A device network policy migration method and system
By extracting multi-dimensional behavioral features of the target device and combining them with the behavioral features of offline devices, the system determines whether the device has an original identity. When the original identity is confirmed, policy migration is performed, which solves the problem of network policy failure caused by random MAC addresses and realizes reliable identification of device identity and automatic migration of network policies.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- E-SURFING DIGITAL LIFE TECH CO LTD
- Filing Date
- 2026-03-09
- Publication Date
- 2026-05-29
AI Technical Summary
Existing network management policies heavily rely on device MAC addresses as unique identifiers, causing network policies to fail when random MAC addresses change, resulting in low management efficiency and an inability to automatically migrate device network policies.
By extracting multi-dimensional behavioral features of the target device and combining them with the behavioral features of the target offline device, it is determined whether the device has an original identity. If the original identity is confirmed, a policy migration operation is performed, including copying network control policies and updating MAC addresses.
It enables reliable identification of device identities and automatic migration of network policies, ensuring zero-interruption execution of network management policies, reducing manual intervention by administrators, and improving management efficiency and user experience.
Smart Images
Figure CN122120325A_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of computer network technology, and in particular relates to a method and system for migrating device network policies. Background Technology
[0002] In related technologies, with increasing user awareness of privacy protection, mainstream operating systems and IoT devices have widely adopted random MAC address technology. When a device scans and connects to a Wi-Fi network, it uses a random, non-fixed MAC address. Existing network management policies (such as user control, device rate limiting, access permissions, etc.) heavily rely on the device's MAC address as a unique and stable identifier. When a device's MAC address changes, the gateway system identifies it as a completely new and unknown device, causing all previously configured network policies for that device to become invalid. Administrators must manually identify which old device this "new" device is actually and reconfigure its policies, resulting in extremely low management efficiency. Therefore, how to better achieve device network migration has become an urgent problem to be solved. Summary of the Invention
[0003] In view of the shortcomings of the prior art, the purpose of the invention is to provide a method and system for migrating device network policies.
[0004] In a first aspect, the present invention proposes a device network policy migration method, comprising: S1, upon detecting an online event of a target device, extracting device behavior features of the target device, the device behavior features including multi-dimensional behavior features; S2, determining a target offline device and extracting device behavior features of the target offline device, the target offline device being a currently offline device whose offline time is within a preset time window, wherein different types of offline devices correspond to different preset time windows; S3, determining whether the target device has an original identity based on the device behavior features of the target device and the device behavior features of the target offline device; S4, if it is determined that the target device has the original identity, performing a policy migration operation based on the original identity.
[0005] Furthermore, the number of target offline devices is one or more, wherein determining whether the target device has an original identity based on the device behavior characteristics of the target device and the device behavior characteristics of the target offline device includes: determining a first profile of the target device based on the device behavior characteristics of the target device; determining a second profile of each target offline device based on the device behavior characteristics of each target offline device; and determining whether the target device has an original identity based on the similarity score between the first profile and the second profile.
[0006] Further, the features in the first and second files are divided into Boolean features and aggregate features. The similarity score S = (Boolean feature weight × Boolean feature similarity) + (aggregate feature weight × aggregate feature similarity) is used to calculate the similarity score between the first and second files. If the Boolean features of the first and second files are the same, the Boolean feature similarity is 1; if the Boolean features of the first and second files are different, the Boolean feature similarity is 0. Calculate the similarity of the set-type features.
[0007] Further, based on the similarity scores of the first file and the second file, determining whether the target device has an original identity includes: determining a target similarity score where the similarity score exceeds a preset score, and determining the second file corresponding to the target similarity score, and using the second file corresponding to the target similarity score as a candidate file; determining whether the target device has an original identity based on the number of candidate files; wherein, when the number of candidate files is one, it is determined that the target device has an original identity, and the target offline device corresponding to the candidate file is taken as the original identity of the target device.
[0008] Furthermore, it also includes: when the number of candidate files is zero, determining that the target device is an unknown device and creating the first file for the target device; when the number of candidate files is multiple, determining the candidate file most recently accessed by the target device from the multiple candidate files; when the number of candidate files most recently accessed by the target device is one, taking the target offline device corresponding to the candidate file most recently accessed by the target device as the original identity of the target device.
[0009] Furthermore, the policy migration operation based on the original identity includes: copying and applying the network control policy of the original identity to the target device, updating the MAC address of the original identity to the MAC address of the target device, and setting the status of the original identity to online.
[0010] Furthermore, it also includes: executing the auxiliary verification mechanism on the target device and / or the target offline device when the triggering conditions of the auxiliary verification mechanism are met; wherein, the triggering conditions of the auxiliary verification mechanism include high security level policy migration and the frequency of changes in the device behavior characteristics being greater than a preset threshold.
[0011] A second aspect of the present invention provides a device network policy migration system, comprising: an extraction module, configured to extract device behavior features of the target device upon detecting an online event of the target device, the device behavior features including multi-dimensional behavior features; a determination module, configured to determine a target offline device and extract the device behavior features of the target offline device, the target offline device being a currently offline device whose offline time is within a preset time window, wherein different types of offline devices correspond to different preset time windows; a judgment module, configured to determine whether the target device has an original identity based on the device behavior features of the target device and the device behavior features of the target offline device; and a migration module, configured to perform a policy migration operation based on the original identity if it is determined that the target device has the original identity.
[0012] A third aspect of the present invention provides an electronic device comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor to enable the at least one processor to perform the method described in any one aspect of the present invention.
[0013] A fourth aspect of the present invention provides a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to cause the computer to perform the method described in any one of the first aspects of the present invention.
[0014] The beneficial effects of this invention are as follows: The device network policy migration method and system described in this invention, upon detecting a target device's online event, extracts the target device's device behavior characteristics, including multi-dimensional behavior features; identifies a target offline device and extracts its device behavior characteristics, defining the target offline device as one currently offline and whose offline time is within a preset time window, where different types of offline devices correspond to different preset time windows; based on the target device's and the target offline device's behavior characteristics, determines whether the target device retains its original identity; if the target device retains its original identity, performs a policy migration operation based on that original identity. This method, by combining multi-dimensional device behavior feature matching with device online / offline timing correlation, accurately identifies device identity changes caused by random MAC addresses, achieving reliable device identity identification and providing a foundation for automatic network policy migration. By performing a policy migration operation based on the original identity when the target device retains its original identity, it achieves hot policy migration, ensuring zero-interruption execution of network management policies. Attached Figure Description
[0015] The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Throughout the drawings, the same reference numerals denote the same parts. It is obvious that the drawings described below are merely some embodiments of the present invention, and those skilled in the art can obtain other drawings based on these drawings.
[0016] Figure 1 This is a flowchart of a device network policy migration method according to an embodiment of the present invention; Figure 2 This is a flowchart of a device network policy migration method according to a specific embodiment of the present invention; Figure 3 This is a schematic diagram of a device network policy migration system according to an embodiment of the present invention; Figure 4 This is a structural block diagram of an electronic device according to an embodiment of the present invention. Detailed Implementation
[0017] To enable those skilled in the art to better understand the technical solutions in the embodiments of the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. It should be understood that these descriptions are merely exemplary and are not intended to limit the scope of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.
[0018] Furthermore, descriptions of well-known structures and techniques are omitted in the following description to avoid unnecessarily obscuring the concepts disclosed in this invention.
[0019] In the description of this invention, it should be noted that, unless otherwise explicitly specified and limited, the terms "center," "upper," "lower," "left," "right," "vertical," "horizontal," "inner," and "outer," etc., indicating orientation or positional relationships based on the orientation or positional relationships shown in the accompanying drawings, are only for the convenience of describing the invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of the invention. Furthermore, the terms "first," "second," and "third" are used for descriptive purposes only and should not be construed as indicating or implying relative importance. The terms "installed," "connected," and "linked" should be interpreted broadly; for example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal communication of two components. Those skilled in the art can understand the specific meaning of the above terms in this invention based on the specific circumstances.
[0020] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numerals in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. Rather, they are merely examples of methods and systems consistent with some aspects of the invention as detailed in the appended claims.
[0021] With increasing user awareness of privacy protection, mainstream operating systems and IoT devices have widely adopted random MAC address technology. When a device scans and connects to a Wi-Fi network, it uses a random, non-fixed MAC address. Existing network management policies (such as user control, device rate limiting, and access permissions) heavily rely on the device's MAC address as a unique and stable identifier. When a device's MAC address changes, the gateway system identifies it as a completely new and unknown device, causing all previously configured network policies for that device to become invalid. Administrators must manually identify which old device this "new" device is actually and reconfigure its policies, resulting in extremely low management efficiency. Furthermore, random MAC address technology prevents network policies from being continuously and automatically applied to the same physical device, severely disrupting the continuity and effectiveness of network management. It also requires frequent manual intervention from network administrators, significantly increasing maintenance workload. Users (such as family members) may experience confusion and a poor user experience due to sudden policy failures (e.g., download speeds returning to full speed) or inability to access specific resources. Network systems cannot establish long-term, accurate profiles and behavioral analyses of devices with random MAC addresses.
[0022] To this end, the present invention proposes a device network policy migration method, system and related devices. Specifically, the device network policy migration method, system and related devices of the present invention are described below with reference to the accompanying drawings.
[0023] Figure 1 This is a flowchart of a device network policy migration method according to an embodiment of the present invention. It should be noted that the device network policy migration method of this embodiment can be applied to the device network policy migration system of this embodiment. This device network policy migration system can be configured on a network gateway or on a server. This application does not limit the scope of the application.
[0024] like Figure 1 As shown, the device network policy migration method includes: S110, upon detecting the online event of the target device, extracts the device behavior characteristics of the target device, which include multi-dimensional behavior characteristics.
[0025] In embodiments of the present invention, the network gateway can monitor for the presence of target device online events. Upon detecting a target device online event, the device behavior characteristics of the target device can be extracted. For example, when the target device connects to the network, its device behavior characteristics can be extracted through protocols such as DHCP requests, HTTP User-Agent, and mDNS service discovery.
[0026] Device behavioral characteristics include, but are not limited to, identity characteristics, behavioral characteristics, and communication pattern characteristics. Identity characteristics include device model, device brand, and device type; behavioral characteristics include commonly used service ports; and communication pattern characteristics include data packet size distribution, communication time patterns, and protocol usage habits.
[0027] S120, determine the target offline device and extract the device behavior characteristics of the target offline device. The target offline device is the current offline device and the offline time of the offline device is within a preset time window. Different types of offline devices correspond to different preset time windows.
[0028] In an embodiment of the present invention, a device that is currently offline and whose offline time is within a preset time window can be obtained, and this device can be used as a target offline device, thereby extracting the device behavior features of the target offline device.
[0029] In embodiments of the present invention, different types of offline devices correspond to different preset time windows. This means the time window is not fixed. For example, mobile devices that frequently go offline and back online (such as mobile phones and laptops) often leave the network and quickly return, resulting in a short time window (1-2 minutes). Fixed devices (such as smart home appliances and cameras) rarely go offline; when they do, it's more likely due to a restart or network fluctuations, leading to a longer time window (5-10 minutes). Therefore, the online / offline patterns of devices can be learned. If a device goes offline and back online at a fixed time each day, the time window can be automatically adjusted to adapt to this pattern.
[0030] S130, based on the device behavior characteristics of the target device and the device behavior characteristics of the target offline device, determine whether the target device has an original identity.
[0031] In embodiments of the present invention, the number of target offline devices is one or more.
[0032] In embodiments of the present invention, a first profile of the target device is determined based on the device behavior characteristics of the target device; a second profile of each target offline device is determined based on the device behavior characteristics of each target offline device; and the similarity score between the first and second profiles is used to determine whether the target device retains its original identity. Specific implementation details can be found in subsequent embodiments.
[0033] S140, if it is determined that the target device has an original identity, perform a policy migration operation based on the original identity.
[0034] In an embodiment of the present invention, if it is determined that the target device has an original identity, the network control policy of the original identity is copied and applied to the target device, the MAC address of the original identity is updated to the MAC address of the target device, and the status of the original identity is set to online.
[0035] The migration includes, but is not limited to, bandwidth limiting rules, access control lists, QoS priorities, and security policies.
[0036] According to the device network policy migration method of this invention, when a target device is detected to be online, the method extracts the device behavior features of the target device, which include multi-dimensional behavior features; identifies a target offline device and extracts its device behavior features, wherein the target offline device is a currently offline device whose offline time is within a preset time window, and different types of offline devices correspond to different preset time windows; based on the device behavior features of the target device and the target offline device, it determines whether the target device has an original identity; if it is determined that the target device has an original identity, the method performs a policy migration operation based on the original identity. This method combines multi-dimensional device behavior feature matching with device online / offline timing correlation to accurately identify device identity changes caused by random MAC addresses, achieving reliable device identity identification and providing a foundation for automatic network policy migration. By performing a policy migration operation based on the original identity when it is determined that the target device has an original identity, the method achieves hot policy migration and ensures zero-interruption execution of network management policies.
[0037] To enable those skilled in the art to more readily understand the present invention, Figure 2 This is a device network policy migration method according to a specific embodiment of the present invention, such as... Figure 2 As shown, the network policy migration method for this device includes: S210: Upon detecting an online event of the target device, extract the device behavior characteristics of the target device, which include multi-dimensional behavior characteristics.
[0038] S220, determine the target offline device and extract the device behavior characteristics of the target offline device. The target offline device is the current offline device and the offline time of the offline device is within a preset time window. Different types of offline devices correspond to different preset time windows.
[0039] In the embodiments of the present invention, the implementation of steps S210-S220 can refer to the implementation of steps S110-S120 described above, and the present invention will not repeat the details.
[0040] S230, based on the device behavior characteristics of the target device, determine the first profile of the target device.
[0041] In an embodiment of the present invention, when the device behavior characteristics of the target device are extracted, the device behavior characteristics of the target device can be used as the first profile of the target device.
[0042] S240, based on the device behavior characteristics of each target offline device, determines the second profile of each target offline device.
[0043] In embodiments of the present invention, the number of target offline devices is one or more.
[0044] In an embodiment of the present invention, when the device behavior characteristics of each target offline device are extracted, the device behavior characteristics of each target offline device can be used as a second profile of each target offline device.
[0045] S250 determines whether the target device has an original identity based on the similarity score between the first and second files.
[0046] In embodiments of the present invention, the features in the first file and the second file are divided into Boolean features and set features. The identity features (i.e., device model, device brand, device type) in the first file and the second file are Boolean features, and the behavioral features (i.e., commonly used service ports) in the first file and the second file are set features.
[0047] In an embodiment of the present invention, the similarity score between the first file and the second file is calculated based on the similarity score S = (Boolean feature weight × Boolean feature similarity) + (collective feature weight × collective feature similarity).
[0048] In this system, the sum of the Boolean feature weights and the aggregate feature weights is 1, i.e., device model weight + device brand weight + device type weight + commonly used service port weight = 1. In other words, each feature is assigned a weight coefficient, and the sum of the feature weights is 1. The principle for assigning weight coefficients is that features with higher stability and stronger discriminative power have greater weights. For example, device model has the highest weight, followed by device type and device brand, while commonly used service ports, as dynamic but functionally strong features, also have a certain weight.
[0049] In other words, the similarity score S = (Boolean feature weight × Boolean feature similarity) + (collective feature weight × collective feature similarity), which is equivalent to the similarity score S = (device model weight × device model similarity) + (device brand weight × device brand similarity) + (device type weight × device type similarity) + (common service port weight × common service port similarity).
[0050] If the first and second files have the same Boolean features, the Boolean feature similarity is 1; if the first and second files have different Boolean features, the Boolean feature similarity is 0. Specifically, if the first and second files have the same equipment model, the equipment model similarity is 1; if the equipment models are different, the equipment model similarity is 0. Similarly, if the first and second files have the same equipment type, the equipment type similarity is 1; if the equipment types are different, the equipment type similarity is 0. Finally, if the first and second files have the same equipment brand, the equipment brand similarity is 1; if the equipment brands are different, the equipment brand similarity is 0.
[0051] Among them, based on Calculate the set-type feature similarity, where, The closer the ratio is to 1, the more similar the set characteristics are, that is, the more similar the ports used by the target device and the target offline device are.
[0052] In an embodiment of the present invention, after obtaining the similarity scores of the target device and each target offline device, a target similarity score that exceeds a preset score is determined, and a second file corresponding to the target similarity score is determined, and the second file corresponding to the target similarity score is used as a candidate file; the existence of the original identity of the target device is determined based on the number of candidate files.
[0053] In the case of a single candidate file, the original identity of the target device is determined, and the target offline device corresponding to the candidate file is taken as the original identity of the target device.
[0054] If there are zero candidate files, the target device is determined to be an unknown device, and a first file for the target device is created. An empty or default set of network policies is initialized for the target device, awaiting manual configuration by the administrator.
[0055] In cases where there are multiple candidate files, the candidate file closest to the target device's online time is selected from among the multiple candidate files; in cases where there is only one candidate file closest to the target device's online time, the target offline device corresponding to the candidate file closest to the target device's online time is taken as the original identity of the target device.
[0056] If there are multiple candidate files that are closest to the target device's online time, the matching degree of secondary features such as device type and operating system will be further compared. If the problem still cannot be solved, automatic migration will not be carried out for the time being, and a pending log will be generated to notify the administrator for manual adjudication. At the same time, the target device will be processed according to the matching failure process.
[0057] S260, if it is determined that the target device has an original identity, perform a policy migration operation based on the original identity.
[0058] In an embodiment of the present invention, if it is determined that the target device has an original identity, the network control policy of the original identity is copied and applied to the target device, the MAC address of the original identity is updated to the MAC address of the target device, and the status of the original identity is set to online.
[0059] In other words, once it is determined that the target device is a new identity of a target offline device, the network control policy of that target offline device is copied and applied to the target device, the MAC address of the target offline device is updated to match the target device's MAC address, and the status of the target offline device is set to online. This maintains the continuity of device history, facilitates long-term behavioral analysis and log tracking, and simplifies the database structure, avoiding file redundancy.
[0060] In embodiments of the present invention, when the triggering conditions of the auxiliary verification mechanism are met, the auxiliary verification mechanism is executed on the target device and / or the target offline device.
[0061] The triggering conditions for the auxiliary verification mechanism include high-security policy migration and changes in device behavior characteristics exceeding a preset threshold. For example, for high-security policies, devices may be required to authenticate via a portal page or install a certificate upon initial access, thereby establishing a more robust identity binding at the application layer. The system can also record the history of device characteristic changes, marking and manually reviewing devices with frequently changing characteristics.
[0062] The device network policy migration method according to embodiments of the present invention performs similarity matching through multi-dimensional behavioral features, and comprehensively uses similarity scores of Boolean and set features to accurately determine device identity, avoiding misjudgments caused by relying solely on volatile identifiers such as MAC addresses. It automatically completes device identity recognition and policy migration, eliminating the need for administrators to manually configure policies for newly online devices, significantly reducing network management workload, and is particularly suitable for environments with frequent device online / offline cycles or large-scale networks. Different offline time windows are set for different types of devices (e.g., short window for mobile devices, long window for fixed devices), and can be dynamically adjusted according to the historical online / offline patterns of devices, making it more closely aligned with actual scenarios and improving identity matching accuracy. Timeliness and accuracy are ensured; auxiliary verification mechanisms (such as Portal authentication and certificate installation) can provide secondary confirmation for high-security policy migrations and mark and audit devices with frequently changing characteristics to prevent unauthorized devices from impersonating the user and ensure the strict enforcement of network policies. When multiple similar candidate files exist, further screening is performed using methods such as the closest online time and comparison of secondary characteristics. If a match still cannot be determined, migration is temporarily suspended and manual adjudication is notified to avoid incorrect policy application and ensure network stability. After a successful match, not only is the policy of the original identity copied to the new device, but information such as the MAC address is also updated to maintain the correct association between the policy and the device. At the same time, the device status is set to online, achieving seamless integration. This method is completely transparent to the device side, requires no device modifications, and is compatible with all standard devices that support random MAC addresses, effectively improving accuracy and reliability in complex scenarios.
[0063] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods of the various embodiments of this application.
[0064] According to one aspect of the present invention, a device network policy migration system is also proposed. Figure 3 This is a schematic diagram of a device network policy migration system according to an embodiment of the present invention; as shown. Figure 3 As shown, it includes: Extraction module 310 is used to extract device behavior features of the target device when an online event of the target device is detected. The device behavior features include multi-dimensional behavior features. The determination module 320 is used to determine the target offline device and extract the device behavior features of the target offline device. The target offline device is a current offline device and the offline time of the offline device is within a preset time window. Different types of offline devices correspond to different preset time windows. The judgment module 330 is used to determine whether the target device has an original identity based on the device behavior characteristics of the target device and the device behavior characteristics of the target offline device; The migration module 340 is used to perform a policy migration operation based on the original identity when it is determined that the target device has the original identity.
[0065] According to an embodiment of the present invention, the device network policy migration system, upon detecting an online event of a target device, extracts the device behavior characteristics of the target device, including multi-dimensional behavior characteristics; identifies a target offline device and extracts its device behavior characteristics, wherein the target offline device is a currently offline device whose offline time is within a preset time window, and different types of offline devices correspond to different preset time windows; based on the device behavior characteristics of the target device and the target offline device, determines whether the target device has an original identity; if it is determined that the target device has an original identity, performs a policy migration operation based on the original identity. Thus, by combining multi-dimensional device behavior characteristic matching with the correlation of device online / offline timing, it accurately identifies device identity changes caused by random MAC addresses, achieving reliable device identity identification and providing a foundation for automatic network policy migration. By performing a policy migration operation based on the original identity when it is determined that the target device has an original identity, it achieves hot policy migration and ensures zero-interruption execution of network management policies.
[0066] Optionally, the number of target offline devices is one or more, wherein the judgment module 330 is specifically used to determine a first profile of the target device based on the device behavior characteristics of the target device; determine a second profile of each target offline device based on the device behavior characteristics of each target offline device; and determine whether the target device has an original identity based on the similarity score between the first profile and the second profile.
[0067] Optionally, the judgment module 330 is specifically used to calculate the similarity score between the first file and the second file based on the similarity score S = (Boolean feature weight × Boolean feature similarity) + (collective feature weight × collective feature similarity); wherein, if the Boolean features of the first file and the second file are the same, then the Boolean feature similarity is 1; if the Boolean features of the first file and the second file are different, then the Boolean feature similarity is 0; wherein, based on Calculate the similarity of the set-type features.
[0068] Optionally, the judgment module 330 is specifically used to determine a target similarity score that exceeds a preset score, and to determine the second file corresponding to the target similarity score, and to use the second file corresponding to the target similarity score as a candidate file; to determine whether the target device has an original identity based on the number of candidate files; wherein, when the number of candidate files is one, it is determined that the target device has an original identity, and the target offline device corresponding to the candidate file is used as the original identity of the target device.
[0069] Optionally, the determination module 330 is specifically configured to: determine that the target device is an unknown device when the number of candidate files is zero, and create the first file of the target device; determine the candidate file that is closest to the online time of the target device from the multiple candidate files when the number of candidate files is multiple; and take the target offline device corresponding to the candidate file that is closest to the online time of the target device as the original identity of the target device when the number of candidate files closest to the online time of the target device is one.
[0070] Optionally, the migration module 340 is specifically used to copy and apply the network control policy of the original identity to the target device, update the MAC address of the original identity to the MAC address of the target device, and set the status of the original identity to online.
[0071] Optionally, it also includes a verification module, used to execute the auxiliary verification mechanism on the target device and / or the target offline device when the triggering conditions of the auxiliary verification mechanism are met; wherein, the triggering conditions of the auxiliary verification mechanism include high security level policy migration and the frequency of changes in the device behavior characteristics being greater than a preset threshold.
[0072] According to one aspect of the present invention, an electronic device is provided.
[0073] Figure 4 This is a schematic diagram of the structure of an electronic device according to an embodiment of the present invention. Figure 4 As shown, an electronic device may include one or more ( Figure 4Only one is shown in the image. A processor 102 (which may include, but is not limited to, a microprocessor unit (MPU) or a programmable logic device (PLD)) and a memory 104 for storing data are also shown. In one exemplary embodiment, the electronic device may further include a transmission device 106 for communication functions and an input / output device 108. Those skilled in the art will understand that... Figure 4 The structure shown is for illustrative purposes only and does not limit the structure of the terminal device described above. For example, the terminal device may also include components that are more... Figure 4 The more or fewer components shown, or having the same Figure 4 Equivalent functions or ratios shown Figure 4 The functions shown have more different configurations.
[0074] The memory 104 can be used to store computer programs, such as application software programs and modules, like the computer program corresponding to the device network policy migration method in this embodiment of the invention. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, thereby implementing the above-described method. The memory 104 may include high-speed random access memory and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the terminal device via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.
[0075] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of the switching device. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module used for wireless communication with the Internet.
[0076] This invention proposes a non-transitory computer-readable storage medium storing computer instructions for causing the computer to execute a device network policy migration method.
[0077] The applicant of this invention has provided a detailed description of the embodiments of the invention in conjunction with the accompanying drawings. However, those skilled in the art should understand that the above embodiments are merely preferred embodiments of the invention. The detailed description is only intended to help readers better understand the spirit of the invention and is not intended to limit the scope of protection of the invention. On the contrary, any improvements or modifications made based on the inventive spirit of the invention should fall within the scope of protection of the invention.
[0078] Furthermore, the functional units in the various embodiments of the present invention can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into a module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium.
[0079] The storage medium mentioned above can be a read-only memory, a disk, or an optical disk, etc. Although embodiments of the present invention have been shown and described above, it is to be understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those skilled in the art can make changes, modifications, substitutions, and variations to the above embodiments within the scope of the present invention.
[0080] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the embodiments of the present invention, and are not intended to limit them. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the protection scope of the present invention.
Claims
1. A method for migrating device network policies, characterized in that, include: S1, upon detecting an online event of the target device, extract the device behavior features of the target device, which include multi-dimensional behavior features; S2, determine the target offline device and extract the device behavior features of the target offline device. The target offline device is the current offline device and the offline time of the offline device is within a preset time window. Different types of offline devices correspond to different preset time windows. S3, based on the device behavior characteristics of the target device and the device behavior characteristics of the target offline device, determine whether the target device has an original identity; S4, if it is determined that the target device has the original identity, perform a policy migration operation based on the original identity.
2. The device network policy migration method according to claim 1, characterized in that, The number of target offline devices is one or more, wherein determining whether the target device has an original identity based on the device behavior characteristics of the target device and the device behavior characteristics of the target offline device includes: Based on the device behavior characteristics of the target device, a first file of the target device is determined; Based on the device behavior characteristics of each target offline device, a second profile for each target offline device is determined; Based on the similarity score between the first file and the second file, it is determined whether the target device has an original identity.
3. The device network policy migration method according to claim 2, characterized in that, The features in the first and second files are divided into Boolean features and set features, among which, The similarity score between the first file and the second file is calculated based on the similarity score S = (Boolean feature weight × Boolean feature similarity) + (collective feature weight × collective feature similarity). Wherein, if the Boolean features of the first file and the second file are the same, the Boolean feature similarity is 1; if the Boolean features of the first file and the second file are different, the Boolean feature similarity is 0. Among them, based on Calculate the similarity of the set-type features.
4. The device network policy migration method according to claim 2, characterized in that, Based on the similarity score between the first file and the second file, determine whether the target device has an original identity, including: A target similarity score is determined where the similarity score exceeds a preset score, and the second file corresponding to the target similarity score is determined, and the second file corresponding to the target similarity score is used as a candidate file; The presence of an original identity in the target device is determined based on the number of candidate files. Where the number of candidate files is one, it is determined that the target device has an original identity, and the target offline device corresponding to the candidate file is taken as the original identity of the target device.
5. The device network policy migration method according to claim 4, characterized in that, Also includes: If the number of candidate files is zero, the target device is determined to be an unknown device, and the first file for the target device is created. When there are multiple candidate files, the candidate file that is closest to the online time of the target device is determined from the multiple candidate files; If there is only one candidate file that is closest to the online time of the target device, the target offline device corresponding to the candidate file that is closest to the online time of the target device is taken as the original identity of the target device.
6. The device network policy migration method according to claim 1, characterized in that, Based on the original identity, perform policy migration operations, including: The network control policy of the original identity is copied and applied to the target device, the MAC address of the original identity is updated to the MAC address of the target device, and the status of the original identity is set to online.
7. The device network policy migration method according to claim 1, characterized in that, Also includes: If the triggering conditions of the auxiliary verification mechanism are met, the auxiliary verification mechanism is executed on the target device and / or the target offline device. The triggering conditions for the auxiliary verification mechanism include high-security-level policy migration and the frequency of changes in the device behavior characteristics exceeding a preset threshold.
8. A device network policy migration system, characterized in that, include: The extraction module is used to extract the device behavior features of the target device when the target device is detected to be online. The device behavior features include multi-dimensional behavior features. The determination module is used to determine the target offline device and extract the device behavior characteristics of the target offline device. The target offline device is a currently offline device and the offline time of the offline device is within a preset time window. Different types of offline devices correspond to different preset time windows. The judgment module is used to determine whether the target device has an original identity based on the device behavior characteristics of the target device and the device behavior characteristics of the target offline device; The migration module is used to perform a policy migration operation based on the original identity when it is determined that the target device has the original identity.
9. An electronic device, characterized in that, include: At least one processor; as well as A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the method of any one of claims 1 to 7.
10. A non-transitory computer-readable storage medium storing computer instructions, characterized in that, The computer instructions are used to cause the computer to perform the method according to any one of claims 1 to 7.