CN116361702A - Network equipment identification method, device, equipment and storage medium - Google Patents
Network equipment identification method, device, equipment and storage medium Download PDFInfo
- Publication number
- CN116361702A CN116361702A CN202111617175.3A CN202111617175A CN116361702A CN 116361702 A CN116361702 A CN 116361702A CN 202111617175 A CN202111617175 A CN 202111617175A CN 116361702 A CN116361702 A CN 116361702A
- Authority
- CN
- China
- Prior art keywords
- network device
- similarity
- network
- equipment
- identified
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N20/00—Machine learning
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/22—Matching criteria, e.g. proximity measures
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/24—Classification techniques
- G06F18/241—Classification techniques relating to the classification model, e.g. parametric or non-parametric approaches
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
- G06F21/44—Program or device authentication
Abstract
The application discloses a network equipment identification method, a device, equipment and a storage medium, wherein the method comprises the following steps: acquiring at least two characteristics of network equipment to be identified; determining at least one similarity between the network equipment to be identified and at least one network equipment based on at least two characteristics of the network equipment to be identified and a characteristic table of the at least one network equipment in a preset equipment library; determining a first network device for which the matching was successful based on the at least one similarity; and acquiring the equipment type corresponding to the first network equipment as the equipment type of the network equipment to be identified. In this way, the similarity between the network equipment to be identified and each network equipment in the equipment library is determined by comparing at least two features of the network equipment to be identified with at least two features in the feature table of each network equipment in the equipment library, so that the similarity is determined based on the multi-dimensional comparison result, the accuracy of the similarity result can be improved, and the accuracy of the identification result is further improved.
Description
Technical Field
The present invention relates to the field of network communications technologies, and in particular, to a network device identification method, device, equipment, and storage medium.
Background
In a network environment, where there are a large number of network devices, the network devices must be identified in order to prevent serious consequences of an illegal network device accessing the network. In the prior art, traffic data is often utilized to identify network devices. In the process of identifying network devices by using traffic data, the process is mainly divided into an IP partition process for determining network devices to be identified and a User-Agent (User-Agent) identification process for determining types of network devices to be identified. User-Agent identification is typically performed by matching keywords in the User-Agent with keywords in a device keyword matching library, so as to determine the type of network device to be identified. The User-Agent identification method is simple keyword matching, and has the problem of low identification accuracy.
Disclosure of Invention
In order to solve the above technical problems, it is desirable in the embodiments of the present application to provide a network device identification method, apparatus, device, and storage medium.
The technical scheme of the application is realized as follows:
in a first aspect, a network device identification method is provided, the method including:
acquiring at least two characteristics of network equipment to be identified;
Determining at least one similarity between the network equipment to be identified and at least one network equipment based on at least two characteristics of the network equipment to be identified and a characteristic table of the at least one network equipment in a preset equipment library; wherein the feature table contains at least two features of each network device;
determining a first network device for which the matching is successful based on the at least one similarity;
and acquiring the equipment type corresponding to the first network equipment as the equipment type of the network equipment to be identified.
In the above solution, the determining at least one similarity between the network device to be identified and the at least one network device based on at least two features of the network device to be identified and a feature table of the at least one network device in a preset device library includes: comparing the characteristics in a second network device characteristic table with the characteristics of the network device to be identified, and determining at least one identical characteristic of the second network device and the network device to be identified; wherein the second network device is any network device in the device library; and determining the similarity of the network device to be identified and the second network device based on the at least one same characteristic.
In the above solution, the feature table further includes: the feature weight corresponding to each feature; the determining, based on the at least one identical feature, a similarity of the network device to be identified and the second network device includes: and determining the similarity of the network equipment to be identified and the second network equipment based on the at least one identical feature and the feature weight of the at least one identical feature.
In the above solution, the comparing the features in the second network device feature table with the features of the network device to be identified, and determining at least one identical feature of the second network device and the network device to be identified includes: calculating cosine similarity of the first characteristic of the network equipment to be identified and the second characteristic of the second network equipment; if the cosine similarity is greater than or equal to a preset cosine similarity threshold, determining that the first feature and the second feature are the same feature; the first feature is a feature of the network device to be identified, and the second feature is a feature in a feature table of the second network device.
In the above solution, the feature table further includes: the feature weight corresponding to each feature; the method further comprises the steps of: acquiring a training set; the training set comprises at least one training network device and at least two features corresponding to the training device; determining at least one similarity of the training network device and at least one network device in the device library based on at least two features of the training network device and a feature table of the at least one network device in the device library; determining whether the training network device successfully matches a network device in the device library based on the at least one similarity; and if the matching is failed, adjusting the characteristic weight of the network equipment corresponding to the maximum value in at least one similarity between the training network equipment and the at least one network equipment until the matching is successful, and obtaining the trained characteristic weight.
In the above scheme, the method further comprises: determining matching failure based on the at least one similarity, and recording the matching failure times and the total recognition times from the last training end of the equipment library to the current moment; calculating the ratio of the matching failure times to the total recognition times; and training the equipment library if the ratio is greater than or equal to a preset ratio threshold.
In the above scheme, the equipment library further comprises: the corresponding similarity range of each network device; the first network device that determines that the matching is successful based on the at least one similarity includes: determining a similarity maximum value of the at least one similarity; the maximum value of the similarity is located in the similarity range of the corresponding network equipment, and the network equipment corresponding to the maximum value of the similarity is used as the first network equipment.
In the above scheme, the method further comprises: the maximum value of the similarity is located outside the similarity range of the corresponding network equipment, and the failure of matching is determined; and adding the network equipment to be identified to the equipment library as new network equipment.
In the above scheme, the method further comprises: determining an acquisition difficulty value of each feature; determining a traversing sequence corresponding to at least one network device in the device library based on the acquisition difficulty value;
The traversal order is used for indicating the similarity determining order of the network equipment to be identified and the at least one network equipment.
In a second aspect, there is provided a network device identification apparatus, the apparatus comprising:
the acquisition module is used for acquiring at least two characteristics of the network equipment to be identified;
the processing module is used for determining at least one similarity between the network equipment to be identified and at least one network equipment based on at least two characteristics of the network equipment to be identified and a characteristic table of the at least one network equipment in a preset equipment library; wherein the feature table contains at least two features of each network device;
the processing module is further configured to determine a first network device that is successfully matched based on the at least one similarity;
the obtaining module is further configured to obtain a device type corresponding to the first network device, as the device type of the network device to be identified.
In a third aspect, there is provided a network device identification device, the device comprising: a processor and a memory configured to store a computer program capable of running on the processor, wherein the processor is configured to perform the steps of any of the preceding methods when the computer program is run.
In a fourth aspect, a computer storage medium is provided, on which a computer program is stored, wherein the computer program, when being executed by a processor, carries out the steps of the aforementioned method.
The application discloses a network equipment identification method, which is characterized in that the similarity between the network equipment to be identified and each network equipment in the equipment library is determined by comparing at least two characteristics of the network equipment to be identified with at least two characteristics in a characteristic table of each network equipment in the equipment library, so that the similarity is determined based on a multi-dimensional comparison result, the accuracy of a similarity result can be improved, and the accuracy of an identification result is further improved.
Drawings
Fig. 1 is a schematic flow chart of a network device identification method in an embodiment of the present application;
fig. 2 is a second flow chart of a network device identification method in the embodiment of the present application;
fig. 3 is a third flow chart of a network device identification method in an embodiment of the present application;
fig. 4 is a schematic diagram of a composition structure of a network device identification apparatus in an embodiment of the present application;
fig. 5 is a schematic diagram of a composition structure of a network device identification device in an embodiment of the present application.
Detailed Description
For a more complete understanding of the features and technical content of the embodiments of the present application, reference should be made to the following detailed description of the embodiments of the present application, taken in conjunction with the accompanying drawings, which are for purposes of illustration only and not intended to limit the embodiments of the present application.
Fig. 1 is a schematic flow chart of a network device identification method in an embodiment of the present application. As shown in fig. 1, the network device identification method specifically may include:
step 101: acquiring at least two characteristics of network equipment to be identified;
here, a network device is a physical entity connected to a computer network. By way of example, network devices are computers (whether they are personal computers or servers), hubs, switches, bridges, routers, gateways, network interface cards, wireless access points, printers and modems, fiber optic transceivers, fiber optic cables, and the like. The network device to be identified is an unknown device, and the identification result can be the device type, the device model and the like of the network device.
Here, the at least two features are attribute information corresponding to the network device, which may be obtained by analyzing data of the network device, and exemplary, the at least two features may identify keywords, an operating system, an overall traffic rate, a system name, and the like for the device of the network device.
Step 102: determining at least one similarity between the network equipment to be identified and at least one network equipment based on at least two characteristics of the network equipment to be identified and a characteristic table of the at least one network equipment in a preset equipment library;
Wherein the feature table contains at least two features of each network device;
the preset device library is a database containing at least one characteristic table of network devices, and the network devices in the device library can be continuously updated. The feature table contains at least two features of the data network device.
Here, a degree of similarity is determined between the network device to be identified and a network device in the device library for characterizing the degree of similarity between the identification device and the network device.
For example, the similarity between the network device to be identified and one network device in the device library may be determined by comparing at least two features of the network device to be identified with features in a feature table of the network device, and determining the similarity between the network device to be identified and the network device according to the comparison result.
In some embodiments, the determining the at least one similarity between the network device to be identified and the at least one network device based on at least two features of the network device to be identified and a feature table of the at least one network device in a preset device library includes: comparing the characteristics in a second network device characteristic table with the characteristics of the network device to be identified, and determining at least one identical characteristic of the second network device and the network device to be identified; wherein the second network device is any network device in the device library; and determining the similarity of the network device to be identified and the second network device based on the at least one same characteristic.
Illustratively, in some embodiments, the method further comprises: and traversing the equipment library, and calculating the similarity between the network equipment to be identified and each network equipment in the equipment library.
Illustratively, in some embodiments, the method further comprises: determining an acquisition difficulty value of each feature; determining a traversing sequence corresponding to at least one network device in the device library based on the acquisition difficulty value; the traversal order is used for indicating the similarity determining order of the network equipment to be identified and the at least one network equipment.
By sequencing the network devices in the device library, the recognition efficiency can be improved.
Step 103: determining a first network device for which the matching is successful based on the at least one similarity;
here, the successful matching characterizes the presence of network devices in the device library that match the network device to be identified. The first network device is the network device with the highest similarity with the network device to be identified in the database, and is used for determining the identification result of the network device to be identified based on the first network device. For example, the identification result may be a device type, a device model, etc. of the network device to be identified.
Illustratively, in some embodiments, the device library further comprises: the corresponding similarity range of each network device; the first network device that determines that the matching is successful based on the at least one similarity includes: determining a similarity maximum value of the at least one similarity; the maximum value of the similarity is located in the similarity range of the corresponding network equipment, and the network equipment corresponding to the maximum value of the similarity is used as the first network equipment.
Illustratively, in some embodiments, the method further comprises: the maximum value of the similarity is located outside the similarity range of the corresponding network equipment, and the failure of matching is determined; and adding the network equipment to be identified to the equipment library as new network equipment.
Here, the failed match characterizes that no network device exists in the device library that matches the network device to be identified. By adding the network equipment to be identified to the equipment library as new network equipment when the matching fails, the network equipment in the equipment library can be automatically enriched in the continuous identification process, so that the self-adaptive identification is realized, and the hot start is not required.
Illustratively, in some embodiments, the method further comprises: determining matching failure based on the at least one similarity, and recording the matching failure times and the total recognition times from the last training end of the equipment library to the current moment; calculating the ratio of the matching failure times to the total recognition times; and training the equipment library if the ratio is greater than or equal to a preset ratio threshold.
Here, the preset ratio threshold may be understood as a preset failure rate, and when the ratio of the number of matching failures from the last training of the equipment library to the current time to the total number of identification is greater than or equal to the preset ratio threshold, the error of identifying the network equipment based on the equipment library is larger, and the equipment library needs to be trained. For example, in practical applications, training the device library may be training features and/or feature weights in a feature table of network devices in the device library.
By training the equipment library when the failure rate reaches the preset failure rate, the dynamic adjustment and update of the equipment library can be realized, and the recognition efficiency is improved.
Step 104: and acquiring the equipment type corresponding to the first network equipment as the equipment type of the network equipment to be identified.
Here, the device type may also be information such as a device model number, and is used to distinguish network devices.
Here, the execution subject of steps 101 to 104 may identify the processor of the device for the network device.
According to the technical scheme, the similarity between the network equipment to be identified and each network equipment in the equipment library is determined by comparing at least two characteristics of the network equipment to be identified with at least two characteristics in the characteristic table of each network equipment in the equipment library, the similarity is determined based on the multi-dimensional comparison result, the accuracy of the similarity result can be improved, and the accuracy of the identification result is further improved.
For the purpose of further embodying the present application, further illustrating the present application based on the embodiments of the present application, fig. 2 is a schematic diagram of a second flow of the network device identification method in the embodiment of the present application. As shown in fig. 2, the network device identification method specifically may include:
step 201: acquiring at least two characteristics of network equipment to be identified;
here, a network device is a physical entity connected to a computer network. By way of example, network devices are computers (whether they are personal computers or servers), hubs, switches, bridges, routers, gateways, network interface cards, wireless access points, printers and modems, fiber optic transceivers, fiber optic cables, and the like. The network device to be identified is an unknown device, and the identification result can be the device type, the device model and the like of the network device.
Here, the at least two features are attribute information corresponding to the network device, which may be obtained by analyzing data of the network device, and exemplary, the at least two features may identify keywords, an operating system, an overall traffic rate, a system name, and the like for the device of the network device.
Step 202: comparing the characteristics in a second network device characteristic table with the characteristics of the network device to be identified, and determining at least one identical characteristic of the second network device and the network device to be identified;
Wherein the second network device is any network device in the device library;
the preset device library is a database containing at least one characteristic table of network devices, and the network devices in the device library can be continuously updated. The feature table contains at least two features of the data network device.
Here, a degree of similarity is determined between the network device to be identified and a network device in the device library for characterizing the degree of similarity between the identification device and the network device.
Illustratively, in some embodiments, the method further comprises: and traversing the equipment library, and calculating the similarity between the network equipment to be identified and each network equipment in the equipment library.
Illustratively, in some embodiments, the method further comprises: determining an acquisition difficulty value of each feature; determining a traversing sequence corresponding to at least one network device in the device library based on the acquisition difficulty value; the traversal order is used for indicating the similarity determining order of the network equipment to be identified and the at least one network equipment.
Step 203: determining a similarity of the network device to be identified and the second network device based on the at least one identical feature;
In some embodiments, the determining the similarity between the network device to be identified and the second network device based on the at least one identical feature may be determining the similarity between the network device to be identified and the second network device based on the number of identical features or the proportion of identical features to all features in the second network device feature table.
Illustratively, in some embodiments, the feature table further comprises: the feature weight corresponding to each feature; the determining, based on the at least one identical feature, a similarity of the network device to be identified and the second network device includes: and determining the similarity of the network equipment to be identified and the second network equipment based on the at least one identical feature and the feature weight of the at least one identical feature.
In practical applications, the determining the similarity between the network device to be identified and the second network device based on the at least one identical feature and the feature weight of the at least one identical feature may be: performing a comparison result list based on at least one identical feature and a feature table of the second network device, wherein the comparison result corresponding to the identical feature is 1, and the comparison result of the rest features in the feature table is 0; and calculating products of comparison results of all the features in the result list and corresponding feature weights, and summing to obtain the similarity of the network equipment to be identified and the second network equipment.
Illustratively, in some embodiments, the comparing the features in the second network device feature table with the features of the network device to be identified, determining at least one identical feature of the second network device and the network device to be identified includes: calculating cosine similarity of the first characteristic of the network equipment to be identified and the second characteristic of the second network equipment; if the cosine similarity is greater than or equal to a preset cosine similarity threshold, determining that the first feature and the second feature are the same feature; the first feature is a feature of the network device to be identified, and the second feature is a feature in a feature table of the second network device.
In practical applications, each feature may be represented by a feature vector, and the cosine similarity between the first feature of the network device to be identified and the second feature of the second network device may be obtained by calculating the cosine similarity between the first vector representing the first feature and the second vector representing the second feature.
Step 204: determining a similarity maximum value of the at least one similarity;
step 205: the maximum value of the similarity is positioned in the similarity range of the corresponding network equipment, and the network equipment corresponding to the maximum value of the similarity is used as the first network equipment;
Here, the device library is preset with a similarity range corresponding to each network device.
Step 206: acquiring a device type corresponding to the first network device as the device type of the network device to be identified;
step 207: the maximum value of the similarity is located outside the similarity range of the corresponding network equipment, and the failure of matching is determined;
step 208: adding the network device to be identified to the device library as a new network device;
illustratively, adding the network device to be identified to the device library as a new network device comprises: acquiring a default characteristic weight value and a default similarity range; constructing a feature table of the new network equipment based on the features of the features to be identified and default feature weight values; and adding the characteristic table and the similarity range of the new network equipment to the equipment library.
Step 209: recording the matching failure times and the total recognition times from the last training of the equipment library to the current moment;
step 210: calculating the ratio of the matching failure times to the total recognition times;
step 211: and training the equipment library if the ratio is greater than or equal to a preset ratio threshold.
Here, the preset ratio threshold may be understood as a preset failure rate, and when the ratio of the number of matching failures from the last training of the equipment library to the current time to the total number of identification is greater than or equal to the preset ratio threshold, the error of identifying the network equipment based on the equipment library is larger, and the equipment library needs to be trained. For example, when the feature table further includes a feature weight corresponding to each feature, the training device library may be a feature weight in the feature table of the network device in the training device library.
Illustratively, in some embodiments, the method further comprises: and training the equipment library. Illustratively, the feature table further comprises: the feature weight corresponding to each feature; the training of the equipment library comprises the following steps: acquiring a training set; the training set comprises at least one training network device and at least two features corresponding to the training device; determining at least one similarity of the training network device and at least one network device in the device library based on at least two features of the training network device and a feature table of the at least one network device in the device library; determining whether the training network device successfully matches a network device in the device library based on the at least one similarity; and if the matching is failed, adjusting the characteristic weight of the network equipment corresponding to the maximum value in at least one similarity between the training network equipment and the at least one network equipment until the matching is successful, and obtaining the trained characteristic weight.
By training the feature weights in the equipment library when the failure rate reaches the preset failure rate, the dynamic adjustment and update of the equipment library can be realized, and the recognition efficiency is improved.
Here, the execution subject of steps 201 to 211 may identify the processor of the device for the network device.
According to the technical scheme, the similarity between the network equipment to be identified and the network equipment in the equipment library is determined by comparing at least two characteristics of the network equipment to be identified with the characteristic table of the network equipment in the equipment library, so that the similarity between the two network equipment can be determined based on a multi-dimensional comparison result, the accuracy of the similarity result can be improved, and the identification result obtained based on the similarity has higher accuracy; when the matching fails, the network equipment to be identified is added to the equipment library as new network equipment, so that the network equipment in the equipment library can be automatically enriched in the continuous identification process, the self-adaptive identification is realized, and the hot start is not required; by training the equipment library when the failure rate reaches a preset value, the dynamic adjustment and update of the equipment library can be realized, and the recognition efficiency is improved.
In order to further embody the purpose of the present application, further illustrating the method according to the embodiment of the present application is shown in fig. 3, which is a schematic diagram of a third flow of the network device identification method according to the embodiment of the present application. As shown in fig. 3, the network device identification method specifically may include:
Step 301: training to obtain a device library;
wherein the device library comprises a table of characteristics of at least one network device; the feature table includes at least two features and feature weights.
The training to obtain the equipment library specifically comprises the following steps 311-313:
step 311: a global variable similarity global threshold map Z is defined that includes a similarity range for each network device in the initial device library.
Step 312: the elastic ratio V (corresponding to the ratio threshold in the present application) within the non-threshold range of the global variable is defined.
The non-threshold in-range elasticity ratio V is used to determine whether training of the library is required. Specifically, when the ratio of the number of matching failures to the total number of recognition times from the last training of the equipment library to the current moment is greater than or equal to V, it is indicated that the feature weight in the equipment library has a problem or some features are not recorded, and adjustment is needed.
Step 313: training to obtain a device library.
Specifically, given U kinds of network equipment with known types, acquiring the characteristics and initial weights of the network equipment with each known type to form an initial characteristic table; calculating each network based on cosine similarity algorithmSimilarity S of devices r The formula is as follows:
wherein S is r Representing the similarity of network devices r, X i Representing the comparison result of each feature, alpha i The feature weight of each feature is represented as a small, and N represents the number of features in the feature table of the network device r. Equation elucidation: and (3) respectively and completely matching each characteristic of the network equipment r with the characteristic of the type of network equipment in the equipment library, wherein if the characteristics are matched with the characteristics, the comparison result of the characteristics is 1, and otherwise, the comparison result is 0.
If S r Similarity range Z for network devices not of this type w In (if the similarity range does not exist, a default value is taken), the deviation of the weight setting is indicated, and the self-learning algorithm is adopted for training until the similarity range is Z w And in the range, updating the weight value or recording the new characteristics into a characteristic table of the type of network equipment, and adding the network equipment r into the equipment library.
Here, the feature table is a preset list including at least two features. For feature comparison based on features in the list. The feature table further includes feature weights, and the sum of the feature weights of all the features in the feature table of each network device is 1. The weight update case is used to guide feature weight training. Illustratively, table 1 is a table of features.
TABLE 1
Step 302: ordering network devices in a device library;
Wherein, the ranking standard is the matching difficulty level, and the easier is the earlier is. Specific: determining an acquisition difficulty value of each feature; determining a traversing sequence corresponding to at least one network device in the device library based on the acquisition difficulty value; the traversal order is used for indicating the similarity determining order of the network equipment to be identified and the at least one network equipment.
Step 303: traversing the equipment library, and calculating the similarity of the network equipment to be identified;
specifically, for each network device w to be identified, a cosine similarity algorithm is performed to calculate the similarity Y w The formula is as follows:
equation elucidation: and (3) completely matching each characteristic of the current network equipment to be identified with the characteristic of each network equipment in the equipment library, wherein if the characteristics are matched with the characteristics, the characteristic is 1, and otherwise, the characteristic is 0. Wherein Y is w Representing similarity of network equipment to be identified, X i Representing the comparison result of each feature item obtained, alpha i Representing the feature weight magnitude of each feature term.
Step 304: determining a similarity maximum value;
specifically, at all Y w Selecting the maximum similarity value Y max The corresponding network device is w max 。
Step 305: judging whether the maximum value meets a similarity threshold value or not;
Specifically, the collected similarity Y of the network devices max W in the equipment library max Similarity threshold Z for network devices w By comparison, at Z w If the matching is successful, step 306 is executed; the maximum value of similarity is not at Z w If the range is not matched, step 307 is performed;
step 306: returning the matched network equipment;
specifically, return network device w max Is a piece of information of (a).
Step 307: updating the equipment library;
specifically, the network device to be identified is added to the device library as a new network device.
Step 308: judging whether the elastic ratio V in the global non-threshold range is reached or not;
specifically, the elastic ratio V in the current non-threshold range is calculated w If V w >The global non-threshold range of the elastic ratio V, which indicates a large error, requires training the library of devices, and performs step 309.
Step 309: training the feature weights in the equipment library;
specifically, a training set is obtained; wherein the training set includes the known network devices and the corresponding feature tables in step 313; the feature weights in the device library are trained based on the training set and the training process in step 313, and the feature table of the network device in the device library is updated.
Step 310: and returning the network equipment to be identified as new equipment.
According to the technical scheme, the equipment library is trained by combining a cosine similarity algorithm and a self-learning algorithm, and hot start is not needed; the initial equipment library and the global variable similarity overall threshold value mapping Z are utilized to find the best matched network equipment, if the best matched network equipment is found, the threshold value condition is judged, the network equipment information is returned within the threshold value range, and the self-updating mechanism is adopted to realize self-adaptive updating of the network equipment library if the best matched network equipment is not within the threshold value range; meanwhile, the concept of the elastic ratio in the non-threshold range is introduced, and the weight is dynamically adjusted, so that the identification cost is reduced, the identification error is reduced, and the identification accuracy is improved.
Fig. 4 is a schematic diagram of a composition structure of a network device identification apparatus in an embodiment of the present application, which shows an implementation apparatus 40 of a network device identification method, where the apparatus 40 specifically includes:
an obtaining module 401, configured to obtain at least two features of a network device to be identified;
a processing module 402, configured to determine at least one similarity between the network device to be identified and at least one network device based on at least two features of the network device to be identified and a feature table of the at least one network device in a preset device library; wherein the feature table contains at least two features of each network device;
The processing module 402 is further configured to determine, based on the at least one similarity, a first network device that matches successfully;
the obtaining module 401 is further configured to obtain a device type corresponding to the first network device, as the device type of the network device to be identified.
In some embodiments, the processing module 402 is configured to compare the features in the second network device feature table with the features of the network device to be identified, and determine at least one identical feature of the second network device and the network device to be identified; wherein the second network device is any network device in the device library; and determining the similarity of the network device to be identified and the second network device based on the at least one same characteristic.
In some embodiments, the feature table further comprises: the feature weight corresponding to each feature; the processing module 402 is configured to determine a similarity between the network device to be identified and the second network device based on the at least one identical feature and a feature weight of the at least one identical feature.
In some embodiments, the processing module 402 is configured to calculate a cosine similarity between the first feature of the network device to be identified and the second feature of the second network device; if the cosine similarity is greater than or equal to a preset cosine similarity threshold, determining that the first feature and the second feature are the same feature; the first feature is a feature of the network device to be identified, and the second feature is a feature in a feature table of the second network device.
In some embodiments, the feature table further comprises: the feature weight corresponding to each feature; the processing module 402 is further configured to obtain a training set; the training set comprises at least one training network device and at least two features corresponding to the training device; determining at least one similarity of the training network device and at least one network device in the device library based on at least two features of the training network device and a feature table of the at least one network device in the device library; determining whether the training network device successfully matches a network device in the device library based on the at least one similarity; and if the matching is failed, adjusting the characteristic weight of the network equipment corresponding to the maximum value in at least one similarity between the training network equipment and the at least one network equipment until the matching is successful, and obtaining the trained characteristic weight.
In some embodiments, the processing module 402 is further configured to determine a matching failure based on the at least one similarity, and record a number of matching failures and a total number of identifications from a last training end of the device library to a current time; calculating the ratio of the matching failure times to the total recognition times; and training the equipment library if the ratio is greater than or equal to a preset ratio threshold.
In some embodiments, the device library further comprises: the corresponding similarity range of each network device; the processing module 402 is configured to determine a similarity maximum value of the at least one similarity; the maximum value of the similarity is located in the similarity range of the corresponding network equipment, and the network equipment corresponding to the maximum value of the similarity is used as the first network equipment.
In some embodiments, the processing module 402 is further configured to determine that the maximum similarity value is outside a similarity range of the corresponding network device, and determine that the matching fails; and adding the network equipment to be identified to the equipment library as new network equipment.
In some embodiments, the processing module 402 is further configured to determine an acquisition difficulty value for each feature; determining a traversing sequence corresponding to at least one network device in the device library based on the acquisition difficulty value; the traversal order is used for indicating the similarity determining order of the network equipment to be identified and the at least one network equipment.
Based on the hardware implementation of each unit in the above network device identification apparatus, another network device identification device is further provided in the embodiment of the present application, and fig. 5 is a schematic diagram of the composition structure of the network device identification device in the embodiment of the present application. As shown in fig. 5, the apparatus 50 includes: a processor 501 and a memory 502 configured to store a computer program capable of running on the processor;
Wherein the processor 501 is configured to execute the method steps of the previous embodiments when running a computer program.
Of course, in actual practice, the various components of the network device identification device are coupled together via a bus system 503, as shown in FIG. 5. It is understood that the bus system 503 is used to enable connected communication between these components. The bus system 503 includes a power bus, a control bus, and a status signal bus in addition to the data bus. But for clarity of illustration the various buses are labeled as bus system 503 in fig. 5.
In practical applications, the processor may be at least one of an application specific integrated circuit (ASIC, application Specific Integrated Circuit), a digital signal processing device (DSPD, digital Signal Processing Device), a programmable logic device (PLD, programmable Logic Device), a Field-programmable gate array (Field-Programmable Gate Array, FPGA), a controller, a microcontroller, and a microprocessor. It will be appreciated that the electronic device for implementing the above-mentioned processor function may be other for different apparatuses, and embodiments of the present application are not specifically limited.
The Memory may be a volatile Memory (RAM) such as Random-Access Memory; or a nonvolatile Memory (non-volatile Memory), such as a Read-Only Memory (ROM), a flash Memory (flash Memory), a Hard Disk (HDD) or a Solid State Drive (SSD); or a combination of the above types of memories and provide instructions and data to the processor.
In an exemplary embodiment, the present application also provides a computer readable storage medium, e.g. a memory comprising a computer program executable by a processor of a network device identification device to perform the steps of the aforementioned method.
It is to be understood that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. As used in this application and the appended claims, the singular forms "a," "an," and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It should also be understood that the term "and/or" as used herein refers to and encompasses any or all possible combinations of one or more of the associated listed items. The expressions "having," "including," and "containing," or "including" and "comprising" are used herein to indicate the presence of corresponding features (e.g., elements such as values, functions, operations, or components), but do not exclude the presence of additional features.
It should be understood that although the terms first, second, third, etc. may be used herein to describe various information, these information should not be limited by these terms. These terms are only used to distinguish one type of information from another and do not necessarily describe a particular order or sequence. For example, first information may also be referred to as second information, and similarly, second information may also be referred to as first information, without departing from the scope of the invention.
The technical solutions described in the embodiments of the present application may be arbitrarily combined without any conflict.
In the several embodiments provided in the present application, it should be understood that the disclosed methods, apparatuses, and devices may be implemented in other manners. The above-described embodiments are merely illustrative, and for example, the division of units is merely a logical function division, and other divisions may be implemented in practice, such as: multiple units or components may be combined or may be integrated into another system, or some features may be omitted, or not performed. In addition, the various components shown or discussed may be coupled or directly coupled or communicatively coupled to each other via some interface, whether indirectly coupled or communicatively coupled to devices or units, whether electrically, mechanically, or otherwise.
The units described as separate units may or may not be physically separate, and units displayed as units may or may not be physical units, may be located in one place, or may be distributed on a plurality of network units; some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.
In addition, each functional unit in each embodiment of the present application may be integrated in one processing unit, or each unit may be separately used as one unit, or two or more units may be integrated in one unit; the integrated units may be implemented in hardware or in hardware plus software functional units.
The foregoing is merely specific embodiments of the present application, but the scope of the present application is not limited thereto, and any person skilled in the art can easily think about changes or substitutions within the technical scope of the present application, and the changes and substitutions are intended to be covered by the scope of the present application.
Claims (12)
1. A method of network device identification, the method comprising:
acquiring at least two characteristics of network equipment to be identified;
determining at least one similarity between the network equipment to be identified and at least one network equipment based on at least two characteristics of the network equipment to be identified and a characteristic table of the at least one network equipment in a preset equipment library; wherein the feature table contains at least two features of each network device;
determining a first network device for which the matching is successful based on the at least one similarity;
And acquiring the equipment type corresponding to the first network equipment as the equipment type of the network equipment to be identified.
2. The method according to claim 1, wherein the determining at least one similarity between the network device to be identified and the at least one network device based on at least two features of the network device to be identified and a feature table of the at least one network device in a preset device library includes:
comparing the characteristics in a second network device characteristic table with the characteristics of the network device to be identified, and determining at least one identical characteristic of the second network device and the network device to be identified; wherein the second network device is any network device in the device library;
and determining the similarity of the network device to be identified and the second network device based on the at least one same characteristic.
3. The method of claim 2, wherein the feature table further comprises: the feature weight corresponding to each feature;
the determining, based on the at least one identical feature, a similarity of the network device to be identified and the second network device includes:
And determining the similarity of the network equipment to be identified and the second network equipment based on the at least one identical feature and the feature weight of the at least one identical feature.
4. The method of claim 2, wherein the comparing the features in the second network device feature table with the features of the network device to be identified, determining at least one identical feature of the second network device and the network device to be identified, comprises:
calculating cosine similarity of the first characteristic of the network equipment to be identified and the second characteristic of the second network equipment;
if the cosine similarity is greater than or equal to a preset cosine similarity threshold, determining that the first feature and the second feature are the same feature;
the first feature is a feature of the network device to be identified, and the second feature is a feature in a feature table of the second network device.
5. The method of claim 1, wherein the feature table further comprises: the feature weight corresponding to each feature; the method further comprises the steps of:
acquiring a training set; the training set comprises at least one training network device and at least two features corresponding to the training device;
Determining at least one similarity of the training network device and at least one network device in the device library based on at least two features of the training network device and a feature table of the at least one network device in the device library;
determining whether the training network device successfully matches a network device in the device library based on the at least one similarity;
and if the matching is failed, adjusting the characteristic weight of the network equipment corresponding to the maximum value in at least one similarity between the training network equipment and the at least one network equipment until the matching is successful, and obtaining the trained characteristic weight.
6. The method according to claim 1, wherein the method further comprises:
determining matching failure based on the at least one similarity, and recording the matching failure times and the total recognition times from the last training end of the equipment library to the current moment;
calculating the ratio of the matching failure times to the total recognition times;
and training the equipment library if the ratio is greater than or equal to a preset ratio threshold.
7. The method of claim 1, wherein the library of devices further comprises: the corresponding similarity range of each network device;
The first network device that determines that the matching is successful based on the at least one similarity includes:
determining a similarity maximum value of the at least one similarity;
the maximum value of the similarity is located in the similarity range of the corresponding network equipment, and the network equipment corresponding to the maximum value of the similarity is used as the first network equipment.
8. The method of claim 7, wherein the method further comprises:
the maximum value of the similarity is located outside the similarity range of the corresponding network equipment, and the failure of matching is determined;
and adding the network equipment to be identified to the equipment library as new network equipment.
9. The method according to claim 1, wherein the method further comprises:
determining an acquisition difficulty value of each feature;
determining a traversing sequence corresponding to at least one network device in the device library based on the acquisition difficulty value; the traversal order is used for indicating the similarity determining order of the network equipment to be identified and the at least one network equipment.
10. A network device identification apparatus, the apparatus comprising:
the acquisition module is used for acquiring at least two characteristics of the network equipment to be identified;
The processing module is used for determining at least one similarity between the network equipment to be identified and at least one network equipment based on at least two characteristics of the network equipment to be identified and a characteristic table of the at least one network equipment in a preset equipment library; wherein the feature table contains at least two features of each network device;
the processing module is further configured to determine a first network device that is successfully matched based on the at least one similarity;
the obtaining module is further configured to obtain a device type corresponding to the first network device, as the device type of the network device to be identified.
11. A network device identification device, the device comprising: a processor and a memory configured to store a computer program capable of running on the processor,
wherein the processor is configured to perform the steps of the method of any of claims 1-9 when the computer program is run.
12. A computer readable storage medium, on which a computer program is stored, characterized in that the computer program, when being executed by a processor, implements the steps of the method according to any one of claims 1-9.
Priority Applications (2)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202111617175.3A CN116361702A (en) | 2021-12-27 | 2021-12-27 | Network equipment identification method, device, equipment and storage medium |
| PCT/CN2022/119044 WO2023124255A1 (en) | 2021-12-27 | 2022-09-15 | Network device identification method and apparatus, device and storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202111617175.3A CN116361702A (en) | 2021-12-27 | 2021-12-27 | Network equipment identification method, device, equipment and storage medium |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN116361702A true CN116361702A (en) | 2023-06-30 |
Family
ID=86937498
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202111617175.3A Pending CN116361702A (en) | 2021-12-27 | 2021-12-27 | Network equipment identification method, device, equipment and storage medium |
Country Status (2)
| Country | Link |
|---|---|
| CN (1) | CN116361702A (en) |
| WO (1) | WO2023124255A1 (en) |
Family Cites Families (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| JP4321645B2 (en) * | 2006-12-08 | 2009-08-26 | ソニー株式会社 | Information processing apparatus, information processing method, recognition apparatus, information recognition method, and program |
| CN103166917B (en) * | 2011-12-12 | 2016-02-10 | 阿里巴巴集团控股有限公司 | Network equipment personal identification method and system |
| CN107622197B (en) * | 2016-07-15 | 2020-12-11 | 阿里巴巴集团控股有限公司 | Equipment identification method and device, and weight calculation method and device for equipment identification |
| CN108363811A (en) * | 2018-03-09 | 2018-08-03 | 北京京东金融科技控股有限公司 | Device identification method and device, electronic equipment, storage medium |
-
2021
- 2021-12-27 CN CN202111617175.3A patent/CN116361702A/en active Pending
-
2022
- 2022-09-15 WO PCT/CN2022/119044 patent/WO2023124255A1/en unknown
Also Published As
| Publication number | Publication date |
|---|---|
| WO2023124255A1 (en) | 2023-07-06 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US11620204B2 (en) | Methods and systems for determining system capacity | |
| JP5864586B2 (en) | Method and apparatus for ranking search results | |
| CN107832062B (en) | Program updating method and terminal equipment | |
| EP2815335A1 (en) | Method of machine learning classes of search queries | |
| WO2012055072A9 (en) | Software application recognition | |
| US10255325B2 (en) | Extreme value computation | |
| CN110798467B (en) | Target object identification method and device, computer equipment and storage medium | |
| US20200090076A1 (en) | Non-transitory computer-readable recording medium, prediction method, and learning device | |
| CN111475105A (en) | Monitoring data storage method, device, server and storage medium | |
| CN112800197A (en) | Method and device for determining target fault information | |
| CN110569218B (en) | Offline modification method and device for EXT file system and storage medium | |
| US9875248B2 (en) | System and method for identifying a file path using tree data structure | |
| CN110674397A (en) | Method, device, equipment and readable medium for training age point prediction model | |
| CN113296992A (en) | Method, device, equipment and storage medium for determining abnormal reason | |
| CN113051568A (en) | Virus detection method and device, electronic equipment and storage medium | |
| CN116027989B (en) | Method and system for storing file set based on storage management chip | |
| CN116361702A (en) | Network equipment identification method, device, equipment and storage medium | |
| CN109885180B (en) | Error correction method and apparatus, computer readable medium | |
| CN108681490B (en) | Vector processing method, device and equipment for RPC information | |
| CN107402886B (en) | Storehouse analysis method and relevant apparatus | |
| JP6203313B2 (en) | Feature selection device, feature selection method, and program | |
| CN113782092B (en) | Method and device for generating lifetime prediction model and storage medium | |
| CN108984780B (en) | Method and device for managing disk data based on data structure supporting repeated key value tree | |
| CN114021861A (en) | Power load prediction method, device, terminal and storage medium | |
| CN113672389A (en) | Server compatibility method, system, equipment and computer readable storage medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |