Router under-association equipment identification system based on multi-dimensional network message feature matching

Abstract

This invention relates to the field of network communication technology, and specifically discloses a router downstream device identification system based on multi-dimensional network packet feature matching. The system includes: a behavior modeling module that continuously captures packets from the downstream device to be analyzed and extracts and fuses multi-dimensional features to generate a dynamically updated device behavior profile composed of static identifier fingerprints and dynamic behavior pattern features; an intent reasoning module that, based on the device behavior profile and an intent classification rule base, performs real-time reasoning on the current network behavior intent of the downstream device to be analyzed, and outputs valid reasoning results and corresponding confidence levels; and a policy execution module that parses the valid reasoning results and corresponding confidence levels to obtain the functional role of the downstream device to be analyzed, dynamically configures differentiated network service quality policies based on the functional role of the downstream device to be analyzed, and triggers corresponding access control or security protection actions based on the security status attributes of the downstream device to be analyzed; providing a basis for supporting refined network management.

Description

Technical Field

[0001] This invention relates to the field of network communication technology, and in particular to a router downstream device identification system based on multi-dimensional network packet feature matching. Background Technology

[0002] In today's digital age, the interconnection of network devices is becoming increasingly complex. Accurate identification of downstream devices connected to routers is crucial for network management, security, and rational resource allocation. Router downstream device identification systems based on multi-dimensional network packet feature matching can accurately identify downstream devices through in-depth analysis of network packets, providing strong support for stable network operation and efficient management. With the rapid development of IoT technology, more and more devices are connecting to networks, making the application prospects of such identification systems extremely broad. They are expected to become one of the core technologies for future network management, driving network management towards intelligence and precision.

[0003] However, current router-connected device identification technologies have many shortcomings. Traditional identification methods often rely on single static features, such as MAC addresses or OUIs. This approach is too crude, unable to effectively distinguish between different models of devices from the same manufacturer, and MAC addresses are easily forged, posing a threat to network security. Furthermore, existing technologies are relatively rigid in feature extraction, typically employing a single-shot feature collection mode. This fails to update identification results in a timely manner as device behavior changes, rendering the original identification results invalid. Additionally, existing device identification schemes often only output basic device information, failing to deeply understand the device's network intent, making it difficult for network administrators to manage and control devices in a targeted manner. Moreover, network policy configuration lacks flexibility, employing a one-size-fits-all fixed model without differentiated configuration based on device function roles and security status. This results in unreasonable resource allocation and a lack of targeted security protection, failing to meet the needs of complex and ever-changing network environments.

[0004] Therefore, this invention proposes a router downstream device identification system based on multi-dimensional network packet feature matching. Summary of the Invention

[0005] This invention provides a router downstream device identification system based on multi-dimensional network packet feature matching. Utilizing advanced technologies, it extracts device features from multiple dimensions to construct a comprehensive device profile. This not only helps improve network security and prevent unauthorized device access, but also enables differentiated network resource allocation and quality of service assurance based on the device's function and security status, meeting the diverse needs of different devices.

[0006] This invention provides a router downstream device identification system based on multi-dimensional network packet feature matching, comprising: The behavior modeling module is used to continuously capture packets from the downstream devices to be analyzed on the router. Based on the time-series correlation algorithm, it extracts and fuses multi-dimensional features from the captured packets to generate a dynamically updated device behavior profile. The device behavior profile is composed of static identification fingerprints and dynamic behavior pattern features. The dynamic behavior pattern features are established by analyzing three types of time-series parameters: packet sending period, active port distribution, and traffic burst patterns. The intent reasoning module is used to perform real-time reasoning on the current network behavior intent of the downstream device to be analyzed based on the device behavior profile and the intent classification rule base. It outputs valid reasoning results and corresponding confidence scores, including device function roles and security status attributes. The intent classification rule base defines the mapping relationship from device behavior profile to device function roles and security status attributes. The policy execution module is used to parse valid inference results and corresponding confidence levels, obtain the functional roles of the downstream devices to be analyzed, dynamically configure differentiated network service quality policies according to the functional roles of the downstream devices to be analyzed, and trigger corresponding access control or security protection actions according to the security status attributes of the downstream devices to be analyzed.

[0007] Preferably, the behavior modeling module includes: The protocol feature extraction submodule is used to continuously capture, parse, and extract feature fields from DHCP, HTTP, mDNS, UPnP, and TCP protocol messages sent by the downstream device to be analyzed on the router locally. The feature fields include Option 55 parameter request list and Option 60 vendor category identifier in DHCP messages, User-Agent field in HTTP messages, service type field in mDNS messages, modelName field in UPnP messages, and window size field in TCP handshake messages. The time-series pattern analysis submodule is used to perform sliding window analysis on the feature field stream, calculate and output dynamic behavior pattern features, which include periodic parameters, burst parameters and stability parameters. The behavior profile fusion submodule is used to generate static identification features based on the latest extracted feature fields, and then structurally integrate the static identification features with the latest obtained dynamic behavior pattern features to generate dynamically updated device behavior profiles.

[0008] Preferably, the time-series pattern analysis submodule includes: The periodic parameter analysis unit is used to statistically analyze the mean and variance of the arrival time intervals of various protocol messages of the downstream device to be analyzed within the first dynamically updated time window according to the protocol type, so as to obtain periodic parameters. The port activity pattern analysis unit is used to record the set of TCP or UDP ports that appear more frequently than the frequency threshold and their active periods in the connections initiated by the downstream device to be analyzed within the dynamically updated second time window, forming a port activity pattern. The traffic burst pattern analysis unit is used to calculate the ratio of the standard deviation to the mean of the unit time traffic volume originating from the downstream device to be analyzed within the dynamically updated third time window, thus forming the traffic burst pattern.

[0009] Preferably, the intent reasoning module includes: The rule reasoning engine submodule is used to store the intent classification rule library; The confidence assessment submodule is used to calculate the degree of fit between the device behavior profile and the preconditions of the matching rules in the intent classification rule base, and to generate at least one initial inference result and corresponding confidence score by combining the number and weight of the matching rules. The intent output submodule is used to filter out initial inference results with a confidence level higher than a set confidence threshold from all initial inference results, output them as valid inference results, and bind the corresponding confidence level to the output.

[0010] Preferably, the confidence assessment submodule includes: The weight calculation unit is used to calculate the probability of occurrence of each feature in the device behavior profile based on the historical recognition sample library, and to calculate the information entropy value of each feature in combination with the information entropy formula, and to use the reciprocal of the information entropy value of each feature as the unique feature weight of each feature. The feature arrangement unit is used to arrange all features in the device behavior profile in a preset order to obtain a first feature sequence, and to arrange the precondition features of each rule in the intent classification rule base to obtain a second feature sequence for each rule. The distance calculation unit is used to calculate the normalized edit distance between the first feature sequence and the second feature sequence of each rule; The confidence calculation unit is used to calculate the confidence level of each rule based on the normalized edit distance between the first feature sequence and the second feature sequence of each rule, and the unique feature weights of all features in the first feature sequence.

[0011] Preferably, the intent reasoning module further includes: The local sample encapsulation unit is used to encapsulate the initial inference results with confidence levels not higher than the set confidence threshold and higher than the learning threshold, along with the corresponding device behavior profiles and feature fields of the original messages, into samples to be confirmed. It also initiates a sympathetic learning process for the corresponding downstream device to be analyzed, and filters and annotates all samples to be confirmed based on the sympathetic learning process to obtain samples to be learned. The cloud-based federated aggregation unit, deployed on a cloud server, receives learning samples from multiple routers and iteratively updates the intent classification rule base of each router using a federated averaging algorithm.

[0012] Preferably, the circumstantial learning process is an active exploratory learning process based on the ideas of multi-armed slot machines and collaborative filtering, specifically implementing the following steps: Step 1: Initialize the multiple candidate device functional roles contained in the initial inference results corresponding to the sample to be confirmed as multiple candidate arms of a multi-armed slot machine, and initialize a reward expectation value for each candidate arm; Step 2: In each decision cycle, based on the expected reward value of all candidate arms, select a target candidate arm to be pulled in this round using the upper confidence bound algorithm or the ε-greedy algorithm. Step 3: Based on the device function role corresponding to the target candidate arm, apply associated differentiated network strategy perturbations to the downstream devices to be analyzed corresponding to the samples to be confirmed, and collect the device behavior profiles generated by the downstream devices to be analyzed after the perturbations are applied as feedback behavior profiles. Step 4: Calculate the matching degree between the feedback behavior profile and the expected behavior pattern of the target candidate arm, as an immediate reward; Step 5: Update the expected reward value of the target candidate arm using the instant reward. At the same time, query the final confirmation results of other routers for devices with similar device behavior profiles from the cloud federated aggregation unit. If any final confirmation result is consistent with a candidate arm, then positively correct the expected reward value of the corresponding candidate arm. Step Six: Repeat steps two through five until the preset number of decision rounds is reached or the expected reward value of a certain candidate arm is significantly higher than that of other candidate arms. Then, select the device function role corresponding to the candidate arm with the highest final expected reward value as the annotation intent of the sample to be confirmed, which will be used to generate the sample to be learned.

[0013] Preferably, the intent reasoning module further includes: The interactive confirmation unit is used to prompt the user to manually specify or confirm the type information of a device when the confidence level of all initial inference results of a certain downstream device to be analyzed is not higher than the set confidence level threshold. The user confirmation result is obtained, and the user confirmation result, the corresponding device behavior profile, and the feature fields of the original packet are encapsulated as the learning sample of the corresponding router.

[0014] Preferably, the strategy execution module includes: The reasoning result parsing submodule is used to parse the reasoning results and corresponding confidence levels to obtain the functional roles of the downstream devices to be analyzed. The service policy execution submodule is used to retrieve the service quality policy library according to the functional role of the downstream device to be analyzed, determine the corresponding network service quality policy, and call the router's operating system interface to execute the corresponding network service quality policy. The parameters of the network service quality policy include bandwidth guarantee level, forwarding priority, NAT type preference, and specific port acceleration flag. The security action response submodule is used to determine the corresponding security status attributes based on the functional roles of the downstream devices to be analyzed, retrieve the security action response library based on the corresponding security status attributes, determine the corresponding access control or security protection actions, and call the router's operating system interface to execute the corresponding access control or security protection actions. The access control or security protection actions include alarms, traffic rate limiting, specific connection blocking, and isolation to the sandbox network.

[0015] Preferably, the service policy execution submodule integrates a dynamic bandwidth allocation model based on Poiseuille's law; The dynamic bandwidth allocation model compares the router's total outgoing bandwidth to a pipe with a fixed cross-section, and the data flow from the downstream devices to be analyzed, which have different functional roles, to fluids with different equivalent viscosities. The service policy execution submodule performs dynamic bandwidth allocation according to the following steps: Step 1: Based on the functional role of the downstream device to be analyzed, obtain the equivalent viscosity parameter and target flow rate priority of the corresponding data stream from the preset mapping table; Step 2: Based on Poiseuille's law, combined with the current total network bandwidth, the equivalent viscosity parameter of the data flow, and the target flow rate priority, dynamically calculate and allocate the bandwidth value of the data flow to each downstream device to be analyzed in real time.

[0016] The beneficial effects of this invention compared to existing technologies are as follows: By combining the static identifier fingerprint extracted and fused from continuously captured packets with dynamic behavioral pattern features through the behavior modeling module, a device-specific behavior fingerprint is formed, significantly improving device identification accuracy and anti-MAC forgery capabilities. Its continuous packet capture and profile update mechanism enables the system to adapt to the dynamic networking characteristics of mobile devices, IoT devices, etc., and to match device behavior changes in real time. The intent reasoning module, based on the device behavior profile and intent classification rule base, infers effective reasoning results in real time, including device functional roles and security status, providing a basis for supporting refined network management and facilitating operations such as bandwidth priority allocation and specific port acceleration. The policy execution module dynamically configures differentiated network service quality policies based on the reasoning results, and triggers corresponding security actions based on security status attributes, achieving coordinated optimization of security and user experience, ensuring network security while meeting the network needs of different devices.

[0017] Other features and advantages of the invention will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the invention. The objects and other advantages of the invention may be realized and obtained by means of the structures particularly pointed out in this application.

[0018] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description

[0019] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings: Figure 1 This is a diagram illustrating the overall architecture of the router downstream device identification system based on multi-dimensional network packet feature matching in this invention embodiment. Figure 2 This is an architecture diagram of the terminal static fingerprint management system in an embodiment of the present invention; Figure 3 This is a flowchart illustrating the dynamic behavior profile construction process in this embodiment of the invention. Figure 4 This is a flowchart illustrating the strategy execution and dynamic bandwidth allocation process in an embodiment of the present invention. Detailed Implementation

[0020] The preferred embodiments of the present invention will be described below with reference to the accompanying drawings. It should be understood that the preferred embodiments described herein are for illustration and explanation only and are not intended to limit the present invention.

[0021] like Figure 1 and Figure 2 As shown, this invention provides an implementation method for a router downstream device identification system based on multi-dimensional network packet feature matching, comprising: The behavior modeling module is used to continuously capture packets from the downstream devices to be analyzed on the router. Based on the time-series correlation algorithm, it extracts and fuses multi-dimensional features from the captured packets to generate a dynamically updated device behavior profile. The device behavior profile is composed of static identification fingerprints and dynamic behavior pattern features. The dynamic behavior pattern features are established by analyzing three types of time-series parameters: packet sending period, active port distribution, and traffic burst patterns. The intent reasoning module is used to perform real-time reasoning on the current network behavior intent of the downstream device to be analyzed based on the device behavior profile and the intent classification rule base. It outputs valid reasoning results and corresponding confidence scores, including device function roles and security status attributes. The intent classification rule base defines the mapping relationship from device behavior profile to device function roles and security status attributes. The policy execution module is used to parse valid inference results and corresponding confidence levels, obtain the functional roles of the downstream devices to be analyzed, dynamically configure differentiated network service quality policies according to the functional roles of the downstream devices to be analyzed, and trigger corresponding access control or security protection actions according to the security status attributes of the downstream devices to be analyzed.

[0022] In this embodiment, the downstream device to be analyzed refers to the device connected to the LAN port of the router, which the system identifies and analyzes. The system determines its relevant attributes and behavioral patterns by capturing its packets and other operations.

[0023] In this embodiment, the time-series correlation algorithm is used to analyze the interrelationship of data over time. The system processes the captured downstream device messages and analyzes the changes of various features in the messages over time to find the correlation patterns between them.

[0024] In this embodiment, multi-dimensional feature extraction and fusion involves extracting downlink device message features from multiple aspects and integrating these features together, such as extracting static identification features and dynamic behavior features and then fusing them to more accurately describe the characteristics of the device.

[0025] In this embodiment, the static fingerprint is a relatively fixed and unchanging identification information extracted from the device message, including the MAC address OUI segment, manufacturer identifier, etc., which can be used to preliminarily determine basic information such as the device manufacturer.

[0026] In this embodiment, dynamic behavior pattern characteristics are established by analyzing three types of time-series parameters, namely, message sending period, active port distribution, and traffic burst pattern, to reflect the dynamic network behavior characteristics of the device and help to understand the network behavior intention of the device.

[0027] In this embodiment, the message sending period refers to the time interval pattern of the device sending messages. The system obtains this period by statistically analyzing the time interval of the downstream device to be analyzed sending messages in different time periods, which reflects the frequency characteristics of the device's network activity.

[0028] In this embodiment, active port distribution refers to the set of TCP or UDP ports that appear more frequently than a set threshold when the downstream device to be analyzed initiates a connection within a certain time window, as well as their active periods, which can help to understand the network services or applications used by the device.

[0029] In this embodiment, the traffic burst mode is derived by calculating the ratio of the standard deviation to the mean of the unit time traffic volume originating from the downstream device to be analyzed within a certain dynamic update time window, which describes the degree of drastic change in device traffic during that time period.

[0030] In this embodiment, the intent classification rule base stores rules that map device behavior profiles to specific device functional roles and security status attributes. Based on these rules, the system infers device functional roles and security status attributes from the device behavior profiles.

[0031] In this embodiment, the device functional role indicates the function that the device undertakes in the network, such as a game host, and the security status attribute reflects the security status of the device. The system obtains this information by analyzing the device behavior profile and matching rule base.

[0032] In this embodiment, confidence score is used to measure the degree of fit between the device behavior profile and the matching rules in the intent classification rule base. The confidence score is generated by combining the number of matching rules and their weights, and represents the reliability of the inference result.

[0033] In this embodiment, the system analyzes the valid reasoning results and corresponding confidence levels to obtain the functional role of the downstream device to be analyzed. That is, the system analyzes and interprets the output of the intent reasoning module to obtain the functional role information of the device in the network.

[0034] In this embodiment, the network service quality policy is a series of network configuration policies determined from the service quality policy library based on the functional roles of the downstream devices to be analyzed. The parameters include bandwidth guarantee level, etc., to provide appropriate network service quality assurance for the devices.

[0035] In this embodiment, access control or security protection actions are operations determined and executed from the security action response library based on the security status attributes of the downstream device to be analyzed, including alarms, to ensure network security.

[0036] like Figure 3 As shown, to continuously capture various protocol packets of the downstream device to be analyzed locally on the router and extract feature fields, generate dynamic behavior pattern features through sliding window analysis, and then integrate them with static identification features to generate a dynamically updated and accurate device behavior profile, a behavior modeling module is proposed, including: The protocol feature extraction submodule is used to continuously capture, parse, and extract feature fields from DHCP, HTTP, mDNS, UPnP, and TCP protocol messages sent by the downstream device to be analyzed on the router locally. The feature fields include Option 55 parameter request list and Option 60 vendor category identifier in DHCP messages, User-Agent field in HTTP messages, service type field in mDNS messages, modelName field in UPnP messages, and window size field in TCP handshake messages. The time-series pattern analysis submodule is used to perform sliding window analysis on the feature field stream, calculate and output dynamic behavior pattern features, which include periodic parameters, burst parameters and stability parameters. The behavior profile fusion submodule is used to generate static identification features based on the latest extracted feature fields, and then structurally integrate the static identification features with the latest obtained dynamic behavior pattern features to generate dynamically updated device behavior profiles.

[0037] In this embodiment, DHCP, HTTP, mDNS, UPnP, and TCP protocol messages are the key protocol messages that the system focuses on when capturing and analyzing messages from downstream devices. DHCP is used for dynamically allocating network addresses, HTTP is commonly used for web page data transmission, mDNS enables zero-configuration discovery of devices within a local area network, UPnP supports automatic device discovery and network service interaction, and TCP ensures reliable data stream transmission. The system obtains device-related information by parsing these protocol messages.

[0038] In this embodiment, the Option 55 parameter request list in the DHCP message reflects the network configuration parameter information requested by the device, and the Option 60 vendor category identifier displays the device's vendor-related information; the User-Agent field in the HTTP message contains information such as the device's software application and operating system; the Service Type field in the mDNS message indicates the type of network service provided or requested by the device; the modelName field in the UPnP message reflects the device's model name; and the window size field in the TCP handshake message reflects the buffer size for receiving and sending data. These fields are all key sources of information for the system to extract device characteristics.

[0039] In this embodiment, static identification features are generated based on the latest extracted feature fields. This means that relatively fixed feature fields that can identify the device identity, such as Option60 vendor category identifier and modelName field, which are recently obtained from protocol messages such as DHCP and HTTP, are used to generate static identification features that represent the inherent attributes of the device, and thus serve as one of the basic information for identifying the device.

[0040] In this embodiment, static identification features are structurally integrated with the latest obtained dynamic behavior pattern features to generate a dynamically updated device behavior profile. This involves combining static identification features reflecting the inherent attributes of the device with dynamic behavior pattern features obtained through analysis of packet transmission cycles, active port distribution, etc., according to a specific structural method. This integration comprehensively and dynamically depicts the device's behavioral characteristics and identity information in the network, forming a continuously updated device behavior profile that reflects the device's real-time status, providing a comprehensive basis for subsequent device intent inference.

[0041] like Figure 3As shown, to accurately analyze and generate dynamic behavior pattern characteristics from different dimensions by statistically analyzing the mean and variance of message arrival time intervals according to protocol type, recording port activity patterns, and calculating traffic burst patterns, a time-series pattern analysis submodule is proposed, including: The periodic parameter analysis unit is used to statistically analyze the mean and variance of the arrival time intervals of various protocol messages of the downstream device to be analyzed within the first dynamically updated time window according to the protocol type, so as to obtain periodic parameters. The port activity pattern analysis unit is used to record the set of TCP or UDP ports that appear more frequently than the frequency threshold and their active periods in the connections initiated by the downstream device to be analyzed within the dynamically updated second time window, forming a port activity pattern. The traffic burst pattern analysis unit is used to calculate the ratio of the standard deviation to the mean of the unit time traffic volume originating from the downstream device to be analyzed within the dynamically updated third time window, thus forming the traffic burst pattern.

[0042] In this embodiment, the dynamically updated first time window is a specific time period used to statistically analyze the arrival time intervals of various protocol messages from the downstream device to be analyzed. This window is not fixed, but will be dynamically adjusted according to the system operation. By performing data statistics within this window, parameters related to the periodicity of device message transmission can be obtained.

[0043] In this embodiment, "various protocol messages" refers to different types of protocol messages such as DHCP, HTTP, mDNS, UPnP, and TCP. These protocol messages carry different information about the downstream devices being analyzed in network communication. Each protocol message has its specific purpose and format, and the system analyzes them to gain a comprehensive understanding of the devices' network behavior.

[0044] In this embodiment, the mean and variance of the arrival time intervals of various protocol messages from the downstream device under analysis within the dynamically updated first time window are statistically analyzed according to protocol type. That is, for messages of different protocols such as DHCP and HTTP, the average value and dispersion of their arrival time intervals within the dynamically changing first time window are calculated respectively. The mean reflects the average time interval of message transmission, while the variance reflects the fluctuation of the time interval, thereby analyzing the message transmission cycle patterns of the device based on different protocols.

[0045] In this embodiment, the dynamically updated second time window is also a time period that is dynamically adjusted with the operation of the system. It is mainly used to record data related to the port usage of the downstream devices to be analyzed in the network connection, providing a time range basis for analyzing the distribution of active ports of the devices.

[0046] In this embodiment, the frequency threshold is a pre-set numerical standard. When analyzing the port usage of downstream devices, only ports whose usage frequency exceeds this threshold will be given special attention and recorded. This filters out frequently used active ports and eliminates interference from occasionally used ports, making the analysis more targeted.

[0047] In this embodiment, the set of TCP or UDP ports used by the downstream device to be analyzed in the connection initiated within the dynamically updated second time window, which have an occurrence frequency exceeding the occurrence frequency threshold, and their active periods are recorded. In other words, within the dynamically changing second time window, the TCP or UDP ports used by the device when initiating a connection that reach or exceed the set threshold are recorded, and the time periods during which these ports are in an active state are recorded, thereby understanding the distribution and time pattern of active ports used by the device.

[0048] In this embodiment, the dynamically updated third time window is also a dynamically changing time period. This window is used to collect data related to the unit time flow of the downstream device to be analyzed, providing a time definition for analyzing the burst mode of device flow.

[0049] In this embodiment, the ratio of the standard deviation to the mean of the unit-time flow rate from the downstream device to be analyzed within the dynamically updated third time window is calculated. This involves statistically analyzing the unit-time flow rate of the devices within this dynamically adjusted third time window and then calculating the ratio of its standard deviation to the mean. This ratio reflects the degree of fluctuation in device flow rate during this period and can be used to analyze the pattern and severity of sudden flow rate spikes.

[0050] To accurately infer the network behavior intent of downstream devices by storing an intent classification rule base, calculating the fit between device behavior profiles and rule preconditions, generating initial inference results and confidence levels by combining the number and weight of rules, and filtering out valid inference results, an intent inference module is proposed, including: The rule reasoning engine submodule is used to store the intent classification rule library; The confidence assessment submodule is used to calculate the degree of fit between the device behavior profile and the preconditions of the matching rules in the intent classification rule base, and to generate at least one initial inference result and corresponding confidence score by combining the number and weight of the matching rules. The intent output submodule is used to filter out initial inference results with a confidence level higher than a set confidence threshold from all initial inference results, output them as valid inference results, and bind the corresponding confidence level to the output.

[0051] In this embodiment, the preconditions for matching rules in the intent classification rule base are based on a series of conditions set by the device behavior profile. These conditions originate from the combination and limitation of multi-dimensional information such as static identification features and dynamic behavior pattern features in the device behavior profile. For example, it may be stipulated that the device behavior profile must simultaneously meet certain conditions such as a specific message sending cycle range, a specific distribution of active ports, and a specific static identification fingerprint in order to conform to a certain matching rule, thereby serving as the basis for inferring the device's functional role and security status attributes.

[0052] In this embodiment, the number and weight of matching rules are defined as follows: the number of matching rules refers to the total number of rules in the intent classification rule base that match the current behavioral profile characteristics of the device; the weight is a numerical value assigned to each matching rule to measure its importance in the reasoning process. Different rules are assigned different weights because they contribute differently to accurately determining the device's functional role and security status attributes. For example, rules corresponding to features closely related to the device's core functions may be assigned higher weights. By combining the number and weight of these rules, the credibility of the reasoning results can be assessed more accurately.

[0053] In this embodiment, the initial inference results are preliminary inferences about the device's functional roles and security status attributes derived by the intent inference module after matching the device behavior profile with the intent classification rule base. These results are based on the matching of the current device behavior profile with the rules in the rule base, but the results at this stage have not yet undergone further processing such as confidence level filtering, and may contain inaccurate or unreliable inferences, requiring further analysis and judgment.

[0054] In this embodiment, a confidence threshold is set, which is a predetermined numerical standard. The intent reasoning module compares the confidence of the initial reasoning result with this threshold. Only when the confidence is higher than the set confidence threshold is the corresponding initial reasoning result considered a valid reasoning result, and the output serves as the basis for judging the device's functional role and security status attributes. This threshold serves to filter reliable reasoning results, ensuring that the final output result has a high degree of credibility.

[0055] To determine unique feature weights by calculating feature information entropy based on a historical recognition sample database, arranging feature sequences and calculating normalized edit distance, and then accurately calculating the confidence level corresponding to each rule, thus providing a reliable confidence assessment for intent reasoning, a confidence assessment submodule is proposed, including: The weight calculation unit is used to calculate the probability of occurrence of each feature in the device behavior profile based on the historical recognition sample library, and to calculate the information entropy value of each feature in combination with the information entropy formula, and to use the reciprocal of the information entropy value of each feature as the unique feature weight of each feature. The feature arrangement unit is used to arrange all features in the device behavior profile in a preset order to obtain a first feature sequence, and to arrange the precondition features of each rule in the intent classification rule base to obtain a second feature sequence for each rule. The distance calculation unit is used to calculate the normalized edit distance between the first feature sequence and the second feature sequence of each rule; The confidence calculation unit is used to calculate the confidence level of each rule based on the normalized edit distance between the first feature sequence and the second feature sequence of each rule, and the unique feature weights of all features in the first feature sequence.

[0056] In this embodiment, the historical identification sample library stores relevant sample data from past identification processes of various devices. These samples include behavioral profiles of different devices in various network scenarios and corresponding accurate identification results, providing a reference for the identification and analysis of current devices. By learning from and comparing historical samples, the relationship between device characteristics and identification results can be better understood.

[0057] In this embodiment, the features in the device behavior profile encompass both static identification features and dynamic behavior pattern features. Static identification features, such as the MAC address OUI segment and vendor identifier, are relatively fixed identification information for the device; dynamic behavior pattern features, such as packet sending cycle and active port distribution, reflect the device's dynamic behavior in the network. These features describe the device from multiple dimensions and are important bases for identifying the device and inferring its behavioral intentions.

[0058] In this embodiment, the probability of occurrence of each feature in the device behavior profile is calculated based on the historical recognition sample library, and the information entropy value of each feature is calculated using the information entropy formula. Specifically, the probability of occurrence of each feature is obtained by statistically analyzing the number of times each feature appears in the historical recognition sample library and dividing by the total number of samples. Then, the information entropy formula is used; the information entropy value is related to the probability of feature occurrence. The more uniform the probability, the higher the information entropy value, and vice versa. The information entropy value can measure the uncertainty or discriminative power of a feature; features with low entropy values ​​have stronger discriminative power in device recognition.

[0059] In this embodiment, the preset order is a rule set in advance to unify the arrangement of features. Since the device behavior profile contains multiple different types of features, in order to accurately calculate the similarity between feature sequences, the features need to be arranged in a specific order to ensure consistency and comparability in each calculation.

[0060] In this embodiment, all features in the device behavior profile are arranged in a preset order to obtain a first feature sequence. Specifically, static identifier features and dynamic behavior pattern features in the device behavior profile are arranged sequentially according to a pre-defined order to form an ordered feature sequence. This sequence contains key information describing the device and forms the basis for matching and calculating similarity with rules in the intent classification rule base.

[0061] In this embodiment, the precondition features of each rule in the intent classification rule base are arranged to obtain the second feature sequence of each rule. This involves arranging the features related to the preconditions of each matching rule in the intent classification rule base in the same preset order as the first feature sequence. In this way, each rule has a corresponding feature sequence, facilitating comparison and analysis with the first feature sequence of the device behavior profile.

[0062] In this embodiment, the normalized edit distance between the first feature sequence and the second feature sequence of each rule is calculated. The normalized edit distance is used to measure the similarity between two sequences. It calculates the minimum number of editing operations (such as inserting, deleting, or replacing characters or features) required to transform one sequence into another and then normalizes the result. The smaller the distance, the more similar the two sequences are. By calculating this distance, the degree of matching between the device behavior profile and the preconditions of each rule can be determined.

[0063] In this embodiment, the confidence level of each rule is calculated based on the normalized edit distance between the first feature sequence and the second feature sequence of each rule, and the unique feature weights of all features in the first feature sequence. Specifically, the sequence similarity reflected by the normalized edit distance is combined with the unique feature weight determined by the information entropy value of each feature. Generally, the higher the similarity and the larger the unique feature weight, the higher the confidence level of the corresponding rule. Combining these two factors allows for a more comprehensive and accurate assessment of the matching credibility between each rule and the device behavior profile, providing a basis for ultimately determining the device's functional role and security status attributes.

[0064] To encapsulate initial inference results and related information with confidence levels not exceeding a set confidence threshold but exceeding a learning threshold into samples to be confirmed, a learning sample is formed through a circumstantial learning process of screening and annotation. Then, the cloud-based federated aggregation unit uses a federated averaging algorithm to receive and update the intent classification rule base of each router, thereby improving the inference accuracy of the intent inference module and the overall performance of the rule base. An intent inference module is proposed, which also includes: The local sample encapsulation unit is used to encapsulate the initial inference results with confidence levels not higher than the set confidence threshold and higher than the learning threshold, along with the corresponding device behavior profiles and feature fields of the original messages, into samples to be confirmed. It also initiates a sympathetic learning process for the corresponding downstream device to be analyzed, and filters and annotates all samples to be confirmed based on the sympathetic learning process to obtain samples to be learned. The cloud-based federated aggregation unit, deployed on a cloud server, receives learning samples from multiple routers and iteratively updates the intent classification rule base of each router using a federated averaging algorithm.

[0065] In this embodiment, the learning threshold is a critical value used to determine whether the initial inference result needs to enter a specific learning process. When the confidence level of the initial inference result output by the intent inference module is not higher than the set confidence threshold, but higher than the learning threshold, these initial inference results and related data will be further processed, such as being packaged into samples to be confirmed and the circumstantial learning process will be started, thereby balancing the requirements for the reliability of the inference result and the system's need to learn new device features.

[0066] In this embodiment, the feature fields of the original message refer to the information fields extracted from device identification and connection interaction messages captured from the router's LAN port. Examples include the Option55 parameter request list in DHCP messages and the User-Agent field in HTTP messages. These fields contain information about the device's hardware identification, network configuration, communication behavior, and other aspects, serving as a crucial data foundation for building device behavior profiles, performing device identification, and intent reasoning.

[0067] In this embodiment, the cloud server is a remote server with powerful computing and storage capabilities. Within the system, it receives learning samples uploaded from multiple routers, processes these samples using a federated averaging algorithm, updates the intent classification rule base, and synchronizes the updated content to each router. It plays a core role in aggregating data, optimizing the rule base, and coordinating information exchange between routers, thereby improving the entire system's ability to identify downstream devices.

[0068] In this embodiment, the samples to be confirmed are encapsulated from initial inference results with a confidence level not higher than a set confidence threshold but higher than a learning threshold, along with the corresponding device behavior profile and feature fields of the original message. The credibility of the inference results of these samples is in an intermediate state and needs to be further confirmed through circumstantial learning processes or user interaction to determine their accurate device functional roles and security status attributes, thereby providing reliable data for the system to learn new device features.

[0069] In this embodiment, the samples to be learned are filtered and annotated samples, originating from samples awaiting confirmation. All samples awaiting confirmation are filtered and annotated through a circumstantial learning process, such as an active exploratory learning process based on multi-armed slot machine and collaborative filtering concepts. Finally, samples with accurate annotation information are determined. These samples will be used to update the intent classification rule base of each router, enabling the system to continuously learn new device features and improve its recognition capabilities.

[0070] In this embodiment, a federated averaging algorithm is used to iteratively update the intent classification rule base of each router. Specifically, the cloud server receives training samples uploaded by multiple routers and performs aggregation calculations on these samples. While protecting the data privacy of each router, the federated averaging algorithm integrates the features of the sample data from each router to calculate update parameters that represent global features. These update parameters are then distributed to each router, and each router updates its own intent classification rule base based on these parameters. This achieves collaborative updating and optimization of the entire system's intent classification rule base, improving the accuracy and comprehensiveness of downstream device identification.

[0071] To encapsulate low-confidence but valuable initial inference results into samples to be verified, an annotation process based on multi-armed slot machine and collaborative filtering is used to filter and annotate the data. Then, cloud-based federated aggregation updates the intent classification rule base, improving its accuracy and adaptability. The proposed circumstantial learning process is an active exploratory learning process based on multi-armed slot machine and collaborative filtering, specifically executing the following steps: Step 1: Initialize the multiple candidate device functional roles contained in the initial inference results corresponding to the sample to be confirmed as multiple candidate arms of a multi-armed slot machine, and initialize a reward expectation value for each candidate arm; Step 2: In each decision cycle, based on the expected reward value of all candidate arms, select a target candidate arm to be pulled in this round using the upper confidence bound algorithm or the ε-greedy algorithm. Step 3: Based on the device function role corresponding to the target candidate arm, apply associated differentiated network strategy perturbations to the downstream devices to be analyzed corresponding to the samples to be confirmed, and collect the device behavior profiles generated by the downstream devices to be analyzed after the perturbations are applied as feedback behavior profiles. Step 4: Calculate the matching degree between the feedback behavior profile and the expected behavior pattern of the target candidate arm, as an immediate reward; Step 5: Update the expected reward value of the target candidate arm using the instant reward. At the same time, query the final confirmation results of other routers for devices with similar device behavior profiles from the cloud federated aggregation unit. If any final confirmation result is consistent with a candidate arm, then positively correct the expected reward value of the corresponding candidate arm. Step Six: Repeat steps two through five until the preset number of decision rounds is reached or the expected reward value of a certain candidate arm is significantly higher than that of other candidate arms. Then, select the device function role corresponding to the candidate arm with the highest final expected reward value as the annotation intent of the sample to be confirmed, which will be used to generate the sample to be learned.

[0072] In this embodiment, the initial inference result includes multiple candidate device functional roles, which are preliminary inferences of several possible device functional roles given by the intent inference module after matching the device behavior profile with the intent classification rule base. Since the confidence level of the initial inference result is limited, it cannot determine the unique functional role of the device, so there are multiple candidates. For example, it is possible to infer that the device has different functional roles such as both a smart TV and a network set-top box.

[0073] In this embodiment, the multiple candidate device functional roles contained in the initial inference result corresponding to the sample to be confirmed are initialized as multiple candidate arms of a multi-armed slot machine. This utilizes the multi-armed slot machine algorithm, treating each candidate device functional role as an operating arm of the multi-armed slot machine. Each arm represents a hypothetical device functional role possibility, and a series of operations are subsequently used to explore which arm corresponds to the actual functional role of the device.

[0074] In this embodiment, a reward expectation value is initialized for each candidate arm, that is, an initial expected benefit value is set for each arm representing the functional role of the candidate device. This value is uniformly set at the beginning of the algorithm and will be adjusted later based on actual feedback. It is an initial reference value for measuring whether it is worthwhile to select a certain arm, and is used to guide the algorithm to explore and select among different arms.

[0075] In this embodiment, the decision cycle is a time unit or operational phase in the multi-armed slot machine algorithm. Within each decision cycle, the algorithm selects a target candidate arm to operate on based on the expected reward value of each candidate arm using a specific algorithm. That is, it attempts to assume the functional role of a candidate device as the real role and observes the device's reaction to gradually determine the device's true functional role.

[0076] In this embodiment, based on the expected reward values ​​of all current candidate arms, a target candidate arm to be activated in this round is selected using either the upper confidence bound algorithm or the ε-greedy algorithm. The upper confidence bound algorithm comprehensively considers the expected reward value and uncertainty of candidate arms, prioritizing arms with high uncertainty but potentially high returns, in order to balance exploring new possibilities and utilizing existing experience; the ε-greedy algorithm randomly selects an arm to explore with a probability of ε, and selects the arm with the highest expected reward value to utilize with a probability of 1-ε. By balancing exploration and utilization using these two algorithms, the target candidate arm for this round of operation is selected.

[0077] In this embodiment, based on the functional role of the device corresponding to the candidate target arm, a differentiated network policy perturbation is applied to the downstream device to be analyzed corresponding to the sample to be confirmed, and the device behavior profile generated by the downstream device to be analyzed after the perturbation is collected. That is, once a candidate device functional role is determined as the true role hypothesized in this round, specific network policies are applied to the device based on the characteristics of that functional role, such as adjusting bandwidth or changing port priority. Then, the new behavioral profile generated by the device under this policy is collected, and the device's reaction to the policy is observed to determine whether the hypothesized functional role is correct.

[0078] In this embodiment, the expected behavior pattern of the target candidate arm refers to the expected behavior pattern of the device in the network when the device functional role corresponding to the target candidate arm is real. For example, if it is assumed that the target candidate arm represents the functional role of a smart TV, the expected behavior pattern may include specific video traffic characteristics, frequent use of specific ports, etc. The accuracy of the assumption is judged by comparing the actual feedback behavior profile with the expected pattern.

[0079] In this embodiment, the matching degree between the feedback behavior profile and the expected behavior pattern of the target candidate arm is calculated. That is, through certain algorithms and indicators, the similarity between the collected behavior profile of the device after perturbation and the expected behavior pattern is measured. The higher the matching degree, the more consistent the assumed functional role is with the actual situation of the device. This matching degree serves as an immediate reward and is used to subsequently update the expected reward value of the candidate arm.

[0080] In this embodiment, the expected reward value of the target candidate arm is updated using immediate rewards. That is, the expected reward value of the target candidate arm is adjusted based on the matching degree (immediate reward) between the calculated feedback behavior profile and the expected behavior pattern of the target candidate arm. If the matching degree is high, it means that the assumption and operation have achieved good results, and the expected reward value will be increased accordingly; otherwise, it will be decreased. In this way, the evaluation of each candidate arm is continuously optimized, guiding the algorithm to make better decisions.

[0081] In this embodiment, the cloud-based federated aggregation unit is a module in the cloud server responsible for processing and aggregating data from multiple routers. It receives data such as learning samples uploaded by each router, integrates and calculates this data using a federated averaging algorithm, generates parameters for updating the intent classification rule base, and distributes the updated parameters to each router, thereby achieving information sharing among routers and collaborative optimization of the rule base.

[0082] In this embodiment, the final confirmation result of other routers for devices with similar device behavior profiles refers to the device functional roles and other information determined by other routers throughout the network system after a series of identification and confirmation processes for devices with similar behavioral profiles to the current device to be confirmed sample. These results can serve as a reference for the current router to determine the device functional roles, and by sharing information with other routers, the accuracy of identification can be improved.

[0083] In this embodiment, if any final confirmation result is consistent with a candidate arm, the expected reward value of the corresponding candidate arm is positively corrected. That is, when the cloud federated aggregation unit obtains the final confirmation results of other routers for similar devices and finds that they are the same as the device functional role corresponding to a certain hypothetical candidate arm, it indicates that the hypothesis may be correct. Therefore, the expected reward value of the candidate arm is increased and adjusted to strengthen the credibility of the hypothesis and make the algorithm more inclined to select the arm.

[0084] In this embodiment, the preset number of decision rounds is a pre-defined maximum number of rounds that the multi-armed slot machine algorithm can run. Within this number of rounds, the algorithm continuously tries different candidate arms, exploring the true functional role of the equipment by applying strategy perturbations, observing the equipment's response, and updating the expected reward value. After reaching the preset number of rounds, the algorithm stops exploring and determines the final result based on the expected reward value of each candidate arm, thus preventing the algorithm from running indefinitely.

[0085] In this embodiment, the expected reward value of a certain candidate arm is significantly higher than that of the other arms. This means that during the operation of the multi-armed slot machine algorithm, after multiple decision cycles of exploration and adjustment, the expected reward value of a certain candidate arm representing the functional role of the candidate device far exceeds that of the other candidate arms. This indicates that the assumption of the device functional role corresponding to this candidate arm has been well verified in multiple trials and is more consistent with the actual behavior pattern of the device. The algorithm tends to consider the functional role corresponding to this candidate arm to be the actual functional role of the device.

[0086] In this embodiment, the labeled intent of the sample to be confirmed is the device functional role corresponding to the sample determined through exploration using a multi-armed slot machine algorithm. When a preset number of decision rounds is reached or the expected reward value of a candidate arm is significantly higher than that of other arms, the device functional role corresponding to the candidate arm with the highest final expected reward value is selected as the labeled intent of the sample to be confirmed. This labeled intent will be used to generate samples to be learned, update the intent classification rule base, and improve the system's ability to identify similar devices.

[0087] To improve inference accuracy when inference confidence is low, an intent inference module is proposed. This module prompts users to manually specify or confirm device type information as a learning sample through the router management interface, thereby supplementing and improving the intent inference data. The module also includes: The interactive confirmation unit is used to prompt the user to manually specify or confirm the type information of a device when the confidence level of all initial inference results of a certain downstream device to be analyzed is not higher than the set confidence level threshold. The user confirmation result is obtained, and the user confirmation result, the corresponding device behavior profile, and the feature fields of the original packet are encapsulated as the learning sample of the corresponding router.

[0088] In this embodiment, the router management interface serves as the operating platform for user interaction with the router. It provides a visual interface where users can configure and manage various router functions. In the device identification system, it displays relevant device information and receives user input.

[0089] In this embodiment, prompting the user to manually specify or confirm the device type information on the router management interface and obtaining user confirmation means that when the confidence level of all initial inference results for a certain downstream device to be analyzed is not higher than a set confidence threshold, the system will display a prompt on the router management interface. The prompt requires the user to manually select or enter the device type information based on their understanding of the device, such as whether the device is a mobile phone, computer, or smart camera. After the user makes a selection or input, the system uses this information as the user confirmation result to help the system more accurately identify the device.

[0090] In this embodiment, the user confirmation result, the corresponding device behavior profile, and the feature fields of the original message are encapsulated as a learning sample for the corresponding router. That is, the user's confirmation information about the device type, the device's corresponding behavior profile (including static identification features and dynamic behavior pattern features), and the feature fields extracted from the original message are integrated together. This set of information is packaged into a data unit, which is the learning sample for the corresponding router. This sample can be used in the subsequent system learning process, such as being uploaded to a cloud server to participate in the updating of the intent classification rule base, thereby improving the system's ability to recognize various types of devices.

[0091] like Figure 4 As shown, to obtain device functional roles through parsing inference results, retrieve the service quality policy library and security action response library, and call the router operating system interface to execute corresponding network service quality policies and security actions, thereby achieving differentiated management of devices with different functional roles, a policy execution module is proposed, including: The reasoning result parsing submodule is used to parse the reasoning results and corresponding confidence levels to obtain the functional roles of the downstream devices to be analyzed. The service policy execution submodule is used to retrieve the service quality policy library according to the functional role of the downstream device to be analyzed, determine the corresponding network service quality policy, and call the router's operating system interface to execute the corresponding network service quality policy. The parameters of the network service quality policy include bandwidth guarantee level, forwarding priority, NAT type preference, and specific port acceleration flag. The security action response submodule is used to determine the corresponding security status attributes based on the functional roles of the downstream devices to be analyzed, retrieve the security action response library based on the corresponding security status attributes, determine the corresponding access control or security protection actions, and call the router's operating system interface to execute the corresponding access control or security protection actions. The access control or security protection actions include alarms, traffic rate limiting, specific connection blocking, and isolation to the sandbox network.

[0092] In this embodiment, parsing the inference results and corresponding confidence levels to obtain the functional role of the downstream device to be analyzed refers to the system analyzing and interpreting the inference results output by the intent inference module and the corresponding confidence levels. Through this parsing, the functional role information of the downstream device to be analyzed in the network is extracted from the inference results, such as determining whether the device is used for online gaming, video playback, or general office work, providing a key basis for subsequent network strategy formulation.

[0093] In this embodiment, the system retrieves the Quality of Service (QoS) policy library based on the functional role of the downstream device to be analyzed, and determines the corresponding QoS policy. Specifically, the system searches for a matching QoS policy in the pre-built QoS policy library based on the acquired device functional role. Devices with different functional roles have different QoS requirements. For example, game consoles typically require low latency and high bandwidth network services. The system uses these characteristics to find suitable network configuration policies for devices with that functional role from the policy library.

[0094] In this embodiment, calling the router's operating system interface to execute the corresponding network service quality policy means that the system uses the interface provided by the router's operating system to apply the determined network service quality policy to the actual network environment. Through these interfaces, the system can interact with the router's underlying operating system to adjust and configure network parameters, ensuring that the device obtains network service quality that meets its functional role requirements.

[0095] In this embodiment, the parameters of the network service quality policy include bandwidth guarantee level, forwarding priority, NAT type preference, and specific port acceleration flag. The bandwidth guarantee level determines the lower limit of network bandwidth resources available to the device, ensuring sufficient bandwidth for critical applications; the forwarding priority determines the order in which data packets are forwarded within the router, allowing higher-priority packets to be processed first, reducing latency; the NAT type preference involves the selection of network address translation methods, with different NAT types suitable for different network scenarios and device requirements; and the specific port acceleration flag optimizes ports for certain specific applications, improving data transmission speed.

[0096] In this embodiment, determining the corresponding security status attribute based on the functional role of the downstream device to be analyzed means that the system assesses the potential security risks faced by the device based on its functional role in the network, thereby determining the corresponding security status attribute. For example, video surveillance equipment, due to its long-term online nature and involvement of private data, may have a security status attribute that focuses more on data encryption and access control; while ordinary smart home devices may be more sensitive to network intrusion detection. Different functional roles of devices have different security risk characteristics, therefore their security status attributes will also differ.

[0097] In this embodiment, the system retrieves a security action response library based on the corresponding security status attribute to determine the corresponding access control or security protection action. Specifically, the system searches the pre-established security action response library for matching security measures based on the determined device security status attribute. The security action response library stores various combinations of access control and security protection actions for different security statuses. The system selects the most appropriate action from these combinations based on the specific security status attribute of the device, such as imposing stricter access restrictions on high-risk devices.

[0098] In this embodiment, the router's operating system interface is invoked to execute corresponding access control or security protection actions. This also utilizes the interfaces provided by the router's operating system to apply the determined access control or security protection actions to the actual network environment. Through these interfaces, the system can control the router to perform corresponding operations, such as blocking specific connections or limiting device traffic, thereby achieving security protection for the devices and ensuring the security and stability of the network environment.

[0099] In this embodiment, access control or security protection actions include alarms, traffic limiting, specific connection blocking, and isolation to a sandbox network. Alarms send notifications to the administrator when a security risk is detected in a device, reminding them to monitor the device's status. Traffic limiting restricts the device's network traffic to prevent abnormal traffic from consuming excessive network resources and affecting the normal use of other devices. Specific connection blocking cuts off the device's network connection to a specific target, preventing potential malicious communication. Isolation to a sandbox network places the device in an isolated virtual network environment, monitoring and restricting its network activity to avoid posing a security threat to the main network. These actions collectively constitute the system's security protection mechanism.

[0100] like Figure 4 As shown, in order to achieve dynamic and reasonable bandwidth allocation for data streams of devices with different functional roles by analogy between the total outbound bandwidth of the router and the data stream of the device, based on Poiseuille's law, and combined with the equivalent viscosity parameters corresponding to the functional roles of the devices and the target flow rate priority, a service policy execution submodule is proposed to integrate a dynamic bandwidth allocation model based on Poiseuille's law. The dynamic bandwidth allocation model compares the router's total outgoing bandwidth to a pipe with a fixed cross-section, and the data flow from the downstream devices to be analyzed, which have different functional roles, to fluids with different equivalent viscosities. The service policy execution submodule performs dynamic bandwidth allocation according to the following steps: Step 1: Based on the functional role of the downstream device to be analyzed, obtain the equivalent viscosity parameter and target flow rate priority of the corresponding data stream from the preset mapping table; Step 2: Based on Poiseuille's law, combined with the current total network bandwidth, the equivalent viscosity parameter of the data flow, and the target flow rate priority, dynamically calculate and allocate the bandwidth value of the data flow to each downstream device to be analyzed in real time.

[0101] In this embodiment, the dynamic bandwidth allocation model based on Poiseuille's law is a model that dynamically allocates network bandwidth by utilizing the principle of Poiseuille's law. Poiseuille's law was originally used to describe the flow of fluids in pipes. In this model, its concept is applied to the network bandwidth allocation scenario to achieve a more reasonable and efficient allocation of bandwidth to different devices.

[0102] In this embodiment, the router's total outbound bandwidth refers to the total network bandwidth resources that the router can provide to all connected devices. It is similar to a resource pool with a limited total amount, from which all devices connected to the router must obtain the portion they need.

[0103] In this embodiment, the router's total outgoing bandwidth is likened to a pipe with a fixed cross-section. This analogy is used to illustrate the application of Poiseuille's law for bandwidth allocation. Just as fluid flows through a pipe with a fixed cross-section, network data is transmitted through the router's total outgoing bandwidth. This analogy facilitates understanding and applying the relevant principles to handle bandwidth allocation issues.

[0104] In this embodiment, the data streams from the downstream devices to be analyzed, which have different functional roles, refer to the data transmission streams generated by various functional devices connected to the router. For example, gaming devices generate real-time battle data transmission streams, video devices generate video playback data transmission streams, etc. The data stream characteristics and requirements of devices with different functional roles are different.

[0105] In this embodiment, the data streams from the downstream devices under analysis, which have different functional roles, are analogous to fluids with different equivalent viscosities. This is because the bandwidth requirements and transmission characteristics of the data streams from devices with different functional roles are different, just as fluids of different viscosities have different effects on flow rate and volume when flowing in a pipe. For example, data streams with high real-time requirements can be analogous to low-viscosity fluids, which can flow more smoothly and quickly; while some data streams with low real-time requirements can be analogous to high-viscosity fluids.

[0106] In this embodiment, the preset mapping table is a pre-set table. This table records the correspondence between data streams of devices with different functional roles and their equivalent viscosity parameters and target flow rate priorities. Through this mapping table, the system can quickly obtain the relevant parameters corresponding to the data stream of each device.

[0107] In this embodiment, based on the functional role of the downstream device to be analyzed, the equivalent viscosity parameter and target flow rate priority of the corresponding data stream are obtained from a preset mapping table. Specifically, after determining the device's functional role, the corresponding equivalent viscosity parameter and target flow rate priority are looked up in the mapping table. For example, after determining that the device is a video playback device, the equivalent viscosity parameter and set target flow rate priority of the data stream for this type of device are found in the table, preparing for subsequent bandwidth allocation calculations.

[0108] In this embodiment, the current total network bandwidth, the equivalent viscosity parameter of the data flow, and the target flow rate priority are the three key factors for dynamically calculating the bandwidth value. The current total network bandwidth is the router's total outbound bandwidth, and the data flow equivalent viscosity parameter and target flow rate priority are derived from a preset mapping table. Together, they determine the bandwidth allocated to each device's data flow.

[0109] In this embodiment, based on Poiseuille's law, and combining the current total network bandwidth, the equivalent viscosity parameter of the data stream, and the target flow rate priority, the bandwidth value of the data stream to be analyzed is dynamically calculated and allocated in real time to each downstream device. Specifically, the calculation formula related to pipes and fluids in Poiseuille's law is used, treating the total network bandwidth as the total flow rate that the pipe can provide. The equivalent viscosity parameter and the target flow rate priority are incorporated into the calculation to obtain a suitable bandwidth value for each device's data stream. The allocation is then dynamically adjusted according to the real-time network situation to ensure that devices with different functional roles can obtain relatively suitable bandwidth resources.

[0110] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of this invention and its equivalents, this invention also intends to include these modifications and variations.

Claims

1. A router underlay device identification system based on multi-dimensional network packet feature matching, characterized in that, Comprise: The behavior modeling module is used for continuous packet capture of the analyzed downlink device locally in the router, multi-dimensional feature extraction and fusion of the captured packets based on the timing correlation algorithm, and generation of a dynamically updated device behavior portrait, wherein the device behavior portrait is composed of static identification fingerprints and dynamic behavior mode features, and the dynamic behavior mode features are established by analyzing three types of timing parameters, including packet sending period, active port distribution, and traffic burst mode; The intent reasoning module is used for real-time reasoning of the current network behavior intent of the analyzed downlink device according to the device behavior portrait, combining an intent classification rule library, outputting effective reasoning results containing device function roles and security state attributes and corresponding confidence, and wherein the intent classification rule library defines the mapping relationship from the device behavior portrait to the device function roles and security state attributes; The policy execution module is used for analyzing the effective reasoning results and the corresponding confidence, obtaining the function role of the analyzed downlink device, dynamically configuring differentiated network service quality policies according to the function role of the analyzed downlink device, and triggering corresponding access control or security protection actions according to the security state attribute of the analyzed downlink device. 2.The multi-dimensional network packet feature matching based router under-connected device identification system of claim 1, wherein, The behavior modeling module comprises: The protocol feature extraction submodule is used for continuous packet capture, analysis and extraction of feature fields in DHCP, HTTP, mDNS, UPnP and TCP protocol packets sent by the analyzed downlink device, wherein the feature fields include Option55 parameter request list and Option60 manufacturer class identifier in DHCP packets, User-Agent field in HTTP packets, service type field in mDNS packets, modelName field in UPnP packets, and window size field in TCP handshake packets; The timing mode analysis submodule is used for sliding window analysis of the feature field stream, and outputs dynamic behavior mode features, wherein the dynamic behavior mode features include periodicity parameters, burstiness parameters and stability parameters; The behavior portrait fusion submodule is used for generating static identification features based on the latest extracted feature fields, structurally integrating the static identification features with the latest obtained dynamic behavior mode features, and generating a dynamically updated device behavior portrait. 3.The multi-dimensional network packet feature matching based router under-connected device identification system of claim 1, wherein, The timing mode analysis submodule comprises: The periodicity parameter analysis unit is used for respectively calculating the mean and variance of the arrival time interval of each type of protocol packet of the analyzed downlink device in a dynamically updated first time window according to the protocol type, and obtaining periodicity parameters; The port active mode analysis unit is used for recording the TCP or UDP port set whose occurrence frequency exceeds the occurrence frequency threshold and its active period used in the connections initiated by the analyzed downlink device in a dynamically updated second time window, and forming a port active mode; The traffic burst mode analysis unit is used for calculating the ratio of the standard deviation to the mean of the unit time traffic size originating from the analyzed downlink device in a dynamically updated third time window, and forming a traffic burst mode. 4.The multi-dimensional network packet feature matching based router under-connected device identification system of claim 1, wherein, The intent reasoning module comprises: a rule reasoning engine sub-module, configured to store an intent classification rule library; a confidence evaluation sub-module, configured to calculate a fitting degree of the device behavior portrait to a precondition of a matched rule in the intent classification rule library, and combine a number and a weight of the matched rule to generate at least one initial reasoning result and a corresponding confidence; an intent output sub-module, configured to filter out an initial reasoning result with a confidence higher than a set confidence threshold from all the initial reasoning results, and output the initial reasoning result as a valid reasoning result while binding the corresponding confidence.

5. The multi-dimensional network packet feature matching based router underlay device identification system of claim 4, wherein, The confidence evaluation sub-module comprises: a weight calculation unit, configured to calculate an occurrence probability of each feature in the device behavior portrait based on a historical recognition sample library, and calculate an information entropy value of each feature by combining an information entropy formula, and take a reciprocal of the information entropy value of each feature as a unique feature weight of each feature; a feature arrangement unit, configured to arrange all features in the device behavior portrait in a preset order to obtain a first feature sequence, and arrange precondition features of each rule in the intent classification rule library to obtain a second feature sequence of each rule; a distance calculation unit, configured to calculate a normalized edit distance between the first feature sequence and the second feature sequence of each rule; a confidence calculation unit, configured to calculate a confidence corresponding to each rule based on the normalized edit distance between the first feature sequence and the second feature sequence of each rule and the unique feature weight of each feature in the first feature sequence.

6. The multi-dimensional network packet feature matching based router underlay device identification system of claim 4, wherein, The intent reasoning module further comprises: a local sample packaging unit, configured to package an initial reasoning result with a confidence not higher than a set confidence threshold and higher than a learning threshold, and a corresponding device behavior portrait and a feature field of an original message as a to-be-confirmed sample, and start a collateral learning process for a to-be-analyzed downstream device corresponding to the to-be-confirmed sample, and filter and annotate all to-be-learned samples based on the collateral learning process to obtain to-be-learned samples; a cloud federated aggregation unit, deployed on a cloud server, configured to receive to-be-learned samples from multiple routers, and iteratively update intent classification rule libraries of the routers by using a federated average algorithm.

7. The multi-dimensional network packet feature matching based router underlay device identification system of claim 6, wherein, The collateral learning process is an active exploration learning process based on a multi-armed bandit and a collaborative filtering idea, and specifically performs the following steps: Step one: multiple candidate device function roles contained in the initial reasoning result corresponding to the to-be-confirmed sample are initialized as multiple candidate arms of a multi-armed bandit, and a reward expectation value is initialized for each candidate arm; Step two: in each decision cycle, a target candidate arm to be pulled in the current round is selected by using an upper confidence bound algorithm or an ε-greedy algorithm according to reward expectation values of all candidate arms; Step three: a differential network policy disturbance associated with the device function role corresponding to the target candidate arm is applied to the to-be-analyzed downstream device corresponding to the to-be-confirmed sample, and a device behavior portrait generated by the to-be-analyzed downstream device after being subjected to the disturbance is collected as a feedback behavior portrait; Step four: a matching degree between the feedback behavior portrait and an expected behavior mode of the target candidate arm is calculated as an immediate reward. Step five: update the reward expectation value of the target candidate arm with the instant reward, and query the final confirmation results of the devices with similar device behavior portraits from the cloud federated aggregation unit, if any final confirmation result is consistent with a certain candidate arm, then positively correct the reward expectation value of the corresponding candidate arm; Step six: repeat steps two to five until the preset decision round is reached or the reward expectation value of a certain candidate arm is significantly higher than those of other candidate arms, select the device function role corresponding to the candidate arm with the highest final reward expectation value as the label of the to-be-confirmed sample, and generate the to-be-learned sample. 8.The multi-dimensional network packet feature matching based router underlay device identification system of claim 6, wherein, The intention reasoning module further comprises: The interaction confirmation unit is configured to, when determining that the confidence of all initial reasoning results of a to-be-analyzed downstream device is not higher than the set confidence threshold, prompting a user to manually specify or confirm the type information of the device on a router management interface, obtaining a user confirmation result, and encapsulating the user confirmation result, the corresponding device behavior portrait, and the feature field of the original message as a to-be-learned sample of the corresponding router. 9.The multi-dimensional network packet feature matching based router underlay device identification system of claim 1, wherein, The policy execution module comprises: The reasoning result analysis submodule is configured to analyze the reasoning result and the corresponding confidence to obtain the function role of the to-be-analyzed downstream device. The service policy execution submodule is configured to retrieve a service quality policy library according to the function role of the to-be-analyzed downstream device, determine a corresponding network service quality policy, and call an operating system interface of the router to execute the corresponding network service quality policy, wherein the parameters of the network service quality policy include a bandwidth guarantee level, a forwarding priority, a NAT type preference, and a specific port acceleration flag. The security action response submodule is configured to determine a corresponding security state attribute according to the function role of the to-be-analyzed downstream device, retrieve a security action response library based on the corresponding security state attribute, determine a corresponding access control or security protection action, and call an operating system interface of the router to execute the corresponding access control or security protection action, wherein the access control or security protection action includes an alarm, a traffic speed limit, a specific connection block, and isolation to a sandbox network.

10. The multi-dimensional network packet feature matching based router underlay device identification system of claim 9, wherein, The service policy execution submodule integrates a dynamic bandwidth allocation model based on Poiseuille's law. The dynamic bandwidth allocation model analogizes the total export bandwidth of the router as a pipe with a fixed cross section, and analogizes the data flow from the to-be-analyzed downstream device with different function roles as fluid with different equivalent viscosities. The service policy execution submodule executes dynamic bandwidth allocation according to the following steps: Step one: according to the function role of the to-be-analyzed downstream device, obtain the equivalent viscosity parameter and target flow speed priority of the corresponding data flow from a preconfigured mapping table; Step two: dynamically calculate and real-time allocate the bandwidth value of the data flow of each to-be-analyzed downstream device according to Poiseuille's law, combined with the current total network bandwidth, the equivalent viscosity parameter of the data flow, and the target flow speed priority.

Images