Object-oriented protocol consistency problem positioning test method and system

Abstract

The application discloses an object-oriented protocol consistency problem positioning test method and system, and the method comprises the following steps: collecting interactive communication messages generated by a power utilization information collection system as original sample data to form an original sample library; reading original sample data from the original sample library, performing data standardization processing on the original sample data to form standard data; based on a large amount of historical standard data records, forming a standard sample library taking standard data containing all characteristic factors of the messages as training samples, and performing model training on the training samples according to a machine learning algorithm to determine a prediction model; inputting a to-be-detected sample into the prediction model to perform abnormality detection, and outputting a detection result.

Description

Technical Field

[0001] This invention relates to the field of data mining technology, and more specifically, to a method and system for locating and testing object-oriented protocol consistency issues. Background Technology

[0002] With the release and widespread application of the "DL\T-698.45 Object-Oriented Electricity Information Data Exchange Protocol," its high development flexibility and scalability have significantly reduced the system development and maintenance costs of electricity information acquisition systems and equipment. However, the drawbacks of this high flexibility are also obvious. Given the widespread adoption of the protocol, many manufacturers have their own unique interpretations of the descriptions of certain object attributes or methods. This leads to inconsistencies in the communication messages used by devices operating within the same electricity information acquisition system, resulting in incompatibility between devices from different manufacturers, reduced communication efficiency of the electricity information acquisition system, and increased development costs for manufacturers. Therefore, there is an urgent need for a protocol consistency evaluation rule that conforms to mainstream standards.

[0003] Current methods for protocol consistency testing of electricity information collection equipment specify concrete test content and rigorously compare the data types and values ​​returned to determine whether the equipment conforms to the protocol consistency specifications. This testing method has significant limitations. First, its test cases are fixed, making them difficult to extend and easily optimized by equipment manufacturers to pass the test. Second, its coverage is insufficient; the specified test content cannot encompass all real-world usage scenarios, failing to meet the requirements of massive amounts of data. Third, the testing rules may not align with mainstream understanding; limitations in the business knowledge of the testing software developers can lead to inaccurate testing rules. Summary of the Invention

[0004] According to the present invention, a method and system are provided to address the technical problem that current methods for detecting protocol consistency in electricity information collection equipment involve specifying specific test content and rigorously comparing the data type and value of the returned data to determine whether the equipment conforms to the protocol consistency specification. This testing method has significant limitations.

[0005] According to a first aspect of the present invention, a method for locating and testing object-oriented protocol consistency issues is provided, comprising:

[0006] The interactive communication messages generated by the electricity information collection system are collected as raw sample data to form a raw sample library;

[0007] Original sample data is read from the original sample library, and the original sample data is standardized to form standard data.

[0008] Based on massive historical standard data records, a standard sample library is formed, which uses standard data containing all feature factors of the message as training samples. The training samples are then used to train a model based on machine learning algorithms to determine the prediction model.

[0009] The sample to be detected is input into the prediction model for anomaly detection, and the detection result is output.

[0010] Optionally, the original sample data is subjected to data standardization processing to form standard data, including:

[0011] The original sample data is subjected to data standardization processing, and the frame structure of the message is divided into parameter units of the attributes or methods of a certain object according to predetermined rules;

[0012] Based on the data type of the parameter unit, the feature factors of the parameter unit are generated, and all feature factors are serialized to form standard data.

[0013] Optionally, the frame structure of the message is divided into parameter units of an object's attributes or methods according to predetermined rules, including:

[0014] The message is divided into start character, length field, control field, address field, frame header checksum, link user data, frame checksum, end character, and parameter unit that determines the attribute or method of a certain object according to the predetermined rules.

[0015] Optionally, feature factors for the parameter unit are generated based on the data type of the parameter unit, and all feature factors are serialized to form standard data, including:

[0016] Determine whether the parameter unit conforms to the predetermined specification. If the parameter unit conforms to the predetermined specification, generate the feature factor of the parameter unit. If the parameter unit does not conform to the predetermined specification, determine that the message is abnormal sample data and discard it.

[0017] After the feature factors are extracted from the raw data, a standard data stream is formed in a decision tree manner according to the parsing structure of the message.

[0018] Optionally, the sample to be detected is input into the prediction model for anomaly detection, and the detection results are output, including:

[0019] The sample to be detected is input into the prediction model for anomaly detection, and the probability distribution of the sample to be detected belonging to each category is determined.

[0020] If the probability distribution of no arbitrary category is greater than the specified threshold, the sample data to be detected is determined to be abnormal and does not conform to the protocol consistency rules.

[0021] If the probability distribution of a certain category is greater than a specified threshold, then the sample data to be detected can be determined to conform to a sub-category of the protocol consistency rules.

[0022] According to another aspect of the present invention, an object-oriented protocol consistency problem localization and testing system is also provided, comprising:

[0023] The module for forming the original sample library is used to collect interactive communication messages generated by the electricity information collection system as original sample data to form the original sample library;

[0024] A standard data module is formed, which is used to read raw sample data from the raw sample library, perform data standardization processing on the raw sample data, and form standard data.

[0025] The prediction model determination module is used to form a standard sample library based on massive historical standard data records, with standard data containing all feature factors of the message as training samples, and to train the model on the training samples according to machine learning algorithms to determine the prediction model.

[0026] The output detection result module is used to input the sample to be detected into the prediction model for anomaly detection and output the detection result.

[0027] Optionally, a standard data module is formed, including:

[0028] The data is divided into parameter unit sub-modules, which are used to perform data standardization processing on the original sample data and divide the frame structure of the message into parameter units of the attributes or methods of a certain object according to predetermined rules.

[0029] A standard data submodule is formed, which is used to generate the feature factors of the parameter unit according to the data type of the parameter unit, and serialize all the feature factors to form standard data.

[0030] Optionally, it is divided into parameter unit sub-modules, including:

[0031] The parameter determination unit is used to divide a message into start character, length field, control field, address field, frame header checksum, link user data, frame checksum, and end character according to predetermined rules, and to determine the parameter unit of an object's attributes or methods.

[0032] Optionally, a standard data submodule is formed, including:

[0033] The parameter determination unit is used to determine whether the parameter unit conforms to the predetermined specification. If the parameter unit conforms to the predetermined specification, the feature factor of the parameter unit is generated. If the parameter unit does not conform to the predetermined specification, the message is determined to be abnormal sample data and discarded.

[0034] Standard data stream units are formed to create standard data streams in a decision tree manner, following the parsing structure of the message, after the feature factors of the original data have been extracted.

[0035] Optionally, the output detection result module includes:

[0036] The probability distribution determination submodule is used to input the sample to be detected into the prediction model for anomaly detection and determine the probability distribution of the sample to be detected belonging to each category.

[0037] The consistency determination submodule is used to determine that the sample data to be tested is abnormal and does not conform to the protocol consistency rules when the probability distribution of no arbitrary classification category is greater than a specified threshold.

[0038] The consistency determination submodule is used to determine that if the probability distribution of a certain category is greater than a specified threshold, the sample data to be detected conforms to a sub-category of the protocol consistency rules.

[0039] Therefore, by using an existing sample database for baseline learning, an optimized prediction model is trained. This model can predict whether any sample with a similar structure to those in the sample database conforms to the rules. If expansion is needed, only the sample database for the corresponding category needs to be added and retrained, without modifying the software itself, demonstrating high scalability. The detection data comes from the interaction messages of daily device operation, greatly encompassing the application conditions of devices in various scenarios, improving test coverage and meeting the requirements of massive message data in daily use. The message sample database of this detection method comes from actual interaction scenarios in the user acquisition system, including numerous terminal manufacturers, ensuring sufficient richness and randomness of the samples. The analysis and prediction model trained using this sample database is sufficiently typical and can represent the mainstream understanding methods of many manufacturers. Attached Figure Description

[0040] Exemplary embodiments of the present invention can be more fully understood by referring to the following figures:

[0041] Figure 1 This is a flowchart illustrating a method for locating and testing object-oriented protocol consistency issues as described in this embodiment.

[0042] Figure 2 This is a schematic diagram of the data standardization model described in this embodiment;

[0043] Figure 3 This is a schematic diagram of the data serialization described in this embodiment;

[0044] Figure 4This is a schematic diagram of an object-oriented protocol consistency problem localization and testing system described in this embodiment. Detailed Implementation

[0045] Exemplary embodiments of the invention will now be described with reference to the accompanying drawings. However, the invention may be embodied in many different forms and is not limited to the embodiments described herein. These embodiments are provided to fully and completely disclose the invention and to fully convey its scope to those skilled in the art. The terminology used in the exemplary embodiments illustrated in the drawings is not intended to limit the invention. In the drawings, the same units / elements are referred to by the same reference numerals.

[0046] Unless otherwise stated, the terms used herein (including technical terms) have their common meaning as understood by one of ordinary skill in the art. Furthermore, it is understood that terms defined in commonly used dictionaries should be understood to have a meaning consistent with the context of their relevant field, and not to be interpreted as having an idealized or overly formal meaning.

[0047] According to a first aspect of the present invention, a test method 100 for locating object-oriented protocol consistency problems is provided, with reference to... Figure 1 As shown, the method 100 includes:

[0048] S101: Collect the interactive communication messages generated by the electricity information collection system as raw sample data to form a raw sample library;

[0049] S102: Read the original sample data from the original sample library, and perform data standardization processing on the original sample data to form standard data;

[0050] S103: Based on massive historical standard data records, a standard sample library is formed with standard data containing all feature factors of the message as training samples, and the training samples are used to train the model according to the machine learning algorithm to determine the prediction model.

[0051] S104: Input the sample to be detected into the prediction model for anomaly detection and output the detection result.

[0052] Specifically, including:

[0053] S1: Data Preparation. A message material library is created by collecting the daily interactive communication messages generated by the electricity consumption information collection system.

[0054] S2: Data Standardization. The original message material library is analyzed and processed. According to the rules agreed upon in the "Protocol", the frame structure of the message is divided into parameter units of the attributes or methods of a certain object. Then, feature factors of each parameter unit are generated according to the data type of each parameter unit to avoid feature loss due to differences in specific data content. Finally, all feature factors are serialized to form standard data.

[0055] S3: Training and Analysis Model. Based on massive historical data records, a training sample library is formed using standard data containing all characteristic factors of the messages as samples. The model is then trained using computer machine learning algorithms.

[0056] S4: Anomaly Data Detection. When there are messages that need to be detected, after the data standardization operation in step S2, a test sample library using standard data as samples is obtained. After inputting into the anomaly detection analysis model, the detection conclusion and the corresponding probability distribution are given.

[0057] Furthermore, the frame structure parsing model for step S2 is shown in Table 1.

[0058] Table 1

[0059]

[0060] According to the protocol, the data can be divided into the start symbol, length field, control field, address field, frame header checksum, link user data, frame checksum, and end symbol. The link user data can be further categorized into different application service types according to the protocol.

[0061] Furthermore, the training model in step S3 is defined as the random forest algorithm in ensemble learning. This is a supervised learning algorithm based on the if-then-else rule, which is highly interpretable and conforms to human intuitive thinking.

[0062] Random forests are based on the decision tree algorithm, a type of algorithm for solving classification problems. It uses a tree structure and employs layer-by-layer reasoning to achieve the final classification. A decision tree consists of the following elements:

[0063] Root node: The entire set containing the samples.

[0064] Internal nodes: corresponding feature attribute tests

[0065] Leaf nodes: represent the outcome of a decision.

[0066] During prediction, a judgment is made at an internal node of the tree using a certain attribute value. The judgment result determines which branch node to proceed to, until a leaf node is reached, yielding the classification result. A random forest consists of many decision trees, which are independent of each other. The final prediction result of a random forest is the mode of the predictions from all the decision trees. Detailed implementation method:

[0068] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. Embodiments:

[0069] S1: As Figure 2 As shown, the software reads the original sample data DA1 from the original sample database. After passing through the data standardization module, the original sample DA1 is parsed into several parameter units PA1…PAn according to the frame structure. The labeling rules of the parameter units follow the abstract syntax of ASN.1, as detailed in GB / T16262.1—2006. Following the abstract syntax rules of ASN.1, the feature factor Tm of the current parameter unit PAm is extracted. Tm is the specific data type of the current parameter unit, and its detailed definition can be found in the data type definition section of the protocol.

[0070] S2: After feature factors are extracted from the original data, data serialization is required. The principle of serialization follows the theoretical decision tree definition of the random forest algorithm, such as... Figure 3 Based on the parsing structure of the messages, a standard data stream is formed in a decision tree manner, as shown in Table 2:

[0071] Table 2

[0072] Feature factor 1 Eigenfactor 2 Eigenfactors… … Feature factor N

[0073] If any parameter unit is detected that does not conform to the "Protocol" specification, the message is judged as abnormal sample data and discarded.

[0074] S3: The model training process can be performed using the sklearn.ensemble.RandomForestRegressor() library in Python. Key performance parameters of the RandomForestRegressor function:

[0075] max_features: The maximum number of features that a single decision tree in a random forest can use.

[0076] n_estimators: The number of decision trees in the random forest.

[0077] min_sample_leaf: Minimum number of samples in a leaf node.

[0078] This function returns a prediction model that has been trained using the training samples.

[0079] S4: Anomaly detection is performed on the test sample data using a predictive model. The predictive model provides an external interface function `predict_proba(testdata)`, which returns a one-dimensional vector representing the probability distribution of `testdata` belonging to each category. If the probability distribution of no category is greater than a specified threshold, the test sample data is determined to be anomaly and does not conform to the protocol consistency rules. If the probability distribution of any category is greater than the specified threshold, the test sample data can be determined to conform to a subclass of the protocol consistency rules.

[0080] Therefore, by using an existing sample database for baseline learning, an optimized prediction model is trained. This model can predict whether any sample with a similar structure to those in the sample database conforms to the rules. If expansion is needed, only the sample database for the corresponding category needs to be added and retrained, without modifying the software itself, demonstrating high scalability. The detection data comes from the interaction messages of daily device operation, greatly encompassing the application conditions of devices in various scenarios, improving test coverage and meeting the requirements of massive message data in daily use. The message sample database of this detection method comes from actual interaction scenarios in the user acquisition system, including numerous terminal manufacturers, ensuring sufficient richness and randomness of the samples. The analysis and prediction model trained using this sample database is sufficiently typical and can represent the mainstream understanding methods of many manufacturers.

[0081] Optionally, the original sample data is subjected to data standardization processing to form standard data, including:

[0082] The original sample data is subjected to data standardization processing, and the frame structure of the message is divided into parameter units of the attributes or methods of a certain object according to predetermined rules;

[0083] Based on the data type of the parameter unit, the feature factors of the parameter unit are generated, and all feature factors are serialized to form standard data.

[0084] Optionally, the frame structure of the message is divided into parameter units of an object's attributes or methods according to predetermined rules, including:

[0085] The message is divided into start character, length field, control field, address field, frame header checksum, link user data, frame checksum, end character, and parameter unit that determines the attribute or method of a certain object according to the predetermined rules.

[0086] Optionally, feature factors for the parameter unit are generated based on the data type of the parameter unit, and all feature factors are serialized to form standard data, including:

[0087] Determine whether the parameter unit conforms to the predetermined specification. If the parameter unit conforms to the predetermined specification, generate the feature factor of the parameter unit. If the parameter unit does not conform to the predetermined specification, determine that the message is abnormal sample data and discard it.

[0088] After the feature factors are extracted from the raw data, a standard data stream is formed in a decision tree manner according to the parsing structure of the message.

[0089] Optionally, the sample to be detected is input into the prediction model for anomaly detection, and the detection results are output, including:

[0090] The sample to be detected is input into the prediction model for anomaly detection, and the probability distribution of the sample to be detected belonging to each category is determined.

[0091] If the probability distribution of no arbitrary category is greater than the specified threshold, the sample data to be detected is determined to be abnormal and does not conform to the protocol consistency rules.

[0092] If the probability distribution of a certain category is greater than a specified threshold, then the sample data to be detected can be determined to conform to a sub-category of the protocol consistency rules.

[0093] Therefore, by using an existing sample database for baseline learning, an optimized prediction model is trained. This model can predict whether any sample with a similar structure to those in the sample database conforms to the rules. If expansion is needed, only the sample database for the corresponding category needs to be added and retrained, without modifying the software itself, demonstrating high scalability. The detection data comes from the interaction messages of daily device operation, greatly encompassing the application conditions of devices in various scenarios, improving test coverage and meeting the requirements of massive message data in daily use. The message sample database of this detection method comes from actual interaction scenarios in the user acquisition system, including numerous terminal manufacturers, ensuring sufficient richness and randomness of the samples. The analysis and prediction model trained using this sample database is sufficiently typical and can represent the mainstream understanding methods of many manufacturers.

[0094] According to another aspect of the present invention, an object-oriented protocol consistency problem localization and testing system 400 is also provided, with reference to... Figure 4 As shown, the system 400 includes:

[0095] The module 410 for forming the original sample library is used to collect the interactive communication messages generated by the electricity information collection system as original sample data to form the original sample library.

[0096] A standard data module 420 is used to read raw sample data from the raw sample library, perform data standardization processing on the raw sample data, and form standard data.

[0097] The prediction model module 430 is used to form a standard sample library based on massive historical standard data records, with standard data containing all feature factors of the message as training samples, and to train the model on the training samples according to the machine learning algorithm to determine the prediction model.

[0098] The output detection result module 440 is used to input the sample to be detected into the prediction model for anomaly detection and output the detection result.

[0099] Optionally, a standard data module is formed, including:

[0100] The data is divided into parameter unit sub-modules, which are used to perform data standardization processing on the original sample data and divide the frame structure of the message into parameter units of the attributes or methods of a certain object according to predetermined rules.

[0101] A standard data submodule is formed, which is used to generate the feature factors of the parameter unit according to the data type of the parameter unit, and serialize all the feature factors to form standard data.

[0102] Optionally, it is divided into parameter unit sub-modules, including:

[0103] The parameter determination unit is used to divide a message into start character, length field, control field, address field, frame header checksum, link user data, frame checksum, and end character according to predetermined rules, and to determine the parameter unit of an object's attributes or methods.

[0104] Optionally, a standard data submodule is formed, including:

[0105] The parameter determination unit is used to determine whether the parameter unit conforms to the predetermined specification. If the parameter unit conforms to the predetermined specification, the feature factor of the parameter unit is generated. If the parameter unit does not conform to the predetermined specification, the message is determined to be abnormal sample data and discarded.

[0106] Standard data stream units are formed to create standard data streams in a decision tree manner, following the parsing structure of the message, after the feature factors of the original data have been extracted.

[0107] Optionally, the output detection result module includes:

[0108] The probability distribution determination submodule is used to input the sample to be detected into the prediction model for anomaly detection and determine the probability distribution of the sample to be detected belonging to each category.

[0109] The consistency determination submodule is used to determine that the sample data to be tested is abnormal and does not conform to the protocol consistency rules when the probability distribution of no arbitrary classification category is greater than a specified threshold.

[0110] The consistency determination submodule is used to determine that if the probability distribution of a certain category is greater than a specified threshold, the sample data to be detected conforms to a sub-category of the protocol consistency rules.

[0111] The object-oriented protocol consistency problem localization test system 400 of the present invention corresponds to the object-oriented protocol consistency problem localization test method 100 of another embodiment of the present invention, and will not be described again here.

[0112] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code. The solutions in the embodiments of this application can be implemented in various computer languages, such as the object-oriented programming language Java and the interpreted scripting language JavaScript.

[0113] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0114] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0115] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0116] Although preferred embodiments of this application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of this application.

[0117] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A method for locating and testing object-oriented protocol consistency issues, characterized in that, include: The interactive communication messages generated by the electricity information collection system are collected as raw sample data to form a raw sample library; Original sample data is read from the original sample library, and the original sample data is standardized to form standard data. Based on massive historical standard data records, a standard sample library is formed, which uses standard data containing all feature factors of the message as training samples. The training samples are then used to train a model based on machine learning algorithms to determine the prediction model. The sample to be detected is input into the prediction model for anomaly detection, and the detection result is output. The original sample data is standardized to form standard data, including: The original sample data is subjected to data standardization processing, and the frame structure of the message is divided into parameter units of the attributes or methods of a certain object according to predetermined rules; Based on the data type of the parameter unit, the feature factors of the parameter unit are generated, and all feature factors are serialized to form standard data. The sample to be detected is input into the prediction model for anomaly detection, and the detection results are output, including: The sample to be detected is input into the prediction model for anomaly detection, and the probability distribution of the sample to be detected belonging to each category is determined. If the probability distribution of no arbitrary category is greater than the specified threshold, the sample data to be detected is determined to be abnormal and does not conform to the protocol consistency rules. If the probability distribution of a certain category is greater than a specified threshold, then the sample data to be detected can be determined to conform to a sub-category of the protocol consistency rules.

2. The method according to claim 1, characterized in that, The message frame structure is divided into parameter units of an object's attributes or methods according to predetermined rules, including: The message is divided into start character, length field, control field, address field, frame header checksum, link user data, frame checksum, end character, and parameter unit that determines the attribute or method of a certain object according to the predetermined rules.

3. The method according to claim 1, characterized in that, Based on the data type of the parameter unit, the feature factors of that parameter unit are generated. All feature factors are then serialized to form standard data, including: Determine whether the parameter unit conforms to the predetermined specification. If the parameter unit conforms to the predetermined specification, generate the feature factor of the parameter unit. If the parameter unit does not conform to the predetermined specification, determine that the message is abnormal sample data and discard it. After the feature factors are extracted from the raw data, a standard data stream is formed in a decision tree manner according to the parsing structure of the message.

4. An object-oriented protocol consistency problem localization and testing system, characterized in that, include: The module for forming the original sample library is used to collect interactive communication messages generated by the electricity information collection system as original sample data to form the original sample library; A standard data module is formed, which is used to read raw sample data from the raw sample library, perform data standardization processing on the raw sample data, and form standard data. The prediction model determination module is used to form a standard sample library based on massive historical standard data records, with standard data containing all feature factors of the message as training samples, and to train the model on the training samples according to machine learning algorithms to determine the prediction model. The output detection result module is used to input the sample to be detected into the prediction model for anomaly detection and output the detection result; Standard data modules are formed, including: The data is divided into parameter unit sub-modules, which are used to perform data standardization processing on the original sample data and divide the frame structure of the message into parameter units of the attributes or methods of a certain object according to predetermined rules. A standard data submodule is formed, which is used to generate the feature factors of the parameter unit according to the data type of the parameter unit, and serialize all the feature factors to form standard data. The output detection result module includes: The probability distribution determination submodule is used to input the sample to be detected into the prediction model for anomaly detection and determine the probability distribution of the sample to be detected belonging to each category. The consistency determination submodule is used to determine that the sample data to be tested is abnormal and does not conform to the protocol consistency rules when the probability distribution of no arbitrary classification category is greater than a specified threshold. The consistency determination submodule is used to determine that if the probability distribution of a certain category is greater than a specified threshold, the sample data to be detected conforms to a sub-category of the protocol consistency rules.

5. The system according to claim 4, characterized in that, Divided into parameter unit sub-modules, including: The parameter determination unit is used to divide a message into start character, length field, control field, address field, frame header checksum, link user data, frame checksum, and end character according to predetermined rules, and to determine the parameter unit of an object's attributes or methods.

6. The system according to claim 4, characterized in that, The standard data submodules are formed, including: The parameter determination unit is used to determine whether the parameter unit conforms to the predetermined specification. If the parameter unit conforms to the predetermined specification, the feature factor of the parameter unit is generated. If the parameter unit does not conform to the predetermined specification, the message is determined to be abnormal sample data and discarded. Standard data stream units are formed to create standard data streams in a decision tree manner, following the parsing structure of the message, after the feature factors of the original data have been extracted.

Images