Packet detection method and apparatus

Abstract

The application discloses a message detection method and device, and relates to the technical field of security. A first message is received, and if it is determined to detect the first message, the identification of the first message is written into a first sequence, and the first sequence is used for storing the identification of the message in a message flow carrying the first message. If the number of the identification in the first sequence reaches a first preset value, the probability value of a sequence formed by multiple identifications in the first sequence is determined. The multiple identifications include the identification of the first message, and the multiple identifications are arranged in the first sequence according to the receiving order of the compared messages. The probability value of the sequence is used for representing whether the sequence formed by the multiple identifications is legal. If the probability value of the sequence formed by the multiple identifications is less than a preset value, alarm information indicating that the first message is abnormal is output.

Description

TECHNICAL FIELD

[0001] The present application relates to the security field, and particularly to a message detection method and device. BACKGROUND

[0002] In the industrial control field, such as the power control field, a message flow detection system can detect whether a message conforms to baseline data through baseline technology. If the message does not conform to the baseline data, it means that the message is illegal, and the message flow detection system can generate an alarm at this time.

[0003] Generally, the baseline technology only detects a single message. In some scenarios, multiple messages need to be sent continuously. If a message in the multiple messages is legal, but the sending time of the message has a problem, problems may also occur. For example, if the message needs to be sent after other messages, but is actually sent before the other messages, it may cause device control failure. SUMMARY

[0004] Embodiments of the present application provide a message detection method and device, which can improve the accuracy of message detection.

[0005] To achieve the above purpose, embodiments of the present application adopt the following technical solutions:

[0006] In a first aspect, a message detection method is provided, which includes: receiving a first message, and writing an identifier of the first message into a first sequence in a case where it is determined to detect the first message, the first sequence being used to store identifiers of messages in a message flow carrying the first message. If the number of identifiers in the first sequence reaches a first preset value, a probability value of a sequence formed by multiple identifiers in the first sequence is determined. The multiple identifiers include the identifier of the first message, and the multiple identifiers are arranged in the first sequence according to the receiving order of the compared messages. The probability value of the sequence is used to represent whether the sequence formed by the multiple identifiers is legal. If the probability value of the sequence formed by the multiple identifiers is less than a preset value, alarm information indicating that the first message is abnormal is output.

[0007] Based on the technical solution of the first aspect, when it is determined that the received message belongs to a message flow that needs to be detected, the message can be parsed to obtain the identifier or key field of the message, and the key field of the message is written into the sequence of the message flow. In this way, when the number of key fields in the sequence reaches a preset value, the probability value of the legality of the sequence can be calculated, and when the probability value of the legality of the sequence is less than a threshold value, alarm information for prompting message abnormalities is output. Compared with the single message detection mode, the present application judges whether the message is reasonable according to the probability of the overall appearance of multiple messages, thereby solving the problem that a single message is legal but the sending time is not correct, resulting in control failure. At the same time, the technical solution provided by the present application is not affected by a single message, and the accuracy of message detection is improved.

[0008] In a second aspect, a message detection device is provided, which can include a receiving unit, a processing unit and an output unit. The receiving unit is configured to receive a first message. The processing unit is configured to write an identifier of the first message into a first sequence in a case where it is determined that the first message needs to be detected, the first sequence being used to store identifiers of messages in a message flow carrying the first message. The processing unit is further configured to determine a probability value of a sequence formed by multiple identifiers in the first sequence if the number of identifiers in the first sequence reaches a first preset value. The multiple identifiers include the identifier of the first message, and the multiple identifiers are arranged in the first sequence according to the receiving order of the compared messages. The probability value of the sequence is used to represent whether the sequence formed by the multiple identifiers is legal. The output unit is configured to output alarm information for indicating that the first message is abnormal if the probability value of the sequence formed by the multiple identifiers is less than a preset value.

[0009] In a third aspect, a computer readable storage medium is provided, which stores computer instructions or programs. When the computer instructions or programs are run on a computer, the computer executes the message detection method of the first aspect.

[0010] In a fourth aspect, a message detection device is provided, which includes a processor and a memory. The memory is configured to store one or more programs including computer execution instructions. When the user device is running, the processor executes the computer execution instructions stored in the memory to enable the user device to execute the message detection method of the first aspect.

[0011] In a fifth aspect, a computer program product including instructions is provided. When the instructions are run on a computer, the computer executes the message detection method of the first aspect.

[0012] The message detection device, the computer readable storage medium or the computer program product provided above are all used to execute the corresponding method provided above, and therefore, the beneficial effects that can be achieved are referred to the beneficial effects of the corresponding solutions in the corresponding method provided above, which will not be described herein again. BRIEF DESCRIPTION OF DRAWINGS

[0013] Figure 1 A schematic diagram of a mapping relationship between a natural language and a message execution is provided for an embodiment of the present application;

[0014] Figure 2 A schematic diagram of a control system is provided for an embodiment of the present application;

[0015] Figure 3 A structural schematic diagram of a detection device 300 is provided for an embodiment of the present application;

[0016] Figure 4 A schematic diagram of a learning stage in a message detection method is provided for an embodiment of the present application;

[0017] Figure 5 A schematic diagram of a detection stage in a message detection method is provided for an embodiment of the present application;

[0018] Figure 6 A structural schematic diagram of a detection device 60 is provided for an embodiment of the present application. DETAILED DESCRIPTION

[0019] In order to clearly describe the technical solutions of the embodiments of the present application, in the embodiments of the present application, the same items or similar items with basically the same functions and effects are distinguished by using "first", "second", etc. For example, the first terminal and the second terminal are only used to distinguish different terminals, and do not limit the order. Those skilled in the art can understand that "first", "second", etc. do not limit the quantity and execution order, and "first", "second", etc. also do not necessarily mean different.

[0020] It should be noted that in the present application, "exemplary" or "for example" is used to represent an example, illustration or description. Any embodiment or design scheme described as "exemplary" or "for example" in the present application should not be interpreted as more preferred or more advantageous than other embodiments or design schemes. Rather, the use of "exemplary" or "for example" is intended to present the relevant concept in a specific manner.

[0021] In the present application, "at least one" means one or more, and "multiple" means two or more. The "and / or" describes the association relationship of the associated objects, which means that there can be three relationships, for example, A and / or B, which can represent the following three cases: A exists alone, A and B exist together, and B exists alone, where A and B can be singular or plural. The character " / " generally represents an "or" relationship between the associated objects before and after it. "At least one of the following" or similar expressions means any combination of these items, including any combination of single or multiple items. For example, at least one of a, b, or c can represent a, b, c, a-b, a-c, b-c, or a-b-c, where a, b, and c can be single or multiple. The terms "first", "second", and the like do not limit the quantity and execution order, and the terms "first", "second", and the like do not necessarily mean different.

[0022] Before introducing the embodiments of the present application, some terms related to the embodiments of the present application are explained:

[0023] Language model: is a probability model used to calculate whether a sentence is reasonable. It is commonly used in automatic translation systems, question and answer systems, search engine autocompletion, input method automatic prompt, speech recognition, etc.

[0024] Language models can include rule-based language models and statistical language models. However, the accuracy of rule-based language models is relatively low, so the most commonly used is statistical language models, such as N-Gram.

[0025] N-Gram: referred to as N-gram, is a commonly used model in natural language processing. In neuro-linguistic programming (NLP), based on corpus, N-Gram can be used to judge or evaluate whether a sentence is reasonable. N-Gram is commonly used in language translation, input method prediction, and search engine prediction of input key fields.

[0026] Packet flow: also referred to as flow. The packet flow can be used to carry packets. That is, the packet can be transmitted through the packet flow. For example, the packet flow can include a transmission control protocol (TCP) packet flow, a user datagram protocol (UDP) packet flow, etc.

[0027] The TCP message flow refers to a TCP-based connection and can be determined by a five-tuple. The five-tuple can include a protocol, a source Internet Protocol (IP), a source port, a target IP, and a target port. The UDP message flow refers to UDP interaction of the same four-tuple in proximity.

[0028] Baseline: Also referred to as baseline technology, can be understood as reference data, commonly used in industrial control safety detection systems as a detection means.

[0029] Specifically, the baseline can be divided into a content baseline and an order baseline. The content baseline is a baseline based on the specific content of a protocol. The content can include a five-tuple of a specific protocol message and a protocol specific field value. The order baseline is a baseline established based on the sending order relationship of different types of messages in a protocol.

[0030] In actual application, the baseline technology can include a learning phase (also referred to as baseline learning) and a detection phase (also referred to as baseline detection). The learning phase can refer to a process of generating a baseline by analyzing the message traffic terminal of different protocols. The detection phase can refer to a process of determining whether a message or a message flow carrying the message is legal by comparing the message in the message traffic with the generated baseline.

[0031] For example, a protocol is a language for computer interaction. Therefore, in the learning phase, the message content of the protocol can be learned, and in the detection phase, content baseline matching can be performed by completely matching the content of the protocol.

[0032] In an application scenario, in the industrial control field, the message traffic detection system also includes a learning phase and a detection phase when running. In the learning phase, the message traffic detection system can generate a baseline by learning the messages of the industrial control protocol in the industrial control environment, and in the detection phase, it can be determined whether to generate an alarm by judging whether the messages of the industrial control protocol conform to the baseline generated in the learning phase.

[0033] However, in the case, the baseline technology is generally used to detect the message of an industrial control protocol. If the message conforms to the baseline, but the sending time of the message is not appropriate or the message is sent at an inappropriate time, a problem can also be caused. Inappropriate refers to the order between messages. Since the result of baseline learning in the baseline technology can refer to learning the specific format of a message, which is a static data, the result cannot determine whether the sending time of the message is appropriate.

[0034] In order to determine whether the message is legal, the following way one and way two can be used to solve the problem.

[0035] Way one, content baseline based on content.

[0036] The content baseline is used to determine the baseline of individual messages, but it does not take into account the relationships between messages. Furthermore, the content baseline should cover as many messages as possible, thus requiring a relatively long learning time. If the learning time is too short, it may generate a large number of useless alarms.

[0037] Method 2: Order baseline based on the value and order of key fields.

[0038] This method saves the order of key fields of multiple messages during the learning phase and uses this order as a baseline. During the detection phase, the order of messages can be determined based on the values ​​of their key fields, thus determining whether to generate an alarm. However, if a small number of illegal messages are learned during the learning phase, no alarm will be generated during the detection phase because this method matches messages based on their key field values.

[0039] Therefore, this application adopts the ordered baseline approach of the N-Gram model. During the learning phase, the key field values ​​of the messages are used as Gram, and multiple messages are grouped into a "sentence," thus learning baseline data. During the detection phase, the N-Gram model is used to determine whether this "sentence" is reasonable. If it is unreasonable, an alarm is generated.

[0040] The N-Gram model can calculate whether a message is reasonable based on the probability of its occurrence with the messages preceding it, and thus determine whether to generate an alarm.

[0041] For example, such as Figure 1 The diagram illustrates the mapping relationship between natural language and a message order composed of multiple messages. Key fields in a message can be viewed as grams in natural language, and the message order can be considered a sentence. Just as a sentence's validity can be determined based on a natural language feature library, the validity of a message order composed of multiple messages can be determined based on a message feature library.

[0042] This method is not affected by the learning and writing stage, nor by a single illegal message, thus providing accurate alarms.

[0043] In one example, the order in which messages are sent can be used to determine if a message is problematic. For instance, message A is valid if judged by the content baseline. If the order baseline is used, it is also necessary to check if the message preceding message A is message B. If message B precedes message A, then message A is valid; if message C precedes message A, then message A is invalid.

[0044] First, the method of calculating the probability of judging the rationality of a sentence in N-Gram model is described.

[0045] In an example, a sentence is composed of k words, and the probability of the occurrence of the sentence is p(w1, w2, w3, …, w k ).

[0046] wherein w1, w2, w3, …, w k represent words respectively. k is a positive integer.

[0047] According to the arrangement rule of the words in the sentence, the probability of the occurrence of the sentence can be shown in formula one:

[0048] p(w1, w2, w3, …, w k )=

[0049] p(w1)*p(w2|w1)*p(w3|w1, w2)…*p(w k |w1, w2, …, w k-1 ) formula one

[0050] wherein p(w2|w1), p(w3|w1, w2), …, p(w k |w1, w2, w3, …, w k-1 ) are conditional probabilities. p(w2|w1) represents the probability of the occurrence of w2 after w1 in the sentence. p(w3|w1, w2) represents the probability of the occurrence of w3 after w1 and w2 in the sentence. Similarly, p(w k |w1, w2, …, w k-1 ) represents the probability of the occurrence of w k-1 after w1, w2, …, w k in the sentence.

[0051] Further, according to the maximum likelihood estimation, the following can be obtained:

[0052] p(w2|w1)=count(w1w2) / count(w1),

[0053] p(w3|w1, w2)=count(w1w2w3) / count(w1w2),

[0054] …

[0055] p(w k |w1, w2, …, w k-1 )=count(w1w2w3…w k ) / count(w1w2…w k-1 ).

[0056] where count represents the number of times a word or multiple words appear in the N-Gram model simultaneously.

[0057] It should be noted that when k is large, w1, w2, w3, …, w k The probability of simultaneous occurrence is 0.

[0058] In an example, according to the assumption of Markov chain, the occurrence of a word is only related to the previous n words. Based on this, the probability of the above sentence can be shown as Formula Two.

[0059]

[0060] In an application scenario, taking the order baseline of a TCP message stream or a UDP message stream as an example, M messages in a TCP message stream with a long connection can be taken as a sentence. A message of a certain type in a UDP message stream without a connection can be taken as a starting point, and the subsequent M messages of the type can be taken as a sentence.

[0061] In an example, multiple order baselines can be stored in an order baseline library. For example, according to the assumption of Markov chain, the order baseline of a TCP message stream or a UDP message stream can be stored in the order baseline library. Figure 1 The mapping relationship is shown in the table. Taking 3 messages as an example, the order baseline in the order baseline library can be shown as Table 1.

[0062] Table 1

[0063]

[0064]

[0065] It should be noted that in Table 1, AA, BB, and CC represent the key fields of the message, and 6 order baselines are shown in Table 1. An order baseline includes three key fields, and the order of the three key fields is “first”, “second”, and “third” in Table 1. The number of occurrences represents the number of order baselines. For example, 22 represents that the number of order baselines (AA BB CC) is 22, and 21 represents that the number of order baselines (BB CC AA) is 21.

[0066] The probability of a single message AA, BB can be shown as follows.

[0067] p(AA) = (count(AA) + 1) / (sum() + count(type)),

[0068] p(BB) = (count(BB) + 1) / (sum() + count(type)).

[0069] Wherein, count(AA) represents the number of order baselines including the word AA in the order baseline library, such as the number of order baselines including the word AA in Table 1 is 22+4+3+16=45. sum() represents the total number of messages in the order baseline library, such as the total number of messages in the messages in Table 1 = (22+21+4+3+16+2)*3=204. count(type) represents the number of types of messages in the order baseline library, such as the number of messages including 4 types in Table 1. count(BB) represents the number of order baselines including the word BB in the order baseline library, such as the number of order baselines including the word BB in Table 1 is 22+21+4+3+2=52.

[0070] Based on the data in Table 1, p(AA)≈0.22, p(BB)≈0.25.

[0071] Similarly, the probabilities of messages CC and DD can be calculated according to the calculation method of messages AA and BB, which will not be described here.

[0072] In an example, the TCP message flow includes M messages (i.e., M messages constitute a sentence), and the process of determining the legality of the sentence is as follows:

[0073] Example 1, the sentence S1 composed of multiple messages is AA BB CC AA BB CC DD.

[0074] Based on the above calculation method of the probability of the rationality of the sentence and the data in Table 1, the probability of the legality of the sentence can be shown in Formula Three.

[0075]

[0076] Example 2, the sentence S2 composed of multiple messages is BB CC AA BB CC DD AA.

[0077] Based on the above calculation method of the probability of the rationality of the sentence and the data in Table 1, the probability of the legality of the sentence can be shown in Formula Four.

[0078]

[0079] In combination with the above examples 1 and 2, the message flow detection system can output alarm information for the message flow with a probability lower than the threshold value according to the actual situation in the production process.

[0080] The technical solutions in the embodiments of the present application will be described below in combination with the drawings in the embodiments of the present application.

[0081] As Figure 2As shown in the figure, a structural schematic diagram of a control system provided in an embodiment of the present application is shown. The control system can include a management device 10 and one or more managed devices 20 (only two managed devices are shown in the figure) connected with the management device 10.

[0082] Figure 2 In some embodiments, the one or more managed devices 20 can communicate with the management device 10 in a wired manner (for example, universal serial bus (USB), Type-C, etc.). Of course, the one or more managed devices 20 can also communicate with the management device 10 in a wireless manner. For example, the one or more managed devices 20 communicate with the management device 10 through a network, such as wireless fidelity (WiFi), near field communication (NFC), Bluetooth, etc.

[0083] In some embodiments, the management device 10 can be used to control the managed device according to the received message. For example, the management device can be a controller in an industrial control system. The controller can control the industrial device (i.e., the managed device) in the industrial control system according to the instructions in the message. For example, open the valve, increase the voltage, increase the temperature, etc.

[0084] In some embodiments, the management device 10 can be a computer, a server, an electronic device, etc.

[0085] Figure 2 In some embodiments, the managed device 20 can perform corresponding actions according to the instructions of the management device. For example, the managed device 20 can be an industrial device in an industrial control system, such as a generator in a power system.

[0086] In another embodiment, the management device described above can also detect whether the message is legal. For example, the management device can be configured with a message flow detection system. Based on the message flow detection system, the management device can detect the legality of the received message.

[0087] It should be noted that in the embodiments of the present application, Figure 2 The system shown can be an intranet system. That is, the management device 10 and the managed device 20 can be intranet devices.

[0088] In specific implementation, Figure 2 The management device in the above embodiment can adopt Figure 3 the component structure shown, or include Figure 3 the components shown. Figure 3 A structural schematic diagram of a detection device 300 provided in an embodiment of the present application is shown. The detection device 300 can be a chip or a system on a chip in the management device 10.

[0089] As shown in Figure 3 The detection apparatus 300 comprises a processor 301, a communication interface 302 and a communication line 303.

[0090] Further, the detection apparatus 300 can further comprise a memory 304. The processor 301, the memory 304 and the communication interface 302 can be connected through the communication line 303.

[0091] The processor 301 can be a central processing unit (CPU), a general processor network processor (NP), a digital signal processing (DSP), a microprocessor, a microcontroller, a programmable logic device (PLD) or any combination thereof. The processor 301 can also be other devices with processing function, such as a circuit, a device or a software module, which are not limited herein.

[0092] The communication interface 302 is configured to communicate with other devices or other communication networks. The other communication networks can be an Ethernet, a radio access network (RAN), a wireless local area network (WLAN) or the like. The communication interface 302 can be a module, a circuit, a communication interface or any device capable of realizing communication.

[0093] The communication line 303 is configured to transmit information between components comprised in the detection apparatus 300.

[0094] The memory 304 is configured to store instructions. The instructions can be a computer program.

[0095] The memory 304 can be a read-only memory (ROM) or other type of static storage device that can store static information and / or instructions, a random access memory (RAM) or other type of dynamic storage device that can store information and / or instructions, an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disk storage, a magnetic disk storage or other magnetic storage devices, and the like, without limitation.

[0096] It should be noted that the memory 304 can exist independently of the processor 301, or can be integrated with the processor 301. The memory 304 can be used to store instructions or program codes or some data, etc. The memory 304 can be located in the detection apparatus 300, or can be located outside the detection apparatus 300, without limitation. The processor 301 is configured to execute the instructions stored in the memory 304, so as to implement the message detection method provided by the embodiments described below.

[0097] In an example, the processor 301 can include one or more CPUs, such as the CPU0 and CPU1 in the CPU 100. Figure 2

[0098] As an optional implementation, the detection apparatus 300 includes multiple processors, for example, in addition to the processor 301 in the CPU 100, the detection apparatus 300 can further include a processor 307. Figure 2

[0099] As an optional implementation, the detection apparatus 300 further includes an output device 305 and an input device 306. Exemplarily, the input device 306 is a keyboard, a mouse, a microphone, a joystick, or the like, and the output device 305 is a display screen, a speaker, or the like.

[0100] It should be noted that the detection apparatus 300 can be a desktop computer, a laptop computer, a network server, a mobile phone, a tablet computer, a wireless terminal, an embedded device, a chip system, or a device having a similar structure as shown in the FIG. 100. In addition, the constituent structures shown in the FIG. 100 do not constitute a limitation on the terminal device, and the terminal device can include more or fewer components than those shown in the FIG. 100, or combine certain components, or have a different arrangement of components. Figure 3 Figure 3 It should be noted that the detection apparatus 300 can be a desktop computer, a laptop computer, a network server, a mobile phone, a tablet computer, a wireless terminal, an embedded device, a chip system, or a device having a similar structure as shown in the FIG. 100. In addition, the constituent structures shown in the FIG. 100 do not constitute a limitation on the terminal device, and the terminal device can include more or fewer components than those shown in the FIG. 100, or combine certain components, or have a different arrangement of components. Figure 3 It should be noted that the detection apparatus 300 can be a desktop computer, a laptop computer, a network server, a mobile phone, a tablet computer, a wireless terminal, an embedded device, a chip system, or a device having a similar structure as shown in the FIG. 100. In addition, the constituent structures shown in the FIG. 100 do not constitute a limitation on the terminal device, and the terminal device can include more or fewer components than those shown in the FIG. 100, or combine certain components, or have a different arrangement of components.​​​

[0101] In the embodiments of the present application, the chip system can be composed of a chip, or can include a chip and other discrete devices.

[0102] In addition, the actions, terms and the like involved among the embodiments of the present application can be mutually referenced and are not limited. The message name or the parameter name in the message exchanged between the devices in the embodiments of the present application is only an example, and other names can also be used in the specific implementation, which is not limited.

[0103] The message detection method provided by the embodiments of the present application will be described below in combination with the system shown in Figure 2 Among them, the actions, terms and the like involved among the embodiments of the present application can be mutually referenced and are not limited. The message name or the parameter name in the message exchanged between the devices in the embodiments of the present application is only an example, and other names can also be used in the specific implementation, which is not limited. The actions involved in the embodiments of the present application are only an example, and other names can also be used in the specific implementation, for example, “carried on” described in the embodiments of the present application can be replaced by “included in” or “carried in” and the like.

[0104] The message detection method provided by the embodiments of the present application can include a “learning phase” and a “detection phase”. Specifically, the “learning phase” can refer to the embodiments shown in Figure 4 The “detection phase” can refer to the embodiments shown in Figure 5 .

[0105] The “learning phase” and the “detection phase” will be described below respectively.

[0106] I. Learning phase

[0107] As shown in Figure 4 , the “learning phase” can specifically include S401-S405.

[0108] S401, receiving a message.

[0109] The message can be carried in a message flow. The message flow can be a TCP message flow or a UDP message flow.

[0110] In an example, in combination with the system shown in Figure 2 , the management device can receive the message from other devices. The other devices can be devices in an internal network or devices in an external network.

[0111] S402, detecting whether the message flow carrying the message needs to be learned.

[0112] The determining whether the message flow needs to be learned can indicate whether an order baseline in the message flow is determined. If it is determined that the message flow needs to be learned, the message can be parsed to obtain a key field in the message. If it is determined that the message flow does not need to be learned, the message can be detected.

[0113] In a possible implementation, the management device can determine, according to the identifier of the message flow, whether the message flow needs to be learned.

[0114] The identifier of the message flow can be a timestamp of the message flow. The timestamp can be a time at which the management device receives the message flow, or a time at which the message flow is generated.

[0115] In an example, the management device can be preconfigured with one or more learning time periods. That is, if a timestamp of a message flow carrying a message is located in a learning time period, the management device can determine to learn the message flow. If the timestamp of the message flow carrying the message is not located in the learning time period, the management device can determine to detect the message flow, or directly control the managed device according to the message, or delete the message.

[0116] In an application scenario, Figure 2 The system shown is an intranet system, and the management device can determine, according to an IP address of the message flow, whether the message flow needs to be learned. For example, if the IP address of the message flow belongs to an IP address of a public network, the message flow does not need to be learned. If the IP address of the message flow does not belong to the IP address of the public network, for example, belongs to an IP address in the intranet system, the message flow needs to be learned.

[0117] In another application scenario, the management device can determine, according to a field in the message used to indicate a function of the message, whether the message flow needs to be learned. The function of the message can be an action indicated by the message. For example, opening a valve, raising a temperature, raising a pressure, and the like.

[0118] S403, if it is determined that the message flow needs to be learned, the received message is parsed to obtain a key field of the message.

[0119] The key field of the message can be used to identify the message. For example, the key field of the message can be a field in the message used to indicate an action. In combination with the message in the industrial control field described above (such as indicating opening a valve, raising a pressure, raising a temperature, and the like), the key field of the message can be a field in the message used to represent opening a valve, raising a pressure, or raising a temperature.

[0120] S404, the key field of the message is written into a sequence corresponding to a message flow to which the message belongs.

[0121] The key field of the message in the sequence can be sorted according to the sending order of the message.

[0122] In an example, the key field of the message in the sequence corresponding to the message stream is (AA-BB). At this time, the management device receives another message carried by the message stream, and the key field of the message is CC. After writing the key field CC of the message into the sequence corresponding to the message stream, a new sequence is obtained, which is AA-BB-CC.

[0123] S405, if the number of key fields in the sequence reaches the preset number, the sequence is stored.

[0124] The preset number can be set as needed, for example, it can be 3, and of course it can also be other values, which are not limited.

[0125] In an example, when the number of key fields in the sequence corresponding to the message stream carrying the message is 3, the sequence can be used as the order baseline, and the sequence is stored in the order baseline library.

[0126] In another example, if the order baseline has been saved in the order baseline library, the number corresponding to the order baseline recorded in the order baseline library can be increased by a preset value (such as 1).

[0127] Further, after storing the order baseline into the order baseline library, an identifier for indicating that there is no need to continue learning can be added to the message stream.

[0128] It should be noted that a message stream can include multiple messages, and when the key fields of the preset number of messages in the message stream are obtained, it means that the message stream has been sufficiently learned, or the preset number of messages can be used to identify the message stream. Therefore, there is no need to learn the messages in the message stream, which reduces the detection pressure of the management device.

[0129] After storing the order baseline into the order baseline library, the above S401-S405 can be executed cyclically.

[0130] Based on Figure 4The technical scheme of the application, after obtaining the packet, first checks whether the packet flow to which the packet belongs needs to be learned. If learning is needed, the packet can be parsed to obtain the key field of the packet, and the key field of the packet is written into a sequence corresponding to the packet flow carrying the packet. Since the key field of the packet can identify the packet, and a preset number of packets can identify a packet flow, therefore, the order baseline formed by the key fields of multiple packets can identify a packet flow, that is, in the embodiment of the application, the packet flow can be sufficiently learned through a preset number of packets, which can increase the learning efficiency of the packet flow compared with learning each packet in the packet flow.

[0131] After introducing the "learning phase", the "detection phase" in the packet detection method is described below.

[0132] II. Detection phase

[0133] As shown in Figure 5 The "detection phase" can specifically include S501-S504.

[0134] S501, receiving a first packet.

[0135] S501 can refer to S401 described above, and will not be described here.

[0136] S502, in the case of determining to detect the first packet, writing the identifier of the first packet into a first sequence.

[0137] The first sequence can be used to store the identifiers of the packets in the packet flow carrying the first packet, or the first sequence corresponds to the packet flow carrying the first packet. Different sequences correspond to different packet flows. In this way, the identifiers of the packets of the same flow can be stored in a packet sequence, which can facilitate subsequent packet detection. In the first sequence, the identifiers of multiple packets can be arranged in the order of reception of the packets.

[0138] In one possible implementation, the management device can determine whether the packet needs to be detected according to the identifier of the packet flow carrying the first packet. The identifier of the packet flow can be the timestamp of the packet flow or the IP address of the packet flow.

[0139] In one example, if the identifier of the packet flow is the timestamp of the packet flow, if the timestamp of the packet flow carrying the first packet is not located in the learning time period, it is determined that the first packet is detected. Of course, the management device can also be configured with one or more detection time periods. If the timestamp of the packet flow carrying the first packet is located in the detection time period, it is determined that the first packet is detected.

[0140] In another example, the identifier of the packet flow is an IP address of the packet flow. If the IP address of the packet flow carrying the first packet is in a preset IP address segment, it is determined to detect the first packet. For example, the preset IP address segment can include IP addresses of public networks.

[0141] In some examples, if the first packet does not have a corresponding sequence, a sequence for storing the identifier of the packet carrying the first packet can be newly created.

[0142] S503, if the number of identifiers in the first sequence reaches a first preset value, the probability value of the sequence formed by the plurality of identifiers in the first sequence is determined.

[0143] The sequence formed by the plurality of identifiers can be understood as a "sentence" formed by the plurality of identifiers. The probability value of the sequence can be used to represent the legitimacy of the sequence.

[0144] In a possible implementation, the management device can divide the first sequence into a plurality of sub-sequences, and calculate a first probability value of each sub-sequence in the plurality of sub-sequences. In this way, the management device can calculate the probability value of the sequence formed by the plurality of identifiers in the first sequence according to the first probability values of the plurality of sub-sequences in the first sequence.

[0145] The sub-sequence can include a first number of adjacent identifiers. For example, the first sequence is AA-BB-CC-AA-DD, and the first number is 3. The plurality of sub-sequences of the first sequence can include sub-sequence (AA-BB-CC), sub-sequence (BB-CC-AA), and sub-sequence (CC-AA-DD). That is, the management device can take the first number as the division granularity, traverse the plurality of identifiers in the first sequence, and obtain the plurality of sub-sequences of the first sequence.

[0146] In an example, the first probability value of the sub-sequence can satisfy formula five.

[0147] P = (countA + 1) / (countB + countC) Formula five

[0148] Wherein, P is the first probability value of the sub-sequence, countA represents the number of the sub-sequence in the order baseline library, countC represents the number of the sequence in the order baseline library except the first identifier in the sub-sequence, the first identifier is the identifier of the packet with the latest receiving time in the sub-sequence, and countC is the sum of the number of the sequences including the plurality of identifiers of the sub-sequence in the order baseline library.

[0149] For example, the sub-sequence is AA-BB-CC, countA represents the number of the sub-sequence (AA-BB-CC) in the order baseline library, and countB represents the number of the sequence (AA BB) in the order baseline library. The first identifier is CC. For example, in combination with Table 1, countA = 22, countB = 22 + 4 = 26, and countC = 22 + 21 + 4 + 3 + 16 + 2 = 68.

[0150] In this way, the management device can calculate the probability value of each sub-sequence in the first sequence. After calculating the probability value of each sub-sequence in the first sequence, the management device can calculate the probability value of the first sequence according to the probability value of each sub-sequence in the first sequence. Specifically, reference can be made to the above formula three or formula four, and no further description is given.

[0151] It should be noted that if the number of identifiers in the first sequence does not reach the first preset value, the second packet can be continuously received, and in the case that the packet stream carrying the second packet is the same as the packet stream carrying the first packet, the second packet is parsed to obtain the identifier of the second packet, and the identifier of the second packet is written into the first sequence. In this way, the cycle is repeated until the number of identifiers in the first sequence is greater than the first preset value.

[0152] S504, if the probability value of the sequence composed of the plurality of identifiers in the first sequence is less than a preset value, outputting an alarm information.

[0153] The preset value can be set as needed, for example, can be 1.1, 1.3, 1.5, 1.7, etc., and is not limited. The alarm information can be used to indicate that the first packet is abnormal.

[0154] In an example, the preset value is 1.7. In combination with the above example 1, the plurality of identifiers in the first sequence is AA-BB-CC-AA-BB-CC-DD, and the corresponding probability value is 1.6337121627434124e-06, which is less than 1.5, indicating that the sequence composed of the plurality of identifiers in the first sequence is not legal. Therefore, the management device can output the alarm information.

[0155] In another example, the preset value is 1.1. In combination with the above example 2, the plurality of identifiers in the first sequence is BB CC AABB CC DD AA, and the corresponding probability value is 1.2238113050104755e-06, which is greater than 1.1, indicating that the sequence composed of the plurality of identifiers in the first sequence is legal. The management device can not output the alarm information, and cyclically execute the above S501-S504.

[0156] Further, when the sequence composed of the plurality of identifiers in the first sequence is legal, an identifier indicating that no detection is required can be added to the packet stream corresponding to the first sequence.

[0157] Based on Figure 5 According to the technical solution, when it is determined that the message flow to which the received message belongs needs to be detected, the message can be parsed to obtain the identifier or key field of the message, and the key field of the message is written into the sequence of the message flow. In this way, when the number of key fields in the sequence reaches a preset value, the probability value of the legality of the sequence can be calculated, and when the probability value of the legality of the sequence is less than a threshold value, alarm information for prompting message abnormalities is output. Compared with the single message detection mode, the present application determines whether the message is reasonable according to the probability of the overall appearance of multiple messages, thereby solving the problem that a single message is legal, but the sending time is not correct, resulting in control failure. At the same time, the technical solution provided by the present application is not affected by a single message, and the accuracy of message detection is improved.

[0158] In some embodiments, in the learning stage, the probability of each message can be calculated. Specifically, the calculation method of the probability of a single message in the method of judging the reasonableness of a sentence can be referred to, and details are not described herein. In this way, in the detection stage, the legality of the message or the flow carrying the message can be judged according to the probability of a single message. For example, the probability of a single message can be calculated according to the ratio of the number of received messages to the total number of messages that have been received.

[0159] The various schemes in the above embodiments of the present application can be combined without contradiction.

[0160] The embodiments of the present application can divide the functional modules or functional units of the Internet of Things device according to the above method examples. For example, each functional module or functional unit can be divided according to each function, or two or more functions can be integrated into one processing module. The above integrated module can be realized in the form of hardware or software functional module or functional unit. In the embodiments of the present application, the division of the module or unit is illustrative, and is only a logical function division. In actual implementation, another division mode can be used.

[0161] In the case of dividing each functional module according to each function, Figure 6 A structural schematic diagram of a detection device 60 is shown, which can be a management device or a chip applied to a management device. The detection device 60 can be used to execute the functions of the management device involved in the above embodiments. Figure 6 The detection device 60 shown can include a receiving unit 601, a processing unit 602, and an output unit 603.

[0162] In an embodiment, the receiving unit 601 is configured to receive a first packet. The processing unit 602 is configured to, in a case where it is determined that the first packet is detected, write an identifier of the first packet into a first sequence, the first sequence being used to store identifiers of packets in a packet flow carrying the first packet. The processing unit 602 is further configured to, if a number of identifiers in the first sequence reaches a first preset value, determine a probability value of a sequence of a plurality of identifiers in the first sequence. The plurality of identifiers include the identifier of the first packet, and the plurality of identifiers are arranged in the first sequence according to a receiving order of the compared packets. The probability value of the sequence is used to represent whether the sequence of the plurality of identifiers is legitimate. The output unit 603 is configured to, if the probability value of the sequence of the plurality of identifiers is less than a preset value, output alarm information indicating that the first packet is abnormal.

[0163] In a possible implementation, the processing unit 602 is specifically configured to: determine a first probability value of each sub-sequence of a plurality of sub-sequences of the first sequence, to obtain a plurality of first probability values; one sub-sequence includes a first number of adjacent identifiers in the first sequence; and calculate the probability value of the first sequence according to the plurality of probability values of the plurality of sub-sequences.

[0164] In a possible implementation, the first probability of the sub-sequence satisfies a preset formula, and the preset formula is:

[0165] P = (countA + 1) / (countB + countC).

[0166] wherein P is the first probability value of the sub-sequence, countA represents a number of sub-sequences in an order baseline library, the order baseline library includes a plurality of sequences, the plurality of sequences include the first sequence and the plurality of sub-sequences of the first sequence, countB represents a number of sequences other than the first identifier in the sub-sequences in the order baseline library, the first identifier is an identifier of a packet with the latest receiving time in the sub-sequence, and countC represents a number of order baselines in the order baseline library.

[0167] In a possible implementation, as shown in Figure 6 the apparatus further includes an obtaining unit 604. The obtaining unit 604 is configured to, in a case where it is determined that the first packet is learned, obtain an identifier of the first packet, and write the identifier of the first packet into a packet sequence corresponding to a packet flow carrying the first packet. The processing unit 602 is further configured to, if a number of identifiers in the packet sequence reaches a second preset value, store the packet sequence into an order baseline library.

[0168] In a possible implementation, the processing unit 602 is further configured to, if the packet sequence is stored in the order baseline library, increase a number of recorded packet sequences in the order baseline library by a preset value.

[0169] In a possible implementation, the processing unit 602 is further configured to, if the number of the identifiers in the first sequence is less than a first preset value, continue to receive a second packet, and write an identifier of the second packet into the first sequence, the second packet belonging to the same packet flow as the first packet.

[0170] The specific implementation of the detection apparatus 60 can refer to the behavior of the management device in the packet detection method shown in Figure 4 and Figure 5 .

[0171] In a possible design, Figure 6 the detection apparatus 60 can further include a storage unit 605. The storage unit 605 is configured to store sequences, program codes and instructions.

[0172] As another possible implementation, Figure 6 the processing unit 602 in the detection apparatus 60 can be replaced by a processor, which can integrate the functions of the processing unit 602. Figure 6 the receiving unit 601 in the detection apparatus 60 can be replaced by a transceiver or a transceiving unit, which can integrate the functions of the receiving unit 601.

[0173] Further, when the processing unit 602 is replaced by a processor and the receiving unit 601 is replaced by a transceiver or a transceiving unit, the detection apparatus 60 involved in the embodiments of the present application can be the apparatus shown in Figure 3 .

[0174] The embodiments of the present application further provide a computer-readable storage medium. All or part of the packet flow in the method embodiments can be instructed by a computer program to be completed by related hardware, and the program can be stored in the computer-readable storage medium. When the program is executed, the packet flow of each method embodiment can be included. The computer-readable storage medium can be an internal storage unit of the detection apparatus (including the data sending end and / or the data receiving end) in any of the foregoing embodiments, for example, a hard disk or a memory of the detection apparatus. The computer-readable storage medium can also be an external storage device of the detection apparatus, for example, a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card and the like. Further, the computer-readable storage medium can include both the internal storage unit and the external storage device of the detection apparatus. The computer-readable storage medium is used to store the computer program and other programs and data required by the detection apparatus. The computer-readable storage medium can also be used to temporarily store data that has been output or will be output.

[0175] It should be noted that the terms "first", "second" and "third" and the like in the description, claims and drawings of the application are used for distinguishing between similar elements and not necessarily for describing a particular sequential or chronological order. It is to be understood that the terms so used are interchangeable under appropriate circumstances and are not intended to limit the application to a single embodiment. Furthermore, the terms "comprise", "include", "contain" and / or "have" and variations thereof, when used in this description and / or in the claims, are intended to cover a non-exclusive inclusion such that determinations of equivalence of compositions are made not only by the presence of the recited elements, but also by the presence of other elements that are not expressly listed or even inherent to the compositions.

[0176] It should be understood that, in the application, "at least one" refers to one or more, "multiple" refers to two or more, "at least two" refers to two or three and more, and "and / or" is used to describe the association relationship of the associated objects, which means that there can be three relationships, for example, "A and / or B" can represent three cases of only A, only B and A and B existing at the same time, wherein A and B can be singular or plural. The character " / " generally represents an "or" relationship between the front and rear associated objects. "At least one of the following" or similar expressions means any combination of these items, including any combination of single or multiple items. For example, at least one of a, b or c can represent a, b, c, "a and b", "a and c", "b and c", or "a and b and c", wherein a, b and c can be single or multiple.

[0177] Through the description of the above embodiments, those skilled in the art can clearly understand that, for the convenience and brevity of description, only the above division of functional modules is taken as an example, and in actual application, the above functions can be completed by different functional modules according to needs, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above.

[0178] In several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only illustrative, for example, the division of the modules or units is only a logical function division, and actual implementation can have another division manner, for example, a plurality of units or components can be combined or integrated into another device, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the displayed or discussed each other can be through some interface, indirect coupling or communication connection between devices or units, which can be electrical, mechanical or other forms.

[0179] The units described as separate components may or may not be physically separate, and the components displayed as units may be a physical unit or multiple physical units, that is, may be located in one place, or also can be distributed to multiple different places. Part or all of the units can be selected according to actual needs to achieve the purpose of the embodiment of the present application.

[0180] In addition, each functional unit in each embodiment of the present application can be integrated in one processing unit, or each unit can be physically present alone, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or in the form of a software functional unit.

[0181] The integrated unit, if realized in the form of a software functional unit and sold or used as an independent product, can be stored in a readable storage medium. Based on this understanding, the technical solutions of the embodiments of the present application essentially or the part that contributes to the prior art or the whole or part of the technical solutions can be embodied in the form of a software product, which is stored in a storage medium and includes a number of instructions to make a device (which can be a single-chip microcomputer, a chip, etc.) or a processor execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a ROM, a RAM, a magnetic disk or an optical disk and various storage media that can store program codes.

[0182] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto, any change or replacement within the technical scope disclosed in the present application should be covered in the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A method of packet inspection, the method comprising: The method comprises: receiving a first packet; determining whether the first packet needs to be detected according to an identifier of a packet flow carrying the first packet; the identifier of the packet flow comprises a timestamp of the packet flow and an IP address of the packet flow; in a case where it is determined that the first packet needs to be detected, writing an identifier of the first packet into a first sequence; the first sequence is used to store identifiers of packets in the packet flow carrying the first packet; the first sequence corresponds to the packet flow carrying the first packet, and different sequences correspond to different packet flows; if a number of identifiers in the first sequence reaches a first preset value, determining a probability value of a sequence formed by a plurality of identifiers in the first sequence; the plurality of identifiers comprise the identifier of the first packet, and the plurality of identifiers are arranged in the first sequence according to a receiving order of the packets; the probability value is used to represent whether the sequence formed by the plurality of identifiers is legal; if the probability value of the sequence formed by the plurality of identifiers in the first sequence is less than a preset value, outputting alarm information; the alarm information is used to indicate that the first packet is abnormal.

2. The method of claim 1, wherein, The determination of the probability value of the sequence formed by the plurality of identifiers in the first sequence comprises: determining a first probability value of each sub-sequence of the first sequence to obtain a plurality of first probability values; the first sequence comprises a plurality of sub-sequences, and one sub-sequence comprises a first number of adjacent identifiers in the first sequence; calculating the probability value of the first sequence according to the plurality of first probability values.

3. The method of claim 2, wherein, The first probability of the sub-sequence satisfies a preset formula, and the preset formula is: ； wherein, is a first probability value of the sub-sequence, represents a number of the sub-sequence in an order baseline library, the order baseline library comprising a plurality of sequences, the plurality of sequences comprising a first sequence and a plurality of sub-sequences of the first sequence, represents a number of sequences in the sub-sequence except for a first identifier in the order baseline library, the first identifier being an identifier of a message with a latest receiving time in the sub-sequence, represents a number of order baselines in the order baseline library.

4. The method according to any one of claims 1 to 3, characterized in that, The method further comprises: in a case where it is determined that the first packet needs to be learned, obtaining the identifier of the first packet, and writing the identifier of the first packet into a packet sequence corresponding to the packet flow carrying the first packet; if a number of identifiers in the packet sequence reaches a second preset value, storing the packet sequence into a sequence baseline library.

5. The method of claim 4, wherein, The method further comprises: if the packet sequence is stored in the sequence baseline library, increasing a number of the packet sequence recorded in the sequence baseline library by a preset value.

6. The method of claim 1, wherein, The method further comprises: if a number of identifiers in the first sequence is less than the first preset value, continuing to receive a second packet, and writing an identifier of the second packet into the first sequence; the second packet belongs to the same packet flow as the first packet.

7. A packet inspection apparatus, characterized by comprising: The apparatus comprises: a receiving unit configured to receive a first packet; a processing unit configured to determine whether the first packet needs to be detected according to an identifier of a packet flow carrying the first packet; the identifier of the packet flow comprises a timestamp of the packet flow and an IP address of the packet flow; the processing unit is further configured to, in a case where it is determined that the first packet needs to be detected, write an identifier of the first packet into a first sequence; the first sequence is used to store identifiers of packets in the packet flow carrying the first packet; the first sequence corresponds to the packet flow carrying the first packet, and different sequences correspond to different packet flows; The processing unit is further configured to determine a probability value of a sequence formed by the plurality of identifiers in the first sequence if a number of identifiers in the first sequence reaches a first preset value, the plurality of identifiers including the identifier of the first packet, the plurality of identifiers being arranged in the first sequence according to a receiving order of the packets, the probability value being used to represent whether the sequence formed by the plurality of identifiers is legal. The output unit is configured to output an alarm information if the probability value of the sequence formed by the plurality of identifiers in the first sequence is less than a preset value, the alarm information being used to indicate that the first packet is abnormal.

8. The apparatus of claim 7, wherein, The processing unit is specifically configured to: determine a first probability value of each sub-sequence of the first sequence to obtain a plurality of first probability values, the first sequence including a plurality of sub-sequences, one sub-sequence including a first number of adjacent identifiers in the first sequence; calculate the probability value of the first sequence according to the plurality of first probability values.

9. The apparatus of claim 8, wherein, The first probability of the sub-sequence satisfies a preset formula, and the preset formula is: ； wherein, is a first probability value of the sub-sequence, represents a number of the sub-sequence in an order baseline library, the order baseline library comprising a plurality of sequences, the plurality of sequences comprising a first sequence and a plurality of sub-sequences of the first sequence, represents a number of sequences in the sub-sequence except for a first identification in the order baseline library, the first identification being an identification of a message with a latest receiving time in the sub-sequence, represents a number of order baselines in the order baseline library.

10. The device of any of claims 7-9, wherein, The device further includes: The obtaining unit is configured to, in a case where it is determined to learn the first packet, obtain the identifier of the first packet and write the identifier of the first packet into a packet sequence corresponding to a packet flow carrying the first packet; The processing unit is further configured to store the packet sequence into a rank order baseline library if a number of identifiers in the packet sequence reaches a second preset value.

11. The device of claim 10, wherein: The processing unit is further configured to increase a number of the packet sequences recorded in the rank order baseline library by a preset value if the packet sequence is stored in the rank order baseline library.

12. The device of claim 7, wherein: The receiving unit is further configured to continue to receive a second packet and write an identifier of the second packet into the first sequence if a number of identifiers in the first sequence is less than the first preset value, the second packet belonging to a same packet flow as the first packet.

13. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer instructions or programs, when the computer instructions or programs are run on a computer, causing the computer to execute the packet detection method of any one of claims 1-6.

14. A terminal device, comprising: including: a processor and a memory; wherein the memory is configured to store one or more programs, the one or more programs including computer execution instructions, when the terminal device is running, the processor executes the computer execution instructions stored in the memory, so that the terminal device executes the packet detection method of any one of claims 1-6.

Images