Protocol format segmentation method, device and storage medium

Abstract

The present invention provides a protocol format segmentation method, device and storage medium, including: obtaining a traffic picture to be segmented of a protocol traffic; inputting the traffic picture to be segmented into a field segmentation model, using the field segmentation model to predict the segmentation position of the traffic picture to be segmented, and outputting the field segmentation position; inputting each protocol segmentation bit sequence corresponding to the field segmentation position into a field determination twin model, using the field determination twin model to perform category determination on each protocol segmentation bit sequence, and outputting the protocol format segmentation result. The present invention uses a field segmentation model to perform a primary segmentation on the traffic picture to be segmented to obtain the field segmentation position, and uses the field determination twin model to perform a secondary determination on the protocol segmentation bit sequences on the left and right of the field segmentation position to further determine whether the segmentation position is predicted accurately. The technical means solves the technical problem of low accuracy of protocol format segmentation, thereby improving the accuracy of protocol format segmentation.

Description

Technical Field

[0001] The present invention relates to the field of communication network technology, and in particular to a protocol format segmentation method, device and storage medium. Background Art

[0002] As the core element of network communication, the quality of network protocol is directly related to the stability, reliability and security of communication. Currently, there is no public network protocol specification, and the protocol reverse analysis technology is mainly used to obtain the protocol specification of unknown protocols.

[0003] The protocol reverse analysis technology aims to obtain the protocol format and protocol state machine. Among them, the protocol format acquisition mainly infers the message format such as the protocol keyword field, message structure and field semantic information. At present, it usually relies on sequence alignment technology for format inference. Specifically, various sequence alignment algorithms are used to align message pairs and calculate similarity scores. Messages are clustered based on such scores, and then the message format is inferred by analyzing the commonalities of messages in the cluster. However, when processing large quantities of protocol traffic data, due to the diversity of messages in a protocol, the accuracy of alignment will be greatly reduced, which will lead to low accuracy in protocol format segmentation. Summary of the invention

[0004] The present invention provides a protocol format segmentation method, a device and a storage medium, aiming to improve the accuracy of protocol format segmentation.

[0005] The present invention provides a protocol format segmentation method, comprising:

[0006] Get the traffic image to be segmented corresponding to the target protocol traffic;

[0007] Inputting the traffic image to be segmented into a field segmentation model, using the field segmentation model to predict the segmentation position of the traffic image to be segmented, and outputting the field segmentation position;

[0008] Input each protocol segmentation bit sequence corresponding to the field segmentation position into the field determination twin model, so as to use the field determination twin model to perform category determination on each protocol segmentation bit sequence, and output the protocol format segmentation result;

[0009] Among them, the field segmentation model is obtained by iterative training based on the protocol traffic picture corresponding to the pre-collected historical protocol traffic and the field segmentation sequence label of the protocol traffic picture, and the field judgment twin model is obtained by iterative training based on the bit sequence to be trained selected in the protocol traffic picture and the field segmentation sequence label.

[0010] Optionally, according to a protocol format segmentation provided by the present invention, the field segmentation model includes an encoding module, a decoding module and a protocol segmentation output module, wherein:

[0011] The encoding module includes a plurality of cascaded encoding units; among all the encoding units, each encoding unit except the last encoding unit includes a first convolution layer and a downsampling layer; the last encoding unit includes the first convolution layer; among all the encoding units, each encoding unit except the last two encoding units also includes a third convolution layer;

[0012] The decoding module includes a plurality of cascaded decoding units, each of which includes an upsampling layer, a second convolutional layer, a feature connection layer and a fourth convolutional layer;

[0013] The protocol segmentation output module includes a plurality of cascaded fifth convolutional layers;

[0014] The network structures corresponding to the third convolutional layer, the fourth convolutional layer and the fifth convolutional layer are the same;

[0015] The output of the fourth convolutional layer of the last decoding unit is used as the input of the protocol segmentation output module.

[0016] Optionally, according to a protocol format segmentation provided by the present invention, the inputting the traffic picture to be segmented into a field segmentation model, using the field segmentation model to predict the segmentation position of the traffic picture to be segmented, and outputting each protocol segmentation bit sequence corresponding to the field segmentation position, including:

[0017] Performing feature extraction on the traffic image to be segmented through the first convolutional layer in the first encoding unit to obtain a coding feature map output by the first convolutional layer in the first encoding unit;

[0018] Downsampling the coded feature map output by the first coding unit through the downsampling layer in the first coding unit to obtain a downsampled feature map, and using the downsampled feature map as the input of the first convolutional layer in the next coding unit, until the coded feature map output by the first convolutional layer in the last coding unit is obtained;

[0019] Upsampling and convolution processing are performed on the encoding feature map output by the last encoding unit through the upsampling layer and the second convolution layer in the first decoding unit to obtain a first target processing feature map;

[0020] Performing feature connection on the first target processing feature map and the encoding feature map output by the encoding unit at the same depth level as the first decoding unit through the feature connection layer in the first decoding unit to obtain a first connection feature map;

[0021] Performing convolution processing on the first connection feature map through the fourth convolution layer in the first decoding unit to obtain a convolution processing feature map output by the first decoding unit, and using the convolution processing feature map output by the first decoding unit as input to the next decoding unit;

[0022] Upsampling and convolution processing are performed on the convolution processing feature map through the upsampling layer and the second convolution layer in the next decoding unit to obtain a second target processing feature map;

[0023] Performing convolution processing on the encoding feature map output by the target encoding unit through a third convolution layer in the target encoding unit to obtain a target feature map having the same size as the second target processing feature map, wherein the target encoding unit is an encoding unit at the same depth level as the next decoding unit;

[0024] Performing feature connection on the second target processing feature map and the target feature map through a feature connection layer in the next decoding unit to obtain a second connection feature map;

[0025] Performing convolution processing on the second connection feature map through the fourth convolution layer in the next decoding unit to obtain a convolution processing feature map output by the next decoding unit;

[0026] Return to the step of upsampling and convolutionally processing the convolution processing feature map through the upsampling layer and the second convolution layer in the next decoding unit to obtain a second target processing feature map, until the convolution processing feature map output by the fourth convolution layer in the last decoding module is obtained;

[0027] The convolution processing feature map of the last decoding module is input into the protocol segmentation output module to obtain the field segmentation position output by the protocol segmentation output module.

[0028] Optionally, according to a protocol format segmentation provided by the present invention, the field determination twin model is composed of a preset number of twin neural networks with the same network structure and shared model parameters, a similarity calculation layer and a fully connected layer, wherein the output of the twin neural network is used as the input of the similarity calculation layer;

[0029] The step of inputting each protocol segmentation bit sequence corresponding to the field segmentation position into the field determination twin model, using the field determination twin model to perform category determination on each protocol segmentation bit sequence, and outputting the protocol format segmentation result, includes:

[0030] Selecting each protocol segmentation bit sequence adjacent to the field segmentation position in the to-be-segmented traffic picture;

[0031] Inputting each of the protocol segmentation bit sequences into the twin neural network respectively to obtain a feature vector output by each of the twin neural networks;

[0032] Calculate the similarity vector between each of the feature vectors through the similarity calculation layer;

[0033] The similarity vector is input into the fully connected layer to obtain the format segmentation result output by the fully connected layer.

[0034] Optionally, according to a protocol format segmentation provided by the present invention, the twin neural network includes a feature fusion layer, a temporal feature extraction layer and a spatial feature extraction layer;

[0035] The step of inputting each of the protocol segmentation bit sequences into the twin neural network to obtain a feature vector of each of the protocol segmentation bit sequences comprises:

[0036] For each of the protocol segmentation bit sequences, the protocol segmentation bit sequences are input into the temporal feature extraction layer and the spatial feature extraction layer, respectively, so as to extract the temporal feature vector of the protocol segmentation bit sequence by using the temporal feature extraction layer, and to extract the spatial feature vector of the protocol segmentation bit sequence by using the spatial feature extraction layer;

[0037] The temporal feature vector and the spatial feature vector are input into the feature fusion layer, so as to utilize the feature fusion layer to perform feature fusion on the temporal feature vector and the spatial feature vector to obtain the feature vector.

[0038] Optionally, according to a protocol format segmentation provided by the present invention, the field segmentation model is trained based on the following steps:

[0039] Acquire historical protocol traffic and extract format information of the historical protocol traffic;

[0040] Based on the format information of the historical protocol traffic, generating multiple protocol traffic images;

[0041] For each of the protocol traffic images, input the protocol traffic image into a field segmentation model to be trained to obtain a predicted segmentation position output by the field segmentation model to be trained;

[0042] Calculating a model loss value based on the predicted segmentation position and the field segmentation sequence label in the protocol traffic graph;

[0043] Based on the model loss value obtained in each iteration, the parameters of the field segmentation model to be trained are updated to obtain the field segmentation model.

[0044] Optionally, according to a protocol format segmentation provided by the present invention, the field determination twin model is trained based on the following steps:

[0045] For each of the protocol traffic pictures, based on the field segmentation sequence label, each to-be-trained bit sequence is selected in the protocol traffic picture;

[0046] Inputting each of the to-be-trained bit sequences into the to-be-trained twin model to obtain a category prediction result output by the to-be-trained twin model;

[0047] Calculate a cross entropy loss value based on the category prediction result and the field segmentation sequence label in the protocol traffic picture;

[0048] Based on the cross entropy loss value obtained in each iteration, the parameters of the twin model to be trained are updated to obtain the field judgment twin model.

[0049] Optionally, according to a protocol format segmentation provided by the present invention, the format information includes field position and length information, and the generating of multiple protocol flow pictures based on the format information of the historical protocol flow includes:

[0050] Based on the field position and the length information, classify the historical protocol traffic to obtain a protocol traffic classification result;

[0051] In the protocol traffic classification result, each protocol traffic belonging to the same communication session is grouped;

[0052] Based on the field position and length information of each of the protocol flows, generating a field segmentation sequence label in a binary format;

[0053] The protocol traffic graph is generated based on each protocol traffic in the same group and its corresponding field segmentation sequence label.

[0054] The present invention also provides a protocol format segmentation device, comprising:

[0055] An acquisition module is used to obtain the traffic image to be segmented corresponding to the target protocol traffic;

[0056] A position prediction module, used for inputting the traffic picture to be segmented into a field segmentation model, so as to use the field segmentation model to predict the segmentation position of the traffic picture to be segmented, and outputting the field segmentation position;

[0057] A determination module is used to input each protocol segmentation bit sequence corresponding to the field segmentation position into a field determination twin model, so as to use the field determination twin model to perform category determination on each protocol segmentation bit sequence, and output a protocol format segmentation result; wherein, the field segmentation model is obtained by iterative training based on a protocol traffic picture corresponding to a pre-collected historical protocol traffic and a field segmentation sequence label of the protocol traffic picture, and the field determination twin model is obtained by iterative training based on a bit sequence to be trained selected in the protocol traffic picture and the field segmentation sequence label.

[0058] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, any of the above-mentioned protocol format segmentation methods is implemented.

[0059] The present invention also provides a non-transitory computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the protocol format segmentation method described in any one of the above is implemented.

[0060] The present invention also provides a computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the protocol format segmentation method described above is implemented.

[0061] The protocol format segmentation method, device and storage medium provided by the present invention obtain a traffic picture to be segmented corresponding to the target protocol traffic; input the traffic picture to be segmented into a field segmentation model, so as to use the field segmentation model to predict the segmentation position of the traffic picture to be segmented, and output the field segmentation position; input each protocol segmentation bit sequence corresponding to the field segmentation position into a field determination twin model, so as to use the field determination twin model to perform category determination on each protocol segmentation bit sequence, and output the protocol format segmentation result; wherein the field segmentation model is obtained by iterative training based on the protocol traffic picture corresponding to the historical protocol traffic collected in advance and the field segmentation sequence label of the protocol traffic picture, and the field determination twin model is obtained by iterative training based on the bit sequence to be trained selected from the protocol traffic picture and the field segmentation sequence label. The present invention performs primary format segmentation on the traffic picture to be segmented through the field segmentation model to obtain the field segmentation position, and then performs secondary determination on the protocol segmentation bit sequence corresponding to the field segmentation position on the left and right sides through the field determination twin model, so as to further determine whether the segmentation position is predicted accurately, thereby improving the accuracy of protocol format segmentation. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0063] Figure 1 This is one of the flow charts of the protocol format segmentation method provided by the present invention;

[0064] Figure 2 A schematic diagram of the structure of a field segmentation model in the protocol format segmentation method provided by the present invention;

[0065] Figure 3 A schematic diagram of the structure of a field determination twin model in the protocol format segmentation method provided by the present invention;

[0066] Figure 4 It is a structural schematic diagram of the protocol format segmentation device provided by the present invention;

[0067] Figure 5 It is a structural schematic diagram of the electronic device provided by the present invention.

[0068] Wherein, the accompanying drawings are marked as follows:

[0069] 1: the first convolutional layer; 2: downsampling layer; 3: upsampling layer and second convolutional layer; 4: feature connection layer; 5: fourth convolutional layer; 6: third convolutional layer; 7: fifth convolutional layer. DETAILED DESCRIPTION

[0070] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0071] The terms used in one or more embodiments of the present invention are only for the purpose of describing specific embodiments, and are not intended to limit one or more embodiments of the present invention. The singular forms of "a", "said" and "the" used in one or more embodiments of the present invention are also intended to include plural forms, unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used in one or more embodiments of the present invention refers to and includes any or all possible combinations of one or more associated listed items.

[0072] It should be understood that, although the terms first, second, etc. may be used to describe various information in one or more embodiments of the present invention, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of one or more embodiments of the present invention, the first may also be referred to as the second, and similarly, the second may also be referred to as the first. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0073] Combine the following Figure 1-Figure 3 Exemplary embodiments of the present invention are described in detail.

[0074] like Figure 1 FIG. 1 is a flow chart of a protocol format segmentation method according to an embodiment of the present invention. Figure 1 As shown, the protocol format segmentation method includes:

[0075] Step S10, obtaining a flow picture to be segmented corresponding to the target protocol flow;

[0076] It should be noted that the target protocol traffic represents protocol traffic in an unknown protocol format, and its format information such as field position and length information cannot be parsed and obtained.

[0077] Specifically, the target protocol traffic of the network communication process is obtained, and then similarity clustering is performed on the target protocol traffic, and the protocol traffic whose similarity meets a preset similarity threshold is clustered into one category, wherein the preset similarity threshold can be set according to actual conditions and will not be elaborated here, thereby obtaining the traffic picture to be segmented corresponding to the target protocol traffic.

[0078] Step S20, inputting the traffic picture to be segmented into a field segmentation model, using the field segmentation model to predict the segmentation position of the traffic picture to be segmented, and outputting the field segmentation position;

[0079] It should be noted that the field segmentation model is a segmentation model coupled with an encoder-decoder architecture based on the U-net model, including an encoding module, a decoding module and a protocol segmentation output module, wherein the encoding module includes a plurality of cascaded encoding units; among all encoding units, each encoding unit except the last encoding unit includes a first convolutional layer and a downsampling layer, and the last encoding unit includes a first convolutional layer; among all encoding units, each encoding unit except the last two encoding units also includes a third convolutional layer; the decoding module includes a plurality of cascaded decoding units, and the decoding units They all include an upsampling layer, a second convolutional layer, a feature connection layer and a fourth convolutional layer. The output of the first convolutional layer in the encoding unit is convolutionally processed by the third convolutional layer and then input into the feature connection layer in the corresponding decoding unit, or the output of the first convolutional layer in the encoding unit is directly input into the feature connection layer in the corresponding decoding unit. The protocol segmentation output module includes several cascaded fifth convolutional layers. The network structures corresponding to the third convolutional layer, the fourth convolutional layer and the fifth convolutional layer are the same. The output of the fourth convolutional layer of the last decoding unit is used as the input of the protocol segmentation output module.

[0080] Reference Figure 2 The encoding module includes 5 encoding units, and the decoding module includes 4 decoding units. The encoding feature map output by the first convolutional layer in the 5th encoding unit is directly used as the up-sampled input in the 1st decoding unit. The encoding unit is connected to the decoding units in the same depth level, wherein the 4th encoding unit and the 1st decoding unit are at the same depth level, the 3rd encoding unit and the 2nd decoding unit are at the same depth level, the 2nd encoding unit and the 3rd decoding unit are at the same depth level, and the 1st encoding unit and the 4th decoding unit are at the same depth level.

[0081] Specifically, the traffic picture to be segmented is first input into the first convolutional layer in the first coding unit of the word, so as to use the first convolutional layer in the first coding unit to extract the encoding feature map corresponding to the traffic picture to be segmented, and then the encoding feature map output by the first convolutional layer in the first coding unit is downsampled through the downsampling layer in the first coding unit to obtain a sampling feature map, and the downsampled feature map is used as the input of the first convolutional layer in the next coding unit, until the encoding feature map output by the first convolutional layer in the last coding unit is obtained.

[0082] Furthermore, after obtaining the coding feature map output by the last coding unit, the decoding stage begins. At this time, the coding feature map output by the last coding unit will enter the first decoding unit in the decoding module, and then the coding feature map output by the last coding unit will be upsampled and convolved through the upsampling layer and the second convolution layer in the first decoding unit to obtain a first target processing feature map, and the target coding unit at the same depth level as the first decoding unit is determined, and then the first target processing feature map and the coding feature map output by the target coding unit are feature-connected, so that the connected feature map is input into the fourth convolution layer of the current decoding unit to perform a convolution operation on the connected feature map to obtain the convolution processing feature map output by the first decoding unit, and the convolution processing feature map is used as the input of the next decoding unit, and then the convolution processing feature map is upsampled and convolved through the upsampling layer and the second convolution layer of the next decoding unit to obtain the second target processing feature map, and the target coding unit at the same depth level as the current decoding unit is determined. For the target coding unit at the same depth level, since the feature map input to the next decoding unit is convolved by the fourth convolutional layer, the size of the coded feature map output by the target coding unit is different from the size of the feature map after upsampling and convolution processing, and feature connection cannot be performed directly. Therefore, it is necessary to perform a convolution operation on the coded feature map output by the target coding unit through the third convolutional layer of the target coding unit to obtain a target feature map with the same size as the second target processing feature map. Further, the second target processing feature map and the target feature map are spliced ​​through the feature connection layer of the next decoding unit, and the spliced ​​feature map is input into the fourth convolutional layer of the next decoding unit to obtain the convolution processing feature map output by the next decoding unit, thereby returning to execute the step of upsampling and convolution processing the convolution processing feature map through the upsampling layer and the second convolutional layer of the next decoding unit to obtain the second target processing feature map, until the convolution processing feature map output by the fourth convolutional layer in the last decoding module is obtained.

[0083] Furthermore, the convolution processing feature map of the last decoding module is input into the protocol segmentation output module, so that the convolution processing feature map of the last decoding module is gradually convolved through each fifth convolution layer to obtain the field segmentation position output by the protocol segmentation output module.

[0084] In addition, when predicting the segmentation positions of a large amount of protocol traffic data, several predicted field segmentation positions may be predicted. In this case, the several predicted field segmentation positions need to be fused to obtain one field segmentation position.

[0085] For example: referring to Table 1, the third convolutional layer in the last decoding unit outputs a convolution processing feature map with a size of 16×256×64. After each third convolutional layer in the protocol segmentation output module, the convolution processing feature map of the last decoding module is gradually convolved to obtain a feature map with a size of 1×256×1.

[0086] Table 1

[0087]

[0088] Step S30, inputting each protocol segmentation bit sequence corresponding to the field segmentation position into the field determination twin model, so as to use the field determination twin model to perform category determination on each of the protocol segmentation bit sequences, and outputting the protocol format segmentation result;

[0089] Among them, the field segmentation model is obtained by iterative training based on the protocol traffic picture corresponding to the pre-collected historical protocol traffic and the field segmentation sequence label of the protocol traffic picture, and the field judgment twin model is obtained by iterative training based on the bit sequence to be trained selected in the protocol traffic picture and the field segmentation sequence label.

[0090] It should be noted that, refer to Figure 3 The field judgment twin model is composed of a preset number of twin neural networks with the same network structure and shared model parameters, a similarity calculation layer and a fully connected layer. The preset number is at least 2. Preferably, the twin neural network includes a feature fusion layer, a temporal feature extraction layer and a spatial feature extraction layer. The spatial feature extraction layer includes an average pooling layer and 3 sequence convolution layers. Each sequence convolution layer is followed by a normalization layer and an activation layer. The temporal feature extraction layer includes a bidirectional long short-term memory layer and is followed by a dropout layer to prevent the model from overfitting.

[0091] Specifically, in the traffic picture to be segmented, two bit sequences adjacent to the field segmentation position on the left and right are selected as the protocol segmentation bit sequences, and then each of the protocol segmentation bit sequences is input into the twin neural network respectively. For each of the protocol segmentation bit sequences, the protocol segmentation bit sequences are input into the timing feature extraction layer and the spatial feature extraction layer respectively, so as to use the timing feature extraction layer to extract the timing feature vector of the protocol segmentation bit sequence, and use the spatial feature extraction layer to extract the spatial feature vector of the protocol segmentation bit sequence, and then use the feature fusion layer to perform feature fusion on the timing feature vector and the spatial feature vector to obtain the feature vector corresponding to the twin neural network.

[0092] Furthermore, based on the feature vectors output by each twin neural network, the similarity calculation layer calculates the similarity vectors between the feature vectors, wherein the similarity vector calculation methods include Euclidean distance, cosine similarity, Mahalanobis distance and other calculation methods, and then the similarity vector is input into the fully connected layer to obtain the format segmentation result output by the fully connected layer.

[0093] The present invention adopts the above scheme, that is, obtaining the traffic picture to be segmented corresponding to the target protocol traffic; inputting the traffic picture to be segmented into the field segmentation model, so as to use the field segmentation model to predict the segmentation position of the traffic picture to be segmented, and output the field segmentation position; inputting each protocol segmentation bit sequence corresponding to the field segmentation position into the field determination twin model, so as to use the field determination twin model to perform category determination on each protocol segmentation bit sequence, and output the protocol format segmentation result; wherein, the field segmentation model is obtained by iterative training based on the protocol traffic picture corresponding to the historical protocol traffic collected in advance and the field segmentation sequence label of the protocol traffic picture, and the field determination twin model is obtained by iterative training based on the bit sequence to be trained selected from the protocol traffic picture and the field segmentation sequence label. It is realized that the first-level format segmentation of the traffic picture to be segmented is performed by the field segmentation model to obtain the field segmentation position, and then the second-level determination is performed on the protocol segmentation bit sequence corresponding to the left and right of the field segmentation position by the field determination twin model, so as to further determine whether the segmentation position is predicted accurately, thereby improving the accuracy of protocol format segmentation.

[0094] Based on any of the above embodiments, in another embodiment of the present invention, the above step S20: inputting the traffic picture to be segmented into a field segmentation model, using the field segmentation model to predict the segmentation position of the traffic picture to be segmented, and outputting each protocol segmentation bit sequence corresponding to the field segmentation position, includes:

[0095] Step S21, performing feature extraction on the traffic image to be segmented through the first convolutional layer in the first encoding unit to obtain a coding feature map output by the first convolutional layer in the first encoding unit;

[0096] It should be noted that the first convolution layer is a symmetric convolution layer with a convolution step size of 1×1, which can increase the number of channels in the feature layer.

[0097] Specifically, the traffic image to be segmented is input into the first convolutional layer in the first encoding unit, so as to use the first convolutional layer to perform convolution processing on the traffic image to be segmented, thereby obtaining the encoding feature map output by the first convolutional layer in the first encoding unit.

[0098] Step S22, downsampling the coded feature map output by the first coding unit through the downsampling layer in the first coding unit to obtain a downsampled feature map, and using the downsampled feature map as the input of the first convolutional layer in the next coding unit, until the coded feature map output by the first convolutional layer in the last coding unit is obtained;

[0099] Specifically, the encoding feature map is input to the downsampling layer in the first encoding unit to perform a downsampling operation on the encoding feature map, thereby outputting the maximum value of the 2×2 area, obtaining the downsampling feature map output by the current encoding unit, and using the downsampling feature map as the input of the next encoding unit to perform corresponding processing through the first convolutional layer and the downsampling layer of the next encoding unit until the encoding feature map output by the first convolutional layer in the last encoding unit is obtained.

[0100] It can be understood that, referring to Table 1, the size of the input traffic image to be segmented is 256×256×1, and the size of the feature map obtained after processing by the first convolutional layer in the first coding unit is 256×256×64, and then down-sampled by the downsampling layer in the first coding unit, the height and width are reduced by half, and the size of the obtained feature map is 128×128×64, so that the 128×128×64 feature map is used as the input of the first convolutional layer in the next coding unit, and so on, until the encoded feature map output by the first convolutional layer in the last coding unit is obtained.

[0101] Step S23, upsampling and convolution processing are performed on the encoding feature map output by the last encoding unit through the upsampling layer and the second convolution layer in the first decoding unit to obtain a first target processing feature map;

[0102] It should be noted that the second convolution layer is a symmetric convolution layer with a convolution step size of 1×1, which can reduce the number of channels in the feature layer.

[0103] Specifically, the encoding feature map output by the last encoding unit is upsampled by the upsampling layer in the first decoding unit, and then the upsampled feature map is convolved by the second convolution layer in the first decoding unit to obtain the first target processing feature map.

[0104] It can be understood that, referring to Table 1, the size of the encoded feature map output by the last encoding unit is 16×16×1024, and after upsampling, a feature map of size 32×32×1024 is obtained, and then after convolution processing, a feature map of size 32×32×512 is obtained.

[0105] Step S24, performing feature connection on the first target processing feature map and the encoding feature map output by the encoding unit at the same depth level as the first decoding unit through the feature connection layer in the first decoding unit to obtain a first connection feature map;

[0106] Specifically, an encoding feature map output by an encoding unit at the same depth level as the current decoding unit is determined, and the first target processing feature map and the encoding feature map are feature-connected through a feature connection layer in the first decoding unit to obtain a first connection feature map.

[0107] understandably, understandably, with reference to Figure 2 As shown in Table 1, since the feature map size output by the first convolutional layer in the fourth coding unit is the same as the feature map size after processing by the upsampling layer and the second convolutional layer in the first decoding unit, the output end of the first convolutional layer in the fourth coding unit is directly connected to the input end of the feature connection layer in the first decoding unit. The last coding unit outputs a coded feature map of size 16×16×1024, and the first target processing feature map of size 32×32×512 is obtained after upsampling and convolution processing by the upsampling layer and the second convolutional layer in the first decoding unit. The first convolutional layer in the fourth coding unit outputs a coded feature map of size 32×32×512. Therefore, the first target processing feature map and the coded feature map are directly feature spliced ​​to obtain a feature map of 32×32×1024.

[0108] Step S25, performing convolution processing on the first connection feature map through the fourth convolution layer in the first decoding unit to obtain a convolution processing feature map output by the first decoding unit, and using the convolution processing feature map output by the first decoding unit as the input of the next decoding unit;

[0109] It should be noted that the fourth convolutional layer is a convolutional layer with a convolution step size of 1×2, so that the height of the feature map is reduced by one time. Using the example of step S24 above, feature concatenation is performed to obtain a feature map of size 32×32×1024, and then the first connection feature map is convolved by the fourth convolutional layer to obtain a feature map of size 16×32×1024.

[0110] Step S26, upsampling and convolution processing are performed on the convolution processing feature map through the upsampling layer and the second convolution layer in the next decoding unit to obtain a second target processing feature map;

[0111] It should be noted that the process of upsampling and convolution processing in this embodiment is basically the same as the process of upsampling and convolution processing in step S23 above, which will not be repeated here.

[0112] Step S27, performing convolution processing on the coding feature map output by the target coding unit through the third convolution layer in the target coding unit to obtain a target feature map of the same size as the second target processing feature map, wherein the target coding unit is a coding unit at the same depth level as the next decoding unit;

[0113] It should be noted that the third convolution layer is a convolution layer with a convolution step size of 1×2. Specifically, the target coding unit at the same depth level as the next decoding unit is determined. Since the height of the second target processing feature is halved after the convolution processing of the fourth convolution layer, the encoding feature map output by the target coding unit at the same depth level as the next decoding unit is different in size from the second target processing feature map. Therefore, it is necessary to perform convolution processing on the encoding feature map output by the target coding unit through the third convolution layer in the target coding unit to obtain a target feature map of the same size as the second target processing feature map, wherein the number of times the encoding unit performs convolution on the encoding feature map is the same as the number of times the third convolution layer is used in the decoding module.

[0114] Reference Figure 2 As shown in Table 1, after the first convolution processing feature map of size 16×32×512 is obtained by convolution through the fourth convolution layer of the first decoding unit, a feature map of size 32×64×256 is obtained after upsampling and convolution processing through the second decoding unit, and the first convolution layer in the third encoding unit outputs a coding feature map of size 64×64×256, which is different from the size of the feature map of the decoding unit. Therefore, it is necessary to perform a convolution processing on the coding feature map through the third convolution layer in the third encoding unit to obtain a target feature map of 32×64×256. In addition, for the third decoding unit, since the convolution operation is performed through the third convolution layer in both the first decoding unit and the second decoding unit, the coding feature map output by the coding unit (the second coding unit) at the same depth level as the third decoding unit needs to be convolved twice using the third convolution layer.

[0115] Step S28, performing feature connection on the second target processing feature map and the target feature map through the feature connection layer in the next decoding unit to obtain a second connection feature map;

[0116] It should be noted that the process of performing feature connection in this embodiment is basically the same as the process of performing feature connection in the above step S24, and will not be repeated here.

[0117] Step S29, performing convolution processing on the second connection feature map through the fourth convolution layer in the next decoding unit to obtain a convolution processing feature map output by the next decoding unit;

[0118] Step S210, returning to the step of upsampling and convolutionally processing the convolution processing feature map through the upsampling layer and the second convolution layer in the next decoding unit to obtain a second target processing feature map, until the convolution processing feature map output by the fourth convolution layer in the last decoding module is obtained;

[0119] Specifically, the second connection feature map is input into the fourth convolution layer in the next decoding unit to obtain the convolution processing feature map output by the next decoding unit, thereby returning to execute the step of upsampling and convolution processing the convolution processing feature map through the upsampling layer and the second convolution layer in the next decoding unit to obtain the second target processing feature map, until the convolution processing feature map output by the last decoding unit is obtained.

[0120] Step S211, inputting the convolution processing feature map of the last decoding module into the protocol segmentation output module to obtain the field segmentation position output by the protocol segmentation output module.

[0121] Specifically, the convolution processing feature map of the last decoding module is input into the protocol segmentation output module, so as to use each fifth convolution layer in the protocol segmentation output module to gradually perform convolution operation on the convolution processing feature map of the last decoding module, so as to reduce the height of the feature map to 1, and obtain the field segmentation position output by the protocol segmentation output module.

[0122] Through the above scheme, the embodiment of the present invention realizes an improved design based on the classic image semantic segmentation model UNet, retains the downsampling process of the original UNet model, but gradually shrinks the feature map to a height of 1 through an asymmetric convolution step size in the upsampling stage, thereby using the improved field segmentation model to perform a preliminary segmentation position prediction on the traffic image to be segmented, thereby effectively improving the accuracy of unknown protocol segmentation.

[0123] Based on any of the above embodiments, in another embodiment of the present invention, the above step S30: inputting each protocol segmentation bit sequence corresponding to the field segmentation position into the field determination twin model, so as to use the field determination twin model to perform category determination on each of the protocol segmentation bit sequences, and outputting the protocol format segmentation result, including:

[0124] Step S41, inputting each of the protocol segmentation bit sequences into the twin neural network respectively to obtain a feature vector output by each of the twin neural networks;

[0125] The above step S41: inputting each of the protocol segmentation bit sequences into the twin neural network to obtain the feature vectors of each of the protocol segmentation bit sequences includes:

[0126] Step S411, for each of the protocol segmentation bit sequences, inputting the protocol segmentation bit sequences into the temporal feature extraction layer and the spatial feature extraction layer, respectively, so as to extract the temporal feature vector of the protocol segmentation bit sequence by using the temporal feature extraction layer, and extract the spatial feature vector of the protocol segmentation bit sequence by using the spatial feature extraction layer;

[0127] Step S412: input the temporal feature vector and the spatial feature vector into the feature fusion layer, so as to utilize the feature fusion layer to perform feature fusion on the temporal feature vector and the spatial feature vector to obtain the feature vector.

[0128] Step S42, calculating the similarity vector between each of the feature vectors through the similarity calculation layer;

[0129] Step S42: input the similarity vector into the fully connected layer to obtain the format segmentation result output by the fully connected layer.

[0130] Specifically, the selected protocol segmentation bit sequences are respectively input into the corresponding twin neural networks, wherein the following steps are performed in each twin neural network: the protocol segmentation bit sequences are respectively input into the temporal feature extraction layer and the spatial feature extraction layer in the twin neural network, and then the temporal feature extraction layer is used to extract the temporal feature vector of the protocol segmentation bit sequence. In addition, the sequence convolution layer in the spatial feature extraction layer is used to extract the feature vector of the protocol segmentation bit sequence, and then the feature vector is normalized through the normalization layer and the activation layer to obtain the normalized feature vector, and then the normalized feature vector is pooled through the average pooling layer to obtain the spatial feature vector output by the average pooling layer, and then the feature fusion layer is used to perform feature fusion processing on the spatial feature vector and the temporal feature vector to obtain the feature vector corresponding to the twin neural network.

[0131] Furthermore, the similarity calculation layer calculates the similarity vectors between the feature vectors output by each twin neural network, and then inputs the similarity vectors into the fully connected layer to determine whether they are of the same data type, thereby obtaining the format segmentation result.

[0132] Through the above scheme, the embodiment of the present invention realizes that after the field segmentation model predicts the format segmentation of the traffic image to be segmented to obtain the field segmentation position, the field determination twin model is further used to accurately determine the protocol segmentation bit sequence of the first-level segmentation position to achieve the final field segmentation output. This improves the accuracy of unknown protocol format segmentation.

[0133] Based on any of the above embodiments, in another embodiment of the present invention, the field segmentation model is trained based on the following steps:

[0134] Step A10, obtaining historical protocol traffic and extracting format information of the historical protocol traffic;

[0135] Step A20, generating a plurality of protocol flow images based on the format information of the historical protocol flow;

[0136] The format information includes field position and length information. The above step A20: generating multiple protocol flow images based on the format information of the historical protocol flow includes:

[0137] Step A21, classifying each protocol flow in the historical protocol flow based on the field position and the length information to obtain a protocol flow classification result;

[0138] Step A22, grouping the protocol flows belonging to the same communication session in the protocol flow classification result;

[0139] Step A23, generating a field segmentation sequence tag in binary format based on the field position and length information of each of the protocol flows;

[0140] Step A24, generating the protocol traffic graph based on each protocol traffic in the same group and its corresponding field segmentation sequence label.

[0141] Step A30, for each of the protocol traffic images, inputting the protocol traffic image into a field segmentation model to be trained, and obtaining a predicted segmentation position output by the field segmentation model to be trained;

[0142] Step A40, calculating a model loss value based on the predicted segmentation position and the field segmentation sequence label in the protocol traffic picture;

[0143] Step A50, based on the model loss value obtained in each iteration, the parameters of the field segmentation model to be trained are updated to obtain the field segmentation model.

[0144] Specifically, firstly, several protocol flows of known protocol formats are collected from the network (historical protocol flows in this embodiment), and then each protocol flow is parsed to obtain the format information corresponding to each protocol flow, wherein the format information includes field position and length information, and then based on the field position and length information, each protocol flow in the historical protocol flow is classified to obtain a protocol flow classification result, for example: the DNS system domain name protocol is classified into one category, the TCP communication protocol is classified into one category, and the ARP address resolution protocol is classified into one category. Further, in the protocol flow classification result, each protocol flow belonging to the same communication session is classified into a group, wherein, based on the field position and length information of the protocol flow, each protocol flow in each group is marked to obtain a field segmentation sequence label in a binary format, for example: the starting position of the field in the protocol flow is marked as 1, and the other positions are marked as 0, and a field segmentation sequence label in a binary format of 0 and 1 is generated. Further, based on each protocol flow in the same group and its corresponding field segmentation sequence label, the protocol flow picture is generated.

[0145] It should be noted that the field segmentation model to be trained is a segmentation model coupled with an encoder-decoder architecture based on the U-net model. In this embodiment, the downsampling process of the original UNet model is retained, but in the upsampling stage, the feature map is gradually reduced to a height of 1 through an asymmetric convolution step size. Specifically, the protocol traffic image is input into the field segmentation model to be trained to obtain the predicted segmentation position output by the field segmentation model to be trained, and then the predicted segmentation position is mapped through an activation function to obtain the target segmentation position. Furthermore, through a pre-set target loss function, a first loss value between the target segmentation position and the field segmentation sequence label is calculated, and a second loss value corresponding to the non-target segmentation position is calculated.

[0146] The calculation formula of the first loss value is as follows:

[0147]

[0148] The calculation formula of the second loss value is as follows:

[0149]

[0150] Among them, L FS Represents the first loss value, L NFS represents the second loss value, t i It represents the value of each segmentation position in the field segmentation sequence label, and yi represents the target segmentation position.

[0151] Then, based on the first loss value, the second loss value and the weight between the two, the model loss value is calculated. The model loss value calculation formula is as follows:

[0152] L total =a1L FS +a2L NFS

[0153] Among them, L total Represents the model loss value, L FS represents the first loss value, L NFS represents the second loss value, and a1 and a2 represent the weights corresponding to the first loss value and the second loss value respectively.

[0154] On this basis, in other embodiments, the target loss function can be set according to actual needs, and no specific limitation is made here. After the model loss value is calculated, the current training process ends, and the error back propagation algorithm is used to update the model parameters in the field segmentation model to be trained, and then the next training is carried out. During the training process, it is determined whether the updated field segmentation model to be trained meets the preset training end conditions. If so, the updated field segmentation model to be trained is used as the field segmentation model. If not, the model continues to be trained, wherein the preset training end conditions include loss convergence and reaching the maximum number of iterations threshold, etc.

[0155] Through the above scheme, the present invention realizes that by training the field segmentation model, the loss value of the field segmentation model is controlled within a preset range, thereby facilitating improving the accuracy of the field segmentation model in performing protocol format segmentation.

[0156] Based on any of the above embodiments, in another embodiment of the present invention, the field determination twin model is trained based on the following steps:

[0157] Step B10, for each of the protocol traffic images, based on the field segmentation sequence label, selecting each bit sequence to be trained in the protocol traffic image;

[0158] Step B20, input each of the to-be-trained bit sequences into the to-be-trained twin model to obtain a category prediction result output by the to-be-trained twin model; input the protocol traffic picture into the to-be-trained twin model to obtain a category prediction result output by the to-be-trained twin model;

[0159] Step B30, calculating a cross entropy loss value based on the category prediction result and the field segmentation sequence label in the protocol traffic picture;

[0160] Step B40, based on the cross entropy loss value obtained in each iteration, update the parameters of the twin model to be trained to obtain the field judgment twin model.

[0161] Specifically, after generating the protocol traffic graph corresponding to the historical protocol traffic, two adjacent bit sequences to be trained are selected according to the position of the field segmentation sequence label in the protocol traffic graph. For example, in the protocol traffic graph, the starting position of the field in the protocol traffic is marked as 1, and the other positions are marked as 0 to obtain the field segmentation sequence label. Two adjacent bit sequences to be trained are selected at the position marked as 1 as the bit sequences to be trained. Each of the bit sequences to be trained is input into the twin model to be trained to obtain the category prediction result between each protocol traffic in the protocol traffic graph. Based on the category prediction result, the cross entropy loss value is calculated by a preset classification loss function, for example, by a BCE-loss loss function. Further, after the cross entropy loss value is calculated, the training process ends, and the error back propagation algorithm is used to update the model parameters in the twin model to be trained, and then the next training is carried out. During the training process, it is determined whether the updated twin models to be trained meet the preset training end conditions. If they do, the updated twin models to be trained are used as field judgment twin models.

[0162] Through the above-mentioned scheme, the present invention realizes training the field judgment twin model, which is beneficial to control the loss value of the field segmentation model within a preset range, thereby facilitating improving the accuracy of the field segmentation model in performing protocol format segmentation.

[0163] The protocol format segmentation device provided by the present invention is described below. The protocol format segmentation device described below and the protocol format segmentation method described above can be referred to each other.

[0164] like Figure 4 As shown, a protocol format segmentation device according to an embodiment of the present invention includes:

[0165] An acquisition module 10 is used to acquire a flow picture to be segmented corresponding to the target protocol flow;

[0166] The position prediction module 20 is used to input the traffic picture to be segmented into the field segmentation model, so as to use the field segmentation model to predict the segmentation position of the traffic picture to be segmented, and output the field segmentation position;

[0167] The determination module 30 is used to input each protocol segmentation bit sequence corresponding to the field segmentation position into the field determination twin model, so as to use the field determination twin model to perform category determination on each protocol segmentation bit sequence, and output the protocol format segmentation result; wherein, the field segmentation model is obtained by iterative training based on the protocol traffic picture corresponding to the pre-collected historical protocol traffic and the field segmentation sequence label of the protocol traffic picture, and the field determination twin model is obtained by iterative training based on the bit sequence to be trained selected in the protocol traffic picture and the field segmentation sequence label.

[0168] Optionally, the location prediction module 20 is further used for:

[0169] Performing feature extraction on the traffic image to be segmented through the first convolutional layer in the first encoding unit to obtain a coding feature map output by the first convolutional layer in the first encoding unit;

[0170] Downsampling the coded feature map output by the first coding unit through the downsampling layer in the first coding unit to obtain a downsampled feature map, and using the downsampled feature map as the input of the first convolutional layer in the next coding unit, until the coded feature map output by the first convolutional layer in the last coding unit is obtained;

[0171] Upsampling and convolution processing are performed on the encoding feature map output by the last encoding unit through the upsampling layer and the second convolution layer in the first decoding unit to obtain a first target processing feature map;

[0172] Performing feature connection on the first target processing feature map and the encoding feature map output by the encoding unit at the same depth level as the first decoding unit through the feature connection layer in the first decoding unit to obtain a first connection feature map;

[0173] Performing convolution processing on the first connection feature map through the fourth convolution layer in the first decoding unit to obtain a convolution processing feature map output by the first decoding unit, and using the convolution processing feature map output by the first decoding unit as input to the next decoding unit;

[0174] Upsampling and convolution processing are performed on the convolution processing feature map through the upsampling layer and the second convolution layer in the next decoding unit to obtain a second target processing feature map;

[0175] Performing convolution processing on the encoding feature map output by the target encoding unit through a third convolution layer in the target encoding unit to obtain a target feature map having the same size as the second target processing feature map, wherein the target encoding unit is an encoding unit at the same depth level as the next decoding unit;

[0176] Performing feature connection on the second target processing feature map and the target feature map through a feature connection layer in the next decoding unit to obtain a second connection feature map;

[0177] Performing convolution processing on the second connection feature map through the fourth convolution layer in the next decoding unit to obtain a convolution processing feature map output by the next decoding unit;

[0178] Return to the step of upsampling and convolutionally processing the convolution processing feature map through the upsampling layer and the second convolution layer in the next decoding unit to obtain a second target processing feature map, until the convolution processing feature map output by the fourth convolution layer in the last decoding module is obtained;

[0179] The convolution processing feature map of the last decoding module is input into the protocol segmentation output module to obtain the field segmentation position output by the protocol segmentation output module.

[0180] Optionally, the determination module 30 is further configured to:

[0181] Selecting each protocol segmentation bit sequence adjacent to the field segmentation position in the to-be-segmented traffic picture;

[0182] Inputting each of the protocol segmentation bit sequences into the twin neural network respectively to obtain a feature vector output by each of the twin neural networks;

[0183] Calculate the similarity vector between each of the feature vectors through the similarity calculation layer;

[0184] The similarity vector is input into the fully connected layer to obtain the format segmentation result output by the fully connected layer.

[0185] Optionally, the determination module 30 is further configured to:

[0186] For each of the protocol segmentation bit sequences, the protocol segmentation bit sequences are input into the temporal feature extraction layer and the spatial feature extraction layer, respectively, so as to extract the temporal feature vector of the protocol segmentation bit sequence by using the temporal feature extraction layer, and to extract the spatial feature vector of the protocol segmentation bit sequence by using the spatial feature extraction layer;

[0187] The temporal feature vector and the spatial feature vector are input into the feature fusion layer, so as to utilize the feature fusion layer to perform feature fusion on the temporal feature vector and the spatial feature vector to obtain the feature vector.

[0188] Optionally, the protocol format segmentation device further includes:

[0189] Acquire historical protocol traffic and extract format information of the historical protocol traffic;

[0190] Based on the format information of the historical protocol traffic, generating multiple protocol traffic images;

[0191] For each of the protocol traffic images, input the protocol traffic image into a field segmentation model to be trained to obtain a predicted segmentation position output by the field segmentation model to be trained;

[0192] Calculating a model loss value based on the predicted segmentation position and the field segmentation sequence label in the protocol traffic graph;

[0193] Based on the model loss value obtained in each iteration, the parameters of the field segmentation model to be trained are updated to obtain the field segmentation model.

[0194] Optionally, the protocol format segmentation device further includes:

[0195] For each of the protocol traffic pictures, based on the field segmentation sequence label, each to-be-trained bit sequence is selected in the protocol traffic picture;

[0196] Inputting each of the to-be-trained bit sequences into the to-be-trained twin model to obtain a category prediction result output by the to-be-trained twin model;

[0197] Calculate a cross entropy loss value based on the category prediction result and the field segmentation sequence label in the protocol traffic picture;

[0198] Based on the cross entropy loss value obtained in each iteration, the parameters of the twin model to be trained are updated to obtain the field judgment twin model.

[0199] Optionally, the protocol format segmentation device further includes:

[0200] Based on the field position and the length information, classify each protocol flow in the historical protocol flow to obtain a protocol flow classification result;

[0201] In the protocol traffic classification result, each protocol traffic belonging to the same communication session is grouped;

[0202] Based on the field position and length information of each of the protocol flows, generating a field segmentation sequence label in a binary format;

[0203] The protocol traffic graph is generated based on each protocol traffic in the same group and its corresponding field segmentation sequence label.

[0204] It should be noted here that the above-mentioned device provided in the embodiment of the present application can implement all the method steps implemented in the above-mentioned method embodiment, and can achieve the same technical effect. The parts and beneficial effects that are the same as the method embodiment in this embodiment will not be described in detail here.

[0205] Figure 5 An example physical structure diagram of an electronic device is shown, which may include: a processor (processor) 610, a memory (memory) 620, a communication interface (Communications Interface) 630 and a communication bus 640, wherein the processor 610, the memory 620, and the communication interface 630 communicate with each other through the communication bus 640. The processor 610 can call the logic instructions in the memory 620 to execute the protocol format segmentation method, which includes: obtaining a traffic picture to be segmented corresponding to the target protocol traffic; inputting the traffic picture to be segmented into a field segmentation model, so as to use the field segmentation model to predict the segmentation position of the traffic picture to be segmented, and output the field segmentation position; inputting each protocol segmentation bit sequence corresponding to the field segmentation position into a field judgment twin model, so as to use the field judgment twin model to perform category judgment on each protocol segmentation bit sequence, and output the protocol format segmentation result; wherein the field segmentation model is obtained by iterative training based on the protocol traffic picture corresponding to the pre-collected historical protocol traffic and the field segmentation sequence label of the protocol traffic picture, and the field judgment twin model is obtained by iterative training based on the bit sequence to be trained selected in the protocol traffic picture and the field segmentation sequence label.

[0206] In addition, the logic instructions in the above-mentioned memory 620 can be implemented in the form of software functional units and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0207] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute the protocol format segmentation method provided by the above-mentioned methods, the method comprising: obtaining a traffic picture to be segmented corresponding to the target protocol traffic; inputting the traffic picture to be segmented into a field segmentation model, so as to use the field segmentation model to predict the segmentation position of the traffic picture to be segmented, and output the field segmentation position; inputting each protocol segmentation bit sequence corresponding to the field segmentation position into a field determination twin model, so as to use the field determination twin model to perform category determination on each of the protocol segmentation bit sequences, and output the protocol format segmentation result; wherein the field segmentation model is obtained by iterative training based on the protocol traffic picture corresponding to the pre-collected historical protocol traffic and the field segmentation sequence label of the protocol traffic picture, and the field determination twin model is obtained by iterative training based on the bit sequence to be trained selected in the protocol traffic picture and the field segmentation sequence label.

[0208] On the other hand, the present invention also provides a computer program product, which includes a computer program, which can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the protocol format segmentation method provided by the above methods, which method includes: obtaining a traffic picture to be segmented corresponding to the target protocol traffic; inputting the traffic picture to be segmented into a field segmentation model, so as to use the field segmentation model to predict the segmentation position of the traffic picture to be segmented, and output the field segmentation position; inputting each protocol segmentation bit sequence corresponding to the field segmentation position into a field judgment twin model, so as to use the field judgment twin model to perform category judgment on each protocol segmentation bit sequence, and output the protocol format segmentation result; wherein, the field segmentation model is obtained by iterative training based on the protocol traffic picture corresponding to the pre-collected historical protocol traffic and the field segmentation sequence label of the protocol traffic picture, and the field judgment twin model is obtained by iterative training based on the bit sequence to be trained selected in the protocol traffic picture and the field segmentation sequence label.

[0209] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0210] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0211] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A protocol format segmentation method, characterized in that: include: Get the traffic image to be segmented corresponding to the target protocol traffic; Inputting the traffic image to be segmented into a field segmentation model, using the field segmentation model to predict the segmentation position of the traffic image to be segmented, and outputting the field segmentation position; Input each protocol segmentation bit sequence corresponding to the field segmentation position into the field determination twin model, so as to use the field determination twin model to perform category determination on each protocol segmentation bit sequence, and output the protocol format segmentation result; The field segmentation model is obtained by iterative training based on the protocol traffic graph corresponding to the pre-collected historical protocol traffic and the field segmentation sequence label of the protocol traffic graph, and the field determination twin model is obtained by iterative training based on the bit sequence to be trained selected in the protocol traffic graph and the field segmentation sequence label; The field determination twin model is composed of a preset number of twin neural networks with the same network structure and shared model parameters, a similarity calculation layer and a fully connected layer, wherein the output of the twin neural network is used as the input of the similarity calculation layer; The step of inputting each protocol segmentation bit sequence corresponding to the field segmentation position into the field determination twin model, using the field determination twin model to perform category determination on each protocol segmentation bit sequence, and outputting the protocol format segmentation result, includes: Selecting each protocol segmentation bit sequence adjacent to the field segmentation position in the to-be-segmented traffic picture; Inputting each of the protocol segmentation bit sequences into the twin neural network respectively to obtain a feature vector output by each of the twin neural networks; Calculate the similarity vector between each of the feature vectors through the similarity calculation layer; Inputting the similarity vector into the fully connected layer to obtain a format segmentation result output by the fully connected layer; The twin neural network includes a feature fusion layer, a temporal feature extraction layer and a spatial feature extraction layer; The step of inputting each of the protocol segmentation bit sequences into the twin neural network to obtain a feature vector of each of the protocol segmentation bit sequences comprises: For each of the protocol segmentation bit sequences, the protocol segmentation bit sequences are input into the temporal feature extraction layer and the spatial feature extraction layer, respectively, so as to extract the temporal feature vector of the protocol segmentation bit sequence by using the temporal feature extraction layer, and to extract the spatial feature vector of the protocol segmentation bit sequence by using the spatial feature extraction layer; The temporal feature vector and the spatial feature vector are input into the feature fusion layer, so as to utilize the feature fusion layer to perform feature fusion on the temporal feature vector and the spatial feature vector to obtain the feature vector.

2. The protocol format segmentation method according to claim 1, characterized in that: The field segmentation model includes an encoding module, a decoding module and a protocol segmentation output module, wherein: The encoding module includes a plurality of cascaded encoding units; among all the encoding units, each encoding unit except the last encoding unit includes a first convolution layer and a downsampling layer; the last encoding unit includes the first convolution layer; among all the encoding units, each encoding unit except the last two encoding units also includes a third convolution layer; The decoding module includes a plurality of cascaded decoding units, each of which includes an upsampling layer, a second convolutional layer, a feature connection layer and a fourth convolutional layer; The protocol segmentation output module includes a plurality of cascaded fifth convolutional layers; The network structures corresponding to the third convolutional layer, the fourth convolutional layer and the fifth convolutional layer are the same; The output of the fourth convolutional layer of the last decoding unit is used as the input of the protocol segmentation output module.

3. The protocol format segmentation method according to claim 2, characterized in that: The step of inputting the traffic picture to be segmented into a field segmentation model, using the field segmentation model to predict the segmentation position of the traffic picture to be segmented, and outputting each protocol segmentation bit sequence corresponding to the field segmentation position includes: Performing feature extraction on the traffic image to be segmented through the first convolutional layer in the first encoding unit to obtain a coding feature map output by the first convolutional layer in the first encoding unit; Downsampling the coded feature map output by the first coding unit through the downsampling layer in the first coding unit to obtain a downsampled feature map, and using the downsampled feature map as the input of the first convolutional layer in the next coding unit, until the coded feature map output by the first convolutional layer in the last coding unit is obtained; Upsampling and convolution processing are performed on the encoding feature map output by the last encoding unit through the upsampling layer and the second convolution layer in the first decoding unit to obtain a first target processing feature map; Performing feature connection on the first target processing feature map and the encoding feature map output by the encoding unit at the same depth level as the first decoding unit through the feature connection layer in the first decoding unit to obtain a first connection feature map; Performing convolution processing on the first connection feature map through the fourth convolution layer in the first decoding unit to obtain a convolution processing feature map output by the first decoding unit, and using the convolution processing feature map output by the first decoding unit as input to the next decoding unit; Upsampling and convolution processing are performed on the convolution processing feature map through the upsampling layer and the second convolution layer in the next decoding unit to obtain a second target processing feature map; Performing convolution processing on the encoding feature map output by the target encoding unit through a third convolution layer in the target encoding unit to obtain a target feature map having the same size as the second target processing feature map, wherein the target encoding unit is an encoding unit at the same depth level as the next decoding unit; Performing feature connection on the second target processing feature map and the target feature map through a feature connection layer in the next decoding unit to obtain a second connection feature map; Performing convolution processing on the second connection feature map through the fourth convolution layer in the next decoding unit to obtain a convolution processing feature map output by the next decoding unit; Return to the step of upsampling and convolutionally processing the convolution processing feature map through the upsampling layer and the second convolution layer in the next decoding unit to obtain a second target processing feature map, until the convolution processing feature map output by the fourth convolution layer in the last decoding module is obtained; The convolution processing feature map of the last decoding module is input into the protocol segmentation output module to obtain the field segmentation position output by the protocol segmentation output module.

4. The protocol format segmentation method according to claim 1, characterized in that: The field segmentation model is trained based on the following steps: Acquire historical protocol traffic and extract format information of the historical protocol traffic; Based on the format information of the historical protocol traffic, generating multiple protocol traffic images; For each of the protocol traffic images, input the protocol traffic image into a field segmentation model to be trained to obtain a predicted segmentation position output by the field segmentation model to be trained; Calculating a model loss value based on the predicted segmentation position and the field segmentation sequence label in the protocol traffic graph; Based on the model loss value obtained in each iteration, the parameters of the field segmentation model to be trained are updated to obtain the field segmentation model.

5. The protocol format segmentation method according to claim 4, characterized in that: The field determination twin model is trained based on the following steps: For each of the protocol traffic pictures, based on the field segmentation sequence label, each to-be-trained bit sequence is selected in the protocol traffic picture; Inputting each of the to-be-trained bit sequences into the to-be-trained twin model to obtain a category prediction result output by the to-be-trained twin model; Calculate a cross entropy loss value based on the category prediction result and the field segmentation sequence label in the protocol traffic picture; Based on the cross entropy loss value obtained in each iteration, the parameters of the twin model to be trained are updated to obtain the field judgment twin model.

6. The protocol format segmentation method according to claim 4, characterized in that: The format information includes field position and length information, and the format information based on the historical protocol traffic is used to generate multiple protocol traffic pictures, including: Based on the field position and the length information, classify each protocol flow in the historical protocol flow to obtain a protocol flow classification result; In the protocol traffic classification result, each protocol traffic belonging to the same communication session is grouped; Based on the field position and length information of each of the protocol flows, generating a field segmentation sequence label in a binary format; The protocol traffic graph is generated based on each protocol traffic in the same group and its corresponding field segmentation sequence label.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the protocol format segmentation method according to any one of claims 1 to 6 is implemented.

8. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the protocol format segmentation method according to any one of claims 1 to 6 is implemented.

Images