A multi-protocol intelligent recognition terminal direct connection communication method and system

Abstract

The present invention discloses a multi - protocol intelligent recognition terminal direct connection communication method and system, which relates to the field of communication technologies. The multi - protocol intelligent recognition terminal direct connection communication method includes: obtaining the reliability types of each first test protocol frame of the terminal device; grouping each first test protocol frame according to the corresponding reliability type to obtain at least one protocol frame set; for each first test protocol frame in the protocol frame set, respectively calculating the structural similarity between the first test protocol frame and each corresponding verification protocol frame in the protocol library of the main control system; sorting each verification protocol frame corresponding to the first test protocol frame in the order of the size of the structural similarity, and determining the verification protocol frame with the largest structural similarity as the matching protocol frame corresponding to the first test protocol frame; connecting and debugging each first test protocol frame according to the corresponding protocol frame sender and the corresponding matching protocol frame to realize multi - protocol communication between the terminal device and the main control system.

Description

Technical Field

[0001] The present invention relates to the field of communication technologies, and particularly to a multi - protocol intelligent recognition terminal direct connection communication method and system. Background Art

[0002] In traditional communication systems, the communication protocol between terminal devices and the network is often fixed. However, in the Internet of Things scenario, there are a wide variety of terminal devices accessing the network, with different communication protocols, which increases the complexity and cost of the communication system. Therefore, the multi - protocol intelligent recognition terminal direct connection communication technology has emerged, which can automatically identify and adapt to different communication protocols to achieve interconnection and interoperability between heterogeneous networks.

[0003] In existing methods, the protocol to be recognized is usually matched with each protocol pre - stored in the protocol library of the main control system respectively to determine the protocol type of the protocol to be recognized.

[0004] However, this method requires separate matching attempts for each protocol pre - stored in the protocol library, resulting in low matching efficiency and poor matching accuracy. Summary of the Invention

[0005] Embodiments of the present invention provide a multi - protocol intelligent recognition terminal direct connection communication method and system, which can improve the efficiency and accuracy of protocol matching.

[0006] On one hand, an embodiment of the present invention provides a multi - protocol intelligent recognition terminal direct connection communication method, including:

[0007] Obtaining the reliability types of each first test protocol frame of the terminal device, where the first test protocol frame is a test frame corresponding to each communication protocol in the terminal device;

[0008] Grouping each first test protocol frame according to the corresponding reliability type to obtain at least one protocol frame set;

[0009] For each first test protocol frame in the protocol frame set, calculating the structural similarity between the first test protocol frame and each verification protocol frame corresponding in the protocol library of the main control system, where the reliability type of the verification protocol frame matches the reliability type of the protocol frame set;

[0010] Sorting each verification protocol frame corresponding to the first test protocol frame in the order of the size of the structural similarity, and determining the verification protocol frame with the largest structural similarity as the matching protocol frame corresponding to the first test protocol frame;

[0011] Connecting and debugging each first test protocol frame according to the corresponding protocol frame sender and the corresponding matching protocol frame to achieve multi - protocol communication between the terminal device and the main control system.

[0012] On one hand of the embodiments of the present invention, a multi - protocol intelligent recognition terminal direct connection communication system is provided, including a terminal device, a main control system, and a controller;

[0013] The terminal device is used for communicating with the main control system;

[0014] The main control system is used for communicating with the terminal device;

[0015] The controller is connected to the terminal device and the main control system, and is used for executing the multi - protocol intelligent recognition terminal direct connection communication method provided in any one of the above aspects.

[0016] In the multi - protocol intelligent recognition terminal direct connection communication method provided by the embodiments of the present invention, each first test protocol frame is grouped according to the corresponding reliability type. Then, for each first test protocol frame, it only needs to be matched with each verification protocol frame of the same reliability type in the protocol library of the main control system, without having to match with all the verification protocol frames in the protocol library of the main control system, thus improving the efficiency of protocol matching. Then, the structural similarity is calculated between the first test protocol frame and each verification protocol frame of the same reliability type in the protocol library of the main control system, and the verification protocol frame with the maximum structural similarity is determined as the matching protocol frame corresponding to the first test protocol frame, thereby improving the accuracy of protocol matching. In this way, by grouping each first test protocol frame according to the corresponding reliability type, calculating the structural similarity between the first test protocol frame and each verification protocol frame of the same reliability type in the protocol library of the main control system, and selecting the one with the maximum structural similarity as the matching protocol frame corresponding to the first test protocol frame, the embodiments of the present invention can improve the efficiency and accuracy of protocol matching. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions and advantages in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings required for the description of the embodiments or the prior art. Obviously, the following - described drawings are only some embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts.

[0018] Figure 1 It is a schematic flow chart of the first multi - protocol intelligent recognition terminal direct connection communication method provided by an embodiment of the present invention;

[0019] Figure 2 It is a schematic flow chart of the second multi - protocol intelligent recognition terminal direct connection communication method provided by an embodiment of the present invention;

[0020] Figure 3 It is a schematic diagram of the protocol structure of the transmission control protocol provided by an embodiment of the present invention;

[0021] Figure 4 Schematic flowchart of the third multi - protocol intelligent recognition terminal direct connection communication method provided by an embodiment of the present invention;

[0022] Figure 5 Schematic flowchart of the fourth multi - protocol intelligent recognition terminal direct connection communication method provided by an embodiment of the present invention. Detailed implementation manners

[0023] In order to further elaborate on the technical means and effects adopted by the present invention to achieve the predetermined invention purpose, the following, in combination with the accompanying drawings and preferred embodiments, details a multi - protocol intelligent recognition terminal direct connection communication method proposed according to the present invention, including its specific implementation manners, structures, features and effects. In the following description, different "one embodiment" or "another embodiment" do not necessarily refer to the same embodiment. In addition, the specific features, structures or characteristics in one or more embodiments can be combined in any suitable form.

[0024] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the technical field to which the present invention belongs.

[0025] It should be noted that the acquisition, storage, use, processing, etc. of data in the technical solution of the present invention all comply with the relevant regulations of laws and regulations.

[0026] It should be noted that in the embodiments of the present invention, some existing industry solutions such as certain software, components, models, etc. may be mentioned. They should be regarded as exemplary, and their purpose is only to illustrate the feasibility in the implementation of the technical solution of the present invention, but it does not mean that the applicant has already or necessarily used this solution.

[0027] In the existing method, the protocol to be recognized is usually matched with each protocol pre - stored in the protocol library of the master control system respectively to determine the protocol type of the protocol to be recognized. However, this method requires separate matching attempts for each protocol pre - stored in the protocol library, resulting in low matching efficiency and poor matching accuracy.

[0028] The object of the present invention is to provide a multi - protocol intelligent recognition terminal direct connection communication method and system. In the multi - protocol intelligent recognition terminal direct connection communication method provided by the embodiments of the present invention, each first test protocol frame is grouped according to the corresponding reliability type, and then for each first test protocol frame, it only needs to be matched with each verification protocol frame of the same reliability type in the protocol library of the main control system. There is no need to match with each verification protocol frame in the protocol library of the main control system, thereby improving the efficiency of protocol matching. Then, calculate the structural similarity between the first test protocol frame and each verification protocol frame of the same reliability type in the protocol library of the main control system, and determine the verification protocol frame with the maximum structural similarity as the matching protocol frame corresponding to the first test protocol frame, thereby improving the accuracy of protocol matching. In this way, the embodiments of the present invention group each first test protocol frame according to the corresponding reliability type, then calculate the structural similarity between the first test protocol frame and each verification protocol frame of the same reliability type in the protocol library of the main control system, and select the one with the maximum structural similarity as the matching protocol frame corresponding to the first test protocol frame, which can improve the efficiency and accuracy of protocol matching.

[0029] Figure 1 A flowchart of a multi - protocol intelligent recognition terminal direct connection communication method is provided. This multi - protocol intelligent recognition terminal direct connection communication method can be applied to a server, and this multi - protocol intelligent recognition terminal direct connection communication method may include the following S101 to S105.

[0030] S101, obtain the reliability type of each first test protocol frame of the terminal device, where the first test protocol frame is the test frame corresponding to each communication protocol in the terminal device.

[0031] In this embodiment, the terminal device supports multiple communication protocols, and for each communication protocol, a corresponding first test protocol frame is created respectively.

[0032] The reliability type is used to characterize whether the first test protocol frame is reliable. Exemplarily, the reliability type includes a reliable protocol and an unreliable protocol. Specifically, the reliable protocol can ensure the accuracy and integrity of data transmission, and the unreliable protocol does not guarantee the accuracy or integrity of data transmission.

[0033] As an example, the server obtains the first test protocol frames corresponding to various communication protocols in the terminal device, and obtains the reliability type corresponding to the first test protocol frame.

[0034] S102, group each first test protocol frame according to the corresponding reliability type to obtain at least one protocol frame set.

[0035] In this embodiment, the protocol frame set includes at least one first test protocol frame, and the reliability types of the first test protocol frames in the protocol frame set are the same.

[0036] As an example, the server stores reliable protocols in the first protocol frame set and unreliable protocols in the second protocol frame set according to the reliability types corresponding to each first test protocol frame.

[0037] S103. For each first test protocol frame in the protocol frame set, calculate the structural similarity between the first test protocol frame and each corresponding verification protocol frame in the protocol library of the master control system, where the reliability type of the verification protocol frame matches the reliability type of the protocol frame set.

[0038] In this embodiment, multiple communication protocol templates are pre-stored in the protocol library of the master control system, and each communication protocol template corresponds to a verification protocol frame.

[0039] The structural similarity is used to characterize the similarity degree between the structures of two protocol frames. Exemplarily, the structure of a protocol frame may include the byte length of each part in the protocol and the header length of the protocol frame, etc.

[0040] As an example, for each first test protocol frame in the first protocol frame set, the server respectively obtains the frame structure of each first test protocol frame. Then, obtain each verification protocol frame with a reliable protocol as the reliability type in the protocol library of the master control system, and obtain the frame structure of each verification protocol frame.

[0041] Then, compare the frame structure of each first test protocol frame with the frame structure of each verification protocol frame respectively to obtain the structural similarity between each first test protocol frame and each verification protocol frame.

[0042] Specifically, a protocol frame includes multiple protocol regions. Compare each protocol region of the first test protocol frame with the corresponding protocol region of the verification protocol frame, and then count the number of protocol regions with the same structure between the first test protocol frame and the verification protocol frame. Divide this number by the total number of protocol regions of the first test protocol frame to obtain the structural similarity between the first test protocol frame and the verification protocol frame.

[0043] Then, for each first test protocol frame in the second protocol frame set, the server obtains the structural similarity between the corresponding first test protocol frame and the verification protocol frame according to the above method.

[0044] S104. Sort the verification protocol frames corresponding to the first test protocol frame in the order of the size of the structural similarity, and determine the verification protocol frame with the largest structural similarity as the matching protocol frame corresponding to the first test protocol frame.

[0045] In this embodiment, as an example, for each verification protocol frame corresponding to the first test protocol frame, the server sorts them in descending order according to the corresponding structural similarity, so as to select the verification protocol frame with the largest structural similarity as the matching protocol frame corresponding to the first test protocol frame.

[0046] S105. Connect and debug each first test protocol frame according to the corresponding protocol frame sender and the corresponding matching protocol frame, so as to realize multi-protocol communication between the terminal device and the main control system.

[0047] In this embodiment, as an example, the server obtains the protocol frame sender and the corresponding matching protocol frame corresponding to each first test protocol frame, and performs connection debugging according to the relationship between the protocol frame sender and the matching protocol frame, so that the terminal device and the main control system can communicate through multiple protocols.

[0048] Through this embodiment, each first test protocol frame is grouped according to the corresponding reliability type. Then, for each first test protocol frame, it only needs to be matched with each verification protocol frame of the same reliability type in the protocol library of the main control system, without having to be matched with all the verification protocol frames in the protocol library of the main control system, thus improving the efficiency of protocol matching. Then, calculate the structural similarity between the first test protocol frame and each verification protocol frame of the same reliability type in the protocol library of the main control system, and determine the verification protocol frame with the largest structural similarity as the matching protocol frame corresponding to the first test protocol frame, thereby improving the accuracy of protocol matching. In this way, the embodiment of the present invention groups each first test protocol frame according to the corresponding reliability type, then calculates the structural similarity between the first test protocol frame and each verification protocol frame of the same reliability type in the protocol library of the main control system, and selects the one with the largest structural similarity as the matching protocol frame corresponding to the first test protocol frame, which can improve the efficiency and accuracy of protocol matching.

[0049] As an optional embodiment, S101 may specifically include:

[0050] Send a type recognition signal to the terminal device to enable the terminal device to send each first test protocol frame to the main control system;

[0051] In response to the operation that the terminal device receives the confirmation frame feedback by the main control system, determine the reliability type of each first test protocol frame corresponding to the confirmation frame as a reliable protocol;

[0052] Determine the reliability type of each first test protocol frame other than the reliable protocol as an unreliable protocol.

[0053] In this embodiment, the type recognition signal is used to instruct the terminal device to send a first test protocol frame to the master control system for identifying the reliability type of the first test protocol frame.

[0054] As an example, the server sends a type recognition signal to the terminal device, and the terminal device receives the type recognition signal sent by the server. Then, in response to the type recognition signal, the terminal device sends a corresponding first test protocol frame to the master control system according to various communication protocols supported by the terminal device, one for each communication protocol.

[0055] After the master control system receives the first test protocol frame sent by the terminal device, if the first test protocol frame is a reliable protocol, the master control system will return an acknowledgment frame to indicate normal communication; if the first test protocol frame is an unreliable protocol, it will not return an acknowledgment frame to indicate normal communication.

[0056] Therefore, the reliable type of the first test protocol frame that requires an acknowledgment frame to be returned is marked as a reliable protocol, and the reliable type of the first test protocol frame that does not require an acknowledgment frame to be returned is marked as an unreliable protocol frame. According to the acknowledgment frames feedback by the master control system received by the terminal device, the reliable types of the first test protocol frames can be obtained.

[0057] Through this embodiment, the terminal device sends each first test protocol frame to the master control system. According to whether the master control system feedbacks an acknowledgment frame, the reliability type of each first test protocol frame can be accurately determined. This helps to perform accurate grouping according to the reliability types of the first test protocol frames subsequently, so that only the same batch of verification protocol frames need to be used for matching for each first test protocol frame in the same protocol frame set, which can improve the efficiency of protocol matching.

[0058] As an alternative embodiment, as Figure 2 shown, S103 may specifically include the following S201 - S204:

[0059] S201, divide the verification protocol frame into N verification regions according to the corresponding protocol structure, where N is a positive integer;

[0060] S202, divide the first test protocol frame into N test regions in the same protocol division manner as the verification protocol frame;

[0061] S203, match each test region with the corresponding verification region to obtain the matching regions that match successfully in each test region;

[0062] S204, use each matching region to determine the structural similarity between the first test protocol frame and the verification protocol frame.

[0063] In this embodiment, the server first divides the verification protocol frame into regions according to the corresponding protocol structure to obtain N verification regions corresponding to the verification protocol frame. For example, as Figure 3 shown, a schematic diagram of the protocol structure of the Transmission Control Protocol (TCP) is provided. Among them, the TCP protocol includes a header byte and a data byte. There are no effective features in the data byte part for analysis. Therefore, only the header byte needs to be divided into regions according to the corresponding protocol structure. The characteristic byte of the TCP header is 20 bytes, and 1 byte is 16 bits.

[0064] Assume that the verification protocol frame divides a total of H bytes into N verification regions. Then, the first test protocol frame also extracts the first N bytes and divides them into N test regions in the same division manner as the verification protocol frame.

[0065] After dividing the regions, each test region in the first test protocol frame is extracted and analyzed. For example, assume that the first verification region of the verification protocol frame represents the source port information. Then, use the network analysis tool Wireshark to extract the binary data of this verification region and convert it into the corresponding port number. Assume that the valid range of the corresponding port number is from 0 to 65535. Then, extract the binary data of the first test region in the first test protocol frame and convert it into the corresponding port number to see if it is within the range of 0 to 65535. If it is within the range of 0 to 65535, it means that the match is successful.

[0066] Finally, count the number of matching regions that match successfully in each test region, and divide the number of matching regions by the total number of test regions to obtain the structural similarity between the first test protocol frame and the verification protocol frame.

[0067] Through this embodiment, the verification protocol frame and the first test protocol frame are divided into regions in the same division manner, and then the divided verification regions are matched with the corresponding test regions. According to the number of matching regions that match successfully, the structural similarity between the first test protocol frame and the verification protocol frame can be determined. In this way, by dividing the protocol frame into multiple regions and comparing each region one by one, the present invention can accurately analyze whether the first test protocol frame is similar to the verification protocol frame and improve the accuracy of judging the structural similarity.

[0068] As an alternative embodiment, before S202, the multi-protocol intelligent recognition terminal direct communication method may further include:

[0069] Obtain the number of protocol frame bytes of the first test protocol frame;

[0070] Compare the number of protocol frame bytes of the first test protocol frame with the number of header bytes of the verification protocol frame to obtain a byte comparison result;

[0071] When it is determined that the number of protocol frame bytes in the byte comparison result indicates that the number of protocol frame bytes is less than the number of header bytes, the structural similarity between the first test protocol frame and the verification protocol frame is determined to be a preset similarity threshold.

[0072] In this embodiment, the number of protocol frame bytes is the total number of bytes in the protocol frame, that is, the number of header bytes plus the number of data bytes. The number of header bytes only refers to the number of header bytes in the protocol frame and does not include the number of data bytes.

[0073] As an example, assume that the number of header bytes of the verification protocol frame is H bytes. Then, the number of protocol frame bytes of the first test protocol frame is compared with H. If the number of protocol frame bytes of the first test protocol frame is less than H, it indicates that the first test protocol frame does not match the verification protocol frame, that is, the structural similarity between the first test protocol frame and the verification protocol frame must be very low and it is impossible to match successfully. At this time, the structural similarity between the first test protocol frame and the verification protocol frame can be directly set to the preset similarity threshold without further calculating the structural similarity.

[0074] If the number of protocol frame bytes of the first test protocol frame is greater than or equal to H, it indicates that the first test protocol frame and the verification protocol frame may match. In this case, the calculation of the structural similarity continues.

[0075] Through this embodiment, by comparing the number of protocol frame bytes of the first test protocol frame with the number of header bytes of the verification protocol frame, it is possible to determine the first test protocol frame and the verification protocol frame that are clearly not matched. For the first test protocol frame and the verification protocol frame that are clearly not matched, there is no need to continue calculating the structural similarity. Thus, the calculation amount of the structural similarity can be reduced and the calculation efficiency can be improved.

[0076] As an alternative embodiment, S204 may specifically include:

[0077] Sort the matching regions in ascending order of the corresponding region numbers to obtain a matching region sequence;

[0078] Accumulate the number differences between two adjacent matching regions in the matching region sequence to obtain an accumulated number difference value;

[0079] Divide the number of matching regions by N to obtain a region number ratio;

[0080] According to the accumulated number difference value and the region number ratio, obtain the structural similarity between the first test protocol frame and the verification protocol frame.

[0081] In this embodiment, the structural similarity between the first test protocol frame and the verification protocol frame can be determined by the following formula 1:

[0082] Formula 1

[0083] Wherein, represents the structural similarity between the p-th first test protocol frame and the q-th verification protocol frame, represents the number of matching regions between the p-th first test protocol frame and the q-th verification protocol frame, represents the number of test regions and verification regions, represents the cumulative value of the number differences between the p-th first test protocol frame and the q-th verification protocol frame.

[0084] Specifically, sort the matching regions in ascending order of the corresponding region numbers to obtain a matching region sequence. Assuming the obtained matching region sequence is {1, 4, 6, 9}, then the cumulative value of the number differences is the cumulative value of the difference between 4 and 1, the difference between 6 and 4, and the difference between 9 and 6, that is, 3 + 2 + 3 = 8.

[0085] The larger the value of, the smaller the value of, the higher the structural similarity between the p-th first test protocol frame and the q-th verification protocol frame is. Wherein, the larger the value of, the more the number of matching regions between the p-th first test protocol frame and the q-th verification protocol frame. the smaller the value of, the higher the continuity between the matching regions.

[0086] The higher the structural similarity between the p-th first test protocol frame and the q-th verification protocol frame is, the more likely the q-th verification protocol frame is the matching protocol frame of the p-th first test protocol frame.

[0087] Through this embodiment, considering both the number of matching regions and the continuity between the matching regions, calculate the structural similarity between the first test protocol frame and the verification protocol frame. In this way, by calculating comprehensively from the two dimensions of the number of matching regions and the continuity between the matching regions, it can accurately analyze whether the first test protocol frame and the verification protocol frame are similar, improving the accuracy of the judgment of structural similarity.

[0088] As an alternative embodiment, as Figure 4 shown, after S104, the multi-protocol intelligent recognition terminal direct communication method may further include S401 - S404:

[0089] S401, obtain the port region information in each second test protocol frame corresponding to the matching protocol frame;

[0090] S402, obtain the port types of the corresponding second test protocol frames according to the port region information;

[0091] S403. Determine the malicious possibility of each second test protocol frame respectively by using the number of the first frames of the first test protocol frame, the number of the second frames of the second test protocol frame, the port type of each second test protocol frame, and the occurrence frequency of the port number of each second test protocol frame.

[0092] S404. Determine the second test protocol frames with malicious possibility greater than the malicious threshold as malicious information frames.

[0093] S105 may specifically include:

[0094] Connect and debug each first test protocol frame except the malicious information frames according to the corresponding protocol frame sender and the corresponding matching protocol frame, so as to realize multi-protocol communication between the terminal device and the main control system.

[0095] In this embodiment, one matching protocol frame may correspond to multiple second test protocol frames.

[0096] The number of the first frames is the total number of the first test protocol frames, and the number of the second frames is the total number of the second test protocol frames corresponding to the matching protocol frame.

[0097] The port type includes two types: normal port and abnormal port. When the port number is within the preset port range, the corresponding port is a normal port; when the port number is not within the preset port range, the corresponding port is an abnormal port.

[0098] As an example, the server first obtains the port area information corresponding to the second test protocol frame corresponding to the matching protocol frame, and then determines the port number of the second test protocol frame according to the port area information. When the port number is within the range of 0 to 1023, it is determined that the port type of the second test protocol frame is a normal port; when the port number is not within the range of 0 to 1023, it is determined that the port type of the second test protocol frame is an abnormal port.

[0099] Then, count the occurrence frequency of the port number of the second test protocol frame, and divide the occurrence frequency by the number of the first test protocol frames corresponding to the port type to which the port number belongs to obtain the ratio of the frequencies. Then divide the number of the second frames corresponding to the second test protocol frame by the number of the first frames corresponding to the first test protocol frame to obtain the ratio of the frame numbers. Finally, multiply the ratio of the frequencies by the ratio of the frame numbers, and then multiply by the preset malicious value to obtain the malicious possibility of the second test protocol frame.

[0100] Finally, compare the malicious possibility of the second test protocol frame with a preset malicious threshold. In the case where the malicious possibility of the second test protocol frame is greater than the preset malicious threshold, it indicates that the second test protocol frame belongs to a malicious information frame; in the case where the malicious possibility of the second test protocol frame is not greater than the preset malicious threshold, it indicates that the second test protocol frame does not belong to a malicious information frame. Then, filter out the malicious information frames during connection debugging to ensure the smooth progress of the debugging.

[0101] Through this embodiment, by calculating the malicious possibility of the second test protocol frame, it is determined whether the second test protocol frame belongs to a malicious information frame. Filter out the malicious information frames during connection debugging to ensure the smooth progress of the debugging, thereby ensuring the normal communication between the intelligent terminal and the master control device and improving the security of multi-protocol communication.

[0102] As an alternative embodiment, S403 may specifically include:

[0103] Determine the third frame quantity and the initial malicious value matching the port type according to the port type of the second test protocol frame;

[0104] Divide the second frame quantity by the first frame quantity to obtain a first calculated value;

[0105] Divide the frequency of occurrence of the port number of the second test protocol frame by the third frame quantity to obtain a second calculated value;

[0106] Multiply the first calculated value, the second calculated value, and the initial malicious value to obtain the malicious possibility of the second test protocol frame.

[0107] In this embodiment, the third frame quantity is the total quantity of the first test protocol frames with the same port type as the second test protocol frame. For example, if the port type of the second test protocol frame is a normal port, obtain the total quantity of the first test protocol frames with the port type of normal port and determine this quantity as the third frame quantity.

[0108] Each port type corresponds to a preset initial malicious value. For example, if the second test protocol frame belongs to a normal port, its corresponding initial malicious value is 0.3; if the second test protocol frame belongs to an abnormal port, its corresponding initial malicious value is 0.7.

[0109] As an example, the malicious possibility of the second test protocol frame can be determined by the following formula 2:

[0110] Formula 2

[0111] In the formula, represents the malicious possibility of the j-th second test protocol frame corresponding to the n-th matching protocol frame, Indicates the second frame count of the second test protocol frame corresponding to the nth matching protocol frame. Indicates that the second frame counts of the second test protocol frames corresponding to each matching protocol frame are accumulated, which is the first frame count of the first test protocol frame, and N represents the number of matching protocol frames. Indicates the initial malicious value of the jth second test protocol frame corresponding to the nth matching protocol frame. Indicates the frequency of occurrence of the port number of the jth second test protocol frame corresponding to the nth matching protocol frame. Indicates the third frame count that matches the port type of the jth second test protocol frame corresponding to the nth matching protocol frame.

[0112] Among them, The larger the value of, the more the second test protocol frame corresponding to the nth matching protocol frame is among all the matching protocol frames, and the more frequent the protocol communication frequency of the corresponding matching protocol frame is. The larger the value of, the more times the port number of the jth second test protocol frame corresponding to the nth matching protocol frame appears, and the greater its malicious possibility.

[0113] The malicious possibility of the jth second test protocol frame corresponding to the nth matching protocol frame The larger it is, the greater the risk that the jth second test protocol frame corresponding to the nth matching protocol frame is an abnormal Trojan information frame. At this time, it is more necessary to avoid communication between it and the master control system.

[0114] Through this embodiment, by accurately calculating the malicious possibility of the second test protocol frame, the risk that the second test protocol frame is a malicious information frame can be accurately evaluated. Thus, it can ensure that malicious information frames are screened out in a timely manner during connection debugging to ensure the smooth progress of debugging, ensure normal communication between the intelligent terminal and the master control device, and improve the security of multi-protocol communication.

[0115] As an alternative embodiment, as Figure 5 shown, before S104, this multi-protocol intelligent recognition terminal direct communication method may further include S501 - S506:

[0116] S501, comparing the maximum structural similarity with the lowest similarity threshold to obtain a similarity comparison result;

[0117] S502, when the similarity comparison result indicates that the maximum structural similarity is less than the lowest similarity threshold, determining that the first test protocol frame is an unmatched test frame;

[0118] S503, calculating the frame structure consistency between each unmatched test frame according to the frame lengths of the unmatched test frames;

[0119] S504. Cluster each unmatched test frame according to the frame structure consistency to obtain at least one cluster of unmatched test frames;

[0120] S505. When the cluster of unmatched test frames meets the preset cluster anomaly condition, determine each unmatched test frame in the cluster of unmatched test frames as an abnormal test frame;

[0121] S506. When the cluster of unmatched test frames does not meet the preset cluster anomaly condition, perform connection debugging on each unmatched test frame in the cluster of unmatched test frames.

[0122] In this embodiment, the preset cluster anomaly condition is a condition preset for determining whether the cluster of unmatched test frames is abnormal. For example, the preset cluster anomaly condition may be that when the number of unmatched test frames in the cluster is greater than half of the total number of all unmatched test frames, it indicates that the unmatched test frames in this cluster are test frames with a relatively high communication frequency, and they are marked as abnormal test frames.

[0123] As an example, after the server obtains the structural similarity of each verification protocol frame corresponding to the first test protocol frame, it will also compare the maximum structural similarity with the lowest similarity threshold. If even the maximum structural similarity is less than the lowest similarity threshold, it indicates that the first test protocol frame does not match any of the verification protocol frames, and it may be a protocol set by the user or an abnormal information frame. At this time, it is first marked as an unmatched test frame.

[0124] Then, the server obtains the frame structure consistency between each unmatched test frame according to the frame length of each unmatched test frame. Specifically, the corresponding frame structure consistency is matched according to the absolute value of the difference in frame length between two unmatched test frames. The smaller the absolute value of the difference in frame length between two unmatched test frames, the greater the corresponding frame structure consistency.

[0125] Then, use the K - means method to cluster all the unmatched test frames according to the corresponding frame structure consistency. If the number of unmatched test frames in a certain cluster after clustering is greater than half of the total number of all unmatched test frames, then determine each unmatched test frame in this cluster as an abnormal test frame; if the number of unmatched test frames in a certain cluster after clustering is less than or equal to half of the total number of all unmatched test frames, then construct the corresponding protocol frame and device according to the corresponding features for connection testing, and save the structure of this unmatched test frame in the protocol library.

[0126] In this embodiment, for each unmatched test frame, the frame structure consistency between each unmatched test frame is calculated according to the corresponding frame length. Then clustering is performed according to the frame structure consistency, so as to determine whether each unmatched test frame is an abnormal test frame. Connectivity tests are performed on each unmatched test frame that does not belong to an abnormal test frame, and its structure is stored in the protocol library. The communication protocols in the protocol library can be enriched, thereby expanding the communication methods of the communication system.

[0127] As an alternative embodiment, the unmatched test frames include a first unmatched test frame and a second unmatched test frame;

[0128] S503 may specifically include:

[0129] Take the difference between the frame length of the first unmatched test frame and the frame length of the second unmatched test frame to obtain the absolute value of the frame length difference;

[0130] According to the absolute value of the frame length difference, obtain the frame structure consistency between the first unmatched test frame and the second unmatched test frame.

[0131] In this embodiment, the frame structure consistency can be determined by the following formula 3:

[0132] Formula 3

[0133] In the formula, represents the frame structure consistency between the a-th first unmatched test frame and the b-th second unmatched test frame, represents the frame length of the a-th first unmatched test frame, represents the frame length of the b-th second unmatched test frame.

[0134] Among them, represents the absolute value of the frame length difference between the a-th first unmatched test frame and the b-th second unmatched test frame. The smaller the frame length difference, the greater the frame structure consistency between the two unmatched test frames.

[0135] The frame structure consistency between the a-th first unmatched test frame and the b-th second unmatched test frame is greater, then the a-th first unmatched test frame and the b-th second unmatched test frame are more likely to belong to the same cluster of unmatched test frames.

[0136] In this embodiment, according to the frame length of the first unmatched test frame and the frame length of the second unmatched test frame, the frame structure consistency between the first unmatched test frame and the second unmatched test frame is calculated. Thus, clustering can be performed using the frame structure consistency, which helps to accurately determine whether each unmatched test frame belongs to an abnormal test frame subsequently, thereby improving the security of communication between the terminal device and the main control system.

[0137] Multi - protocol intelligent recognition terminal direct connection communication method. Correspondingly, the present invention also provides a specific embodiment of a multi - protocol intelligent recognition terminal direct connection communication system.

[0138] The multi - protocol intelligent recognition terminal direct connection communication system specifically includes a terminal device, a main control system, and a controller;

[0139] The terminal device is used to communicate with the main control system;

[0140] The main control system is used to communicate with the terminal device;

[0141] The controller is connected to the terminal device and the main control system, and is used to execute the multi - protocol intelligent recognition terminal direct connection communication method provided in any one of the above aspects.

[0142] In this embodiment, the terminal device and the main control system establish a connection with each other, so as to realize the communication between the terminal device and the main control system. The controller establishes connections with the terminal device and the main control system respectively to send control signals to the terminal device and the main control system, so as to execute the multi - protocol intelligent recognition terminal direct connection communication method provided in any one of the above aspects.

[0143] It should be clear that the present invention is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, the detailed descriptions of known methods are omitted here. In the above - mentioned embodiments, several specific steps are described and shown as examples.

[0144] It should also be noted that in the exemplary embodiments mentioned in the present invention, some methods or systems are described based on a series of steps or devices. However, the present invention is not limited to the order of the above - mentioned steps, that is, the steps can be executed in the order mentioned in the embodiments, or different from the order in the embodiments, or several steps can be executed simultaneously.

[0145] As mentioned above, only the specific embodiments of the present invention are described. Those skilled in the art can clearly understand that for the convenience and brevity of description, the specific working processes of the systems, modules, and units described above can refer to the corresponding processes in the foregoing method embodiments, and will not be repeated here. It should be understood that the protection scope of the present invention is not limited thereto. Any person skilled in the art within the technical scope disclosed by the present invention can easily think of various equivalent modifications or substitutions, and these modifications or substitutions should all be covered within the protection scope of the present invention.

Claims

1. A multi-protocol intelligent identification terminal direct communication method, characterized in that: The method comprises: Obtaining a reliability type of each first test protocol frame of a terminal device, where the first test protocol frame is a test frame corresponding to each communication protocol in the terminal device; Grouping each of the first test protocol frames according to a corresponding reliability type to obtain at least one protocol frame set; For each of the first test protocol frames in the protocol frame set, respectively calculating the structural similarity between the first test protocol frame and each corresponding verification protocol frame in the protocol library of the main control system, and the reliability type of the verification protocol frame matches the reliability type of the protocol frame set; Sort the verification protocol frames corresponding to the first test protocol frame in order of the size of the structural similarity, and determine the verification protocol frame with the greatest structural similarity as the matching protocol frame corresponding to the first test protocol frame; Connect and debug each of the first test protocol frames according to the corresponding protocol frame sending end and the corresponding matching protocol frame to achieve multi-protocol communication between the terminal device and the main control system; After sorting the verification protocol frames corresponding to the first test protocol frame in order of the size of the structural similarity and determining that the verification protocol frame with the greatest structural similarity is the matching protocol frame corresponding to the first test protocol frame, the method further includes: Obtaining port area information in each second test protocol frame corresponding to the matching protocol frame; According to each of the port area information, obtain the corresponding port type of each of the second test protocol frames; Determine the malicious possibility of each of the second test protocol frames respectively by using the number of first frames of the first test protocol frames, the number of second frames of the second test protocol frames, the port type of each of the second test protocol frames, and the frequency of occurrence of the port number of each of the second test protocol frames; Determine the second test protocol frame whose malicious possibility is greater than the malicious threshold as a malicious information frame; The step of connecting and debugging each of the first test protocol frames according to the corresponding protocol frame sending end and the corresponding matching protocol frame to realize multi-protocol communication between the terminal device and the main control system includes: Connect and debug each of the first test protocol frames except the malicious information frame according to the corresponding protocol frame sending end and the corresponding matching protocol frame to achieve multi-protocol communication between the terminal device and the main control system; The method of using the number of first frames of the first test protocol frames, the number of second frames of the second test protocol frames, the port type of each of the second test protocol frames, and the frequency of occurrence of the port number of each of the second test protocol frames to respectively determine the malicious possibility of each of the second test protocol frames, includes: Determine, according to the port type of the second test protocol frame, the number of third frames matching the port type and an initial malicious value matching the port type; Dividing the second frame quantity by the first frame quantity to obtain a first calculated value; Divide the frequency of occurrence of the port number of the second test protocol frame by the number of the third frames to obtain a second calculated value; The first calculated value, the second calculated value, and the initial malicious value are multiplied to obtain the malicious possibility of the second test protocol frame.

2. The multi-protocol intelligent identification terminal direct communication method according to claim 1, characterized in that: The obtaining the reliability type of each first test protocol frame of the terminal device includes: Sending a type identification signal to the terminal device so that the terminal device sends each of the first test protocol frames to the main control system; In response to the terminal device receiving the confirmation frame fed back by the main control system, determining the reliability type of each of the first test protocol frames corresponding to the confirmation frame as a reliable protocol; The reliability type of each of the first test protocol frames except the reliable protocol is determined as an unreliable protocol.

3. The multi-protocol intelligent identification terminal direct communication method according to claim 1, characterized in that: The calculating, for each of the first test protocol frames in the protocol frame set, the structural similarity between the first test protocol frame and each corresponding verification protocol frame in the protocol library of the main control system includes: Divide the verification protocol frame into regions according to the corresponding protocol structure to obtain N verification regions corresponding to the verification protocol frame, where N is a positive integer; Divide the first test protocol frame into regions according to the same protocol division method as the verification protocol frame, to obtain N test regions corresponding to the first test protocol frame; Matching each of the test areas with the corresponding verification area to obtain a successfully matched matching area in each of the test areas; The structural similarity between the first test protocol frame and the verification protocol frame is determined by using each of the matching regions.

4. The multi-protocol intelligent identification terminal direct communication method according to claim 3, characterized in that: Before dividing the first test protocol frame into regions according to the same protocol division method as the verification protocol frame to obtain N test regions corresponding to the first test protocol frame, the method further includes: Obtaining the number of protocol frame bytes of the first test protocol frame; Compare the number of protocol frame bytes of the first test protocol frame with the number of header bytes of the verification protocol frame to obtain a byte comparison result; When the byte comparison result indicates that the number of bytes of the protocol frame is less than the number of bytes of the header, it is determined that the structural similarity between the first test protocol frame and the verification protocol frame is a preset similarity threshold.

5. The multi-protocol intelligent identification terminal direct communication method according to claim 3, characterized in that: The using each of the matching regions to determine the structural similarity between the first test protocol frame and the verification protocol frame includes: Sort the matching regions in order of their corresponding region numbers to obtain a matching region sequence; Accumulating the serial number differences between two adjacent matching regions in the matching region sequence to obtain a serial number difference cumulative value; Dividing the number of matching regions by N to obtain a region number ratio; According to the accumulated value of the number differences and the ratio of the number of regions, the structural similarity between the first test protocol frame and the verification protocol frame is obtained.

6. The multi-protocol intelligent identification terminal direct communication method according to any one of claims 1 to 5, characterized in that: Before sorting the verification protocol frames corresponding to the first test protocol frame in order of the size of the structural similarity and determining that the verification protocol frame with the greatest structural similarity is the matching protocol frame corresponding to the first test protocol frame, the method further includes: Comparing the maximum structural similarity with the minimum similarity threshold to obtain a similarity comparison result; In a case where the similarity comparison result indicates that the maximum structural similarity is less than a minimum similarity threshold, determining that the first test protocol frame is an unmatched test frame; Calculating the frame structure consistency between the unmatched test frames according to the frame length of each unmatched test frame; Clustering the unmatched test frames according to the frame structure consistency to obtain at least one unmatched test frame cluster; In the case where the unmatched test frame cluster meets a preset cluster abnormality condition, determining each of the unmatched test frames in the unmatched test frame cluster as an abnormal test frame; When the unmatched test frame cluster does not satisfy a preset cluster abnormality condition, connection debugging is performed on each of the unmatched test frames in the unmatched test frame cluster.

7. The multi-protocol intelligent identification terminal direct communication method according to claim 6, characterized in that: The unmatched test frame includes a first unmatched test frame and a second unmatched test frame; The calculating, according to the frame length of each of the unmatched test frames, the frame structure consistency between the unmatched test frames comprises: Subtracting the frame length of the first unmatched test frame from the frame length of the second unmatched test frame to obtain an absolute value of the frame length difference; The frame structure consistency between the first non-matching test frame and the second non-matching test frame is obtained according to the absolute value of the frame length difference.

8. A multi-protocol intelligent identification terminal direct communication system, characterized in that: The system includes a terminal device, a main control system and a controller; The terminal device is used to communicate with the main control system; The main control system is used to communicate with the terminal device; The controller is connected to the terminal device and the main control system, and is used to execute the multi-protocol intelligent identification terminal direct communication method described in any one of claims 1 to 7.

Images