Device identification method, apparatus, and system
A device identification method, apparatus, and system are provided. A management device or a collection device first determines a network traffic feature of a to-be-identified device based on a first dataset. The first dataset includes a plurality of pieces of first data, and each piece of first data includes a data amount of a data packet that is of the to-be-identified device and that is collected within one first periodicity. Then, the management device or the collection device determines a device type of the to-be-identified device based on a device identification model and the network traffic feature of the to-be-identified device.
1 . A device identification method, wherein the method comprises:
determining a network traffic feature of a to-be-identified device based on a first dataset, wherein the first dataset comprises a plurality of pieces of first data, wherein each piece of first data comprises a data amount of a data packet that is related to the to-be-identified device and that is collected within a first periodicity, and wherein the data packet is a heartbeat packet having a packet length less than a target length threshold; and
determining a device type of the to-be-identified device based on a device identification model and the network traffic feature of the to-be-identified device by inputting the network traffic feature of the to-be-identified device to the device identification model;
wherein the device identification model is a machine learning model obtained through training based on network traffic features of a plurality of known devices of a known device type.
2 . The method according to claim 1 , wherein the determining the network traffic feature of the to-be-identified device based on the first dataset comprises:
generating, based on the first dataset, a first data amount time series (T n , S n ) corresponding to the to-be-identified device, wherein T n represents an nth first periodicity, S n represents a data amount of a data packet that is related to the to-be-identified device and that is collected within the n th first periodicity, and n is a positive integer; and
determining the network traffic feature of the to-be-identified device based on the first data amount time series (T n , S n ).
3 . The method according to claim 2 , wherein the determining the network traffic feature of the to-be-identified device based on the first data amount time series (T n , S n ) comprises at least one of:
determining, based on the first data amount time series (T n , S n ), a data amount distribution feature corresponding to the to-be-identified device; or
performing a frequency-domain change on the first data amount time series (T n , S n ) to obtain a data amount frequency-domain feature corresponding to the to-be-identified device, wherein the data amount frequency-domain feature comprises at least one of a frequency or an amplitude of the first data amount time series (T n , S n ).
4 . The method according to claim 2 , wherein the generating, based on the first dataset, the first data amount time series (T n , S n ) corresponding to the to-be-identified device comprises at least one of:
generating, based on the first dataset, in response to the plurality of pieces of first data comprising data amounts of uplink data packets that are related to the to-be-identified device and that are collected within a plurality of first periodicities, an uplink data amount time series corresponding to the to-be-identified device; or
generating, based on the first dataset, in response to the plurality of pieces of first data comprising data amounts of downlink data packets that are related to the to-be-identified device and that are collected within a plurality of first periodicities, a downlink data amount time series corresponding to the to-be-identified device.
5 . The method according to claim 1 , wherein the method further comprises:
sending a statistical information collection instruction to a collection device that is in a first network; and
performing one of:
obtaining the first dataset by receiving, in response to the statistical information collection instruction instructing the collection device to count data amounts of data packets that are of the to-be-identified device and that are collected within a plurality of first periodicities, the plurality of pieces of first data sent by the collection device that is in the first network; or
performing:
receiving, in response to the statistical information collection instruction instructing the collection device to count data amounts of data packets that are of the to-be-identified device and that are collected at a plurality of collection moments, a plurality of pieces of second data sent by the collection device that is in the first network; and
generating the first dataset, based on the plurality of pieces of second data, wherein each piece of second data comprises one collection moment, and based on a data amount of a data packet that is related to the to-be-identified device and that is collected at the collection moment.
6 . The method according to claim 1 , wherein the method further comprises:
determining a network traffic feature of a known device based on a second dataset, wherein the second dataset comprises a plurality of pieces of third data, and wherein each piece of third data comprises a data amount of a data packet that is related to the known device and that is collected within a second periodicity; and
generating the device identification model.
7 . The method according to claim 1 , wherein the network traffic feature comprises a data amount distribution feature or a data amount frequency-domain feature.
8 . An apparatus, comprising:
at least one processor; and
at least one non-transitory computer-readable storage medium storing instructions and configured to execute the instructions to cause the apparatus to:
determine a network traffic feature of a to-be-identified device based on a first dataset, wherein the first dataset comprises a plurality of pieces of first data, wherein each piece of first data comprises a data amount of a data packet that is related to the to-be-identified device and that is collected within a first periodicity, and wherein the data packet is a heartbeat packet having a packet length less than a target length threshold; and
determine a device type of the to-be-identified device based on a device identification model and the network traffic feature of the to-be-identified device by inputting the network traffic feature of the to-be-identified device to the device identification model;
wherein the device identification model is a machine learning model obtained through training based on network traffic features of a plurality of known devices of a known device type.
9 . The apparatus according to claim 8 , wherein the instructions further include instructions to:
generate, based on the first dataset, a first data amount time series (T n , S n ) corresponding to the to-be-identified device, wherein T n represents an n th first periodicity, S n represents a data amount of a data packet that is related to the to-be-identified device and that is collected within the n th first periodicity, and n is a positive integer; and
determine the network traffic feature of the to-be-identified device based on the first data amount time series (T n , S n ).
10 . The apparatus according to claim 9 , wherein the instructions further include instructions to at least one of:
determine, based on the first data amount time series (T n , S n ), a data amount distribution feature corresponding to the to-be-identified device; or
obtain a data amount frequency-domain feature corresponding to the to-be-identified device by performing a frequency-domain change on the first data amount time series (T n , S n ), wherein the data amount frequency-domain feature comprises at least one of a frequency or an amplitude of the first data amount time series (T n , S n ).
11 . The apparatus according to claim 9 , wherein the instructions further include instructions to at least one of:
generate, based on the first dataset, in response to the plurality of pieces of first data comprising data amounts of uplink data packets that are related to the to-be-identified device and that are collected within a plurality of first periodicities, an uplink data amount time series corresponding to the to-be-identified device; or
generate, based on the first dataset, in response to the plurality of pieces of first data comprising data amounts of downlink data packets that are related to the to-be-identified device and that are collected within a plurality of first periodicities, a downlink data amount time series corresponding to the to-be-identified device.
12 . The apparatus according to claim 8 , wherein the instructions further include instructions to:
determine a network traffic feature of a known device based on a second dataset, wherein the second dataset comprises a plurality of pieces of third data, and wherein each piece of third data comprises a data amount of a data packet that is related to the known device and that is collected within one second periodicity; and
generate the device identification model.
13 . The apparatus according to claim 8 , wherein the network traffic feature comprises a data amount distribution feature or a data amount frequency-domain feature.