Method for constructing computer network protocol dataset based on protocol deduction system

Abstract

The present invention proposes a method for constructing a computer network protocol data set based on a protocol deduction system. The implementation steps are as follows: obtaining a computer network protocol sample set and a standardized Latex structure symbol sequence for each computer network protocol; constructing a feature matrix of the standardized Latex structure symbol sequence; classifying the sample set of computer network protocols; expanding a basic protocol data set; and obtaining the construction results of the data set. When expanding the basic protocol data set, the present invention expands the feature matrix and determines the feasibility based on the protocol combination expansion rules in the protocol deduction system, ensuring the structural rationality and reliability of the expanded protocol, achieving a good expansion effect, and improving the classification accuracy of the constructed data set. In the stage of obtaining the construction results of the data set, a weight is assigned to each symbol in the feature matrix by calculating the word frequency and inverse document frequency of each symbol, effectively improving the data representation of key features in the data set.

Description

Technical Field

[0001] The present invention belongs to the field of artificial intelligence and data processing technology, and relates to a data set construction method, specifically to a computer network protocol data set construction method based on a protocol deduction system, which can be applied to network security, network protocol development and testing, artificial intelligence, finance, the Internet of Things and other fields. Background Art

[0002] Computer network protocols are a set of rules, standards, and conventions established for data communication. They define how data is transmitted between network devices, including the data format, transmission methods, error detection and correction, and connection and disconnection procedures. Computer network protocols manage the end-to-end process of timely, secure, and managed data or network communications. They can be built into hardware or software, and every network relies on network protocols for communication and connectivity. As the foundation for understanding, designing, and maintaining computer network systems, computer network protocols play a vital role in global communication platforms, business applications and e-commerce, cloud computing, and big data.

[0003] A dataset is a set of structured data used for a specific task, consisting of samples, features, and labels. A computer network protocol dataset is specifically designed for storing and analyzing network protocols. It typically contains protocol samples, key protocol features, and protocol labels that record protocol-related properties. Using computer network protocol datasets, developers and researchers can train relevant protocol models for protocol security analysis, performance analysis, and protocol development and optimization.

[0004] The process of building a dataset typically involves data collection, data cleaning, data labeling, data segmentation, data augmentation, and data storage. Data collection can come from public data sources, web scraping, sensors, or user input. Data cleaning involves handling missing values ​​and noise, as well as standardization. Data labeling can be done manually, automatically, or through crowdsourcing. Data segmentation involves dividing the data into training, validation, and test sets. Data augmentation involves performing various transformations on the data to improve the model's generalization capabilities. Finally, the data is stored in a suitable format such as CSV or JSON.

[0005] Tongfang Knowledge Network Digital Publishing Technology Co., Ltd. and Tongfang Knowledge Network (Beijing) Technology Co., Ltd. proposed a method for constructing a corpus dataset of an academic model in their patent application "Method, device, equipment and medium for constructing a corpus dataset of an academic model" (patent application number: CN202311738155.0, application publication number: CN117851562A). The method includes: formulating construction rules for a corpus dataset of an academic model; extracting massive corpus data according to the data extraction requirements; pre-processing the massive corpus data according to the data processing rules to obtain processed corpus data; and labeling the processed corpus data according to the manual annotation standards. The corpus data after manual annotation is performed to obtain the annotated corpus data; the annotated corpus data is classified according to the task type to obtain multiple task type scenario basic data sets; each task type scenario basic data set is expanded to form a task type scenario data set. This invention ensures the accuracy and applicability of the output academic documents, but because the automatic construction and expansion method is adopted during data expansion, the composition rules between the data are not considered, the expansion effect is poor, and the classification accuracy of the constructed data set is low; the data cannot be fully extracted by the manual annotation method, which leads to the lack of data representation of the key features of the constructed data set. Summary of the Invention

[0006] The purpose of the present invention is to overcome the defects of the above-mentioned prior art and propose a data set construction method for computer network protocol to solve the technical problems of low data set classification accuracy and lack of key features in data representation in the prior art.

[0007] To achieve the above object, the technical solution adopted by the present invention includes the following steps:

[0008] (1) Obtain a sample set of computer network protocols:

[0009] Obtain the expression images, symbol sequences and security attributes of M computer network protocols, and use the security attributes as labels of the expression images. Then, the expression images, their labels, and symbol sequences form a sample set D. sample , where M ≥ 600;

[0010] (2) Obtain the standardized Latex structure symbol sequence for each computer network protocol:

[0011] Segment the symbol sequence of the mth computer network protocol, and convert the lexical unit list including variable names, operators, delimiters and brackets obtained by segmentation into a symbol tree, and then recursively parse each symbol tree to obtain a standardized Latex structure symbol sequence;

[0012] (3) Construct the feature matrix of the standardized Latex structure symbol sequence:

[0013] Divide the mth group of standardized Latex structure symbol sequences into N protocol events. Each protocol event contains four elements: subject, action, message, and key. Then construct an event matrix with dimension N×4, with N rows and four elements as columns. Then fill the empty positions of the event matrix with 0s when the dimension is less than H×4, to obtain a feature matrix with dimension H×4, where 1≤N≤100 and H>100.

[0014] (4) Classify the sample set of computer network protocols:

[0015] According to the security attribute, the sample set D sample The M expression images in the image are divided into F categories, and the protocol basic data sets consisting of each category of expression images and their corresponding standardized Latex structure symbol sequence, feature matrix and image label are obtained to obtain F protocol basic data sets;

[0016] (5) Expand the protocol basic data set:

[0017] The proportion of the number of f-th protocols in the protocol combination expansion rule based on the protocol deduction system f and the preset threshold Y satisfies P f <Y, modify some elements of each feature matrix in the protocol basic data set, and add the modified feature matrix with multiple encryption problems and random numbers that is feasible to the corresponding protocol basic data set, while discarding the infeasible feature matrix, to expand the F protocol basic data sets and obtain F protocol data sets including R feature matrices, where 0.1≤Y≤0.2 and R≥1000;

[0018] (6) Obtain the construction results of the dataset:

[0019] Calculate the initial weight value of each symbol in the B symbols contained in each of the four elements of each feature matrix in each protocol data set And Modify it according to the result of ascending sorting in the corresponding elements to obtain a weight matrix W with a dimension of H×4 Protocol , and then combine the F protocol data sets to obtain a computer network protocol data set containing R groups of protocol feature matrices, security attribute labels and corresponding weight matrices, where B≤100.

[0020] Compared with the prior art, the present invention has the following advantages:

[0021] First, based on the protocol combination expansion rules in the protocol deduction system, the present invention modifies some elements of each feature matrix in the protocol basic data set whose number of protocols is less than a preset threshold, and adds the modified feature matrix that is feasible for multiple encryption problems and random numbers to the corresponding protocol basic data set, while discarding the non-feasible feature matrix to achieve the expansion of each protocol basic data set, fully considering the composition rules between protocols, and has a good expansion effect. Compared with the existing technology, it effectively improves the classification accuracy of the constructed data set.

[0022] Second, in the stage of obtaining the construction results of the data set, the present invention assigns weights to each symbol based on the word frequency and inverse document frequency of each symbol in the four elements to obtain a weight matrix. The weight matrix can better reflect the importance of different protocol events, and then extract the key features of the protocol data, effectively improving the data representation of the key features in the data set. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 It is a flow chart for implementing the present invention. DETAILED DESCRIPTION

[0024] The present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0025] Reference Figure 1 , the present invention comprises the following steps:

[0026] Step 1) Obtain a sample set of computer network protocols:

[0027] Obtain the expression images, symbol sequences and security attributes of M computer network protocols, and use the security attributes as labels of the expression images. Then, the expression images, their labels, and symbol sequences form a sample set D. sample ,where,M≥600, and the security properties include protocol security, vulnerability, and defective steps;

[0028] Step 2) Obtain the standardized Latex structure symbol sequence for each computer network protocol:

[0029] Segment the symbol sequence of the mth computer network protocol, and convert the lexical unit list including variable names, operators, delimiters and brackets obtained by segmentation into a symbol tree, and then recursively parse each symbol tree to obtain a standardized Latex structure symbol sequence;

[0030] The symbol tree includes a root node for storing the start and end marks of the sequence, a plurality of parent nodes equal to the number of operators included in the symbol sequence in the computer network protocol, and child nodes equal to the number and sum of brackets, separators and variable names included in the symbol sequence in the computer network protocol;

[0031] Recursively parse each symbol tree to obtain a standardized Latex structure symbol sequence. The implementation steps are:

[0032] Step 2a) Initialize a stack S for tracking node matching and a list listinfo for collecting information fragments, with the root node of the symbol tree being the current node;

[0033] Step 2b) Push the data stored in the root node into the stack S, and move the current node to the position of the leftmost child node;

[0034] Step 2c) Determine whether the current node has a child node. If so, push the data stored in the current node into stack S, move the current node to the position of the leftmost child node, and execute step 2c). Otherwise, execute step 2d).

[0035] Step 2d) Store the data stored in the current node into the list listinfo and determine whether the current node has a right sibling node. If so, move the current node to the position of the right sibling node and execute step 2c); otherwise, execute step 2e);

[0036] Step 2e) Extract the contents of listinfo stored in the protocol dictionary D, convert them into standardized symbols and store them in the standardized symbol sequence S std In the process, determine whether the data stored in the parent node of the current node is the same as the data at the top of the stack S. If so, store the data stored in the parent node of the current node into the standardized symbol sequence S. std In the process, the top element of the stack is popped and step 2f) is executed. Otherwise, the current node is moved to the right sibling node of the parent node of the current node and step 2c) is executed. The symbol dictionary D is used to uniformly record different symbolic representations of the same protocol information.

[0037] Step 2f) Determine whether the stack S is empty. If so, obtain the standardized LaTeX structure symbol sequence after recursive parsing of each symbol tree. Otherwise, move the current node to the right sibling node of the parent node of the current node and execute step 2c);

[0038] Step 3) Construct the feature matrix of the standardized Latex structure symbol sequence:

[0039] Divide the mth group of standardized LaTeX structure symbol sequences into N protocol events. Each protocol event indicates that the protocol subject has completed an atomic protocol action, such as sending or receiving a message, encrypting a message, and each protocol event contains four elements: subject, action, message, and key. Construct an N×4 event matrix with N rows and four elements as columns. Then, fill in the empty spaces in the event matrix that are less than H×4 with zeros to obtain a feature matrix with H×4 dimensions. The size of N is related to the complexity of the protocol, 1≤N≤100, and H>100.

[0040] Step 4) Classify the sample set of computer network protocols:

[0041] According to the security attribute, the sample set D sample The M expression images in the image are divided into F categories, and the protocol basic data sets consisting of each category of expression images and their corresponding standardized Latex structure symbol sequence, feature matrix and image label are obtained to obtain F protocol basic data sets;

[0042] According to the security attribute, the sample set D sample The M expression images in the image are divided into F classes. The division method is: divide the sample set D sample The M expression images in the image are divided into images of secure protocols and images of non-secure protocols, wherein the images of non-secure protocols are divided into F-1 categories according to the vulnerable attack types;

[0043] Step 5) Expand the protocol basic data set:

[0044] The proportion of the number of f-th protocols in the protocol combination expansion rule based on the protocol deduction system f and the preset threshold Y satisfies P f <Y, modify some elements of each feature matrix in the protocol basic data set, and add the modified feature matrix with multiple encryption problems and random numbers that is feasible to the corresponding protocol basic data set, while discarding the infeasible feature matrix, to expand the F protocol basic data sets and obtain F protocol data sets including R feature matrices, where 0.1≤Y≤0.2 and R≥1000;

[0045] The protocol deduction system introduces that most protocols can be expanded sequentially or in parallel by multiple security components. Based on the protocol combination expansion rules, a new protocol can be obtained by changing one or more components of the protocol without changing the security properties of the protocol.

[0046] The proportion of the number of agreements f , the calculation formula is:

[0047]

[0048] Among them, M f represents the number of protocols in the fth protocol basic data set;

[0049] The modified characteristic matrix of multiple encryption problems and random numbers is feasible, which means that there are no multiple encryption problems that make data difficult to interpret or analyze and the random numbers satisfy the randomness;

[0050] Step 6) Get the dataset construction results:

[0051] Calculate the initial weight value of each symbol in the B symbols contained in each of the four elements of each feature matrix in each protocol data set And Modify it according to the result of ascending sorting in the corresponding elements to obtain a weight matrix W with a dimension of H×4 Protocol , then combine F protocol data sets to obtain a computer network protocol data set containing R groups of protocol feature matrices, security attribute labels and corresponding weight matrices, where B≤100;

[0052] The initial weight value of each symbol The calculation formula is:

[0053]

[0054]

[0055]

[0056] in, Indicates the frequency of the bth symbol in the R feature matrix, Indicates the proportion of the number of feature matrices of the bth symbol in the R feature matrices, a b,r is the number of times the bth symbol appears in the rth feature matrix, |{r:t b ∈d r}| represents the number of characteristic matrices containing the bth symbol;

[0057] All the amplified weight values ​​in each element are processed in ascending order and recombined, specifically:

[0058] Step 6a) Take k as the magnification factor Amplify and get the amplified weight value and will Split into two parts: integer and decimal, where k ≥ 100;

[0059] Step 6b) Sort the amplified weight values ​​of the subject, action, message, and key in ascending order of integer digits, and determine whether there are weight values ​​with the same integer digits. If so, sort them in ascending order of decimal digits;

[0060] Step 6c) Determine whether the subject, action, message, and key parts have the same integer digits. If so, increment the integer digit of the corresponding value with the larger decimal place by 1 until no integer digits of the weight value are the same in any part. Otherwise, proceed to step 6d)

[0061] Step 6d) Combine the integer bits of the subject, action, message, and key after processing to obtain a weight matrix W with a dimension of H×4 protocol .

Claims

1. A method for constructing a computer network protocol dataset based on a protocol deduction system, characterized in that: The steps include: (1) Obtain a sample set of computer network protocols: Obtain the expression images, symbol sequences and security attributes of M computer network protocols, and use the security attributes as labels of the expression images. Then, the expression images, their labels, and symbol sequences form a sample set D. sample , where M ≥ 600; (2) Obtain the standardized Latex structure symbol sequence for each computer network protocol: Segment the symbol sequence of the mth computer network protocol, and convert the lexical unit list including variable names, operators, delimiters and brackets obtained by segmentation into a symbol tree, and then recursively parse each symbol tree to obtain a standardized Latex structure symbol sequence; (3) Construct the feature matrix of the standardized Latex structure symbol sequence: Divide the mth group of standardized LaTeX structure symbol sequences into N protocol events. Each protocol event contains four elements: subject, action, message, and key. Then construct an N×4 event matrix with N rows and four elements as columns. Then fill the empty positions of the event matrix with zeros if the dimension is less than H×4, to obtain a feature matrix with dimension H×4, where 1≤N≤100 and H>100. (4) Classify the sample set of computer network protocols: According to the security attribute, the sample set D sample The M expression images in the image are divided into F categories, and the protocol basic data sets consisting of each category of expression images and their corresponding standardized Latex structure symbol sequence, feature matrix and image label are obtained to obtain F protocol basic data sets; (5) Expand the protocol basic data set: Based on the protocol composition expansion rule in the protocol deduction system, for the proportion P of the number of the f-th protocol f and the pre-set threshold Y satisfy P f < Y, modify some elements of each feature matrix in the protocol base dataset, and add the modified feature matrices with feasible multiple encryption problems and random numbers to the corresponding protocol base datasets, while discarding the non-feasible feature matrices, to achieve the expansion of the F protocol base datasets, and obtain F protocol datasets including R feature matrices, where 0.1 ≤ Y ≤ 0.2 and R ≥ 1000; (6) Obtain the construction results of the dataset: Calculate the initial weight value of each symbol in the B symbols contained in each of the four elements of each feature matrix in each protocol data set And Modify it according to the result of ascending sorting in the corresponding elements to obtain a weight matrix W with a dimension of H×4 Protocol , and then combine the F protocol data sets to obtain a computer network protocol data set containing R groups of protocol feature matrices, security attribute labels and corresponding weight matrices, where B≤100.

2. The method according to claim 1, characterized in that The security properties described in step (1) include protocol security, vulnerabilities, and defective steps.

3. The method according to claim 1, characterized in that The symbol tree described in step (2) includes a root node for storing the start and end marks of the sequence, a plurality of parent nodes equal to the number of operators contained in the symbol sequence in the computer network protocol, and a number of child nodes equal to the number of brackets, separators and variable names contained in the symbol sequence in the computer network protocol.

4. The method according to claim 3, characterized in that The steps for recursively parsing each symbol tree in step (2) to obtain a standardized Latex structure symbol sequence are as follows: (2a) Initialize the stack S for tracking node matching and the list listinfo for collecting information fragments. The root node of the symbol tree is the current node. (2b) Push the data stored in the root node into the stack S, and move the current node to the position of the leftmost child node; (2c) Determine whether the current node has a child node. If so, push the data stored in the current node into stack S, move the current node to the position of the leftmost child node, and execute step (2c). Otherwise, execute step (2d). (2d) Store the data stored in the current node into the list listinfo and determine whether the current node has a right sibling node. If so, move the current node to the position of the right sibling node and execute step (2c). Otherwise, execute step (2e). (2e) Extract the contents of listinfo according to the protocol dictionary D, convert them into standardized symbols and store them in the standardized symbol sequence S std In the process, determine whether the data stored in the parent node of the current node is the same as the data at the top of the stack S. If so, store the data stored in the parent node of the current node into the standardized symbol sequence S. std In the process, the top element of the stack is popped and step (2f) is executed. Otherwise, the current node is moved to the right sibling node of the parent node of the current node and step (2c) is executed. The symbol dictionary D is used to uniformly record different symbolic representations of the same protocol information. (2f) Determine whether the stack S is empty. If so, obtain the standardized Latex structure symbol sequence after recursive parsing of each symbol tree. Otherwise, move the current node to the right sibling node of the parent node of the current node and execute step (2c).

5. The method according to claim 1, wherein As described in step (2), the sample set D is divided into sample The M expression images in the image are divided into F classes. The division method is: divide the sample set D sample The M expression images in the algorithm are divided into images of secure protocols and images of non-secure protocols, where the images of non-secure protocols are divided into F-1 categories according to the vulnerable attack types.

6. The method according to claim 1, characterized in that The number of agreements described in step (4) accounts for P f , the calculation formula is: Among them, M f represents the number of protocols in the fth protocol base dataset.

7. The method according to claim 1, characterized in that The modified characteristic matrix after the multiple encryption problems and random numbers described in step (5) are feasible means that there are no multiple encryption problems that make the data difficult to interpret or analyze and the random numbers satisfy the randomness.

8. The method according to claim 1, characterized in that The initial weight value of each symbol described in step (6) The calculation formula is: in, Indicates the frequency of the bth symbol in the R feature matrix, Indicates the proportion of the number of feature matrices of the bth symbol in the R feature matrices, a b,r is the number of times the bth symbol appears in the rth feature matrix, |{r:t b ∈d r }| represents the number of characteristic matrices containing the bth symbol.

9. The method according to claim 1, characterized in that The pair described in step (6) Modify it according to the result of ascending sorting in the corresponding elements, specifically: (6a) With k as the amplification factor Amplify and get the amplified weight value and will Split into two parts: integer and decimal, where k ≥ 100; (6b) sorting the amplified weight values ​​of the subject, action, message, and key in ascending order of integer digits, and determining whether there are weight values ​​with the same integer digits. If so, sorting them in ascending order of decimal digits; (6c) Determine whether there are any integers in the subject, action, message, and key parts that are identical. If so, increment the integer of the corresponding value with the larger decimal place by 1 until no integers in the parts have the same weight value. Otherwise, execute step (6d). (6d) Combine the integer bits of the subject, action, message, and key after processing to obtain a weight matrix W with a dimension of H×4 protocol .

Images