Intelligent learning-based dynamic construction method of an address conversion map of an internet-of-things terminal

Abstract

The intelligent learning-based dynamic construction method of the address conversion atlas of the Internet of Things terminal belongs to the technical field of power Internet of Things security and solves the problems of poor dynamic performance, low precision and insufficient automation in the existing address mapping method of the Internet of Things network terminal. The IP mapping data and network topology structure data are first collected, and the time-series data set is generated through cleaning, standardization, association and sorting. Then, the dynamic mapping relationship between the real IP address of the terminal and the gateway proxy IP address is learned by using a mixed model of DNN and CNN, and a trained deep learning model is obtained. Next, the model is called to predict all real IP addresses of the terminal in the time-series data set, generate IP mapping relationship pairs and construct a graphical address conversion atlas. Finally, the incremental data set is collected through the timing or event triggering mode, the model is fine-tuned by using the incremental learning, and the atlas is locally refreshed based on the updated model. The present application is suitable for dynamic conversion of the address atlas of the Internet of Things terminal.

Description

Technical Field

[0001] This invention belongs to the field of power Internet of Things security technology. Background Technology

[0002] Against the backdrop of building new power systems and smart IoT systems, the massive influx of heterogeneous IoT terminals into the network presents both unprecedented opportunities and challenges for the power grid. However, accurately and efficiently locating and tracing these terminals accessed through security gateways has become a technical bottleneck restricting the improvement of its security management capabilities. Therefore, developing an advanced terminal address mapping method is not only an urgent need for the development of IoT technology, but also a major issue serving power grid security and social stability, possessing extremely high research value and broad application prospects.

[0003] Traditional terminal address location methods can be mainly divided into two categories: methods based on traffic pattern association and methods based on static mapping rules.

[0004] The first type of method, especially the traffic feature analysis-based techniques that have emerged in recent years, attempts to trace the true IP address of a terminal by learning the correspondence between encrypted and decrypted traffic. Its basic logic is to find the correlation between encrypted traffic at the front end and decrypted traffic at the back end of the secure access zone by analyzing the statistical characteristics or behavioral patterns of the traffic. However, this method has encountered insurmountable obstacles in practice. The core dilemma lies in the high degree of randomness and unreadable nature of encrypted traffic itself; its characteristic information is often obscured by noise and anomalous data. For the analysis model, learning stable and distinguishable correlation patterns from heavily hidden and protected traffic is inherently paradoxical. Even the most diverse traffic samples relied upon for model training cannot exhaustively represent the true forms under all combinations of encryption protocols, network loads, and user behaviors. This makes the model highly susceptible to "overfitting," meaning the model only remembers specific traffic fluctuations from the training samples, and its correlation accuracy drops significantly when encountering new, unseen traffic patterns. In other words, the model learns the "associations in samples" rather than the abstract concept of a true "mapping relationship." This makes the method severely lacking in robustness and generalization ability when facing the complex and ever-changing network environment of the real world, ultimately leading to the failure of source tracing.

[0005] The second type of method relies on static rules configured manually, such as network device logs, to map IP addresses. For example, it uses static routing tables or NAT translation tables of routers and switches for marking. While this method is simple and intuitive, its drawbacks are becoming increasingly apparent in the context of dynamic and large-scale IoT networks. First, its mapping rules are highly lagging; once the network topology or terminal access status changes, the static rules cannot be automatically updated, requiring manual intervention, which is inefficient and prone to errors. Second, the mapping granularity is fixed; it maps all terminals under a gateway to the same proxy IP in a "one-size-fits-all" manner, completely ignoring individual terminal differences. Finally, this method has extremely poor dynamic adaptability and cannot keep up with frequent terminal online / offline cycles and dynamic IP address allocation. A terminal's network session may change at any time, and this static rule-based mapping method obviously cannot capture these dynamic characteristics.

[0006] In summary, traditional methods have significant shortcomings in terms of dynamism, accuracy, and automation, making it difficult to meet the actual needs of modern Internet of Things (IoT) networks for efficient, accurate, and secure management of massive numbers of terminals. Summary of the Invention

[0007] This invention aims to address the problems of poor dynamism, low accuracy, and insufficient automation in existing IoT network terminal address mapping methods. It provides a method for dynamically constructing IoT terminal address conversion maps based on intelligent learning.

[0008] The present invention describes a method for dynamically constructing an IoT terminal address translation map based on intelligent learning. This method includes:

[0009] Step 100: Collect IP mapping data and network topology data of IoT terminals in the target area, clean, standardize, associate and sort the collected data, and generate a processed time-series dataset.

[0010] Step 200: Construct a hybrid model using a deep neural network (DNN) and a convolutional neural network (CNN), and train the hybrid model using the time-series dataset to learn the dynamic mapping relationship between the terminal's real IP address and the gateway proxy IP address in the time-series dataset, thereby generating a trained deep learning model.

[0011] Step 300: Call the trained deep learning model to predict the terminal real IP address of all gateway proxy IP addresses in the time-series dataset, generate a set of IP mapping relationship pairs, and use the set of IP mapping relationship pairs to construct a graphical address translation graph.

[0012] Step 400: Collect new IP mapping data through timed or event-triggered methods to form an incremental dataset; use the incremental dataset to update and adjust the trained deep learning model; use the updated and adjusted deep learning model and the incremental dataset to update the graphical address translation map.

[0013] Furthermore, in this invention, in step one, the IP address mapping data of the IoT terminal includes: multiple IP mapping records, each record including: the terminal's real IP address, the gateway proxy IP address, a timestamp, and the device type;

[0014] The network topology data includes: the connection relationships of devices in the network. Each connection relationship record includes: source device identifier and destination device identifier. The key devices include node devices with routing, forwarding, address translation or network boundary delineation functions.

[0015] Furthermore, in this invention, step 100, the process of cleaning, standardizing, associating, and sorting the IP mapping data and network topology data of the IoT terminal to generate the processed time-series dataset, is as follows:

[0016] Step 101: Call the data cleaning method to compare the terminal real IP address, gateway proxy IP address and timestamp field of each mapping record in the data, remove duplicate mapping records, and detect and remove invalid data by setting IP address format rules and timestamp range, thereby cleaning the IP mapping data;

[0017] Step 102: Use the data standardization method to convert the IP address formats and timestamp formats from different sources in the cleaned IP mapping data into a standard form; obtain the standardized IP mapping data;

[0018] Step 103: Using a data association method, associate the device types in the standardized IP mapping data with the device identifiers in the network topology dataset, supplementing each IP mapping record with network topology location information; obtain the associated data;

[0019] Step 104: Using a data sorting method, the associated data is sorted in ascending order based on the timestamp field in the IP mapping record to form a time-series dataset.

[0020] Furthermore, in this invention, step 200, the process of generating the trained deep learning model, is as follows:

[0021] Step 201: Construct a hybrid model of deep neural network (DNN) and convolutional neural network (CNN); this model concatenates the outputs of DNN and CNN, and then encodes the concatenated gateway proxy IP address through a fully connected layer before outputting it;

[0022] Among them, deep neural networks (DNNs) are used to learn the non-linear mapping between the terminal's real IP address, timestamp, device type, network topology location characteristics and the gateway proxy IP address;

[0023] Convolutional Neural Networks (CNNs) are used to extract the spatial features of IP addresses in network topology.

[0024] Step 202: Use the time-series dataset as the training set, with the terminal's real IP address and timestamp, device type and network topology location features as input, and the gateway proxy IP address as the training target. Use the backpropagation algorithm and mean squared error loss function to train the hybrid model. Continuously adjust the model's weight parameters through gradient descent to minimize the loss function until the model converges, and obtain the trained deep learning model.

[0025] Furthermore, in this invention, in step 202, the loss function is:

[0026]

[0027] in, It is the sample size. It is the actual value. These are model predictions.

[0028] Furthermore, in this invention, the deep neural network (DNN) is activated using an activation function;

[0029] The activation function is:

[0030] Where x represents the linear combination result of neurons input to the activation function;

[0031] Convolutional Neural Networks (CNNs) use convolutional layers to capture the local spatial correlation between the terminal's real IP address and the gateway's proxy IP address.

[0032] The formula for calculating a convolutional layer is:

[0033] in, It is the input feature map. b is the convolution kernel, and b is the bias. It is the ReLU activation function.

[0034] Furthermore, in this invention, the specific process of constructing a graphical address translation graph of the set using the IP mapping relationship in step 300 is as follows:

[0035] Step 301: Call the trained deep learning model to predict the real IP address of the terminal for all gateway proxy IP addresses in the time-series dataset, and form IP mapping pairs;

[0036] Step 302: Call the graph generation algorithm to convert the IP mapping pairs into a graphical representation, and use the graphical tool library to generate the graph in the form of a network topology diagram.

[0037] Furthermore, in this invention, the process of updating the graphical address translation map in step 400 is as follows:

[0038] Step 401: Use timed triggering or network topology change event triggering as the triggering condition for map update; when map update is triggered, collect new IP mapping records generated since the last update to form an incremental dataset;

[0039] Step 402: Call the incremental learning algorithm, update and adjust the deep learning model using the incremental dataset, use the updated and adjusted deep learning model to predict the real IP addresses of all terminals in the incremental dataset, obtain the newly added IP mapping pairs, and use the newly added IP mapping pairs to update the graphical address translation graph.

[0040] Furthermore, in this invention, in step 402, the method for updating and adjusting the deep learning model using the incremental dataset is to adjust the model weight parameters:

[0041]

[0042] in, These are the updated model weights. These are the model weights before the update. It's the learning rate. It is the loss gradient calculated on incremental data. This indicates a newly added IP mapping pair.

[0043] This invention introduces multi-source data fusion and data preprocessing to deeply integrate IP mapping records with network topology information, forming a high-quality dataset rich in temporal features and location information, providing a reliable data foundation for deep learning models. Based on this, a hybrid DNN and CNN model is constructed. The DNN learns the complex nonlinear mapping patterns between the terminal's real IP address, timestamp, device type, and network location multidimensional features and the gateway proxy IP address. Simultaneously, the CNN extracts the spatial correlation features of IP addresses in the network topology, achieving accurate mining and modeling of dynamic mapping relationships. Furthermore, the model prediction results are transformed into a graphical representation, with nodes representing terminals and gateway devices, and edges representing mapping relationships with added confidence attributes, achieving intuitive visualization and interactive management of mapping relationships. Finally, relying on the incremental learning mechanism of the dynamic update module, the model can quickly adapt to changes in network topology and terminal status by only fine-tuning the newly generated incremental data, and only locally update the affected nodes and edges in the graph. This invention decouples static IP mapping rules into a dynamic adaptive learning system, effectively solving problems such as reliance on manual maintenance, coarse mapping granularity, poor dynamic adaptability, and overfitting in traditional methods. It achieves precise, automated, and visual management of IoT terminal address mapping relationships, significantly improving security control capabilities in scenarios with massive heterogeneous terminal access. Attached Figure Description

[0044] Figure 1 This is a flowchart of the method described in this invention. Detailed Implementation

[0045] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention. It should be noted that, unless otherwise specified, the embodiments and features in the embodiments of the present invention can be combined with each other.

[0046] Specific implementation method one: Refer to Figure 1 This embodiment specifically describes the method for dynamically constructing IoT terminal address translation maps based on intelligent learning. The method includes:

[0047] Step 100: Collect IP mapping data and network topology data of IoT terminals in the target area, clean, standardize, associate and sort the collected data, and generate a processed time-series dataset.

[0048] Step 200: Construct a hybrid model using a deep neural network (DNN) and a convolutional neural network (CNN), and train the hybrid model using the time-series dataset to learn the dynamic mapping relationship between the terminal's real IP address and the gateway proxy IP address in the time-series dataset, thereby generating a trained deep learning model.

[0049] Step 300: Call the trained deep learning model to predict the terminal real IP address of all gateway proxy IP addresses in the time-series dataset, generate a set of IP mapping relationship pairs, and use the set of IP mapping relationship pairs to construct a graphical address translation graph.

[0050] Step 400: Collect new IP mapping data through timed or event-triggered methods to form an incremental dataset; use the incremental dataset to update and adjust the trained deep learning model; use the updated and adjusted deep learning model and the incremental dataset to update the graphical address translation map.

[0051] Furthermore, in this embodiment, in step one, the IP address mapping data of the IoT terminal includes: multiple IP mapping records, each record including: the terminal's real IP address, the gateway proxy IP address, a timestamp, and the device type;

[0052] The network topology data includes: the connection relationships of devices in the network. Each connection relationship record includes: source device identifier and destination device identifier. The key devices include node devices with routing, forwarding, address translation or network boundary delineation functions.

[0053] Furthermore, in this embodiment, step 100, which involves cleaning, standardizing, associating, and sorting the IP mapping data and network topology data of the IoT terminal to generate a processed time-series dataset, is as follows:

[0054] Step 101: Call the data cleaning method to compare the terminal real IP address, gateway proxy IP address and timestamp field of each mapping record in the data, remove duplicate mapping records, and detect and remove invalid data by setting IP address format rules and timestamp range, thereby cleaning the IP mapping data;

[0055] Step 102: Use the data standardization method to convert the IP address formats and timestamp formats from different sources in the cleaned IP mapping data into a standard form; obtain the standardized IP mapping data;

[0056] Step 103: Using a data association method, associate the device types in the standardized IP mapping data with the device identifiers in the network topology dataset, supplementing each IP mapping record with network topology location information; obtain the associated data;

[0057] Step 104: Using a data sorting method, the associated data is sorted in ascending order based on the timestamp field in the IP mapping record to form a time-series dataset.

[0058] Furthermore, in this embodiment, step 200, the process of generating the trained deep learning model, is as follows:

[0059] Step 201: Construct a hybrid model of deep neural network (DNN) and convolutional neural network (CNN); this model concatenates the outputs of DNN and CNN, and then encodes the concatenated gateway proxy IP address through a fully connected layer before outputting it;

[0060] Among them, deep neural networks (DNNs) are used to learn the non-linear mapping between the terminal's real IP address, timestamp, device type, network topology location characteristics and the gateway proxy IP address;

[0061] Convolutional Neural Networks (CNNs) are used to extract the spatial features of IP addresses in network topology.

[0062] Step 202: Use the time-series dataset as the training set, with the terminal's real IP address and timestamp, device type and network topology location features as input, and the gateway proxy IP address as the training target. Use the backpropagation algorithm and mean squared error loss function to train the hybrid model. Continuously adjust the model's weight parameters through gradient descent to minimize the loss function until the model converges, and obtain the trained deep learning model.

[0063] Furthermore, in this embodiment, in step 202, the loss function is:

[0064]

[0065] in, It is the sample size. It is the actual value. These are model predictions.

[0066] Furthermore, in this embodiment, the deep neural network (DNN) is activated using an activation function;

[0067] The activation function is:

[0068] Where x represents the linear combination result of neurons input to the activation function;

[0069] Convolutional Neural Networks (CNNs) use convolutional layers to capture the local spatial correlation between the terminal's real IP address and the gateway's proxy IP address.

[0070] The formula for calculating a convolutional layer is:

[0071] in, It is the input feature map. b is the convolution kernel, and b is the bias. It is the ReLU activation function.

[0072] Furthermore, in this embodiment, the specific process of constructing a graphical address translation graph for the set using the IP mapping relationship in step 300 is as follows:

[0073] Step 301: Call the trained deep learning model to predict the real IP address of the terminal for all gateway proxy IP addresses in the time-series dataset, and form IP mapping pairs;

[0074] Step 302: Call the graph generation algorithm to convert the IP mapping pairs into a graphical representation, and use the graphical tool library to generate the graph in the form of a network topology diagram.

[0075] Furthermore, in this embodiment, the process of updating the current graphical address translation map in step 400 is as follows:

[0076] Step 401: Use timed triggering or network topology change event triggering as the triggering condition for map update; when map update is triggered, collect new IP mapping records generated since the last update to form an incremental dataset;

[0077] Step 402: Call the incremental learning algorithm, update and adjust the deep learning model using the incremental dataset, use the updated and adjusted deep learning model to predict the real IP addresses of all terminals in the incremental dataset, obtain the newly added IP mapping pairs, and use the newly added IP mapping pairs to update the graphical address translation graph.

[0078] Furthermore, in this embodiment, in step 402, the method for updating and adjusting the deep learning model using the incremental dataset is to adjust the model weight parameters:

[0079]

[0080] in, These are the updated model weights. These are the model weights before the update. It's the learning rate. It is the loss gradient calculated on incremental data. This indicates a newly added IP mapping pair.

[0081] The method described in this invention introduces a multi-source data fusion and preprocessing process, while simultaneously operating a deep learning mapping relationship learning module to fuse and learn multi-source data such as network device logs, terminal communication records, and network management systems. This allows for in-depth mining of the dynamic mapping relationship between terminal IPs and gateway proxy IPs, thereby constructing a graphical address translation graph to achieve accurate and automated management of IoT terminal address mapping relationships.

[0082] Specific implementation process:

[0083] Step S1: Data Acquisition;

[0084] The main purpose of this step is to obtain the basic dataset for model training and graph construction, including the IP mapping information of IoT terminals and network topology information.

[0085] IPMappingDataSet is a collection of IP address mapping information; this collection contains N IP mapping records (IPMappingRecord); each IPMappingRecord contains four core fields:

[0086] Terminal IP address: The actual IP address of the IoT terminal in the network.

[0087] Gateway IP address: The proxy IP address used by a terminal when accessing the network through a gateway or network isolation device.

[0088] Timestamp: The point in time when this mapping relationship occurred or was recorded.

[0089] DeviceType: The device type of the terminal or gateway, such as: {meter, sensor, router, firewall} and other enumerated values.

[0090] Input a set of network topology information, NetworkTopologySet; this set contains connection information for key devices in the network. Each connection information, Connection, in NetworkTopologySet contains two fields:

[0091] SourceDeviceID: A unique identifier for the starting device of the network connection.

[0092] DestinationDeviceID: A unique identifier for the terminating device of the network connection.

[0093] Step S2: Construct the Multi-source Data Fusion and Preprocessing Module (MDFPP); This step aims to clean, standardize, and integrate the collected IP mapping information and network topology information of IoT terminals to form a high-quality training dataset.

[0094] Step S201: Establish the MDFPP module. The input of this module is a set of IP address mapping information and a set of input network topology information. The output is a processed, time-series dataset, ProcessedMappingSet.

[0095] S202: Invoke the data cleaning method to process each IPMappingDataSet in the IP address mapping information set. Remove duplicate mapping records by comparing the TerminalIP, GatewayIP, and Timestamp fields. Detect, correct, or remove invalid data by setting rules for IP address format (e.g., IPv4 / IPv6 regular expressions) and timestamp range (e.g., whether it's within the last 30 days).

[0096] S203: Invoke the data standardization method to convert the IP address formats and timestamp formats from different sources into a unified standard form. For example, all timestamps should be unified to UTC time format.

[0097] S204: Call the data association method to associate the device type in the IP address mapping information set with the device identifier in the NetworkTopologySet, and supplement each mapping record with its location information in the network topology, such as the access switch port and the VLAN it belongs to.

[0098] S205: Call the data sorting method to sort the associated data in ascending order based on the Timestamp field, forming time-series data for subsequent time series analysis and incremental learning.

[0099] S206: Output the processed time-series data set as a ProcessedMappingSet.

[0100] S3: Construct a deep learning mapping relationship learning module MLML (Mapping Relationship LearningModule based on Deep Learning); the aim is to use this learning module to learn the complex, non-linear dynamic mapping relationship between terminal IP and gateway proxy IP from historical data.

[0101] S301: Utilize the constructed deep learning mapping relationship learning module MLML. The input of this module is ProcessedMappingSet, and the output is a trained deep learning model MappingModel.

[0102] S302: Deep Learning Mapping Relationship Learning Module MLML selects Deep Neural Networks (DNNs) and Convolutional Neural Networks (CNNs) as its core learning models. DNNs excel at learning the complex nonlinear mapping relationships between various features such as terminal IP, time, and network location and proxy IPs; while CNNs can extract the spatial features of IP addresses in the network topology (such as belonging to the same subnet, physical proximity, etc.). The combination of the two can more comprehensively characterize the mapping relationship.

[0103] A hybrid model is constructed using deep neural networks (DNNs) and convolutional neural networks (CNNs) as the core learning models. The input layer receives encoded features such as TerminalIP, Timestamp, DeviceType, and topological location; the DNN part contains three hidden layers using the ReLU activation function, the formula of which is:

[0104]

[0105] The CNN part performs convolution operations on the vector representation of IP addresses to capture local spatial relationships. Its convolutional layer calculation formula is as follows:

[0106]

[0107] in, It is the input feature map. b is the convolution kernel, b is the bias, and f() is the ReLU activation function.

[0108] Finally, the outputs of the DNN and CNN are concatenated and output through a fully connected layer to produce the final predicted GatewayIP code.

[0109] S303: Using the data in ProcessedMappingSet as the training set, with TerminalIP and related features as input, and GatewayIP as the training target, the hybrid model is trained using the backpropagation algorithm and the mean squared error loss function until the model converges. The formula for the mean squared error loss function is:

[0110]

[0111] in, It is the sample size. It is the actual value. These are model predictions.

[0112] S304: Save the trained hybrid model as a trained MappingModel.

[0113] S4: Constructing the Address Translation Graph (ATG) Generation Module. This step aims to use the trained model to generate a visual address translation graph that reflects the current network state.

[0114] S401: Establish the ATG generation module. The inputs to this module are MappingModel and ProcessedMappingSet, and the output is a graphical address translation map.

[0115] S402: The MappingModel is invoked to predict the TerminalIP of all records in the ProcessedMappingSet, obtaining the corresponding predicted GatewayIP, forming a complete set of model-calibrated IP mapping pairs. The innovation here is that the model not only predicts but also outputs a confidence score to represent the reliability of the mapping relationship. S403: A graph generation algorithm is invoked to convert the IP mapping pairs into a graphical representation. Nodes are created to represent network devices (terminals, gateways), and edges are created to represent mapping relationships. Attributes are added to nodes, such as IP address and device type; attributes are added to edges, such as mapping strength (quantified by model confidence) and last update time.

[0116] S404: Uses graphical tool libraries (such as D3.js, ECharts) to visualize the generated map as a network topology diagram, supporting interactive operations such as zooming, dragging, and highlighting queries by IP or device type.

[0117] S5: Implement a dynamic update mechanism for the address translation map; DUM (Dynamic Update Module) This step aims to enable the address translation map to adapt to changes in network topology and terminal access status, maintaining its accuracy and timeliness.

[0118] S501: Establish the DUM module. This module executes periodically (e.g., every 24 hours) or event-triggered (e.g., upon detecting a network topology change alarm) to update the trained MappingModel and address translation graph.

[0119] S502: Set a timer or an event listener as the trigger condition for the update mechanism.

[0120] S503: When the triggering condition is met, new IP mapping records generated since the last update are collected to form an incremental dataset IncrementalDataSet.

[0121] S504: Invoke the incremental learning algorithm, using the IncrementalDataSet to fine-tune the saved MappingModel, instead of completely retraining. The model only makes minor adjustments to its parameters using the new data, and its weight update formula can be simplified to:

[0122]

[0123] in, These are the updated model weights. These are the model weights before the update. It's the learning rate. It is the loss gradient calculated on incremental data. This indicates a newly added IP mapping pair.

[0124] S505: Using a fine-tuned MappingModel, it re-predicts the affected IP mapping relationships and only updates the nodes and edges that have changed in the address translation graph, achieving local and efficient graph refresh rather than global reconstruction.

[0125] One advantage of this invention is that it decouples static IP address mapping rules from the dynamic network environment, avoiding the dilemma of manual maintenance and rule updates. The IP mapping relationship of a terminal essentially stems from its location and communication behavior within the network topology, and these behaviors and locations are dynamically changing. Therefore, this invention introduces an intelligent learning model and an incremental update mechanism to establish a more stable and interpretable adaptive terminal address mapping system with dual data perspectives: historical mapping data and real-time network behavior data.

[0126] While the invention has been described herein with reference to specific embodiments, it should be understood that these embodiments are merely examples of the principles and applications of the invention. Therefore, it should be understood that many modifications can be made to the exemplary embodiments, and other arrangements can be designed without departing from the spirit and scope of the invention as defined by the appended claims. It should be understood that different dependent claims and features described herein can be combined in ways different from those described in the original claims. It is also understood that features described in conjunction with individual embodiments can be used in other described embodiments.

Claims

1. A method for dynamically constructing an IoT terminal address translation map based on intelligent learning, characterized in that, The method includes: Step 100: Collect IP mapping data and network topology data of IoT terminals in the target area, clean, standardize, associate and sort the collected data, and generate a processed time-series dataset. Step 200: Construct a hybrid model using a deep neural network (DNN) and a convolutional neural network (CNN), and train the hybrid model using the time-series dataset to learn the dynamic mapping relationship between the terminal's real IP address and the gateway proxy IP address in the time-series dataset, thereby generating a trained deep learning model. Step 300: Call the trained deep learning model to predict the terminal real IP address of all gateway proxy IP addresses in the time-series dataset, generate a set of IP mapping relationship pairs, and use the set of IP mapping relationship pairs to construct a graphical address translation graph. Step 400: Collect new IP mapping data through timed or event-triggered methods to form an incremental dataset; use the incremental dataset to update and adjust the trained deep learning model; use the updated and adjusted deep learning model and the incremental dataset to update the graphical address translation map.

2. The method for dynamically constructing IoT terminal address translation maps based on intelligent learning according to claim 1, characterized in that, In step 100, the IP address mapping data of the IoT terminal includes: multiple IP mapping records, each of which includes: the terminal's real IP address, the gateway proxy IP address, a timestamp, and the device type; The network topology data includes: the connection relationships of devices in the network, and the connection relationships include: source device identifier and destination device identifier. The key devices include node devices with routing, forwarding, address translation or network boundary delineation functions.

3. The method for dynamically constructing IoT terminal address translation maps based on intelligent learning according to claim 1, characterized in that, In step 100, the process of cleaning, standardizing, associating, and sorting the IP mapping data and network topology data of the IoT terminal to generate the processed time-series dataset is as follows: Step 101: Call the data cleaning method to compare the terminal real IP address, gateway proxy IP address and timestamp field of each mapping record in the data, remove duplicate mapping records, and detect and remove invalid data by setting IP address format rules and timestamp range, thereby cleaning the IP mapping data; Step 102: Use the data standardization method to convert the IP address formats and timestamp formats from different sources in the cleaned IP mapping data into a standard form; obtain the standardized IP mapping data; Step 103: Using a data association method, associate the device types in the standardized IP mapping data with the device identifiers in the network topology dataset, supplementing each IP mapping record with network topology location information; obtain the associated data; Step 104: Using a data sorting method, the associated data is sorted in ascending order based on the timestamp field in the IP mapping record to form a time-series dataset.

4. The method for dynamically constructing IoT terminal address translation maps based on intelligent learning according to claim 1, characterized in that, In step 200, the process of generating the trained deep learning model is as follows: Step 201: Construct a hybrid model of deep neural network (DNN) and convolutional neural network (CNN); this model concatenates the outputs of the deep neural network (DNN) and the convolutional neural network (CNN), and then encodes the concatenated gateway proxy IP address through a fully connected layer. Among them, the deep neural network (DNN) is used to learn the non-linear mapping pattern between the terminal's real IP address, timestamp, device type, network topology location characteristics and the gateway proxy IP address; Convolutional Neural Networks (CNNs) are used to extract the spatial features of IP addresses in network topology. Step 202: Use the time-series dataset as the training set, with the terminal's real IP address and timestamp, device type and network topology location features as input, and the gateway proxy IP address as the training target. Use the backpropagation algorithm and mean squared error loss function to train the hybrid model. Continuously adjust the model's weight parameters through gradient descent to minimize the loss function until the model converges, and obtain the trained deep learning model.

5. The method for dynamically constructing IoT terminal address translation maps based on intelligent learning according to claim 4, characterized in that, In step 202, the loss function is: in, It is the sample size. It is the actual value. These are model predictions.

6. The method for dynamically constructing IoT terminal address translation maps based on intelligent learning according to claim 4, characterized in that, Deep neural networks (DNNs) are activated using activation functions. The activation function is: Where x represents the linear combination result of neurons input to the activation function; Convolutional Neural Networks (CNNs) use convolutional layers to capture the local spatial correlation between the terminal's real IP address and the gateway's proxy IP address. The formula for calculating a convolutional layer is: in, It is the input feature map. b is the convolution kernel, and b is the bias. It is the ReLU activation function.

7. The method for dynamically constructing IoT terminal address translation maps based on intelligent learning according to claim 1, characterized in that, In step 300, the specific process of constructing a graphical address translation graph of the set using the IP mapping relationship is as follows: Step 301: Call the trained deep learning model to predict the real IP address of the terminal for all gateway proxy IP addresses in the time-series dataset, and form IP mapping pairs; Step 302: Call the graph generation algorithm to convert the IP mapping pairs into a graphical representation, and use the graphical tool library to generate the graph in the form of a network topology diagram.

8. The method for dynamically constructing IoT terminal address translation maps based on intelligent learning according to claim 1, characterized in that, In step 400, the process of updating the graphical address translation map is as follows: Step 401: Use timed triggering or network topology change event triggering as the triggering condition for map update; when map update is triggered, collect new IP mapping records generated since the last update to form an incremental dataset; Step 402: Call the incremental learning algorithm, update and adjust the deep learning model using the incremental dataset, use the updated and adjusted deep learning model to predict the real IP addresses of all terminals in the incremental dataset, obtain the newly added IP mapping pairs, and use the newly added IP mapping pairs to update the graphical address translation graph.

9. The method for dynamically constructing IoT terminal address translation maps based on intelligent learning according to claim 8, characterized in that, In step 402, the method for updating and adjusting the deep learning model using the incremental dataset is to adjust the model weight parameters: in, These are the updated model weights. These are the model weights before the update. It's the learning rate. It is the loss gradient calculated on incremental data. This indicates a newly added IP mapping pair.

Images