Network equipment model level identification method and apparatus, electronic device, and storage medium

Abstract

The application relates to the technical field of communication, in particular to a network equipment model level identification method and device, electronic equipment and a storage medium. The method comprises the following steps: obtaining a set of internet protocol addresses of network equipment to be identified; extracting a multi-dimensional feature corresponding to each internet protocol address in the set of internet protocol addresses of the network equipment to be identified; inputting the multi-dimensional feature corresponding to each internet protocol address in the set of internet protocol addresses of the network equipment to be identified into a pre-trained model for model level identification to obtain a model level identification result of each device in the network equipment to be identified. Thus, the problems of coarse device identification granularity, insufficient network equipment IP discovery coverage, low label construction efficiency and insufficient model level identification accuracy in the related art are solved.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to a method, apparatus, electronic device and storage medium for identifying network device model level. Background Technology

[0002] Critical network equipment (such as routers, switches, firewalls, and VPNs) supports global communications, and their failure or attack can have a significant impact. However, these devices come from diverse manufacturers and models, resulting in design differences and varying vulnerability risks that can be exploited to trigger large-scale attacks. Therefore, identifying these critical network devices (identifying manufacturers, models, etc.) and conducting further vulnerability correlation and analysis is beneficial for discovering potential risks, preventing large-scale attacks, and ensuring stable network operation.

[0003] Research on the identification of critical network devices mainly focuses on two directions: one is to build device identification rules solely based on application layer protocol banner (device identification banner) capture technology. This method is highly dependent on banner data, which limits the ability of the solution to be scaled up to identify devices on a larger scale.

[0004] The second approach can meet the needs of large-scale identification: First, a small number of network device samples are labeled using application layer protocol banners. Then, TCP (Transmission Control Protocol), UDP (User Datagram Protocol), and ICMP (Internet Control Message Protocol) probes are used to obtain the TCP / IP (Internet Protocol Address) protocol stack features of the corresponding device samples. Finally, the sample labels and features are used to build a dataset, train a network device manufacturer identification model, or generate manufacturer fingerprints, enabling inference and identification of a larger scale of devices. This method effectively expands the scope of device identification by leveraging the high coverage of TCP / IP protocol stack features, but it suffers from coarse-grained identification—it can only identify the device manufacturer and cannot distinguish specific device model series, making it difficult to achieve accurate model-level identification.

[0005] Furthermore, network device identification research in related technologies is mainly based on ITDK (Macroscopic Internet Topology Data Kit) or RIPE (Réseaux IP Européens) datasets. The actual number of network device IPs discovered and used as research objects is only in the millions, which is not wide enough. At the same time, there is still room for improvement in the efficiency of device sample label construction and the accuracy of identification. These factors also restrict the realization of large-scale model-level identification to some extent.

[0006] Therefore, the coarse granularity of the relevant technologies limits the understanding of the distribution status and changing patterns of device models in the Internet or large networks, and makes it difficult to support large-scale and accurate risk assessment. At the same time, the insufficient coverage of network device IP discovery, tag construction efficiency and identification accuracy also hinder the implementation of model-level identification, which urgently needs to be addressed. Summary of the Invention

[0007] This application provides a method, apparatus, electronic device, and storage medium for network device model-level identification, in order to solve the problems of excessively coarse device identification granularity, insufficient coverage of network device IP discovery, low efficiency of tag construction, and insufficient accuracy of model-level identification in related technologies.

[0008] To achieve the above objectives, the first aspect of this application proposes a network device model-level identification method, comprising the following steps: Obtain the set of Internet Protocol addresses of the network device to be identified; Extract the multidimensional features corresponding to each Internet Protocol address in the set of Internet Protocol addresses of the network device to be identified; The multidimensional features corresponding to each Internet Protocol address in the set of Internet Protocol addresses of the network devices to be identified are input into a pre-trained model-level identification model to obtain the model-level identification result of each device in the network devices to be identified.

[0009] According to one embodiment of this application, before inputting the multi-dimensional features corresponding to each Internet Protocol address in the set of Internet Protocol addresses of the network devices to be identified into a pre-trained model-level identification model to obtain the model-level identification result of each device in the network devices to be identified, the method further includes: Obtain the set of Internet Protocol addresses of the target network device; Based on the target network device Internet Protocol address set, construct a new model-level sample label corresponding to each Internet Protocol address in the target network device Internet Protocol address set; A basic dataset is constructed based on the multidimensional features corresponding to each Internet Protocol address in the target network device Internet Protocol address set and the new model-level sample label; Based on the preset random forest algorithm, the preset model is trained using the basic dataset to obtain the pre-trained model-level recognition model.

[0010] According to one embodiment of this application, obtaining the target network device Internet Protocol address set includes: Determine the target detection network segment; Generate a probe data packet with a weighted random TTL, send the probe data packet with the weighted random TTL to the target probe network segment, receive an ICMP timeout message, and determine the first network device Internet Protocol address set based on the ICMP timeout message; A protocol probe message library is constructed, and the messages in the protocol probe message library are broadcast to the target probe network segment. Protocol response messages are received, and the protocol response messages are parsed to obtain the Internet Protocol address set of the second network device. The target network device Internet Protocol address set is obtained by deduplicating and fusing the first network device Internet Protocol address set and the second network device Internet Protocol address set.

[0011] According to one embodiment of this application, the step of constructing a new model-level sample tag corresponding to each Internet Protocol address in the target network device Internet Protocol address set includes: Determine the companion protocol request message, and obtain multiple initial device model-level sample tags based on the companion protocol request message and the target network device Internet Protocol address set; Generate a fingerprint list for each initial device model-level sample tag, and perform clustering based on the fingerprint list of each initial device model-level sample tag. Based on the clustering results, obtain a new model-level sample tag corresponding to each Internet Protocol address in the target network device Internet Protocol address set.

[0012] According to one embodiment of this application, obtaining the initial device model-level sample tag based on the companion protocol request message and the target network device Internet Protocol address set includes: Send the companion protocol request message to at least one Internet Protocol address in the Internet Protocol address set of the target network device to obtain protocol response data for each Internet Protocol address; The protocol response data for each Internet Protocol address is clustered into multiple text clusters, and at least one sampled text for each text cluster is determined. Based on at least one sampled text of each text cluster, a model regular expression is generated for each text cluster, and model information is extracted according to the model regular expression of each text cluster to obtain the multiple initial device model-level sample labels.

[0013] According to the network device model-level identification method proposed in this application, multi-dimensional features corresponding to each Internet Protocol address in the Internet Protocol address set of the network device to be identified are extracted. These multi-dimensional features are then input into a pre-trained model-level identification model to obtain the model-level identification result for each device in the network device to be identified. This solves the problems of excessively coarse device identification granularity, insufficient coverage of network device IP discovery, low tag construction efficiency, and insufficient accuracy of model-level identification in related technologies.

[0014] To achieve the above objectives, a second aspect of this application provides a network device model-level identification device, comprising: The acquisition module obtains the set of Internet Protocol addresses of the network device to be identified; The extraction module extracts multi-dimensional features corresponding to each Internet Protocol address in the set of Internet Protocol addresses of the network device to be identified; The identification module inputs the multi-dimensional features corresponding to each Internet Protocol address in the set of Internet Protocol addresses of the network devices to be identified into a pre-trained model-level identification model to obtain the model-level identification result of each device in the network devices to be identified.

[0015] According to one embodiment of this application, before inputting the multi-dimensional features corresponding to each Internet Protocol address in the set of Internet Protocol addresses of the network devices to be identified into a pre-trained model-level identification model to obtain the model-level identification result of each device in the network devices to be identified, the identification module is further configured to: Obtain the set of Internet Protocol addresses of the target network device; Based on the target network device Internet Protocol address set, construct a new model-level sample label corresponding to each Internet Protocol address in the target network device Internet Protocol address set; A basic dataset is constructed based on the multidimensional features corresponding to each Internet Protocol address in the target network device Internet Protocol address set and the new model-level sample label; Based on the preset random forest algorithm, the preset model is trained using the basic dataset to obtain the pre-trained model-level recognition model.

[0016] According to one embodiment of this application, the identification module is specifically used for: Determine the target detection network segment; Generate a probe data packet with a weighted random TTL, send the probe data packet with the weighted random TTL to the target probe network segment, receive an ICMP timeout message, and determine the first network device Internet Protocol address set based on the ICMP timeout message; A protocol probe message library is constructed, and the messages in the protocol probe message library are broadcast to the target probe network segment. Protocol response messages are received, and the protocol response messages are parsed to obtain the Internet Protocol address set of the second network device. The target network device Internet Protocol address set is obtained by deduplicating and fusing the first network device Internet Protocol address set and the second network device Internet Protocol address set.

[0017] According to one embodiment of this application, the identification module is specifically used for: Determine the companion protocol request message, and obtain multiple initial device model-level sample tags based on the companion protocol request message and the target network device Internet Protocol address set; Generate a fingerprint list for each initial device model-level sample tag, and perform clustering based on the fingerprint list of each initial device model-level sample tag. Based on the clustering results, obtain a new model-level sample tag corresponding to each Internet Protocol address in the target network device Internet Protocol address set.

[0018] According to one embodiment of this application, the identification module is specifically used for: Send the companion protocol request message to at least one Internet Protocol address in the Internet Protocol address set of the target network device to obtain protocol response data for each Internet Protocol address; The protocol response data for each Internet Protocol address is clustered into multiple text clusters, and at least one sampled text for each text cluster is determined. Based on at least one sampled text of each text cluster, a model regular expression is generated for each text cluster, and model information is extracted according to the model regular expression of each text cluster to obtain the multiple initial device model-level sample labels.

[0019] According to the network device model-level identification device proposed in this application, multi-dimensional features corresponding to each Internet Protocol address in the Internet Protocol address set of the network device to be identified are extracted. The multi-dimensional features are then input into a pre-trained model-level identification model to obtain the model-level identification result for each device in the network device to be identified. This solves the problems of excessively coarse device identification granularity, insufficient coverage of network device IP discovery, low tag construction efficiency, and insufficient model-level identification accuracy in related technologies.

[0020] To achieve the above objectives, a third aspect of this application provides an electronic device, including: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the network device model-level identification method as described in the above embodiments.

[0021] To achieve the above objectives, a fourth aspect of this application provides a computer-readable storage medium having a computer program stored thereon, which is executed by a processor to implement the network device model-level identification method as described in the above embodiments.

[0022] To achieve the above objectives, a fifth aspect of this application provides a computer program product, which, when executed by a processor, implements the network device model-level identification method as described in the above embodiments.

[0023] Additional aspects and advantages of this application will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of this application. Attached Figure Description

[0024] The above and / or additional aspects and advantages of this application will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, wherein: Figure 1 This is a flowchart of a network device model-level identification method provided according to an embodiment of this application; Figure 2 This is a comparative schematic diagram of different routing device discovery methods provided according to an embodiment of this application; Figure 3 This is a schematic diagram of a method for constructing multiple initial device model-level sample tags according to an embodiment of this application; Figure 4 This is a schematic diagram illustrating a solution to granularity mismatch and tag aggregation according to an embodiment of this application; Figure 5 This is a flowchart of a network device model-level identification method according to an embodiment of this application; Figure 6 This is a block diagram of a network device model-level identification device provided according to an embodiment of this application; Figure 7 This is a schematic diagram of the structure of an electronic device provided according to an embodiment of this application. Detailed Implementation

[0025] The embodiments of this application are described in detail below. Examples of these embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain this application, and should not be construed as limiting this application.

[0026] The following describes, with reference to the accompanying drawings, a method, apparatus, electronic device, and storage medium for identifying network device model levels according to embodiments of this application. First, the method for identifying network device model levels according to embodiments of this application will be described with reference to the accompanying drawings.

[0027] Figure 1 This is a flowchart of a network device model-level identification method according to an embodiment of this application.

[0028] like Figure 1 As shown, the network device model-level identification method includes the following steps: In step S101, the set of Internet Protocol addresses of the network device to be identified is obtained.

[0029] Among them, the Internet Protocol address of the network device to be identified refers to the Internet Protocol address corresponding to the network device that needs to be identified at the model level.

[0030] Specifically, in this embodiment of the application, the Internet Protocol addresses corresponding to all network devices to be identified within a specific network domain are obtained, and after deduplication, verification and other processing, a set of Internet Protocol addresses of network devices to be identified is formed.

[0031] In step S102, multi-dimensional features corresponding to each Internet Protocol address in the Internet Protocol address set of the network device to be identified are extracted.

[0032] Among them, multidimensional features refer to a set of multidimensional features extracted from the network interaction data corresponding to the Internet Protocol address of the target network device, which can characterize the device's hardware attributes, protocol interaction characteristics, and network behavior characteristics.

[0033] Specifically, this application embodiment constructs TCP, UDP, ICMP and other probe messages in a customized manner, optimizes the UDP probe logic, triggers the device response and extracts a set of features that can reflect the differences in underlying hardware and product line implementation. At the same time, it expands the features that can be extracted in the IP discovery phase to obtain multi-dimensional features corresponding to each Internet Protocol address in the Internet Protocol address set of the network device to be identified.

[0034] Furthermore, this application embodiment needs to extract stable and distinguishable sample features to support the training of large-scale device identification models. Therefore, this application embodiment extracts a set of features that can reflect the differences in the underlying implementation of manufacturers and models of devices based on IP discovery phase information and multi-type active probe message responses, as shown in Table 1.

[0035] Table 1

[0036] On the one hand, some features can be generated directly during the IP discovery phase without repeated packet collection. In the IP discovery process, this embodiment selects devices that can return ICMP timeout messages, or support any of the following protocols: BGP (Border Gateway Protocol), RIP (Routing Information Protocol), ISAKMP (Internet Security Association and Key Management Protocol), IKEv2 (Internet Key Exchange Version 2), CWMP (CPEWAN Management Protocol), and GTP (GPRS Tunneling Protocol). These selection criteria reflect the device's functional attributes and network location. Therefore, whether or not an ICMP timeout message is returned and the supported protocol type are used as features. For devices that can return ICMP timeout messages, features such as initial TTL (Time to Live), IP packet length, and IPID (Identifier) ​​are further extracted from the messages.

[0037] On the other hand, this application embodiment also modifies the Zmap (an open-source, stateless, single-packet network scanning tool) to send six customized probe packets to the target or the entire network IP, including two ICMP packets, three TCP packets, and one UDP packet, for extracting multi-dimensional features. The ICMP and TCP modules adopt the operating system identification probe logic and related features of Nmap (Network Mapper), while the UDP module designs a network-wide probe strategy to improve device response rate and feature richness. Compared with the related technologies that only send packets to the target IP to obtain ICMP port unreachable responses, this application embodiment adds a probe method of sending packets to non-target IPs to obtain more types of ICMP responses. Specifically, this application embodiment sends UDP probe packets to all IPs on the network, not just the target IP. The payload contains 300 repeating characters "C", the IP ID field is fixed at 0x1042, and the TTL uses the default normal value of the probe host (in contrast, UDP packets in the IP discovery phase use a weighted random TTL). This allows for obtaining more comprehensive responses beyond port unreachability, such as network unreachability. Finally, features such as initial TTL, IP packet length, IP ID, ICMP type, and ICMP Code (network encoding) are extracted from various ICMP responses. Thus, multi-dimensional features corresponding to each Internet Protocol address in the target network device's Internet Protocol address set are obtained.

[0038] In step S103, the multi-dimensional features corresponding to each Internet Protocol address in the set of Internet Protocol addresses of the network devices to be identified are input into the pre-trained model-level identification model to obtain the model-level identification result of each device in the network devices to be identified.

[0039] Specifically, in this embodiment, the multi-dimensional features corresponding to each Internet address in the Internet Protocol address set of the network device to be identified are used as input and fed into a pre-trained model-level identification model. The pre-trained model-level identification model performs validity verification on the input multi-dimensional features based on the mapping rules between the underlying features of the network device and the device model learned during its training process, and finally outputs the model-level identification result of the corresponding network device for each address in the Internet Protocol address set to be identified.

[0040] Therefore, multi-dimensional features corresponding to each Internet Protocol address in the set of Internet Protocol addresses of the network devices to be identified are extracted. These multi-dimensional features are then input into a pre-trained model-level identification model to obtain the model-level identification result for each device in the network devices to be identified. This solves the problems of excessively coarse device identification granularity, insufficient coverage of network device IP discovery, low tag construction efficiency, and insufficient accuracy of model-level identification in related technologies.

[0041] Furthermore, in order to ensure that the pre-trained model-level recognition model has high accuracy and strong generalization, the embodiments of this application have also effectively trained the model-level recognition model.

[0042] Optionally, in some embodiments, before inputting the multidimensional features corresponding to each Internet Protocol address in the set of Internet Protocol addresses of the network devices to be identified into a pre-trained model-level identification model to obtain the model-level identification result of each device in the network devices to be identified, the method further includes: obtaining the set of Internet Protocol addresses of the target network devices; constructing new model-level sample labels corresponding to each Internet Protocol address in the set of Internet Protocol addresses of the target network devices based on the set of Internet Protocol addresses of the target network devices; constructing a basic dataset according to the multidimensional features corresponding to each Internet Protocol address in the set of Internet Protocol addresses of the target network devices and the new model-level sample labels; and training a preset model using the basic dataset based on a preset random forest algorithm to obtain a pre-trained model-level identification model.

[0043] Among them, the preset random forest algorithm refers to a random forest ensemble learning algorithm that is pre-selected for the task scenario of network device model-level identification and has completed parameter adaptation and scenario-based optimization.

[0044] Specifically, the goal of network device IP discovery is to identify research objects. The construction of sample labels, feature sets, and subsequent identification work for network devices all require the selected network device IPs as research objects. This application's embodiments achieve large-scale network device IP discovery through two channels: first, triggering the ICMP Time Exceeded response from network routing devices; and second, sending network device-specific protocol requests to the Internet. Based on these methods, tens of millions of network device IPs, i.e., the target network device Internet Protocol address set, are obtained.

[0045] Furthermore, model-level sample label construction is used to obtain real labels for device models in the training samples of the recognition model. For the discovered network device IPs, this embodiment actively sends various accompanying protocol messages such as SNMP (Simple Network Management Protocol), SSH (Secure Shell Protocol), and TELNET (Telecommunication Network Protocol), triggering the device to directly return plaintext protocol text containing fine-grained information such as manufacturer and model. Subsequently, an LC-based approach is used... SA text clustering method based on the Longest Common Subsequence (LCS) is proposed, and lightweight inference using a large language model is employed to generate reusable regular rules. This enables the efficient extraction of device model-level information, thereby completing the construction of model-level sample labels.

[0046] Furthermore, a dataset can be formed based on model-level sample labels and multidimensional features. Since there is a granularity mismatch between the original labels and features in the dataset, this application further proposes a clustering and LLM (Large Language Model) method to reconstruct the label system of the dataset, aggregate the original model-level sample labels to obtain new model-level sample labels, and form a basic dataset with multidimensional features.

[0047] Specifically, in the model training stage, this embodiment of the application solves the problem of sample imbalance by sampling and uses the random forest algorithm to train the preset model. Multidimensional features are used as model input and new model-level labels are used as model output to obtain a pre-trained model-level recognition model.

[0048] Optionally, in some embodiments, obtaining the target network device Internet Protocol address set includes: determining the target probe network segment; generating probe data packets with weighted random TTL, sending the probe data packets with weighted random TTL to the target probe network segment, receiving ICMP timeout messages, and determining a first network device Internet Protocol address set based on the ICMP timeout messages; constructing a protocol probe message library, broadcasting the messages in the protocol probe message library to the target probe network segment, receiving protocol response messages, and parsing the protocol response messages to obtain a second network device Internet Protocol address set; and deduplicating and fusing the first network device Internet Protocol address set and the second network device Internet Protocol address set to obtain the target network device Internet Protocol address set.

[0049] Among them, probe packets refer to standardized network messages actively constructed and customized by the probe end. The protocol probe packet library refers to a database that structurally integrates and stores various types of customized protocol probe packets that can be directly sent, categorized by network protocol type. The first set of network device Internet Protocol addresses and the second set of network device Internet Protocol addresses can be user-predefined network device Internet Protocol addresses, network device Internet Protocol addresses obtained through a limited number of experiments, or network device Internet Protocol addresses obtained through a limited number of computer simulations.

[0050] Specifically, the IPv4 (Internet Protocol Version 4) address space contains approximately 4.3 billion addresses, a large number of which are terminal devices such as servers, PCs (Personal Computers), and IoT (Internet of Things). Accurately identifying the IPs of key network devices such as routers, switches, and firewalls from this massive pool of IPs is a crucial prerequisite for subsequent identification work. Related technologies rely on traditional traceroute datasets, which can only cover millions of routing devices, resulting in insufficient coverage. Therefore, this application proposes a method for discovering routing devices based on weighted random TTL sampling and a method for discovering network device IPs based on specific protocol detection.

[0051] Furthermore, in the routing device discovery process of this application embodiment, a UDP probe packet with a payload containing 300 repeated characters 'C' and an IPID field fixed at 0x1042 is sent to trigger the routing device to return an ICMP timeout message, thereby achieving device identification and path discovery. For example... Figure 2 As shown, Figure 2 This is a comparative schematic diagram of different routing device discovery methods provided according to an embodiment of this application. Figure 2 (a) is a schematic diagram of the Traceroute route detection method for network segment 24. Figure 2 (b) is a schematic diagram of the Traceroute route detection method for network segment 27. Figure 2 (c) is a schematic diagram of the random TTL route probing method. Figure 2 (d) is a schematic diagram of the weighted random TTL route probing method. Figure 2 As shown in (a), the relevant technical solution performs TTL1-32 hop-by-hop probing on a single IP in the / 24 network segment, which is easy to miss due to the single path; Figure 2 (b) is another related technical solution that uses a single IP address in the / 27 network segment to perform TTL1-32 hop-by-hop probing, thereby covering multiple paths to each / 24 network segment to adapt to load balancing; Figure 2 (c) Maintain with Figure 2 (b) With the same packet volume, instead send one TTL probe to each IP in the entire network, and sample the TTL evenly and randomly within the range of 1-32 to further disperse the forwarding paths; Figure 2 (d) also keeps the total number of packages sent unchanged. Figure 2 Based on (c), TTL uniform random sampling is changed to weighted random sampling to increase the selection probability of medium TTL values. Since complex load balancing topologies are mostly concentrated in the medium TTL range, there are more undiscovered devices. Therefore, the embodiments of this application can significantly obtain more intermediate routing device responses under the premise of lightweight packet sending.

[0052] Meanwhile, this application embodiment supplements the coverage of terminal network devices not covered by the aforementioned routing device discovery methods by detecting network device-specific protocols such as BGP, RIP, IKEv2, ISAKMP, CWMP, and GTP. This application embodiment determines the IP address that generates a valid response to any of the above protocols as a network device IP address, thereby supplementing the existing device set.

[0053] Furthermore, in this embodiment, the two types of results are deduplicated and merged to construct a more comprehensive set of Internet Protocol addresses for target network devices, reaching tens of millions of addresses.

[0054] Optionally, in some embodiments, based on the target network device Internet Protocol address set, a new model-level sample label corresponding to each Internet Protocol address in the target network device Internet Protocol address set is constructed, including: determining the accompanying protocol request message, and obtaining multiple initial device model-level sample labels according to the accompanying protocol request message and the target network device Internet Protocol address set; generating a fingerprint list for each initial device model-level sample label, and performing clustering according to the fingerprint list of each initial device model-level sample label, and obtaining a new model-level sample label corresponding to each Internet Protocol address in the target network device Internet Protocol address set according to the clustering results.

[0055] Optionally, in some embodiments, obtaining multiple initial device model-level sample tags based on the companion protocol request message and the target network device Internet Protocol address set includes: sending a companion protocol request message to at least one Internet Protocol address in the target network device Internet Protocol address set to obtain protocol response data for each Internet Protocol address; performing text clustering on the protocol response data of each Internet Protocol address to obtain multiple text clusters, and determining at least one sampled text for each text cluster; generating a model regular expression extraction expression for each text cluster based on the at least one sampled text for each text cluster, and extracting model information based on the model regular expression extraction expression for each text cluster to obtain multiple initial device model-level sample tags.

[0056] Among them, the accompanying protocol request message refers to the auxiliary customized probe message used in conjunction with the main protocol request message in network device protocol probe scenarios. The fingerprint list refers to a standardized data list that structurally integrates and orderly stores the fingerprint features of network devices.

[0057] Specifically, network devices typically provide various companion protocol services. The responses to these protocols often contain rich device description information such as manufacturer and model number, from which device information can be extracted to construct device sample tags. This application embodiment sends targeted companion protocol request messages to the target network device and collects protocol response data from each IP address. For the obtained plaintext return protocol data such as SNMP, SSH, and TELNET, this application embodiment proposes a sample tag construction scheme based on LCS text clustering and LLM lightweight inference. Figure 3 As shown, Figure 3 This is a schematic diagram illustrating a method for constructing multiple initial device model-level sample labels according to an embodiment of this application. This embodiment designs a clustering algorithm that segments protocol text at the word level, uses the normalized longest common subsequence (LCS) as a similarity metric, and performs agglomerative hierarchical clustering. During clustering, each cluster maintains cluster LCS information, which represents the common sequence of all text within that cluster. After clustering, the protocol text format within the same cluster tends to be unified, thus solving the problem that the diverse formats of device protocol response text make it difficult to generate unified extraction rules later.

[0058] Furthermore, after clustering, K texts are randomly sampled from each cluster (K ​​<< the number of texts in the cluster). Based on the sampled texts, a large language model is used to extract device model information from the original text. Combining the extracted model information, cluster LCS, and sampled text, a model model regular expression adapted to the cluster is automatically generated for extraction. This expression is used to extract device models within the cluster. Then, LLM is used to fuse and analyze the statistical information of all cluster models extracted by the regular expression with the cluster LCS to infer the manufacturer information to which the cluster belongs. Finally, the extraction rules are precipitated into a reusable static knowledge base. Furthermore, when extracting device information from newly added asset texts, the cluster LCS can be used to classify the text into the corresponding cluster. The manufacturer information to which the cluster belongs is extracted first, and then the cluster regular expression is used to further extract the model information. The entire process relies on regular expression matching and does not require calling LLM again. In this embodiment, LLM is only used sparingly during the initial information extraction; subsequent information extraction does not rely on LLM, thus meeting the requirements for efficient and accurate sample label construction. Therefore, multiple initial device model-level sample labels are constructed.

[0059] Furthermore, multiple initial device model-level sample labels and the multi-dimensional features corresponding to each Internet Protocol address in the target network device Internet Protocol address set can form an initial dataset by IP association. However, this initial dataset suffers from granularity mismatch; the granularity of the multiple initial device model-level sample labels is too fine, making it difficult to effectively distinguish existing features and preventing direct use for model training. Therefore, this application's embodiment adopts a label aggregation and reconstruction scheme to uniformly map the labels to new model-level labels that match the feature granularity. Figure 4 As shown, Figure 4 This diagram illustrates a solution to granularity mismatch and label aggregation based on an embodiment of this application. As shown, the first approach directly performs label aggregation mapping using a Large Language Model (LLM). However, due to the lack of internal knowledge of vendor product design and the inability to perceive protocol stack implementation differences, this aggregation often remains only at the text surface level (e.g., directly extracting the prefix NSa from NSa2800 (SonicWall NSa 2800, firewall product name)). The granularity of the aggregated labels may still mismatch with the feature granularity, making it difficult for the model to distinguish between them. This application proposes a label aggregation scheme combining fingerprint list clustering and LLM naming. First, a corresponding fingerprint list is generated for each old model-level label. Then, clustering is performed based on the fingerprint list to obtain clusters. Subsequently, the semantic understanding and correction capabilities of the Large Language Model are used to name each cluster with standardized new model-level labels, ensuring that the labels conform to business logic and industry common sense. Specifically, the same model can correspond to multiple feature combinations. In this embodiment, effective feature combinations that satisfy the absolute threshold of IP quantity and the relative threshold of proportion are used as fingerprints, forming a fingerprint list corresponding to each old model-level label. Top-P sampling (Top-Probability, probability cumulative threshold sampling) is used to remove low-proportion noisy fingerprints. The similarity between fingerprint lists of different models is calculated based on Jaccard similarity. Agglomerative hierarchical clustering is used to complete the clustering of old model labels under the same manufacturer. After clustering, LLM combines manufacturer information and old labels within the cluster to generate new model-level labels and cluster explanations. Finally, the old model-level labels of the original dataset are mapped to new model-level labels, generating a basic dataset that can be used for model training.

[0060] Therefore, this embodiment of the application initiates the IP discovery module, sends customized UDP probe packets (TTL-weighted random sampling) and combines them with multi-protocol probes. After deduplication and fusion, it constructs a target IP set of tens of millions of network devices, solving the problem of limited IP discovery coverage. It sends companion protocol requests to the target IPs, collects response text, and classifies it through LCS agglomerative hierarchical clustering to maintain LCS information for each cluster. The sampled text within the cluster is used to call LLM to generate regular expression extraction rules and vendor information, accumulating reusable knowledge base rules. Based on these rules, device sample tags are constructed, improving tag construction efficiency. Based on the information from the IP discovery module... By customizing probe messages, extracting features from multiple modules, and constructing a complete sample feature set, the feature richness and device response rate are effectively improved, significantly enhancing the accuracy of network device model-level identification. Based on sample labels and sample feature sets, a basic dataset is initially constructed. An old model label fingerprint list is generated and clustered, and LLM is used to name new model labels, reconstructing the dataset and solving the problem of feature and label granularity mismatch. To address the problem of imbalanced samples, a model is trained based on the random forest algorithm to complete large-scale model-level identification and output results. This realizes a method for large-scale model-level device identification on critical network devices without relying on manual rules.

[0061] Furthermore, to facilitate those skilled in the art to further understand the network device model-level identification method proposed in the embodiments of this application, the following is combined with... Figure 5 Further explanation is needed.

[0062] like Figure 5 As shown, Figure 5 This is a flowchart of a network device model-level identification method according to an embodiment of this application. As shown in the figure, this embodiment locates the IPv4 address based on the network device IP discovery module; automatically generates standardized old model-level labels for the device through a sample label construction library (integrating detection of mainstream management protocols such as SNMP, SSH, and TELNET and lightweight LLM text parsing); accurately extracts multi-dimensional fingerprint features and constructs a feature set based on a sample feature set library (integrating detection of core network layer protocols such as TCP, UDP, and ICMP and IP selection modules); in the classification model construction and model training stage, new labels are generated by aggregating them through a clustering algorithm, combined with multi-dimensional features, and input into the model-level identification model for training, ultimately realizing the full automation of the network device from IP discovery to model identification.

[0063] Therefore, this application proposes a model-level identification method for large-scale critical network devices based on active measurement and machine learning models. Network device discovery is used to identify the target device by sending UDP probe messages with weighted random sampling TTL values ​​and network device-specific protocol request messages, expanding the scope of discovered network devices and solving the problem of insufficient network device coverage in related technologies. Sample label construction is used to obtain the true device model labels of the training samples of the identification model. A combination of LCS text clustering and lightweight inference using a large language model significantly improves the efficiency of device sample label construction. Sample feature set construction is used to extract features from the training samples of the identification model. Based on the Nmap feature set, features are expanded and UDP probe logic is optimized to improve feature richness and device response rate, thereby improving identification accuracy. After forming a training dataset based on the true model labels and features of the samples, a granularity mismatch problem is found in the dataset. This application solves the granularity mismatch problem between features and model labels through a fingerprint list clustering and LLM naming fusion scheme, ultimately achieving fine-grained model-level identification.

[0064] According to the network device model-level identification method proposed in this application, multi-dimensional features corresponding to each Internet Protocol address in the Internet Protocol address set of the network device to be identified are extracted. These multi-dimensional features are then input into a pre-trained model-level identification model to obtain the model-level identification result for each device in the network device to be identified. This solves the problems of excessively coarse device identification granularity, insufficient coverage of network device IP discovery, low tag construction efficiency, and insufficient accuracy of model-level identification in related technologies.

[0065] Next, the network device model identification device proposed according to the embodiments of this application is described with reference to the accompanying drawings.

[0066] Figure 6 This is a block diagram of a network device model identification device according to an embodiment of this application.

[0067] like Figure 6 As shown, the network device model identification device 10 includes: an acquisition module 100, a determination module 200, and an identification module 300.

[0068] Module 100 obtains the set of Internet Protocol addresses of the network device to be identified; Extraction module 200 extracts multi-dimensional features corresponding to each Internet Protocol address in the set of Internet Protocol addresses of the network device to be identified; The identification module 300 inputs the multi-dimensional features corresponding to each Internet Protocol address in the Internet Protocol address set of the network devices to be identified into a pre-trained model-level identification model to obtain the model-level identification result of each device in the network devices to be identified.

[0069] According to one embodiment of this application, before inputting the multi-dimensional features corresponding to each Internet Protocol address in the set of Internet Protocol addresses of the network devices to be identified into a pre-trained model-level identification model to obtain the model-level identification result for each device in the network devices to be identified, the identification module 300 is further configured to: Obtain the set of Internet Protocol addresses of the target network device; Based on the Internet Protocol address set of the target network device, construct a new model-level sample label corresponding to each Internet Protocol address in the Internet Protocol address set of the target network device; A basic dataset is constructed based on the multidimensional features and new model-level sample labels corresponding to each Internet Protocol address in the target network device Internet Protocol address set. Based on the preset random forest algorithm, a pre-trained model-level recognition model is obtained by training a preset model with a basic dataset.

[0070] According to one embodiment of this application, the identification module 300 is specifically used for: Determine the target detection network segment; Generate probe packets with weighted random TTL, send probe packets with weighted random TTL to the target probe network segment, receive ICMP timeout messages, and determine the Internet Protocol address set of the first network device based on the ICMP timeout messages; Construct a protocol probe message library, broadcast the messages in the protocol probe message library to the target probe network segment, receive protocol response messages, and parse the protocol response messages to obtain the Internet Protocol address set of the second network device; The target network device Internet Protocol address set is obtained by deduplicating and fusing the Internet Protocol address set of the first network device and the Internet Protocol address set of the second network device.

[0071] According to one embodiment of this application, the identification module 300 is specifically used for: The companion protocol request message is identified, and multiple initial device model-level sample tags are obtained based on the companion protocol request message and the target network device Internet Protocol address set; Generate a fingerprint list of sample tags for each initial device model, and perform clustering based on the fingerprint list of sample tags for each initial device model. Based on the clustering results, obtain a new model-level sample tag corresponding to each Internet Protocol address in the target network device Internet Protocol address set.

[0072] According to one embodiment of this application, the identification module 300 is specifically used for: Send a companion protocol request message to at least one Internet Protocol address in the target network device's Internet Protocol address set to obtain protocol response data for each Internet Protocol address; For each Internet Protocol address, the protocol response data is clustered into multiple text clusters, and at least one sampled text for each text cluster is determined. Based on at least one sampled text for each text cluster, a model regular expression is generated for each text cluster, and model information is extracted according to the model regular expression for each text cluster to obtain multiple initial device model-level sample labels.

[0073] It should be noted that the foregoing explanation of the network device model-level identification method embodiment also applies to the network device model-level identification device of this embodiment, and will not be repeated here.

[0074] According to the network device model-level identification device proposed in this application, multi-dimensional features corresponding to each Internet Protocol address in the Internet Protocol address set of the network device to be identified are extracted. The multi-dimensional features are then input into a pre-trained model-level identification model to obtain the model-level identification result for each device in the network device to be identified. This solves the problems of excessively coarse device identification granularity, insufficient coverage of network device IP discovery, low tag construction efficiency, and insufficient model-level identification accuracy in related technologies.

[0075] Figure 7 This is a schematic diagram of an electronic device provided in an embodiment of the present invention. The electronic device may include: The memory 701, the processor 702, and the computer program stored on the memory 701 and executable on the processor 702.

[0076] When the processor 702 executes the program, it implements the network device model-level identification method provided in the above embodiments.

[0077] Furthermore, electronic devices also include: Communication interface 703 is used for communication between memory 701 and processor 702.

[0078] The memory 701 is used to store computer programs that can run on the processor 702.

[0079] The memory 701 may include high-speed RAM (Random Access Memory) memory, and may also include non-volatile memory, such as at least one disk storage.

[0080] If the memory 701, processor 702, and communication interface 703 are implemented independently, then the communication interface 703, memory 701, and processor 702 can be interconnected via a bus to complete communication between them. The bus can be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect) bus, or an EISA (Extended Industry Standard Architecture) bus, etc. The bus can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 7 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0081] Optionally, in a specific implementation, if the memory 701, processor 702, and communication interface 703 are integrated on a single chip, then the memory 701, processor 702, and communication interface 703 can communicate with each other through an internal interface.

[0082] The processor 702 may be a CPU (Central Processing Unit), an ASIC (Application Specific Integrated Circuit), or one or more integrated circuits configured to implement embodiments of the present invention.

[0083] This invention also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the network device model identification method described above.

[0084] This application also provides a computer program product, which includes a computer program that, when executed by a processor, implements the steps in any of the above-described network device model identification method embodiments.

[0085] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this application, "multiple" means at least two, such as two, three, etc., unless otherwise explicitly specified.

[0086] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of this application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0087] Although embodiments of this application have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting this application. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of this application.

Claims

1. A network device model level identification method, characterized in that, include: Obtain the set of Internet Protocol addresses of the network device to be identified; Extract the multidimensional features corresponding to each Internet Protocol address in the set of Internet Protocol addresses of the network device to be identified; The multidimensional features corresponding to each Internet Protocol address in the set of Internet Protocol addresses of the network devices to be identified are input into a pre-trained model-level identification model to obtain the model-level identification result of each device in the network devices to be identified.

2. The method of claim 1, wherein, Before inputting the multi-dimensional features corresponding to each Internet Protocol address in the set of Internet Protocol addresses of the network devices to be identified into a pre-trained model for model-level identification to obtain the model-level identification result for each device in the network devices to be identified, the method further includes: Obtain the set of Internet Protocol addresses of the target network device; Based on the target network device Internet Protocol address set, construct a new model-level sample label corresponding to each Internet Protocol address in the target network device Internet Protocol address set; A basic dataset is constructed based on the multidimensional features corresponding to each Internet Protocol address in the target network device Internet Protocol address set and the new model-level sample label; Based on the preset random forest algorithm, the preset model is trained using the basic dataset to obtain the pre-trained model-level recognition model.

3. The method of claim 2, wherein, The acquisition of the target network device's Internet Protocol address set includes: Determine the target detection network segment; Generate a probe data packet with a weighted random TTL, send the probe data packet with the weighted random TTL to the target probe network segment, receive an ICMP timeout message, and determine the first network device Internet Protocol address set based on the ICMP timeout message; A protocol probe message library is constructed, and the messages in the protocol probe message library are broadcast to the target probe network segment. Protocol response messages are received, and the protocol response messages are parsed to obtain the Internet Protocol address set of the second network device. The target network device Internet Protocol address set is obtained by deduplicating and fusing the first network device Internet Protocol address set and the second network device Internet Protocol address set.

4. The method according to claim 2, characterized in that, The step of constructing a new model-level sample label corresponding to each Internet Protocol address in the target network device Internet Protocol address set includes: Determine the companion protocol request message, and obtain multiple initial device model-level sample tags based on the companion protocol request message and the target network device Internet Protocol address set; Generate a fingerprint list for each initial device model-level sample tag, and perform clustering based on the fingerprint list of each initial device model-level sample tag. Based on the clustering results, obtain a new model-level sample tag corresponding to each Internet Protocol address in the target network device Internet Protocol address set.

5. The method according to claim 4, characterized in that, The step of obtaining the initial device model-level sample tag based on the companion protocol request message and the target network device Internet Protocol address set includes: Send the companion protocol request message to at least one Internet Protocol address in the Internet Protocol address set of the target network device to obtain protocol response data for each Internet Protocol address; The protocol response data for each Internet Protocol address is clustered into multiple text clusters, and at least one sampled text for each text cluster is determined. Based on at least one sampled text of each text cluster, a model regular expression is generated for each text cluster, and model information is extracted according to the model regular expression of each text cluster to obtain the multiple initial device model-level sample labels.

6. A network device model-level identification device, characterized in that, include: The acquisition module obtains the set of Internet Protocol addresses of the network device to be identified; The extraction module extracts multi-dimensional features corresponding to each Internet Protocol address in the set of Internet Protocol addresses of the network device to be identified; The identification module inputs the multi-dimensional features corresponding to each Internet Protocol address in the set of Internet Protocol addresses of the network devices to be identified into a pre-trained model-level identification model to obtain the model-level identification result of each device in the network devices to be identified.

7. The apparatus according to claim 6, characterized in that, Before inputting the multi-dimensional features corresponding to each Internet Protocol address in the set of Internet Protocol addresses of the network devices to be identified into a pre-trained model-level identification model to obtain the model-level identification result for each device in the network devices to be identified, the identification module further includes: Obtain the set of Internet Protocol addresses of the target network device; Based on the target network device Internet Protocol address set, construct a new model-level sample label corresponding to each Internet Protocol address in the target network device Internet Protocol address set; A basic dataset is constructed based on the multidimensional features corresponding to each Internet Protocol address in the target network device Internet Protocol address set and the new model-level sample label; Based on the preset random forest algorithm, the preset model is trained using the basic dataset to obtain the pre-trained model-level recognition model.

8. An electronic device, characterized in that, include: A memory, a processor, and a computer program stored in the memory and executable on the processor, the processor executing the program to implement the network device model-level identification method as described in any one of claims 1-5.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, The program is executed by the processor to implement the network device model-level identification method as described in any one of claims 1-5.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the network device model-level identification method as described in any one of claims 1-5.

Images