Protocol data processing method and apparatus, electronic device, and storage medium
By removing redundant and padding fields, and utilizing the location information and clustering techniques of protocol data, the problem of classifying multi-session obfuscated network stream data was solved, achieving accurate protocol data classification without context.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- TSINGHUA UNIVERSITY
- Filing Date
- 2022-02-08
- Publication Date
- 2026-06-09
AI Technical Summary
Existing technologies lack effective methods for classifying protocol data in multi-session conflated network streams, especially when there is no contextual relationship of continuous complete sessions, making it difficult to accurately identify the category of unknown protocol data.
By removing redundant and padding fields from the protocol data, extracting field location information as features, optimizing clustering parameters and judging feature distances, and combining trie information, the protocol data is classified.
In the absence of context, it improves the accuracy of protocol data classification and the efficiency of automated processing, reduces the possibility of local optima, and provides more accurate cluster information to identify protocol data categories.
Smart Images
Figure CN114462534B_ABST
Abstract
Description
Technical Field
[0001] This disclosure relates to the field of computer technology, and in particular to a protocol data processing method and apparatus, electronic device and storage medium. Background Technology
[0002] With the rapid development of the internet and communications fields, the categories of network applications and services are increasing. Various network protocols, from the physical layer to the application layer, are the main medium for information interconnection in network information systems. However, a significant proportion of this massive network traffic consists of data from unknown protocols, making network management and maintenance increasingly burdensome and difficult. According to reports, approximately 45% of network traffic is unidentifiable, 23% of IT administrators cannot identify 70% of network traffic, and a quarter of respondents are unaware of how their bandwidth is being consumed.
[0003] In related technologies, when classifying protocol data, protocol identification and parsing are typically performed on network stream data from multiple consecutive complete sessions. This type of data has a certain contextual relationship and can play a significant role in protocol classification. However, in other cases, network stream data with multiple sessions may be mixed up, and the data may not have a contextual relationship of consecutive complete sessions. Therefore, classifying this type of protocol data is much more difficult. Summary of the Invention
[0004] This disclosure presents a protocol data processing method, apparatus, electronic device, and storage medium.
[0005] According to one aspect of this disclosure, a protocol data processing method is provided, comprising: removing preset fields from protocol data to be processed transmitted in a network to obtain first protocol data; performing feature extraction processing on the first protocol data according to the position information of each field in the first protocol data to obtain first feature information of the first protocol data; and obtaining category information of the protocol data to be processed according to the first feature information and preset cluster information of multiple protocol data.
[0006] In one possible implementation, the preset field includes a redundant field and / or a padding field.
[0007] In one possible implementation, the method further includes: uniformly initializing the clustering parameters to obtain uniformly initialized clustering parameters; performing random optimization processing on the uniformly initialized clustering parameters at a preset ratio to obtain clustering information; and performing clustering processing on the feature information of multiple protocol data according to the clustering information to obtain clusters of the multiple protocol data.
[0008] In one possible implementation, clustering the feature information of multiple protocol data to obtain clusters of the multiple protocol data includes: determining the feature distance between the feature information of each protocol data; and clustering the feature information of the protocol data according to the feature distance to obtain clusters of the multiple protocol data.
[0009] In one possible implementation, the cluster information includes representative feature information of the cluster. Based on the first feature information and the cluster information of a plurality of preset protocol data, the category information of the protocol data to be processed is obtained, including: determining the category information of the protocol data to be processed based on the feature distance between the first feature information and the representative feature information of the clusters of the plurality of protocol data.
[0010] In one possible implementation, the cluster information includes the trie information of the cluster. Based on the first feature information and the cluster information of multiple preset protocol data, the category information of the protocol data to be processed is obtained, including: querying the protocol data to be processed based on the trie information of the multiple protocol data to obtain the category information of the protocol data to be processed.
[0011] According to one aspect of this disclosure, a protocol data processing apparatus is provided, comprising: a removal module for removing preset fields from protocol data to be processed transmitted in a network to obtain first protocol data; a feature extraction module for performing feature extraction processing on the first protocol data based on the position information of each field in the first protocol data to obtain first feature information of the first protocol data; and a category acquisition module for obtaining category information of the protocol data to be processed based on the first feature information and preset cluster information of multiple protocol data.
[0012] In one possible implementation, the preset field includes a redundant field and / or a padding field.
[0013] In one possible implementation, the device further includes: a clustering module, which performs uniform initialization of clustering parameters to obtain uniformly initialized clustering parameters; performs random optimization processing on the uniformly initialized clustering parameters at a preset ratio to obtain clustering information; and performs clustering processing on the feature information of multiple protocol data according to the clustering information to obtain clusters of the multiple protocol data.
[0014] In one possible implementation, the clustering module is further configured to: determine the feature distance between the feature information of each of the protocol data; and perform clustering processing on the feature information of the protocol data according to the feature distance to obtain the clusters of the multiple protocol data.
[0015] In one possible implementation, the cluster information includes representative feature information of the cluster, and the category acquisition module is further configured to: determine the category information of the protocol data to be processed based on the feature distance between the first feature information and the representative feature information of the clusters of the plurality of protocol data.
[0016] In one possible implementation, the cluster information includes the trie information of the cluster, and the category acquisition module is further configured to: query the protocol data to be processed based on the trie information of the plurality of protocol data to obtain the category information of the protocol data to be processed.
[0017] According to one aspect of this disclosure, an electronic device is provided, comprising: a processor; a memory for storing processor-executable instructions; wherein the processor is configured to invoke the instructions stored in the memory to perform the method described above.
[0018] According to one aspect of this disclosure, a computer-readable storage medium is provided that stores computer program instructions thereon, which, when executed by a processor, implement the above-described method.
[0019] According to the protocol data processing method of the embodiments of this disclosure, preset fields that may interfere with data classification can be removed, and feature information for classification can be obtained based on the position information of each field of the protocol data itself. Furthermore, multiple feature information in the database can be clustered, and the possibility of getting trapped in local optima can be reduced during the clustering process, resulting in more accurate cluster information. Based on the cluster information, the category information of the protocol data can be determined. This allows for the determination of category information based on the characteristics of the protocol data itself without contextual relationships, providing a basis for identifying the location of the protocol data.
[0020] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Other features and aspects of this disclosure will become clear from the following detailed description of exemplary embodiments with reference to the accompanying drawings. Attached Figure Description
[0021] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this disclosure and, together with the specification, serve to illustrate the technical solutions of this disclosure.
[0022] Figure 1 A flowchart illustrating a protocol data processing method according to an embodiment of this disclosure is shown;
[0023] Figure 2 A schematic diagram illustrating protocol data according to an embodiment of this disclosure is shown;
[0024] Figure 3A schematic diagram showing location information according to an embodiment of the present disclosure;
[0025] Figure 4 A schematic diagram of a trie according to an embodiment of the present disclosure is shown;
[0026] Figure 5 This diagram illustrates an application of the protocol data processing method according to an embodiment of the present disclosure.
[0027] Figure 6 A block diagram of a protocol data processing apparatus according to an embodiment of the present disclosure is shown;
[0028] Figure 7 A block diagram of an electronic device according to an embodiment of the present disclosure is shown;
[0029] Figure 8 A block diagram of an electronic device according to an embodiment of the present disclosure is shown. Detailed Implementation
[0030] Various exemplary embodiments, features, and aspects of this disclosure will now be described in detail with reference to the accompanying drawings. The same reference numerals in the drawings denote elements that have the same or similar functions. Although various aspects of the embodiments are shown in the drawings, they are not necessarily drawn to scale unless specifically indicated otherwise.
[0031] The term “exemplary” as used herein means “serving as an example, embodiment, or illustration.” Any embodiment illustrated herein as “exemplary” is not necessarily to be construed as superior to or better than other embodiments.
[0032] In this document, the term "and / or" is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent three cases: A alone, A and B simultaneously, and B alone. Furthermore, the term "at least one" in this document means any combination of at least two of any one or more elements. For example, including at least one of A, B, and C can mean including any one or more elements selected from the set consisting of A, B, and C.
[0033] Furthermore, to better illustrate this disclosure, numerous specific details are set forth in the following detailed description. Those skilled in the art will understand that this disclosure can be practiced without certain specific details. In some instances, methods, means, components, and circuits well known to those skilled in the art have not been described in detail in order to highlight the main points of this disclosure.
[0034] Figure 1 A flowchart illustrating a protocol data processing method according to an embodiment of this disclosure is shown, such as... Figure 1 As shown, the method includes:
[0035] In step S11, preset fields are removed from the protocol data to be processed transmitted in the network to obtain the first protocol data;
[0036] In step S12, based on the position information of each field in the first protocol data, feature extraction processing is performed on the first protocol data to obtain the first feature information of the first protocol data;
[0037] In step S13, the category information of the protocol data to be processed is obtained based on the first feature information and the preset cluster information of multiple protocol data.
[0038] According to the protocol data processing method of the embodiments of this disclosure, preset fields that may interfere with data classification can be removed, feature information for classification can be obtained based on the position information of each field of the protocol data itself, and the category information of the protocol data can be determined based on the cluster information obtained by clustering. The category information can be determined based on the features of the protocol data itself without contextual relationship, providing a basis for identifying the location of the protocol data.
[0039] In one possible implementation, to address the problem of classifying unknown protocol data, in step S11, preset fields in the protocol data to be processed can be removed. These preset fields may be fields without specific meaning. Such fields may be fields set only to meet the form of the communication protocol and have no specific meaning, but they may interfere with the distribution of data and affect the classification of data.
[0040] In the example, the preset fields include redundant fields and / or padding fields. For example, redundant fields may include fields that have no practical meaning, and padding fields may include fields that are filled at specific positions in the data to reach a specific length. For example, a field with data of 0x00 is a redundant field, and a field at the end of the protocol data is a padding field, etc. This disclosure does not limit the specific meaning of redundant fields and padding fields.
[0041] Figure 2 A schematic diagram illustrating protocol data according to an embodiment of this disclosure is shown, such as... Figure 2 As shown, Figure 2The protocol data to be processed may include multiple fields. For example, the first field may contain data A, the second field may contain data 0x00, the third field may contain data B, and so on, with the last three fields containing data 0xff. The second field can be considered redundant, as its data has no practical meaning. Similarly, the last three fields can be considered filler fields, also having no practical meaning. These fields can be removed to obtain the first protocol data. In the example, all fields can be removed entirely, for example, leaving only the original first, third, fourth, and fifth fields in the first protocol data; that is, the first protocol data retains only four fields, with data A, B, C, and D respectively. Alternatively, only the data in a field can be removed, leaving the original second and last three fields empty, ensuring that the positional information of the retained fields remains unchanged. This disclosure does not impose any restrictions on this approach.
[0042] In one possible implementation, in step S12, feature extraction processing can be performed on the first protocol data after removing the aforementioned fields. When extracting feature information, the positional information of each data bit in the first protocol data can also be referenced. In this example, protocol data differs from text information. In text data, a particular text (e.g., a character, word, phrase, sentence, etc.) has a specific meaning regardless of its position. For example, the number 1 in text information always represents "quantity 1". However, in protocol data, the same data appearing in different positions can represent different meanings. For example, "0x06" in the fifth byte of the ARP protocol represents "hardware size," while in the tenth byte of the IP protocol it represents "TCP protocol." Therefore, even if the data is the same, different positions can lead to different meanings in protocol data. Therefore, when classifying protocol data, the positional information of each field can be referenced, i.e., which data bit each field contains.
[0043] In the example, the position information of the field can be the position information before removing the preset field or the position information after removing the preset field; this disclosure does not limit this.
[0044] Figure 3 A schematic diagram illustrating location information according to embodiments of the present disclosure is shown, such as... Figure 3As shown, the protocol data may include multiple fields. The second and fifth fields (e.g., the field with data 0x00) can be removed to obtain the first protocol data. In the first protocol data, although the aforementioned fields are removed, the position information of each field before removal can still be obtained to preserve the position information and meaning of each field in the original protocol data. For example, in the original protocol data, the position information of data A is 0, the position information of data 0x00 is 1 (removed), the position information of data B is 2, the position information of data C is 3, the position information of data D is 4, the position information of data 0x00 is 5 (removed), and the position information of data E is 6. Furthermore, in the protocol data after removing the aforementioned fields, the position information of some combinations of fields can also be obtained. For example, fields separated by data that were not removed can be combined, and their position information can be obtained. For example, the position information of data BC is 2 (e.g., using the position information of the first data as the combined position information; this disclosure does not limit this), the position information of data CD is 3, the position information of data BCD is 2, and so on.
[0045] In one possible implementation, a natural language processing model can be used to extract features from the first protocol data, and during the feature extraction process, the positional information of each field can be obtained simultaneously. For example, the first protocol data can be processed using a multi-scale n-gram natural language processing model, and this model can obtain the first feature information of the first protocol data by referring to the positional information of each field. The first feature information can be feature information representing the specific meaning of the protocol data to be processed. In the example, the first feature information can be feature information in the form of feature matrix, feature vector, feature tensor, etc., and this disclosure does not limit the form of the first feature information.
[0046] In one possible implementation, low-frequency feature information of multiple dimensions may be generated during the feature extraction process. This low-frequency feature information can be deleted to reduce the dimensionality and complexity of the computation and improve computational efficiency.
[0047] In one possible implementation, in step S13, the protocol data to be processed can be classified based on the first feature information. For example, a database including multiple feature information can be pre-established, and the category information of the multiple feature information can be determined. Matching can be performed in the database based on the first feature information. For example, the feature information with the smallest feature distance (e.g., cosine distance or Euclidean distance in feature space) to the first feature information can be found, and the category information of the feature information can be used as the category information of the protocol data to be processed.
[0048] In one possible implementation, the multiple feature information in the database can be feature information from multiple protocol data used as samples. The methods for obtaining the category information of the feature information can include manual annotation; supervised training of a classification model (e.g., neural network model, support vector machine model, decision tree model, etc.) through partial manual annotation, and determining the category information of other feature information through the classification model; and classification through unsupervised training methods such as clustering. This disclosure does not impose any limitations on this.
[0049] In one possible implementation, unsupervised clustering can be used to obtain category information of multiple protocol data in the database. This allows for the acquisition of category information of the protocol data to be processed without human intervention, thereby improving automation and processing efficiency. The method further includes: uniformly initializing clustering parameters to obtain uniformly initialized clustering parameters; randomly optimizing the uniformly initialized clustering parameters at a preset ratio to obtain clustering information; and clustering the feature information of the multiple protocol data based on the clustering information to obtain clusters of the multiple protocol data.
[0050] In one possible implementation, during clustering, the clustering parameters (e.g., the number of clusters, the number of features included in the clusters, the radius of the clusters, etc.) can be optimized first. In the example, particle swarm optimization can be used to optimize the clustering parameters to obtain better clustering results.
[0051] In one possible implementation, clustering parameters can be treated as particles in a particle swarm optimization method and optimized to obtain the optimal parameters for clustering, which serve as clustering information. During the optimization process, the clustering parameters can be initialized first. In one example, the clustering parameters can be randomly initialized, i.e., randomly set, and optimized during the optimization process. In another example, to improve the efficiency of clustering, the clustering parameters can be uniformly initialized, for example, to make the number of features included in each cluster uniform, and / or to make the radii of each cluster uniform, thereby improving the efficiency of the optimization. This disclosure does not limit the method of initialization.
[0052] In one possible implementation, after uniform initialization, the uniformly initialized clustering parameters can be optimized. For example, the uniformly initialized clustering parameters can be used as particles in a particle swarm optimization method for optimization.
[0053] In one possible implementation, during the optimization process described above, the clustering parameters can be adjusted in multiple rounds according to a preset rule in order to seek the optimal solution, that is, to seek the optimal clustering parameters.
[0054] In one possible implementation, during the optimization process, factors such as the magnitude and direction of adjustment of clustering parameters may cause the optimization to fall into a local optimum. For example, some clustering parameters may be optimized, but the overall result of all clustering parameters may not be optimal. To reduce this phenomenon, an ε-greedy strategy can be used for optimization to decrease the possibility of local optima.
[0055] In one possible implementation, the optimization process may include multiple iterations. In the nth iteration (n is a positive integer), the clustering parameters can be optimized according to the particle swarm optimization algorithm described above to adjust the clustering parameters and obtain better clustering parameters. However, to reduce the possibility of getting trapped in local optima, a predetermined proportion of the clustering parameters may not be optimized according to the above rules, but rather through random optimization to explore more optimization possibilities. For example, according to the above rules, the optimization magnitude of certain clustering parameters becomes increasingly larger, but it becomes increasingly difficult to coordinate with the overall clustering parameters constituted by all parameters, and it becomes increasingly unlikely to achieve overall optimization of all clustering parameters. However, by randomly optimizing some clustering parameters, more optimization possibilities can be explored, that is, the possibility of achieving overall optimization of all clustering parameters can be explored, thereby reducing the possibility of forming local optima.
[0056] In one possible implementation, the optimization process can be performed for multiple iterations using the above optimization method until the optimization condition is met. In the example, the optimization condition can be determined by the following formula (1):
[0057] fitness function=SC+αI(x)log 10 (cluster num )+(1-I(x))noise (1)
[0058] Wherein, fitness function is the fitness function, SC is the silhouette coefficient, and cluster is the silhouette coefficient. num α is the number of clusters, noise is the percentage of noise, and α is the adjustment factor. The condition of the indicator function I(x) is set according to the requirements. In the example, I(x) can be determined by the following formula (2):
[0059]
[0060] The conditions in I(x) can include any conditions, such as the number of clusters, the number of iteration cycles, etc., and this disclosure does not impose any restrictions on them.
[0061] In one possible implementation, the fitness function can be optimized through multiple iterations. That is, when the fitness function obtains its optimal solution, the optimization conditions are met, and the optimal clustering parameters, i.e., the clustering information, are obtained. The above optimization process is merely an example; the optimization process may also include other processes, such as random initialization, or no random optimization required. This disclosure does not impose any limitations on this.
[0062] In one possible implementation, after obtaining the clustering information, the features of multiple protocol data can be clustered. The feature information of multiple protocol data in the database can be obtained through the method described above for obtaining the first feature information, and then clustered according to the clustering information.
[0063] In one possible implementation, clustering the feature information of multiple protocol data to obtain clusters of the multiple protocol data includes: determining the feature distance between the feature information of each protocol data; and clustering the feature information of the protocol data according to the feature distance to obtain clusters of the multiple protocol data.
[0064] In one possible implementation, clustering can be performed based on the feature distance between feature information, gradually reducing the feature distance between feature information with similar features and gradually increasing the feature distance between feature information with different features. Ultimately, multiple clusters can be formed, that is, multiple sets of feature information of the same category grouped together. The number of clusters, their radius, and the number of feature information included in each cluster all meet the requirements of the clustering information.
[0065] In one possible implementation, the clustering process may include various methods, such as k-means clustering, hierarchical clustering, etc. This disclosure does not limit the specific method of clustering.
[0066] In one possible implementation, after performing the above clustering process, multiple categories of clusters can be obtained, and the category information of the protocol data to be processed can be determined based on the relationship between the first feature information and the clusters.
[0067] In one possible implementation, the cluster information includes representative feature information of the cluster, and step S13 may include: determining the category information of the protocol data to be processed based on the feature distance between the first feature information and the representative feature information of the clusters of the plurality of protocol data.
[0068] In the example, each cluster is a set formed by the aggregation of multiple feature information. The representative feature information of this set can be determined, that is, the feature information that represents the position of the set in the feature space. For example, the feature information obtained by weighted averaging of multiple feature information in the cluster, or the feature information of the cluster center position, etc., are not limited in this disclosure. Furthermore, the category information of the protocol data to be processed can be determined by the relationship between the representative feature information and the first feature information, without needing to determine the relationship between the first feature information and every feature information in the feature space, which can reduce computational load, reduce resource consumption, and improve processing efficiency.
[0069] In the example, the feature distance (e.g., cosine distance) between the first feature information and the representative feature information of each cluster can be determined, and the category information to which the representative feature information with the smallest feature distance from the first feature information belongs is determined as the category information of the protocol data to be processed.
[0070] In one possible implementation, expressions for each cluster can be obtained using a trie, and the category information of the protocol data to be processed can be determined based on these expressions. The cluster information includes the trie information of the clusters. Step S13 may include: querying the protocol data to be processed based on the trie information of the multiple protocol data sets to obtain the category information of the protocol data to be processed.
[0071] Figure 4 A schematic diagram of a trie according to an embodiment of this disclosure is shown. As described above, each cluster is composed of feature information from multiple protocol data sets, and the trie is an expression that allows querying the protocol data corresponding to the feature information within a cluster using specific rules. Figure 4 As shown, the trie is a trie with weight information, allowing for searching according to the weight information. Protocol data corresponding to each feature information within a cluster can be obtained through the nodes recorded in the trie. For example, protocol data composed of 0x00, 0x00, 0x00, -, 0xff, 0x53, 0x4d, 0x42, 0x72, 0x00, 0x00, 0xc0, 0x18, and 0x45 can be found. This disclosure does not limit the search method or the specific protocol data.
[0072] In the example, trie information that can be used to query protocol data in various clusters can be obtained. The protocol data to be processed is queried using the trie information of various clusters to determine the trie that can find the protocol data to be processed, and the category information of the cluster corresponding to the trie is determined as the category information of the protocol data to be processed.
[0073] According to the protocol data processing method of the embodiments of this disclosure, preset fields that may interfere with data classification can be removed, and feature information for classification can be obtained based on the position information of each field of the protocol data itself. Furthermore, multiple feature information in the database can be clustered, and the possibility of getting trapped in local optima can be reduced during the clustering process, resulting in more accurate cluster information. Based on the cluster information, the category information of the protocol data can be determined. This allows for the determination of category information based on the characteristics of the protocol data itself without contextual relationships, providing a basis for identifying the location of the protocol data.
[0074] Figure 5 This diagram illustrates an application of the protocol data processing method according to an embodiment of the present disclosure, such as... Figure 5 As shown, protocol data in a database containing multiple protocol data can be preprocessed. For example, padding fields and fields with data as 0x00 can be removed to reduce the adverse effects of meaningless data on the data distribution. Furthermore, feature information for each protocol data can be obtained through a multi-scale n-gram natural language processing model. When obtaining feature information, the positional information of each field within each feature can be referenced. After obtaining the feature information, low-frequency features can be removed to reduce computational complexity.
[0075] In one possible implementation, the feature information of each protocol data in the database can be clustered. For example, the clustering parameters can be optimized using particle swarm optimization, and an ε-greedy strategy can be used to reduce the possibility of getting trapped in local optima. After determining the optimal clustering parameters, the feature information of each protocol data can be clustered to obtain multiple clusters. Furthermore, two classifiers can be determined based on the multiple clusters: a classifier based on representative feature vectors and a classifier based on trie information.
[0076] In one possible implementation, when classifying the protocol data to be processed, the feature information of the protocol data to be processed can be obtained by referring to the above method, and either of the two classifiers mentioned above can be used to classify the protocol data to be processed or its feature information to obtain the category information of the protocol data to be processed.
[0077] In one possible implementation, the protocol data processing method can be used to classify protocol data in fields such as networks and communications, providing a basis for the identification of protocol data. This disclosure does not limit the application areas of the protocol data processing method.
[0078] It is understood that the various method embodiments mentioned above in this disclosure can be combined with each other to form combined embodiments without violating the principle and logic. Due to space limitations, this disclosure will not elaborate further. Those skilled in the art will understand that in the above methods of specific implementation, the specific execution order of each step should be determined by its function and possible internal logic.
[0079] In addition, this disclosure also provides a protocol data processing apparatus, an electronic device, a computer-readable storage medium, and a program, all of which can be used to implement any of the protocol data processing methods provided in this disclosure. The corresponding technical solutions and descriptions are described in the corresponding section of the method and will not be repeated here.
[0080] Figure 6 A block diagram of a protocol data processing apparatus according to an embodiment of the present disclosure is shown, such as Figure 6 As shown, the device includes: a removal module 11, used to remove preset fields from protocol data to be processed transmitted in the network to obtain first protocol data; a feature extraction module 12, used to perform feature extraction processing on the first protocol data according to the position information of each field in the first protocol data to obtain first feature information of the first protocol data; and a category acquisition module 13, used to obtain category information of the protocol data to be processed according to the first feature information and the preset cluster information of multiple protocol data.
[0081] In one possible implementation, the preset field includes a redundant field and / or a padding field.
[0082] In one possible implementation, the device further includes: a clustering module, which performs uniform initialization of clustering parameters to obtain uniformly initialized clustering parameters; performs random optimization processing on the uniformly initialized clustering parameters at a preset ratio to obtain clustering information; and performs clustering processing on the feature information of multiple protocol data according to the clustering information to obtain clusters of the multiple protocol data.
[0083] In one possible implementation, the clustering module is further configured to: determine the feature distance between the feature information of each of the protocol data; and perform clustering processing on the feature information of the protocol data according to the feature distance to obtain the clusters of the multiple protocol data.
[0084] In one possible implementation, the cluster information includes representative feature information of the cluster, and the category acquisition module is further configured to: determine the category information of the protocol data to be processed based on the feature distance between the first feature information and the representative feature information of the clusters of the plurality of protocol data.
[0085] In one possible implementation, the cluster information includes the trie information of the cluster, and the category acquisition module is further configured to: query the protocol data to be processed based on the trie information of the plurality of protocol data to obtain the category information of the protocol data to be processed.
[0086] In some embodiments, the functions or modules of the apparatus provided in this disclosure can be used to perform the methods described in the above method embodiments. The specific implementation can be referred to the description of the above method embodiments, and for the sake of brevity, it will not be repeated here.
[0087] This disclosure also proposes a computer-readable storage medium storing computer program instructions that, when executed by a processor, implement the above-described method. The computer-readable storage medium may be a non-volatile computer-readable storage medium.
[0088] This disclosure also proposes an electronic device, including: a processor; and a memory for storing processor-executable instructions; wherein the processor is configured to invoke the instructions stored in the memory to execute the above-described method.
[0089] This disclosure also provides a computer program product including computer-readable code, which, when executed on a device, causes a processor in the device to execute instructions for implementing the protocol data processing method provided in any of the above embodiments.
[0090] This disclosure also provides another computer program product for storing computer-readable instructions that, when executed, cause a computer to perform the operation of the protocol data processing method provided in any of the above embodiments.
[0091] Electronic devices can be provided as terminals, servers, or other forms of devices.
[0092] Figure 7 This diagram illustrates a block diagram of an electronic device 800 according to an embodiment of the present disclosure. For example, the electronic device 800 may be a mobile phone, computer, digital broadcasting terminal, messaging device, game console, tablet device, medical device, fitness equipment, personal digital assistant, or other terminal.
[0093] Reference Figure 7 The electronic device 800 may include one or more of the following components: a processing component 802, a memory 804, a power supply component 806, a multimedia component 808, an audio component 810, an input / output (I / O) interface 812, a sensor component 814, and a communication component 816.
[0094] Processing component 802 typically controls the overall operation of electronic device 800, such as operations associated with display, telephone calls, data communication, camera operation, and recording operations. Processing component 802 may include one or more processors 820 to execute instructions to complete all or part of the steps of the methods described above. Furthermore, processing component 802 may include one or more modules to facilitate interaction between processing component 802 and other components. For example, processing component 802 may include a multimedia module to facilitate interaction between multimedia component 808 and processing component 802.
[0095] Memory 804 is configured to store various types of data to support the operation of electronic device 800. Examples of this data include instructions for any application or method operating on electronic device 800, contact data, phonebook data, messages, pictures, videos, etc. Memory 804 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.
[0096] Power supply component 806 provides power to various components of electronic device 800. Power supply component 806 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to electronic device 800.
[0097] Multimedia component 808 includes a screen that provides an output interface between the electronic device 800 and the user. In some embodiments, the screen may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen may be implemented as a touchscreen to receive input signals from the user. The touch panel includes one or more touch sensors to sense touches, swipes, and gestures on the touch panel. The touch sensors may sense not only the edges of the touch or swipe action but also the duration and pressure associated with the touch or swipe operation. In some embodiments, multimedia component 808 includes a front-facing camera and / or a rear-facing camera. When the electronic device 800 is in an operating mode, such as a shooting mode or a video mode, the front-facing camera and / or the rear-facing camera may receive external multimedia data. Each front-facing camera and rear-facing camera may be a fixed optical lens system or have focal length and optical zoom capabilities.
[0098] Audio component 810 is configured to output and / or input audio signals. For example, audio component 810 includes a microphone (MIC) configured to receive external audio signals when electronic device 800 is in an operating mode, such as call mode, recording mode, and voice recognition mode. The received audio signals may be further stored in memory 804 or transmitted via communication component 816. In some embodiments, audio component 810 also includes a speaker for outputting audio signals.
[0099] I / O interface 812 provides an interface between processing component 802 and peripheral interface modules, such as keyboards, click wheels, buttons, etc. These buttons may include, but are not limited to, home buttons, volume buttons, power buttons, and lock buttons.
[0100] Sensor assembly 814 includes one or more sensors for providing state assessments of various aspects of electronic device 800. For example, sensor assembly 814 can detect the on / off state of electronic device 800, the relative positioning of components such as the display and keypad of electronic device 800, changes in position of electronic device 800 or a component of electronic device 800, the presence or absence of user contact with electronic device 800, orientation or acceleration / deceleration of electronic device 800, and temperature changes of electronic device 800. Sensor assembly 814 may include a proximity sensor configured to detect the presence of nearby objects without any physical contact. Sensor assembly 814 may also include a light sensor, such as a CMOS or CCD image sensor, for use in imaging applications. In some embodiments, sensor assembly 814 may also include an accelerometer, gyroscope, magnetometer, pressure sensor, or temperature sensor.
[0101] Communication component 816 is configured to facilitate wired or wireless communication between electronic device 800 and other devices. Electronic device 800 can access wireless networks based on communication standards, such as WiFi, 2G, or 3G, or combinations thereof. In one exemplary embodiment, communication component 816 receives broadcast signals or broadcast-related information from an external broadcast management system via a broadcast channel. In one exemplary embodiment, communication component 816 also includes a near-field communication (NFC) module to facilitate short-range communication. For example, the NFC module may be implemented based on radio frequency identification (RFID) technology, Infrared Data Association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology, and other technologies.
[0102] In an exemplary embodiment, the electronic device 800 may be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to perform the methods described above.
[0103] In an exemplary embodiment, a non-volatile computer-readable storage medium is also provided, such as a memory 804 including computer program instructions that can be executed by a processor 820 of an electronic device 800 to perform the above-described method.
[0104] Figure 8 A block diagram of an electronic device 1900 according to an embodiment of the present disclosure is shown. For example, the electronic device 1900 may be provided as a server. (Refer to...) Figure 8 The electronic device 1900 includes a processing component 1922, which further includes one or more processors, and memory resources represented by memory 1932 for storing instructions, such as application programs, that can be executed by the processing component 1922. The application programs stored in memory 1932 may include one or more modules, each corresponding to a set of instructions. Furthermore, the processing component 1922 is configured to execute instructions to perform the methods described above.
[0105] Electronic device 1900 may also include a power supply component 1926 configured to perform power management of electronic device 1900, a wired or wireless network interface 1950 configured to connect electronic device 1900 to a network, and an input / output (I / O) interface 1958. Electronic device 1900 can operate on an operating system, such as Windows Server, stored in memory 1932. TM Mac OS X TM Unix TM Linux TM FreeBSD TM Or similar.
[0106] In an exemplary embodiment, a non-volatile computer-readable storage medium is also provided, such as a memory 1932 including computer program instructions that can be executed by a processing component 1922 of an electronic device 1900 to perform the above-described method.
[0107] This disclosure can be a system, method, and / or computer program product. A computer program product may include a computer-readable storage medium having computer-readable program instructions loaded thereon for causing a processor to implement various aspects of this disclosure.
[0108] Computer-readable storage media can be tangible devices capable of holding and storing instructions for use by an instruction execution device. Computer-readable storage media can be, for example—but not limited to—electrical storage devices, magnetic storage devices, optical storage devices, electromagnetic storage devices, semiconductor storage devices, or any suitable combination thereof. More specific examples (a non-exhaustive list) of computer-readable storage media include: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disc read-only memory (CD-ROM), digital multifunction disc (DVD), memory sticks, floppy disks, mechanical encoding devices, such as punch cards or recessed protrusions storing instructions thereon, and any suitable combination thereof. The computer-readable storage media used herein are not to be construed as transient signals themselves, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides or other transmission media (e.g., light pulses through fiber optic cables), or electrical signals transmitted through wires.
[0109] The computer-readable program instructions described herein can be downloaded from computer-readable storage media to various computing / processing devices, or downloaded via a network, such as the Internet, local area network, wide area network, and / or wireless network, to an external computer or external storage device. The network may include copper transmission cables, fiber optic transmission, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards them to the computer-readable storage media in the respective computing / processing device.
[0110] Computer program instructions used to perform the operations of this disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, status setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages such as Smalltalk, C++, etc., and conventional procedural programming languages such as the "C" language or similar programming languages. The computer-readable program instructions may execute entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or may be connected to an external computer (e.g., via the Internet using an Internet service provider). In some embodiments, electronic circuitry, such as programmable logic circuitry, field-programmable gate arrays (FPGAs), or programmable logic arrays (PLAs), is personalized by utilizing the status information of the computer-readable program instructions to implement various aspects of this disclosure.
[0111] Various aspects of this disclosure are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this disclosure. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer-readable program instructions.
[0112] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that, when executed by the processor of the computer or other programmable data processing apparatus, they create means for implementing the functions / actions specified in one or more blocks of the flowchart and / or block diagram. These computer-readable program instructions can also be stored in a computer-readable storage medium that causes a computer, programmable data processing apparatus, and / or other device to operate in a particular manner; thus, the computer-readable medium storing the instructions comprises an article of manufacture that includes instructions for implementing aspects of the functions / actions specified in one or more blocks of the flowchart and / or block diagram.
[0113] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to perform the functions / actions specified in one or more boxes of a flowchart and / or block diagram.
[0114] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of an instruction containing one or more executable instructions for implementing a specified logical function. In some alternative implementations, the functions marked in the blocks may occur in a different order than those shown in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.
[0115] The computer program product can be implemented specifically through hardware, software, or a combination thereof. In one alternative embodiment, the computer program product is specifically embodied in a computer storage medium; in another alternative embodiment, the computer program product is specifically embodied in a software product, such as a software development kit (SDK), etc.
[0116] The various embodiments of this disclosure have been described above. These descriptions are exemplary and not exhaustive, nor are they limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is chosen to best explain the principles, practical application, or improvement of the technology in the market, or to enable others skilled in the art to understand the embodiments disclosed herein.
Claims
1. A protocol data processing method, characterized by, include: Preset fields are removed from the protocol data to be processed transmitted in the network to obtain first protocol data; wherein, the preset fields include redundant fields and / or padding fields; Based on the position information of each field in the first protocol data, feature extraction processing is performed on the first protocol data to obtain the first feature information of the first protocol data; Based on the first feature information and the preset cluster information of multiple protocol data, the category information of the protocol data to be processed is obtained; The cluster information includes the trie information of the cluster; Based on the first feature information and the preset cluster information of multiple protocol data, the category information of the protocol data to be processed is obtained, including: The protocol data to be processed is queried based on the trie information of the multiple protocol data to obtain the category information of the protocol data to be processed.
2. The method of claim 1, wherein, The method further includes: The clustering parameters are uniformly initialized to obtain the uniformly initialized clustering parameters; Random optimization processing is performed on the uniformly initialized clustering parameters at a preset ratio to obtain clustering information; Based on the clustering information, the feature information of multiple protocol data is clustered to obtain the clusters of the multiple protocol data.
3. The method of claim 2, wherein, Clustering is performed on the feature information of multiple protocol data to obtain clusters of the multiple protocol data, including: Determine the feature distance between the feature information of each of the protocol data; Based on the feature distance, the feature information of the protocol data is clustered to obtain clusters of the multiple protocol data.
4. The method of claim 1, wherein, The cluster information includes representative feature information of the cluster. Based on the first feature information and the preset cluster information of multiple protocol data, the category information of the protocol data to be processed is obtained, including: The category information of the protocol data to be processed is determined based on the feature distance between the first feature information and the representative feature information of the clusters of the multiple protocol data.
5. A protocol data processing apparatus, characterized by, include: The removal module is used to remove preset fields from the protocol data to be processed transmitted in the network to obtain first protocol data; wherein, the preset fields include redundant fields and / or padding fields; The feature extraction module is used to perform feature extraction processing on the first protocol data based on the position information of each field in the first protocol data to obtain the first feature information of the first protocol data. The category acquisition module is used to obtain the category information of the protocol data to be processed based on the first feature information and preset cluster information of multiple protocol data; the cluster information includes the trie information of the cluster. Based on the first feature information and the preset cluster information of multiple protocol data, the category information of the protocol data to be processed is obtained, including: The protocol data to be processed is queried based on the trie information of the multiple protocol data to obtain the category information of the protocol data to be processed.
6. An electronic device, comprising: include: processor; Memory used to store processor-executable instructions; The processor is configured to invoke instructions stored in the memory to execute the method according to any one of claims 1 to 4.
7. A computer-readable storage medium having computer program instructions stored thereon, characterized in that, When the computer program instructions are executed by the processor, they implement the method described in any one of claims 1 to 4.