Power system protocol analysis method and system based on association rule analysis and sequence comparison

Abstract

The invention discloses a power system protocol analysis method and system based on association rule analysis and sequence alignment, particularly relates to the field of private protocol analysis, is used for solving the problems of dynamic field feature extraction and boundary recognition, and aims at extracting features of dynamic fields through separation of static fields and the dynamic fields. Then, hidden frequent items and associated features are mined by using an association rule algorithm, so that dynamic fields are displayed in a structured manner in a feature matrix, which becomes the basis of subsequent clustering and inference. The feature matrix is clustered through a DBSCAN algorithm, protocol formats are classified, noise and abnormal data are processed, and a preliminary format is provided for field boundary recognition. According to the method, the Nedleman-Wunsch sequence comparison and information entropy verification technology is combined, the boundary position is accurately identified, the fuzzy field is dynamically adjusted by using the field boundary ambiguity index and the sequence alignment error correction index, and finally, the boundary division precision is enhanced through mutual information correction, so that the accuracy and processing efficiency of protocol analysis are improved, and the method is suitable for popularization and application. And automatic analysis of a complex protocol is realized.

Description

Technical Field

[0001] The present invention relates to the field of private protocol analysis, and more specifically, to a method and system for analyzing power system protocols based on association rule analysis and sequence comparison. Background Art

[0002] With the integration of the Internet and industrial control networks, the relatively closed environment of industrial control systems faces new security challenges. Since the network design of industrial control systems is based on the premise of physical isolation, network security protection is not fully considered, which provides opportunities for potential attackers. Industrial networks usually use specific private communication protocols in the communication process. Understanding the design details of these private protocols is crucial to improving the security of industrial control systems and can help users take effective protective measures. Since the specifications of private protocols are not public, protocol reverse engineering becomes a necessary means to understand their design details. Protocol reverse engineering extracts the protocol format used in the communication process by monitoring and analyzing the network messages of the protocol entity without relying on the protocol description. This process can not only help researchers and industrial enterprises understand the details of the protocol, but also discover potential vulnerabilities in the protocol design and formulate targeted preventive measures to improve the security of industrial systems.

[0003] In recent years, cyber attacks in the power sector have continued to increase, and the security situation of power industrial control networks remains severe. With the gradual construction of new power systems, the scale of power grid equipment has continued to expand, and a large number of intelligent terminal devices, such as distribution DTUs and FTUs, have been connected to the distribution network. These devices are relatively new in technology, have a short period of large-scale application, and the protection mechanism of the communication protocol is relatively weak. It is urgent to effectively identify and analyze the private communication protocols in the new power system to improve the efficiency of automated analysis of private protocols. Based on the reference test of the MODBUS protocol commonly used in power systems, an efficient method is proposed to verify the accuracy and performance of the method.

[0004] The existing technology has deficiencies in protocol feature recognition. The existing protocol feature extraction mainly relies on the classic Apriori algorithm, which requires frequent scanning of the original data set and has low efficiency. In addition, the extracted protocol features have not been further analyzed, which affects the accuracy of protocol reversal. In protocol format extraction, the multiple sequence alignment algorithm can effectively infer the protocol format, but it will insert blank characters during the alignment process, reducing the accuracy of protocol format inference. In order to improve the accuracy of protocol format inference, it is urgent to introduce a new processing flow for optimization.

[0005] In order to solve the above problems, a technical solution is now provided. Summary of the invention

[0006] In order to overcome the above-mentioned defects of the prior art, the present invention provides a power system protocol analysis method based on association rule analysis and sequence alignment. Through the precise separation of static fields and dynamic fields, the feature extraction of dynamic fields is optimized. The association rule algorithm deeply explores the hidden frequent items and associated features, so that the features of dynamic fields can be displayed in a structured manner in the feature matrix, which becomes the basis for subsequent clustering and inference. On this basis, the clustering operation of the feature matrix classifies and integrates the protocol format through the DBSCAN algorithm, processes the noise and abnormal data in the protocol, and provides a more accurate preliminary format for the subsequent field boundary identification. Combined with the Needleman-Wunsch sequence alignment and information entropy verification technology, the boundary position is accurately identified, and the fuzzy field is dynamically adjusted through the field boundary fuzziness index and the sequence alignment error correction index. The mutual information correction mechanism further enhances the accuracy of field division, ensures the accuracy of the entire protocol format inference and the efficiency of processing, thereby improving the parsing ability of complex protocols and realizing an automated and accurate processing process to solve the problems raised in the above background technology.

[0007] Another aspect of the present invention provides a power system protocol analysis system based on association rule analysis and sequence comparison.

[0008] To achieve the above object, the present invention provides the following technical solutions: A power system protocol analysis method based on association rule analysis and sequence comparison, comprising: Obtain private protocol data packets from real-time data packets and offline data packets in industrial network data packets.

[0009] Based on the traffic division of simple sequence alignment, the data in the acquired private protocol data packet is separated into static fields and dynamic fields by field, and the feature information in the dynamic field is extracted and encapsulated as feature data to generate a feature matrix.

[0010] The feature matrix is ​​clustered to form a cluster set in a protocol format.

[0011] A global sequence alignment is performed on the clustered protocol format set to generate a preliminary set of field boundaries. The boundary positions are verified based on information entropy. The entropy difference of adjacent fields is calculated, and the ambiguity of field boundaries and the comprehensive analysis of sequence alignment errors are combined to dynamically adjust the field boundary positions identified as highly ambiguous until the entropy difference and the entropy value change rate meet the optimization criteria.

[0012] In a preferred embodiment, the traffic division based on simple sequence alignment separates the data in the acquired private protocol data packet into static fields and dynamic fields by field, extracts feature information in the dynamic field, encapsulates the feature information into feature data, and generates a feature matrix, which specifically includes the following contents: The data in the acquired private protocol data packet is serialized in byte order: the contents of each field of the data in each data packet are converted into a continuous byte stream representation.

[0013] A simple sequence alignment algorithm is used to compare multiple private protocol data packets byte by byte to determine whether the values ​​in all data packets at the same byte position are exactly the same; for byte positions that are consistent in all data packets, they are marked as static fields; for byte positions that change in different data packets, they are marked as dynamic fields, by constructing a character set set, each set contains the value at the same byte position, if the set size is 1, the corresponding byte position is a static field, if the set size is greater than 1, it is a dynamic field; finally, a field classification matrix is ​​output, and each position in the matrix is ​​marked as a static field or a dynamic field.

[0014] After separating the dynamic fields, the association rule algorithm is applied to mine frequent item sets in the dynamic fields. First, the positions of all dynamic fields are numbered, and the content of each dynamic field is regarded as an item. The Apriori algorithm is used to identify frequently occurring item sets in the dynamic fields. The specific steps include: scanning the data of the dynamic fields, counting the frequency of occurrence of each field, and filtering out frequent item sets that meet the minimum support. Then, strong association rules are generated based on the identified frequent item sets, and the relationship between each dynamic field and the corresponding association features is recorded.

[0015] Based on the results of frequent item set mining, determine the associated features of each dynamic field; associate the field position corresponding to each frequent item set with its feature information and encapsulate it as feature data; The extracted feature information is encapsulated into a two-dimensional matrix to generate a feature matrix.

[0016] In a preferred embodiment, the clustering process of the feature matrix to form a clustering set in a protocol format specifically includes the following contents: All rows are extracted from the generated feature matrix as data points, and each row corresponds to the feature of a private protocol data packet.

[0017] The clustering process uses the DBSCAN algorithm and sets the core parameters of neighborhood radius and minPts. The neighborhood radius represents the range of the neighborhood centered on the data point, that is, calculating the maximum distance of other data points affected by a data point. MinPts represents the minimum number of data points that need to be included in the corresponding neighborhood to calculate the core point.

[0018] The feature matrix is ​​clustered using the set DBSCAN parameters. For each data point, i.e., the feature of each private protocol data packet, its distance from other surrounding data points is calculated to determine whether it falls within the neighborhood radius, and whether it meets the core point condition based on the minPts parameter. If a data point meets the core point condition, the corresponding data point and all data points in its neighborhood are grouped into one cluster, and the data points in this cluster are recursively processed until all data points are marked as core points or noise points. The clustering results output multiple clusters, each of which represents a protocol format with similar dynamic field features.

[0019] After clustering, the results of each cluster are numbered in sequence, and each number corresponds to a group of similar private protocol data packets; for each data point in each cluster, only its position and feature information in the feature matrix are recorded, and the clustering results are stored as a set of numbered feature matrices, each set representing a protocol format category; each clustering result is numbered and output as a cluster set in the protocol format.

[0020] In a preferred embodiment, the clustered protocol format set is subjected to global sequence alignment to generate a preliminary set of field boundaries, the boundary position is verified based on information entropy, the entropy difference of adjacent fields is calculated, and the fuzziness of the field boundary and the comprehensive analysis of the sequence alignment error are combined to dynamically adjust the field boundary position identified as highly ambiguous until the entropy difference and the entropy value change rate meet the optimization criteria, which specifically includes the following contents: From the generated protocol format clustering set, a set of protocol data packets with similar dynamic field features is extracted and used as input for sequence alignment using the Needleman-Wunsch algorithm. Through global alignment, the fields in the protocol message are aligned to generate an aligned sequence alignment result. The output of the sequence alignment is the set of field boundaries in the protocol data packet.

[0021] After the sequence alignment results are generated, the boundary positions of each field in the protocol message are preliminarily determined based on the aligned field positions; through the alignment results of the Needleman-Wunsch algorithm, the fields are preliminarily divided according to the aligned sequences, and a preliminary set of field boundary positions is generated.

[0022] Use information entropy technology to verify the field boundary positions obtained by sequence alignment; the output is a set of field boundaries after information entropy verification.

[0023] The field boundaries that have been verified by information entropy are analyzed to evaluate the boundary ambiguity and sequence alignment error. The field boundary ambiguity index is used to quantify the degree of ambiguity of the field boundary. At the same time, the alignment error of the protocol field during the comparison process is analyzed in combination with the sequence alignment error correction index.

[0024] In a preferred embodiment, the logic for obtaining the field boundary fuzziness index is as follows: For each field boundary in the protocol message, first calculate its information entropy; suppose the protocol message sequence is , where each Represents a field or part of a field in a message; field The information entropy of is defined as: ;in, Representation field The set of values ​​in For Field Internal symbol Probability of occurrence.

[0025] Capture the fuzziness at the field boundary and calculate the entropy difference of the adjacent fields on both sides of each field boundary; let the field and The boundary is , then the entropy difference between adjacent fields is calculated as: .

[0026] Capture boundary fuzziness, calculate the gradient change rate of field entropy value at the boundary, and calculate field The gradient of the boundaries on both sides is: .

[0027] Based on the comprehensive analysis of entropy difference and entropy gradient, the field boundary fuzziness index is calculated As a quantitative indicator of boundary fuzziness, the formula of fuzziness index is as follows: ;in, A small constant to prevent the denominator from being zero.

[0028] In a preferred embodiment, the logic for obtaining the sequence alignment error correction index is as follows: For each field , calculate the offset introduced during the comparison process , that is, the difference in the starting position of the field before and after the comparison: ;in, and Represents the fields separately The starting position before and after the comparison.

[0029] For each adjacent field and , calculate the misalignment distance between the two after comparison , indicating the relative position difference between two fields in the comparison result: .

[0030] In order to capture the changing trend of the misalignment between fields, the gradient change rate of the misalignment distance is calculated; let the field The offset distance between the adjacent fields before and after is and , then the gradient change rate is: ; Gradient change rate Indicates the fluctuation of the misalignment distance.

[0031] Combine the field offset, misalignment distance, and gradient change rate to calculate the sequence alignment error correction index Used to quantify the alignment error, the formula is as follows: ;in, is a constant that prevents the denominator from being zero.

[0032] In a preferred embodiment, the clustered protocol format set is subjected to global sequence alignment to generate a preliminary set of field boundaries, the boundary position is verified based on information entropy, the entropy difference of adjacent fields is calculated, and the fuzziness of the field boundary and the comprehensive analysis of the sequence alignment error are combined to dynamically adjust the field boundary position identified as highly ambiguous until the entropy difference and the entropy value change rate meet the optimization criteria, and also includes the following contents: The field boundary ambiguity index and sequence alignment error correction index are standardized, and the protocol complexity control coefficient is obtained by weighted summation.

[0033] The mode is selected according to the size of the protocol complexity control coefficient: when the protocol complexity control coefficient exceeds the preset critical value, the enhanced correction mode needs to be enabled to generate a high ambiguity signal.

[0034] In a preferred embodiment, the clustered protocol format set is subjected to global sequence alignment to generate a preliminary set of field boundaries, the boundary position is verified based on information entropy, the entropy difference of adjacent fields is calculated, and the fuzziness of the field boundary and the comprehensive analysis of the sequence alignment error are combined to dynamically adjust the field boundary position identified as highly ambiguous until the entropy difference and the entropy value change rate meet the optimization criteria, and also includes the following contents: After obtaining the analysis results of boundary fuzziness and alignment error, the information entropy value of the field boundary with high fuzzy signal is recalculated, and the information entropy value of each field is set to , the entropy difference between adjacent fields ;when Less than ,Right now , indicating that the corresponding boundary is fuzzy; for the judgment of the change trend, the entropy change rate of the adjacent fields is calculated ;when The absolute difference from 1 is less than or equal to the preset threshold, indicating that the entropy value changes steadily, that is, the field boundary changes are not obvious. The specific method of dynamic adjustment is to shift the field boundary position by the rated unit amplitude, and gradually adjust the position of the field boundary position until Exceed ,and The absolute difference from 1 is greater than the preset threshold, indicating that the field boundary position has been adjusted to the required purpose.

[0035] For field boundaries that still have deviations after information entropy optimization, mutual information is used for correction.

[0036] Another aspect of the present invention further provides a power system protocol analysis system based on association rule analysis and sequence comparison, comprising: A data acquisition module, used for acquiring private protocol data packets from real-time data packets and offline data packets in industrial network data packets; The feature matrix generation module is used for traffic segmentation based on simple sequence alignment, separating the data in the acquired private protocol data packet into static fields and dynamic fields by field, extracting feature information in the dynamic field, encapsulating the feature information into feature data, and generating a feature matrix; A clustering module is used to perform clustering processing on the feature matrix to form a clustering set in a protocol format; The field boundary position adjustment module is used to perform global sequence alignment on the clustered protocol format set to generate a preliminary set of field boundaries, verify the boundary position based on information entropy, calculate the entropy difference of adjacent fields, and combine the fuzziness of field boundaries with a comprehensive analysis of sequence alignment errors to dynamically adjust the field boundary positions identified as highly ambiguous until the entropy difference and entropy value change rate meet the optimization criteria.

[0037] Technical effects and advantages of the power system protocol analysis method based on association rule analysis and sequence comparison of the present invention: 1. The efficiency of dynamic field feature extraction is improved by accurately separating static fields from dynamic fields. At the same time, through the application of association rule algorithms, the frequent items and associated features hidden in dynamic fields are captured, ensuring the integrity of the data and the comprehensiveness of the features. By using the form of feature matrix, the dynamic field information of private protocols can be expressed in a structured and analyzable way, providing a more efficient processing path for reverse parsing of private protocols, and effectively improving the accuracy and processing efficiency of protocol format inference.

[0038] 2. Through the clustering operation of the feature matrix, the classification and integration of dynamic field features in private protocol data packets are realized. By utilizing the density clustering characteristics of the DBSCAN algorithm, noise points and abnormal data in protocol data packets can be effectively processed to ensure the accuracy and robustness of protocol format classification. Clustering processing simplifies the complexity of protocol format inference, improves the efficiency of parsing private protocol formats, and provides a solid foundation for subsequent field boundary identification and protocol format inference.

[0039] 3. By combining the Needleman-Wunsch sequence alignment algorithm with information entropy verification technology, the field boundaries of the protocol message can be accurately identified. At the same time, the field boundary fuzziness index and sequence alignment error correction index are used to quantitatively analyze the boundary fuzziness and sequence alignment error, realizing dynamic adjustment of fuzzy fields. Finally, the accuracy of boundary division is further optimized through the mutual information correction mechanism, ensuring the correct division of fields and accurate inference of protocol formats, significantly improving the efficiency of protocol message processing and the accuracy of parsing, and providing strong support for the automated parsing of complex protocols. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 It is a structural schematic diagram of the power system protocol analysis method based on association rule analysis and sequence comparison of the present invention; Figure 2 It is a flow chart of step S2 of the power system protocol analysis method based on association rule analysis and sequence comparison of the present invention. DETAILED DESCRIPTION

[0041] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0042] Example, Figure 1 The present invention provides a power system protocol analysis method based on association rule analysis and sequence comparison, comprising: S1, obtains private protocol data packets from real-time data packets and offline data packets in industrial network data packets.

[0043] S2, based on the traffic division of simple sequence alignment, separates the data in the acquired private protocol data packet into static fields and dynamic fields by field. The separated dynamic fields are mined for frequent items through the association rule algorithm, and the feature information in the dynamic fields is extracted using the Apriori algorithm, which is encapsulated as feature data to generate a feature matrix.

[0044] S3, clustering the feature matrix, clustering the feature matrix based on the neighborhood radius and minPts parameter to form a clustering set in the protocol format.

[0045] S4, use the Needleman-Wunsch algorithm to perform global sequence alignment on the clustered protocol format set to generate a preliminary set of field boundaries, verify the boundary position based on information entropy, calculate the entropy difference of adjacent fields, combine the ambiguity of field boundaries with a comprehensive analysis of sequence alignment errors, and dynamically adjust the field boundary positions identified as highly ambiguous until the entropy difference and entropy value change rate meet the optimization criteria, and use mutual information for correction.

[0046] In the field of modern power systems and industrial control, the complexity of protocol parsing and the widespread use of private protocols have brought great challenges to system security, real-time performance, and accuracy. Industrial control systems communicate through private protocols, which are usually not public, and the formats of various protocols are complex and changeable, making it difficult for traditional protocol parsing methods to adapt to real-time requirements in dynamic environments. At the same time, the parsing of the protocol format not only requires identifying the static part of the protocol field, but also requires in-depth analysis of the dynamic fields, extracting key information, and reconstructing the format to ensure the validity and consistency of the communication data.

[0047] In this context, a protocol analysis method based on association rule analysis and sequence alignment is proposed. By obtaining private protocol data from industrial network data packets, using sequence alignment technology to divide traffic, and combining association rule algorithms to mine frequent items and extract features for dynamic fields, a feature matrix is ​​generated. This process effectively separates static fields and dynamic fields in the protocol, and conducts in-depth mining of frequent feature items of dynamic fields, providing data support for protocol format analysis.

[0048] Furthermore, based on the clustering processing of the feature matrix, the format set of the private protocol is clustered by the neighborhood radius and density parameters to form a cluster set of protocol formats. Based on the cluster set, the sequence alignment algorithm is used in combination with the information entropy technology to verify the boundaries of the protocol fields, and the information entropy change results are corrected through a comprehensive analysis of the field boundary fuzziness and sequence alignment errors, and finally the precise division of the protocol format is obtained. This technology provides an efficient and dynamic solution for the parsing of private protocols in industrial networks, and effectively responds to the challenges of complex protocol formats and dynamic field extraction.

[0049] Step S1 includes the following contents: During the initialization phase, the source of data packets collected is specified through the configuration file or management port, including real-time data packets and offline data packets. Real-time data packets come from the communication traffic of the industrial network, and offline data packets retrieve historical data from the storage medium. The data packet collection mode is automatically switched according to task requirements to ensure that the acquisition of data packets is compatible with the operating status of the industrial network.

[0050] When real-time data packets are selected, the industrial network communication link is accessed through the network monitoring module, the network traffic is parsed using deep packet inspection technology, and the traffic data that meets the characteristics of the private protocol is captured according to established rules to generate private protocol data packets; when offline data packets are selected, offline data is called from the specified storage path and loaded into the memory in the specified format for subsequent processing.

[0051] Regardless of whether the data packet source is real-time or offline data, the captured data packets need to be preprocessed. The preprocessing steps include data packet integrity verification, timestamp marking, protocol header parsing, etc., to ensure that the data packet content is not damaged during transmission, and additional metadata such as timestamps can provide accurate basis for subsequent analysis.

[0052] After the data packet is captured, its content is quickly screened and filtered. According to the preset protocol feature matching rules, data packets that do not conform to the private protocol format are filtered out, and only data that conforms to the specific private protocol features is retained. The filtering rules include multiple dimensions such as protocol header structure, field type, data length, etc., to ensure that only data packets of the target protocol are captured.

[0053] The selected private protocol data packets are encapsulated into a data structure that conforms to the internal processing flow. Each data packet structure includes protocol fields, protocol metadata (such as timestamp, source address, destination address, etc.), and is stored in memory in order, or stored persistently when necessary, for subsequent feature extraction and analysis. The encapsulation process must ensure the structural integrity and data accuracy of the private protocol data packets.

[0054] In the communication protocol analysis of the power system, the format of the private protocol is complex and the standard is not open, which makes the feature extraction and field separation of the protocol a key issue in protocol reverse engineering. To meet this demand, a traffic partitioning method based on simple sequence alignment is proposed to separate the acquired private protocol data packets into static fields and dynamic fields according to fields. This method serializes the byte stream of the private protocol data packet and combines the association rule algorithm with the Apriori algorithm to complete the feature extraction and frequent item set mining of the dynamic field. By generating a feature matrix, the structured expression of the feature information of the dynamic field in the private protocol is realized, providing an accurate and rich data foundation for the subsequent protocol message clustering analysis. Among them, the Apriori algorithm refers to an association analysis algorithm used to mine frequent item sets and association rules from dynamic fields, and extracts field feature information by screening frequent items that meet the minimum support.

[0055] like Figure 2 As shown, step S2 includes the following contents: S2.1, serialize the data in the acquired private protocol data packet in byte order: convert the contents of each field of the data in each data packet into a continuous byte stream representation. Each byte position in the byte stream corresponds to a specific field or part of a field in the data packet. The byte streams of all data packets are arranged in the same order to ensure that the position correspondence in the subsequent comparison process is consistent.

[0056] S2.2, use a simple sequence alignment algorithm to compare multiple private protocol data packets byte by byte to determine whether the values ​​in all data packets at the same byte position are exactly the same. For byte positions that are consistent in all data packets, mark them as static fields; for byte positions that change in different data packets, mark them as dynamic fields. This is done by constructing a character set, each set containing values ​​at the same byte position. If the set size is 1, the corresponding byte position is a static field, and if the set size is greater than 1, it is a dynamic field. Finally, a field classification matrix is ​​output, and each position in the matrix is ​​marked as a static field or a dynamic field.

[0057] S2.3, after separating the dynamic fields, apply the association rule algorithm to mine frequent item sets for the dynamic fields. First, number the positions of all dynamic fields and treat the content of each dynamic field as an item. Use the Apriori algorithm to identify frequently occurring item sets in the dynamic fields. The specific steps include: scanning the data of the dynamic fields, counting the frequency of occurrence of each field, and filtering out frequent item sets that meet the minimum support. Then, generate strong association rules based on the identified frequent item sets, and record the relationship between each dynamic field and the corresponding association features.

[0058] S2.4, based on the results of frequent item set mining, determine the associated features of each dynamic field. Associate the field position corresponding to each frequent item set with its feature information and encapsulate it as feature data. Feature data contains key information such as field position, association rules, and frequent item sets, ensuring that the features of all dynamic fields can be accurately extracted and represented.

[0059] S2.5, encapsulate the extracted feature information into a two-dimensional matrix to generate a feature matrix. Each row of the feature matrix corresponds to the feature of a private protocol data packet, and each column of the matrix corresponds to the feature information of a dynamic field. Each value in the matrix represents the feature information of the corresponding private protocol data packet at the corresponding field position, including the frequent item sets and association rules of the corresponding field. The generated feature matrix will be used as the input for the subsequent protocol message clustering analysis to ensure that the feature information of the dynamic field is fully expressed and structured.

[0060] The precise separation of static fields and dynamic fields improves the efficiency of dynamic field feature extraction. At the same time, through the application of association rule algorithms, the frequent items and associated features hidden in the dynamic fields are captured, ensuring the integrity of the data and the comprehensiveness of the features. By using the form of feature matrix, the dynamic field information of private protocols can be expressed in a structured and analyzable way, providing a more efficient processing path for the reverse parsing of private protocols, and effectively improving the accuracy and processing efficiency of protocol format inference.

[0061] In the analysis process of private protocols in power systems, the complexity and non-disclosure of protocol formats make the clustering and parsing of protocol fields a key issue. In order to solve this problem, a clustering processing method based on feature matrix clusters the dynamic field features of private protocol data packets through the DBSCAN algorithm. Using the neighborhood radius and minPts parameters, data packets with similar dynamic field features are classified into one category, thus forming a clustering set of similar protocol formats. This method can effectively extract the similarities between different protocol formats from a large amount of protocol data and provide an accurate data basis for the inference of protocol formats. Among them, minPts represents the minimum number of points parameter in the DBSCAN clustering algorithm, which is used to determine the minimum number of neighborhood data points required for a data point to be regarded as a core point in the neighborhood.

[0062] Step S3 includes the following contents: S3.1, extract all rows from the feature matrix generated in step S2 as data points, each row corresponds to the feature of a private protocol data packet. Each column of the feature matrix represents the feature information of a dynamic field, including frequent item sets, association rules, and field positions, to ensure the integrity and accuracy of the input data. The dimensions of all data points remain consistent to ensure that the subsequent clustering algorithm can be processed in the same dimensional space.

[0063] S3.2, clustering processing uses DBSCAN (Density-Based Spatial Clustering of Applications with Noise) algorithm, and sets the core parameters of neighborhood radius and minPts. The neighborhood radius represents the range of the neighborhood centered on the data point, that is, the maximum distance that a data point can affect other data points; minPts represents the minimum number of data points that need to be included in the corresponding neighborhood to calculate the core point. In the feature matrix, the neighborhood radius is calculated based on the feature similarity of the frequent itemsets and association rules of the dynamic field, and is set by a predefined threshold, while minPts is set by empirical value or according to data density to ensure the effectiveness of clustering.

[0064] S3.3, perform clustering operation on the feature matrix through the set DBSCAN parameters. For each data point (i.e., the feature of each private protocol data packet), calculate its distance from other surrounding data points, determine whether it falls within the neighborhood radius, and determine whether it meets the core point condition based on the minPts parameter. If a data point meets the core point condition, the corresponding data point and all data points in its neighborhood are grouped into one cluster, and continue to recursively process the data points in this cluster until all data points are marked as core points or noise points. The clustering result outputs multiple clusters, each cluster represents a protocol format with similar dynamic field features.

[0065] S3.4, after clustering is completed, the results of each cluster are numbered in sequence, and each number corresponds to a group of similar private protocol data packets. For each data point (private protocol data packet) in each cluster, only its position and feature information in the feature matrix are recorded, and the complete protocol data packet is not saved. In this way, the clustering results are stored as a set of numbered feature matrices, each set representing a protocol format category. Each clustering result is numbered and output as a cluster set in the protocol format.

[0066] S3.5, for the noise points identified in the clustering process, that is, the private protocol data packets that do not belong to any cluster, they will be marked as abnormal data packets separately. The characteristic information of the abnormal data packets will be further analyzed to determine whether they are private protocols in a special format or data with unclear protocol formats. Noise points can provide clues for subsequent further processing, such as adjusting clustering parameters or re-identifying the characteristics of this part of the protocol through other methods.

[0067] Through the clustering operation of the feature matrix, the classification and integration of dynamic field features in private protocol data packets are realized. The density clustering characteristics of the DBSCAN algorithm can effectively process noise points and abnormal data in protocol data packets to ensure the accuracy and robustness of protocol format classification. Clustering processing simplifies the complexity of protocol format inference, improves the efficiency of parsing private protocol formats, and provides a solid foundation for subsequent field boundary identification and protocol format inference.

[0068] With the increasing complexity of protocols and dynamic feature fields, traditional protocol message parsing methods often face the challenges of boundary ambiguity and alignment errors when dealing with sequence alignment and field boundary demarcation of private protocols. To solve these problems, a comprehensive processing framework based on the Needleman-Wunsch algorithm, information entropy verification, field boundary ambiguity index and sequence alignment error correction index is proposed for accurate parsing of private protocol messages. Through this multi-step, multi-dimensional dynamic adjustment mechanism, accurate boundary correction and sequence alignment optimization can be achieved for field boundaries with high ambiguity, thereby effectively improving the parsing accuracy of protocol messages. Among them, the Needleman-Wunsch algorithm is a dynamic programming algorithm for global sequence alignment. It globally aligns the fields in the protocol format set by maximizing sequence similarity, thereby generating a preliminary set of field boundaries.

[0069] Step S4 includes the following contents: S4.1, extract a set of protocol data packets with similar dynamic field features from the protocol format clustering set generated in step S3. The data packets in each set have the same or similar field structure and position distribution. Use it as input and use the Needleman-Wunsch algorithm to perform sequence alignment. The algorithm aligns the fields in the protocol message by global alignment, ensuring that the field similarity is maximized while generating an aligned sequence alignment result. The output of the sequence alignment is a set of field boundaries in the protocol data packet.

[0070] S4.2, after the sequence alignment results are generated, the boundary positions of each field in the protocol message are preliminarily determined based on the aligned field positions. Based on the alignment results of the Needleman-Wunsch algorithm, the fields are preliminarily divided according to the aligned sequences, and a preliminary set of field boundary positions is generated. The preliminary set records the starting and ending positions of each field in the protocol message, but since blank characters may be inserted during the sequence alignment process, these boundaries need to be further verified.

[0071] S4.3, use information entropy technology to verify the field boundary positions obtained by sequence alignment. Information entropy is used to measure the uncertainty inside and at the boundaries of the field. The entropy value of the field boundary is usually higher than that of the field. By comparing the changes in the entropy value of each field position, determine whether the currently defined boundary position is accurate. If the entropy value of a field boundary position is significantly different from the entropy value of the adjacent field, it means that the boundary is relatively clear; conversely, if the entropy value difference is not obvious, further correction is required. The output of this step is a set of field boundaries after information entropy verification.

[0072] S4.4, further analyze the field boundaries that have been verified by information entropy to evaluate boundary ambiguity and sequence alignment error. The field boundary ambiguity index is used to quantify the ambiguity of the field boundary. The boundary with a higher field boundary ambiguity index value indicates that it has greater uncertainty and needs further optimization. At the same time, combined with the sequence alignment error correction index, the alignment error of the protocol field during the alignment process is analyzed. A higher index indicates a larger alignment error. Through the comprehensive analysis of these two indicators, the alignment strategy is dynamically adjusted to make a more precise judgment on the field boundary.

[0073] Among them, the logic for obtaining the field boundary fuzziness index is as follows: a1, for each field boundary in the protocol message, first calculate its information entropy. Suppose the protocol message sequence is , where each Represents a field or part of a field in a message. The information entropy of is defined as: ;in, Representation field The set of values ​​in For Field Internal symbol By calculating the entropy value of each field, the initial uncertainty of the boundaries of different fields is obtained.

[0074] a2, in order to capture the ambiguity at the field boundary, the entropy difference between the adjacent fields on both sides of each field boundary is calculated. and The boundary is , then the entropy difference between adjacent fields is calculated as: ; This entropy difference reflects the information uncertainty difference of the fields on both sides of the boundary. If it is larger, it means the boundary is clear; Small, with fuzzy boundaries.

[0075] a3, in order to further capture the boundary fuzziness, the gradient change rate of the field entropy value at the boundary is calculated. The gradient of the boundaries on both sides is: ; The gradient change rate reflects the changing trend of the field entropy value on both sides of the boundary. If the gradient change rate is close to 1, it means that the entropy value changes slowly and the boundary fuzziness is high; if the gradient change rate deviates significantly from 1, it indicates that the boundary is clearer.

[0076] a4, calculate the field boundary fuzziness index based on the comprehensive analysis of entropy difference and entropy gradient As a quantitative indicator of boundary fuzziness, the formula of fuzziness index is as follows: ;in, To prevent the denominator from being a small constant of zero. This formula combines the changes in entropy difference and entropy gradient. When the entropy difference is small and the gradient change is close to 1, the fuzziness index value is high, indicating that the boundary is fuzzy; conversely, the fuzziness index is low, indicating that the boundary is clear.

[0077] The field boundary fuzziness index is used to quantify the uncertainty of the field boundary in the protocol message, reflecting the change of information entropy at the field boundary and the fuzziness of field alignment. When the field boundary fuzziness index value is large, it means that the boundary is not clear, the entropy value changes little and the gradient is close to flat, indicating that the boundary has high fuzziness, there may be alignment errors or unclear boundaries, and further optimization and correction are required; when the fuzziness index value is small, it means that the boundary is clearer, the entropy value difference is significant and the gradient changes greatly, indicating that the boundary accuracy is high and no additional correction processing is required.

[0078] Among them, the logic for obtaining the sequence alignment error correction index is as follows: b1, for each field , calculate the offset introduced during the comparison process , that is, the difference in the starting position of the field before and after the comparison: ;in, and Represents the fields separately The starting position before and after the comparison. The offset indicates the offset of the field during the comparison process.

[0079] b2, for each adjacent field and , calculate the misalignment distance between the two after comparison , indicating the relative position difference between two fields in the comparison result: ; This formula calculates the change in the relative position of two fields before and after the comparison. A larger misalignment distance value indicates that the relative position of the two fields is significantly misaligned.

[0080] b3, in order to capture the changing trend of the misalignment between fields, the gradient change rate of the misalignment distance is calculated. The offset distance between the adjacent fields before and after is and , then the gradient change rate is: ; Gradient change rate Indicates the fluctuation of the misalignment distance. If the gradient change rate is close to 1, it means that the misalignment changes smoothly and the alignment error is small; if it deviates from 1, it means that the misalignment changes greatly and there is a significant alignment error.

[0081] b4, combining the field offset, misalignment distance and gradient change rate to calculate the sequence alignment error correction index Used to quantify the alignment error, the formula is as follows: ;in, is a constant to prevent the denominator from being zero. This formula takes into account the offset of the field and the change in the misalignment distance of adjacent fields, and corrects it through the gradient change rate. The larger the value of the sequence alignment error correction index, the more obvious the alignment error is, and more detailed correction is required; the smaller the value, the smaller the alignment error is, and the comparison result is more accurate.

[0082] The sequence alignment error correction index is used to quantify the field position offset and relative misalignment generated by the protocol message during the sequence alignment process, reflecting the degree of error in field alignment during the alignment process. When the correction index value is large, it means that the field position offset and misalignment distance are significant, indicating that the alignment error is large, the accuracy of the sequence alignment is low, and further correction is required; when the correction index value is small, it means that the field position changes little and the alignment error is small, indicating that the alignment result is more accurate and the relative position of the field remains relatively consistent before and after the alignment.

[0083] c1, the field boundary ambiguity index and the sequence alignment error correction index are standardized, and the protocol complexity control coefficient is obtained by weighted summation.

[0084] c2, select the mode based on the size of the protocol complexity control coefficient: When the protocol complexity control coefficient exceeds the preset critical value, it indicates that the field boundary ambiguity and comparison error are large, and it is necessary to enable the enhanced correction mode, that is, to perform more refined multi-step correction on the boundaries of the protocol fields to ensure the accuracy of field division and generate a high ambiguity signal.

[0085] When the protocol complexity control coefficient is less than the critical value, it indicates that the field boundary and alignment errors are small, and the fast alignment mode can be used, that is, sequence alignment and boundary correction are performed directly according to the current algorithm, reducing the amount of calculation and improving efficiency.

[0086] S4.5, after obtaining the analysis results of boundary fuzziness and alignment error, recalculate the information entropy value of the field boundary with high fuzzy signal, and set the information entropy value of each field to be , the entropy difference between adjacent fields .when Less than ,Right now , indicating that the boundary is ambiguous. To determine the change trend, calculate the entropy change rate of adjacent fields. .when The absolute difference from 1 is less than or equal to the preset threshold, indicating that the entropy value change trend is stable, that is, the field boundary change is not obvious, and further dynamic adjustment is needed. The specific method of dynamic adjustment is to translate the field boundary position by the rated unit amplitude, and gradually adjust the position of the field boundary position until Exceed ,and If the absolute difference from 1 is greater than the preset threshold, it indicates that the field boundary position has been adjusted to the required purpose. This adjustment ensures the accuracy of field boundary division and a more accurate match to the protocol format.

[0087] S4.6, for field boundaries that still have deviations after information entropy optimization, use mutual information to further correct them. Mutual information reflects the mutual dependence between two variables. By calculating the mutual information between the field position and its adjacent positions, we can determine whether the boundary is reasonable. Positions where the mutual information is greater than or equal to the critical value indicate that there is a strong dependency between the fields and should be considered as inside the field; and where the mutual information is less than the critical value, there may be a boundary. The mutual information is used to make a final correction to the field boundaries after information entropy optimization to ensure the accuracy and consistency of all field boundary divisions.

[0088] By combining the Needleman-Wunsch sequence alignment algorithm with information entropy verification technology, the field boundaries of the protocol message can be accurately identified. At the same time, the field boundary fuzziness index and sequence alignment error correction index are used to quantitatively analyze the boundary fuzziness and sequence alignment error, realizing dynamic adjustment of fuzzy fields. Finally, the accuracy of boundary division is further optimized through the mutual information correction mechanism, ensuring the correct division of fields and accurate inference of protocol formats, significantly improving the efficiency of protocol message processing and the accuracy of parsing, and providing strong support for the automatic parsing of complex protocols.

[0089] In another embodiment, the present invention provides a power system protocol analysis system based on association rule analysis and sequence comparison, comprising: A data acquisition module, used for acquiring private protocol data packets from real-time data packets and offline data packets in industrial network data packets; The feature matrix generation module is used for traffic segmentation based on simple sequence alignment, separating the data in the acquired private protocol data packet into static fields and dynamic fields by field, extracting feature information in the dynamic field, encapsulating the feature information into feature data, and generating a feature matrix; A clustering module is used to perform clustering processing on the feature matrix to form a clustering set in a protocol format; The field boundary position adjustment module is used to perform global sequence alignment on the clustered protocol format set to generate a preliminary set of field boundaries, verify the boundary position based on information entropy, calculate the entropy difference of adjacent fields, and combine the fuzziness of field boundaries with a comprehensive analysis of sequence alignment errors to dynamically adjust the field boundary positions identified as highly ambiguous until the entropy difference and entropy value change rate meet the optimization criteria.

[0090] The feature matrix generation module is specifically used for: Serialize the data in the acquired private protocol data packet in byte order: convert the contents of each field of the data in each data packet into a continuous byte stream representation; A simple sequence alignment algorithm is used to compare multiple private protocol data packets byte by byte to determine whether the values ​​in all data packets at the same byte position are exactly the same; for byte positions that are consistent in all data packets, they are marked as static fields; for byte positions that vary in different data packets, they are marked as dynamic fields, by constructing a character set set, each set containing values ​​at the same byte position, if the set size is 1, the corresponding byte position is a static field, if the set size is greater than 1, it is a dynamic field; finally, a field classification matrix is ​​output, and each position in the matrix is ​​marked as a static field or a dynamic field; After separating the dynamic fields, the association rule algorithm is applied to mine frequent item sets in the dynamic fields. First, the positions of all dynamic fields are numbered, and the content of each dynamic field is regarded as an item. The Apriori algorithm is used to identify frequently occurring item sets in the dynamic fields. The specific steps include: scanning the data of the dynamic fields, counting the frequency of occurrence of each field, and filtering out frequent item sets that meet the minimum support. Then, strong association rules are generated based on the identified frequent item sets, and the relationship between each dynamic field and the corresponding association features is recorded. Based on the results of frequent item set mining, determine the associated features of each dynamic field; associate the field position corresponding to each frequent item set with its feature information and encapsulate it as feature data; The extracted feature information is encapsulated into a two-dimensional matrix to generate a feature matrix.

[0091] The clustering module is specifically used for: Extract all rows from the generated feature matrix as data points, where each row corresponds to a feature of a private protocol data packet; The clustering process uses the DBSCAN algorithm, setting the core parameters of neighborhood radius and minPts; the neighborhood radius represents the neighborhood range centered on the data point, that is, calculating the maximum distance of other data points affected by a data point; minPts represents the minimum number of data points that need to be included in the corresponding neighborhood to calculate the core point; The feature matrix is ​​clustered by using the set DBSCAN parameters. For each data point, i.e., the feature of each private protocol data packet, the distance between it and other surrounding data points is calculated to determine whether it falls within the neighborhood radius, and whether it meets the core point condition according to the minPts parameter. If a data point meets the core point condition, the corresponding data point and all data points in its neighborhood are grouped into one cluster, and the data points in this cluster are recursively processed until all data points are marked as core points or noise points. The clustering result outputs multiple clusters, each of which represents a protocol format with similar dynamic field features. After clustering, the results of each cluster are numbered in sequence, and each number corresponds to a group of similar private protocol data packets; for each data point in each cluster, only its position and feature information in the feature matrix are recorded, and the clustering results are stored as a set of numbered feature matrices, each set representing a protocol format category; each clustering result is numbered and output as a cluster set in the protocol format.

[0092] The field boundary position adjustment module is specifically used for: From the generated protocol format clustering set, a set of protocol data packets with similar dynamic field features is extracted, which is used as input and sequenced using the Needleman-Wunsch algorithm; each field in the protocol message is aligned by global alignment to generate an aligned sequence alignment result; the output of the sequence alignment is a set of field boundaries in the protocol data packet; After the sequence alignment results are generated, the boundary positions of each field in the protocol message are preliminarily determined according to the aligned field positions; the fields are preliminarily divided according to the aligned sequences through the alignment results of the Needleman-Wunsch algorithm, and a preliminary set of field boundary positions is generated; Use information entropy technology to verify the field boundary position obtained by sequence alignment; the output is a field boundary set after information entropy verification; The field boundaries that have been verified by information entropy are analyzed to evaluate the boundary ambiguity and sequence alignment error. The field boundary ambiguity index is used to quantify the degree of ambiguity of the field boundary. At the same time, the alignment error of the protocol field during the comparison process is analyzed in combination with the sequence alignment error correction index.

[0093] Among them, the logic for obtaining the field boundary fuzziness index is as follows: For each field boundary in the protocol message, first calculate its information entropy; suppose the protocol message sequence is , where each Represents a field or part of a field in a message; field The information entropy of is defined as: ;in, Representation field The set of values ​​in For Field Internal symbol Probability of occurrence; Capture the fuzziness at the field boundary and calculate the entropy difference of the adjacent fields on both sides of each field boundary; let the field and The boundary is , then the entropy difference between adjacent fields is calculated as: ; Capture boundary fuzziness, calculate the gradient change rate of field entropy value at the boundary, and calculate field The gradient of the boundaries on both sides is: ; Based on the comprehensive analysis of entropy difference and entropy gradient, the field boundary fuzziness index is calculated As a quantitative indicator of boundary fuzziness, the formula of fuzziness index is as follows: ;in, A small constant to prevent the denominator from being zero.

[0094] Among them, the logic for obtaining the sequence alignment error correction index is as follows: For each field , calculate the offset introduced during the comparison process , that is, the difference in the starting position of the field before and after the comparison: ;in, and Represents the fields separately The starting position before and after the alignment; For each adjacent field and , calculate the misalignment distance between the two after comparison , indicating the relative position difference between two fields in the comparison result: ; Capture the changing trend of the misalignment between fields and calculate the gradient change rate of the misalignment distance; set the field The offset distance between the adjacent fields before and after is and , then the gradient change rate is: ; Gradient change rate Indicates the fluctuation of the misalignment distance; Combine the field offset, misalignment distance, and gradient change rate to calculate the sequence alignment error correction index Used to quantify the alignment error, the formula is as follows: ;in, is a constant that prevents the denominator from being zero.

[0095] The field boundary position adjustment module is also used to: The field boundary ambiguity index and sequence alignment error correction index are standardized, and the protocol complexity control coefficient is obtained by weighted summation. The mode is selected according to the size of the protocol complexity control coefficient: when the protocol complexity control coefficient exceeds the preset critical value, the enhanced correction mode needs to be enabled to generate a high ambiguity signal.

[0096] The field boundary position adjustment module is also used to: After obtaining the analysis results of boundary fuzziness and alignment error, the information entropy value of the field boundary with high fuzzy signal is recalculated, and the entropy value of each field is set to , the entropy difference between adjacent fields ;when Less than ,Right now , indicating that the corresponding boundary is fuzzy; for the judgment of the change trend, the entropy change rate of the adjacent fields is calculated ;when The absolute difference from 1 is less than or equal to the preset threshold, indicating that the entropy value changes steadily, that is, the field boundary changes are not obvious. The specific method of dynamic adjustment is to shift the field boundary position by the rated unit amplitude, and gradually adjust the position of the field boundary position until Exceed ,and The absolute difference from 1 is greater than the preset threshold, indicating that the field boundary position has been adjusted to the required purpose; For field boundaries that still have deviations after information entropy optimization, mutual information is used for correction.

[0097] It should be noted that, in this article, if there are relational terms such as first and second, etc., they are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "including a..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0098] The above formulas are all dimensionless and numerical calculations. The formula is a formula for the most recent real situation obtained by collecting a large amount of data and performing software simulation. The preset parameters in the formula are set by technicians in this field according to actual conditions.

[0099] The above embodiments can be implemented in whole or in part by software, hardware, firmware or any other combination. When implemented by software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that contains one or more available media sets. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium. The semiconductor medium can be a solid-state hard disk.

[0100] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0101] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0102] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0103] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0104] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard disks, read-only memories (ROM), random access memories (RAM), magnetic disks or optical disks.

[0105] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. Power system protocol analysis method based on association rule analysis and sequence comparison, It is characterized in that Includes steps: Obtain private protocol data packets from real-time data packets and offline data packets in industrial network data packets; Based on the traffic division of simple sequence alignment, the data in the acquired private protocol data packet is separated into static fields and dynamic fields by field, the feature information in the dynamic field is extracted, the feature information is encapsulated as feature data, and a feature matrix is ​​generated; Perform clustering processing on the feature matrix to form a cluster set in a protocol format; A global sequence alignment is performed on the clustered protocol format set to generate a preliminary set of field boundaries. The boundary positions are verified based on information entropy. The entropy difference of adjacent fields is calculated, and the ambiguity of field boundaries and the comprehensive analysis of sequence alignment errors are combined to dynamically adjust the field boundary positions identified as highly ambiguous until the entropy difference and the entropy value change rate meet the optimization criteria.

2. The power system protocol analysis method based on association rule analysis and sequence comparison according to claim 1, Features: The traffic division based on simple sequence alignment separates the data in the acquired private protocol data packet into static fields and dynamic fields by field, extracts feature information in the dynamic field, encapsulates the feature information into feature data, and generates a feature matrix, which specifically includes the following contents: Serialize the data in the acquired private protocol data packet in byte order: convert the contents of each field of the data in each data packet into a continuous byte stream representation; A simple sequence alignment algorithm is used to compare multiple private protocol data packets byte by byte to determine whether the values ​​in all data packets at the same byte position are exactly the same; for byte positions that are consistent in all data packets, they are marked as static fields; for byte positions that vary in different data packets, they are marked as dynamic fields, by constructing a character set set, each set containing values ​​at the same byte position, if the set size is 1, the corresponding byte position is a static field, if the set size is greater than 1, it is a dynamic field; finally, a field classification matrix is ​​output, and each position in the matrix is ​​marked as a static field or a dynamic field; After separating the dynamic fields, the association rule algorithm is applied to mine frequent item sets in the dynamic fields. First, the positions of all dynamic fields are numbered, and the content of each dynamic field is regarded as an item. The Apriori algorithm is used to identify frequently occurring item sets in the dynamic fields. The specific steps include: scanning the data of dynamic fields, counting the frequency of occurrence of each field, and filtering out frequent item sets that meet the minimum support; then, generating strong association rules based on the identified frequent item sets, and recording the relationship between each dynamic field and the corresponding association features; Based on the results of frequent item set mining, determine the associated features of each dynamic field; associate the field position corresponding to each frequent item set with its feature information and encapsulate it as feature data; The extracted feature information is encapsulated into a two-dimensional matrix to generate a feature matrix.

3. The power system protocol analysis method based on association rule analysis and sequence comparison according to claim 2, Features: The clustering process of the feature matrix to form a clustering set in a protocol format specifically includes the following contents: Extract all rows from the generated feature matrix as data points, where each row corresponds to a feature of a private protocol data packet; The clustering process uses the DBSCAN algorithm, setting the core parameters of neighborhood radius and minPts; the neighborhood radius represents the neighborhood range centered on the data point, that is, calculating the maximum distance of other data points affected by a data point; minPts represents the minimum number of data points that need to be included in the corresponding neighborhood to calculate the core point; The clustering operation of the feature matrix is ​​performed through the set DBSCAN parameters. For each data point, that is, the feature of each private protocol data packet, the distance between it and other surrounding data points is calculated to determine whether it falls within the neighborhood radius, and whether it meets the core point condition according to the minPts parameter. If a data point meets the core point condition, the corresponding data point and all data points in its neighborhood are grouped into a cluster, and the data points in this cluster are recursively processed until all data points are marked as core points or noise points; the clustering result outputs multiple clusters, each cluster represents a protocol format with similar dynamic field characteristics; After clustering, the results of each cluster are numbered in sequence, and each number corresponds to a group of similar private protocol data packets; for each data point in each cluster, only its position and feature information in the feature matrix are recorded, and the clustering results are stored as a set of numbered feature matrices, each set representing a protocol format category; each clustering result is numbered and output as a cluster set in the protocol format.

4. The power system protocol analysis method based on association rule analysis and sequence comparison according to claim 3, Features: The method of performing global sequence alignment on the clustered protocol format set to generate a preliminary set of field boundaries, verifying the boundary position based on information entropy, and dynamically adjusting the field boundary position identified as highly ambiguous by calculating the entropy difference of adjacent fields and combining comprehensive analysis of the fuzziness of field boundaries and sequence alignment errors until the entropy difference and the entropy value change rate meet the optimization criteria, specifically includes the following contents: From the generated protocol format clustering set, a set of protocol data packets with similar dynamic field features is extracted, which is used as input and sequenced using the Needleman-Wunsch algorithm; each field in the protocol message is aligned by global alignment to generate an aligned sequence alignment result; the output of the sequence alignment is a set of field boundaries in the protocol data packet; After the sequence alignment results are generated, the boundary positions of each field in the protocol message are preliminarily determined according to the aligned field positions; the fields are preliminarily divided according to the aligned sequences through the alignment results of the Needleman-Wunsch algorithm, and a preliminary set of field boundary positions is generated; Use information entropy technology to verify the field boundary position obtained by sequence alignment; the output is a field boundary set after information entropy verification; Analyze the field boundaries after information entropy verification to evaluate boundary ambiguity and sequence alignment errors; The field boundary fuzziness index is used to quantify the fuzziness of field boundaries. At the same time, the sequence alignment error correction index is combined to analyze the alignment errors of protocol fields during the alignment process.

5. The power system protocol analysis method based on association rule analysis and sequence comparison according to claim 4 ， Features: Among them, the logic for obtaining the field boundary fuzziness index is as follows: For each field boundary in the protocol message, first calculate its information entropy; suppose the protocol message sequence is , where each Represents a field or part of a field in a message; field The information entropy of is defined as: ;in, Representation field The set of values ​​in For Field Internal symbol Probability of occurrence; Capture the fuzziness at the field boundary and calculate the entropy difference of the adjacent fields on both sides of each field boundary; let the field and The boundary is , then the entropy difference between adjacent fields is calculated as: ; Capture boundary fuzziness, calculate the gradient change rate of field entropy value at the boundary, and calculate field The gradient of the boundaries on both sides is: ; Based on the comprehensive analysis of entropy difference and entropy gradient, the field boundary fuzziness index is calculated As a quantitative indicator of boundary fuzziness, the formula of fuzziness index is as follows: ;in, A small constant to prevent the denominator from being zero.

6. The power system protocol analysis method based on association rule analysis and sequence comparison according to claim 4 ， Features: Among them, the logic for obtaining the sequence alignment error correction index is as follows: For each field , calculate the offset introduced during the comparison process , that is, the difference in the starting position of the field before and after the comparison: ;in, and Represents the fields separately The starting position before and after the alignment; For each adjacent field and , calculate the misalignment distance between the two after comparison , indicating the relative position difference between two fields in the comparison result: ； Capture the changing trend of the misalignment between fields and calculate the gradient change rate of the misalignment distance; set the field The offset distance between the adjacent fields before and after is and , then the gradient change rate is: ; Gradient change rate Indicates the fluctuation of the misalignment distance; Combine the field offset, misalignment distance, and gradient change rate to calculate the sequence alignment error correction index Used to quantify the alignment error, the formula is as follows: ;in, is a constant that prevents the denominator from being zero.

7. The power system protocol analysis method based on association rule analysis and sequence comparison according to claim 4, Features: The method of performing global sequence alignment on the clustered protocol format set to generate a preliminary set of field boundaries, verifying the boundary position based on information entropy, and dynamically adjusting the field boundary position identified as highly ambiguous by calculating the entropy difference of adjacent fields and combining comprehensive analysis of the fuzziness of field boundaries and sequence alignment errors until the entropy difference and the entropy value change rate meet the optimization criteria, further includes the following: The field boundary ambiguity index and sequence alignment error correction index are standardized, and the protocol complexity control coefficient is obtained by weighted summation. The mode is selected according to the size of the protocol complexity control coefficient: when the protocol complexity control coefficient exceeds the preset critical value, the enhanced correction mode needs to be enabled to generate a high ambiguity signal.

8. The power system protocol analysis method based on association rule analysis and sequence comparison according to claim 7, Features: The method of performing global sequence alignment on the clustered protocol format set to generate a preliminary set of field boundaries, verifying the boundary position based on information entropy, and dynamically adjusting the field boundary position identified as highly ambiguous by calculating the entropy difference of adjacent fields and combining comprehensive analysis of the fuzziness of field boundaries and sequence alignment errors until the entropy difference and the entropy value change rate meet the optimization criteria, further includes the following: After obtaining the analysis results of boundary fuzziness and alignment error, the information entropy value of the field boundary with high fuzzy signal is recalculated, and the entropy value of each field is set to , the entropy difference between adjacent fields ;when Less than ,Right now , indicating that the corresponding boundary is fuzzy; for the judgment of the change trend, the entropy change rate of the adjacent fields is calculated ;when The absolute difference from 1 is less than or equal to the preset threshold, indicating that the entropy value changes steadily, that is, the field boundary changes are not obvious. The specific method of dynamic adjustment is to shift the field boundary position by the rated unit amplitude, and gradually adjust the position of the field boundary position until Exceed ,and The absolute difference from 1 is greater than the preset threshold, indicating that the field boundary position has been adjusted to the required purpose; For field boundaries that still have deviations after information entropy optimization, mutual information is used for correction.

9. Power system protocol analysis system based on association rule analysis and sequence comparison, It is characterized in that include: A data acquisition module, used for acquiring private protocol data packets from real-time data packets and offline data packets in industrial network data packets; The feature matrix generation module is used for traffic segmentation based on simple sequence alignment, separating the data in the acquired private protocol data packet into static fields and dynamic fields by field, extracting feature information in the dynamic field, encapsulating the feature information into feature data, and generating a feature matrix; A clustering module is used to perform clustering processing on the feature matrix to form a clustering set in a protocol format; The field boundary position adjustment module is used to perform global sequence alignment on the clustered protocol format set to generate a preliminary set of field boundaries, verify the boundary position based on information entropy, calculate the entropy difference of adjacent fields, and combine the fuzziness of field boundaries with a comprehensive analysis of sequence alignment errors to dynamically adjust the field boundary positions identified as highly ambiguous until the entropy difference and entropy value change rate meet the optimization criteria.

Images