WO2022268226A1

WO2022268226A1 - Client identification method and apparatus, and storage medium and network device

Info

Publication number: WO2022268226A1
Application number: PCT/CN2022/101550
Authority: WO
Inventors: 林夏娜
Original assignee: 联洲集团有限公司
Priority date: 2021-06-25
Filing date: 2022-06-27
Publication date: 2022-12-29
Also published as: CN113595812A; CN113595812B

Abstract

A client identification method and apparatus, and a storage medium and a network device. The method comprises: when any client is associated with the present network device, acquiring a MAC address of the client; performing searching and matching on the MAC address of the client according to a preset user information table, wherein the user information table comprises MAC addresses of all clients which have been associated with the present network device, and feature information corresponding to each MAC address; when the MAC address of the client is successfully matched, marking the client as successfully identified; and when the MAC address of the client fails to be matched, marking the client as to be tested, and when a data packet sent by the client is received, acquiring feature information of the client according to the data packet, and performing searching and matching on the feature information of the client according to the user information table, and identifying the client according to a matching result.

Description

Client identification method, device, storage medium and network equipment

This application claims the priority of the Chinese patent application No. 202110716012.4 submitted on June 25, 2021, and the content disclosed in the above Chinese patent application is cited in its entirety as a part of this application.

technical field

The embodiments of the present disclosure relate to the technical field of communications, and in particular to a client identification method, device, computer-readable storage medium, and network equipment.

Background technique

A MAC address is an identifier of a network device on the network and is often used to track network devices. In order to protect user privacy, Android, IOS, and Windows systems have begun to provide the function of generating random MAC addresses, which has caused a serious impact on the related functions of network devices that are managed by MAC addresses, such as parental control of routers and QoS priority. Level, IoT and other functions, therefore, in order to avoid the failure of such functions, network devices need to have client identification capabilities.

At present, the commonly used solution is to realize client identification through user behavior characteristics. This solution often requires long-term network behavior tracking of users, such as monitoring the domain name and its frequency in the DNS request information of the user within a day, and the domain name and frequency in the HTTP request information. Information such as URL, User Agent, and frequency. This is because the user's online behavior within a certain period of time has certain randomness. Only after long-term tracking and statistics can a more reliable behavior analysis be obtained.

However, the scheme of identifying through user behavior needs to analyze and count a large number of communication data packets for a long period of time, which cannot achieve rapid identification, and the specific time length cannot determine an appropriate threshold, which affects the network to a certain extent. At the same time, this solution will occupy the relevant resources of the real-time system for a long time, especially in the real-time system equipment, it is necessary to carry out long-term packet capture statistics for users, which may cause network delays, congestion and other consequences, resulting in network equipment failure. Performance drops.

Contents of the invention

The technical problem to be solved by the embodiments of the present disclosure is to provide a client identification method, device, computer-readable storage medium, and network equipment, which can quickly identify the client without substantially affecting the performance of the network equipment, and improve Accuracy of recognition.

In order to solve the above technical problems, an embodiment of the present disclosure provides a client identification method, including:

When any client is associated with the network device, obtain the MAC address of the client;

Search and match the MAC address of the client according to a preset user information table; wherein, the user information table includes MAC addresses of all clients associated with the network device and feature information corresponding to each MAC address;

When the MAC address of the client is successfully matched, marking the client as an identification success;

When the MAC address of the client fails to match, the client is marked to be detected, and when the data packet sent by the client is received, the characteristic information of the client is obtained according to the data packet; The user information table searches and matches the characteristic information of the client, and identifies the client according to the matching result.

Further, the data packet is a first-type data packet, and the characteristic information of the client is the first-type characteristic information of the client;

Then, searching and matching the characteristic information of the client according to the user information table, and identifying the client according to the matching result, specifically includes:

Searching and matching the first type of characteristic information of the client according to the user information table;

When the first type of characteristic information of the client is successfully matched, judging whether there is only one first type of characteristic information in the user information table that successfully matches the first type of characteristic information of the client;

If so, then carry out identification success mark to described client;

If not, when receiving the second type of data packet sent by the client, correspondingly obtain the second type of feature information of the client; match the first type of feature information with the client in the user information table The second type of characteristic information corresponding to the successful first type of characteristic information, search and match the second type of characteristic information of the client, and identify the client according to the matching result; wherein, in the user information table It includes the MAC addresses of all clients associated with the network device and the first-type feature information and second-type feature information corresponding to each MAC address.

Further, the method also includes:

When the matching of the first type of feature information of the client fails, add a new user mark to the client;

Add the MAC address of the client and the characteristic information of the first type to the user information table.

Further, when the matching of the first type of characteristic information of the client fails, adding a new user mark to the client includes:

When the matching of the first type of feature information of the client fails, judging whether the matching duration of the first type of feature information is less than a preset first matching duration threshold or whether the number of matches is less than a preset first matching number threshold;

If so, when receiving the next first-type data packet sent by the client, reacquire the first-type characteristic information of the client, and execute the corresponding first-type characteristic information matching processing scheme until the matching duration is longer than Adding a new user mark to the client until the first matching duration threshold or the number of matching times is not less than the first matching number threshold;

If not, mark the client as adding a new user.

Further, according to the second type of feature information corresponding to the first type of feature information in the user information table that successfully matches the first type of feature information of the client, the second type of feature information of the client is performed Search for a match, and identify the client according to the match result, specifically including:

Searching and matching the second type of feature information of the client according to the second type of feature information corresponding to the first type of feature information in the user information table that successfully matches the first type of feature information of the client;

When the second type of characteristic information of the client is successfully matched, marking the client as an identification success;

When the matching of the second type of characteristic information of the client fails, add a new user mark to the client, and add the MAC address of the client, the first type of characteristic information and the second type of characteristic information to the user information sheet.

Further, when the matching of the second type of feature information of the client fails, adding a new user mark to the client includes:

When the matching of the second feature information of the client fails, it is judged whether the matching duration of the second type of feature information is less than the preset second matching duration threshold or whether the number of matches is less than the preset second matching times threshold;

If so, when receiving the next second-type data packet sent by the client, reacquire the second-type feature information of the client, and execute the corresponding second-type feature information matching processing plan until the matching duration is longer than Adding a new user mark to the client until the second matching duration threshold or the number of matching times is not less than the second matching number threshold;

If not, mark the client as adding a new user.

Further, the first type of data packet is a data packet identifying device information, and the first type of feature information corresponds to device information; the second type of data packet is a data packet identifying user behavior, and the second type of Feature information corresponds to user behavior information;

or,

The first type of data packet is a data packet that identifies user behavior, and the first type of characteristic information corresponds to user behavior information; the second type of data packet is a data packet that identifies device information, and the second type of characteristic information Corresponding to device information.

Further, the data packets identifying device information at least include DHCP data packets, DHCPv6 data packets and Probe Request data packets; the data packets identifying user behavior include at least HTTP data packets and DNS data packets.

Further, after the client's MAC address matches successfully, after the client is successfully identified, the method further includes:

When receiving the data packet sent by the client, acquiring the characteristic information of the client according to the data packet;

Searching and matching the characteristic information of the client according to the user information table;

When the matching of the characteristic information of the client fails, update the characteristic information corresponding to the MAC address that successfully matches the MAC address of the client in the user information table according to the characteristic information of the client.

In order to solve the above technical problems, an embodiment of the present disclosure also provides a client identification device, including:

A MAC address obtaining module, configured to obtain the MAC address of the client when any client is associated with the network device;

The MAC address matching module is used to search and match the MAC address of the client according to the preset user information table; wherein, the user information table includes the MAC addresses of all clients associated with the network device and each MAC address Corresponding feature information;

A MAC address matching success processing module, configured to mark the client as a successful identification when the MAC address of the client is successfully matched;

A MAC address matching failure processing module, configured to mark the client to be detected when the MAC address of the client fails to match, and when receiving the data packet sent by the client, obtain The characteristic information of the client; searching and matching the characteristic information of the client according to the user information table, and identifying the client according to the matching result.

An embodiment of the present disclosure also provides a computer-readable storage medium, the computer-readable storage medium includes a stored computer program; wherein, when the computer program is running, the computer-readable storage medium is controlled by the device where the computer-readable storage medium is located to execute The client identification method described in any one of the above.

An embodiment of the present disclosure also provides a network device, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, when the processor executes the computer program Realize the client identification method described in any one of the above.

Compared with the prior art, the embodiments of the present disclosure provide a client identification method and device, a computer-readable storage medium, and a network device. When any client is associated with the network device, the MAC address of the client is obtained. And search and match the MAC address of the client according to the preset user information table; wherein, the preset user information table includes the MAC addresses of all clients associated with the network device and the characteristic information corresponding to each MAC address; When the MAC address of the client matches successfully, it indicates that the identification of the client is successful, and then the identification success mark is carried out on the client; Detect the mark, and when receiving the data packet sent by the client, obtain the characteristic information of the client according to the data packet, so as to search and match the characteristic information of the client according to the preset user information table, and match the client according to the matching result The client continues to identify; the client is identified through the client's MAC address and related feature information, without occupying system resources for a long time, so that the client can be quickly identified without affecting the performance of the network device, and the identification can be improved. accuracy.

Description of drawings

In order to illustrate the technical solutions of the embodiments of the present disclosure more clearly, the accompanying drawings of the embodiments will be briefly introduced below. Obviously, the drawings described below only relate to some embodiments of the present disclosure, rather than limiting the present disclosure .

FIG. 1 is a flow chart of a preferred embodiment of a client identification method provided by the present disclosure;

Fig. 2 is a structural block diagram of a preferred embodiment of a client identification device provided by the present disclosure;

Fig. 3 is a structural block diagram of a preferred embodiment of a network device provided by the present disclosure.

detailed description

The technical solutions in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present disclosure. Obviously, the described embodiments are only part of the embodiments of the present disclosure, not all of them. example. Based on the embodiments in the present disclosure, all other embodiments obtained by persons of ordinary skill in the art without creative efforts fall within the protection scope of the present invention.

An embodiment of the present disclosure provides a client identification method, as shown in FIG. 1 , which is a flowchart of a preferred embodiment of a client identification method provided by the present disclosure. The method includes steps S11 to S14:

Step S11, when any client is associated with the network device, obtain the MAC address of the client;

Step S12, search and match the MAC address of the client according to the preset user information table; wherein, the user information table includes the MAC addresses of all clients associated with the network device and the feature information corresponding to each MAC address ;

Step S13, when the MAC address of the client matches successfully, marking the client as an identification success;

Step S14, when the MAC address of the client fails to match, mark the client to be detected, and when receiving the data packet sent by the client, obtain the characteristic information of the client according to the data packet ; searching and matching the characteristic information of the client according to the user information table, and identifying the client according to the matching result.

It should be noted that the embodiments of the present disclosure can be executed by any network device associated with a client (such as a router, etc.), and the network device has established a user information table in advance, and the user information table includes at least all The MAC address corresponding to the client and the characteristic information corresponding to each MAC address, that is, there is a corresponding relationship between the client, MAC address and characteristic information. When any client associates with the network device for the first time, the network device The MAC address and feature information corresponding to the client will be added to the user information table, thereby realizing real-time update and maintenance of the user information table.

Specifically, the identification process of the client by the network device is as follows: when any client is associated with the network device, the network device obtains the MAC address of the client, and performs a check on the MAC address of the client according to the preset user information table. Search for a match, and judge whether there is a MAC address matching the MAC address of the client in the user information table; when the MAC address of the client matches successfully, it indicates that there is a MAC address matching the MAC address of the client in the user information table, If the client is identified successfully, then the client will be identified successfully, that is, the client will be marked as "identified successfully"; when the client's MAC address fails to match, it indicates that there is no MAC address with the client in the user information table. If the address matches the MAC address, the client will be marked as "to be detected", that is, the "to be detected" mark will be added to the client, indicating that the client has not been successfully identified, and more relevant feature information needs to be obtained for further identification. Therefore, when the network device receives the data packet sent by the client, it analyzes and obtains the characteristic information of the client according to the received data packet, and searches and matches the obtained characteristic information of the client according to the preset user information table. , judging whether there is characteristic information matching the characteristic information of the client in the user information table, so as to continue to identify the client according to the matching result of the characteristic information of the client.

It should be noted that marking the client is to indicate the current recognition result of the client. For example, "1" can be used to represent the "recognition success" mark, and "0" can be used to represent the "to be detected" mark. Any other symbols are used for marking, and the specific marking method is not specifically limited in this embodiment of the present disclosure.

In addition, the characteristic information of the client may be the original characteristic information carried by the data packet, or the characteristic fingerprint information generated after processing the original characteristic information carried by the data packet. The original feature information is processed, and a new value or vector value is correspondingly generated, which is not specifically limited in this embodiment of the present disclosure.

In the client identification method provided by the embodiments of the present disclosure, the client identification is performed sequentially according to the MAC address and characteristic information of the client. Feature information for continuous identification. When the client’s MAC address fails to match, further identification needs to be carried out based on the client’s feature information; client identification is carried out through the corresponding MAC address of the client and related feature information, and it does not need to take a long time to obtain the client. The behavior characteristics corresponding to the client, that is, there is no need to occupy system resources for a long time, so that the client can be quickly identified without affecting the performance of the network device, and different clients may have the same or similar behavior characteristics, according to the customer The recognition results obtained when identifying the behavior characteristics corresponding to the client are greatly affected by the behavior characteristics, and there is a high possibility of misidentification. However, the MAC addresses and characteristic information corresponding to different clients are different. According to the client The identification result obtained when the corresponding MAC address and feature information is identified is less likely to be misidentified, so that the accuracy of identification can be improved.

In another preferred embodiment, the data packet is a first-type data packet, and the characteristic information of the client is the first-type characteristic information of the client;

If so, then carry out identification success mark to described client;

It should be noted that the data packets sent by the client to the network device can be divided into different types of data packets according to the information they carry, for example, divided into the first type of data packets and the second type of data packets, correspondingly, this The characteristic information of the client obtained by the network device according to the first type of data packet is the first type of characteristic information, the characteristic information of the client obtained according to the second type of data packet is the second type of characteristic information, and the user information table includes at least the associated The MAC addresses corresponding to all the clients of the network device and the first-type characteristic information and the second-type characteristic information corresponding to each MAC address, that is, the client, the MAC address, the first-type characteristic information and the second-type characteristic information There is a corresponding relationship between them.

Specifically, in combination with the above-mentioned embodiments, after the network device marks the client to be detected, when receiving the first type of data packet sent by the client, it correspondingly acquires the The first type of characteristic information of the terminal, and according to the above user information table, search and match the obtained first type of characteristic information of the client, and judge whether there is a first type matching the first type of characteristic information of the client in the above user information table. class feature information; when the client’s first-class feature information matches successfully, it means that there is first-class feature information matching the client’s first-class feature information in the above-mentioned user information table, because the above-mentioned user information table exists There may be more than one first-type characteristic information that matches the first-type characteristic information of the client, so it is necessary to further determine whether there is only one first-type characteristic information that successfully matches the first-type characteristic information of the client in the above user information table ; When there is one and only one first-type feature information in the above-mentioned user information table that matches the first-type feature information of the client, it indicates that the client has been identified successfully, and the client is identified successfully, which is the client. The client adds a "recognition success" mark; when more than one first-type characteristic information in the above user information table matches the first-type characteristic information of the client, the "to be detected" mark of the client is retained, indicating that the client is still If the identification is not successful, it is necessary to obtain more relevant characteristic information for further identification. Therefore, when the network device receives the second type of data packet sent by the client, it will analyze and obtain the client’s information according to the received second type of data packet. The second type of characteristic information of the client, and according to the second type of characteristic information corresponding to the first type of characteristic information that successfully matches the first type of characteristic information of the client in the above user information table, the obtained second type of the client Search and match the type feature information, and determine whether there is a second type feature information corresponding to the client's first type feature information in the user information table that matches the client's first type feature information The second type of characteristic information matched with the characteristic information, so as to continue to identify the client according to the matching result of the second type of characteristic information of the client.

It can be understood that, in the foregoing embodiment, client identification is performed sequentially according to the MAC address of the client, the first type of feature information, and the second type of feature information. The first type of characteristic information and the second type of characteristic information are used for continuous identification; if the MAC address of the client fails to match, further identification needs to be carried out based on the first type of characteristic information of the client; if the first type of characteristic information of the client is successfully matched , and there is more than one first-type characteristic information successfully matched in the user information table, it is necessary to further continue to identify based on the second-type characteristic information of the client.

In yet another preferred embodiment, the method also includes:

When the first type of characteristic information of the client fails to match, the client is marked with a new user;

Specifically, in combination with the above embodiments, when the matching of the first type of characteristic information of the client fails, that is, there is no first type of characteristic information matching the first type of characteristic information of the client in the above user information table, indicating that the client If the terminal is a new user, then add a new user mark to the client, that is, add a "new user" mark to the client, and add the client's MAC address and first-class feature information to the user information table accordingly .

Understandably, if the MAC address of the client fails to match, further identification needs to be carried out based on the first type of feature information of the client; The first type of characteristic information of the client. The client has not been associated with the network device. Compared with the network device, the client is a new user. The address and the first type of feature information are correspondingly added to the user information table maintained by the network device, thereby realizing real-time updating and maintenance of the user information table.

As an improvement of the above solution, when the matching of the first type of feature information of the client fails, the client is marked with a new user, specifically including:

If not, mark the client as adding a new user.

Specifically, in combination with the above-mentioned embodiments, before the first type of feature information of the client is successfully matched, the matching process can be repeated multiple times for the first type of feature information of the client, and the network device presets the first matching duration threshold or the first matching times threshold, so as to limit the time or times of the matching processing flow of the first type of feature information.

Taking the time limit as an example, when the matching of the first type of characteristic information of the client fails, first judge whether the current total matching duration of the first type of characteristic information is less than the preset first matching duration threshold, and if so, it can be received next time When the first type of data packet sent by the client, reacquire the first type of characteristic information of the client, and perform search and matching again according to the reacquired first type of characteristic information of the client, when the first type of characteristic information of the client When the matching fails, judge whether the current total matching duration of the first type of characteristic information is still less than the preset first matching duration threshold, and perform corresponding processing according to the judgment result, and so on, until the current total matching duration of the first type of characteristic information At this time, if the first type of feature information of the client still fails to match, and the current total matching time of the first type of feature information is not less than the preset first matching time threshold , the client is regarded as a new user, and the client is marked as a new user.

Similarly, taking the limit of times as an example, when the client fails to match the first type of feature information, first determine whether the current total number of matching times of the first type of feature information is less than the preset first matching number threshold, and if so, then you can When the first type of data packet sent by the client is received once, the first type of characteristic information of the client is reacquired, and the search and matching is performed again according to the obtained first type of characteristic information of the client. When the matching of the feature information of the first category fails, it is judged whether the current total number of matching times of the feature information of the first category is still less than the preset threshold of the first matching times, and corresponding processing is carried out according to the judgment result, and so on, until the current total number of matching times of the feature information of the first category is Until the total number of matching times is not less than the preset first matching times threshold, at this time, if the first type of feature information of the client still fails to match, and the current total number of matching times of the first type of feature information is not less than the preset first match times threshold, the client is regarded as a new user, and the client is marked as a new user.

In yet another preferred embodiment, according to the second type of feature information corresponding to the first type of feature information in the user information table that successfully matches the first type of feature information of the client, the first type of feature information of the client is The second type of characteristic information is searched and matched, and the client is identified according to the matching result, specifically including:

Specifically, in combination with the above-mentioned embodiment, when the first type of characteristic information of the client is successfully matched, and there is more than one first type of characteristic information in the above user information table, it is necessary to further base on the second type of characteristic information of the client. Therefore, when the network device receives the second-type data packet sent by the client, it analyzes and obtains the second-type characteristic information of the client according to the received second-type data packet, and according to the above-mentioned user The second type of characteristic information corresponding to the first type of characteristic information that successfully matches the first type of characteristic information of the client exists in the information table, search and match the obtained second type of characteristic information of the client, and judge the user information table In the second type of feature information corresponding to the first type of feature information that matches the first type of feature information of the client, whether there is second type of feature information that matches the second type of feature information of the client; When the second type of characteristic information of the client is successfully matched, and among the second type of characteristic information corresponding to the first type of characteristic information that matches the first type of characteristic information of the client in the user information table, there is and only When a second type of characteristic information matches successfully with the second type of characteristic information of the client, it indicates that the client is successfully identified, and then the client is identified as a successful mark, that is, the client is marked as "recognized successfully"; when the client When the matching of the second type of feature information of the client fails, that is, the second type of feature information corresponding to the first type of feature information in the user information table that matches the first type of feature information of the client does not exist. If the second type of feature information matches the second type of feature information of the terminal, indicating that the client is a new user, then the client is marked as a new user, that is, the client is marked with "new user", and the The MAC address of the client, the first type of feature information and the second type of feature information are correspondingly added to the user information table.

It can be understood that if the client's second-type feature information matches successfully, it indicates that the client is successfully identified; if the client's second-type feature information also fails to match, it means that the client's second-type Feature information, the client has not been associated with this network device, and this client is a new user compared to this network device, then add a new user mark to this client, and add the MAC address of the client, the first class The feature information and the second type of feature information are correspondingly added to the user information table maintained by the network device, thereby realizing real-time updating and maintenance of the user information table.

It should be noted that, in the case that the second type of characteristic information of the client is successfully matched, if the second type of characteristic information corresponding to the first type of characteristic information matching the first type of characteristic information of the client exists in the user information table Among the feature information, if there is more than one second-type feature information that matches the second-type feature information of the client, then the third-type feature information corresponding to the third-type data packet sent by the client can be combined with the client. The client continues to identify. Correspondingly, the network device can identify the client in turn according to the client's MAC address, the first type of characteristic information, the second type of characteristic information and the third type of characteristic information. When performing client identification, The more types of characteristic information used, the better the recognition effect. The specific recognition principle of each type of characteristic information is the same as that of the above embodiment, and will not be repeated here.

As an improvement of the above solution, when the matching of the second type of feature information of the client fails, add a new user mark to the client, specifically including:

When the matching of the second feature information of the client fails, judging whether the matching duration of the second type of feature information is less than a preset second matching duration threshold or whether the number of matches is less than a preset second matching times threshold;

If not, mark the client as adding a new user.

Specifically, in combination with the above embodiment, before the second type of feature information of the client is successfully matched, the matching process can be repeated multiple times for the second type of feature information of the client, and the network device presets the second matching duration threshold or a second matching times threshold, so as to limit the time or times of the matching processing flow of the second type of characteristic information.

Taking the time limit as an example, when the matching of the second type of characteristic information of the client fails, first judge whether the current total matching duration of the second type of characteristic information is less than the preset second matching duration threshold, and if so, it can be received next time When the second type of data packet is sent by the client, reacquire the second type of characteristic information of the client, and perform search and matching again according to the reacquired second type of characteristic information of the client, when the second type of characteristic information of the client When the matching fails, judge whether the current total matching duration of the second type of characteristic information is still less than the preset second matching duration threshold, and perform corresponding processing according to the judgment result, and so on, until the current total matching duration of the second type of characteristic information At this time, if the second type of characteristic information of the client still fails to match, and the current total matching duration of the second type of characteristic information is not less than the preset second matching duration threshold , the client is regarded as a new user, and the client is marked as a new user.

Similarly, taking the limit of times as an example, when the client fails to match the second type of feature information, first determine whether the current total number of matching times of the second type of feature information is less than the preset second matching times threshold, and if so, you can use the following When the second type of data packet sent by the client is received once, the second type of characteristic information of the client is reacquired, and the second type of characteristic information of the client is searched and matched again. When the matching of the characteristic information of the second type fails, it is judged whether the current total matching times of the characteristic information of the second type is still less than the preset threshold of the second matching times, and corresponding processing is carried out according to the judgment result, and so on until the current total number of matching times of the characteristic information of the second type is Until the total number of matching times is not less than the preset second matching times threshold, at this time, if the second type of feature information of the client still fails to match, and the current total number of matching times of the second type of feature information is not less than the preset second match times threshold, the client is regarded as a new user, and the client is marked as a new user.

In yet another preferred embodiment, the first type of data packet is a data packet identifying device information, and the first type of feature information corresponds to device information; the second type of data packet is a data packet identifying user behavior, The second type of feature information corresponds to user behavior information;

or,

Specifically, in combination with the above embodiments, according to the actual communication between the network device and the associated client, the data packet sent by the client to the network device includes at least a data packet identifying device information and a data packet identifying user behavior. Therefore, the first type of data packet can be a data packet identifying device information, or a data packet identifying user behavior. Correspondingly, the first type of characteristic information obtained by the network device according to the first type of data packet can be the corresponding The device information can also be the user behavior information corresponding to the client. Similarly, the second type of data packet can be the data packet identifying the device information, or the data packet identifying the user behavior. Correspondingly, the network device according to the first The second-type characteristic information obtained by the second-type data packet may be device information corresponding to the client, or user behavior information corresponding to the client.

As an improvement of the above solution, the data packets identifying device information at least include DHCP data packets, DHCPv6 data packets and Probe Request data packets; the data packets identifying user behavior include at least HTTP data packets and DNS data packets.

Specifically, in combination with the above-mentioned embodiment, the data packet identifying the device information at least includes a DHCP data packet, a DHCPv6 data packet, and a Probe Request data packet carrying the device information of the client. Device information corresponds to DHCP feature information, DHCPv6 feature information, and Probe Request feature information; data packets identifying user behavior include at least HTTP data packets and DNS data packets that reflect user behavior information of the client. The user behavior information obtained from the data corresponds to HTTP feature information and DNS feature information.

It should be noted that the DHCP feature information includes IP frame length, Vendor Class Identifier, TTL, etc., the DHCPv6 feature information includes Link-layer address, DUID, etc., and the Probe Request feature information includes SSID Parameter set, Supported Rates, VHT Capabilities, etc. , HTTP feature information includes User Agent, Cookie, URL, Host and other information, DNS feature information includes Queries and other information.

In yet another preferred embodiment, after the client's MAC address matches successfully, after marking the client as a successful identification, the method further includes:

Specifically, in combination with the above-mentioned embodiments, after the client is identified according to the MAC address of the client, when the network device receives the data packet (such as the first type of data packet or the second type of data packet) sent by the client According to the received data packet, the corresponding characteristic information of the client (for example, the first type of characteristic information or the second type of characteristic information) is correspondingly obtained, and the characteristic information of the client is searched and matched according to the above user information table, and the user is judged Whether there is characteristic information matching the characteristic information of the client in the information table, when the matching of the characteristic information of the client fails, it indicates that there is no characteristic information matching the characteristic information of the client in the user information table, but, due to the The client has successfully matched the MAC address, and there is a MAC address that successfully matches the client's MAC address and feature information corresponding to the successful MAC address in the user information table, indicating that the successful match exists in the user information table. The characteristic information corresponding to the MAC address does not match the characteristic information obtained according to the received data packet sent by the client. Therefore, it is necessary to perform corresponding matching on the characteristic information corresponding to the successfully matched MAC address existing in the user information table. The updating process is to replace the characteristic information corresponding to the successfully matched MAC address in the user information table with the characteristic information obtained according to the received data packet sent by the client.

Embodiments of the present disclosure also provide a client identification device, as shown in FIG. 2 , which is a structural block diagram of a preferred embodiment of a client identification device provided by the present disclosure. The device includes:

MAC address acquisition module 11, used for acquiring the MAC address of the client when any client is associated with the network device;

The MAC address matching module 12 is configured to search and match the MAC address of the client according to a preset user information table; wherein, the user information table includes the MAC addresses of all clients associated with the network device and each MAC address The characteristic information corresponding to the address;

MAC address matching success processing module 13, used for when the MAC address of the client is successfully matched, mark the client as successful identification;

MAC address matching failure processing module 14, for when the MAC address of the client fails to match, mark the client to be detected, and when receiving the data packet sent by the client, according to the data packet Obtaining the characteristic information of the client; searching and matching the characteristic information of the client according to the user information table, and identifying the client according to the matching result.

Preferably, the data packet is a first-type data packet, and the characteristic information of the client is the first-type characteristic information of the client;

Then, the MAC address matching failure processing module 14 specifically includes:

a first feature matching unit, configured to search and match the first type of feature information of the client according to the user information table;

A first feature matching successful processing unit, configured to determine whether the first type of feature information in the user information table successfully matches the first type of feature information of the client when the first type of feature information of the client is successfully matched. only one;

The client marking unit is configured to mark the client successfully if it is identified;

The second feature matching unit is configured to, if not, correspondingly obtain the second type of feature information of the client when receiving the second type of data packet sent by the client; according to the user information table and the described The first type of feature information of the client matches the second type of feature information corresponding to the first type of feature information successfully, searching and matching the second type of feature information of the client, and identifying the client according to the matching result; Wherein, the user information table includes the MAC addresses of all clients associated with the network device and the first-type feature information and the second-type feature information corresponding to each MAC address.

Preferably, the MAC address matching failure processing module 14 also includes:

The first feature matching failure processing unit is configured to add a new user mark to the client when the first type of feature information of the client fails to match; add the client's MAC address and the first type of feature information to the In the user information table.

Preferably, the first feature matching failure processing unit is specifically configured to:

If not, mark the client as adding a new user.

Preferably, the second feature matching unit specifically includes:

The second feature matching subunit is configured to, according to the second type of feature information corresponding to the first type of feature information in the user information table that successfully matches the first type of feature information of the client, to the second type of the client. Class feature information for search and matching;

The second feature matching success processing subunit is configured to mark the client as an identification success when the second type of feature information of the client is successfully matched;

The second characteristic matching failure processing subunit is used to add a new user mark to the client when the matching of the second type of characteristic information of the client fails, and add the MAC address of the client, the first type of characteristic information And the second type of feature information is added to the user information table.

Preferably, the second feature matching failure processing subunit is specifically used for:

If not, mark the client as adding a new user.

Preferably, the first type of data packet is a data packet identifying device information, and the first type of feature information corresponds to device information; the second type of data packet is a data packet identifying user behavior, and the second type of feature information corresponds to device information; Feature information corresponds to user behavior information;

or,

Preferably, the data packets identifying device information at least include DHCP data packets, DHCPv6 data packets and Probe Request data packets; the data packets identifying user behavior include at least HTTP data packets and DNS data packets.

Preferably, the device also includes:

A characteristic information acquisition module, configured to acquire characteristic information of the client according to the data packet when receiving the data packet sent by the client;

A characteristic information matching module, configured to search and match the characteristic information of the client according to the user information table;

A feature information update module, configured to perform feature information corresponding to a MAC address in the user information table that matches successfully with the MAC address of the client according to the feature information of the client when the match of the feature information of the client fails. update processing.

The client identification device provided by the embodiments of the present disclosure can realize all the processes of the client identification method described in any of the above embodiments, the functions of each module, unit, and subunit in the device, and the achieved technical effects The functions and technical effects achieved by the client identification method described in the above embodiments are correspondingly the same, and will not be repeated here.

An embodiment of the present disclosure also provides a computer-readable storage medium, the computer-readable storage medium includes a stored computer program; wherein, when the computer program is running, the computer-readable storage medium is controlled by the device where the computer-readable storage medium is located to execute The client identification method described in any one of the above embodiments.

Embodiments of the present disclosure also provide a network device, as shown in FIG. 3 , which is a structural block diagram of a preferred embodiment of a network device provided by the present disclosure. In the memory 20 and configured as a computer program executed by the processor 10, the processor 10 implements the client identification method described in any of the above embodiments when executing the computer program.

Preferably, the computer program can be divided into one or more modules/units (such as computer program 1, computer program 2, ...), and the one or more modules/units are stored in the stored in the memory 20 and executed by the processor 10 to complete the present invention. The one or more modules/units may be a series of computer program instruction segments capable of accomplishing specific functions, and the instruction segments are used to describe the execution process of the computer program in the network device.

The processor 10 can be a central processing unit (Central Processing Unit, CPU), and can also be other general-purpose processors, digital signal processors (Digital Signal Processor, DSP), application specific integrated circuits (Application Specific Integrated Circuit, ASIC), Field-Programmable Gate Array (Field-Programmable Gate Array, FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc., the general-purpose processor can be a microprocessor, or the processor 10 can also be It is any conventional processor, and the processor 10 is the control center of the network device, using various interfaces and lines to connect various parts of the network device.

The memory 20 mainly includes a program storage area and a data storage area, wherein the program storage area can store an operating system, an application program required by at least one function, etc., and the data storage area can store related data and the like. In addition, the memory 20 can be a high-speed random access memory, or a non-volatile memory, such as a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card and a flash memory Card (Flash Card), etc., or the memory 20 can also be other volatile solid-state storage devices.

It should be noted that the above-mentioned network equipment may include, but not limited to, a processor and a memory. Those skilled in the art may understand that the structural block diagram in FIG. 3 is only an example of the above-mentioned network equipment and does not constitute a limitation on the network equipment. More or fewer components than shown, or combinations of certain components, or different components.

To sum up, the client identification method, device, computer-readable storage medium, and network device provided by the embodiments of the present disclosure have the following beneficial effects:

(1) It does not need to occupy system resources for a long time, and can quickly identify clients without affecting the performance of network equipment;

(2) Combining multiple types of feature information of the client for client identification has a better recognition effect than identification based on a single feature information;

(3) It has high identification accuracy and can be used to assist network devices to perform normal functions related to rule management through MAC addresses, such as parental control, QoS priority, IoT and other functions in router products.

The above descriptions are only preferred implementations of the present disclosure. It should be pointed out that for those of ordinary skill in the art, some improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications It should also be regarded as the protection scope of the present invention.

Claims

A client identification method, characterized in that, comprising:

When any client is associated with the network device, obtain the MAC address of the client;

Search and match the MAC address of the client according to a preset user information table; wherein, the user information table includes MAC addresses of all clients associated with the network device and feature information corresponding to each MAC address;

When the MAC address of the client is successfully matched, marking the client as an identification success;

When the MAC address of the client fails to match, the client is marked to be detected, and when the data packet sent by the client is received, the characteristic information of the client is obtained according to the data packet; The user information table searches and matches the characteristic information of the client, and identifies the client according to the matching result.
The client identification method according to claim 1, wherein the data packet is a first-type data packet, and the characteristic information of the client is the first-type characteristic information of the client;

Then, searching and matching the characteristic information of the client according to the user information table, and identifying the client according to the matching result, specifically includes:

Searching and matching the first type of characteristic information of the client according to the user information table;

When the first type of characteristic information of the client is successfully matched, judging whether there is only one first type of characteristic information in the user information table that successfully matches the first type of characteristic information of the client;

If so, then carry out identification success mark to described client;

If not, when receiving the second type of data packet sent by the client, correspondingly obtain the second type of feature information of the client; match the first type of feature information with the client in the user information table The second type of characteristic information corresponding to the successful first type of characteristic information, search and match the second type of characteristic information of the client, and identify the client according to the matching result; wherein, in the user information table It includes the MAC addresses of all clients associated with the network device and the first-type feature information and second-type feature information corresponding to each MAC address.
The client identification method according to claim 2, wherein the method further comprises:

When the matching of the first type of feature information of the client fails, add a new user mark to the client;

Add the MAC address of the client and the characteristic information of the first type to the user information table.
The client identification method according to claim 3, wherein when the matching of the first type of characteristic information of the client fails, adding a new user mark to the client, specifically comprising:

When the matching of the first type of feature information of the client fails, judging whether the matching duration of the first type of feature information is less than a preset first matching duration threshold or whether the number of matches is less than a preset first matching number threshold;

If so, when receiving the next first-type data packet sent by the client, reacquire the first-type characteristic information of the client, and execute the corresponding first-type characteristic information matching processing scheme until the matching duration is longer than Adding a new user mark to the client until the first matching duration threshold or the number of matching times is not less than the first matching number threshold;

If not, mark the client as adding a new user.
The client identification method according to claim 2, wherein, according to the second type of feature corresponding to the first type of feature information in the user information table that successfully matches the first type of feature information of the client, Information, search and match the second type of characteristic information of the client, and identify the client according to the matching result, specifically including:

Searching and matching the second type of feature information of the client according to the second type of feature information corresponding to the first type of feature information in the user information table that successfully matches the first type of feature information of the client;

When the second type of characteristic information of the client is successfully matched, marking the client as an identification success;

When the matching of the second type of characteristic information of the client fails, add a new user mark to the client, and add the MAC address of the client, the first type of characteristic information and the second type of characteristic information to the user information sheet.
The client identification method according to claim 5, wherein when the matching of the second type of characteristic information of the client fails, adding a new user mark to the client, specifically comprising:

When the matching of the second feature information of the client fails, it is judged whether the matching duration of the second type of feature information is less than the preset second matching duration threshold or whether the number of matches is less than the preset second matching times threshold;

If so, when receiving the next second-type data packet sent by the client, reacquire the second-type feature information of the client, and execute the corresponding second-type feature information matching processing plan until the matching duration is longer than Adding a new user mark to the client until the second matching duration threshold or the number of matching times is not less than the second matching number threshold;

If not, mark the client as adding a new user.
The client identification method according to claim 2, wherein the first type of data packet is a data packet identifying device information, and the first type of characteristic information corresponds to device information; the second type of data packet It is a data packet identifying user behavior, and the second type of feature information corresponds to user behavior information;

or,

The first type of data packet is a data packet that identifies user behavior, and the first type of characteristic information corresponds to user behavior information; the second type of data packet is a data packet that identifies device information, and the second type of characteristic information Corresponding to device information.
The client identification method according to claim 7, wherein the data packet identifying device information at least includes a DHCP data packet, a DHCPv6 data packet and a Probe Request data packet; the data packet identifying user behavior includes at least an HTTP packets and DNS packets.
The client identification method according to any one of claims 1 to 8, characterized in that, after the client's MAC address is successfully matched, after the client is identified successfully, the method further include:

When receiving the data packet sent by the client, acquiring the characteristic information of the client according to the data packet;

Searching and matching the characteristic information of the client according to the user information table;

When the matching of the characteristic information of the client fails, update the characteristic information corresponding to the MAC address that successfully matches the MAC address of the client in the user information table according to the characteristic information of the client.
A client identification device, characterized in that it comprises:

A MAC address obtaining module, configured to obtain the MAC address of the client when any client is associated with the network device;

The MAC address matching module is used to search and match the MAC address of the client according to the preset user information table; wherein, the user information table includes the MAC addresses of all clients associated with the network device and each MAC address Corresponding feature information;

A MAC address matching success processing module, configured to mark the client as an identification success when the MAC address of the client is successfully matched;

A MAC address matching failure processing module, configured to mark the client to be detected when the MAC address of the client fails to match, and when receiving the data packet sent by the client, obtain The characteristic information of the client; searching and matching the characteristic information of the client according to the user information table, and identifying the client according to the matching result.
A computer-readable storage medium, characterized in that the computer-readable storage medium includes a stored computer program; wherein, when the computer program is running, the computer-readable storage medium is controlled by the device where the computer-readable storage medium is located to perform the process described in claim 1. The client identification method described in any one of ~9.
A network device, characterized by comprising a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, when the processor executes the computer program, it realizes the The client identification method described in any one of 1 to 9