Method and device for establishing communication model of network equipment

Abstract

The embodiments of the present application provide a method and device for establishing a communication model of a network device. The method includes: determining a plurality of different first binary sequences, wherein each first binary sequence corresponds to a request message; sending the determined plurality of first binary sequences to the network device; obtaining response messages to the request messages corresponding to the plurality of first binary sequences from the network device, wherein each response message corresponds to a second binary sequence; determining the law of changes of each second binary sequence with each first binary sequence; and establishing the communication model of the network device according to the law. The technical solutions of each embodiment can establish a communication model of a network device without knowing anything about the communication mechanism of the network device, and provide important reference data for related application scenarios.

Description

Technical Field

[0001] The present application relates to the field of communications, and in particular to a method and device for establishing a communication model of a network device. Background Art

[0002] With the development of technology, more and more devices need to communicate with other devices through communication networks. In this article, these devices are collectively referred to as network devices. Network devices can include devices that access various communication networks. For example, controlled devices (such as various sensors, servers, actuators, etc.) in various industrial control networks communicate with controllers through industrial buses to achieve automatic control and management; various intelligent devices or facilities exchange information through various wireless and / or wired communication networks to achieve intelligent identification and management of devices or facilities; vehicles interact with network platforms through the Internet of Vehicles to achieve intelligent traffic management, intelligent dynamic information services and intelligent vehicle control, etc. In many cases, it is necessary to analyze the actual communication behavior of the device to obtain a communication model that can reflect the communication behavior of the device. The communication model of a network device refers to a collection of a series of data used to describe the way in which a network device responds to received network request information. The communication model of a network device has important application value in many occasions. For example, a honeypot system can use the communication model of a network device to imitate the communication behavior of a network device, respond to messages from an attacker, and make the attacker mistakenly believe that it is a real system, thereby inducing the attacker to carry out an attack to collect attack behaviors for analysis. Currently, the analysis of device communication behavior is done manually by technical personnel, which takes a lot of time and manpower, is costly, has a long cycle, and is inefficient.

[0003] Technical content

[0004] In view of this, the present application proposes a method and apparatus for establishing a device communication model, which are used to automatically analyze the communication behavior of the device and establish a communication model.

[0005] On the one hand, an embodiment of the present application provides a method for establishing a communication model of a network device, which may include:

[0006] determining a plurality of different first binary sequences, wherein each first binary sequence corresponds to a request message;

[0007] Sending the determined plurality of first binary sequences to the network device;

[0008] Obtaining, from the network device, response messages to the request messages corresponding to the plurality of first binary sequences, wherein each response message corresponds to a second binary sequence;

[0009] determining a rule in which each of the second binary sequences changes with each of the first binary sequences;

[0010] A communication model of the network device is established according to the rule.

[0011] On the other hand, an embodiment of the present application provides a device for establishing a communication model of a network device, which may include:

[0012] a request determination module, configured to determine a plurality of different first binary sequences, wherein each first binary sequence corresponds to a request message;

[0013] a sending module, configured to send the determined plurality of first binary sequences to the network device;

[0014] a response acquisition module, configured to acquire, from the network device, response messages to the request messages corresponding to the plurality of first binary sequences, wherein each response message corresponds to a second binary sequence;

[0015] A model building module is used to determine the rule of each second binary sequence changing with each first binary sequence, and build the communication model of the network device according to the rule.

[0016] On the other hand, the embodiment of the present application further provides another apparatus for establishing a communication model of a network device, which may include: a processor and a memory, wherein:

[0017] The memory stores computer-readable instructions, which can be executed by the processor to implement the method for establishing a communication model of the network device in each embodiment.

[0018] On the other hand, an embodiment of the present application further provides a computer-readable storage medium storing computer-readable instructions, which can be used to enable a processor to execute the method for establishing a communication model of a network device in each embodiment.

[0019] It can be seen that the technical solutions of each embodiment attempt to communicate with the network device using a plurality of binary sequences as request messages, and establish a communication model of the network device according to the response of the network device. It is possible to establish a communication model of the network device without knowing the communication mechanism of the network device, and provide important reference data for related application scenarios. The process can be executed by a computing device without human participation, and the communication model can be established in a relatively short time. The process of establishing the communication model is based on the analysis of a large number of binary sequences, so the communication model can more comprehensively and accurately reflect the communication behavior of the network device.

[0020] In various embodiments, the communication model may include at least one of the following:

[0021] The corresponding relationship between the request message and the response message;

[0022] the inferred message type of the request message;

[0023] the inferred message type of the response message;

[0024] an inferred meaning of at least one field in the request message;

[0025] The inferred meaning of at least one field in the response message.

[0026] In this way, each embodiment can determine the content of the communication model according to the specific situation, and can include information from multiple aspects, so as to provide as detailed information as possible on the communication behavior of the network device, helping related application scenarios to better understand the communication behavior logic of the network device.

[0027] In each embodiment, the correspondence between the request message and the response message may include at least one of the following:

[0028] One first binary sequence corresponds to a plurality of second binary sequences;

[0029] A plurality of the first binary sequences corresponds to one second binary sequence;

[0030] One first binary sequence corresponds to one second binary sequence;

[0031] One first binary sequence corresponds to zero second binary sequence;

[0032] A plurality of the first binary sequences corresponds to zero of the second binary sequence.

[0033] In this way, by giving the correspondence between each request message and the response of the network device in the communication model, the communication model can simply and intuitively reflect the message sending and receiving logic of the network device. The correspondence can facilitate the search of messages. When applied to the honeypot system, it can improve the response speed of the honeypot system and simplify the message processing of the honeypot system.

[0034] In each embodiment, when determining the rule of how each of the second binary sequences changes with each of the first binary sequences, it may be:

[0035] Extract binary segments of specified length from specified positions of the plurality of first binary sequences respectively;

[0036] Determine a rule in which response messages to the request messages corresponding to the plurality of first binary sequences change with the binary segments.

[0037] In this way, by extracting binary fragments from multiple request messages to analyze the pattern of changes in the corresponding response messages along with the fragments, the communication model established according to the pattern can reflect the response logic of the network device to the field-level information, so that the communication model is more detailed and accurate.

[0038] In each embodiment, when establishing the communication model of the network device according to the rule, it is possible to:

[0039] Determine the inferred meaning of each component in each of the first binary sequences and / or each of the second binary sequences according to the rule that each of the second binary sequences changes with each of the components in each of the first binary sequences;

[0040] The communication model is established according to the inferred meaning of each component.

[0041] It can be seen that by analyzing the relationship between the various components in the request message and the response message, the inferred meaning of the various components of the request message and / or response message can be determined. This information can enable the communication model to reflect more details of the message processing logic of the network device, facilitating more detailed and accurate analysis or simulation of the communication behavior of the network device.

[0042] In each embodiment, when determining the rule of changes of each second binary sequence with each component in each first binary sequence, at least one of the following methods may be used:

[0043] When the plurality of second binary sequences do not change with the first component in the corresponding plurality of first binary sequences, determining the inferred meaning of the first component as one or more of message length, time, check code, and value;

[0044] When the plurality of second binary sequences change with the first component in the corresponding plurality of first binary sequences, and the degree of change does not exceed a preset first threshold, determining the inferred meaning of the first component as a numerical value;

[0045] When the plurality of second binary sequences change with the first component in the corresponding plurality of first binary sequences, and the degree of change exceeds the first threshold, determining the inferred meaning of the first component as one or more of version information and type information;

[0046] When a first component in a plurality of the first binary sequences appears in a corresponding second binary sequence, determining the inferred meaning of the first component as a session identifier or a value;

[0047] When the value of the second component in the plurality of second binary sequences corresponding to the plurality of first binary sequences sent successively increases, the inferred meaning of the second component is determined as counting information.

[0048] In this way, by using the preset field characteristics to infer whether a certain component of the request message or the response message is of the preset field type, the inference process has good clarity and operability, and the inference result is accurate and reliable.

[0049] In various embodiments, when the determined plurality of first binary sequences are sent to the network device, the sending may be performed according to at least one of the following:

[0050] Sending the first binary sequence to the network device multiple times;

[0051] Sending the plurality of first binary sequences to the network device multiple times in different orders;

[0052] When determining the rule of how each of the second binary sequences changes with each of the first binary sequences, it is possible to:

[0053] Determine changes in multiple response messages corresponding to multiple transmissions of the same first binary sequence.

[0054] By sending the request message to the network device multiple times or in different orders, it is possible to detect that the same request message corresponds to different response messages, thereby making the speculation of the message type or message structure more complete and accurate.

[0055] In each embodiment, when establishing the communication model of the network device according to the rule, it is possible to:

[0056] Determine the inferred message type of each first binary sequence and / or each second binary sequence according to the rule that each second binary sequence changes with each first binary sequence;

[0057] The communication model is established according to the inferred message type.

[0058] In this way, by analyzing the request message and its response message to obtain the message type of the request message or response message, the communication model can reflect the macro characteristics of the request message and / or response message through the message type, thereby making the communication model more accurate.

[0059] In each embodiment, the step of determining the inferred message type of each first binary sequence and / or each second binary sequence according to the rule that each second binary sequence changes with each first binary sequence may include at least one of the following:

[0060] When the plurality of first binary sequences correspond to the same second binary sequence and the second binary sequence is determined to be an error prompt message, determining the request message corresponding to the plurality of first binary sequences as an invalid request message;

[0061] When a plurality of the second binary sequences are identical to a portion of the corresponding first binary sequences, determining the response message corresponding to the plurality of the second binary sequences as an echo message;

[0062] When a value of the second binary sequence is a Boolean value, determining a response message corresponding to the second binary sequence as a status response message, and determining a request message corresponding to the corresponding first binary sequence as a process request message;

[0063] When multiple second binary sequences received after sending one first binary sequence multiple times are different, determining that the request message corresponding to the first binary sequence is a request message related to time or status;

[0064] When no response message is received after sending the first binary sequence, the request message corresponding to the first binary sequence is determined as a message that triggers an unknown fault of the network device.

[0065] It can be seen that by identifying message types such as invalid request messages, echo messages, process request messages, etc., some special messages that cannot be described by message structures can be identified. Therefore, the established communication model is more comprehensive and accurate.

[0066] The technical solutions of each embodiment may also include:

[0067] sending a plurality of different third binary sequences to the network device based on the established communication model of the network device;

[0068] The communication model is adjusted according to the received response message corresponding to the third binary sequence.

[0069] It can be seen that after the communication model is established, the communication model can be verified by sending several request messages, and the communication model can be further adjusted to make the communication model more accurate and reliable. BRIEF DESCRIPTION OF THE DRAWINGS

[0070] The preferred embodiments of the present application will be described in detail below with reference to the accompanying drawings, so that those skilled in the art can better understand the above and other features and advantages of the present application. In the accompanying drawings:

[0071] Figure 1 A schematic diagram of a scenario in which the analysis device 20 of an embodiment of the present application communicates with a network device.

[0072] Figure 2 The present invention is a flowchart of a method for establishing a communication model of a network device according to an embodiment of the present application.

[0073] Figure 3A A schematic diagram of a device for establishing a communication model of a network device according to an embodiment of the present application.

[0074] Figure 3B A schematic diagram of a device for establishing a communication model of a network device according to an embodiment of the present application.

[0075] Figure 4 A schematic diagram of the correspondence between the request message and the response message of an embodiment of the present application.

[0076] Figure 5 A schematic diagram of the parsing principle of a message field in an embodiment of the present application.

[0077] Figure 6 A schematic diagram of a speculated message structure of an embodiment of the present application.

[0078] Figure 7 A schematic diagram of a honeypot system according to an embodiment of the present application.

[0079] The reference numerals are as follows:

[0080]

[0081] DETAILED DESCRIPTION

[0082] In order to make the purpose, technical solutions and advantages of the present application more clear, the present application is further described in detail with reference to the following embodiments.

[0083] Network devices in various communication networks may be attacked by the communication network or technicians may need to analyze their communication behavior, so it is necessary to establish a communication model for such network devices. To this end, each embodiment of the present application provides a device for analyzing the communication behavior of a network device and then establishing its communication model (hereinafter referred to as an analysis device). Figure 1 Schematic diagram of a scenario in which the analysis device of the embodiment of the present application communicates with the network device. Figure 1 As shown, the analysis device 20 communicates with the network device 10 via a communication connection 30. The communication connection 30 may be any wired or wireless connection; it may be a direct connection or an indirect connection via a network or other device.

[0084] The network device 10 may be a device connected to any communication network, including but not limited to industrial control networks, Internet of Things, Internet of Vehicles, local area networks, the Internet, cellular communication networks, and the like.

[0085] The network device 10 can access the communication network through a certain type of communication interface. In some embodiments, the analysis device 20 can communicate with the network device 10 through the same type of communication interface. For the network device 10, the analysis device 20 is also a network device 10 in a network that can communicate with it. For example, the analysis device 20 can access the communication network to which the network device 10 belongs, and communicate with the network device 10 as a device in the communication network. In other embodiments, the analysis device 20 can communicate with the network device 10 through different types of communication interfaces. For example, the network device 10 can access the communication network through a Wi-Fi interface, and the analysis device 20 can communicate with the network device 10 through the Bluetooth interface of the network device 10. Therefore, the present application does not limit the communication media and network protocol used by the analysis device 20 to communicate with the network device 10, that is, according to the OSI seven-layer communication model, the communication mechanisms of the physical layer, the data link layer, and the network layer are only channels for message transmission for the present application, and the present application does not limit the type of the channel.

[0086] In each embodiment, the analysis device 20 may attempt to send some binary sequences as request messages to the network device 10 , and obtain responses of the network device 10 to these request messages, thereby establishing a communication model of the network device 10 . Figure 2 1 is a flow chart of a method 200 for establishing a communication model of a network device 10 according to an embodiment of the present application. The method 200 may be performed by a device, such as Figure 1 The analysis device 20 executes. Figure 2 As shown, the method may include the following steps.

[0087] Step S11: determining a plurality of different first binary sequences, wherein each first binary sequence corresponds to a request message.

[0088] Step S12 : sending the determined plurality of first binary sequences to the network device 10 .

[0089] Step S13: Acquire response messages to the request messages corresponding to a plurality of first binary sequences from the network device 10, wherein each response message corresponds to a second binary sequence.

[0090] Step S14, determining the regularity of changes of each second binary sequence with each first binary sequence.

[0091] Step S15, establishing a communication model of the network device 10 according to the rule.

[0092] Among them, the plurality of first binary sequences may have the same or different lengths. One or more specified lengths may be determined according to pre-configured information, and a plurality of binary sequences may be determined as first binary sequences for each specified length. For example, the analysis device 20 may pre-configure a default length value of the request message, or may receive a length value input through a human-machine interface. These length values ​​may be discrete values, such as 16, 32, 64, etc., and the unit may be defaulted to bits or bytes. These length values ​​may also be a length range (such as 8-64), or a maximum length value (such as 128). The analysis device 20 may determine each possible length of the request message that needs to be attempted to be sent according to the default length value and the length value input through the human-machine interface.

[0093] For a certain specified length, the analysis device 20 may determine a first binary sequence having the specified length according to preset configuration information. In some embodiments, the analysis device 20 may treat each binary sequence having the specified length as a first binary sequence according to the default configuration. For example, when the specified length is 16 bits, the analysis device 20 may treat each binary number from 0x0000 to 0xFFFF as a first binary sequence. In some embodiments, the analysis device 20 may determine a binary sequence having the specified length and conforming to the feature as a first binary sequence according to the feature of a pre-configured request message. For example, if the feature of the request message is that the nth bit cannot be 0, the analysis device 20 may treat each binary sequence having the specified length and the nth bit not being 0 as a first binary sequence.

[0094] After each first binary sequence is sent to the network device 10, the analysis device 20 may receive a response message fed back by the network device 10, each response message is also a binary sequence, referred to herein as a second binary sequence. The analysis device 20 may record the correspondence between the first binary sequence and the second binary sequence of the corresponding response message. In some cases, the analysis device 20 may not receive a response message from the network device 10 for certain first binary sequences. In this case, the analysis device 20 may record that the second binary sequence corresponding to the first binary sequence is an empty sequence, i.e., a sequence without any elements.

[0095] The analyzing device 20 can establish a communication model of the network device 10 according to the law of the change of each second binary sequence with each first binary sequence. The law of the change of each second binary sequence with each first binary sequence refers to various relationships between a plurality of first binary sequences as request messages and a plurality of second binary sequences as response messages, including the relationship between each request message and its response message, and the relationship between response messages corresponding to multiple request messages, etc. The communication model of the network device 10 refers to a collection of a series of data used to describe the way in which the network device 10 responds to the received request message. The communication model may include any information related to the request message and / or the response message.

[0096] In some embodiments, the analysis device 20 may be implemented by hardware, such as FPGA, ASIC, etc. Figure 3A The communication model establishment device of the network device 10 of the embodiment of the present application (ie Figure 1 Schematic diagram of an analysis device 20). Figure 3A As shown, the device 20 may include: a request determination module 210 , a sending module 220 , a response acquisition module 230 and a model building module 240 .

[0097] The request determination module 210 may determine a plurality of different first binary sequences, wherein each first binary sequence corresponds to a request message.

[0098] The sending module 220 may send the determined plurality of first binary sequences to the network device 10 .

[0099] The response acquisition module 230 may acquire, from the network device 10 , response messages to the request messages corresponding to a plurality of first binary sequences, wherein each response message corresponds to a second binary sequence.

[0100] The model building module 240 may determine a rule in which each second binary sequence changes with each first binary sequence, and build a communication model of the network device 10 according to the rule.

[0101] In some embodiments, the analysis device 20 may also be implemented by a general-purpose processor executing instructions. Figure 3B Another communication model establishment device of the network device 10 of the embodiment of the present application (ie Figure 1 Schematic diagram of the analysis device 20). Figure 3B As shown, the device 20 may include: a processor 250 and a memory 260 .

[0102] The memory 260 may store a request determination module 261, a sending module 262, a response acquisition module 263, and a model building module 264 implemented by computer-readable instructions. The computer-readable instructions corresponding to the request determination module 261, the sending module 262, the response acquisition module 263, and the model building module 264 may be executed by the processor 250 to implement the Figure 3A The request determination module 210, the sending module 220, the response acquisition module 230 and the model building module 240 shown have similar functions and are not described in detail here.

[0103] It can be seen that the technical solutions of each embodiment attempt to communicate with the network device 10 using a plurality of binary sequences as request messages, and establish a communication model of the network device 10 according to the response of the network device 10. It is possible to establish a communication model of the network device 10 without knowing the communication mechanism of the network device 10, and provide important reference data for related application scenarios. The process can be executed by a computing device without human participation, and the communication model can be established in a relatively short time. The process of establishing the communication model is based on the analysis of a large number of binary sequences, so the communication model can more comprehensively and accurately reflect the communication behavior of the network device 10.

[0104] In some embodiments, when the analysis device 20 sends each first binary sequence as a request message, some first binary sequences may be sent to the network device 10 more than once. For example, in order to detect whether a response message to a request message is related to the timing of sending the request message, or whether the response message is related to the number of times the request message is sent, the analysis device 20 may send a first binary sequence to the network device 10 multiple times, and obtain the response message corresponding to each request message respectively. For another example, in order to detect whether the response messages to several request messages are related to the order in which these request messages are sent, the analysis device 20 may send a plurality of different first binary sequences to the network device 10 multiple times in different orders, and obtain a group of response messages corresponding to each group of first binary sequences respectively. At this time, when determining the law of changes of each second binary sequence with each first binary sequence, the analysis device 20 can determine the changes of multiple response messages corresponding to the multiple transmissions of the same first binary sequence as part of the law.

[0105] In this way, by sending the request message to the network device 10 multiple times or in different orders, it is possible to detect situations where the same request message corresponds to different response messages, such as whether the response is related to time or the status of the network device 10, thereby making the speculation on the message type or message structure more complete and accurate.

[0106] In various embodiments, the communication model of the network device 10 may include various information related to the request message and / or the response message. For example, the communication model may include, but is not limited to, at least one of the following:

[0107] The correspondence between request messages and response messages,

[0108] the inferred message type of the request message,

[0109] the inferred message type of the response message,

[0110] the inferred meaning of at least one field in the request message,

[0111] the inferred meaning of at least one field in the response message, etc.

[0112] It can be seen that by allowing the communication model to include multiple aspects of information, the analysis device 20 can determine the content of the communication model according to the specific situation, thereby providing as detailed information as possible on the communication behavior of the network device 10, helping related application scenarios to better understand the communication behavior logic of the network device 10.

[0113] Determine the correspondence between request messages and response messages

[0114] The correspondence between the request message and the response message may include, but is not limited to, at least one of the following: one first binary sequence corresponds to multiple second binary sequences, multiple first binary sequences correspond to one second binary sequence, one first binary sequence corresponds to one second binary sequence, one first binary sequence corresponds to an empty sequence, multiple first binary sequences correspond to an empty sequence, etc. Here, the empty sequence indicates that the analysis device 20 has not received a response message from the network device 10. After the analysis device 20 attempts to send each first binary sequence and obtains the corresponding response message, the relationship between each first binary sequence and its response message can be summarized to obtain the correspondence between the first binary sequence and the second binary sequence. For example, Figure 4 This is a schematic diagram of the correspondence between the request message and the response message of the embodiment of the present application. Among them, request message 1 corresponds to response messages 1-1 and 1-2, request messages 2, 3, and 4 all correspond to the same response message 2-1, request message N corresponds to response message N-1, where N is a positive integer, and so on. Each request message and each response message is a binary sequence, and the binary sequence corresponding to the response message may include an empty sequence.

[0115] In this way, by giving the correspondence between each request message and the response of the network device 10 in the communication model, the communication model can simply and intuitively reflect the message sending and receiving logic of the network device 10. The correspondence can facilitate message retrieval. When applied to the honeypot system, it can improve the response speed of the honeypot system and simplify the message processing of the honeypot system.

[0116] Parsing of message types

[0117] In some embodiments, the communication model may include the inferred message type of the request message and / or the inferred message type of the response message. The analysis device 20 may determine the inferred message type of each first binary sequence and / or each second binary sequence according to the law of the change of each second binary sequence with each first binary sequence, and establish a communication model according to the inferred message type. In this way, by analyzing the request message and its response message to obtain the message type of the request message or the response message, the communication model can reflect the macroscopic characteristics of the request message and / or the response message through the message type, thereby making the communication model more accurate.

[0118] In each embodiment, in order to determine the inferred message type of each first binary sequence and / or each second binary sequence, the analysis device 20 may be pre-set with a plurality of features of preset message types, and the analysis device 20 may use these features to infer the message type of the request message and / or the response message. The features of the preset message type may include features of a general message type, features of a request message type, and features of a response message type. Among them, the features of the message type corresponding to the request message may include not only features of the request message itself, but also features of a response message corresponding to the request message, and features of the relationship between the request message and its response message, etc. The features of the response message may include not only features of the response message itself, but also features of a request message corresponding to the response message, and features of the relationship between the response message and its request message, etc. Using the features of these preset message types, the analysis device 20 may determine the inferred message type of each first binary sequence and / or second binary sequence based on the obtained second binary sequence corresponding to each first binary sequence. For example, the method for determining the message type may include, but is not limited to, at least one of the following:

[0119] When the plurality of first binary sequences correspond to the same second binary sequence and the second binary sequence is determined to be an error prompt message, determining the request message corresponding to the plurality of first binary sequences as an invalid request message;

[0120] When the plurality of second binary sequences are identical to a portion of the corresponding first binary sequences, determining the response message corresponding to the plurality of second binary sequences as an echo message (Echo);

[0121] When a value of a second binary sequence is a Boolean value, determining a response message corresponding to the second binary sequence as a status response message, and determining a request message corresponding to the corresponding first binary sequence as a process request message;

[0122] When multiple second binary sequences received after sending a first binary sequence multiple times are different, determining that the request message corresponding to the first binary sequence is a request message related to time or status;

[0123] When no response message is received after sending a first binary sequence, the request message corresponding to the first binary sequence is determined as a message that triggers an unknown fault of the network device 10 .

[0124] Among them, a second binary sequence can be determined as an error message in a variety of ways. For example, the characteristics of the response message for prompting an error can be pre-set in the analysis device 20, and a second binary sequence can be determined as an error prompt message based on the characteristics. For another example, when a large number of first binary sequences are tried as request messages, the second binary sequence whose number of occurrences exceeds a preset threshold in the received second binary sequences can be determined as an error prompt message. For another example, the characteristics of the request message can be pre-set in the analysis device 20, and one or more first binary sequences that do not meet the characteristics of the request message can be sent to the network device 10, and the response message fed back by the network device 10 is determined as an error prompt message. These are just a few simple examples, and other embodiments can also be implemented using other methods.

[0125] An echo message refers to a response message sent back intact by the network device 10. The analysis device 20 may record a second binary sequence that is completely consistent with the corresponding first binary sequence as an echo message, and record the corresponding first binary sequence as a request message that triggers the echo message.

[0126] The process request message refers to a request message requesting the network device 10 to execute a preset process. At this time, the network device 10 will feedback a status response message. The content of the status response message is whether the process is successfully executed, so it is a Boolean value. Therefore, when a second binary sequence is a Boolean value, the second binary sequence can be inferred to be a status response message, and the corresponding first binary sequence can be inferred to be a process request message.

[0127] The inferred message type determined in the above process can be used as part of the communication model, or as an intermediate result in a subsequent analysis process to produce a more detailed analysis result. For example, when it is determined that the request message is a request message related to time or status, the components of the request message can be analyzed in the subsequent process to determine the components related to time or status in the request message and / or the corresponding response message.

[0128] It can be seen that by identifying message types such as invalid request messages, echo messages, process request messages, etc., some special messages that cannot be described by message structures can be identified. Therefore, the established communication model is more comprehensive and accurate.

[0129] Field analysis

[0130] In some embodiments, the communication model may include the inferred meaning of at least one field in the request message and / or the response message. The analysis device 20 may determine the inferred meaning of each component in each first binary sequence and / or each second binary sequence according to the law of the change of each second binary sequence with each component in each first binary sequence, and establish a communication model according to the inferred meaning of each component. By analyzing the relationship between each component in the request message and the response message, the inferred meaning of each component of the request message and / or the response message can be determined. This information can enable the communication model to reflect more details of the message processing logic of the network device 10, and facilitate a more detailed and accurate analysis or simulation of the communication behavior of the network device 10.

[0131] Generally, the need to establish a communication model is based on the fact that the communication mechanism of the network device 10 is completely unknown, that is, there is no known information about the format and content of the messages sent and received by the network device 10. Therefore, when determining the inferred meaning of a field in the request message, the analysis device 20 needs to complete two tasks: one is to determine the length of each field in the request message, and the other is to analyze the inferred meaning of each field.

[0132] The analyzing device 20 can respectively intercept binary segments of a specified length from the specified positions in the plurality of first binary sequences as a component, and determine the regularity of the response message of the request message corresponding to the plurality of first binary sequences changing with the binary segments. If the regularity of the response message changing with a binary segment can be found, the binary segment is determined to be a field.

[0133] Generally, a message may include a fixed-length field and a variable-length field. For a fixed-length field, the length of the field in each message is a preset length. For a variable-length field, a preset boundary value is usually used to indicate the end of the field.

[0134] In some embodiments, one or more specified lengths may be pre-configured in the analysis device 20, which may be a common specified length for each field, or a specified length for each different field. For example, a default length value may be pre-configured in the analysis device 20, or a length value input through a human-machine interface may be received. These length values ​​may be discrete multiple values, such as 1, 2, 8, etc., and the unit may be defaulted to bits or bytes. These length values ​​may also be a length range (such as 1-16), or a maximum value of a length (such as 32). The analysis device 20 may determine all possible lengths of the binary fragments to be intercepted based on the default length value and the length value input by the human-machine interface, and attempt to intercept the binary fragments corresponding to each possible length from the request message, and analyze whether it is a field. For another example, a plurality of predefined templates may be pre-configured in the analysis device 20. A predefined template refers to a predefined message structure, including the length and / or meaning of each field therein. The analysis device 20 may intercept the binary fragments corresponding to the length of each field from the request message in sequence according to a predefined template, and analyze whether it is a field.

[0135] In some embodiments, the analysis device 20 may also detect a preset field boundary value in the binary sequence of the message, thereby determining a possible boundary of a field. For example, when the analysis device 20 detects a preset value in the message, such as a binary fragment corresponding to "\n", "\0", etc., it can be considered that this is a field boundary.

[0136] In some embodiments, the request message may be viewed as a binary sequence consisting of multiple binary fragments, and thus a tree similar to a parsing model may be used to analyze the structure of the request message and the relationship between the request message and the response message. Figure 5 FIG. 1 is a schematic diagram of the parsing principle of a message field in an embodiment of the present application. Figure 5As shown, the request message can be parsed block by block starting from one end (e.g., the starting position) of the request message. For the first block parsed, binary fragments of each specified length (also referred to as fields or blocks here) can be intercepted from one end of the message according to different specified lengths to analyze the possible length of the first block and its inferred meaning. When it is determined that the first block has more than one possible length, a parsing tree can be established with the first block of each possible length as the root node 51, and the length of the first block and one or more inferred meanings can be recorded in the parsing tree. The analysis device 20 can start from the end position of the first block and repeat the above parsing process to obtain various possible lengths and inferred meanings of the second block, and use the various possibilities of the second block as the child nodes 521, 522-52n of the root node 51. Repeat the above process until all the contents of the request message are parsed and the leaf nodes 5n1, 5n2-5nn of the tree are reached. Each leaf node 5n1, 5n2-5nn can correspond to one or more response messages, where n is a positive integer.

[0137] When parsing a first binary sequence, the analysis device 20 may use information of one or more other first binary sequences and their response messages. In some embodiments, the network device 10 may use more than one request message structure. When the analysis device 20 parses a first binary sequence and determines that the structural characteristics of another first binary sequence do not conform to the structural characteristics of the currently parsed first binary sequence, it may be considered that the other first binary sequence uses a different message structure, and reparse it in the above manner to obtain one or more message structures corresponding to the other first binary sequence.

[0138] After parsing the set of all possible message structures of all possible request messages, one or more possible message structures of the request messages can be obtained, including the length of each field and one or more inferred meanings thereof. The obtained one or more inferred message structures and the first binary sequence and / or second binary sequence using each message structure can be added to the created communication model. During the above-mentioned parsing process of the request message, or after the parsing process is completed, the analysis device 20 can perform similar parsing on the response message, and the parsing process may use the parsing results of the corresponding request message to obtain the inferred message structure of the response message and the inferred meanings of the fields therein.

[0139] In this way, by intercepting binary fragments from multiple request messages to analyze the pattern of changes in the corresponding response messages along with the fragments, the communication model established according to the pattern can reflect the response logic of the network device 10 to the field-level information, so that the communication model is more detailed and accurate.

[0140] During the field parsing process of each embodiment, the analysis device 20 can determine the inferred field type of each block (i.e., binary fragment, component of the message) according to the characteristics of various pre-configured preset field types. For example, the method of inferring the field type may include, but is not limited to, at least one of the following:

[0141] When the plurality of second binary sequences do not change with the first component in the corresponding plurality of first binary sequences, determining the inferred meaning of the first component as one or more of a message length, a time, a check code, and a value;

[0142] When the plurality of second binary sequences change with the first component in the corresponding plurality of first binary sequences, and the degree of change does not exceed a preset first threshold, determining the inferred meaning of the first component as a numerical value;

[0143] When the plurality of second binary sequences change with the first component in the corresponding plurality of first binary sequences, and the degree of change exceeds a first threshold, determining the inferred meaning of the first component as one or more of version information and type information;

[0144] When a first component in the plurality of first binary sequences appears in a corresponding second binary sequence, determining the inferred meaning of the first component as a session identifier or a value;

[0145] When the value of the second component in the plurality of second binary sequences corresponding to the plurality of first binary sequences sent successively increases, the inferred meaning of the second component is determined as the counting information.

[0146] Among them, when the change of the first component in the request message will not cause the change of the response message, if the value of the first component is equal to the length of the request message, the inferred meaning of the first component can be determined as the message length; if the value of the first component conforms to the preset time pattern, the inferred meaning of the first component can be determined as the time; if the value of the first component is equal to a certain checksum obtained by executing a preset algorithm on the request message, the inferred meaning of the first component can be determined as a check code; otherwise, the inferred meaning of the first component can be determined as a numerical value.

[0147] When the change degree of the response message does not exceed a preset first threshold, the inferred meaning of the first component can be determined as a numerical value. Here, the first threshold can refer to the number of bits in the second binary sequence, or the percentage of the number of bits changed in the total length of the second binary sequence, etc.

[0148] For a block, the analysis device 20 can determine multiple inferred meanings in one identification step. The analysis device 20 can record all possible inferred meanings of the block, and can exclude some of the inferred meanings in subsequent identification steps. For example, when in one identification step, it is determined that the inferred meaning of a block includes version information and type information; in a subsequent identification step, the inferred meaning of the component can be determined as version information based on the position of the block. For example, the analysis device 20 can be preset: when the block is located in the first 30% of the sequence, the inferred meaning of the block can be version information, message length, etc., and the inferred meaning of the block does not include checksums, etc. In this way, the inferred meanings of the blocks can be identified one by one according to each preset judgment condition.

[0149] Figure 6 Schematic diagram of a speculated message structure of an embodiment of the present application. Figure 6 As shown, the inferred message structure includes the position and length of each field 61 in the message 62, and at least one inferred meaning 63.

[0150] In this way, by using the preset field characteristics to infer whether a certain component of the request message or the response message is of the preset field type, the inference process has good clarity and operability, and the inference result is accurate and reliable.

[0151] The above-mentioned message type determination process and field parsing process may be performed at any time.

[0152] For example, after a first binary sequence is sent, the message type of the first binary sequence and the fields therein may be parsed.

[0153] For another example, after all rounds of first binary sequences are sent, the message type of each first binary sequence and the fields therein may be parsed.

[0154] For another example, after a first binary sequence is sent, the message type and the fields therein of the first binary sequence may be parsed, and one or more related first binary sequences may be sent multiple times during the parsing process. After parsing the message type and field meaning of these first binary sequences, another first binary sequence that has not been sent is tried to be sent, and the message type and field thereof are parsed. For example, in the above-mentioned message type determination process and field parsing process, other related first binary sequences may be sent as needed. For example, when it is detected that the response messages obtained by two transmissions of a first binary sequence are different, the first binary sequence and the related multiple first binary sequences may be sent multiple times for a preset number of times according to the preset processing method for the situation, and the sending order of each sequence may be adjusted in different rounds. For another example, in order to parse whether a block of the first binary sequence is a field, the content of the first binary sequence except the block may be kept unchanged according to the preset method, and only different values ​​may be assigned to the block to obtain multiple binary sequences, and these binary sequences may be sent to the network device 10, and the corresponding response message may be obtained, thereby obtaining whether the block is a field or the inferred meaning of the field.

[0155] The specific sending and parsing process can be determined as needed and is not limited here.

[0156] In each embodiment, after establishing the communication model of the network device 10, the analysis device 20 may also send a plurality of different third binary sequences to the network device 10 based on the established communication model of the network device 10, and adjust the communication model according to the response message corresponding to the received third binary sequence. The adjustment process may be performed by an adjustment module (not shown) in the analysis device 20.

[0157] sending a plurality of different third binary sequences to the network device based on the established communication model of the network device;

[0158] The communication model is adjusted according to a response message corresponding to the third binary sequence obtained from the network device.

[0159] For example, when a received response message to a third binary sequence is inconsistent with a response message corresponding to a request message identical to the third binary sequence in a communication model, the third binary sequence and its related sequences (e.g., a sequence of several request messages related to the response and its sending order, etc.) can be sent again (or multiple times) to the network device 10, and the correspondence between the request message identical to the third binary sequence and its response message in the communication model is adjusted according to the received response message.

[0160] For another example, when it is concluded from a received response message to a third binary sequence that the message type of the third binary sequence is inconsistent with the message type corresponding to the request message identical to the third binary sequence in the communication model, the third binary sequence and its related sequences (such as a sequence of several request messages related to the order in which the responses are sent, etc.) can be sent again (or multiple times) to the network device 10, and the message type of the request message identical to the third binary sequence in the communication model can be adjusted according to the received response message.

[0161] For another example, when a received response message is inconsistent with the response message inferred according to the communication model, based on a third binary sequence constructed according to the inferred meaning of at least one field of the request message in the communication model, multiple fourth binary sequences can be constructed based on the inferred meaning of at least one field of the request message in the communication model, and the network device 10 can adjust the inferred meaning of at least one field of the request message in the communication model for these response messages of the fourth binary sequences.

[0162] In this way, after the communication model is established, the communication model can be verified by sending a number of request messages, and the communication model can be further adjusted to make the communication model more accurate and reliable.

[0163] In some embodiments, the analysis device 20 may provide the established communication model to a computing device for use. For example, the computing device may use the communication model to find errors and vulnerabilities of the device, or use the communication model to establish a honeypot system, etc. The honeypot system is intended to collect information about attackers by imitating vulnerable systems. Figure 7 Schematic diagram of a honeypot system according to an embodiment of the present application. The honeypot system may include a traffic distributor 71, a traffic analyzer 72, and at least one physical device 73 and / or a virtual device 74 for simulating a network device 10 to generate a response message.

[0164] The traffic distributor 71 may distribute the received network traffic to each physical device 73 and / or virtual device 74 according to a preset distribution principle.

[0165] The physical device 73 and / or the virtual device 74 may utilize the communication model established in each embodiment to determine the response message corresponding to each request message in the received network traffic, and send the response message to the network.

[0166] The traffic analyzer 72 can analyze the request messages in the received network traffic, the response messages sent by the physical device 73 and / or the virtual device 74, and the further message interaction operations performed by the external devices on these response messages to obtain information such as the attack path and means of the attacker.

[0167] It can be seen that by utilizing the communication model established in each embodiment, the honeypot system can respond to external attacks, confuse the attacker into thinking that the honeypot system is a real device, and obtain further attack operations performed by the attacker in response to the device, thereby obtaining richer information about the attacker.

[0168] As can be seen from the above examples, the technical solutions of the embodiments can construct a communication model of the network device 10. By establishing a communication model as the description information of various messages processed by the network device 10, information on the communication behavior pattern of the network device 10 can be obtained. This process is completed by a computing device, which reduces manpower costs and is fast and efficient. In addition, the solution can establish a communication model of the network device 10 without any known information about the format and content of the messages sent and received by the network device 10, which is particularly suitable for the analysis and modeling of new devices.

[0169] The embodiment of the present application further provides a readable storage medium in which machine-readable instructions are stored, and when the machine-readable instructions are executed by a machine, the machine executes the method for establishing the communication model of the network device 10 described in any of the above embodiments.

[0170] The readable medium stores machine-readable instructions, which, when executed by the processor, cause the processor to execute any of the aforementioned methods. Specifically, a system or device equipped with a readable storage medium may be provided, on which a software program code implementing the functions of any of the above-mentioned embodiments is stored, and a computer or processor of the system or device reads and executes the machine-readable instructions stored in the readable storage medium.

[0171] In this case, the program code read from the machine-readable medium itself can implement the function of any one of the above embodiments, so the machine-readable code and the machine-readable storage medium storing the machine-readable code constitute part of the present application.

[0172] Examples of readable storage media include floppy disks, hard disks, magneto-optical disks, optical disks (such as CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RAM, DVD-RW, DVD+RW), magnetic tapes, non-volatile memory cards, and ROMs. Alternatively, the program code may be downloaded from a server computer or a cloud via a communication network.

[0173] Those skilled in the art should understand that the various embodiments disclosed above can be modified and altered in various ways without departing from the essence of the application. Therefore, the protection scope of the present application should be defined by the appended claims.

[0174] It should be noted that not all steps and units in the above-mentioned processes and system structure diagrams are necessary, and some steps or units can be ignored according to actual needs. The execution order of each step is not fixed and can be adjusted as needed. The device structure described in the above-mentioned embodiments can be a physical structure or a logical structure, that is, some units may be implemented by the same physical entity, or some units may be implemented by multiple physical entities, or some components in multiple independent devices may be implemented together.

[0175] In the above embodiments, the hardware unit can be realized by mechanical means or electrical means. For example, a hardware unit or a processor can include permanent dedicated circuits or logic (such as special processors, FPGA or ASIC) to complete the corresponding operation. The hardware unit or the processor can also include programmable logic or circuits (such as general-purpose processors or other programmable processors), which can be temporarily set by software to complete the corresponding operation. Concrete implementation (mechanical means or dedicated permanent circuits or temporarily set circuits) can be determined based on cost and time considerations.

[0176] The above are only preferred embodiments of the present application and are not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the protection scope of the present application.

Claims

1. A method for establishing a communication model of a network device (10), characterized in that: include: determining a plurality of different first binary sequences, wherein each first binary sequence corresponds to a request message; Sending the determined plurality of the first binary sequences to the network device (10) which is unaware of its communication mechanism; Obtaining response messages to a plurality of request messages corresponding to the first binary sequences from the network device (10), wherein each response message corresponds to a second binary sequence; determining a rule in which each of the second binary sequences changes with each of the first binary sequences; A communication model of the network device (10) is established according to the rule; the determining of the rule that each of the second binary sequences changes with each of the first binary sequences comprises: respectively cutting binary segments of a specified length from specified positions in a plurality of the first binary sequences; Determine a rule in which a response message to a request message corresponding to the plurality of first binary sequences changes with the binary fragment; The communication model of the network device (10) refers to a collection of a series of data used to describe the way in which the network device (10) responds to received network request information.

2. The method according to claim 1, characterized in that The communication model includes at least one of the following: The correspondence between request messages and response messages; the inferred message type of the request message; the inferred message type of the response message; the inferred meaning of at least one field in the request message; The inferred meaning of at least one field in the response message.

3. The method according to claim 2, characterized in that The correspondence between the request message and the response message includes at least one of the following: One first binary sequence corresponds to a plurality of second binary sequences; A plurality of the first binary sequences corresponds to one second binary sequence; One first binary sequence corresponds to one second binary sequence; One of the first binary sequences corresponds to an empty sequence; A plurality of the first binary sequences correspond to one empty sequence.

4. The method according to any one of claims 1 to 3, characterized in that: A communication model of the network device (10) is established according to the rule, comprising: Determine the inferred meaning of each component in each of the first binary sequences and / or each of the second binary sequences according to the rule that each of the second binary sequences changes with each of the components in each of the first binary sequences; The communication model is established according to the inferred meaning of each component.

5. The method according to claim 4, characterized in that Determining the inferred meaning of each component in each of the first binary sequences and / or each of the second binary sequences comprises at least one of the following: When the plurality of second binary sequences do not change with the first component in the corresponding plurality of first binary sequences, determining the inferred meaning of the first component as at least one of a message length, a time, a check code, and a value; When the plurality of second binary sequences change with the first component in the corresponding plurality of first binary sequences, and the degree of change does not exceed a preset first threshold, determining the inferred meaning of the first component as a numerical value; When the plurality of second binary sequences change with the first component in the corresponding plurality of first binary sequences, and the degree of change exceeds the first threshold, determining the inferred meaning of the first component as one or more of version information and type information; When a first component in a plurality of the first binary sequences appears in a corresponding second binary sequence, determining the inferred meaning of the first component as a session identifier or a value; When the value of the second component in the plurality of second binary sequences corresponding to the plurality of first binary sequences sent successively increases, the inferred meaning of the second component is determined as counting information.

6. The method according to any one of claims 1 to 3, characterized in that: Sending the determined plurality of the first binary sequences to the network device (10) comprises at least one of the following: Sending the first binary sequence to the network device (10) multiple times; Sending the determined plurality of first binary sequences to the network device (10) multiple times in different orders; The step of determining a rule in which each of the second binary sequences changes with each of the first binary sequences includes: Determine changes in multiple response messages corresponding to multiple transmissions of the same first binary sequence.

7. The method according to any one of claims 1 to 3, characterized in that: A communication model of the network device (10) is established according to the rule, comprising: Determine the inferred message type of each first binary sequence and / or each second binary sequence according to the rule that each second binary sequence changes with each first binary sequence; The communication model is established according to the inferred message type.

8. The method according to claim 7, characterized in that Determining the inferred message type of each of the first binary sequences and / or each of the second binary sequences according to the rule that each of the second binary sequences changes with each of the first binary sequences includes: At least one of the following: When the plurality of first binary sequences correspond to the same second binary sequence and the second binary sequence is determined to be an error prompt message, determining the request message corresponding to the plurality of first binary sequences as an invalid request message; When a plurality of the second binary sequences are identical to the corresponding first binary sequences, determining the response messages corresponding to the plurality of the second binary sequences as echo messages; When a value of the second binary sequence is a Boolean value, determining a response message corresponding to the second binary sequence as a status response message, and determining a request message corresponding to the corresponding first binary sequence as a process request message; When multiple second binary sequences received after sending one first binary sequence multiple times are different, determining that the request message corresponding to the first binary sequence is a request message related to time or status; When a response message to a request message corresponding to the first binary sequence is an empty sequence, the request message corresponding to the first binary sequence is determined as a message that triggers an unknown fault of the network device (10).

9. The method according to claim 8, characterized in that Further including: Sending a plurality of different third binary sequences to the network device (10) based on the established communication model of the network device; The communication model is adjusted according to the received response message corresponding to the third binary sequence.

10. A device (20) for establishing a communication model of a network device (10), characterized in that: include: a request determination module (210) for determining a plurality of different first binary sequences, wherein each first binary sequence corresponds to a request message; a sending module (220), configured to send the determined plurality of the first binary sequences to the network device (10) which is unaware of its communication mechanism; a response acquisition module (230), configured to acquire, from the network device (10), response messages to the request messages corresponding to the plurality of first binary sequences, wherein each response message corresponds to a second binary sequence; A model building module (240) is used to determine the law of changes of each second binary sequence with each first binary sequence, and to establish a communication model of the network device (10) according to the law; the determining the law of changes of each second binary sequence with each first binary sequence includes: respectively cutting binary fragments of specified length from specified positions in a plurality of first binary sequences; Determine a rule in which a response message to a request message corresponding to the plurality of first binary sequences changes with the binary fragment; The communication model of the network device (10) refers to a collection of a series of data used to describe the way in which the network device (10) responds to received network request information.

11. The device (20) according to claim 10, characterized in that The model building module (240) is used to: Determine the inferred meaning of each component in each of the first binary sequences and / or each of the second binary sequences according to the rule that each of the second binary sequences changes with each of the components in each of the first binary sequences; The communication model is established according to the inferred meaning of each component.

12. The device (20) according to claim 11, characterized in that The model building module (240) is used for at least one of the following: When the plurality of second binary sequences do not change with the first component in the corresponding plurality of first binary sequences, determining the inferred meaning of the first component as at least one of a message length, a time, a check code, and a value; When the plurality of second binary sequences change with the first component in the corresponding plurality of first binary sequences, and the degree of change does not exceed a preset first threshold, determining the inferred meaning of the first component as a numerical value; When the plurality of second binary sequences change with the first component in the corresponding plurality of first binary sequences, and the degree of change exceeds the first threshold, determining the inferred meaning of the first component as one or more of version information and type information; When a first component in a plurality of the first binary sequences appears in a corresponding second binary sequence, determining the inferred meaning of the first component as a session identifier or a value; When the value of the second component in the plurality of second binary sequences corresponding to the plurality of first binary sequences sent successively increases, the inferred meaning of the second component is determined as counting information.

13. The device (20) according to any one of claims 10 to 12, characterized in that: The sending module (220) is used for at least one of the following: Sending the first binary sequence to the network device (10) multiple times; Sending the determined plurality of first binary sequences to the network device (10) multiple times in different orders; Wherein, the model building module is used to: Determine changes in multiple response messages corresponding to multiple transmissions of the same first binary sequence.

14. The device (20) according to any one of claims 10 to 12, characterized in that: The model building module (240) is used to: Determine the inferred message type of each first binary sequence and / or each second binary sequence according to the rule that each second binary sequence changes with each first binary sequence; The communication model is established according to the inferred message type.

15. The device (20) according to claim 14, characterized in that The model building module (240) is used for at least one of the following: When the plurality of first binary sequences correspond to the same second binary sequence and the second binary sequence is determined to be an error message, determining the request message corresponding to the plurality of first binary sequences as an invalid request message; When a plurality of the second binary sequences are identical to the corresponding first binary sequences, determining the response messages corresponding to the plurality of the second binary sequences as echo messages; When a value of the second binary sequence is a Boolean value, determining a response message corresponding to the second binary sequence as a status response message, and determining a request message corresponding to the corresponding first binary sequence as a process request message; When multiple second binary sequences received after sending one first binary sequence multiple times are different, determining that the request message corresponding to the first binary sequence is a request message related to time or status; When a response message to a request message corresponding to the first binary sequence is an empty sequence, the request message corresponding to the first binary sequence is determined as a message that triggers an unknown fault of the network device (10).

16. The device (20) according to any one of claims 10 to 12, characterized in that: Further including: Adjustment module for Sending a plurality of different third binary sequences to the network device (10) based on the established communication model of the network device (10); The communication model is adjusted according to a response message corresponding to the third binary sequence obtained from the network device (10).

17. A device (20) for establishing a communication model of a network device, characterized in that: include: A processor (250) and a memory (260), wherein: The memory (260) stores computer-readable instructions, which can be executed by the processor (250) to implement the method for establishing a communication model of the network device (10) as described in any one of claims 1 to 9.

18. A computer-readable storage medium storing computer-readable instructions, characterized in that: The instructions are used to enable the processor to execute the method for establishing a communication model of the network device (10) as claimed in any one of claims 1 to 9.

Images