WO2023284809A1

WO2023284809A1 - Device identification method, apparatus and system

Info

Publication number: WO2023284809A1
Application number: PCT/CN2022/105623
Authority: WO
Inventors: 徐威旺; 薛莉; 刘文倩; 吴俊�; 张亮
Original assignee: 华为技术有限公司
Priority date: 2021-07-15
Filing date: 2022-07-14
Publication date: 2023-01-19

Abstract

The present application relates to the technical field of communications, and discloses a device identification method, apparatus and system, which are beneficial to the identification of the device type of a terminal device and the reduction of the consumption of network resources for device identification. A network device acquires data stream statistical information of a terminal device, and sends the data stream statistical information of the terminal device to an analyzer when a condition is satisfied, such that the analyzer identifies the device type of the terminal device, the condition comprising: the device type of the terminal device is unknown, or the terminal device is a terminal device that is online again; and the network device selectively sends the data stream statistical information to the analyzer, such that the consumption of network resources in a device identification process is reduced.

Description

Method, device and system for equipment identification

This application claims the priority of the Chinese patent application with the application number 202110798343.7 and the title of the invention "Method, device and system for equipment identification" submitted on July 15, 2021, and the application number submitted on September 02, 2021 The priority of the Chinese patent application 202111024391.7, titled "Method, Device and System for Equipment Identification", the entire contents of which are incorporated in this application by reference.

technical field

The present application relates to the field of communication technologies, and in particular to a method, device and system for device identification.

Background technique

There are a large number of Internet of Things (IoT) devices in industries such as smart parks, education, manufacturing, finance, and medical care. Due to their poor defense capabilities, these IoT devices are easy targets for attackers to launch large-scale distributed denial-of-service attacks (DDoS), and there is also the risk of being maliciously counterfeited to achieve illegal purposes. Identifying IoT devices in the network to determine the device type of the IoT device helps to deploy corresponding security protection policies for different types of IoT devices according to the device type, thereby improving the security of IoT devices in the network.

Contents of the invention

The present application provides a method, device and system for device identification, which help to identify the device type of a terminal device and reduce the consumption of network resources for device identification.

In the first aspect, a device identification method is provided, which is executed by a network device that forwards packets for a terminal device. The network device acquires the data flow statistics information of the terminal device, and when a condition is satisfied, sends the data flow statistics information of the terminal device to the analyzer, so that the analyzer can identify the device type of the terminal device.

Wherein, the condition includes: the device type of the terminal device is unknown, or the terminal device is a terminal device that has come online again.

In this application, when the device type of the terminal device is unknown or the terminal device is a re-online terminal device, the network device sends the data flow statistics information of the terminal device to the analyzer, so that the analyzer can identify the device type of the terminal device, and then A corresponding security protection policy can be implemented for the device type of the terminal device.

Further, if the device type of the terminal device is known and the terminal device is always online, the probability of the device type of the terminal device changing is very small. If the terminal device is a terminal device that has come online again, the device type of the terminal device may have changed. In this application, the network device only sends the data flow statistics information of the terminal device whose device type is unknown or has come back online to the analyzer. This avoids bandwidth consumption by traffic statistics for end devices whose device types are known and are always online. The consumption of network resources by device identification is reduced.

In addition, the analyzer can obtain data flow statistical information of a large number of terminal devices of unknown device types, and obtain a high-precision device identification model based on the data flow statistical information of a large number of terminal devices of unknown device types. This method does not reduce the accuracy of device identification.

Optionally, the network device determines whether the device type of the terminal device is unknown according to the identifier of the terminal device corresponding to the known device type.

For example, an identifier of a terminal device corresponding to a known device type may be stored in the network device. If the identifier of the terminal device corresponding to the known device type does not include the identifier of the terminal device, the network device determines that the device type of the terminal device is unknown.

Optionally, the network device determines whether the device type of the terminal device is unknown according to the asset library.

Wherein, the asset library is used to record the device type and the identifier of the terminal device corresponding to the device type.

If the identifier of the terminal device does not exist in the asset library, the network device determines that the device type of the terminal device is unknown.

Optionally, the network device judges whether the terminal device is a re-online terminal device according to the historical traffic volume of the terminal device.

Optionally, if the traffic volume of the terminal device within the first time window is zero, the terminal device is a terminal device that has come online again.

Optionally, the network device receives a message from the analyzer, and updates the identifier of the terminal device corresponding to the known device type based on the message. Wherein, the message includes the identifier of the terminal device.

After identifying the device type of the terminal device, the analyzer sends a message to inform the network device that the device type of the terminal device is known, and the network device stores the device identifier of the terminal device. If the terminal device does not go offline, the network device will no longer send the data flow statistics information of the terminal device to the analyzer. That is, as more and more types of terminal devices are identified, network resources consumed by device identification will become less and less.

Optionally, the network device receives a message from the analyzer, and updates the asset library based on the message. Wherein, the message includes the device type of the terminal device and the identifier of the terminal device.

After identifying the device type of the terminal device, the analyzer sends a message to inform the network device of the device type of the terminal device. The network device adds the device type and identification of the terminal device to the asset library. If the terminal device does not go offline, the network device will no longer send the data flow statistics information sent to the terminal device to the analyzer. That is, as more and more types of terminal devices are identified, network resources consumed by device identification will become less and less.

Optionally, the data flow statistics information of the terminal device includes a source Internet Protocol (Internet Protocol, IP) address or a destination IP address of at least one data flow of the terminal device.

Optionally, the data flow statistical information of the terminal device further includes one or more of the following information: the traffic size of at least one data flow of the terminal device within the second time window, at least one data flow of the terminal device The number of data packets of the flow within the second time window, and the size of each data packet of at least one data flow of the terminal device within the second time window.

Optionally, the identifier of the terminal device includes an IP address of the terminal device.

Optionally, the terminal device includes an IoT device of the Internet of Things.

The above implementations of the first aspect of the present application can be combined with each other without conflicts, and the combinations all belong to the protection scope of the present application.

In a second aspect, a device identification device is provided. The device includes a plurality of functional modules, all of which may be software modules or hardware modules, or a combination of software modules and hardware modules, and the plurality of functional modules may be divided according to different implementations, so as to realize the above-mentioned The methods of the first aspect and its various embodiments are the norm.

In a third aspect, a device identification device is provided. The apparatus includes a processor and memory. A program is stored in the memory, and the processor is configured to execute the program stored in the memory to implement the device identification method provided in the first aspect or any possible implementation manner of the first aspect.

In a fourth aspect, a device identification system is provided. The system includes a device identification device and an analyzer. The device identification apparatus is configured to implement the device identification method provided in the first aspect or any possible implementation manner of the first aspect. The analyzer is configured to receive the data flow statistical information of the terminal device sent by the device identification device, and identify the device type of the terminal device according to the data flow statistical information of the terminal device.

Optionally, the analyzer is further configured to send a message to the device identification device, where the message includes the identifier of the terminal device.

Optionally, the analyzer is further configured to send a message to the device identification apparatus, where the message includes the identifier of the terminal device and the device type of the terminal device.

In a fifth aspect, a computer-readable storage medium is provided. The computer-readable storage medium includes instructions, which, when run on a computer, cause the computer to execute the device identification method provided in the first aspect or any possible implementation manner of the first aspect.

In a sixth aspect, a computer program product including instructions is provided. When it runs on a computer, the computer is made to execute the device identification method provided by the first aspect or any possible implementation manner of the first aspect.

Description of drawings

FIG. 1 is a schematic diagram of an implementation environment involved in an embodiment of the present application;

FIG. 2 is a flow chart of a device identification method provided in an embodiment of the present application;

Fig. 3 is a schematic diagram of an asset library provided by an embodiment of the present application;

Fig. 4 is a schematic diagram of a logic structure of an apparatus identification device provided by an embodiment of the present application;

Fig. 5 is a schematic diagram of the hardware structure of a device identification device provided by an embodiment of the present application;

Fig. 6 is a schematic diagram of a device identification system provided by an embodiment of the present application.

detailed description

In order to make the principles, technical solutions and advantages of the present application clearer, the implementation manners of the present application will be further described in detail below in conjunction with the accompanying drawings.

Please refer to FIG. 1 , which shows a schematic diagram of an implementation environment involved in an embodiment of the present application. As shown in FIG. 1 , the implementation environment includes a communication network 100 . The communication network 100 includes a plurality of terminal devices and a plurality of network devices, and the plurality of terminal devices access the Internet (internet) or intranet (intranet) through corresponding network devices to access services provided by the service server. For example, the terminal devices 101 - 102 are connected to the network device 111 , the terminal devices 103 - 104 are connected to the network device 112 , and the terminal device 105 is connected to the network device 113 . The network device 111 connects the terminal devices 101 - 102 to the Internet or intranet through the network device 121 , so that the terminal devices 101 - 102 can access related services, for example, services provided by the service server 131 . Wherein, the network device 112 connects the terminal devices 103 - 104 to the Internet/Intranet through the network device 121 , so that the terminal devices 103 - 104 can access related services, for example, services provided by the service server 131 . Wherein, the network device 113 connects the terminal device 105 to the Internet/Intranet, so that the terminal device 105 can access related services, for example, services provided by the service server 131 .

Wherein, optionally, the terminal device is an IoT device. End devices can be of various types. For example, in a financial system, a terminal device may be an automated teller machine (automated teller machine, ATM), a self-service inquiry terminal, a card issuer, an intelligent counter, or a camera. For example, the terminal device 101 and the terminal device 103 may be ATMs, the terminal device 102 and the terminal device 104 may be cameras, and the terminal device 105 may be a card issuer.

Wherein, the network device may be various types of devices. For example, a network device may be a switch, router, wireless access point, base station, etc. For example, the network device 111 may be a wireless access point, and the terminal devices 101-102 access the network device 111 through a wireless local area network. For another example, the network device 112 may be a switch, and the terminal devices 103 - 104 access the network device 112 through a wired access manner. For another example, the network device 113 may be a base station, and the terminal device 105 accesses the network device 113 through a cellular network. For another example, the network device 121 may be a router. Wherein, the network devices 111-113 are directly connected to the terminal devices, so the network devices 111-113 may also be called access devices. Wherein, the network device 121 is not directly connected to the terminal device, but forwards the message of the terminal device sent by the access device, and the network device 121 may also be called an aggregation device.

Wherein, the service server 131 may be various types of devices. For example, the service server 131 may be a physical server, a physical server cluster, a virtual machine or a virtual machine cluster, and the like. The service server 131 can be deployed in a public cloud, a private cloud, or an enterprise data center. The service server can provide various services, for example, video service, deposit and withdrawal service, and so on.

In order to prevent the terminal device from being attacked or maliciously counterfeited, the communication network 100 needs to identify the device type of the terminal device, so as to implement corresponding security protection policies for different types of terminal devices according to the device type. Identifying the device type of an end device is also known as asset inventory. That is, by identifying the device type of the terminal device to take stock of the types of device assets.

In view of this, the communication network 100 may further include an analyzer 141 . The analyzer 141 may receive the data flow statistical information of the terminal device sent by the network device, and identify the device type of the terminal device according to the data flow statistical information. The network device may be an access device or an aggregation device. The analyzer 141 may be deployed in a public cloud, a private cloud, an enterprise data center, or an enterprise headquarters campus network. The analyzer 141 may be a server, a server cluster, a virtual machine or a virtual machine cluster, and the like. The analyzer 141 may also be a network device with computing capabilities. The network device with computing capability is deployed in the data center of the enterprise or the headquarters campus network of the enterprise.

An embodiment of the present application provides a method for device identification. In this method, the network device close to the terminal device obtains the data flow statistics information of the terminal device, and when the type of the terminal device is unknown or the terminal device is a terminal device that has come online again, the network device sends the data flow statistics information of the terminal device to An analyzer. The analyzer identifies the device type of the terminal device based on the data flow statistics information of the terminal device. After identifying the device type of the terminal device, the analyzer sends the identifier of the terminal device, or the identifier and device type of the terminal device to the network device. The network device close to the terminal device may be an access device or a convergence device. The data flow statistical information of the terminal device is acquired by a network device close to the terminal device, so the data flow statistical information can reflect all access behaviors of the terminal device. When the device type of the terminal device is unknown or the device type of the terminal device may have changed, the network device will send the data flow statistics information of the terminal device to the analyzer. That is, the analyzer can obtain data flow statistical information of a large number of unknown types of terminal devices, and the data flow statistical information can reflect all access behaviors of the terminal devices. Therefore, the analyzer can also train or update the device recognition model based on this to improve the accuracy of device recognition. The network device will not send the data flow statistics of terminal devices of known device types that are not offline to the analyzer. This avoids the consumption of network resources by the data flow statistics information of a large number of known device types and always-on terminal devices. Therefore, this method can also reduce the consumption of network resources for device identification. Please refer to the following description for the detailed solutions of the embodiments of the present application.

Please refer to FIG. 2 , which shows a flow chart of a device identification method provided by an embodiment of the present application. Including the following steps:

Step 201, the network device acquires data flow statistics information of the terminal device.

Network equipment includes access equipment or aggregation equipment. An access device is a network device connected to a terminal device. The aggregation device is a network device that is not directly connected to the terminal equipment, but the data flow of the terminal equipment must pass through. For example, taking the network 100 shown in FIG. 1 as an example, the terminal device may be the terminal device 101 , the access device may be the network device 111 , and the aggregation device may be the network device 121 . The terminal device 101 accesses the network through the network device 111 , so the network device 111 must be able to obtain the data flow statistics information of the terminal device 101 . Although the network device 121 is not directly connected to the terminal device 101, the packets of the terminal device 101 must be forwarded through the network device 121, so the network device 121 must also be able to obtain the data flow statistics information of the terminal device 101.

The data streams of different types of terminal equipment have different characteristics. For example, there is almost no downlink traffic of the camera, but the uplink traffic exists continuously and the traffic is relatively large, but the data flow of the ATM occurs irregularly, and the traffic is very small. The analyzer distinguishes different end devices based on the data flow statistics of the end devices. Therefore, the data flow statistical information includes statistical information that can reflect the service characteristics of the terminal equipment. For example, the data flow statistics information includes one or more of the following information: the number of data flows of the terminal device in a time window, the size of the data flow of the terminal device in the time window, the number of data flows of the terminal device in the time window The number of data packets, the size of each data packet of the terminal device within the time window, the header information of each data flow of the terminal device within the time window, and the header information of each data flow of the terminal device within the time window The traffic size of the terminal device, the number of packets of each data flow of the terminal device within the time window, and the size of each packet of each data flow of the terminal device within the time window. Wherein, the header information of the data stream includes tuples of the data stream. A tuple of data streams may be a quintuple of data streams. The five-tuple of the data stream includes the source IP address, destination IP address, source port, destination port, and protocol type of the data stream. The data flow statistical information may also include directional information of the data flow, for example, uplink or downlink. The data flow received by the network device from the port close to the terminal device is an uplink data flow, otherwise, it is a downlink data flow.

The network device obtains the data flow statistics information of the terminal device. For example, the network device collects the data flow transmitted through the network device, and obtains statistical information of the data flow within the time window. The network device can distinguish the data flows of different terminal devices within the time window based on the identifier of the terminal device. The identifier of the terminal device includes the IP address of the terminal device. The network device may distinguish data flows of different terminal devices within a time window based on the source IP address of the uplink data flow or the destination IP address of the downlink data flow. Uplink data flows with the same source IP address or downlink data flows with the same destination IP address are data flows belonging to the same terminal device. For example, the time window may be 5 minutes. The network device calculates the data flow statistics information of each terminal device within each 5 minutes to obtain the data flow statistics information of each terminal device within the time window. The network device can always obtain the data flow statistics information of the terminal device. For example, the network device acquires data flow statistics information of each terminal device in each time window starting from a specified time (for example, when the network device starts running, or a time configured by an administrator). For example, the network device acquires data flow statistics information every 5 minutes from the start of operation, and the data flow statistics information includes data flow statistics information of each terminal device that has data flows within the 5 minutes. The network device can also obtain the data flow statistics information of the terminal device according to predetermined requirements. For example, according to the configuration of the administrator, the network device obtains data flow statistics information every half hour, and the data flow statistics information obtained each time includes each terminal device with data flow within a time window (for example, 5 minutes) data flow statistics.

The data flow statistics information of the terminal device can also be obtained by other devices. For example, the data flow statistics of the terminal device are obtained by a network probe attached to the side of the network device. For example, the access device 111 in FIG. 1 may bypass a network probe, and the network probe has computing capability. The access device 111 can mirror the data flow to the network probe, and the network probe calculates the data flow statistical information of each terminal device within the time window according to the mirrored data flow.

Step 202, when the condition is met, the network device sends the data flow statistics information of the terminal device to the analyzer. The condition includes: the device type of the terminal device is unknown, or the terminal device is a terminal device that has come online again.

When the terminal device meets the conditions, the network device sends the data flow statistics information of the terminal device to the analyzer. The conditions include: the device type of the terminal device is unknown, or the terminal device is a terminal device that has come online again.

When the device type of the terminal device is unknown, the network device sends the data flow statistics information of the terminal device to the analyzer, so as to trigger the analyzer to identify the device type of the terminal device. The network device may determine whether the terminal device is a terminal device of a known device type based on various methods. For example, the identification of a terminal device of a known device type is recorded on the network device (for example, the identification includes the IP address of the terminal device, and the network device records multiple IP addresses, indicating the device type of the terminal device associated with the multiple IP addresses. Known), if there is an IP address associated with the data flow statistics information of the terminal device in the multiple IP addresses (for example, the source IP address or destination IP address of the data flow), the network device determines the terminal device associated with the data flow An end device that is a known device type. For another example, the network device may also store an asset library, which records device types and IP addresses of one or more terminal devices corresponding to each device type. The network device extracts the IP address in the data flow statistics information, and queries the asset library according to the IP address. If the IP address exists in the asset library, the network device judges that the terminal device associated with the data flow is a terminal of a known device type equipment. The identifier or asset library of the terminal device corresponding to the known device type can be configured by the administrator, or, after the analyzer identifies the device type of the terminal device, it sends the device type and/or the device identifier corresponding to the device type to the network device . Correspondingly, when the network device collects the data stream of the terminal device, it may also use the IP address of the terminal device of known device type as a filter condition, so as not to collect the data stream of the terminal device of the known device type. In this way, the overhead of network equipment can be further reduced.

When the terminal device is a re-online terminal device, its device type may have changed, so the network device also sends its data flow statistics to the analyzer to trigger the analyzer to re-identify the device type of the terminal device. For example, the IP address of a query machine is IP A, but one day the query machine is damaged, and IP A may be used by other devices. At this time, if the network device uses IP addresses to distinguish terminal devices, it is necessary to send The data flow statistical information of the analyzer is given to the analyzer to trigger the analyzer to re-identify the device type of the terminal device bound to the IP A.

The network device can determine whether the terminal device is a terminal device that has come online again through various methods. For example, if the network device 111 is a wireless access point device, when it is found that the terminal device 101 is disconnected, the network device 111 judges that the terminal device 101 has gone offline; when the terminal device 101 associates with the network device 111 again, the network device judges that the The terminal 101 is a terminal device that goes online again. For another example, if the network device 112 is a switch, when it is detected that the port connected to the terminal device 104 is disconnected, the network device 112 judges that the terminal device 104 has gone offline, and when it detects that the port is connected again, the network device 112 judges that the terminal Device 104 is a terminal device that has come online again. For another example, the network device may also determine whether the terminal device is a terminal device that has come online again according to the historical traffic volume of the terminal device. For example, if the network device does not detect the data flow of a terminal device within the specified time window, it is judged that the terminal device has gone offline; On-line terminal equipment. The designated time window may be multiplied with the window in which the network device obtains the data flow statistics information in step 201 . For example, if the network device obtains the data flow statistics information of the terminal device every 5 minutes, when the network device does not detect the data flow of a terminal device within one or more 5 minutes, the network device judges that the terminal device has gone offline . When the network device detects the data flow of the terminal device again, the network device judges that the terminal device is a terminal device that has come online again. The specified time window can also be other values. For example, when the time window for obtaining the data flow statistics information of the terminal device is 5 minutes, the time window for judging whether the terminal device is online again may also be 18 minutes. When the network device does not detect the data stream of the terminal device within 18 minutes, it is judged that the terminal device has gone offline, and when the data stream of the terminal device is detected again, the network device judges that the terminal device is a terminal device that has come back online.

Step 203, the analyzer identifies the device type of the terminal device.

The analyzer identifies the device type of the terminal device based on the data flow statistics information of the terminal device sent by the network device. For example, the analyzer takes the data flow statistics information of the terminal device as an input of the device identification model, so as to obtain the device type of the terminal device from the output of the device identification model.

The device identification model can be configured by an administrator. The device recognition model can also be obtained by analyzer training. The analyzer can train and obtain the device identification model based on the data flow statistics information of a plurality of terminal devices of unknown device types sent by each network device and the data flow statistics information of a plurality of terminal devices of known device types. The device recognition model can be various machine learning models, for example, random forest or convolutional neural network. Initially, the device types of the terminal devices of the plurality of known device types may be marked by the administrator. For example, a network device sends data flow statistics information of 1000 terminal devices, and the administrator randomly marks the correct device type for 100 terminal devices. For another example, the administrator enters 20 IP addresses and the device types associated with the 20 IP addresses on the input interface of the analyzer, and the data flow statistics information associated with the 20 IP addresses received by the analyzer is the known device Data flow statistics for the type of terminal device.

The administrator can also input an instruction on the input interface of the analyzer to instruct the analyzer to start training the device recognition model. After receiving the input instruction from the administrator, the analyzer can send the collection instruction to each network device. The collection instruction instructs the network device to obtain the data flow statistics information of the terminal device, so that the analyzer obtains a data set for training a device recognition model. The collection instruction may include collection duration, collection frequency, collection information type and other information. For example, the collection duration may be 1 day, the collection frequency may be 5 minutes, and the type of collected information may be one or more types of information included in the data stream statistical information described in step 201 . After receiving the collection instruction, the network device calculates data flow statistics every 5 minutes within 1 day. The data flow statistical information within every 5 minutes includes the data flow statistical information of each terminal device that has data traffic on the network device within the 5 minutes. The network device can periodically obtain data flow statistics. For example, the network device collects data flow every 5 minutes and calculates the data flow statistics within the 5 minutes. A network device can also acquire data flow statistics in multiple time windows at one time. For example, the network device saves a data flow file for one day, and then obtains 288 (24 hours*60/5 minutes=288) pieces of data flow statistics information within 5 minutes in one day at one time. The network device can regularly send data flow statistics, for example, the network device obtains data flow statistics every 5 minutes and immediately sends the data flow statistics to the analyzer. The network device can also send data flow statistics in multiple time windows at one time. For example, after the network device obtains 288 data flow statistics every 5 minutes in a day, it sends the data flow to 288 time windows at one time. Statistics to the analyzer.

When the analyzer identifies the device type of the terminal device based on the data flow statistics information of the terminal device, the analyzer associates the identifier of the terminal device with the device type, and adds the identifier of the terminal device to the asset library for the device type corresponding asset information entry. For example, the asset library can be as shown in FIG. 3 . The asset library shown in FIG. 3 records multiple asset information entries, and each asset information entry includes a device type and one or more identifiers of terminal devices corresponding to the device type. The device identification includes the IP address of the terminal device. For example, as shown in Figure 3, the ATM includes terminal devices associated with IP addresses 192.168.7.2 and 192.168.8.2, the camera includes terminal devices associated with IP addresses 192.168.11.11 and 192.168.22.22, and the card issuer includes Terminal Equipment. The asset library may also record the identification of equipment that is not of interest. For example, the analyzer can mark terminal devices with strong protection capabilities, such as personal computers (PCs), as non-concerned devices, and the analyzer or other management devices do not need to set special protection policies for these non-concerned devices . If these non-concerned devices do not come online again, the network device does not need to collect the data streams of these non-concerned devices.

After identifying the device type of the terminal device, the analyzer may send the identifier of the terminal device or the identifier of the terminal device and the device type of the terminal device to the network device. For example, during initial training, if the analyzer identifies a large number of terminal devices of unknown device types, the analyzer may send the identifiers of one or more terminal devices corresponding to each device type to the network device. For another example, after the training is completed, each time the analyzer receives the data flow statistical information sent by the network device, it can obtain the device type of the terminal device associated with the data flow statistical information based on the data flow statistical information. The analyzer may send the identifier of the terminal device associated with the data flow statistics information or the identifier of the terminal device and the device type of the terminal device to the network device. The network device records the device identification of the known device type based on the analyzer's message, or updates the asset library to record the known device type and the device identification associated with the known device type. As more and more types of terminal devices are identified, the network devices need to send less and less data flow statistics, and the network resources consumed by device identification will become less and less.

After the model training is completed, the analyzer can also update the device identification model based on the data flow statistics information of the unknown device type terminal device sent by the network device subsequently.

In the device identification method provided in the embodiment of the present application, the network device sends the data flow statistical information of the terminal device whose device type is unknown or whose device type may change to the analyzer, and the data flow statistical information is obtained by the network device close to the terminal device, It can reflect all access behaviors of terminal equipment. Therefore, the method enables the analyzer to identify the device type of the terminal device whose device type is unknown or the device type may change, and update the device identification model based on the data flow statistics of a large number of terminal devices whose device type is unknown or the device type may change to Improve the accuracy of device identification. In addition, the network device only sends the data flow statistics information of terminal devices of unknown device types or re-online terminal devices to the analyzer, avoiding the consumption of bandwidth by the data flow statistics information of terminal devices of known device types and always online. This reduces the consumption of network resources for device identification.

Fig. 4 is a schematic diagram of a logical structure of an apparatus for identifying equipment provided by an embodiment of the present application. Please refer to FIG. 4 , the device identification apparatus 400 includes an acquisition module 410 and a sending module 420 . Wherein, the acquiring module 410 is configured to execute step 201 in the embodiment shown in FIG. 2 , and the sending module 420 is configured to execute step 202 in the embodiment shown in FIG. 2 .

Wherein, the acquiring module 410 is configured to acquire data flow statistical information of the terminal device. The device identification apparatus 400 is an access device connected to the terminal device or a converging device through which the data flow of the terminal device must pass. The data stream of the terminal device is forwarded through the device identification device 400 .

Wherein, the sending module 420 is configured to send the data flow statistics information of the terminal device to the analyzer when a condition is met, so that the analyzer can identify the device type of the terminal device.

Optionally, the sending module is configured to determine whether the device type of the terminal device is known or unknown according to the identifier of the terminal device of known device type. When the identifier of the terminal device exists in the identifiers of terminal devices of a known device type, the sending module determines that the device type of the terminal device is known, otherwise it is unknown.

Optionally, the sending module is configured to determine whether the device type of the terminal device is known or unknown according to the asset library. The asset library is used to record the device type and the identifier of the terminal device corresponding to the device type. When the identifier of the terminal device exists in the asset library, the sending module determines that the device type of the terminal device is known, otherwise it is unknown.

Optionally, the sending module is configured to judge whether the terminal device is a re-online terminal device according to the historical traffic volume of the terminal device. If the traffic volume of the terminal device in the first time window is zero, the sending module judges that the terminal device is a terminal device that has come online again.

Optionally, the device identification device further includes a receiving module and an updating module. The receiving module is used for receiving messages. Optionally, the message includes the identifier of the terminal device, and the updating module is configured to update the identifier of the terminal device of the known device type based on the message. Optionally, the message further includes the device type of the terminal device, and the update module is configured to update the asset library based on the message.

The device identification apparatus 400 provided in this embodiment is used to execute the technical solution of the method embodiment shown in FIG. 2 , and its implementation principle and technical effect are similar. Each device identification apparatus 400 sends the data flow statistics information of terminal devices whose device types are unknown or re-online to the analyzer, so that the analyzer can identify the device types of these terminal devices. The analyzer can also train or update the device identification model based on the data flow statistics of a large number of unknown or re-online terminal devices to improve the accuracy of device identification. In addition, the device identification apparatus 400 selectively sends the data flow statistical information of the terminal device to the analyzer: only the data flow statistical information of the terminal device whose device type is unknown or whose device type may change is sent to the analyzer. This avoids the consumption of bandwidth by the data flow statistics information of terminal devices whose device types are known and is always online, and reduces the network resources consumed by device identification.

It should be noted that when the device identification device provided by the embodiment shown in FIG. 4 executes the device identification method, it only uses the division of the above-mentioned functional modules as an example. In practical applications, the above-mentioned functions can be assigned to different function modules according to needs. Module completion means that the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the device identification device and the device identification method embodiments provided in the above embodiments belong to the same concept, and the specific implementation process thereof is detailed in the method embodiments, and will not be repeated here.

FIG. 5 is a schematic diagram of a hardware structure of a device identification device 500 provided by an embodiment of the present application. Referring to FIG. 5 , the device identification apparatus 500 includes a processor 520 , a memory 540 , a communication interface 560 and a bus 580 , and the processor 520 , the memory 540 and the communication interface 560 are connected to each other through the bus 580 . The processor 520 , the memory 540 and the communication interface 560 may also be connected in other connection ways than the bus 580 .

Wherein, the memory 540 can be various types of storage media, such as random access memory (random access memory, RAM), read-only memory (read-only memory, ROM), non-volatile RAM (non-volatile RAM, NVRAM ), programmable ROM (programmable ROM, PROM), erasable PROM (erasable PROM, EPROM), electrically erasable PROM (electrically erasable PROM, EEPROM), flash memory, optical memory, hard disk, etc.

Wherein, the processor 520 may be a general-purpose processor, and the general-purpose processor may be a processor that performs specific steps and/or operations by reading and executing contents stored in a memory (such as the memory 540 ). For example, the general processor may be a central processing unit (CPU). The processor 520 may include at least one circuit to execute all or part of the steps of the device identification method provided by the embodiment shown in FIG. 2 .

Among them, the communication interface 560 includes an input/output (input/output, I/O) interface, a physical interface and a logical interface, etc., which are used to realize the interconnection of devices inside the device identification device 500, and are used to realize the connection between the device identification device 500 and The interface through which other devices, such as analyzers or end devices, are interconnected. The physical interface can be Ethernet interface, optical fiber interface, ATM interface, etc.

Wherein, the bus 580 may be any type of communication bus for interconnecting the processor 520, the memory 540 and the communication interface 560, such as a system bus.

The above-mentioned devices may be respectively arranged on independent chips, or at least partly or all of them may be arranged on the same chip. Whether each device is independently arranged on different chips or integrated and arranged on one or more chips often depends on the needs of product design. The embodiments of the present application do not limit the specific implementation forms of the foregoing devices.

The device identifying apparatus 500 shown in FIG. 5 is only exemplary. During implementation, the device identifying apparatus 500 may also include other components, which will not be listed here. In addition, the device identification device 500 provided in the above embodiment is based on the same idea as the device identification method embodiment, and its specific implementation process is detailed in the method embodiment, and will not be repeated here.

Fig. 6 is a schematic diagram of a device identification system provided by an embodiment of the present application. Please refer to FIG. 6 , the device identification system 600 includes an analyzer 610 and one or more device identification devices. For example, the one or more device identifying means includes device identifying means 620 and/or device identifying means 630 . The equipment identification device includes the access equipment connected to the terminal equipment or the converging equipment through which the data flow of the terminal equipment must pass. The device identification device and the analyzer are connected via the Internet or an intranet. The analyzer 610 is configured to execute step 203 in the embodiment of the device identification method shown in FIG. 2 . The device identification device 620 or the device identification device 630 is used to execute step 201 and step 202 in the embodiment of the device identification method shown in FIG. 2 . In a possible implementation manner, the device identifying device 620 or the device identifying device 630 includes the device identifying device 400 shown in FIG. 4 . In another possible implementation manner, the device identifying device 620 or the device identifying device 630 includes the device identifying device 500 shown in FIG. 5 .

In the above embodiments, all or part of them may be implemented by software, hardware, firmware or any combination thereof. When implemented using software, it may be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on the computer, the processes or functions according to the embodiments of the present invention will be generated in whole or in part. The computer can be a general purpose computer, a special purpose computer, a computer network, or other programmable devices. The computer instructions may be stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website, computer, server or data center Transmission to another website site, computer, server, or data center by wired (eg, coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (eg, infrared, wireless, microwave, etc.). The computer-readable storage medium may be any available medium that can be accessed by a computer, or a data storage device such as a server or a data center integrated with one or more available media. The available medium may be a magnetic medium (for example, a floppy disk, a hard disk, or a magnetic tape), an optical medium (for example, DVD), or a semiconductor medium (for example, a solid state disk (solid state disk, SSD)), etc.

It should be understood that in the embodiment of the present application, the size of the sequence numbers of the above-mentioned processes does not mean the order of execution, and the execution order of the processes should be determined by their functions and internal logic, and should not constitute the implementation process of the embodiment of the present application. Any restrictions.

The specific embodiments described above have further described the purpose, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above descriptions are only specific embodiments of the present invention and are not intended to limit the scope of the present invention. Protection scope, any modification, equivalent replacement, improvement, etc. made on the basis of the technical solution of the present invention shall be included in the protection scope of the present invention.

Claims

A device identification method, characterized in that the method comprises:

Obtain the data flow statistics information of the terminal device;

When a condition is met, sending the data flow statistics information of the terminal device to the analyzer, so that the analyzer identifies the device type of the terminal device, wherein the condition includes: the device type of the terminal device is unknown, Alternatively, the terminal device is a terminal device that has come online again.
The method according to claim 1, characterized in that the method comprises:

Determine whether the device type of the terminal device is unknown according to the identifier of the terminal device corresponding to the known device type.
The method according to claim 1, characterized in that the method comprises:

determining whether the device type of the terminal device is unknown according to the asset library;

Wherein, the asset library is used to record the device type and the identifier of the terminal device corresponding to the device type.
The method according to any one of claims 1 to 3, characterized in that the method comprises:

It is judged whether the terminal device is a terminal device that goes online again according to the historical traffic volume of the terminal device.
The method according to claim 4, wherein, if the traffic volume of the terminal device within the first time window is zero, the terminal device is a terminal device that goes online again.
The method according to claim 2, 4 or 5, characterized in that the method further comprises:

receiving a message from the analyzer, and updating the identifier of the terminal device corresponding to the known device type based on the message, wherein the message includes the identifier of the terminal device.
The method according to any one of claims 3 to 5, wherein the method further comprises:

A message is received from the analyzer, and the asset library is updated based on the message, wherein the message includes the device type of the terminal device and the identification of the terminal device.
The method according to any one of claims 1 to 7, wherein the data flow statistical information of the terminal device includes a source Internet Protocol IP address or a destination IP address of at least one data flow of the terminal device.
The method according to claim 8, wherein the data flow statistical information of the terminal device further includes one or more of the following information: the traffic volume of at least one data flow of the terminal device within the second time window , the number of data packets of the at least one data flow of the terminal device within the second time window, and the size of each data packet of the at least one data flow of the terminal device within the second time window.
The method according to any one of claims 2 to 9, wherein the identifier of the terminal device includes the IP address of the terminal device.
The method according to any one of claims 1 to 10, wherein the terminal device comprises an IoT device of the Internet of Things.
A device identification device, characterized in that the device includes an acquisition module and a sending module,

The obtaining module is used to obtain the data flow statistics information of the terminal equipment;

The sending module is configured to send the data flow statistics information of the terminal device to the analyzer when a condition is met, so that the analyzer can identify the device type of the terminal device;

Wherein, the condition includes: the device type of the terminal device is unknown, or the terminal device is a terminal device that has come online again.
The device according to claim 12, characterized in that,

The sending module is further configured to determine whether the device type of the terminal device is unknown according to the identifier of the terminal device corresponding to the known device type.
The device according to claim 12, characterized in that,

The sending module is further configured to determine whether the device type of the terminal device is unknown according to the asset library;

Wherein, the asset library is used to record the device type and the identifier of the terminal device corresponding to the device type.
The device according to any one of claims 12 to 14, characterized in that,

The sending module is further configured to judge whether the terminal device is a re-online terminal device according to the historical traffic volume of the terminal device.
The device according to claim 15, wherein, if the traffic volume of the terminal device within the first time window is zero, the terminal device is a terminal device that has come online again.
The device according to claim 13, 15 or 16, characterized in that the device further comprises a receiving module and an updating module,

The receiving module is configured to receive messages;

The update module is configured to update the identifier of the terminal device corresponding to the known device type based on the message;

Wherein, the message includes the identifier of the terminal device.
The device according to any one of claims 14 to 16, wherein the device further comprises a receiving module and an updating module,

The receiving module is configured to receive messages;

The update module is configured to update the asset library based on the message;

Wherein, the message includes the device type of the terminal device and the identifier of the terminal device.
The apparatus according to any one of claims 12 to 18, wherein the data flow statistical information of the terminal device includes a source Internet Protocol IP address or a destination IP address of at least one data flow of the terminal device.
The apparatus according to claim 19, wherein the data flow statistical information of the terminal device further includes one or more of the following information: the flow size of at least one data flow of the terminal device within the second time window . The number of data packets of at least one data flow of the terminal device within the second time window.
The apparatus according to any one of claims 12 to 20, wherein the identifier of the terminal device includes an IP address of the terminal device.
The apparatus according to any one of claims 12 to 21, wherein the terminal device comprises an IoT device of the Internet of Things.
A device identification device, characterized in that it includes a processor and a memory, the memory stores a program, and the processor is used to execute the program stored in the memory to realize the device described in any one of claims 1 to 11 recognition methods.
An equipment identification system, characterized in that the system includes an equipment identification device and an analyzer,

The device identification device is used to implement the device identification method described in any one of claims 1 to 11;

The analyzer is configured to receive the data flow statistical information of the terminal device sent by the device identification device, identify the device type of the terminal device according to the data flow statistical information of the terminal device, and send the device type of the terminal device The type identifies the device to the device.
A computer-readable storage medium, characterized by comprising instructions, which, when run on a computer, cause the computer to execute the method as claimed in any one of claims 1 to 11.
A computer program product, characterized in that it includes program codes, and when the computer runs the computer program product, the computer executes the method according to any one of claims 1 to 11.