General interconnection data automatic analysis system, method and device

Abstract

The invention provides a universal interconnection data automatic analysis system, method and device. The system comprises a protocol generation model training module; a training stage protocol description structure generation module. The method comprises the following steps of in the training stage, decoding a compiler calling module; training analysis result acquisition module. The invention creatively provides a real-time high-performance full-automatic network data analysis system. Due to the fact that an automatic learning method is applied to the system, labor cost investment can be greatly reduced, and the system can adapt to continuously emerging new (monitored or analyzed) applications and continuous changes of the applications. Meanwhile, due to decomposition, isolation and compilation of the intermediate structure, the method has extremely high performance and can be widely applied to offline analysis and online analysis. Therefore, the method has wide applicability in IT operation and maintenance, is not only suitable for traditional network performance management, but also suitable for service performance management, and can support scientific and technological financial innovation, 5G application, IoT application and the like.

Description

technical field [0001] The invention relates to the field of network protocol analysis, in particular to a system, method and device for automatic analysis of general interconnection data. Background technique [0002] Network protocol analysis refers to the process of identifying the codes, fields, messages and transactions based on the binary bit stream of the protocol data message captured from the network by integrating various technical means, so as to extract the easy-to-understand information contained in the data stream. of various information. In network protocol analysis, there will be known or public network protocols, as well as unknown or secret communication formats. Network protocol analysis is an important means to monitor and guarantee network performance and manage network performance in IT operation and maintenance. Its applications include monitoring network operation indicators, providing timely alarms and providing fault location; analyzing traffic di...

AI Technical Summary

Problems solved by technology

[0007] 1. It is not considered from the perspective of actual application performance, either the degree of automation is low, or it cannot support the high-performance requirements of real-time processing of operation and maintenance and business monitoring

Early applications such as DPI detection were mainly manual software development or abnormal feature definition, with a low degree of automation

Some methods based on data mining in recent years have a large amount of online calculations, which cannot achieve high performance and meet real-time performance.

Even some relatively fast deep learning methods at runtime are often powerless to analyze gigabytes of traffic in real time, millions of transactions per minute, and dozens of business fields per transaction.

[0008] 2. Even a relatively automated method only provides a static algorithm and cannot automatically iteratively update itself online

Security issues are generally dominated by emergencies, and there is a lack of effective evaluation "indicators" for automatic online iterative updates of algorithms, so these systems have no consideration in this regard at all

[0009] 3. Even relatively automated methods are only isolated algorithms or implementations, with small coverage and lack of scalability

But they are all isolated, unable to be compatible, utilize and integrate the advantages of other algorithms

[0010] 4. In terms of specific implementation, these methods have weak expression ability and limited scope of application

Security issues mainly identify attacks, and the flat processing and identification of key features have met this requirement. Different from the business-oriented precise decoding target, there is a lack of support, design and implementation of substructures, branches, multiple branches, and loops. Considering, therefore, the implementation of the syntax is weak and the scope of application is limited

[0011] 5. Completely rely on reverse, the accuracy is low

The security field is mainly aimed at unknown protocols and confrontation scenarios, and does not use existing information at all, including existing decoders, development specifications, etc. The actual accuracy is low and cannot meet the higher accuracy required by the business system

Images