JP2014052825A - Device identification apparatus, device identification system, device identification method and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To identify a device in a shorter time.SOLUTION: A device identification apparatus includes: feature vector generating means which converts qualitative feature quantity and quantitative feature quantity included in feature quantity of a device to a feature vector formed of predetermined two numerical values, on the basis of a predetermined vectorization rule according to the characteristics of the device feature quantity; grouping means for classifying the devices into a plurality of groups on the basis of the converted feature vector; a cluster analysis bundle 118 for deciding a representative vector for each of the groups; a device cluster extraction bundle 119 which compares the feature vector of a device to be identified with the representative vector for each group, to extract a group most similar to the device to be identified; and a device identification bundle 115 which identifies a device having the most similar comparison feature item, as the device to be identified.

Description

  The present invention relates to a device identification device, a device identification system, a device identification method, and a program.

  Device information of a feature group that receives response packets and passive packets as a result of sending commands to home appliances connected to the network, accumulates necessary information from them as features, and maps device information in advance A method has been proposed in which device information closest to a dictionary is estimated as device information of home appliances (see Non-Patent Document 1, for example).

Sawako Sato, Ryuji Yanada, Hiroyuki Maedo, “Examination of Device Identification Method in Home Network”, IEICE Technical Report, ICM, Information Communication Management: IEICE technical report 110 (466), 87-92, 2011-03 -03

  In the prior art, when device identification is executed, the feature amount for each model of the dictionary registered in advance is compared with the feature amount of the identified device one by one. However, when the number of registered models increases and the dictionary becomes large, there is a problem that the number of models to be compared increases and the identification time becomes very long.

  In addition, a sufficient number of features is necessary for identification from other models, but when the number of feature groups registered in the dictionary increases, the number of features to be compared also increases, so the identification time is further increased. . When used in a remote support service or the like, it is desired to respond in a short time, and depending on the usage scene, it may be necessary to activate and execute the device identification function as necessary. In such a situation, when the identification time becomes long, there is a problem that a wasteful waiting time of the remote support operator / user occurs.

  Thus, one embodiment of the present invention has been made in view of the above problem, and an object thereof is to enable device identification in a shorter time.

(1) The present invention has been made in view of the above circumstances, and one aspect of the present invention is based on a predetermined vectorization rule according to the property of the feature amount of the device for the device to be compared and the device to be identified. The qualitative feature quantity and the quantitative feature quantity included in the feature quantity are included in a plurality of numeric values determined for each feature quantity under the condition that the number of possible numeric values is determined in advance. A feature vector generating unit that generates a feature vector having each converted numeric value as an element, a feature vector of a comparison target device generated by the feature vector generation unit, and an identification target device An apparatus identification apparatus comprising: an identification unit configured to identify the identification target apparatus with reference to a feature vector.

(2) In the device identification apparatus described above, according to one aspect of the present invention, when the feature vector generation unit is an important feature amount, the important feature amount is converted by the feature vector generation unit. After that, a predetermined number of important feature values are inserted into the generated feature vector.

(3) In the device identification apparatus described above, one aspect of the present invention is a group division that divides a plurality of devices into a plurality of groups based on a feature vector of a comparison target device generated by the feature vector generation unit. And the identification means identifies all the devices included in the same group by excluding from the comparison target a feature quantity having a common feature vector element, and identifying the identification target device. Features.

(4) In the device identification device described above, one aspect of the present invention is a representative vector determining unit that determines a representative vector for each group divided by the group dividing unit, and the feature vector generating unit generates the representative vector Similar group extraction means for extracting a plurality of groups by comparing a feature vector of a device to be identified with a representative vector for each group, and the identification means includes a plurality of extracted by the similar group extraction means The identification target device is identified by comparing a feature vector for each device in the group with a feature vector of the identification target device.

(5) In the device identification apparatus described above, one aspect of the present invention is that, when the number of feature vectors existing in the extracted group is equal to or less than a predetermined number, the similar group extraction unit To complete device identification.

(6) According to one aspect of the present invention, a qualitative feature amount included in the feature amount is based on a predetermined vectorization rule corresponding to the property of the feature amount of the device with respect to the comparison target device and the identification target device. And quantitative feature quantities are converted into one numerical value included in multiple numerical values determined for each feature quantity under the condition that the number of possible numerical values is determined in advance. A feature vector generating means for generating a feature vector having the numerical value of the element, a feature vector of the comparison target device generated by the feature vector generating means and a feature vector of the identification target device An apparatus identification system comprising: identification means for identifying an apparatus.

(7) In the device identification system described above, one aspect of the present invention is the device identification system described above including a device information dictionary server device and a device identification device, and the device information dictionary server device includes: A device information storage unit for storing a feature amount of the device, wherein the device identification device includes the feature vector generation unit and the identification unit, and the feature vector generation unit receives the device information from the device information dictionary server device. A feature amount is acquired.

(8) According to one aspect of the present invention, the feature vector generation unit adds the feature amount to the feature amount based on a predetermined vectorization rule corresponding to the property of the feature amount of the device for the comparison target device and the identification target device. Convert each qualitative feature quantity and quantitative feature quantity into one numeric value included in multiple numeric values determined for each feature quantity under the condition that the number of possible numeric values is predetermined. Then, a procedure for generating a feature vector having each converted numerical value as an element, and the identification unit refer to the feature vector of the comparison target device and the feature vector of the identification target device generated by the feature vector generation unit. And a procedure for identifying the device to be identified.

(9) According to one aspect of the present invention, the device identification device includes the comparison target device and the identification target device in the feature amount based on a predetermined vectorization rule corresponding to the property of the device feature amount. Each of the qualitative feature quantity and the quantitative feature quantity is converted into one numerical value included in a plurality of numerical values determined for each feature quantity under the condition that the number of possible numerical values is predetermined. A feature vector generation step for generating a feature vector having each converted numerical value as an element, and a feature vector of a comparison target device and a feature vector of an identification target device generated by the feature vector generation step. And an identification step for identifying the device to be identified.

  According to one aspect of the present invention, device identification can be performed in a shorter time.

It is a block diagram which shows the structure of the apparatus identification system by embodiment of this invention. It is a block diagram which shows a structure when the apparatus information dictionary is included in the apparatus identification apparatus by this embodiment. It is a conceptual diagram which shows the data structural example in the feature storage DB by this embodiment, apparatus information DB, terminal information DB, and cluster DB. It is a flowchart for demonstrating the whole operation | movement in the dictionary preparation stage of the apparatus identification device by this embodiment. It is a flowchart for demonstrating operation | movement of the dictionary analysis function by this embodiment. It is a flowchart for demonstrating operation | movement of the dictionary analysis function by this embodiment. It is a conceptual diagram for demonstrating the vectorization rule in the feature vector conversion function by this embodiment. In this embodiment, it is a conceptual diagram which illustrates a part of what binarized all the feature-values based on the vectorization rule. In this embodiment, it is a conceptual diagram for demonstrating the distance between feature vectors. It is a flowchart for demonstrating the distance calculation procedure between nodes by this embodiment. It is a flowchart for demonstrating the distance calculation method between vectors by this embodiment. It is a conceptual diagram which shows the dendrogram (dendrogram) of the result of having implemented the clustering by this embodiment. It is a conceptual diagram which illustrates the vector in the same group by this embodiment. It is a flowchart for demonstrating the whole operation | movement in the apparatus identification stage of the apparatus identification apparatus by this embodiment. It is a flowchart for demonstrating operation | movement of the apparatus identification range extraction function in step Se4 of FIG.

  In the device identification system according to the present embodiment, the number of devices to be compared and the number of features to be compared are extracted from the registered dictionary by extracting a device range most similar to the device identified at the time of device identification. Both are minimized, and the identification speed is increased while ensuring accuracy even when the dictionary becomes large.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

  FIG. 1 is a block diagram showing a configuration of a device identification system according to an embodiment of the present invention. 1, the device identification system 1 includes a device information dictionary server device 10, a device identification device 11, and network home appliances 12-1 to 12-5 connected to the device identification device 11 via a LAN (Local Area Network). The device information dictionary server device 10 and the device identification device 11 are connected via a wide area network (WAN) 13. The device information dictionary server device 10 manages the device information dictionary, and extracts and returns device information having information closest to the feature group received from the device identification device 11 in response to a request from each device identification device 11. . However, in the present embodiment, a case in which a device information dictionary is included in the device identification apparatus 11 is allowed, and in this case, the device information dictionary server apparatus 10 is not necessary.

  The device identification device 11 detects the network home appliances 12-1 to 12-5 connected in the LAN, the response packet of the command transmission result of each network home appliance 12-1 to 12-5, and the network home appliance 12- The passive packet transmitted from 1 to 12-5 is received, and necessary information is stored as a feature. In addition, the device identification device 11 compares the accumulated feature group with the device information dictionary, and acquires and displays the closest device information. When the device information dictionary exists on the WAN 13, the device information dictionary server device 10 is requested to perform device identification together with the feature group, and the result is received from the device information dictionary server device 10.

  FIG. 2 is a block diagram illustrating a configuration when a device information dictionary is included in the device identification apparatus 11 according to the present embodiment. 2, the device identification apparatus 11 includes a capture bundle 111, a protocol feature analysis bundle 112, an active measurement bundle 113, a DB access bundle 114, a device identification bundle 115, a Web UI bundle 116, a feature accumulation determination bundle 117, a cluster analysis bundle 118, A device cluster extraction bundle 119, an OSGiFW (Open Services Gateway Initiative Frame Work) 120, a feature storage DB 121, a device information DB 122, a terminal information DB 123, and a cluster DB 124 are provided. Here, a plurality of protocol feature analysis bundles 112 exist for each protocol. There are also a plurality of active measurement bundles 113 for each protocol.

  The capture bundle 111 captures packets transmitted by the network home appliances 12-1 to 12-5 connected to the same network, identifies the corresponding protocol, and takes over the information to the corresponding protocol feature analysis bundle 112. The protocol feature analysis bundle 112 performs analysis for each protocol, extracts features necessary for device identification, and takes over DB registration to the DB access bundle 114. Examples of the protocol to be analyzed include TCP (Transmission Control Protocol) analysis, SSL (Secure Socket Layer) analysis, and WOL (Wake On LAN) analysis.

  The active measurement bundle 113 transmits a command to the network home appliances 12-1 to 12-5 connected to the same network, extracts features from the response result, and takes over registration to the DB access bundle 114. As a specific example, an arping command is transmitted, a device is detected from the response status, and the TCP port open / close status of the corresponding model is confirmed from the detected information. The DB access bundle 114 registers the inherited information in a specified table. The DB access bundle 114 extracts data from the feature storage DB 121, device information DB 122, terminal information DB 123, and cluster DB 124 under specified conditions.

  The device identification bundle 115 is a function required when a device information dictionary is included in the device identification apparatus 11. The device identification bundle 115 includes one type of feature group received from the Web UI bundle 116 and features registered in the device information dictionary that matches the candidate portion of the device information notified from the device cluster extraction bundle 119. The comparison is made except for the features registered in the all-match vector item ID, and the model information having the closest features is extracted and returned.

  The Web UI bundle 116 creates and displays a device list screen and a dictionary registration screen as a Web server. On the device list screen, device information is output for each MAC (Media Access Control) address. The Web UI bundle 116 may extract device information from the feature storage DB 121, and may manage devices detected by providing a device information table. The device information includes a dictionary registration button and a device identification button for each MAC address. When the dictionary registration button is pressed, a device information registration screen is displayed, and when the device identification button is pressed, feature accumulation is performed. The feature having the corresponding MAC address is extracted from the DB 121 and notified to the device identification bundle 115, and the result is obtained and displayed. In the case of a system configuration having the device information dictionary server device 10, since the device identification function is in the device information dictionary server device 10, the extracted corresponding MAC address group is transmitted to the device information dictionary server device 10 and the result is received. To do.

  On the dictionary registration screen, the feature having the corresponding MAC address is extracted from the feature storage DB 121. The extracted feature group may or may not be displayed on the screen. Further, an input area for model information (for example, category, manufacturer name, product name, model name, etc.) and a registration button / cancel button for the model having the corresponding MAC address are displayed. When the registration button is pressed, the feature group and model information are registered in the device information DB 122. In the case of a system configuration having the device information dictionary server device 10, the feature group and model information are notified to the device information dictionary server device 10.

  The feature accumulation determination bundle 117 periodically monitors the feature extraction status that has been detected, and determines whether an amount sufficient to execute dictionary registration / device identification is accumulated. The cluster analysis bundle 118 creates device feature vectors using the information in the device information DB 122 and registers them in the cluster DB 124. The cluster analysis bundle 118 executes a cluster analysis algorithm based on the registered feature vector, and registers the execution result in the cluster DB 124. The device cluster extraction bundle 119 uses the information in the cluster DB 124 to determine a candidate group to be subjected to the device identification algorithm and notifies the device identification bundle 115 of the candidate group.

  The feature storage DB 121 stores parameter / value data using a feature extraction / storage function. The device information DB 122 includes a model number table and a detailed data table, and accumulates learned device information. The terminal information DB 123 registers the detection status of devices connected to the network NW and the device identification result. The cluster DB 124 includes a model number cluster table, a vector value table, a vector name table, a cluster information table, and a match vector item table, and registers the result information of the dictionary analysis function of the cluster analysis bundle 118.

  FIG. 3 is a conceptual diagram illustrating a data configuration example in the feature accumulation DB 121, the device information DB 122, the terminal information DB 123, and the cluster DB 124 according to the present embodiment. In FIG. 3, the feature storage DB 121 stores parameter / value data using a feature extraction / storage function. The feature storage DB 121 includes a feature storage table 121a including a MAC address, an IP address, a feature name, a feature value, and a recording date. The device information DB 122 accumulates learned device information, and includes a dictionary creation device ID, learning ID, category, manufacturer name, device name, model number, comment, learning date and time, a model number table 122a, a dictionary creation device ID, and a learning ID. And a detailed table 122b made up of feature names and feature values.

  The terminal information DB 123 registers the detection status of devices connected to the network NW and the device identification result. The terminal information DB 123 includes a terminal information table 123a including a terminal ID, a MAC address, an IP address, a connection state, and an accumulation state, and a designation information table 123b including a terminal ID, a point, a category, a manufacturer name, a model name, a model number, and a comment. It has.

  Further, the cluster DB 124 registers the result information of the dictionary analysis function. The cluster DB 124 includes a model number cluster table 124a, a vector value table 124b, a vector name table 124c, a cluster information table 124d, and a match vector item table 124e. The model number cluster table 124a includes a vector ID, a dictionary creation device ID, a learning ID, and a cluster ID. The vector value table 124b includes a vector ID, a vector item ID, and a vector value.

  The vector name table 124c includes a vector item ID, a vector item name, a variable property flag, and an analysis target flag. The cluster information table 124d includes a cluster ID, a representative vector ID, a vector ID, and a cluster analysis date / time. The match vector item table 124e includes a cluster ID and an all match vector item ID.

Next, the operation of the device identification apparatus 11 according to the present embodiment will be described.
The operation of the device identification apparatus 11 according to the present embodiment is roughly divided into two steps: (a) dictionary creation stage, and (b) device identification stage. Each is explained in detail below

(A) Dictionary Creation Stage FIG. 4 is a flowchart for explaining the overall operation in the dictionary creation stage of the device identification apparatus 11 according to the present embodiment. In the dictionary creation stage, response packets and passive packets as a result of sending commands to the network home appliances 12-1 to 12-5 connected to the network NW are received and necessary information is stored as features. This is a process for creating a device information dictionary and performing a dictionary analysis function on the created dictionary to group device information. The difference from the prior art is the “dictionary analysis function” portion of steps Sa5 to Sa7 surrounded by a broken line in the flowchart shown in FIG.

  First, the protocol feature analysis bundle 112 and the active measurement bundle 113 are packets sent by network home appliances A, B, C,... Connected to the network NW (response packets as a result of sending commands to home appliances, and Passive packet) is received, and necessary information is analyzed as a feature (step Sa1). Next, the DB access bundle 114 is registered as a feature in the feature storage DB 121 (step Sa2).

  Next, the Web UI bundle 116 reads out the feature data of the device to be registered in the dictionary from the feature storage DB 121 and displays it (step Sa3). Then, the device data and the input data (model number input by the user) are mapped and registered as dictionary data in the device information DB 122 (step Sa4).

  Next, the cluster analysis bundle 118 acquires the dictionary data of the device from the device information DB 122, replaces it with an n-dimensional space binary vector (step Sa5; feature vector creation function), and performs cluster analysis to identify the device. The data is divided into groups (step Sa6; cluster analysis function), a representative vector for each device group is determined, and stored in the cluster DB 124. Then, the cluster analysis bundle 118 analyzes and registers in the cluster DB 124 what the feature values match based on the vector values in the group and the nature of the values that can be taken for each feature amount (step Sa7; representative vector selection) function). More specifically, for example, the cluster analysis bundle 118 flags those whose feature values clearly match based on the vector values in the group and the nature of the values that can be taken for each feature amount. Here, for all the matched vector items in which the vector values match in all the devices in the group, the feature values before vector conversion clearly match in all the devices in the group only by looking at the vector values.

<Dictionary analysis function>
In the flowchart shown in FIG. 4 described above, the dictionary analysis function (steps Sa5 to Sa7) surrounded by a broken line is a function for grouping device information, (1) a feature vector creation function, (2) a cluster analysis function, ( 3) A representative vector determination function is provided.

  5 and 6 are flowcharts for explaining the operation of the dictionary analysis function according to the present embodiment.

(1) Feature Vector Creation Function The feature vector creation function is a function that reads feature quantities registered in the dictionary, converts them into 0 or 1 vector values, and registers them in the cluster DB 124.

  First, the cluster analysis bundle 118 acquires all information from the detailed table 122b (step Sb1). Specifically, the cluster analysis bundle 118 reads all feature quantities from the device information DB 122. Next, a feature vector conversion function is executed in which the feature values of all model names are converted into 0 or 1 vector values and registered in the model number cluster table 124a, vector value table 124b, and vector name table 124c (step Sb2). . Next, as an example, the cluster analysis bundle 118 adds a variable property flag to a vector item converted from a qualitative feature and a feature that takes only two values (eg, TCP_PORT_XX) (step Sb3). The cluster analysis bundle 118 selects not only the qualitative features but also all the features including the qualitative features and the quantitative features, and particularly selects an item to be analyzed, and assigns a variable property flag to the selected item. May be. The cluster analysis bundle 118 adds a flag to the analysis target vector item (step Sb4). The analysis target vector item may be specified in the initial file.

Here, the feature vector conversion function described above will be described in detail.
In the feature vector conversion function, after dividing into three types based on the property of the value that can be taken for each feature amount, each element takes a binary value of 0 or 1 according to different vectorization rules depending on the feature amount property. Replace with possible vectors. Specifically, the feature amount is roughly divided into two, a qualitative feature amount and a quantitative feature amount, according to the property, and the qualitative feature amount is further divided into two. Here, the qualitative feature quantity is a feature quantity that classifies qualitative differences, and the quantitative feature quantity is a feature quantity that classifies quantitative differences. Each vectorization rule will be described with reference to FIG.

  FIG. 7 is a conceptual diagram for explaining a vectorization rule in the feature vector conversion function according to the present embodiment. Here, the feature name is the name of the feature amount. The qualitative feature name is a name of a qualitative feature quantity having a qualitative variable representing a qualitative difference as a feature value. The qualitative feature value can distinguish data, but the magnitude of the numerical value itself has no meaning. The qualitative feature amount is divided into a feature that takes one of two values (a feature name “1” shown in FIG. 7) and another feature (a feature name “2” shown in FIG. 7).

  For example, since the feature name “TCP_PORT_XX” takes only OPEN or CLOSE, in this case, one is converted into a binary value of a vector value “1” and the other is a vector value “0”. For other qualitative feature names, if the feature can be acquired, the vector value “1” regardless of the acquired value, and if the feature cannot be acquired, the vector value “0”. And converted to binary.

  The quantitative feature name is a name of a quantitative feature amount having a quantitative variable representing a quantitative difference as a feature value. The quantitative feature amount is a feature amount having a significance in the magnitude of the feature value (feature name “3” shown in FIG. 7). The quantitative feature amount is also converted into a binary vector so that it can be handled in the same manner as the qualitative feature amount. For example, assume that the value of a certain quantitative feature value is large, medium, or small. In that case, it is expanded into a vector having three items, and can be converted into large (1, 0, 0), medium (0, 1, 0), and small (0, 0, 1). However, when two of the three items have a vector value of 0, the rest always takes “1”, and therefore is represented by a vector value having two items. In other words, it may be converted into large (1, 1), medium (0, 1), and small (0, 0). In this case, the distance between (large and medium) is the same as the distance between (medium and small), and the distance between (large and small) is two of them.

If this expression method is used, it is possible to give a difference due to the magnitude of the quantitative feature quantity as information while converting the quantitative feature quantity into a binary vector. Furthermore, when converted into a vector having the same number of items as the number of feature values, each becomes an independent feature item. However, the vector has two items with one degree of freedom reduced. When converted, the relationship between the quantitative feature values can be expressed as a distance. Here, the number of quantitative feature values has been described as “3”. However, as in the example described in the feature name “3” shown in FIG. 7, one of large, medium, small, and none is used. If any one of these four values is used, or if the number of variables is more than that, the same conversion can be performed.
By vectorizing in this way, it is possible to deal with the case where features with various characteristics increase in the future.

In the present embodiment, as an example, the cluster analysis bundle 118 converts the qualitative feature quantity and the quantitative feature quantity each into a vector value having a binary value (0 or 1). It is not a thing. The cluster analysis bundle 118 may convert each of the qualitative feature quantity and the quantitative feature quantity into three or more numbers. In this case, the number of values that can be taken by the conversion destination numerical value may be the same, and the possible values may be common. For example, the cluster analysis bundle 118 converts the qualitative feature quantity into either 0, 1 or 2, and the quantitative feature quantity is a vector value (for example, (2, 1, 2) that 0, 1 or 2 can take as an element. 0) etc.).
Further, the number of values that can be taken by the numerical value of the conversion destination may be the same, and the values that can be taken may be different. For example, the cluster analysis bundle 118 converts the qualitative feature quantity into -1, 0, or 1, and the quantitative feature quantity is a vector value (for example, (2, 1) that can be taken as an element of 0, 1 or 2. , 0), etc.).
Therefore, the cluster analysis bundle 118 has a plurality of numerical values determined for each feature amount under the condition that the number of numerical values that can be taken as the qualitative feature amount and the quantitative feature amount is determined in advance. It may be converted into one numerical value included in.

FIG. 8 is a conceptual diagram illustrating a part of a binary vector obtained by converting all feature quantities into a binary vector based on the vectorization rule in this embodiment. In the example of FIG. 8, for the device “PC A”, the vector value is “0” for the feature quantity “TCP_PORT_20”, the vector value is “1” for the feature quantity “TCP_OPT_2”, and the feature quantity is “DHCP_OPT_8”. On the other hand, it is indicated that the vector value is “1” and the vector value is “0” for the feature quantity “IPv6 DISTERDER”. That is, the feature vector of the device “PC A” is (0, 1, 1, 0,...).
Similarly, for the device “Printer B”, the vector value is “0” for the feature quantity “TCP_PORT_20”, the vector value is “1” for the feature quantity “TCP_OPT_2”, and the vector is “vector” for the feature quantity “DHCP_OPT_8”. It is indicated that the value is “0” and the vector value is “0” with respect to the feature amount “IPv6 DISTERDER”. That is, the feature vector of the device “Printer B” is (0, 1, 0, 0,...).

Similarly, for the device “TV C”, the vector value is “0” for the feature value “TCP_PORT_20”, the vector value is “0” for the feature value “TCP_OPT_2”, and the vector is “vector” for the feature value “DHCP_OPT_8”. It is indicated that the value is “1” and the vector value is “0” with respect to the feature amount “IPv6 DISTERDER”. That is, the feature vector of the device “TV C” is (0, 0, 1, 0,...).
Similarly, for the device “TV D”, the vector value is “1” for the feature quantity “TCP_PORT_20”, the vector value is “0” for the feature quantity “TCP_OPT_2”, and the vector is “vector” for the feature quantity “DHCP_OPT_8”. It is indicated that the value is “1” and the vector value is “0” with respect to the feature amount “IPv6 DISTERDER”. That is, the feature vector of the device “TV D” is (1, 0, 1, 0,...).

  Further, in the example shown in FIG. 8, for example, when a certain feature quantity is an important feature quantity, before performing cluster analysis, the cluster analysis bundle 118 has a predetermined number of feature quantities (for example, three times). ) May be inserted into the same column as a feature vector. If the same column is inserted three times and the feature values have different values, the distance between the different feature values is calculated three times, so the distance increases by 3 × distance. For this reason, if the feature quantity is different between the device to be identified and the device to be compared, the distance between the feature vector of the device to be identified and the feature vector of the device to be compared is increased. , It becomes difficult to be identified by the device name. As described above, the cluster analysis bundle 118 serving as the feature vector generation unit, when a certain feature amount is an important feature amount, uses the numerical value after the important feature amount is converted by the feature vector generation unit as an important feature amount. A predetermined number may be inserted into the generated feature vector.

(2) Cluster analysis function The cluster analysis function is a function for grouping feature vectors obtained by converting feature quantities into 0/1 vector values using a cluster analysis algorithm. In the cluster analysis algorithm, the distance between feature vectors is defined, the distance between all feature vectors is calculated, and all feature vectors are combined in order from one closest to a cluster. The process can be expressed by dendrogram. By cutting this dendrogram at an appropriate height, individual objects are classified into categories.

  In FIG. 5, the cluster analysis bundle 118 repeats steps Sb6 to Sb8 described below until all vector IDs are included in one node in step Sb5. First, the cluster analysis bundle 118 calculates an inter-node distance (step Sb6), extracts a node pair having the minimum distance (step Sb7), and sets a vector included in the node pair having the minimum distance as a new node. Register in the node table (see FIG. 5) (step Sb8). Details of the procedure for calculating the distance between nodes will be described later.

  Next, the cluster analysis bundle 118 extracts nodes whose coupling distance is shorter than the threshold (step Sb9), sets all the vectors included under the extracted nodes as the same cluster ID, the model number cluster table 124a, the cluster Register in the information table 124d (step Sb10).

FIG. 9 is a conceptual diagram for explaining the distance between feature vectors in the present embodiment. There are various definitions for the distance between feature vectors, and they can be freely set as appropriate. For example, a distance D _αβ between two feature vectors α and β is defined as shown in FIG. The definition of the distance between vectors may be described in a setting file or may be fixed in the logic.

A cluster including a plurality of feature vectors is defined as a node. There are various methods for calculating the distance between nodes including a plurality of vectors, and they can be freely set as appropriate. For example, when the group average method is used, the average value of distances of combinations of vectors included in both nodes is obtained. In addition, for example, when the longest distance method is used, the distance between two nodes is the farthest vector distance among the combinations of vectors included in both nodes. For example, when the shortest distance method is used, the distance between two nodes is set to the closest inter-vector distance among the combinations of vectors included in both nodes. The method for calculating the distance between nodes including a plurality of vectors is not limited to these, and the distance between nodes may be calculated using other methods such as the Ward method and the center of gravity method.
The definition of the distance between nodes may be described in a configuration file or may be fixed in the logic.

Next, the calculation of the distance between nodes when the distance between nodes is a group average method and the distance between vectors is defined as shown in FIG. 9 will be described.
FIG. 10 is a flowchart for explaining the inter-node distance calculation procedure according to this embodiment. First, the cluster analysis bundle 118 selects two nodes that perform distance calculation (step Sc1). Note that the vector is regarded as a single node. Next, in step Sc2, the cluster analysis bundle 118 sequentially sets all vector IDs included in the node. Next, the cluster analysis bundle 118 repeats the distance calculation between the vectors (step Sc3) until the vector ID is completed. Details of the distance calculation procedure between vectors will be described later. Thereafter, the cluster analysis bundle 118 calculates an average value of the inter-vector distances as the inter-node distances (Step Sc4). As for the distance between nodes, it is possible to specify a distance calculation formula in the initial file.

  FIG. 11 is a flowchart for explaining the inter-vector distance calculation procedure according to this embodiment. First, the cluster analysis bundle 118 extracts two vectors α and β for distance calculation from the cluster DB 124 (step Sd1), and sequentially sets vector item IDs in step Sd2. Next, the cluster analysis bundle 118 repeats steps Sd3 to Sd10 described later until the vector item ID is completed.

  First, the cluster analysis bundle 118 determines whether or not both vector items are “1” (step Sd3). If both vector items are “1” (YES in step Sd3), the number of elements is set to a. “1” is added (step Sd4). On the other hand, when both the vector items are not “1” (NO in step Sd3), the cluster analysis bundle 118 determines whether the vector items are “1” and “0” (step Sd5). When the vector items are “1” and “0” (YES in step Sd5), the cluster analysis bundle 118 adds “1” to the number of elements b (step Sd6). On the other hand, when the vector item is not “1” or “0” (NO in step Sd5), the cluster analysis bundle 118 determines whether the vector item is “0” or “1” (step Sd7). .

When the vector items are “0” and “1” (YES in step Sd7), the cluster analysis bundle 118 adds “1” to the number of elements c (step Sd8). On the other hand, if the vector item is not “0” or “1” (NO in step Sd7), the cluster analysis bundle 118 determines whether both the vector items are “0” (step Sd9). If the vector items are both “0” (YES in step Sd9), the cluster analysis bundle 118 adds “1” to the number of elements d (step Sd10). Thereafter, the cluster analysis bundle 118 repeats the above steps Sd3 to Sd10 until the vector item ID ends. When Steps Sd3 to Sd10 are completed, the cluster analysis bundle 118 calculates the distance D _αβ between the two feature vectors α and β using the element numbers a, b, c, and d (Step Sd11). The distance between vectors may be specified by a distance calculation formula in the initial file.

  FIG. 12 is a conceptual diagram showing a dendrogram (a tree diagram) as a result of performing clustering according to the present embodiment. In FIG. 12, the number of divided groups varies depending on the cutting height of the dendrogram. When the cutting distance is set low, it is divided into a large number of clusters including a small number of vectors in one cluster, and when it is set high, it is divided into a small number of clusters including a large number of vectors in one cluster. When the cutting distance is set to 0.0, each cluster includes only the same vector. For this reason, if a vector is calculated for an object to be newly identified, it can be determined in which cluster it is included, so that the speed of device identification is the fastest.

  Regarding how to divide the cluster, you can determine the cutting height by specifying the number of devices included in the group and other conditions by looking at the clustering result, and set the height in the configuration file in advance. May be specified.

(3) Representative Vector Selection Function Next, returning to the flowchart of FIG. 6, the processing of the representative vector selection function will be described. As a result of cutting the dendrogram, a group divided into a plurality of clusters is created. One representative point of each group is determined and used as a representative vector. The representative vector is a vector having the smallest error when the vector in the cluster is replaced with the representative vector, and an appropriate one can be arbitrarily set. For example, the point where the sum of the distances of the vectors in the cluster is minimized may be defined as the representative vector. In that case, a representative vector having the smallest sum of distances between the coordinates indicated by the representative vector and the coordinates of each point included in the target cluster may be obtained.

  In addition, when the cutting distance is set sufficiently low after the above-described (2) cluster analysis function, since only one identical vector exists in one group, the representative vector is the same as all the vectors in the group. It is good also as a representative vector. The definition of the representative vector may be described in a setting file or may be fixed in the logic.

  Conventionally, the representative vector has not been determined by binary grouping. Therefore, when determining a representative vector by binary grouping, as described above, obtaining a representative vector having the smallest sum of distances is one of the features of the processing in this embodiment.

  In FIG. 6, in step Sb11, the cluster analysis bundle 118 repeats steps Sb12 to Sb18 for each cluster ID until the cluster ID is completed. First, the cluster analysis bundle 118 acquires all information in the vector value table 124b (step Sb12), and sequentially sets cluster IDs in step Sb13. Next, the cluster analysis bundle 118 repeats steps Sb14 and Sb15 until the cluster ID ends.

  First, the cluster analysis bundle 118 calculates the inter-vector distance from all vectors (step Sb14), and calculates the sum of the inter-vector distances (step Sb15). Next, the cluster analysis bundle 118 extracts a vector ID that minimizes the sum of distances, and registers it as a representative vector ID in the cluster information table 124d (step Sb17). Next, for all vector IDs, the cluster analysis bundle 118 has a vector item ID whose variable property flag is “1” and whose vector value is “0” or “1”, and the vector item ID. A vector item ID having a variable property flag of “0” and a vector value of “0” is extracted and registered in the match vector item table 124e (step Sb18).

  Similar vectors are aggregated in the same group. Vector items that have zero values in all the vectors in the same group can be excluded from comparison targets at the time of device identification because they match because there is no feature in the group. Furthermore, for a vector item corresponding to a qualitative feature name, which always takes one of the two values, for example, an item created from TCP_PORT_xx, if all vectors have the value “1”, the feature value is Since all the OPENs are taken, since the features match, it is possible to exclude them from the comparison targets for device identification. For this reason, even when the number of devices in the same group increases, it is possible to omit the feature to be compared when comparing the identified devices, so that the speed of the identification process can be realized.

  FIG. 13 is a conceptual diagram illustrating vectors in the same group according to this embodiment. In this example, there are five feature amounts from α to ε, the variable property flags of α, β, and δ are 1, and the feature amount β matches with “0” in the feature vectors of all devices. The quantity δ is a feature vector of all devices and is equal to “1”. In addition, the variable property flags of γ and ε are 0, and the feature value ε is “0” for all the device vectors. β, δ, and ε are all matched items in the feature vectors of all devices, and the feature values before vector conversion also match, so there is no effect on the identification accuracy even if they are excluded from the comparison target, only α and γ Only the feature value of suffices to be compared at the time of device identification.

(B) Device Identification Stage FIG. 14 is a flowchart for explaining the overall operation in the device identification stage of the device identification apparatus 11 according to the present embodiment. The device identification stage receives response packets and passive packets as a result of sending commands to home appliances connected to the network NW, accumulates necessary information from them as features, and grouped device information This is a process of extracting the nearest device information group from the dictionary and estimating the nearest device information from the device information group as the device information of the home appliance. The difference from the prior art is the “equipment identification range extraction function” portion of step Se4 surrounded by a solid line in the flowchart shown in FIG. Further, Steps Se5 and Se6 surrounded by a broken line in the same figure are processes for comparison without the comparison target items as a result of the analysis by the dictionary analysis function (see FIGS. 5 and 6) described above.

  First, the protocol feature analysis bundle 112 and the active measurement bundle 113 receive a packet (a response packet and a passive packet as a result of transmitting a command to the home appliance) transmitted from the device X of the network NW, and from among the packets Necessary information is analyzed as a feature (step Se1). Next, the DB access bundle 114 is registered as a feature in the feature storage DB 121 (step Se2).

  Next, when the device identification by the user is executed, the Web UI bundle 116 extracts the feature data of the device X from the feature storage DB 121 (step Se3). Next, the device cluster extraction bundle 119 creates a feature vector of the device X, compares the device X with a representative vector (cluster DB 124) for each cluster, and selects a cluster with the closest distance (step Se4; device identification). Range extraction function). Details of this processing will be described later.

  Next, the device identification bundle 115 acquires device data in the selected cluster (step Se5). Next, the device identification bundle 115 compares items of individual device data in the selected cluster other than items whose values match in all devices in the cluster. At that time, the device identification bundle 115 identifies the feature values before vector conversion for the vector items excluding the matching vector items in which the vector items match between the device to be identified and the device to be compared for each device data. Compare between the target device and the target device. Then, the device identification bundle 115 calculates the sum of different feature values × weights as a distance (step Se6). In this way, by removing the feature quantities common to all devices included in the cluster from the comparison targets, the number of feature quantities to be compared can be reduced, thus affecting the identification accuracy. Thus, the identification speed can be improved.

  For example, in the example shown in FIG. 13, assuming that the feature amounts α to ε of the device X are all “1”, when the device X is compared with the TV E, the device identification bundle 115 has values for all the devices in the cluster. Comparison is made with feature quantities α and γ, excluding feature quantities β, δ, and ε, which are matching items. In this example, α has different vector values between “0” and “1”, so it is not necessary to compare feature values before vector conversion, and it can be seen that the feature values are different, and γ has vector values “1” and “1”. Therefore, the feature values before vector conversion are compared. The device identification bundle 115 calculates the sum of different feature values × weights as a distance.

  Then, the device identification bundle 115 estimates that the device A is the closest to the device X (step Se7), displays the device A, and registers it in the terminal information DB 123 (step Se8).

<Device identification range extraction function>
The device identification range extraction function is a function of comparing a representative vector with a vector of an identification target device and extracting a similar group. An example in which the identified terminal and each representative vector are compared and a similar group is notified to the device identification bundle 115 is shown below. The group to be notified as a similar group notifies one of the shortest distances from the representative vector, but if there are two or more of the shortest, notify the two or more of them. Further, as a result of comparing the representative vector and the vector of the identified terminal, when the shortest distance and the distance after the next are sufficiently close, it may be appropriately defined such that two or more of them are notified as similar groups.

  FIG. 15 is a flowchart for explaining the operation of the device identification range extraction function in step Se4 of FIG. First, the Web UI bundle 116 acquires feature information to be identified (step Sf1), and the device cluster extraction bundle 119 converts the feature value of the feature name into a 0/1 vector value (step Sf2). Next, the device cluster extraction bundle 119 acquires all the representative vectors from the cluster information table 124d (step Sf3), and sets only the vector items common to the device to be identified and the representative vector as analysis targets (step Sf4).

  Next, in step Sf5, the device cluster extraction bundle 119 calculates the distance between the feature vector of the device to be identified and the representative vector until the end of the representative vector (step Sf6). Details of the calculation of the inter-vector distance are the same as those in the flowchart of FIG. Next, the device cluster extraction bundle 119 determines a representative vector ID that minimizes the distance (step Sf7). If there are a plurality of items having the smallest distance, the device cluster extraction bundle 119 determines a plurality of vector IDs.

  Next, the device cluster extraction bundle 119 acquires the cluster ID from the cluster information table 124d (step Sf8). It is possible to select not only the representative vector that minimizes the distance, but also several such as the second in descending order. Next, the device cluster extraction bundle 119 determines whether or not the total number of vector IDs included in the acquired cluster ID is “1” or less than a specified number (step Sf9).

  If the total number of vector IDs included in the acquired cluster ID is 1 or less than the specified number (YES in step Sf9), the device cluster extraction bundle 119 ends the process. If the number of vector IDs present in the group extracted as a similar group is one or less than the specified number, the device cluster extraction bundle 119 can complete device identification only by the device identification range extraction function. In that case, the device cluster extraction bundle 119 does not need to notify the device identification bundle 115.

  On the other hand, if the total number of vector IDs included in the acquired cluster ID is not one or less than the specified number (NO in step Sf9), the device cluster extraction bundle 119 notifies the device identification bundle 115 of the acquired cluster ID. (Step Sf10), the process ends.

  As described above, in the present embodiment, the bundle included in the device identification device 11 that is a device identification device that identifies the device to be identified based on the feature amount of the device performs the following processing. The cluster analysis bundle 118 serving as a feature vector generation unit is a qualitative element included in the feature amount based on a predetermined vectorization rule corresponding to the property of the feature amount of the device for the comparison target device and the identification target device. Each of the feature quantity and the quantitative feature quantity is converted into a predetermined number of numerical values, and a feature vector having each converted numerical value as an element is generated. The device identification bundle 115 as identification means identifies the identification target device with reference to the feature vector of the comparison target device and the feature vector of the identification target device generated by the feature vector generation unit.

  According to the embodiments described above, grouping devices using both qualitative and quantitative variables provides more features than grouping devices using only qualitative variables or only quantitative variables. Since the devices can be grouped using, similar devices can be grouped in a shorter time and with higher accuracy. In other words, the accuracy when grouping similar devices can be improved, and the time required for grouping can be shortened.

  Moreover, since the accuracy of grouping is improved, the frequency at which the device identification apparatus 11 erroneously selects a group to which a certain device X does not belong can be reduced. Thus, since the precision which selects a group can be improved, as a result, the precision of apparatus identification can be improved.

  According to the above-described embodiment, the device identification apparatus 11 represents both the qualitative variable and the quantitative variable by binary vectors, so that the qualitative variable and the quantitative variable can be handled in the same manner, thereby simplifying the processing. And the processing speed can be improved. In addition, the device identification device 11 can group the dictionary information in advance by binarization vectorization and clustering and extract a group similar to the identified terminal, thereby minimizing the comparison target terminal. The processing speed can be increased while maintaining the accuracy.

  Further, according to the above-described embodiment, the cluster analysis bundle 118 as the group dividing unit divides a plurality of devices into a plurality of groups based on the feature vector of the comparison target device generated by the feature vector generating unit. The device identification bundle 115 as identification means identifies the device to be identified by excluding from the comparison target the feature quantity in which the elements of the feature vector have a common value in all devices included in the same group. Here, since similar vectors are aggregated in the same group, a feature amount having a value common to all devices in the same group has no feature in the group. From this, it is possible to realize high-speed processing while maintaining high accuracy by excluding from the comparison target feature quantities having values that are common to all devices in the same group.

The cluster analysis bundle 118 serving as a representative vector determining unit determines a representative vector for each group divided by the group dividing unit. The device cluster extraction bundle 119 as a similar group extraction unit extracts a plurality of groups by comparing the feature vector of the device to be identified with the representative vector for each group. The device identification bundle 115 as identification means identifies the device to be identified by comparing the feature vector for each device in the plurality of groups extracted by the device cluster extraction bundle 119 with the feature vector of the device to be identified. To do.
Thereby, for example, even if there are a plurality of groups having the same distance between the feature vector and the representative vector of the device to be identified, the plurality of groups can be extracted. Thereby, since the apparatus contained in the several group mentioned above can be made into a comparison object, identification accuracy can be improved.

  Further, according to the above-described embodiment, the device cluster extraction bundle 119 serving as the similar group extraction unit, when the number of feature vectors existing in the extracted group is equal to or less than a predetermined number, device identification at that time To complete. Thereby, since device identification can be completed only by the device identification range extraction function (step Se4), the processing speed can be increased.

Note that a system including a plurality of devices may process each process of the device identification device 11 of the present embodiment in a distributed manner by the plurality of devices. For example, in the present embodiment, the configuration in the case where the device information dictionary is included in the device identification device 11 is shown, but the present invention is not limited to this, and the device identification device 11 does not include the device information dictionary, The device information dictionary server device 10 may hold a device information dictionary. In this case, the device identification system may have the following configuration, for example. The device information dictionary server apparatus includes a device information DB 122 that holds device feature amounts. The feature vector generation unit of the device identification device 11 acquires the feature amount of the device from the device information dictionary server device 10.
In addition, a program for executing each process of the device identification apparatus 11 of the present embodiment is recorded on a computer-readable recording medium, and the program recorded on the recording medium is read into a computer system and executed. The above-described various processes related to the device identification apparatus 11 may be performed.

  Here, the “computer system” may include an OS and hardware such as peripheral devices. Further, the “computer system” includes a homepage providing environment (or display environment) if a WWW system is used. The “computer-readable recording medium” means a flexible disk, a magneto-optical disk, a ROM, a writable nonvolatile memory such as a flash memory, a portable medium such as a CD-ROM, a hard disk built in a computer system, etc. This is a storage device.

  Further, the “computer-readable recording medium” refers to a volatile memory (for example, DRAM (Dynamic) in a computer system serving as a server or a client when a program is transmitted via a network such as the Internet or a communication line such as a telephone line. Random Access Memory)) that holds a program for a certain period of time is also included. The program may be transmitted from a computer system storing the program in a storage device or the like to another computer system via a transmission medium or by a transmission wave in the transmission medium. Here, the “transmission medium” for transmitting the program refers to a medium having a function of transmitting information, such as a network (communication network) such as the Internet or a communication line (communication line) such as a telephone line. The program may be for realizing a part of the functions described above. Furthermore, what can implement | achieve the function mentioned above in combination with the program already recorded on the computer system, what is called a difference file (difference program) may be sufficient.

  As mentioned above, although embodiment of this invention was explained in full detail with reference to drawings, the concrete structure is not restricted to this embodiment, The design etc. of the range which does not deviate from the summary of this invention are included.

DESCRIPTION OF SYMBOLS 1 Device identification system 10 Device information dictionary server device 11 Device identification device 12 Network home appliance 13 Wide area network 111 Capture bundle 112 Protocol feature analysis bundle 113 Active measurement bundle 114 DB access bundle 115 Device identification bundle 116 WebUI bundle 117 Feature accumulation determination bundle 118 Cluster Analysis bundle 119 Device cluster extraction bundle 120 OSGiFW
121 Feature storage DB
122 Device information DB
123 Terminal information DB
124 Cluster DB

Claims (9)

For the device to be compared and the device to be identified, each of the qualitative feature quantity and the quantitative feature quantity included in the feature quantity can be obtained based on a predetermined vectorization rule according to the property of the feature quantity of the equipment. Converts to one numerical value included in multiple numerical values determined for each feature amount under the condition that the number of numerical values is predetermined, and generates a feature vector with each converted numerical value as an element A feature vector generating means,
An identification unit that identifies the identification target device with reference to the feature vector of the comparison target device generated by the feature vector generation unit and the feature vector of the identification target device;
A device identification apparatus comprising:   The feature vector generation means, when a certain feature quantity is an important feature quantity, the numerical value after the important feature quantity has been converted by the feature vector generation means is a predetermined number for the important feature quantity. The device identification apparatus according to claim 1, wherein the device identification apparatus is inserted into the generated feature vector. A group dividing unit that divides a plurality of devices into a plurality of groups based on a feature vector of a device to be compared generated by the feature vector generating unit;
The identification unit is characterized by excluding a feature quantity having a common value of feature vector elements from all comparison devices in all the devices included in the same group, and identifying the identification target device. Item 1. The device identification apparatus according to Item 1 or 2. Representative vector determining means for determining a representative vector for each group divided by the group dividing means;
Similar group extraction means for extracting a plurality of groups by comparing the feature vector of the device to be identified generated by the feature vector generation means and a representative vector for each group;
With
The identification unit identifies the identification target device by comparing a feature vector for each device in the plurality of groups extracted by the similar group extraction unit with a feature vector of the identification target device. The device identification apparatus according to claim 3, wherein the device identification apparatus is a device.   5. The device identification according to claim 4, wherein when the number of feature vectors existing in the extracted group is equal to or less than a predetermined number, the similar group extraction unit completes device identification at that time. apparatus. For the device to be compared and the device to be identified, each of the qualitative feature quantity and the quantitative feature quantity included in the feature quantity can be obtained based on a predetermined vectorization rule according to the property of the feature quantity of the equipment. Converts to one numerical value included in multiple numerical values determined for each feature amount under the condition that the number of numerical values is predetermined, and generates a feature vector with each converted numerical value as an element A feature vector generating means,
An identification unit that identifies the identification target device with reference to the feature vector of the comparison target device generated by the feature vector generation unit and the feature vector of the identification target device;
A device identification system comprising: The device identification system according to claim 6, comprising a device information dictionary server device and a device identification device,
The device information dictionary server device includes a device information storage unit that holds the feature amount of the device,
The device identification apparatus includes the feature vector generation unit and the identification unit, and the feature vector generation unit acquires the feature amount of the device from the device information dictionary server device. The feature vector generation means includes a qualitative feature quantity and a quantitative feature included in the feature quantity based on a predetermined vectorization rule corresponding to a property of the feature quantity of the equipment for the comparison target device and the identification target device. Each quantity is converted into one numerical value included in multiple numerical values determined for each feature quantity under the condition that the number of possible numerical values is predetermined, and each converted numerical value is an element. A procedure for generating a feature vector
A step of identifying the device to be identified with reference to the feature vector of the device to be compared and the feature vector of the device to be identified generated by the feature vector generating unit;
The apparatus identification method characterized by having. In equipment identification equipment,
For the device to be compared and the device to be identified, each of the qualitative feature quantity and the quantitative feature quantity included in the feature quantity can be obtained based on a predetermined vectorization rule according to the property of the feature quantity of the equipment. Converts to one numerical value included in multiple numerical values determined for each feature amount under the condition that the number of numerical values is predetermined, and generates a feature vector with each converted numerical value as an element Generating a feature vector,
An identification step of identifying the identification target device with reference to the feature vector of the comparison target device generated by the feature vector generation step and the feature vector of the identification target device;
A program for running

Images