Protocol analysis method and device, terminal equipment and storage medium

Abstract

Embodiments of the present application relate to the technical field of Internet of Things, and specifically provide a protocol analysis method and device, a terminal and a storage medium. The method comprises: determining a first target protocol analysis strategy according to a similarity result between target protocol transmission data and a target protocol transmission style; when the similarity result is greater than a preset value, performing protocol analysis on the target protocol transmission data according to the first target protocol analysis strategy to obtain a first protocol analysis result; when the similarity result is less than the preset value, storing the target protocol transmission data in a database for temporary storage, obtaining a data clustering result of the target protocol transmission data in the database, and obtaining a second target protocol analysis strategy according to the data clustering result and performing protocol analysis on the target protocol transmission data to obtain a second protocol analysis result corresponding to the target protocol transmission data. The method can analyze protocol transmission data of Internet of Things devices using different industrial protocols, thereby improving the efficiency of building an Internet of Things platform.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of Internet of Things, and in particular to a protocol analysis method and device, a terminal device and a storage medium. BACKGROUND

[0002] With the development of the Internet of Things, the demand for interconnection of all things is increasing. For a large number of Internet of Things devices and complex Internet of Things scenarios, the advantages and disadvantages of different industrial protocols need to be considered to select multiple different industrial protocols for cooperation, so as to ensure efficient and reliable transmission of data between Internet of Things devices. However, different industrial protocols are not compatible with each other, especially some factories will customize private protocols, which leads to a huge difference in data between different protocols. If various devices are to be connected to the Internet of Things, the Internet of Things needs to adapt to each Internet of Things device with different industrial protocols, which increases the cost and reduces the efficiency of building an Internet of Things platform. SUMMARY

[0003] The main purpose of the embodiments of the present application is to provide a protocol analysis method and device, a terminal device and a storage medium, which aims to solve the problem that the existing Internet of Things devices support different industrial protocols when transmitting data, resulting in a large difference in data format between the transmitted data, and the efficiency of building an Internet of Things platform is low. The protocol analysis method improves the protocol analysis efficiency of the transmitted data of the Internet of Things device, so that the Internet of Things platform can be quickly built, interconnection of all things is realized, and better services are provided for users.

[0004] In a first aspect, the embodiments of the present application provide a protocol analysis method, comprising:

[0005] Constructing a protocol type set, the protocol type set including a protocol type, a target protocol transmission style corresponding to the protocol type, and a protocol analysis strategy corresponding to the protocol type;

[0006] Obtaining target protocol transmission data of an Internet of Things device, calculating the similarity between the target protocol transmission data and the target protocol transmission style, obtaining the similarity result of the target protocol transmission data and the target protocol transmission style, and determining a first target protocol analysis strategy corresponding to the target protocol transmission data according to the similarity result;

[0007] When the similarity result is greater than or equal to a preset value, the target protocol transmission data is protocol-analyzed according to the first target protocol analysis strategy to obtain a first protocol analysis result corresponding to the target protocol transmission data;

[0008] When the similarity result is less than a preset value, the target protocol transmission data is stored in a database for temporary storage, and when an amount of data stored in the database reaches a preset data amount, the target protocol transmission data in the database is subjected to data clustering to obtain a data clustering result of the target protocol transmission data, and protocol analysis is performed according to the data clustering result to obtain a second target protocol analysis strategy corresponding to the target protocol transmission data;

[0009] The target protocol transmission data is subjected to protocol analysis according to the second target protocol analysis strategy to obtain a second protocol analysis result corresponding to the target protocol transmission data.

[0010] In a second aspect, the embodiments of the present application further provide a protocol analysis device, comprising:

[0011] A data construction module is configured to construct a protocol type set, wherein the protocol type set comprises a protocol type, a target protocol transmission style corresponding to the protocol type, and a protocol analysis strategy corresponding to the protocol type.

[0012] A first strategy obtaining module is configured to obtain target protocol transmission data of an Internet of Things device, calculate a similarity between the target protocol transmission data and the target protocol transmission style, obtain a similarity result of the target protocol transmission data and the target protocol transmission style, and determine a first target protocol analysis strategy corresponding to the target protocol transmission data according to the similarity result.

[0013] A first data analysis module is configured to, when the similarity result is greater than or equal to a preset value, perform protocol analysis on the target protocol transmission data according to the first target protocol analysis strategy to obtain a first protocol analysis result corresponding to the target protocol transmission data.

[0014] A second strategy obtaining module is configured to, when the similarity result is less than a preset value, store the target protocol transmission data in a database for temporary storage, and when an amount of data stored in the database reaches a preset data amount, perform data clustering on the target protocol transmission data in the database to obtain a data clustering result of the target protocol transmission data, and perform protocol analysis according to the data clustering result to obtain a second target protocol analysis strategy corresponding to the target protocol transmission data.

[0015] A second data analysis module is configured to perform protocol analysis on the target protocol transmission data according to the second target protocol analysis strategy to obtain a second protocol analysis result corresponding to the target protocol transmission data.

[0016] In a third aspect, the embodiments of the present application further provide a terminal device, which comprises a processor, a memory, a computer program stored in the memory and executable by the processor, and a data bus for realizing connection communication between the processor and the memory, wherein the computer program, when executed by the processor, realizes the steps of any protocol parsing method provided in the specification of the present application.

[0017] In a fourth aspect, the embodiments of the present application further provide a storage medium for computer readable storage, characterized in that the storage medium stores one or more programs, and the one or more programs are executable by one or more processors to realize the steps of any protocol parsing method provided in the specification of the present application.

[0018] The embodiments of the present application provide a protocol parsing method, device, terminal device and storage medium, wherein the method comprises constructing a protocol type set of a known protocol, wherein the protocol type set comprises a protocol type, a target protocol transmission style corresponding to the protocol type and a protocol parsing strategy corresponding to the protocol type; obtaining target protocol transmission data of an Internet of Things device, calculating a similarity between the target protocol transmission data and a target protocol transmission style in the protocol type set, obtaining a similarity result, and obtaining a protocol type according to a target protocol transmission style corresponding to a maximum value of the similarity result, and then determining a first target protocol parsing strategy corresponding to the target protocol transmission data according to the protocol type; when the similarity result is greater than or equal to a preset value, performing protocol parsing on the target protocol transmission data according to the first target protocol parsing strategy to obtain a first protocol parsing result corresponding to the target protocol transmission data; when the similarity result is less than the preset value, storing the target protocol transmission data in a database for temporary storage, and if the amount of data stored in the database reaches a preset data amount, performing data clustering on the target protocol transmission data in the database to obtain a data clustering result of the target protocol transmission data, and then analyzing a protocol parsing rule of the target protocol transmission data in the data clustering result to obtain a second target protocol parsing strategy corresponding to the target protocol transmission data; and performing protocol parsing on the target protocol transmission data according to the second target protocol parsing strategy to obtain a second protocol parsing result corresponding to the target protocol transmission data. Thus, the problem that existing Internet of Things devices support different industrial protocols when transmitting data, resulting in large differences in data formats between the transmitted data and low efficiency of building an Internet of Things platform, is solved, the protocol parsing efficiency of the transmitted data of the Internet of Things device is improved by using the protocol parsing method, so that the Internet of Things platform can be quickly built, the Internet of Things is realized, and better services are provided for users. BRIEF DESCRIPTION OF DRAWINGS

[0019] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings needed to be used in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0020] Figure 1A A schematic diagram of an existing Internet of Things platform provided by an embodiment of the present application is shown in the figure.

[0021] Figure 1B A schematic diagram of an Internet of Things platform built by the present application is provided by an embodiment of the present application.

[0022] Figure 2 A flowchart of a protocol analysis method provided by an embodiment of the present application is shown in the figure.

[0023] Figure 3 A flowchart of obtaining a target analysis classification model in a protocol analysis method provided by an embodiment of the present application is shown in the figure.

[0024] Figure 4 A module structure diagram of a protocol analysis device provided by an embodiment of the present application is shown in the figure.

[0025] Figure 5 A structure schematic block diagram of a terminal device provided by an embodiment of the present application is shown in the figure. DETAILED DESCRIPTION

[0026] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are some embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0027] The flowchart shown in the drawings is only an example description, and it is not necessary to include all the contents and operations / steps, and it is not necessary to execute in the described order. For example, some operations / steps can be decomposed, combined or partially merged, so the actual execution order can be changed according to the actual situation.

[0028] It should be understood that the terms used in the present application specification are only for the purpose of describing specific embodiments and are not intended to limit the present application. As used in the present application specification and the appended claims, unless otherwise clearly indicated by the context, the singular forms "a", "an" and "the" are intended to include the plural forms.

[0029] For a variety of IoT devices and complex IoT scenarios, the advantages and disadvantages of different industrial protocols need to be considered to select multiple different industrial protocols to cooperate, so as to ensure efficient and reliable transmission of data between IoT devices. However, different industrial protocols are not compatible with each other, and some factories customize their own private protocols, which leads to a huge difference in data formats of different protocols. In the traditional way, when various IoT devices want to access the same IoT platform, the IoT platform needs to adapt the protocols one by one for IoT devices of different industrial protocols, which is costly, as shown in Figure 1A .

[0030] Embodiments of the present application provide a protocol analysis method and device, a terminal device and a storage medium. The protocol analysis method can be applied to a terminal device, which can be a tablet computer, a notebook computer, a personal digital assistant, a wearable device or a server. The server can be a standalone server or a server cluster.

[0031] The protocol analysis method provided by the embodiments of the present application includes constructing a protocol type set of known protocols, which includes a protocol type, a target protocol transmission style corresponding to the protocol type, and a protocol analysis strategy corresponding to the protocol type. The target protocol transmission data of an IoT device is obtained, the similarity between the target protocol transmission data and the target protocol transmission style in the protocol type set is calculated, and the similarity result is obtained. The protocol type is obtained according to the target protocol transmission style corresponding to the maximum value of the similarity result, and then the first target protocol analysis strategy corresponding to the target protocol transmission data is determined according to the protocol type. When the similarity result is greater than or equal to a preset value, the target protocol transmission data is protocol-analyzed according to the first target protocol analysis strategy to obtain the first protocol analysis result corresponding to the target protocol transmission data. When the similarity result is less than the preset value, the target protocol transmission data is stored in a database for temporary storage. If the amount of data stored in the database reaches a preset data amount, the target protocol transmission data in the database is data-clustered to obtain a data clustering result of the target protocol transmission data, and then the protocol analysis rule of the target protocol transmission data in the data clustering result is analyzed to obtain a second target protocol analysis strategy corresponding to the target protocol transmission data. The target protocol transmission data is protocol-analyzed according to the second target protocol analysis strategy to obtain a second protocol analysis result corresponding to the target protocol transmission data. Thus, the problem that existing IoT devices support different industrial protocols when transmitting data, resulting in a large difference in data formats between the transmitted data, and the low efficiency of building an IoT platform are solved. The protocol analysis method improves the protocol analysis efficiency of the transmitted data of the IoT device, so that the IoT platform can be quickly built to realize the interconnection of all things, and better services can be provided for users, as shown in Figure 1B .

[0032] Some embodiments of the present application will be described in detail below with reference to the drawings. The following embodiments and features of the embodiments can be combined with each other without conflict.

[0033] Please refer to Figure 2 , Figure 2 A flowchart of a protocol analysis method provided by an embodiment of the present application is shown.

[0034] As Figure 2 shown, the protocol analysis method includes steps S1 to S5.

[0035] Step S1: Construct a protocol type set, which includes protocol types, target protocol transmission styles corresponding to the protocol types, and protocol analysis strategies corresponding to the protocol types.

[0036] Exemplarily, there are various Internet of Things devices, and the industrial protocols of different Internet of Things devices can be different. However, in order to consider the universality of Internet of Things devices, manufacturers sometimes also use common industrial protocols of Internet of Things devices. Therefore, a common industrial protocol can be constructed as a protocol type set. The protocol type set includes protocol types, target protocol transmission styles corresponding to the protocol types, and protocol analysis strategies corresponding to the protocol types, wherein the target protocol transmission style represents the format of the transmission data corresponding to the protocol type, which is used to determine whether the subsequently obtained target protocol transmission data is of the protocol type corresponding to the target protocol transmission style, and the protocol analysis strategy is used to realize the analysis when the subsequently obtained target protocol transmission data is of the protocol type.

[0037] For example, the common industrial protocols of Internet of Things devices at present include OPC UA protocol, MQTT protocol, Modbus protocol, Ethernet / IP protocol, and CAN protocol. Then, the protocol type set is constructed according to the OPC UA protocol, MQTT protocol, Modbus protocol, Ethernet / IP protocol, and CAN protocol. First, the OPC UA protocol, MQTT protocol, Modbus protocol, Ethernet / IP protocol, and CAN protocol are respectively taken as protocol types. Second, the target protocol transmission styles corresponding to the above five protocols are obtained, such as style1, style2, style3, style4, and style5, and the protocol analysis strategies corresponding to the above five protocols are obtained, which are rule1, rule2, rule3, rule4, and rule5, respectively. Finally, the protocol type set can be obtained as {OPC UA protocol: style1, rule1, MQTT protocol: style2, rule2, Modbus protocol: style3, rule3, Ethernet / IP protocol: style4, rule4, CAN protocol: style5, rule5}.

[0038] In step S2, the target protocol transmission data of the Internet of Things device is obtained, the similarity between the target protocol transmission data and the target protocol transmission style is calculated, the similarity result of the target protocol transmission data and the target protocol transmission style is obtained, and the first target protocol analysis strategy corresponding to the target protocol transmission data is determined according to the similarity result.

[0039] For example, the target protocol transmission data sent by the Internet of Things device to the Internet of Things platform is obtained, the target protocol transmission data is selected for features, the main target features corresponding to the target protocol transmission data are obtained, and then the main target features and the target protocol transmission style in the protocol type set are used for similarity calculation, and then the similarity result of the target protocol transmission data and each target protocol transmission style in the protocol type set is determined. The protocol type corresponding to the target protocol transmission style corresponding to the maximum similarity result is obtained as the target protocol type, and then the protocol analysis strategy corresponding to the target protocol type is used as the first target protocol analysis strategy.

[0040] For example, the obtained target protocol transmission data is {“A”:a, “B”:b, “collection time”:February 22, 2022, “D”:none}, which can be obtained by feature selection techniques such as deleting features with missing values or irrelevant features, and then the main target features {“A”:a, “B”:b} are obtained. The main target features and style1, style2, style3, style4, style5 in the above protocol type set {OPC UA protocol: style1, rule1, MQTT protocol: style2, rule2, Modbus protocol: style3, rule3, Ethernet / IP protocol: style4, rule4, CAN protocol: style5, rule5} are calculated respectively. The similarity results s1, s2, s3, s4, s5 are obtained. Then the maximum value of s1, s2, s3, s4, s5 is obtained, assuming that the maximum value is s5, then the first target protocol analysis strategy is rule5 corresponding to the CAN protocol.

[0041] The similarity calculation between the main target features and the target protocol transmission style in the protocol type set can convert the main target features and the target protocol transmission style into corresponding vector transformations, and then calculate the similarity between the vectors. No specific limitation is made here.

[0042] In some implementations, obtaining the target protocol transmission data of the IoT device includes: obtaining the initial protocol transmission data sent by the IoT device, and performing noise removal and data normalization processing on the initial protocol transmission data to obtain the initial protocol transmission data corresponding to the initial protocol transmission data; and performing feature extraction based on the initial protocol transmission data using principal component analysis to obtain the target protocol transmission data corresponding to the initial protocol transmission data.

[0043] For example, in order to reduce the impact of the initial protocol transmission data on the subsequent protocol parsing results, the received initial protocol transmission data is cleaned to remove noise, invalid information, duplicate information, etc., thereby ensuring the accuracy and reliability of the initial protocol transmission data.

[0044] For example, the initial protocol transmission data after cleaning is preprocessed, including data formatting, data transformation, data normalization, and acquisition time normalization. Different processing methods are used for different types of data to obtain the initial protocol transmission data, so that subsequent dimensionality reduction and feature extraction can be more accurate.

[0045] For example, the case of English letters in the initial protocol transmission data is standardized, and punctuation marks in the strings are removed to achieve the purpose of data noise removal and data normalization.

[0046] For example, PCA principal component analysis is used to extract key features from the initial tuning protocol transmission data, transforming the initial tuning protocol transmission data from a high-dimensional space to a low-dimensional space, and then filtering to obtain the main information corresponding to the initial tuning protocol transmission data, thereby using the main information as the target protocol transmission data.

[0047] In some implementations, obtaining target protocol transmission data of IoT devices and calculating the similarity between target protocol transmission data and target protocol transmission style includes: classifying the target protocol transmission data by protocol type using a target parsing classification model to obtain the target protocol type corresponding to the target protocol transmission data; when the target protocol type is a preset protocol type, calculating the similarity between the target protocol transmission data and the target protocol transmission style.

[0048] Exemplarily, the sample data corresponding to the respective type is collected according to the protocol types in the protocol type set, and then a classification model is constructed according to the sample data, wherein the classification categories in the classification model include not only the protocol types in the protocol type set, but also a classification type of unknown or other category. When the target protocol transmission data is obtained, the target protocol type is obtained by performing category classification on the target protocol transmission data by using the classification model. When the target protocol type is a protocol type in the protocol type set, the target protocol transmission data is parsed by using the protocol parsing strategy corresponding to the target protocol type in the protocol type set. When the target protocol type is a preset protocol type, i.e., the preset protocol type is the classification type of unknown or other category, the similarity between the target protocol transmission data and the target protocol transmission style is calculated.

[0049] For example, according to the above-mentioned protocol types in the protocol type set, the protocol types include OPC UA protocol, MQTT protocol, Modbus protocol, Ethernet / IP protocol, and CAN protocol. The classification categories of the classification model include OPC UA protocol, MQTT protocol, Modbus protocol, Ethernet / IP protocol, CAN protocol, and unknown protocol. After the target protocol type is obtained by performing category classification on the target protocol transmission data by using the classification model, if the target protocol type is any one of the OPC UA protocol, MQTT protocol, Modbus protocol, Ethernet / IP protocol, and CAN protocol, the protocol is parsed directly according to the protocol parsing strategy corresponding to the target protocol type in the protocol type set. When the target protocol type is the unknown protocol, the similarity between the target protocol transmission data and the target protocol transmission style is calculated, and then the protocol type closest to the unknown protocol is further determined.

[0050] In some embodiments, as shown in Figure 3 The target parsing classification model includes a feature extraction layer and a type classification layer. The target parsing classification model is obtained by: obtaining training data, wherein the training data includes historical protocol transmission data and real protocol types corresponding to the historical protocol transmission data; determining initial model parameters of an initial parsing classification model, and inputting the historical protocol transmission data into the feature extraction layer to obtain feature vectors corresponding to the historical protocol transmission data; inputting the feature vectors into the type classification layer to obtain predicted protocol types of the historical protocol transmission data; constructing an error function according to the predicted protocol types and the real protocol types; updating the initial model parameters of the initial parsing classification model by iteration through the error function to obtain target model parameters, and determining the target parsing classification model according to the target model parameters.

[0051] Exemplarily, first, a large amount of sample data is collected from known industrial protocols, including data in the case of known protocol types and unknown protocol types, ensuring that the sample data is representative and covers various possible industrial protocol features and scenarios, and then data annotation is performed to determine the real protocol type corresponding to the historical protocol transmission data, and then the historical protocol transmission data is transmitted to the feature extraction layer of the target analysis and classification model to obtain the feature vector corresponding to the historical protocol transmission data, and then the feature vector is input to the type classification layer to obtain the predicted protocol type of the historical protocol transmission data, and then the cross-entropy is used to establish an error function according to the predicted protocol type and the real protocol type, and the initial model parameters of the initial analysis and classification model are continuously updated, and when the error function meets the preset error value, the target model parameters are obtained, and then the initial analysis and classification model corresponding to the target model parameters is used as the target analysis and classification model.

[0052] Optionally, the initial analysis and classification model can also be trained in a data enhancement manner using training data to obtain the target analysis and classification model.

[0053] Optionally, during the training process, the model parameters need to be adjusted to obtain better performance, and K-fold cross-validation can be used, that is, the training set is divided into K parts, K-1 parts are used for training each time, and the remaining part is used for verification. In this way, the performance of the model can be more accurately evaluated to prevent overfitting and underfitting problems.

[0054] In some embodiments, when the target protocol type is a preset protocol type, the similarity between the target protocol transmission data and the target protocol transmission pattern is calculated, including: respectively extracting keywords from the target protocol transmission data and the target protocol transmission pattern to obtain first protocol keywords corresponding to the target protocol transmission data and second protocol keywords corresponding to the target protocol transmission pattern; vector representation is performed on the first protocol keywords and the second protocol keywords to obtain a first feature vector corresponding to the first protocol keywords and a second feature vector corresponding to the second protocol keywords; and the similarity between the target protocol transmission data and the target protocol transmission pattern is calculated according to the first feature vector and the second feature vector.

[0055] Exemplarily, when the target protocol type is the preset protocol type, the keyword extraction technology is utilized to obtain first protocol keywords and second protocol keywords corresponding to the target protocol transmission data and the target protocol transmission style respectively, the first protocol keywords and the second protocol keywords are transmitted to a word vector expression model such as a BERT model (Bidirectional Encoder Representation from Transformers), first feature vectors and second feature vectors corresponding to the first protocol keywords and the second protocol keywords are obtained, and then the cosine similarity is utilized to obtain the similarity between the target protocol transmission data and the target protocol transmission style according to the first feature vectors and the second feature vectors.

[0056] For example, according to the conventional technical means, it is known that English is generally used in the data transmission process, therefore, when the first protocol keywords and the second protocol keywords are converted into the first feature vectors and the second feature vectors, the English word vector expression should be utilized. For example, the BERT model should be obtained by training the English text. When the first protocol keywords and the second protocol keywords are obtained, a plurality of words are included in the first protocol keywords and the second protocol keywords, for example, the first protocol keywords include a1, b1, c1, and the second protocol keywords include a2, b2, c2, and d2, therefore, a1, b1, c1, a2, b2, c2, and d2 are respectively input into the BERT model to obtain corresponding feature vectors Va1, Vb1, Vc1, Va2, Vb2, Vc2, and Vd2. The first feature vector is x*Va1+y*Vb1+z*Vc1, and the second feature vector is u*Va2+v*Vb2+w*Vc2+m*Vd2, wherein x, y, z, u, v, w, and m are weight parameters.

[0057] Step S3: When the similarity result is greater than or equal to the preset value, the target protocol transmission data is parsed according to the first target protocol parsing strategy to obtain a first protocol parsing result corresponding to the target protocol transmission data.

[0058] Exemplarily, when the similarity result is greater than the preset value, it indicates that the target protocol transmission data is more similar to the target protocol transmission style corresponding to the maximum value of the similarity result, that is, it can be represented that the target protocol transmission data can be parsed by the protocol parsing strategy corresponding to the protocol type corresponding to the target protocol transmission style, and the corresponding protocol parsing strategy is taken as the first target protocol parsing strategy. Therefore, the target protocol transmission data is parsed according to the first target protocol parsing strategy to obtain a first protocol parsing result corresponding to the target protocol transmission data.

[0059] For example, after obtaining the target protocol transmission data data, the similarity of data and style1, style2, style3, style4, style5 in the above protocol type set {OPC UA protocol: style1, rule1, MQTT protocol: style2, rule2, Modbus protocol: style3, rule3, Ethernet / IP protocol: style4, rule4, CAN protocol: style5, rule5} is calculated, and the corresponding similarity results s1=0.7, s2=0.6, s3=0.35, s4=0.67, and s5=0.88 are obtained. Further, the maximum value of s1, s2, s3, s4, and s5 is 0.88, and assuming that the preset value is 0.8, the similarity result 0.88 is greater than the preset value 0.8, which meets the condition, so the first target protocol analysis strategy rule5 is used for target protocol transmission data analysis.

[0060] In some embodiments, when the similarity result is greater than or equal to the preset value, the target protocol transmission data is protocol-analyzed according to the first target protocol analysis strategy, and after obtaining the first protocol analysis result corresponding to the target protocol transmission data, it further includes: judging whether the target protocol transmission data meets the analysis requirement according to the first protocol analysis result, and the analysis requirement is used to represent that the target protocol transmission data can be correctly analyzed according to the first target protocol analysis strategy; when the first protocol analysis result does not meet the analysis requirement, the target protocol transmission data is stored in the database for temporary storage.

[0061] For example, when the similarity result is greater than the preset value, the protocol analysis strategy corresponding to the maximum similarity result is used as the first target protocol analysis strategy. When the preset value is small or even if the preset value is set to be large, it cannot be guaranteed that the first target protocol analysis strategy can completely analyze the target protocol transmission data. Therefore, when the first protocol analysis result is obtained, it is necessary to judge whether the target protocol transmission data has been completely analyzed. When the first protocol analysis result cannot correctly represent the target protocol transmission data, it indicates that the first protocol analysis result does not meet the analysis requirement, and then the target protocol transmission data is stored in the database for temporary storage for subsequent analysis.

[0062] For example, before protocol analysis using the first target protocol analysis strategy, the amount of data to be analyzed in the target protocol transmission data is obtained, and then compared with the amount of data obtained by analysis in the first protocol analysis result. When the amount of data to be analyzed and the amount of data obtained by analysis are inconsistent, the target protocol transmission data is stored in the database for temporary storage.

[0063] Step S4: When the similarity result is less than the preset value, the target protocol transmission data is stored in the database for temporary storage, and if the amount of data stored in the database reaches the preset data amount, the target protocol transmission data in the database is subjected to data clustering to obtain a data clustering result of the target protocol transmission data, and the protocol analysis is performed according to the data clustering result to obtain a second target protocol analysis strategy corresponding to the target protocol transmission data.

[0064] Exemplarily, when the similarity result is less than the preset value, it indicates that the target protocol transmission data is not similar to the protocol types in the existing protocol type set, and thus the existing protocol analysis strategy cannot be used for protocol analysis, and the target protocol transmission data is stored in the database. When the amount of data stored in the database reaches the preset data amount, the target protocol transmission data stored in the database is subjected to data clustering to obtain a corresponding clustering result. The relationship analysis is performed according to the class cluster in the clustering result to obtain a protocol analysis strategy corresponding to the class cluster, i.e., the second target protocol analysis strategy.

[0065] For example, when the preset data amount is 100, if the amount of target protocol transmission data with a similarity result less than the preset value stored in the database reaches 100, or if the amount of data obtained by the first protocol analysis result is compared, when the amount of data to be analyzed and the amount of data obtained by the analysis are inconsistent, the sum of the amount of target protocol transmission data stored in the database for temporary storage and the amount of target protocol transmission data with a similarity result less than the preset value stored in the database is the preset data amount, i.e., 100. Then, the 100 pieces of target protocol transmission data in the database are subjected to clustering.

[0066] For example, the 100 pieces of target protocol transmission data in the database are subjected to keyword extraction, and then the keywords are used for clustering to obtain a clustering result. The clustering result includes multiple class clusters, such as a class cluster 1 including 40 pieces of data, a class cluster 2 including 25 pieces of data, and a class cluster 3 including 35 pieces of data. Then, the different class clusters are subjected to protocol analysis to obtain the second target protocol analysis strategies corresponding to the class cluster 1, the class cluster 2, and the class cluster 3, respectively. Then, the target protocol transmission data is subjected to protocol analysis according to the second target protocol analysis strategy corresponding to the class cluster corresponding to the target protocol transmission data.

[0067] The second target protocol analysis strategy corresponding to the class cluster can be obtained by using a relationship extraction method, for example, a relationship extraction model is used to extract triple information in the target protocol transmission data in the class cluster, and the protocol analysis strategy of the target protocol transmission data is determined according to the triple information.

[0068] For example, the target protocol transmission data in the database includes two pieces of data 1: {“name”: “Zhang San”, “gender”: male, “date of birth”: “2022-9-10”} and data 2: {“name”: “Li Si”, “gender”: male, “date of birth”: “2022-9-12”}. Therefore, the relation extraction is performed on data 1 and data 2 respectively to obtain triple information, i.e., data 1: (Zhang San, gender, male), (Zhang San, date of birth, 2022-9-10), and data 2: (Li Si, gender, male), (Li Si, date of birth, 2022-9-12). Therefore, the protocol analysis strategy of the class cluster composed of data 1 and data 2 can be obtained, i.e., extracting the name, gender, and date of birth in the class cluster data.

[0069] In some embodiments, the target protocol transmission data in the database is subjected to data clustering to obtain a data clustering result of the target protocol transmission data, including: obtaining third protocol keywords of the target protocol transmission data by using a TF-IDF model; and performing data clustering according to the third protocol keywords to obtain the data clustering result of the target protocol transmission data.

[0070] For example, the target protocol transmission data is subjected to word segmentation by using a jieba word segmentation technology to obtain segmented word groups, and then meaningless words or punctuation marks in the segmented word groups are removed to obtain keyword groups. The keyword groups are analyzed by using a TF-IDF model to obtain third protocol keywords. The third protocol keywords are subjected to data clustering by using a k-means clustering method, and then the data clustering result of the target protocol transmission data is obtained.

[0071] Optionally, the clustering methods include, but are not limited to, k-means, hierarchical clustering, and DBSCAN clustering.

[0072] Step S5: performing protocol analysis on the target protocol transmission data according to the second target protocol analysis strategy to obtain a second protocol analysis result corresponding to the target protocol transmission data.

[0073] For example, after the second target protocol analysis strategy is obtained, the protocol analysis is performed by using the second target protocol analysis strategy, and then the protocol analysis result of the target protocol transmission data is completed.

[0074] For example, when the data amount reaches 100 in step S4, clustering is performed to obtain class cluster 1: 40 pieces of data, class cluster 2: 25 pieces of data, and class cluster 3: 35 pieces of data. After performing protocol analysis on class cluster 1, class cluster 2, and class cluster 3 respectively, target protocol analysis strategies of class cluster 1, class cluster 2, and class cluster 3 are obtained. Then, the 40 pieces of data in class cluster 1 are analyzed according to the target protocol analysis strategy of class cluster 1, the 25 pieces of data in class cluster 2 are analyzed according to the target protocol analysis strategy of class cluster 2, and the 35 pieces of data in class cluster 3 are analyzed according to the target protocol analysis strategy of class cluster 3. Thus, the protocol analysis result of the target protocol transmission data in the database is obtained.

[0075] In some embodiments, after the target protocol transmission data is analyzed according to the second target protocol analysis strategy to obtain the second protocol analysis result corresponding to the target protocol transmission data, the method further comprises: updating the protocol type set according to the second target protocol analysis strategy to obtain an updated protocol type set, so that the target protocol transmission data is analyzed according to the updated protocol type set.

[0076] For example, after the target protocol analysis strategy corresponding to the class cluster is obtained by clustering analysis on the target protocol transmission data in the database, the target protocol analysis strategy is updated to the protocol type set, so that when the corresponding data is received, the target protocol analysis strategy can be used for protocol analysis, and the protocol type set is constantly improved to improve the efficiency of protocol analysis.

[0077] For example, after the target protocol analysis strategy corresponding to the class cluster is obtained by clustering analysis on the target protocol transmission data in the database, the target protocol analysis strategy is updated to the protocol type set, so that when the corresponding data is received, the target protocol analysis strategy can be used for protocol analysis, and the protocol type set is constantly improved to improve the efficiency of protocol analysis. Figure 4 , Figure 4A protocol analysis device 200 is provided for an embodiment of the present application, and the protocol analysis device 200 comprises a data construction module 201, a first strategy obtaining module 202, a first data analysis module 203, a second strategy obtaining module 204, and a second data analysis module 205. The data construction module 201 is configured to construct a protocol type set, and the protocol type set comprises a protocol type, a target protocol transmission mode corresponding to the protocol type, and a protocol analysis strategy corresponding to the protocol type. The first strategy obtaining module 202 is configured to obtain target protocol transmission data of an Internet of Things device, calculate a similarity between the target protocol transmission data and the target protocol transmission mode, obtain a similarity result of the target protocol transmission data and the target protocol transmission mode, and determine a first target protocol analysis strategy corresponding to the target protocol transmission data according to the similarity result. The first data analysis module 203 is configured to perform protocol analysis on the target protocol transmission data according to the first target protocol analysis strategy when the similarity result is greater than or equal to a preset value, and obtain a first protocol analysis result corresponding to the target protocol transmission data. The second strategy obtaining module 204 is configured to store the target protocol transmission data in a database for temporary storage when the similarity result is less than the preset value, perform data clustering on the target protocol transmission data in the database when a data amount stored in the database reaches a preset data amount, obtain a data clustering result of the target protocol transmission data, and perform protocol analysis and analysis according to the data clustering result, and obtain a second target protocol analysis strategy corresponding to the target protocol transmission data. The second data analysis module 205 is configured to perform protocol analysis on the target protocol transmission data according to the second target protocol analysis strategy, and obtain a second protocol analysis result corresponding to the target protocol transmission data.

[0078] In some embodiments, the first strategy obtaining module 202 performs the following in the process of obtaining the target protocol transmission data of the Internet of Things device:

[0079] obtains initial protocol transmission data sent by the Internet of Things device, removes noise from the initial protocol transmission data, and performs data normalization processing on the initial protocol transmission data to obtain initial protocol transmission data corresponding to the initial protocol transmission data;

[0080] performs feature extraction on the initial protocol transmission data using principal component analysis to obtain target protocol transmission data corresponding to the initial protocol transmission data.

[0081] In some embodiments, the first strategy obtaining module 202 performs the following in the process of obtaining the target protocol transmission data of the Internet of Things device and calculating the similarity between the target protocol transmission data and the target protocol transmission mode:

[0082] The target protocol type corresponding to the target protocol transmission data is obtained by performing protocol type classification on the target protocol transmission data by using a target analysis classification model.

[0083] When the target protocol type is a preset protocol type, a similarity between the target protocol transmission data and the target protocol transmission pattern is calculated.

[0084] In some embodiments, the target analysis classification model includes a feature extraction layer and a type classification layer, and the first strategy obtaining module 202 performs the following steps in obtaining the target analysis classification model:

[0085] obtaining training data, the training data including historical protocol transmission data and real protocol types corresponding to the historical protocol transmission data;

[0086] determining initial model parameters of an initial analysis classification model, and inputting the historical protocol transmission data into the feature extraction layer to obtain feature vectors corresponding to the historical protocol transmission data;

[0087] inputting the feature vectors into the type classification layer to obtain predicted protocol types of the historical protocol transmission data;

[0088] constructing an error function according to the predicted protocol types and the real protocol types;

[0089] updating the initial model parameters of the initial analysis classification model by iteration through the error function to obtain target model parameters, and determining the target analysis classification model according to the target model parameters.

[0090] In some embodiments, the first strategy obtaining module 202 performs the following steps in calculating the similarity between the target protocol transmission data and the target protocol transmission pattern when the target protocol type is a preset protocol type:

[0091] respectively extracting keywords from the target protocol transmission data and the target protocol transmission pattern to obtain first protocol keywords corresponding to the target protocol transmission data and second protocol keywords corresponding to the target protocol transmission pattern;

[0092] vectorizing the first protocol keywords and the second protocol keywords to obtain a first feature vector corresponding to the first protocol keywords and a second feature vector corresponding to the second protocol keywords;

[0093] calculating the similarity between the target protocol transmission data and the target protocol transmission pattern according to the first feature vector and the second feature vector.

[0094] In some embodiments, the first data analysis module 203, in the process after the target protocol transmission data is parsed according to the first target protocol analysis strategy based on the similarity result being greater than or equal to a preset value and a first protocol analysis result corresponding to the target protocol transmission data is obtained, further performs:

[0095] judges whether the target protocol transmission data meets an analysis requirement according to the first protocol analysis result, the analysis requirement being used to represent that the target protocol transmission data can be correctly parsed according to the first target protocol analysis strategy;

[0096] stores the target protocol transmission data into the database for temporary storage when the first protocol analysis result does not meet the analysis requirement.

[0097] In some embodiments, the second strategy obtaining module 204, in the process of data clustering of the target protocol transmission data in the database and obtaining a data clustering result of the target protocol transmission data, further performs:

[0098] obtains a third protocol keyword of the target protocol transmission data by using a TF-IDF model analysis;

[0099] performs data clustering according to the third protocol keyword and obtains the data clustering result of the target protocol transmission data.

[0100] In some embodiments, the second data analysis module 205, in the process after the target protocol transmission data is parsed according to the second target protocol analysis strategy and a second protocol analysis result corresponding to the target protocol transmission data is obtained, further performs:

[0101] updates the protocol type set according to the second target protocol analysis strategy to obtain an updated protocol type set, so that the target protocol transmission data is parsed according to the updated protocol type set.

[0102] In some embodiments, the protocol analysis apparatus 200 is applied to a terminal device.

[0103] It should be noted that, for the convenience and brevity of description, the specific working process of the apparatus described above can refer to the corresponding process in the foregoing protocol analysis method embodiments, which will not be described herein.

[0104] Please refer to Figure 5 , Figure 5 for a structural schematic block diagram of a terminal device provided by the embodiments of the present application.

[0105] As Figure 5As shown, the terminal device 300 includes a processor 301 and a memory 302, which are connected through a bus 303, such as an I2C (Inter-integrated Circuit) bus.

[0106] Specifically, the processor 301 is configured to provide computing and control capabilities to support the operation of the entire server. The processor 301 can be a central processing unit (CPU), and the processor 301 can also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs) or other programmable logic devices, discrete gates or transistor logic components, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor.

[0107] Specifically, the memory 302 can be a Flash chip, a read-only memory (ROM) disk, an optical disk, a U disk, or a mobile hard disk, etc.

[0108] Those skilled in the art can understand that, Figure 5 The structure shown in the figure is only a block diagram of part of the structure related to the embodiments of the present application, and does not constitute a limitation on the terminal device to which the embodiments of the present application are applied. The specific terminal device can include more or fewer components than those shown in the figure, or combine certain components, or have a different component arrangement.

[0109] The processor 301 is configured to run the computer program stored in the memory and implement the protocol analysis method provided by any of the embodiments of the present application when the computer program is executed.

[0110] In some embodiments, the processor 301 is configured to run the computer program stored in the memory, apply to the terminal device, and implement the following steps when the computer program is executed:

[0111] Constructing a protocol type set, the protocol type set including a protocol type, a target protocol transmission style corresponding to the protocol type, and a protocol analysis strategy corresponding to the protocol type;

[0112] obtaining target protocol transmission data of the IoT device, calculating similarity between the target protocol transmission data and the target protocol transmission pattern, and obtaining a similarity result of the target protocol transmission data and the target protocol transmission pattern and determining a first target protocol analysis strategy corresponding to the target protocol transmission data according to the similarity result;

[0113] When the similarity result is greater than or equal to a preset value, performing protocol analysis on the target protocol transmission data according to the first target protocol analysis strategy to obtain a first protocol analysis result corresponding to the target protocol transmission data.

[0114] When the similarity result is less than the preset value, storing the target protocol transmission data in a database for temporary storage, performing data clustering on the target protocol transmission data in the database when a data amount stored in the database reaches a preset data amount to obtain a data clustering result of the target protocol transmission data, and performing protocol analysis according to the data clustering result to obtain a second target protocol analysis strategy corresponding to the target protocol transmission data.

[0115] Performing protocol analysis on the target protocol transmission data according to the second target protocol analysis strategy to obtain a second protocol analysis result corresponding to the target protocol transmission data.

[0116] In some embodiments, the processor 301, in the process of obtaining target protocol transmission data of the IoT device, performs:

[0117] obtaining initial protocol transmission data sent by the IoT device, and performing noise removal and data normalization processing on the initial protocol transmission data to obtain initial protocol transmission data corresponding to the initial protocol transmission data;

[0118] performing feature extraction on the initial protocol transmission data using principal component analysis to obtain target protocol transmission data corresponding to the initial protocol transmission data.

[0119] In some embodiments, the processor 301, in the process of obtaining target protocol transmission data of the IoT device and calculating similarity between the target protocol transmission data and the target protocol transmission pattern, performs:

[0120] performing protocol type classification on the target protocol transmission data using a target analysis classification model to obtain a target protocol type corresponding to the target protocol transmission data;

[0121] When the target protocol type is a preset protocol type, calculating similarity between the target protocol transmission data and the target protocol transmission pattern.

[0122] In some embodiments, the processor 301 performs the following in the process of obtaining the target protocol resolution classification model, when the target protocol resolution classification model comprises a feature extraction layer and a type classification layer:

[0123] obtaining training data, the training data comprising historical protocol transmission data and real protocol types corresponding to the historical protocol transmission data;

[0124] determining initial model parameters of an initial protocol resolution classification model, and inputting the historical protocol transmission data into the feature extraction layer to obtain feature vectors corresponding to the historical protocol transmission data;

[0125] inputting the feature vectors into the type classification layer to obtain predicted protocol types of the historical protocol transmission data;

[0126] constructing an error function according to the predicted protocol types and the real protocol types;

[0127] updating the initial model parameters of the initial protocol resolution classification model iteratively through the error function to obtain target model parameters, and determining the target protocol resolution classification model according to the target model parameters.

[0128] In some embodiments, the processor 301 performs the following in the process of calculating the similarity between the target protocol transmission data and the target protocol transmission pattern when the target protocol type is a preset protocol type:

[0129] performing keyword extraction on the target protocol transmission data and the target protocol transmission pattern respectively to obtain first protocol keywords corresponding to the target protocol transmission data and second protocol keywords corresponding to the target protocol transmission pattern;

[0130] vectorizing the first protocol keywords and the second protocol keywords to obtain a first feature vector corresponding to the first protocol keywords and a second feature vector corresponding to the second protocol keywords;

[0131] calculating the similarity between the target protocol transmission data and the target protocol transmission pattern according to the first feature vector and the second feature vector.

[0132] In some embodiments, the processor 301 performs the following in the process of obtaining the target protocol resolution classification model, when the target protocol resolution classification model comprises a feature extraction layer and a type classification layer:

[0133] determining whether the target protocol transmission data meets the parsing requirement according to the first protocol parsing result, the parsing requirement being used to represent that the target protocol transmission data can be correctly parsed according to the first target protocol parsing strategy;

[0134] storing the target protocol transmission data into the database for temporary storage when the first protocol parsing result does not meet the parsing requirement.

[0135] In some embodiments, the processor 301 performs the following in the process of performing data clustering on the target protocol transmission data in the database and obtaining a data clustering result of the target protocol transmission data:

[0136] obtaining a third protocol keyword of the target protocol transmission data by using a TF-IDF model analysis;

[0137] performing data clustering according to the third protocol keyword to obtain a data clustering result of the target protocol transmission data.

[0138] In some embodiments, the processor 301 performs the following in the process after performing protocol parsing on the target protocol transmission data according to the second target protocol parsing strategy and obtaining a second protocol parsing result corresponding to the target protocol transmission data:

[0139] updating the protocol type set according to the second target protocol parsing strategy to obtain an updated protocol type set, so that the target protocol transmission data is parsed according to the updated protocol type set.

[0140] It should be noted that, for the convenience and brevity of description, the specific working process of the terminal device described above can refer to the corresponding process in the foregoing protocol parsing method embodiments, which will not be described here.

[0141] The embodiments of the present application also provide a storage medium for computer readable storage, the storage medium storing one or more programs, and the one or more programs can be executed by one or more processors to implement the steps of any one of the protocol parsing methods provided by the embodiments of the present application.

[0142] The storage medium can be an internal storage unit of the terminal device, such as a memory of the terminal device. The storage medium can also be an external storage device of the terminal device, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc.

[0143] Those skilled in the art can understand that all or some of the steps in the methods disclosed above and the functional modules / units in the devices can be implemented by software, firmware, hardware, or a combination thereof. In hardware embodiments, the division between the functional modules / units mentioned in the above description does not necessarily correspond to the division of physical components; for example, one physical component can have multiple functions, or one function or step can be performed by several physical components in cooperation. Some or all of the physical components can be implemented as software executed by a processor, such as a central processing unit, a digital signal processor, or a microprocessor, or as hardware, or as an integrated circuit, such as an application-specific integrated circuit. Such software can be distributed on computer-readable media, which can include computer storage media (or non-transitory media) and communication media (or transitory media). As is well known to those skilled in the art, the term computer storage media includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or any other medium which can be used to store the desired information and which can be accessed by a computer. In addition, it is well known to those skilled in the art that communication media typically embodies computer readable instructions, data structures, program modules or other data in a modulated data signal such as a carrier wave or other transport mechanism and can include any information delivery media.

[0144] It should be understood that the term "and / or" as used herein refers to any combination of associated listed items, and all possible combinations, and includes these combinations. It should be noted that the terms "comprising", "including", or any other variant thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article or system that comprises a list of elements does not include only those elements, but can also include other elements not expressly listed or inherent to such process, method, article or system. Without more limitations, an element defined by the phrase "comprising a" does not exclude the presence of additional identical elements in the process, method, article or system including the element.

[0145] The above sequence numbers of the embodiments of the present application are only for description, and do not represent advantages or disadvantages of the embodiments. The above are only specific embodiments of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art can easily think of various equivalent modifications or replacements within the technical range disclosed by the present application, and these modifications or replacements should be covered in the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A protocol parsing method, characterized by, The method comprises: constructing a protocol type set, the protocol type set comprising a protocol type, a target protocol transmission pattern corresponding to the protocol type, and a protocol resolution strategy corresponding to the protocol type; obtaining target protocol transmission data of an Internet of Things device, calculating a similarity between the target protocol transmission data and the target protocol transmission pattern, and obtaining a similarity result of the target protocol transmission data and the target protocol transmission pattern and a first target protocol resolution strategy corresponding to the target protocol transmission data according to the similarity result; when the similarity result is greater than or equal to a preset value, performing protocol resolution on the target protocol transmission data according to the first target protocol resolution strategy to obtain a first protocol resolution result corresponding to the target protocol transmission data; when the similarity result is less than the preset value, storing the target protocol transmission data in a database for temporary storage, and if a data amount stored in the database reaches a preset data amount, performing data clustering on the target protocol transmission data in the database to obtain a data clustering result of the target protocol transmission data, the clustering result comprising a plurality of clusters, performing protocol resolution on the plurality of clusters in the clustering result to obtain a second target protocol resolution strategy corresponding to each cluster, and obtaining a second target protocol resolution strategy corresponding to the target protocol transmission data according to the cluster corresponding to the target protocol transmission data; performing protocol resolution on the target protocol transmission data according to the second target protocol resolution strategy to obtain a second protocol resolution result corresponding to the target protocol transmission data.

2. The method of claim 1, wherein, The obtaining of the target protocol transmission data of the Internet of Things device comprises: obtaining initial protocol transmission data sent by the Internet of Things device, and performing noise removal and data normalization processing on the initial protocol transmission data to obtain initial protocol transmission data corresponding to the initial protocol transmission data; performing feature extraction on the initial protocol transmission data using principal component analysis to obtain target protocol transmission data corresponding to the initial protocol transmission data.

3. The method of claim 1, wherein, The obtaining of the target protocol transmission data of the Internet of Things device, and the calculation of the similarity between the target protocol transmission data and the target protocol transmission pattern, comprises: performing protocol type classification on the target protocol transmission data using a target resolution classification model to obtain a target protocol type corresponding to the target protocol transmission data; when the target protocol type is a preset protocol type, calculating the similarity between the target protocol transmission data and the target protocol transmission pattern.

4. The method of claim 3, wherein, The target resolution classification model comprises a feature extraction layer and a type classification layer, and the obtaining of the target resolution classification model comprises: obtaining training data, the training data comprising historical protocol transmission data and a true protocol type corresponding to the historical protocol transmission data; determining initial model parameters of an initial resolution classification model, and inputting the historical protocol transmission data into the feature extraction layer to obtain a feature vector corresponding to the historical protocol transmission data; inputting the feature vector into the type classification layer to obtain a predicted protocol type of the historical protocol transmission data; constructing an error function according to the predicted protocol type and the real protocol type; updating initial model parameters of the initial analytical classification model through the error function to obtain target model parameters, and determining the target analytical classification model according to the target model parameters.

5. The method as claimed in claim 3, wherein, When the target protocol type is a preset protocol type, calculating a similarity between the target protocol transmission data and the target protocol transmission pattern, comprising: respectively extracting keywords from the target protocol transmission data and the target protocol transmission pattern to obtain first protocol keywords corresponding to the target protocol transmission data and second protocol keywords corresponding to the target protocol transmission pattern; vectorizing the first protocol keywords and the second protocol keywords to obtain a first feature vector corresponding to the first protocol keywords and a second feature vector corresponding to the second protocol keywords; calculating the similarity between the target protocol transmission data and the target protocol transmission pattern according to the first feature vector and the second feature vector.

6. The method as claimed in claim 1, wherein, When the similarity result is greater than or equal to a preset value, performing protocol analysis on the target protocol transmission data according to the first target protocol analysis strategy to obtain a first protocol analysis result corresponding to the target protocol transmission data, and then comprising: judging whether the target protocol transmission data meets an analysis requirement according to the first protocol analysis result, the analysis requirement being used to represent that the target protocol transmission data can be correctly analyzed according to the first target protocol analysis strategy; when the first protocol analysis result does not meet the analysis requirement, storing the target protocol transmission data in the database for temporary storage.

7. The method as claimed in claim 1, wherein, The target protocol transmission data in the database is clustered to obtain a data clustering result of the target protocol transmission data, comprising: analyzing the target protocol transmission data to obtain third protocol keywords by using a TF-IDF model; performing data clustering according to the third protocol keywords to obtain a data clustering result of the target protocol transmission data.

8. The method of claim 1, wherein, After performing protocol analysis on the target protocol transmission data according to the second target protocol analysis strategy to obtain a second protocol analysis result corresponding to the target protocol transmission data, further comprising: updating the protocol type set according to the second target protocol analysis strategy to obtain an updated protocol type set, so that the target protocol transmission data is analyzed according to the updated protocol type set.

9. A protocol parsing apparatus characterized by comprising: comprising: a data construction module configured to construct a protocol type set, the protocol type set comprising a protocol type, a target protocol transmission pattern corresponding to the protocol type, and a protocol analysis strategy corresponding to the protocol type; a first strategy obtaining module configured to obtain target protocol transmission data of an Internet of Things device, calculate a similarity between the target protocol transmission data and the target protocol transmission pattern, and obtain a similarity result of the target protocol transmission data and the target protocol transmission pattern and a first target protocol analysis strategy corresponding to the target protocol transmission data according to the similarity result; The first data analysis module is configured to, when the similarity result is greater than or equal to a preset value, analyze the target protocol transmission data according to the first target protocol analysis strategy to obtain a first protocol analysis result corresponding to the target protocol transmission data; The second strategy obtaining module is configured to, when the similarity result is less than the preset value, store the target protocol transmission data in a database for temporary storage, and, when the amount of data stored in the database reaches a preset data amount, perform data clustering on the target protocol transmission data in the database to obtain a data clustering result of the target protocol transmission data, wherein the clustering result includes a plurality of clusters, analyze the plurality of clusters in the clustering result to obtain a second target protocol analysis strategy corresponding to each cluster, and obtain a second target protocol analysis strategy corresponding to the target protocol transmission data according to the cluster corresponding to the target protocol transmission data. The second data analysis module is configured to analyze the target protocol transmission data according to the second target protocol analysis strategy to obtain a second protocol analysis result corresponding to the target protocol transmission data.

10. A terminal device, comprising: The terminal device includes a processor and a memory; The memory is configured to store a computer program; The processor is configured to execute the computer program and implement the protocol analysis method in any one of claims 1 to 8 when executing the computer program.

11. A computer readable storage medium, characterized in that, The computer readable storage medium, when executed by one or more processors, causes the one or more processors to perform the protocol analysis method in any one of claims 1 to 8.

Images