the temporal dimension cannot effectively capture the inherent frequency-domain periodicity in device communication, resulting in insufficient robustness in network jitter or high-noise environments. In addition, the single LSTM structure has bottlenecks in extracting global long-range dependencies, and due to the lack of real-time monitoring and adaptive update mechanisms for data distribution drift, it is difficult to fundamentally solve the model aging and performance degradation problems caused by device firmware upgrades or changes in behavior patterns.

[0005] Therefore, there is an urgent need in this field for a novel solution that can break free from the reliance on manual feature engineering, automatically and fully mine raw frequency domain information, and has the ability to adapt to dynamic changes in the environment.

[0006] To address the two major shortcomings of existing frequency domain analysis-based IoT device identification methods—reliance on cumbersome manual feature engineering and limited model expressive power, as well as insensitivity to device behavior drift—this invention provides an IoT device identification method based on frequency domain depth spatiotemporal feature adaptation. Summary of the Invention

[0007] This invention is achieved through the following technical solution: An IoT device identification method based on frequency domain depth spatiotemporal feature adaptation includes the following steps: Step 1, Data Preprocessing and Frequency Domain Transformation: First, traffic data from different sources was integrated to construct an experimental dataset. After data cleaning, time binning technology was applied to aggregate the data according to a fixed time window, and characteristic time series signals containing four dimensions—byte count, packet count, average packet size, and average packet interval—were calculated and generated. Subsequently, windowing and Fast Fourier Transform were performed to obtain the frequency domain amplitude spectrum. Finally, the processed dataset was divided into training, validation, and test sets.

[0008] Step 2, Construct the network model: Construct a cascaded deep neural network model, which sequentially includes a local frequency domain feature extraction module, a global frequency domain mode enhancement module, a frequency domain sequence dependency modeling module, a time-series dynamic evolution modeling module, and a probability prediction module.

[0009] Step 3, train the network model: Select a loss function and start network training. Input the dataset processed in step 1 into the network model built in step 2 for training until the number of training epochs reaches a preset threshold, or the value of the validation set loss function does not decrease for several consecutive epochs and is below the preset threshold. The network model training is then complete, and the obtained network model parameters are saved.

[0010] Step 4, Fine-tuning and solidifying the network model: The trained model parameters are fine-tuned using a validation set. Once the model converges, the network parameters are fixed to generate the final IoT device identification model.

[0011] Step 5, Network Model Deployment: The model solidified in step 4 is deployed in a real network environment. During deployment, the PSI detection module continuously monitors data distribution drift and triggers the model update process when necessary.

[0012] Furthermore, in step 1, the dataset construction integrates two data sources from different scenarios, specifically a hybrid of the CIC IoT 2022 dataset and the Aalto University IoT dataset. The CIC IoT 2022 dataset provides multi-protocol, multi-state laboratory benchmark features, while the Aalto dataset incorporates background noise and network fluctuation features from a real smart home environment. After cleaning and time-binning the two datasets respectively, the system performs mixing, shuffling, and partitioning to construct training, validation, and test sets.

[0013] Furthermore, in step 2, the local frequency domain feature extraction module is implemented using a one-dimensional convolutional neural network, which has a multi-layer progressive convolutional structure. The structure includes at least three convolutional layers. By progressively increasing the number of convolutional kernels layer by layer and combining normalization layers and activation functions, the local frequency domain patterns are extracted in a layered and progressive manner.

[0014] Furthermore, in step 2, the global frequency domain mode enhancement module is composed of Fourier neural operators. It performs a fast Fourier transform on the input feature vector, retains the first k low-frequency modes (where k is a preset threshold) in the frequency domain space, and filters out high-frequency noise components. It applies a learnable complex weight matrix to the retained modes for linear transformation, and then reconstructs the signal back to the time domain through an inverse fast Fourier transform. The reconstructed signal is then residually connected to the original input of the module to achieve adaptive enhancement of global frequency domain features.

[0015] Furthermore, in step 2, the frequency domain sequence dependency modeling module adopts a multi-head self-attention mechanism to divide the input frequency domain features into multiple independent subspaces. It calculates the global dependency relationship between each time point in the sequence in parallel by scaling dot product attention, and performs residual connection with the original input after fusing the multi-head output to achieve long-term dependency modeling of the frequency domain sequence.

[0016] Furthermore, in step 2, the time-series dynamic evolution modeling module adopts a residual bidirectional long short-term memory network. Through a gating mechanism, it performs in-depth modeling of the dynamic evolution process of frequency domain features over time. It utilizes the bidirectional structure to simultaneously capture past and future contextual information, and combines inter-layer residual connections to maintain gradient flow. Finally, it extracts high-dimensional time-series contextual features for device identification.

[0017] Furthermore, in step 2, the probability prediction module adopts a structure of a fully connected layer and a Softmax activation function layer connected in series, which is used to map the high-dimensional features extracted by the preceding module to the device category space and output the final device identity prediction probability distribution.

[0018] Furthermore, in step 3, the loss function employs a composite loss function comprising a classification loss term and an intra-class compactness feature loss term. The classification loss term constrains the prediction accuracy of device categories, while the intra-class compactness feature loss term constrains the distribution compactness of devices of the same category in the deep feature space. By minimizing the distance between the deep features and the corresponding category centers, the robustness of the model to feature drift is enhanced. The two are weighted and summed using balanced weight coefficients to achieve end-to-end joint optimization.

[0019] Specifically, the composite loss function is defined as: , in, The standard cross-entropy loss, also known as the classification loss term, is used to quantify the difference between the predicted probability distribution output by the model and the actual device category label, thereby improving classification accuracy. These are preset weighting coefficients used to balance the contributions of classification tasks and feature clustering tasks; This is an intra-class compactness feature loss term designed to address the feature distribution divergence problem caused by traditional classification losses. Specifically, it calculates the distance between the high-dimensional deep features extracted by the model and the learnable feature center of the sample's class. This loss term forces features from devices of the same class to cluster towards the class center in the feature space, thereby significantly enhancing the model's feature robustness and anti-drift capability in the face of firmware upgrades, network attacks, or environmental noise without relying on signal reconstruction.

[0020] This composite loss function calculates the total loss through forward propagation and updates the network parameters and class centers synchronously during backpropagation, supporting end-to-end training. Compared to methods that only use classification loss, this invention effectively overcomes the inherent defect of loose feature distribution by increasing the constraints on the feature space, significantly improving the stability and generalization ability of the overall recognition performance.

[0021] Furthermore, in step 5, deploying the network model in a real-world network environment includes online inference, drift checking, and adaptive updates.

[0022] The online inference process involves performing preprocessing and frequency domain conversion on real-time traffic in step 1, and then inputting the data into a pre-defined model to perform device identification.

[0023] The drift detection involves continuously monitoring the distribution of data features flowing into the model using a PSI module. This module records the baseline distribution during model finalization and calculates the PSI value between the current distribution and the baseline distribution in real time during inference.

[0024] The adaptive update refers to the system automatically triggering an early warning and initiating a model update process once the PSI value exceeds a preset threshold, indicating a significant behavioral drift. This process utilizes newly acquired data to incrementally learn from the existing model, generating an updated model version and redeploying it, thereby achieving the system's self-evolution and long-term high-precision operation.

[0025] Compared with existing technologies, the beneficial effects of this invention are: 1. Frequency domain adaptive feature learning mechanism: Unlike traditional methods that use fixed frequency domain filters or manually designed frequency domain features, this invention introduces a Fourier neural operator (FNO) to construct a global frequency domain adaptive enhancement module. This module performs learnable low-frequency mode selection and complex weight transformation in the frequency domain space, automatically adjusting the frequency domain feature extraction strategy according to different device types, thereby achieving accurate capture of the inherent communication cycle patterns of the devices.

[0026] 2. Significant cross-domain generalization ability and environmental robustness: This invention innovatively combines laboratory benchmark data (CIC IoT 2022) with real-world scenario data (Aalto) for hybrid training. Compared to methods relying on a single data source, this strategy leverages real-world background noise to enhance the model's robustness, enabling it to extract the frequency domain fingerprint of the device's communication behavior. This effectively improves the model's adaptability to different network environments, network jitter, or background traffic interference, providing a better generalization foundation for the model's deployment in real-world scenarios.

[0027] 3. Introduce intra-class compactness constraints to improve drift robustness: This invention designs a composite loss function that includes classification loss and intra-class compactness feature loss. Unlike schemes that rely solely on traditional cross-entropy loss, this composite loss function increases inter-class differences while forcing features of devices of the same class to cluster towards the class center in the feature space. This mechanism makes the feature distribution more compact, and even if the input signal experiences slight feature drift caused by minor network fluctuations, the samples can still remain within a safe boundary, thereby significantly enhancing the robustness of the model.

[0028] 4. Implemented dynamic adaptive updates and built a maintenance mechanism that combines internal and external mechanisms: This invention introduces a PSI data drift detection module during the deployment phase to monitor changes in data distribution in real time. When significant drift is detected, the system automatically triggers incremental model updates based on high-confidence samples. This mechanism provides external proactive adjustment capabilities, which, combined with the intrinsic feature robustness described in point 3, forms a complementary mechanism of "internal resistance to feature fluctuations" and "external response to data drift." This dual protection effectively balances the model's resistance to short-term noise and its adaptability to long-term environmental changes, ensuring the stability of the identification system during long-term operation. Attached Figure Description

[0029] Figure 1 This is a flowchart illustrating the overall steps of the IoT device identification method described in this invention. Figure 2 This is a schematic diagram of the overall framework of the IoT device identification method based on frequency domain depth spatiotemporal features described in this invention; Figure 3 This is a schematic diagram of the internal processing flow of the global frequency domain mode enhancement module (FNO) in an embodiment of the present invention.

[0030] Figure 4 This is a flowchart of the online inference and adaptive update logic based on PSI drift detection described in this invention. Detailed Implementation

[0031] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0032] Example 1: This embodiment details an IoT device identification method based on frequency domain depth spatiotemporal feature adaptation. For example... Figure 1 The diagram shown is a flowchart illustrating the overall steps of the IoT device identification method provided in an embodiment of the present invention. Further, for specific implementation... Figure 1 The complete processing flow from data preprocessing to device identification described in the previous example is presented in this embodiment, which constructs an overall system architecture based on an end-to-end deep neural network. For example... Figure 2 The diagram shown is a schematic representation of the overall framework of the IoT device identification method based on frequency domain depth spatiotemporal features provided in an embodiment of the present invention.

[0033] The following will combine Figure 1 Steps and procedures Figure 2 The model architecture is described in detail below, along with the specific technical implementation of this embodiment: Step 1, Data Preprocessing and Frequency Domain Transformation: In this embodiment, the experimental data source is a mixture of the CIC IoT 2022 dataset and the Aalto University IoT dataset. The CIC IoT 2022 dataset was collected in a laboratory environment and covers 40 physical devices and traffic from multiple protocols such as WiFi, ZigBee, and Z-Wave. The Aalto dataset was collected in smart home and office environments and includes approximately 31 consumer-grade IoT devices and background traffic.

[0034] In the specific processing flow, the system first parses and cleans the original PCAP files of the two datasets, removes control packets such as ARP and ICMP that are not related to the device's business, and applies time binning technology to aggregate the original traffic according to a fixed time window.

[0035] Specifically, for the first By analyzing data within a time window, statistical features are extracted across four dimensions: byte count, data packet count, average packet size, and packet interval, to construct a multidimensional traffic feature vector. : , in, Total number of bytes Total number of data packets For average package size, This represents the average packet interval.

[0036] Subsequently, in order to suppress spectral leakage when converting the discrete feature sequence to the frequency domain, the Hanning window function was applied to the feature sequence. Perform weighted processing: , in, This represents the total number of sampling points within the time window. This is the index of the current sampling point.

[0037] After windowing, a Fast Fourier Transform (FFT) is performed to obtain the frequency domain amplitude spectrum. Finally, the frequency domain feature data from two different data sources are mixed and randomly shuffled to break the order correlation of the data sources, and then proportionally divided into training, validation, and test sets for subsequent model training, parameter fine-tuning, and performance evaluation, respectively. This processing method ensures that the training data includes traffic characteristics under different network environments, providing more diverse sample support for subsequent model training.

[0038] Step 2, Construct the network model: A cascaded recognition model is constructed, consisting of a local frequency domain feature extraction module, a global frequency domain mode enhancement module, a frequency domain sequence dependency modeling module, a time-series dynamic evolution modeling module, and a probability prediction module.

[0039] The local frequency domain feature extraction module consists of convolutional block 1, convolutional block 2, and convolutional block 3. Each convolutional block is connected in series to form a progressive feature extraction network. Convolutional block 1 and convolutional block 2 have the same topology, both consisting of convolutional layers, batch normalization layers, ReLU activation functions, and Dropout regularization layers connected in sequence. Convolutional block 3 consists of convolutional layers, batch normalization layers, ReLU activation functions, and pooling layers.

[0040] Convolutional block 1 is used to capture basic frequency domain patterns with a large receptive field while preserving the original signal resolution; convolutional block 2 is used to generate intermediate frequency domain patterns by fusing them through a 2x downsampling operation, while increasing the channel dimension and reducing computational complexity; convolutional block 3 is used to extract high-level frequency domain semantic features and output a fixed-length feature vector through another 2x downsampling and pooling operation, providing high-dimensional feature input for subsequent global modality enhancement.

[0041] The global frequency domain modality enhancement module is built based on Fourier neural operators, and its internal processing flow is shown in Figure 3. Addressing the locality limitations of one-dimensional convolutional neural networks when extracting long sequence features, this module utilizes Fourier neural operators to achieve global enhancement of the input features.

[0042] Specifically, this module performs a Fast Fourier Transform on the input channel features, transforming them from the time domain to the frequency domain. In the frequency domain, to filter high-frequency noise and retain the global components representing the device's inherent period, the system performs a low-frequency truncation operation, retaining only the preceding frequency components in the frequency domain. A low-frequency mode (in this embodiment, preferably set) This truncation operation essentially leverages the frequency domain distribution characteristics of IoT traffic: the inherent communication behaviors of IoT devices (such as heartbeat packets and periodic reporting) typically manifest as stable low-frequency periodic signals, while interference such as delay jitter and out-of-order delivery introduced by network transmission typically manifests as high-frequency random noise. Traditional convolutional networks cannot distinguish between these two, but this embodiment achieves physical-level filtering of non-device-specific features by forcibly truncating high-frequency components in the frequency domain, thereby significantly improving the signal-to-noise ratio of subsequent time-series modeling.

[0043] Subsequently, a learnable complex weight matrix is ​​applied to the preserved pure low-frequency modes for linear transformation to capture global frequency domain dependencies. Finally, the signal is reconstructed back to the time domain using an inverse fast Fourier transform, and the reconstructed signal is residually concatenated with the original input of the module to output an enhanced feature vector. The specific calculation formulas for the above processing are as follows: , in, The input feature vector represents the original input signal of the module; Indicates Fast Fourier Transform; This indicates a low-frequency mode truncation operation, preserving the first few modes in the frequency domain. The low-frequency mode is selected and the remaining high-frequency components are set to zero to filter noise and focus on the inherent periodic patterns of the device. Represents a learnable complex weight matrix used for spectral convolution of the preserved low-frequency modes in the frequency domain to capture global frequency domain dependencies; This represents the inverse fast Fourier transform, used to reconstruct the enhanced frequency domain signal back into a time domain sequence; The output feature vector is the globally enhanced signal obtained through residual connections.

[0044] The frequency domain sequence dependency modeling module employs a multi-head self-attention mechanism, aiming to uncover long-distance correlations between different time steps or frequency components in the frequency domain feature sequence. This allows the module to capture global contextual information while preserving local features. By dividing the input feature space into multiple independent subspaces and computing the global dependency weights between various time points in the sequence in parallel, the model can dynamically focus on the key feature regions that are most discriminative for device fingerprint recognition based on the current context, without being limited by sequence distance.

[0045] The temporal dynamic evolution modeling module employs a residual bidirectional long short-term memory network to deeply model the nonlinear laws governing the dynamic evolution of device communication behavior over time and extract high-dimensional temporal contextual features. This module utilizes a bidirectional structure to simultaneously capture past and future contextual information in the feature sequence, adaptively controlling the retention and transmission of information flow through forget gates, input gates, and output gates. Furthermore, it introduces inter-layer residual connections to construct identity mapping pathways, effectively alleviating the gradient vanishing problem in deep networks and ensuring stable transmission of features in long sequences.

[0046] The probability prediction module consists of a fully connected layer and a Softmax activation function layer connected in series. First, the fully connected layer receives high-dimensional temporal context features from the output of the residual bidirectional long short-term memory network and linearly maps them to a feature space consistent with the number of preset IoT device categories. Then, the Softmax layer normalizes the mapped feature vectors, calculates the confidence probability of belonging to each device category, and determines the category with the highest probability value as the final device identification result.

[0047] Step 3, train the network model: To begin network training, a loss function is selected. The preprocessed and partitioned training set data from step 1 is input in batches into the end-to-end deep recognition model constructed in step 2, initiating the iterative training process. A suitable loss function is selected to minimize the classification difference between the predicted class probability output by the model and the real device label, as well as the consistency difference between the reconstructed frequency domain features and the original input frequency domain amplitude spectrum. Training iteration thresholds and early stopping conditions are set, and the model performance is continuously iterated and optimized. When the number of training cycles reaches the set threshold, or the value of the loss function converges to a preset stable range on the validation set and no longer decreases, the model parameters are considered to have been trained successfully, and the current optimal model parameters are saved. Subsequently, test set data is input into the trained network model to obtain recognition results, and accuracy, precision, recall, and F1 score are determined to be used as core evaluation metrics. Among them, the F1 score can effectively evaluate the comprehensive performance of the model under imbalanced sample conditions, thereby verifying and ensuring the accuracy and robustness of the model in device recognition under complex network environments.

[0048] During model training, a composite loss function is used to guide the optimization of network parameters. Specifically, this composite loss function is defined as: , The standard cross-entropy loss is used to quantify the difference between the predicted probability distribution of the model output and the actual device category label, thereby improving classification accuracy. Intra-class compactness feature loss aims to minimize intra-class variation among samples of the same type of device in the feature space. Its mathematical definition is as follows: , in, Indicates the first The high-dimensional feature vectors of each input sample are extracted by a deep neural network before being fed into the Softmax classification layer; Indicates the first The actual device category labels for each sample; Indicates the first The feature center of the device in the feature space, and the center vector is a learnable parameter that is updated synchronously during the network training process; This represents the size of the current training batch.

[0049] Specifically, for optimizing the category feature centers, this embodiment employs a moving average strategy instead of direct gradient updates to suppress drastic center oscillations caused by batch data fluctuations and ensure the stability of the training process. The specific update formula is as follows: , , in, That is, the label in the aforementioned definition. = The feature center corresponding to time , For the Kronecker function (when = The value is 1 if it is true, and 0 otherwise. The learning rate is centered on the feature distribution. This sliding update mechanism ensures that the feature center can be smoothly adjusted to follow the drift of the feature distribution, rather than abruptly changing.

[0050] Based on this, the design concept of the composite loss function is as follows: The aim is to maximize the inter-class differences between different category features, while The aim is to minimize intra-class differences within features of the same category. This joint optimization mechanism makes the feature distribution learned by the model more compact and discriminative. Even if slight feature drift occurs in subsequent inference due to network jitter, the sample features can still remain within a safe radius of the class center, thereby improving the robustness of the system.

[0051] Step 4, Fine-tuning and solidifying the network model: The validation set data from step 1 is used to optimize and fine-tune the initially trained model, optimize model parameters, correct overfitting issues that may occur on the training set, and further improve the generalization performance of the recognition network on unknown samples, resulting in an IoT device feature extractor with strong noise resistance and high discriminative power.

[0052] After fine-tuning the training, all weights and bias parameters of the network are fixed, determining the final IoT device identification model. This completes the model building phase. The fixed model possesses end-to-end feature extraction and classification capabilities. In subsequent practical IoT device identification tasks, the frequency domain amplitude spectrum generated by real-time traffic acquisition can be directly input into this trained end-to-end network model, and the final device identity or type identification result will be directly output after forward propagation.

[0053] Step 5, Network Model Deployment: Although this embodiment completed the training and validation of the model based on the CIC IoT 2022 and Aalto datasets in the aforementioned steps, the actual application process of this method also includes deploying the finely tuned and solidified model in a real IoT network environment for online inference.

[0054] At this stage, it is important to note that the "solidification" mentioned in step 4 refers to locking the model parameters during the initial deployment phase to generate a stable baseline model version, which serves as the initial baseline for subsequent online inference. However, during subsequent operation, this solidified state is not static but is conditionally and dynamically released through a data drift detection mechanism (as described in Example 2) to initiate the update process.

[0055] Example 2: This embodiment, based on Embodiment 1, is a concretization and detailed expansion of step 5, network model deployment, in the aforementioned method. This embodiment describes in detail the deployment scheme of the trained network model in a real-world IoT environment, focusing on the specific mechanism for monitoring data distribution drift and adaptively updating the model through the PSI detection module.

[0056] like Figure 4 The diagram shows the online inference and adaptive update logic flowchart based on PSI drift detection provided in this embodiment. This flowchart illustrates a parallel closed-loop system consisting of a real-time inference process and a drift monitoring process. Its core logic is as follows: while ensuring the main process outputs device identification results in real time, it asynchronously calculates the Population Stability Index (PSI) through a sliding window caching mechanism, and triggers incremental updates based on high-confidence samples when significant data distribution drift is detected, thereby achieving self-evolution of the model.

[0057] based on Figure 4 The online deployment and adaptive update process specifically includes the following stages: Phase 1: Deployment environment and baseline distribution established First, the network model trained and solidified in Example 1 is deployed on the computing nodes of the target network environment, putting it in standby mode to perform real-time recognition tasks. Before the model is officially connected to real-time traffic, the system calls the validation set data divided in Example 1 to perform a complete forward propagation inference on the model, obtaining the predicted probability values ​​of various devices output by the model at the classification layer. Subsequently, the system divides these probability values ​​according to device category. The system calculates the frequency of samples falling within each statistical interval (corresponding to different device IDs or types) and stores the statistical results as a baseline distribution. ,in Indicates the first The percentage of samples within each interval is used as a reference standard to measure whether subsequent data have experienced distribution drift.

[0058] Phase Two: Real-time Traffic Sampling and Actual Distribution Calculation During online inference, the PSI detection module synchronously runs and maintains a time sliding window of preset capacity to cache real-time traffic samples currently flowing into the model. For each sample entering the sliding window, the system performs frequency domain preprocessing operations identical to those in the training phase, including time binning, Hanning windowing, and fast Fourier transform. The generated frequency domain amplitude spectrum is then input into the model for inference. When the sliding window is full, the system statistically analyzes the predicted probability distribution of all samples within the window to generate the actual distribution for the current time period. ,in Indicates the first The percentage of real-time samples within each interval.

[0059] Phase 3, Calculation of the Group Stability Index (PSI) After obtaining the baseline distribution and the actual distribution, the system uses a population stability index formula to quantify the degree of difference between the two; the specific calculation formula is as follows: , in, This represents the proportion of the actual distribution in the i-th interval. Let N be the proportion of the baseline distribution in the i-th interval, and N be the number of intervals. This formula quantifies the current actual flow distribution. Compared with the baseline distribution The differences between them ensure non-negativity and symmetry, facilitating threshold setting.

[0060] This formula calculates a value reflecting the degree of distribution shift by summing the product of the difference between the baseline percentage and the actual percentage within each interval and the logarithmic ratio. This value is used to determine whether the traffic characteristics in the current network environment have changed significantly relative to the baseline characteristics during model training. The smaller the PSI value, the more stable the data distribution; the larger the PSI value, the more severe the data drift.

[0061] Phase Four: Tiered Early Warning and Adaptive Update Mechanism The system executes a preset hierarchical processing logic based on the calculated PSI value: if the PSI value is less than 0.1, it is determined that the distribution characteristics of the input data are consistent with those during training, and the data distribution is in a stable state. The system maintains the current model parameters unchanged and continues to execute the recognition task; if the PSI value is between 0.1 and 0.25, it is determined that the data has slight fluctuations. The system records the current status log but does not trigger an update operation; if the PSI value is greater than 0.25, it is determined that a significant data distribution drift has occurred, and the system automatically starts the model update process. The process specifically includes: automatically extracting samples with a prediction confidence higher than 0.5 within the current sliding window to construct an incremental dataset; using this dataset to fine-tune the weight parameters of the classification layer and the residual long short-term memory network layer in the model; after the loss function converges, reloading the updated parameters into the inference engine to replace the old parameters; and updating the current actual distribution to the new baseline distribution, thereby completing the adaptation to the changed network environment; and continuing to perform subsequent real-time monitoring tasks based on the new baseline distribution.

[0062] This embodiment achieves online adaptation of the model through PSI monitoring and incremental fine-tuning, which is significantly better than the robustness of existing static fingerprinting methods.

Claims

1. A method for identifying IoT devices based on frequency domain depth spatiotemporal features, characterized in that, Includes the following steps: Step 1: The original network traffic is aggregated according to fixed time windows using time binning technology, and the multidimensional traffic statistical features within each window are extracted to generate a time series signal; then the time series signal is windowed and subjected to fast Fourier transform to generate a frequency domain amplitude spectrum; training set, validation set and test set are constructed based on the processed dataset; Step 2: Construct a cascaded deep neural network model, which sequentially includes a local frequency domain feature extraction module, a global frequency domain mode enhancement module, a frequency domain sequence dependency modeling module, a time-series dynamic evolution modeling module, and a probability prediction module. Step 3: Use a composite loss function to input the training set from Step 1 into the model constructed in Step 2 for training; until the number of training cycles reaches a preset threshold, or the value of the validation set loss function does not decrease for several consecutive cycles and is below the preset threshold, the network model training is completed, and the obtained network model parameters are saved. Step 4: Use the validation set to fine-tune and optimize the parameters of the trained model. After the model converges, fix the network parameters and generate the final IoT device identification model. Step 5: Deploy the solidified model in a network environment for online inference. During deployment, a data distribution drift detection module is introduced to continuously monitor the distribution drift of the input data. When the drift index exceeds a preset threshold, a model warning and adaptive update process are triggered.

2. The IoT device identification method based on frequency domain depth spatiotemporal feature adaptation according to claim 1, characterized in that, In step 1, the extraction of multidimensional traffic statistics features within each window specifically includes: calculating the total number of bytes, total number of data packets, average packet size, and average packet interval time of the original network traffic based on the fixed time window, thereby forming a four-dimensional feature sequence; the windowing process specifically involves using a Hanning window to perform weighted smoothing on the time series signal to suppress spectral leakage.

3. The IoT device identification method based on frequency domain depth spatiotemporal feature adaptation according to claim 1, characterized in that, In step 2, the local frequency domain feature extraction module is specifically constructed using a one-dimensional convolutional neural network. It adopts a multi-layer progressive convolutional structure, in which the number of convolutional kernels increases layer by layer as the number of layers increases, so as to extract local frequency domain features in a layered and progressive manner.

4. The IoT device identification method based on frequency domain depth spatiotemporal feature adaptation according to claim 1, characterized in that, In step 2, the global frequency domain modal enhancement module is specifically composed of Fourier neural operators, which are configured to: perform a fast Fourier transform on the input feature vector, retaining only the first four features in the frequency domain space. One low-frequency mode (of which (A preset positive integer threshold) is used to set the remaining high-frequency components to zero, and a learnable complex weight transformation is applied to the retained low-frequency components. Then, the signal is reconstructed through inverse Fourier transform, and the reconstructed signal is residually connected to the original input of the module to achieve adaptive enhancement of global frequency domain features.

5. The IoT device identification method based on frequency domain depth spatiotemporal feature adaptation according to claim 1, characterized in that, In step 2, the frequency domain sequence dependency modeling module specifically adopts a multi-head self-attention structure to divide the input frequency domain features into multiple subspaces, calculate the global dependency relationship between time points, and perform residual connection between the multi-head output and the original input.

6. The IoT device identification method based on frequency domain depth spatiotemporal feature adaptation according to claim 1, characterized in that, In step 2, the time-series dynamic evolution modeling module specifically adopts a residual bidirectional long short-term memory network, configured as a two-layer bidirectional structure and combined with a residual connection mechanism, to deeply model the dynamic evolution process of frequency domain features over time and extract time-series context features.

7. The IoT device identification method based on frequency domain depth spatiotemporal feature adaptation according to claim 1, characterized in that, In step 2, the probability prediction module adopts a structure of a fully connected layer and a Softmax activation function layer connected in series, which is used to map the high-dimensional features extracted by the preceding module to the device category space and output the final device identity prediction probability distribution.

8. The IoT device identification method based on frequency domain depth spatiotemporal feature adaptation according to claim 1, characterized in that, In step 3, the loss function adopts a composite loss function that includes a classification loss term and an intra-class compactness feature loss term. The classification loss term is used to constrain the prediction accuracy of the device category, and the intra-class compactness feature loss term is used to constrain the distribution compactness of devices of the same category in the deep feature space. By minimizing the distance between the deep feature and the corresponding category center, the robustness of the model to data distribution drift is enhanced. The two are weighted and summed through a preset balanced weight coefficient to achieve end-to-end joint optimization.

9. The IoT device identification method based on frequency domain depth spatiotemporal feature adaptation according to claim 1, characterized in that, In step 5, the data distribution drift detection module specifically uses the population stability index (PSI) as the basis for determining whether the data distribution has drifted.

10. The IoT device identification method based on frequency domain depth spatiotemporal feature adaptation according to claim 9, characterized in that, The adaptive update process specifically includes: obtaining the feature distribution of the validation set when the model is solidified as the baseline data distribution; during the online inference stage, statistically analyzing the actual feature distribution of the current input data based on the sliding window mechanism, and calculating the population stability index (PSI) value between the actual feature distribution and the baseline data distribution in real time; when the PSI value exceeds a preset threshold, it is determined that a data distribution drift has occurred, and samples with prediction confidence higher than the preset threshold within the sliding window are selected to form an incremental dataset. The incremental dataset is used to incrementally train the model, and then the updated model parameters replace the old parameters and the model is redeployed.

Images