Method for identifying equipment present in a home network.

Abstract

The invention relates to a method for identifying a first piece of equipment present in a communication network, this method being implemented by a processing unit and comprising the following steps: - receiving identification data from said first piece of equipment, - using a statistical model based on a neural network to calculate a digital fingerprint of the first piece of equipment from the identification data, - successively determining distances between the calculated digital fingerprint and, respectively, digital fingerprints pre-recorded in a reference database; these pre-recorded digital fingerprints being digital fingerprints of known equipment, - identifying the first piece of equipment as being known equipment when the distance between the digital fingerprint of the first piece of equipment and the pre-recorded digital fingerprint of said known equipment is less than a predetermined threshold. Figure for the abstract: Fig. 2

Description

Title of the invention: Method for identifying equipment present in a home network.

[0001] The present invention relates to a method for identifying a first piece of equipment present in a communication network.

[0002] Generally speaking, the identification of equipment in a home network is based on machine learning solutions of the multi-class classification type. These solutions are all based on environments composed of twenty to thirty different devices.

[0003] The environment of a telecom operator is very different. Millions of users utilize several thousand equipment models. Moreover, some of these devices are very popular and far more prevalent than others (several hundred thousand times more). The fact that there are several thousand classes and a highly unbalanced distribution of models makes the multi-class classification approach unsuitable for networks of several thousand devices.

[0004] US patent US20200382376A1 describes a method for classifying equipment by classifying equipment into a first category according to a first classification technique for a predetermined period. A second classification technique is applied if the equipment has not changed category during the predetermined period.

[0005] US patent 10652116B2 is known to describe a method for classifying equipment. Various types of information are used to enable classification.

[0006] The present invention aims to identify a very large number of equipment.

[0007] Another object of the invention is to design a new identification method capable of easily identifying many new pieces of equipment.

[0008] The invention also aims at a new identification method capable of reliably recognizing unpopular equipment.

[0009] At least one of the objectives is achieved with a method for identifying a first piece of equipment present in a communication network, in particular a home network, this method being implemented by a processing unit and comprising the following steps:

[0010] - receiving identification data from said first equipment,

[0011] - use of a statistical model based on a neural network to calculate a digital fingerprint of the first device from the identification data,

[0012] - successive determination of distances between the calculated digital fingerprint and respectively pre-registered digital fingerprints in a database of reference; these pre-recorded digital fingerprints being digital fingerprints of known equipment,

[0013] - identification of the first piece of equipment as being known equipment when the distance between the digital fingerprint of the first device and the pre-registered digital fingerprint of said known device is less than a predetermined threshold.

[0014] With the method according to the invention, a new digital fingerprinting approach is used rather than a classification as in the prior art. The invention makes it possible, in particular, to recognize equipment that was not known during the model training.

[0015] The distance to the equipment to be identified can advantageously be calculated relative to all the footprints in the reference database, particularly using a KNN (K nearest neighbors) type algorithm. This makes it possible to determine which piece of equipment in the reference database is most similar to the equipment to be identified.

[0016] The statistical model is derived from machine learning technology based on neural networks. The input data is used to predict a digital fingerprint. A search is then initiated in the reference database to find a pre-recorded digital fingerprint that most closely matches or resembles the fingerprint that has just been predicted or determined.

[0017] With the invention, machine learning is used instead of a simple signature creation algorithm. The use of machine learning is less time-consuming.

[0018] Identifying equipment consists of identifying, in particular, the operating system and the type of equipment.

[0019] Preferably, the following information can be identified for each piece of equipment:

[0020] - the type of equipment, for example a computer, a camera, a television...

[0021] - the equipment seller, for example "Apple",...

[0022] - the product line of the equipment, for example "iPhone",...

[0023] - the model of the equipment, for example an "iPhone 13 Pro Max",...

[0024] - the operating system used by the equipment, for example "iOS",...

[0025] - the version of the operating system used by the equipment, for example "15.1.0 "...

[0026] The invention makes it possible to detect a very large number of types of equipment by using machine learning to generate a digital fingerprint and comparing it to digital fingerprints contained in a reference database.

[0027] The use of machine learning and a reference database allows for a limited number of digital fingerprints in the reference database. Indeed, the comparison is not necessarily made identically, but rather seeks a digital fingerprint that comes closest. So it is not necessary to accurately list all the fingerprints of all the equipment.

[0028] We can thus have a non-exhaustive reference base.

[0029] In the method according to the invention, if the equipment is not recognized, a manual or automatic process can be implemented to retrieve a set of data from the equipment being identified. This can be done, in particular, by means of an application communicating with the equipment. The digital fingerprint of this equipment can then be recorded in the reference database.

[0030] According to an advantageous feature of the invention, the pre-recorded digital fingerprints can be vectors obtained from known equipment identification data.

[0031] In addition to the above, each vector can be determined from:

[0032] - on the one hand, identification data containing textual information about to which a processing is applied by means of a subset of the neural network based on recurrent neurons to determine a first subvector,

[0033] - on the other hand identification data containing information categorical elements on which ordinal encoding is applied to determine a unique code per category, then embedding to associate each category with a second subvector,

[0034] - the first and second subvectors are then combined by means of at least a fully connected layer ("dense layers" in English) to form said vector.

[0035] In particular, each category is transformed into a single sub-vector.

[0036] According to one embodiment of the invention, the subset of the neural network based on recurrent neurons can be a recurrent network of the LSTM (Long Short Terni Memory) or GRU (Gated Recurrent Unit) type. Other types of approaches can be considered, such as attention-based layers, of the transformer type.

[0037] According to one embodiment of the invention, for a given piece of equipment, the statistical model may include a cost function per triplet (“Triplet loss” in English) allowing to generate a vector closer to the vectors of identical equipment said given equipment and further away from the vectors of different equipment said given equipment.

[0038] Such an implementation consists of analyzing not only the probabilities but also the differences.

[0039] According to another embodiment of the invention, for a given piece of equipment, the statistical model may include a contrast loss cost function ("Contrastive loss" in English) allowing the generation of a vector closer to the vectors of identical equipment to said given equipment and further away from vectors of different equipment to said given equipment.

[0040] According to the invention, the pre-recorded digital fingerprints can be predetermined by the neural network from the following data from known equipment:

[0041] - DHCP protocol identifiers including the hostname, the options, the vendor class, the list of options in a request package,

[0042] - the first three octets of the MAC address (YES),

[0043] - names of mDNS announcement services, for example ptrs fields of mDNS announcements

[0044] - WiFi data,

[0045] - the TLS client and server fingerprint, for example in the format JA3,

[0046] - the list of domain names contacted,

[0047] - the number of different domain names contacted,

[0048] - the list of network ports used (TCP and UDP),

[0049] - the list of open network ports (TCP and UDP),

[0050] - network communication timing information including the frequency of Wi-Fi and DHCP server connection, and / or network access frequency per domain name, and

[0051] - the type of network connection: wifi or ethernet.

[0052] In addition to the above, wifi data may include:

[0053] - the HT / VHT / HE capacities,

[0054] - the first three bytes present in the supplier's specific label,

[0055] - the number of antennas,

[0056] - the list of supported MCS (“Modulation and Coding Scheme”),

[0057] - the maximum supported bandwidth,

[0058] - the capabilities of UNII bands (“Unlicensed National Information Infrastructure”),

[0059] - spatial flux: maximum supported rx / tx,

[0060] - the supported standards,

[0061] - the supported radio standards.

[0062] According to an advantageous embodiment of the invention, the identification data includes at least one of the following:

[0063] - a user agent in an HTTP or QUIC protocol,

[0064] - DHCP protocol identifiers including the hostname, the vendor class, the user class, and vendor-specific information.

[0065] - mDNS advertisement service names, for example "_printer._tcp", and

[0066] - UPnP protocol data including: manufacturer, familiar name, model, description, model number.

[0067] With at least one of these data, it is possible to identify a piece of equipment.

[0068] According to a preferred embodiment of the invention, before using the statistical model, the identification data can first feed an expert system capable of identifying the equipment or of transmitting the identification data to the statistical model if identification fails; the expert system comprising an equipment recognition algorithm based on rules using regular expressions.

[0069] With such an embodiment, the present invention constitutes a hybrid solution comprising an expert system and a machine learning solution. A first test is performed with the expert system; if the equipment is identified, the algorithm stops, otherwise the identification data is sent to the statistical model for identification. If the statistical model fails to identify the equipment, human intervention may or may not be required to generate a digital fingerprint of this equipment and record it in the reference database.

[0070] The expert system consists of rules based on regular expressions to recognize certain characteristic patterns. These rules use identification data to identify a piece of equipment.

[0071] Advantageously, the reference base may include digital fingerprints obtained from data from information collections and fingerprints obtained from data synthesized from a generator.

[0072] The collected data comes from retrieving information from listed equipment or from queries that have been made. Alternatively, the data collected consists of a sample of the queries that have been made. This sampling is done in such a way as to obtain a sufficient number of examples for each type of equipment to be identified. It is important in this sampling to balance the number of samples for each type of equipment.

[0073] For equipment that is not very present, the data generator makes it possible to generate a sufficient number of examples to add to the reference database.

[0074] The generator used for the reference dataset can also be used during the model training phase. In this case, it is used to rebalance the data distribution. A balanced distribution of classes during model training is essential for its subsequent performance.

[0075] Thus, the reliability of the system's prediction depends on the number and type of input information provided to it. To achieve this, the data used is balanced as much as possible:

[0076] - by removing data from the most popular equipment, and

[0077] - using synthetic data for rarer equipment.

[0078]

[0079] The present invention also relates to a computer program product comprising instructions which, when the program is executed by a computer, lead the computer to implement the process described above.

[0080] A data processing system is also planned, comprising a processor adapted to the process described above.

[0081] Other advantages and features of the invention will become apparent from an examination of the detailed description of a non-limiting embodiment and the accompanying drawings, in which:

[0082] [Fig-1] The [Fig.1] is a schematic overview of an operating system;

[0083] [Fig.2] Fig.2 is a schematic view of different stages of identification of a equipment according to the invention; and

[0084] [Fig.3] The [Fig.3] is a schematic view of an example of a network architecture of neuron according to the invention.

[0085] The embodiments described below are not exhaustive; in particular, variants of the invention may be implemented comprising only a selection of the features described below, isolated from the other features described, if this selection of features is sufficient to confer a technical advantage or to differentiate the invention from the prior art. This selection includes at least one preferably functional feature without structural details, or with only a portion of the structural details if this portion alone is sufficient to confer a technical advantage or to differentiate the invention from the prior art.

[0086] We will first describe, with reference to [Fig. 1], a wireless home local area network 100. The network center is a home gateway 1 distributing an internet connection to the various stations 2 connected throughout the home. The home gateway 1 is located in the home, for example in the living room. The home gateway 1 is the central point for all data streams: images, music, videos, etc. Each station 2 is connected to the gateway via Wi-Fi or an Ethernet cable. The home gateway 1 is connected, on one side, to the home local area network 4, or LAN, and on the other side, to the external network 5, or Wide Area Network, or WAN. The local area network 4 refers to any interconnected computer equipment or station 2 within the user's home, such as a television, tablet, mobile phone, or game console.A remote server 3, such as a telecom operator's server, is connected to the . local network 4 via external network 5. The home gateway 1 is for example a device of said telecom operator.

[0087] The present invention aims to identify any equipment connecting to the telecom operator's devices. To do this, an algorithm according to the invention is implemented in the remote server 3.

[0088] The context of the home local area network is by way of example. The method described by the present invention is applicable to other types of wireless communication networks, for example to a university network, to corporate networks, etc.

[0089] Fig. 2 is an overall view of a process according to the invention.

[0090] A device such as a mobile phone 6 connects to the server 3. The latter will implement the process according to the invention to identify this mobile phone, that is to say, identify the following elements:

[0091] - the type of equipment, for example a computer, a camera, a television...

[0092] - the equipment seller,

[0093] - the equipment product line,

[0094] - the equipment model,

[0095] - the operating system used by the equipment, and

[0096] - the version of the operating system used by the equipment.

[0097] The minimum to identify a piece of equipment is, for example, to find its operating system and its type of equipment.

[0098] Once the equipment has been identified, the result obtained can be:

[0099] - displayed on a display device either for the owner of the equipment, or for customer support services to help resolve problems,

[0100] - used in other services such as quality of service (adapt the configuration network for each piece of equipment), IT security (detecting that a piece of equipment needs a software update, isolating a piece of equipment...), physical security (detecting abnormal behavior that could indicate a possible burglary)...

[0101] The result obtained is therefore data that can be transmitted to another processing device.

[0102] The server 3 comprises hardware and software components for implementing the invention. However, these components can be integrated into a single device or distributed across several nearby or remote devices.

[0103] Server 3 includes an expert system 7, a statistical model 8 based on a neural network, a search algorithm 9, a reference database 10 and outputs 11 and 12.

[0104] When the phone 6 connects to the telecom operator's network, identification data from that phone is transmitted to the server 3.

[0105] Expert system 7 applies its rules.

[0106] If phone 6 is already known to the expert system, then this phone is identified as 11.

[0107] If phone 6 connects for the first time, the expert system infers that this phone is not known. The identification data is then sent to the statistical model 8 which generates a digital fingerprint 13.

[0108] The knn search algorithm 9 is used to search the reference database 10 for a pre-registered digital fingerprint that is close to the digital fingerprint 13. A distance is tested between the digital fingerprint 13 and each pre-registered digital fingerprint. When this distance is less than a predetermined threshold, then the digital fingerprint 13 is considered to be the pre-registered digital fingerprint that falls below the threshold. In this case, the identification is confirmed at 11. The reference 11 can be a visual or auditory output device, a write entry in a database, or something else. For example, information can be sent to the recognized equipment.

[0109] When the phone is identified, services can be unlocked or information exchanged between the recognized equipment and server 3 or any other device.

[0110] If the phone is not recognized in the reference database, the digital fingerprint 13 is placed in a prediction database lObis. Human intervention can then be used to manually identify the device and replace its signature in the reference database by associating it with the phone 6.

[0111] Indeed, when a device is not recognized, its digital fingerprint is only entered into the reference database after manual identification of the device. In the meantime, the data associated with this device is saved in a second database called the prediction database, lObis, which contains a list of predictions already made.

[0112] The present invention advantageously uses machine learning not to predict and identify the device, but to generate a digital fingerprint. This results in a time saving because a database is used to quickly search for a similar digital fingerprint. Given the large number of devices to be identified for a given operator, using machine learning to directly identify the device would be too computationally expensive.

[0113] The statistical model and the reference base can be updated based on fingerprints received from the same device. A fingerprint from the same device can change, for example, following equipment updates.

[0114] All identification requests are for example saved in the prediction database lObis to establish statistical data and improve the reference database and the neural network.

[0115] The neural network uses the following information:

[0116] - DHCP protocol identifiers including the hostname, the options, the vendor class, the list of options in a request package,

[0117] - the first three octets of the MAC address (YES),

[0118] - names of mDNS announcement services,

[0119] - WiFi data:

[0120] - the HT / VHT / HE capacities,

[0121] - the first three bytes present in the supplier's specific label,

[0122] - the number of antennas,

[0123] - the list of supported MCS (“Modulation and Coding Scheme”),

[0124] - the maximum supported bandwidth,

[0125] - the capabilities of UNII bands (“Unlicensed National Information Infrastructure”),

[0126] - spatial flux: maximum supported rx / tx,

[0127] - the supported standards,

[0128] - the supported radio standards,

[0129] - TLS client and server fingerprinting ("Fingerprints"),

[0130] - the list of domain names contacted,

[0131] - the number of different domain names contacted,

[0132] - the list of network ports used (TCP and UDP),

[0133] - the list of open network ports (TCP and UDP),

[0134] - network communication timing information including the frequency of Wi-Fi and DHCP server connection, and / or network access frequency per domain name, and

[0135] - the type of network connection: wifi or ethernet.

[0136] Other sources of information may be added in order to improve the statistical model.

[0137] The neural network takes as input the information listed above and converts it into a vector. The input information is used either directly or encoded.

[0138] Fig. 3 is a schematic view of a simplified architecture of a neural network according to the invention.

[0139] Textual information 14 such as the "hostname" is used as is, and processed by a subset 15 of the neural network based on "recurrent" neurons, for example of the LSTM or GRU type. Other approaches allowing Text processing, such as "attention," can be used for this type of data. A first sub-vector is created. Subset 15 allows the identification of patterns characteristic of certain devices, for example, from their network name (DHCP hostname, MDNS name, UPnP friendly name). For example, during training, the model will learn that the text "iphone"® is common to the iPhone® product line. Furthermore, it will learn to ignore patterns that are common in names but not significant for device identification. For example, in a network name like "iphone-de-romain," the model will have learned that the "romain" part is not significant because it is present in several different devices.

[0140] The categorical information 16, for example the "TLS fingerprint", is first encoded by ordinal encoding 17 as a unique number per category. These categories are then used in an "embeddings" layer 18 which allows each category to be associated with a second subvector which will be learned during the training of the statistical model.

[0141] The first subvector and the second subvector feed several fully connected layers 19 (“dense layers”) to combine subvectors and form said vector 20.

[0142] The neural network is trained with the objective of generating vectors that are close for identical equipment, and far apart for different equipment. This can be done in different ways such as for example by using a cost function per triplet ("Triplet loss" in English) or a cost function per contrastive loss ("Contrastive loss" or "Contrastive learning" in English).

[0143] The cost per triplet tells the model which examples are identical and which are different. This learning is done using triplets of examples: two examples from the same class and one from another class. The model is then explicitly trained to strongly separate the different examples and group the similar examples as much as possible.

[0144] Contrastive learning does not require different examples but only examples of the same class. The model is then trained to group similar examples. The separation of different examples is done implicitly.

[0145] The reference base is composed of two different sources of information:

[0146] - data from the collection of information on queries that have been previously done,

[0147] - of data synthesized from a generator.

[0148] The data from the collection consists of a sample of the requests that were made. This sampling is done in such a way as to have a quantity Sufficient examples for each piece of equipment to be recognized. It is preferable in this sampling to balance the number of samples for each type of equipment.

[0149] For equipment that is not very present, the data generator makes it possible to generate a sufficient number of examples to add to the reference database.

[0150] The generator used for the reference dataset can also be used during the model training phase. In this case, it is used to rebalance the data distribution. Balancing the class distribution during model training allows for good performance.

[0151] In general, the present invention comprises two steps:

[0152] - a first step consisting of a statistical model based on a neural network which calculates a digital fingerprint of the equipment to be recognized, and

[0153] - a second step consisting of finding this fingerprint in a database of Data from known equipment. This search is performed by calculating the distance between the footprint of the equipment to be searched for and that of known equipment. If a known piece of equipment is at a sufficiently short distance from the equipment to be identified, then a match is considered to exist.

[0154] Of course, the invention is not limited to the examples just described. Many modifications can be made to these examples without departing from the scope of the present invention as described.

Claims

Claims

1. Method for identifying a first device present in a communication network, this method being implemented by a processing unit and comprising the following steps: - receiving identification data from said first device, - using a statistical model based on a neural network to calculate a digital fingerprint of the first device from the identification data, - successive determination of distances between the calculated digital fingerprint and respectively digital fingerprints pre-recorded in a reference base; these pre-recorded digital fingerprints being digital fingerprints of known devices, - identifying the first device as being a known device when the distance between the digital fingerprint of the first device and the pre-recorded digital fingerprint of said known device is less than a predetermined threshold.

2. Method according to claim 1, characterized in that the pre-recorded digital fingerprints are vectors obtained from identification data of known equipment.

3. Method according to claim 2, characterized in that each vector is determined from: - on the one hand identification data containing textual information on which processing is applied by means of a subset of the neural network based on recurrent neurons to determine a first sub-vector, - on the other hand identification data containing categorical information on which ordinal encoding is applied to determine a unique code per category, then an embedding to associate each category with a second sub-vector, - the first and second sub-vectors are then combined by means of at least one fully connected layer to form said vector.

4. Method according to claim 3, characterized in that the subset of the neural network based on recurrent neurons is a recurrent network of the LSTM type, “Long Short Terni Memory”, or GRU, “Gated Recurrent Unit”.

5. Method according to claim 3 or 4, characterized in that, for a given piece of equipment, the statistical model comprises a cost function per triplet making it possible to generate a vector closer to the vectors of equipment identical to said given piece of equipment and further from the vectors of equipment different from said given piece of equipment.

6. Method according to claim 3 or 4, characterized in that, for a given equipment, the statistical model comprises a cost function by loss of contrast making it possible to generate a vector closer to the vectors of equipment identical to said given equipment and further from the vectors of equipment different from said given equipment.

7. Method according to any one of the preceding claims, characterized in that the pre-recorded digital fingerprints are predetermined by the neural network from the following data of the known equipment: - DHCP protocol identifiers including the host name, the options, the provider class, the list of options in a request packet, - the first three bytes of the MAC address, - names of the services of the mDNS advertisements, - Wifi data, - the client and server TLS fingerprint, - the list of domain names contacted, - the number of different domain names contacted, - the list of network ports used, - the list of open network ports, - network communication time information including the frequency of connection to Wifi and to the DHCP server, and / or the frequency of network access by domain name, and - the type of network connection: Wifi or Ethernet.

8. Method according to claim 7, characterized in that the Wifi data comprises: - the HT / VHT / HE capabilities, - the first three bytes present in the provider-specific label, - the number of antennas, - the list of MCS, “Modulation and Coding Scheme”, supported, - the maximum bandwidth supported, - the capacities of the UNII, “Unlicensed National Information Infrastructure” bands, - spatial flow: maximum rx / tx supported, - the supported standards, - the supported radio standards.

9. Method according to any one of the preceding claims, characterized in that the identification data comprises at least one of the following data: - a user agent in an HTTP or QUIC protocol, - DHCP protocol identifiers comprising the host name, the provider class, the user class and the provider specific information, - names of the services of the mDNS advertisements, and - UPnP protocol data comprising: manufacturer, familiar name, model, description, model number.

10. Method according to any one of the preceding claims, characterized in that before using the statistical model, the identification data first feeds an expert system capable of identifying the equipment or transmitting the identification data to the statistical model if the identification fails; the expert system comprising an equipment recognition algorithm based on regular expression-based rules.

11. Method according to any one of the preceding claims, characterized in that the reference base comprises digital fingerprints obtained from data from information collections and digital fingerprints obtained from data synthesized from a generator.

12. A computer program product comprising instructions which, when the program is executed by a computer, cause the latter to implement the method according to any one of the preceding claims.

13. Data processing system comprising a processor adapted to the method according to any one of claims 1 to 11.

Images