A variant protocol field partitioning method based on deep learning

Abstract

This invention belongs to the field of network security, specifically a deep learning-based method for segmenting variant protocols. Addressing the issue that existing methods yield field segmentation results with limited reference value, this invention proposes the following steps: collecting original protocol message datasets and variant protocol message datasets; using the proposed column feature extraction method to extract column features from both types of message data to obtain corresponding original protocol column feature datasets and variant protocol column feature datasets; using the message data field segmentation method specified by the original protocol to segment and label the original protocol message dataset and original protocol column feature dataset to generate a training set; using the two datasets of the original protocol as training targets, constructing a variant protocol field segmentation network for training, and saving the trained variant protocol field segmentation network. This invention has higher reference value compared to existing methods for binary variant protocol field segmentation tasks.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a variant protocol field partitioning method based on deep learning. Background Technology

[0002] Network protocols define the form, order, content, and state transitions that should occur when two or more communication entities exchange messages, and specify the behavioral norms of these entities to ensure accurate data transmission even in highly complex network environments. They comprise three basic elements: semantics, syntax, and timing logic. Semantics explains the meaning of each part of the control information; syntax specifies the structure and format of user data and control information, and the order in which data appears; and timing logic details the order in which events occur. A field is the smallest indivisible sequence of bytes with specific semantics, and fields can have sequential, parallel, and hierarchical relationships.

[0003] In practical network communication systems, network protocol specifications are particularly important. However, with the rapid development of network communication, network traffic that does not strictly adhere to protocol specifications often occurs, meaning the protocol has mutated. If the original protocol's field division is directly applied, field division errors will occur. In such cases, it is necessary to predict the field division of the variant protocol.

[0004] Currently, the field partitioning problem for variant protocols can be solved using manual processing or proprietary protocol field partitioning methods. However, manual methods require researchers to spend a significant amount of time and effort parsing the network packet sequences of the modified protocol based on the original protocol to obtain the syntax specifications of the variant protocol. Its efficiency and accuracy depend heavily on the researcher's experience. Using proprietary protocol field partitioning methods for variant protocols loses the available prior information about the original protocol, resulting in field partitioning results with low accuracy and limited reference value. Therefore, proposing an automatic variant protocol field partitioning method with greater reference value is crucial. Summary of the Invention

[0005] This invention proposes a variant protocol field partitioning method based on deep learning, which solves the problem that the existing field partitioning results have low accuracy and only have limited reference value.

[0006] To achieve the above objectives, the present invention adopts the following technical solution:

[0007] A variant protocol field partitioning method based on deep learning includes the following steps:

[0008] Step A: Collect the original protocol message dataset and the variant protocol message dataset;

[0009] Step B: Using the proposed column feature extraction method, column features are extracted from the two types of message data in Step A to obtain the corresponding original protocol column feature dataset and variant protocol column feature dataset;

[0010] Step C: Use the message data field partitioning method specified in the original protocol to partition and label the original protocol message dataset and the original protocol column feature dataset to generate a training set;

[0011] Step D: Build a variant protocol field partitioning network model and initialize the parameters of the variant protocol field partitioning network; use the two datasets of the original protocol as training targets, the loss function of CRF as supervision, and the Adam optimization algorithm to train the variant protocol field partitioning network. When the loss function no longer converges, end the training and save the trained variant protocol field partitioning network model.

[0012] Step E: Use the saved trained variant protocol field partitioning network model to predict the field partitioning method of each message in the variant protocol message dataset based on the variant protocol message sequence dataset and the variant protocol column feature dataset.

[0013] Step F: Calculate the field division position of each data entry and select the position that meets the specified threshold as the field division position of the variant protocol.

[0014] Preferably, step A specifically includes the following steps: intercepting data packets using a packet interception tool, filtering the intercepted data packets to obtain the original protocol packet sequence and variant protocol packet data, and deleting other packet sequences to increase the accuracy of the results.

[0015] Preferably, in step B, the original protocol message sequence and the variant protocol message sequence are divided into data segments of length L in 1-bit units. Messages shorter than L are padded with zeros at the end. Assuming there are r rows, the following protocol dataset matrix A can be constructed:

[0016]

[0017] Perform the following processing on matrix A:

[0018]

[0019] The resulting matrix C is the corresponding column feature dataset.

[0020] Preferably, in step C, the protocol message sequence dataset and the protocol column feature dataset are divided into fields according to the protocol specifications, and the sequence is labeled according to the following rules: four states are defined, where BEGIN represents the start state of a field, MIDDLE represents the middle state of a field, END represents the end state of a field, and SINGLE represents a field with only one unit; if the field length is 1, that is, it consists of 1 unit, then this unit is marked as SINGLE; if the field length is greater than 1, then the beginning of the field is marked as BEGIN, the end of the field is marked as END, and the middle unit of the field is marked as MIDDLE.

[0021] Preferably, step D further includes the following steps:

[0022] Step D1: Construct a network model for variant protocol field partitioning;

[0023] The model consists of two main parts: one part extracts the field format features of the protocol message sequence dataset, and the other part extracts the field format features of the protocol column feature dataset.

[0024] Each part includes an input layer, a word embedding layer, a bidirectional long short-term memory network layer, and a dropout layer; after the field format features of the two parts are extracted, the features are fused through a fully connected layer, and the final field partitioning result is output through a softmax layer and a CRF layer.

[0025] Step D2: Initialize the network parameters for the variant protocol field.

[0026] Step D3: Use the loss function of the CRF layer as the loss function for the variant protocol field partitioning problem, where the numerator is the score of the true label sequence and the denominator is the sum of the scores of all possible label sequences. Use negative log-likelihood as the loss function, i.e.:

[0027]

[0028] in, It is a path Path score, Representing a path The loss function is defined as the ratio of the score of the true path to the score of all paths. For ease of calculation, it can be rewritten as... Format;

[0029] Step D4: Train the variant protocol field partitioning network using the Adam optimization algorithm. Train the Loss function from step D3. When the loss function no longer converges, end the training and save the trained variant protocol field partitioning network model.

[0030] Preferably, step F specifically includes the following steps:

[0031] Step F1: Take the field segmentation result of each variant protocol message data predicted in step E in turn, and increment the count of the corresponding field segmentation position in each data until all variant protocol message data have been traversed.

[0032] Step F2: After all the data has been processed, filter the frequency of occurrence of the field division positions with a threshold of N / 10, where N is the total number of rows of variant protocol message data; the filtered positions are the final variant protocol field division methods.

[0033] Preferably, the minimum unit for field division is half a byte, but methods of division with more than half a byte are allowed.

[0034] Compared with the prior art, the beneficial effects of the present invention are:

[0035] This invention proposes a method for field partitioning of variant protocols, utilizing a BILSTM-CRF neural network from machine learning to construct a field partitioning model for variant protocols. Column features, specific to the field partitioning problem, are incorporated into the model to improve its accuracy. Using half-bytes as the smallest unit, the original protocol's field format features are used to infer the field partitioning method for variant protocols. Compared to existing field partitioning methods, the model proposed in this invention has higher reference value. Attached Figure Description

[0036] Figure 1 This is a flowchart of a variant protocol field partitioning method based on deep learning proposed in this invention;

[0037] Figure 2 This is a neural network structure diagram of a variant protocol field partitioning method based on deep learning proposed in this invention. Detailed Implementation

[0038] The technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments.

[0039] Example 1

[0040] Reference Figure 1-2 A variant protocol field partitioning method based on deep learning includes the following steps:

[0041] Step A: Collect the original protocol message dataset and the variant protocol message dataset;

[0042] Step B: Using the proposed column feature extraction method, column features are extracted from the two types of message data in Step A to obtain the corresponding original protocol column feature dataset and variant protocol column feature dataset;

[0043] Step C: Use the message data field partitioning method specified in the original protocol to partition and label the original protocol message dataset and the original protocol column feature dataset to generate a training set;

[0044] Step D: Build a variant protocol field partitioning network model and initialize the parameters of the variant protocol field partitioning network; use the two datasets of the original protocol as training targets, the loss function of CRF as supervision, and the Adam optimization algorithm to train the variant protocol field partitioning network. When the loss function no longer converges, end the training and save the trained variant protocol field partitioning network model.

[0045] Step E: Use the saved trained variant protocol field partitioning network model to predict the field partitioning method of each message in the variant protocol message dataset based on the variant protocol message sequence dataset and the variant protocol column feature dataset.

[0046] Step F: Calculate the field division position of each data entry and select the position that meets the specified threshold as the field division position of the variant protocol.

[0047] In this embodiment, step A specifically includes the following steps: intercepting data packets using a packet interception tool, filtering the intercepted data packets to obtain the original protocol packet sequence and variant protocol packet data, and deleting other packet sequences to increase the accuracy of the results.

[0048] In this embodiment, in step B, the original protocol message sequence and the variant protocol message sequence are divided into data segments of length L in 1-bit units. Messages shorter than L are padded with zeros at the end. Assuming there are r rows, the following protocol dataset matrix A can be constructed:

[0049]

[0050] Perform the following processing on matrix A:

[0051]

[0052] The resulting matrix C is the corresponding column feature dataset.

[0053] In this embodiment, in step C, the protocol message sequence dataset and the protocol column feature dataset are divided into fields according to the protocol specifications, and the sequence is labeled according to the following rules: four states are defined, where BEGIN represents the start state of a field, MIDDLE represents the middle state of a field, END represents the end state of a field, and SINGLE represents a field with only one unit; if the field length is 1, that is, it consists of 1 unit, then this unit is marked as SINGLE; if the field length is greater than 1, then the beginning of the field is marked as BEGIN, the end of the field is marked as END, and the middle unit of the field is marked as MIDDLE.

[0054] In this embodiment, step D further includes the following step:

[0055] Step D1: Construct a network model for variant protocol field partitioning;

[0056] The model consists of two main parts: one part extracts the field format features of the protocol message sequence dataset, and the other part extracts the field format features of the protocol column feature dataset.

[0057] Each part includes an input layer, a word embedding layer, a bidirectional long short-term memory network layer, and a dropout layer; after the field format features of the two parts are extracted, the features are fused through a fully connected layer, and the final field partitioning result is output through a softmax layer and a CRF layer.

[0058] Step D2: Initialize the network parameters for the variant protocol field.

[0059] Step D3: Use the loss function of the CRF layer as the loss function for the variant protocol field partitioning problem, where the numerator is the score of the true label sequence and the denominator is the sum of the scores of all possible label sequences. Use negative log-likelihood as the loss function, i.e.:

[0060]

[0061] in, It is a path Path score, Representing a path The loss function is defined as the ratio of the score of the true path to the score of all paths. For ease of calculation, it can be rewritten as... Format;

[0062] Step D4: Train the variant protocol field partitioning network using the Adam optimization algorithm. Train the Loss function from step D3. When the loss function no longer converges, end the training and save the trained variant protocol field partitioning network model.

[0063] In this embodiment, step F specifically includes the following steps:

[0064] Step F1: Take the field segmentation result of each variant protocol message data predicted in step E in turn, and increment the count of the corresponding field segmentation position in each data until all variant protocol message data have been traversed.

[0065] Step F2: After all the data has been processed, filter the frequency of occurrence of the field division positions with a threshold of N / 10, where N is the total number of rows of variant protocol message data; the filtered positions are the final variant protocol field division methods.

[0066] In this embodiment, the minimum unit for field division is half a byte, and methods of division into bytes larger than half a byte are allowed.

[0067] Example 2

[0068] Reference Figure 1 This is a schematic diagram of the overall process of a variant protocol field partitioning method based on deep learning proposed in this invention. The method includes the following steps:

[0069] Step A: Collect the raw protocol message dataset and variant protocol message dataset ;

[0070] Specifically, in step A, data packets are intercepted using a message interception tool. The intercepted data packets are then filtered to obtain the original protocol message sequence and variant protocol message data. Other message sequences are deleted to increase the accuracy of the results.

[0071] Step B: Using the proposed column feature extraction method, process the original protocol message dataset from Step A. and variant protocol message dataset Column feature extraction is performed to obtain the corresponding original protocol column feature dataset and variant protocol column feature dataset;

[0072] Specifically, in step B, traditional neural networks for solving field partitioning problems typically do not focus on the variation patterns of elements along the column direction, only extracting features from the elements and their context. However, in protocol field partitioning tasks, the positional information of data fields within the frame, i.e., the column features, is crucial. For example, some fields have relatively fixed positions within the frame and exhibit characteristics such as fixed or increasing / decreasing values. These fields are special in field partitioning tasks and play a vital role in both manual protocol field partitioning and traditional proprietary protocol field partitioning methods. Therefore, this method adds a column feature input layer to the traditional BILSTM-CRF neural network. Experiments demonstrate that adding column features of protocol data to the neural network increases the accuracy of field partitioning. The column feature dataset calculation method is as follows:

[0073] Divide the original protocol message sequence and the variant protocol message sequence into data segments of length L, each segment being 1 bit in length. Messages shorter than L are padded with zeros at the end. Assuming there are r rows in total, the following protocol dataset matrix A can be constructed:

[0074]

[0075] Perform the following processing on matrix A:

[0076]

[0077] The resulting matrix C is the corresponding column feature dataset. The original protocol column feature dataset can be obtained using the method described above. and variant protocol column feature dataset .

[0078] Step C: Divide the original protocol message dataset and the original protocol column feature dataset according to the message data field partitioning method specified in the original protocol. and Perform field partitioning and labeling to generate a training set;

[0079] Specifically, in step C, the protocol message sequence dataset and protocol column feature dataset are divided into fields according to the protocol specifications, and the sequence is labeled according to the following rules: four states are defined, where BEGIN represents the start state of a field, MIDDLE represents the middle state of a field, END represents the end state of a field, and SINGLE represents a field with only one unit. If the field length is 1, i.e., it consists of 1 unit, then this unit is marked as SINGLE. If the field length is greater than 1, then the beginning of the field is marked as BEGIN, the end of the field is marked as END, and the middle unit of the field is marked as MIDDLE. For example, the field "02ebd" would have its corresponding label sequence as "BEGIN MIDDLE MIDDLE MIDDLE END", and the label set for the field "7" would be "SINGLE".

[0080] Step D: Build the variant protocol field partitioning network model and initialize the parameters of the variant protocol field partitioning network. Use the two datasets of the original protocol as training targets, the CRF loss function as supervision, and the Adam optimization algorithm to train the variant protocol field partitioning network. When the loss function no longer converges, end the training and save the trained variant protocol field partitioning network model.

[0081] Specifically, step D further includes the following steps:

[0082] Step D1: Construct a network model for variant protocol field partitioning;

[0083] Reference Figure 2 The model consists of two main parts: one part extracts the protocol message sequence dataset and field format features, and the other part extracts the protocol column feature dataset and field format features.

[0084] Each part includes an input layer, a word embedding layer, a bidirectional long short-term memory (LSTM) network layer, and a dropout layer. The word embedding layer encodes the input fields, mapping the input units to corresponding word vectors, which serve as the input to the network at each time step. The bidirectional LSM network layer extracts abstract features of the field sequence and contextual relationships between fields. After the field format features of the two parts are extracted, they are fused through a fully connected layer, and finally, the field partitioning result is obtained through a softmax layer.

[0085] Training the network described above yields the probability of each unit corresponding to each label. However, the output at this stage does not consider the relationships between labels. For example, the label BEGIN cannot be followed by BEGIN, and the label END can only be followed by BEGIN or SINGLE. Directly outputting the field partitioning results from the Softmax layer may result in unreasonable labels. To address this issue, a CRF layer is added after the fully connected layer to fuse the relationships between context labels, making the model's output more accurate and reasonable.

[0086] set up Represents the input sequence, Indicates network output The corresponding label sequence. Therefore, given an input sequence, the conditional probability of the label sequence in CRF is defined as:

[0087]

[0088] in, It is a normalization factor conditional on the input sequence X. and These are the transition feature function and the state feature function, respectively. and These are the weights of the transition characteristic function and the weights of the state characteristic function, respectively.

[0089] Step D2: Initialize the network parameters for the variant protocol field. The initial values ​​of each parameter in this example are shown in Table 1:

[0090]

[0091] Step D3: Use the loss function of the CRF layer as the loss function for the variant protocol field partitioning problem, where the numerator is the score of the true label sequence and the denominator is the sum of the scores of all possible label sequences. Use negative log-likelihood as the loss function, i.e.:

[0092]

[0093] in, It is a path Path score, Representing a path The loss function is defined as the ratio of the score of the true path to the score of all paths. For ease of calculation, it can be rewritten as... Format;

[0094] Step D4: Train the variant protocol field partitioning network using the Adam optimization algorithm. Train the Loss function from step D3. When the loss function no longer converges, end the training and save the trained variant protocol field partitioning network model.

[0095] Step E: Utilize the trained variant protocol field partitioning network model to predict the field partitioning method for each message in the variant protocol message dataset based on the variant protocol message sequence dataset and the variant protocol column feature dataset;

[0096] Step F: Calculate the field division position of each data entry and select the position that meets the specified threshold as the field division position of the variant protocol;

[0097] Specifically, step F further includes the following steps:

[0098] Step F1: Take the field segmentation result of each variant protocol message data predicted in step E in turn, and increment the count of the corresponding field segmentation position in each data until all variant protocol message data have been traversed.

[0099] Step F2: After all the data has been processed, filter the frequency of occurrence of the field division positions with a threshold of N / 10, where N is the total number of rows of variant protocol message data. The filtered positions are the final variant protocol field division methods.

[0100] The following is a comparative analysis of the recognition performance of the method used in this invention with that of existing technologies:

[0101] The same training method was used to train this invention and several other models, including LSTM, LSTM-CRF, BILSTM-CRF, and PRO-BILSTM-CRF. Field segmentation accuracy was used as the benchmark. Field segmentation recall rate Comprehensive evaluation index of accuracy and recall The calculation method for the evaluation index of the model field partitioning effect is as follows:

[0102]

[0103]

[0104]

[0105] TP (True Positive) indicates that the predicted field splitting position is the same as the actual field splitting position; TN (True Negative) indicates that a position that should have been split is predicted as not split; FN (False Negative) indicates that a position that should not have been split is not split; and FP (False Positive) indicates that a position that should not have been split is predicted as split.

[0106] The results of the variant protocol field partitioning for the centralized model are shown in Table 2:

[0107]

[0108] Analysis of the table reveals that, firstly, compared to the other three LSTM+CRF structures, the LSTM model exhibits a lower F1 score, reflecting overall performance. This is because the single LSTM model ignores the transition relationships between label results, leading to unreasonable label combinations and a decrease in final accuracy. The LSTM+CRF structure, by adding a CRF layer after the LSTM layer, fully considers the transition relationships between labels, reducing the probability of unreasonable label combinations and achieving more accurate results. Secondly, the BILSTM-CRF model shows an improved F1 score compared to the LSTM-CRF model. This is because BILSTM fully considers both forward and backward contextual semantic information, while the unidirectional LSTM can only capture forward syntactic information and fails to capture backward syntactic information. Furthermore, the model proposed in this invention also shows an improved F1 score compared to the BILSTM-CRF model. This is because this invention considers the unique field variation features and column features of field partitioning, incorporating a column feature dataset into the model, which better mines the protocol field format. As can be seen from the above analysis, for the research task of variant protocol field partitioning, the model proposed in this invention is more applicable and more effective than BILSTM-CRF, LSTM-CRF and LSTM models.

[0109] Example 3

[0110] Reference Figure 1-2 A variant protocol field partitioning method based on deep learning includes the following steps:

[0111] Step A: Collect the raw protocol message dataset and variant protocol message dataset ;

[0112] Step B: Using the proposed column feature extraction method, process the original protocol message dataset from Step A. and variant protocol message dataset Column feature extraction is performed to obtain the corresponding original protocol column feature dataset and variant protocol column feature dataset;

[0113] Step C: Use the message data field partitioning method specified in the original protocol to partition and label the original protocol message dataset and the original protocol column feature dataset to generate a training set;

[0114] Step D: Build a variant protocol field partitioning network model and initialize the parameters of the variant protocol field partitioning network; use the two datasets of the original protocol as training targets, the loss function of CRF as supervision, and the Adam optimization algorithm to train the variant protocol field partitioning network. When the loss function no longer converges, end the training and save the trained variant protocol field partitioning network model.

[0115] Step E: Use the saved trained variant protocol field partitioning network model to predict the field partitioning method of each message in the variant protocol message dataset based on the variant protocol message sequence dataset and the variant protocol column feature dataset.

[0116] Step F: Calculate the field division position of each data entry and select the position that meets the specified threshold as the field division position of the variant protocol.

[0117] In this embodiment, step A specifically includes the following steps: intercepting data packets using a packet interception tool, filtering the intercepted data packets to obtain the original protocol packet sequence and variant protocol packet data, and deleting other packet sequences to increase the accuracy of the results.

[0118] In this embodiment, in step B, the original protocol message sequence and the variant protocol message sequence are divided into data segments of length L in 1-bit units. Messages shorter than L are padded with zeros at the end. Assuming there are r rows, the following protocol dataset matrix A can be constructed:

[0119]

[0120] Perform the following processing on matrix A:

[0121]

[0122] The resulting matrix C is the corresponding column feature dataset.

[0123] In this embodiment, in step C, the protocol message sequence dataset and the protocol column feature dataset are divided into fields according to the protocol specifications, and the sequence is labeled according to the following rules: four states are defined, where BEGIN represents the start state of a field, MIDDLE represents the middle state of a field, END represents the end state of a field, and SINGLE represents a field with only one unit; if the field length is 1, that is, it consists of 1 unit, then this unit is marked as SINGLE; if the field length is greater than 1, then the beginning of the field is marked as BEGIN, the end of the field is marked as END, and the middle unit of the field is marked as MIDDLE.

[0124] In this embodiment, step D further includes the following step:

[0125] Step D1: Construct a network model for variant protocol field partitioning;

[0126] The model consists of two main parts: one part extracts the field format features of the protocol message sequence dataset, and the other part extracts the field format features of the protocol column feature dataset.

[0127] Each part includes an input layer, a word embedding layer, a bidirectional long short-term memory network layer, and a dropout layer; after the field format features of the two parts are extracted, the features are fused through a fully connected layer, and the final field partitioning result is output through a softmax layer and a CRF layer.

[0128] Step D2: Initialize the network parameters for the variant protocol field. The initial values ​​for each parameter in this example are shown in Table 1.

[0129]

[0130] Step D3: Use the loss function of the CRF layer as the loss function for the variant protocol field partitioning problem, where the numerator is the score of the true label sequence and the denominator is the sum of the scores of all possible label sequences. Use negative log-likelihood as the loss function, i.e.:

[0131]

[0132] in, It is a path Path score, Representing a path The loss function is defined as the ratio of the score of the true path to the score of all paths. For ease of calculation, it can be rewritten as... Format;

[0133] Step D4: Train the variant protocol field partitioning network using the Adam optimization algorithm. Train the Loss function from step D3. When the loss function no longer converges, end the training and save the trained variant protocol field partitioning network model.

[0134] In this embodiment, step F specifically includes the following steps:

[0135] Step F1: Take the field segmentation result of each variant protocol message data predicted in step E in turn, and increment the count of the corresponding field segmentation position in each data until all variant protocol message data have been traversed.

[0136] Step F2: After all the data has been processed, filter the frequency of occurrence of the field division positions with a threshold of N / 10, where N is the total number of rows of variant protocol message data; the filtered positions are the final variant protocol field division methods.

[0137] In this embodiment, the minimum unit for field division is half a byte, and methods of division into bytes larger than half a byte are allowed.

[0138] In this embodiment, a key field detection dataset is established; then, a key field detection model based on deep learning is constructed; then, the key field detection model based on deep learning is run to obtain the detection results; finally, the key fields of the text are divided according to the detection results.

[0139] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A deep learning-based variant protocol field partitioning method, characterized in that, The method comprises the following steps: Step A, collecting original protocol message data set and variant protocol message data set; Step B, using the column feature extraction method proposed to extract column features from the two kinds of message data in step A to obtain the corresponding original protocol column feature data set and variant protocol column feature data set; Step C, dividing the fields of the original protocol message data set and the original protocol column feature data set according to the field division method specified in the original protocol to generate a training set; Step D, building a variant protocol field division network model, initializing the parameters of the variant protocol field division network, taking the two data sets of the original protocol as the training target, using the loss function of CRF as the supervision, using the Adam optimization algorithm to train the variant protocol field division network, and ending the training and saving the trained variant protocol field division network model when the loss function no longer converges; further comprising the following steps: Step D1, constructing a variant protocol field division network model; The model is composed of two parts: one part extracts the field format features of the protocol message sequence data set, and the other part extracts the field format features of the protocol column feature data set; Each part includes an input layer, a word embedding layer, a bidirectional long short-term memory network layer, and a Dropout layer; after the field format features of the two parts are extracted, the features are fused through a fully connected layer, and the final field division result is output through a Softmax layer and a CRF layer; Step D2, initializing the parameters of the variant protocol field division network; Step D3, using the loss function of the CRF layer as the loss function of the variant protocol field division problem, wherein the numerator is the score of the true label sequence, and the denominator is the sum of the scores of all possible label sequences, and the negative log likelihood is used as the loss function; Step D4, using the Adam optimization algorithm to train the variant protocol field division network, training the loss function in step D3, and ending the training and saving the trained variant protocol field division network model when the loss function no longer converges; Step E, using the saved trained variant protocol field division network model to predict the field division mode of each message in the variant protocol message data set based on the variant protocol message sequence data set and the variant protocol column feature data set; Step F, statistics of the field division position of each data and selection of the position meeting the specified threshold as the field division position of the variant protocol.

2. The method of claim 1, wherein the method is based on a deep learning-based variant protocol field partitioning method. In step A, the following steps are included: intercepting data messages through a message interception tool, filtering the intercepted data messages, obtaining original protocol message sequences and variant protocol message data, and deleting other message sequences to increase the accuracy of the results.

3. The method of claim 1, wherein the method is based on a deep learning-based variant protocol field partitioning method. In step B, the original protocol message sequence and the variant protocol message sequence are cut into data segments with a length of L in units of 1 bit, and the last zero is filled for messages with a length less than L. Assuming that there are r rows, the following protocol data set matrix A can be constructed: , The following processing is performed on matrix A: , The obtained matrix C is the corresponding column feature data set.

4. The method of claim 1, wherein the method is based on a deep learning-based variant protocol field partitioning method. In the step C, the protocol message sequence data set and the protocol column feature data set are divided into fields according to the protocol, and are sequentially labeled according to the following rules: four states are defined, wherein BEGIN represents the start state of a field, MIDDLE represents the middle state of a field, END represents the end state of a field, and SINGLE represents a field with only one unit; if the length of the field is 1, that is, the field is composed of one unit, the unit is marked as SINGLE; if the length of the field is greater than 1, the beginning of the field is marked as BEGIN, the end of the field is marked as END, and the middle units of the field are marked as MIDDLE.

5. The method of claim 1, wherein the method is based on a deep learning-based variant protocol field partitioning method. In the step F, the following steps are specifically included: Step F1, each field division result of the variant protocol message data predicted by the step E is taken in sequence, and the count of the corresponding field division position in each data is added by 1 until all the variant protocol message data are traversed; Step F2, after all the data are processed, the occurrence times of the field division positions are screened, and the threshold is N / 10, wherein N is the total number of rows of the variant protocol message data; the screened positions are the final variant protocol field division mode.

6. The method of claim 5, wherein the method is based on a deep learning-based variant protocol field partitioning method. The minimum unit of the field division is half a byte, and the division method of more than half a byte is allowed.

Images