物联网设备识别及异常检测研究综述  

Survey on IoT Device Identification and Anomaly Detection

作　　者：樊琳娜 李城龙[1] 吴毅超 段晨鑫 王之梁[1,2] 林海 杨家海[1,2] FAN Lin-Na;LI Cheng-Long;WU Yi-Chao;DUAN Chen-Xin;WANG Zhi-Liang;LIN Hai;YANG Jia-Hai(Institute for Network Sciences and Cyberspace,Tsinghua University,Beijing 100084,China;Beijing National Research Center for Information Science and Technology,Beijing 100084,China;College of Information and Communication,National University of Defense Technology,Wuhan 430019,China)

机构地区：[1]清华大学网络科学与网络空间研究院,北京100084 [2]北京信息科学与技术国家研究中心,北京100084 [3]国防科技大学信息通信学院,湖北武汉430019

出　　处：《软件学报》2024年第1期288-308,共21页Journal of Software

基　　金：国家自然科学基金(62172251);国家重点研发计划(2018YFB1800204)。

摘　　要：随着物联网技术的发展,物联网设备广泛应用于生产和生活的各个领域,但也为设备资产管理和安全管理带来了严峻的挑战.首先,由于物联网设备类型和接入方式的多样性,网络管理员通常难以得知网络中的物联网设备类型及运行状态.其次,物联网设备由于其计算、存储资源有限,难以部署传统防御措施,正逐渐成为网络攻击的焦点.因此,通过设备识别了解网络中的物联网设备并基于设备识别结果进行异常检测,以保证其正常运行尤为重要.近几年来,学术界围绕上述问题开展了大量的研究.系统地梳理物联网设备识别和异常检测方面的相关工作.在设备识别方面,根据是否向网络中发送数据包,现有研究可分为被动识别方法和主动识别方法.针对被动识别方法按照识别方法、识别粒度和应用场景进行进一步的调研,针对主动识别方法按照识别方法、识别粒度和探测粒度进行进一步的调研.在异常检测方面,按照基于机器学习算法的检测方法和基于行为规范的规则匹配方法进行梳理.在此基础上,总结物联网设备识别和异常检测领域的研究挑战并展望其未来发展方向.With the development of Internet of Things(IoT)technology,IoT devices are widely applied in many areas of production and life.However,IoT devices also bring severe challenges to equipment asset management and security management.Firstly,Due to the diversity of IoT device types and access modes,it is often difficult for network administrators to know the IoT device types and operating status in the network.Secondly,IoT devices are becoming the focus of cyber attacks due to their limited computing and storage resources,which makes it difficult to deploy traditional defense measures.Therefore,it is important to acknowledge the IoT devices in the network through device identification and detect anomalies based on the device identification results,so as to ensure the normal operation of IoT devices.In recent years,academia has carried out a lot of research on the above issues.This study systematically reviews the work related to IoT device identification and anomaly detection.In terms of device identification,existing research can be divided into passive identification methods and active identification methods according to whether data packets are sent to the network.The passive identification methods are further investigated according to the identification method,identification granularity,and application scenarios.The study also investigates the active identification methods according to the identification method,identification granularity,and detection granularity.In terms of anomaly detection,the existing work can be divided into detection methods based on machine learning algorithms and rule-matching methods based on behavioral norms.On this basis,challenges in IoT device identification and anomaly detection are summarized,and the future development direction is proposed.

关 键 词：物联网 设备识别 异常检测 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]