Information interaction method based on DPI deep packet analysis

Abstract

The invention relates to the technical field of deep packet inspection, in particular to an information interaction method based on DPI deep packet analysis. Comprising the steps of classifying data streams and determining an analysis mode according to a classification result. According to the method, the network flow of the power system is automatically monitored in real time, different analysis modes are determined according to the classification result of the data flow, abnormal state analysis is carried out on the second-class data flow, the telemetry signals are extracted, feature recognition is carried out on the telemetry signals, whether abnormal features exist or not is analyzed, and if the abnormality is not recognized, the telemetry signals are extracted. If yes, analyzing the actual parameters of the associated power supply module to verify the feature recognition result of the telemetry signal and determine whether to intercept the second-class data flow, thereby effectively preventing potential security risks, improving the monitoring and analysis efficiency of the data flow in the power network, ensuring the security and reliability of the network flow, and improving the safety and reliability of the network flow. Potential abnormities or attacks can be found and responded in time, and the network security protection capability of the power system is enhanced.

Description

Technical Field

[0001] The present invention relates to the technical field of deep packet inspection, and in particular to an information interaction method based on DPI deep packet analysis. Background Art

[0002] As a key national infrastructure, the power system is not only related to the national economic security, but also closely related to people's lives and social stability. In recent years, with the proposal of the "carbon peak and carbon neutrality" goals and the widespread access to large-scale new energy grid connection, new energy storage, and adjustable loads, the system structure and form of the power system are undergoing profound changes. Compared with the traditional power system, the system structure of the new power system is more complex, and the production organization model tends to be "integrated and interactive" between source, grid, load and storage. Digitalization is an important support for the construction and development of the new power system. Relying on the support of various digital platforms, the new power system realizes the coordinated operation and intelligent interaction of all links of source, grid, load and storage, and the integration of energy flow, business flow, and data flow. The degree of openness is constantly improving, the participating subjects are more diversified, the interaction mode is more intelligent, and the integrated data is richer, which also brings more network security risks to the new power system. The network security risks originating from terminal equipment, network equipment, and digital platforms are easily transmitted to the power system itself, thereby causing major security incidents. While the new power system is booming, the network security situation at home and abroad is also undergoing tremendous and profound changes.

[0003] DPI technology is a traffic detection and control technology based on the application layer, called "deep packet inspection". The so-called "depth" is compared with the ordinary message analysis level. Ordinary message detection only analyzes the content below the 4th layer of the IP packet, including the source address, destination address, source port, destination port and protocol type.

[0004] The patent document with authorization announcement number CN111371655B discloses a deep message detection method, DPI equipment, transfer equipment, system and storage medium. The deep message detection method is applied to the deep message detection DPI equipment, including: receiving user messages sent by the transfer equipment; wherein the transfer equipment includes a broadband access server BRAS corresponding to the fixed network and a user plane function UPF network element corresponding to the mobile network; when it is determined that the user message does not exceed the traffic threshold, the user message is parsed to obtain the DPI parsing result; the DPI parsing result is sent to the transfer equipment; it can be seen that in the existing power system monitoring technology, there is a lack of clear judgment standards and indicators for data flows, and attack events are difficult to capture quickly in massive historical data, resulting in low transmission efficiency of data flows. Summary of the invention

[0005] To this end, the present invention provides an information interaction method based on DPI deep packet analysis to overcome the problem in the prior art that there is a lack of telemetry signal characteristics for analyzing the working status of the associated power module, resulting in failure to timely discover intrusion risks and causing low monitoring efficiency.

[0006] To achieve the above-mentioned object, the present invention provides an information interaction method based on DPI deep packet analysis, including detecting a control data flow passing through a power network within a preset time period, generating a flow file, parsing the flow file, and obtaining a number of initial association tables, wherein the flow file includes a number of data messages; Matching each of the initial association tables with the data streams respectively to classify the data streams to obtain classification results, wherein the classification results are divided into a first-class data stream and a second-class data stream; Determining a parsing mode according to the classification result of the data stream, the parsing mode including protocol deep packet parsing and abnormal state parsing; wherein, a response identification is performed on a data message corresponding to the type of data stream, and when the target detection device receives a response frame corresponding to the query request, a protocol deep packet analysis is performed on the type of data stream; Performing abnormal state analysis on the data packets corresponding to the second type of data flow to extract telemetry signals, and performing feature recognition and verification on the telemetry signals to determine whether to intercept the second type of data flow; The control data stream is replayed and analyzed, and the analysis result is output.

[0007] Further, responding to and identifying the data message corresponding to the type of data flow includes: Send the data message to the target detection device through a query request, perform response identification and determination on the target detection device after a standard response time, and if the target detection device receives a response frame corresponding to the query request, perform protocol deep packet analysis on the data stream of the first type; If the target detection device does not receive a response frame corresponding to the query request, it determines that the type of data flow is abnormal, and intercepts the type of data flow.

[0008] Further, the protocol deep packet analysis is performed on the data stream of the type, or the playback analysis is performed on the control data stream, and the output analysis results include: Splitting the data stream according to a preset step size, deleting all zero bytes, and obtaining a plurality of data elements; Linking the data elements, constructing a feature tree and creating an index; The feature tree is traversed according to the pointer, and the parsing result is output.

[0009] Further, matching each of the association tables with the data streams includes: When the information in the data flow matches any entry in the association table and meets the specific protocol characteristics, the data flow is determined to be a type of data flow; When the information in the data flow does not match any of the entries in the association table, the data flow is determined to be a second-class data flow.

[0010] Furthermore, performing feature recognition on the telemetry signal includes: Acquire the real-time duration of the telemetry signal for analysis, and determine the loss of the telemetry signal according to the analysis result; when it is determined that the telemetry signal is not lost, acquire the real-time signal amplitude of the telemetry signal for analysis to analyze the abnormality of the telemetry signal; When a primary identification result is obtained, the real-time power supply temperature is compared with the device temperature threshold to verify the primary identification result and obtain a verification result; Determine whether to intercept the second type of data flow according to the verification result.

[0011] Further, determining the loss of the telemetry signal according to the analysis result includes: Obtaining the real-time duration of the telemetry signal, and determining the real-time duration according to the first preset detection duration and the second preset detection duration, When the real-time continuous duration is less than the first preset detection duration, it is determined that the telemetry signal is completely lost; When the real-time continuous duration is greater than the first preset detection duration and less than the second preset detection duration, it is determined that the telemetry signal is partially lost; When the real-time continuous duration is greater than the second preset detection duration, it is determined that the telemetry signal is not lost, the real-time signal amplitude of the telemetry signal is obtained, and the real-time signal amplitude is determined according to the standard signal amplitude range.

[0012] Further, determining the real-time signal amplitude according to the standard signal amplitude interval includes: If there is a real-time signal amplitude that does not fall into the standard signal amplitude interval, it is determined that the telemetry signal is abnormal, the telemetry signal that does not fall into the standard signal amplitude interval is marked, and the signal to be analyzed is obtained, and the change trend of the signal to be analyzed is analyzed to analyze the cause of the fault; If the real-time signal amplitudes all fall within the standard signal amplitude range, a primary identification result is obtained, and the real-time power supply temperature is obtained for determination to verify the primary identification result; Among them, the primary identification result is that there is no abnormality in the telemetry signal.

[0013] Further, analyzing the change trend of the signal to be analyzed includes: If the signals to be analyzed are all greater than the maximum value of the standard signal amplitude range, it is determined that the power module is damaged; If the signal to be analyzed is smaller than the minimum value of the standard signal amplitude range, it is determined that the external circuit is short-circuited.

[0014] Further, obtaining the real-time power supply temperature for determination includes: If the real-time power supply temperature is less than or equal to the device temperature threshold, it is determined that the primary identification result passes the verification, the second type of data flow is not intercepted, and the second type of data flow is stored as a control data flow; If the real-time power supply temperature is greater than the device temperature threshold, it is determined that the primary identification result has not passed the verification, and the second type of data flow is intercepted.

[0015] Further, the traffic file is parsed to obtain several initial association tables including: Perform DPI deep packet analysis on the traffic file to obtain a number of IP addresses and port information, and insert the IP address and the port information into an association table to form an initial association table.

[0016] Compared with the prior art, the beneficial effect of the present invention lies in that, by automatically monitoring the network traffic of the power system in real time, different parsing modes are determined according to the classification results of the data stream. For a type of data stream, when the target detection device receives the response frame corresponding to the query request, the protocol deep packet parsing is performed, and the header and payload of the data packet are analyzed in detail to identify the protocol type, transport layer information, etc. For the second type of data stream, abnormal state analysis is performed, telemetry signals are extracted, and features of the telemetry signals are identified to analyze whether there are abnormal features. If no abnormality is identified, the actual parameters of the associated power module are analyzed to verify the feature identification results of the telemetry signal to determine whether the second type of data stream is intercepted, effectively preventing potential security risks, improving the monitoring and analysis efficiency of data streams in the power network, ensuring the security and reliability of network traffic, timely discovering and responding to potential anomalies or attacks, and enhancing the network security protection capabilities of the power system.

[0017] Furthermore, by acquiring the characteristics of the telemetry signal for identification to analyze whether there are potential problems in the power system, it can not only assist operation and maintenance personnel to quickly locate the source of the problem and reduce troubleshooting time, but also verify the validity of the signal, identify intrusion risks, and enhance the monitoring ability of the system status. When no abnormal characteristics are found in the telemetry signal, the temperature data of the power module is associated to verify the actual working status of the power module, capture malicious attacks against the power monitoring system, and ensure the safe and stable operation of the power system. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1A schematic diagram of a flow chart of an information interaction method based on DPI deep packet parsing according to an embodiment of the present invention; Figure 2 A logical decision diagram for classifying the data stream according to an embodiment of the present invention; Figure 3 A logic decision diagram for performing feature recognition on the telemetry signal according to an embodiment of the present invention; Figure 4 This is a logic decision diagram for verifying the telemetry signal according to an embodiment of the present invention. DETAILED DESCRIPTION

[0019] In order to make the objects and advantages of the present invention more clearly understood, the present invention is further described below in conjunction with embodiments; it should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0020] The preferred embodiments of the present invention are described below with reference to the accompanying drawings. It should be understood by those skilled in the art that these embodiments are only used to explain the technical principles of the present invention and are not intended to limit the protection scope of the present invention.

[0021] It should be noted that, in the description of the present invention, terms such as "up", "down", "left", "right", "inside" and "outside" indicating directions or positional relationships are based on the directions or positional relationships shown in the drawings. This is merely for the convenience of description and does not indicate or imply that the device or element must have a specific orientation, be constructed and operated in a specific orientation. Therefore, it cannot be understood as a limitation on the present invention.

[0022] In addition, it should be noted that in the description of the present invention, unless otherwise clearly specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two components. For those skilled in the art, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0023] See also Figure 1 As shown, it is a flow chart of an information interaction method based on DPI deep packet analysis according to an embodiment of the present invention. The present invention provides an information interaction method based on DPI deep packet analysis, including: Step S1, detecting a control data flow passing through the power network within a preset time period, generating a flow file, parsing the flow file, and obtaining a number of initial association tables, wherein the flow file includes a number of data messages; Step S2, matching each of the initial association tables with the data streams respectively to classify the data streams to obtain classification results, wherein the classification results are divided into a first-class data stream and a second-class data stream; Step S3, determining a parsing mode according to the classification result of the data stream, wherein the parsing mode includes protocol deep packet parsing and abnormal state parsing; wherein, a response identification is performed on a data message corresponding to the type of data stream, and when the target detection device receives a response frame corresponding to the query request, a protocol deep packet analysis is performed on the type of data stream; Performing abnormal state analysis on the data packets corresponding to the second type of data flow to extract telemetry signals, and performing feature recognition and verification on the telemetry signals to determine whether to intercept the second type of data flow; Step S4, replay and analyze the control data stream and output the analysis result.

[0024] In this embodiment, the network traffic of the power system is automatically monitored in real time, and different parsing modes are determined according to the classification results of the data stream. For a type of data stream, when the target detection device receives a response frame corresponding to a query request, a protocol deep packet parsing is performed, and the header and payload of the data packet are analyzed in detail to identify the protocol type, transport layer information, etc. For the second type of data stream, abnormal state analysis is performed, telemetry signals are extracted, and features of the telemetry signals are identified to analyze whether there are abnormal features. If no abnormality is identified, the actual parameters of the associated power module are analyzed to verify the feature identification results of the telemetry signals to determine whether the second type of data stream is intercepted, thereby effectively preventing potential security risks, improving the monitoring and analysis efficiency of data streams in the power network, ensuring the security and reliability of network traffic, timely discovering and responding to potential anomalies or attacks, and enhancing the network security protection capabilities of the power system.

[0025] Use DPI technology to conduct in-depth analysis of network traffic, identify and classify each network traffic data packet from layer 2 to layer 7, implement analysis of application layer protocols, and accurately match traffic features through methods such as feature recognition and regular expressions to improve recognition performance.

[0026] Specifically, responding and identifying the data message corresponding to the type of data flow includes: Send the data message to the target detection device through a query request, perform response identification and determination on the target detection device after a standard response time, and if the target detection device receives a response frame corresponding to the query request, perform protocol deep packet analysis on the data stream of the first type; If the target detection device does not receive a response frame corresponding to the query request, it determines that the type of data flow is abnormal, and intercepts the type of data flow.

[0027] In this embodiment, the standard response time is the actual response time with the longest response delay in the target detection device. Generally, the standard response time is set between 50ms and 60ms and is selected according to the characteristics of the actual target detection device.

[0028] If no corresponding response frame is detected within the set time, it is determined that an abnormal situation occurs and the corresponding type of data flow is intercepted in time.

[0029] Specifically, the protocol deep packet analysis is performed on the data stream of the type, or the playback analysis is performed on the control data stream, and the output analysis results include: Splitting the data stream according to a preset step size, deleting all zero bytes, and obtaining a plurality of data elements; Linking the data elements, constructing a feature tree and creating an index; The feature tree is traversed according to the pointer, and the parsing result is output.

[0030] In this embodiment, the preset step size is set to 1 byte or 2 bytes; a feature tree is constructed by protocol filtering rules, communication node protocol types, protocol affiliations, and application layer data extraction rules; a steering function, an invalidation function, and an output function are introduced to convert the string in the parsing rule base into a finite state machine mode; the three functions defined in the preprocessing stage are used to cross-compare the data packets to locate the position of the protocol parsing rule field in the data packet; the comparison process is performed through a deep traversal search through a goto special function; if the parsing rule fails, a jump match is performed through an invalidation function, and the matching result is output through a final output function; wherein, the filtering rule The attributes include physical address, communication address, port and protocol, which are used to identify key segments of industrial control protocols and detect the integrity of data packets; the protocol subordination description is established based on the TCP / IP five-layer model, and each layer has a corresponding subordinate protocol. The protocol application layer data extraction is based on the fixed format of the protocol to extract data fields such as function codes and address codes to achieve the correspondence between instruction semantics and operation instructions; the redirection function and invalidation function are used to jump to the matching position when the parsing rule match fails, including re-identification, port number identification, protocol identification and protocol ID judgment; the output function returns the corresponding protocol rule string data after a successful match.

[0031] Through efficient indexing and retrieval technology of traffic files, we can quickly capture attack events in massive historical data. By utilizing efficient indexing and retrieval technology of PB-level traffic files, we can capture a single attack event in about 50TB of traffic in seconds. Based on two-level indexing technology, we greatly improve data retrieval capabilities. For any five-tuple query, we can locate the corresponding L2 index through the L1 index, and search the accompanying index for retrieval to query all specified data streams.

[0032] Specifically, the traffic file is parsed to obtain several initial association tables including: Perform DPI deep packet analysis on the traffic file to obtain a number of IP addresses and port information, and insert the IP address and the port information into an association table to form an initial association table.

[0033] See also Figure 2 As shown, it is a logical decision diagram for classifying the data stream according to an embodiment of the present invention; Specifically, matching each of the association tables with the data streams includes: When the information in the data flow matches any entry in the association table and meets the specific protocol characteristics, the data flow is determined to be a type of data flow; When the information in the data flow does not match any of the entries in the association table, the data flow is determined to be a second-class data flow.

[0034] In this embodiment, the control data flow of a specific application protocol is parsed through the identification technology of the application layer gateway, and the association table is used to match and manage the data flow; the application layer gateway is a network device or software that works at the application layer of the OSI model and is used to monitor and control the data flow in and out of the network. A multi-channel protocol refers to a protocol that can run on multiple communication channels, such as FTP (File Transfer Protocol), SIP (Session Initiation Protocol), H.323 (a voice and video communication protocol), MSN (Microsoft Network Service, an instant messaging protocol), etc. ALG understands the behavior of the application by parsing the control data flow of these protocols. The control data flow usually contains the instructions and parameters required to set up communication. The IP address and port information obtained by parsing are inserted into an association table. This association table is a key data structure used by ALG to track and manage data flows, monitor the next input system data flow in real time, and match it with the information in the association table to identify the data flow that conforms to the specific protocol as a type of data flow.

[0035] By identifying and distinguishing different types of data flows, it can effectively identify and control data flows.

[0036] See also Figure 3 As shown, it is a logical decision diagram for feature recognition of the telemetry signal according to an embodiment of the present invention; Specifically, the feature recognition of the telemetry signal includes obtaining the real-time duration of the telemetry signal for analysis, and determining the loss of the telemetry signal according to the analysis result; when it is determined that the telemetry signal is not lost, obtaining the real-time signal amplitude of the telemetry signal for analysis to analyze the abnormality of the telemetry signal; When a primary identification result is obtained, the real-time power supply temperature is compared with the device temperature threshold to verify the primary identification result and obtain a verification result; Determine whether to intercept the second type of data flow according to the verification result.

[0037] Telemetering data is a signal used to indicate the status of equipment in the monitoring system, such as the status of a circuit breaker. In this embodiment, the characteristics of the telemetry signal are obtained for identification to analyze whether there are potential problems in the power system. This can not only assist operation and maintenance personnel in quickly locating the source of the problem and reducing troubleshooting time, but also verify the validity of the signal, identify intrusion risks, and enhance the monitoring capability of the system status. When no abnormal characteristics are found in the telemetry signal, the temperature data of the power module is associated to verify the actual working status of the power module, capture malicious attacks against the power monitoring system, and ensure the safe and stable operation of the power system.

[0038] Specifically, the loss of the telemetry signal is determined according to the analysis result, including: Obtaining the real-time duration of the telemetry signal, and determining the real-time duration according to the first preset detection duration and the second preset detection duration, When the real-time continuous duration is less than the first preset detection duration, it is determined that the telemetry signal is completely lost; When the real-time continuous duration is greater than the first preset detection duration and less than the second preset detection duration, it is determined that the telemetry signal is partially lost; When the real-time continuous duration is greater than the second preset detection duration, it is determined that the telemetry signal is not lost, the real-time signal amplitude of the telemetry signal is obtained, and the real-time signal amplitude is determined according to the standard signal amplitude range.

[0039] In this embodiment, the first preset detection duration is close to zero, and the second preset detection duration is close to the duration of the preset time period, which is set between several seconds and several minutes, and is selected and adjusted according to the system detection requirements.

[0040] By determining the real-time duration of the telemetry signal, if the real-time duration is less than the first preset detection duration, it means that the telemetry signal is interrupted and completely lost. This is caused by component damage. If the real-time duration is greater than the first preset detection duration and less than the second preset detection duration, it means that the external power supply is short-circuited, causing signal loss. If the real-time duration is greater than the second preset detection duration, it means that the telemetry signal is not lost. The cause of the fault cannot be simply determined based on the continuous duration of the signal. It is necessary to determine it by analyzing the amplitude characteristics of the telemetry signal. By analyzing the abnormal characteristics of the telemetry signal, potential problems can be identified in a timely manner to enhance the monitoring capability of the system status.

[0041] Specifically, judging the real-time signal amplitude according to the standard signal amplitude interval includes: If there is a real-time signal amplitude that does not fall into the standard signal amplitude interval, it is determined that the telemetry signal is abnormal, the telemetry signal that does not fall into the standard signal amplitude interval is marked, and the signal to be analyzed is obtained, and the change trend of the signal to be analyzed is analyzed to analyze the cause of the fault; If the real-time signal amplitudes all fall within the standard signal amplitude range, a primary identification result is obtained, and the real-time power supply temperature is obtained for determination to verify the primary identification result; Among them, the primary identification result is that there is no abnormality in the telemetry signal.

[0042] The standard signal amplitude range set in this embodiment is affected by the type of telemetry signal. For example, if the telemetry signal is a power signal with a rated power of 1000W, the standard signal amplitude range is [700W, 1300W]; if the telemetry signal is a current signal with a rated current of 10A, the standard signal amplitude range is [5A, 15A]; if the telemetry signal is a voltage signal with a standard voltage of 220V, the standard signal amplitude range is [176V, 264V], and is selected and adjusted according to the type, characteristics, and monitoring requirements of the actual monitored equipment.

[0043] Specifically, analyzing the change trend of the signal to be analyzed includes: If the signals to be analyzed are all greater than the maximum value of the standard signal amplitude range, it is determined that the power module is damaged; If the signal to be analyzed is smaller than the minimum value of the standard signal amplitude range, it is determined that the external circuit is short-circuited.

[0044] See also Figure 4 As shown, it is a logic decision diagram for verifying the telemetry signal according to an embodiment of the present invention; Specifically, obtaining the real-time power supply temperature for determination includes: If the real-time power supply temperature is less than or equal to the device temperature threshold, it is determined that the primary identification result passes the verification, the second type of data flow is not intercepted, and the second type of data flow is stored as a control data flow; If the real-time power supply temperature is greater than the device temperature threshold, it is determined that the primary identification result has not passed the verification, and the second type of data flow is intercepted.

[0045] In this embodiment, the device temperature threshold is the temperature threshold of the monitored device corresponding to the telemetry signal, which is set to 70° C., and the monitored device is a power module.

[0046] By identifying the abnormal characteristics of the telemetry signal, the cause of the equipment abnormality can be analyzed, and the abnormal data can be quickly and intelligently identified. At the same time, the equipment failure status can be reflected in time. Moreover, when no abnormal characteristics are found in the telemetry signal, the actual working status of the power module is verified by associating the temperature data of the power module, and the validity of the telemetering data is verified. When it is determined that the real-time power supply temperature is greater than the equipment temperature threshold, it means that the working status of the power module is abnormal, and the telemetry signal has not identified abnormal characteristics. At this time, there is an intrusion risk, and the staff needs to check on site to capture and respond to malicious attacks on the power monitoring system in time to maintain the stability of the system.

[0047] So far, the technical solutions of the present invention have been described in conjunction with the preferred embodiments shown in the accompanying drawings. However, it is easy for those skilled in the art to understand that the protection scope of the present invention is obviously not limited to these specific embodiments. Without departing from the principle of the present invention, those skilled in the art can make equivalent changes or substitutions to the relevant technical features, and the technical solutions after these changes or substitutions will fall within the protection scope of the present invention.

[0048] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. An information interaction method based on DPI deep packet analysis, characterized in that: include, Detecting a control data flow passing through the power network within a preset time period, generating a flow file, parsing the flow file, and obtaining a plurality of initial association tables, wherein the flow file includes a plurality of data messages; Matching each of the initial association tables with the data streams respectively to classify the data streams to obtain classification results, wherein the classification results are divided into a first-class data stream and a second-class data stream; Determining a parsing mode according to the classification result of the data stream, the parsing mode including protocol deep packet parsing and abnormal state parsing; Wherein, a response identification is performed on a data message corresponding to the type of data stream, and when the target detection device receives a response frame corresponding to the query request, a protocol deep packet analysis is performed on the type of data stream; Performing abnormal state analysis on the data packets corresponding to the second type of data flow to extract telemetry signals, and performing feature recognition and verification on the telemetry signals to determine whether to intercept the second type of data flow; The control data stream is replayed and analyzed, and the analysis result is output.

2. The information interaction method based on DPI deep packet analysis according to claim 1 is characterized in that: Responding to and identifying the data packets corresponding to the type of data flow includes: The data message is sent to the target detection device through a query request, and the response identification and determination of the target detection device is performed after a standard response time. If the target detection device receives a response frame corresponding to the query request, performing protocol deep packet analysis on the type of data stream; If the target detection device does not receive a response frame corresponding to the query request, it determines that the type of data flow is abnormal, and intercepts the type of data flow.

3. The information interaction method based on DPI deep packet analysis according to claim 2 is characterized in that: Performing protocol deep packet analysis on the data stream of the type, or performing playback analysis on the control data stream, outputting the analysis results including: Splitting the data stream according to a preset step size, deleting all zero bytes, and obtaining a plurality of data elements; Linking the data elements, constructing a feature tree and creating an index; The feature tree is traversed according to the pointer, and the parsing result is output.

4. The information interaction method based on DPI deep packet analysis according to claim 1 is characterized in that: Matching each of the association tables with the data streams respectively includes, When the information in the data flow matches any entry in the association table and meets the specific protocol characteristics, the data flow is determined to be a type of data flow; When the information in the data stream does not match any of the entries in the association table, the data stream is determined to be a second-class data stream, a telemetry signal is extracted, and feature recognition is performed on the telemetry signal.

5. The information interaction method based on DPI deep packet analysis according to claim 4 is characterized in that: Characterizing and verifying the telemetry signal includes: Obtaining the real-time duration of the telemetry signal for analysis, and determining the loss of the telemetry signal according to the analysis result; When it is determined that the telemetry signal is not lost, obtaining a real-time signal amplitude of the telemetry signal for analysis to analyze an abnormality of the telemetry signal; When a primary identification result is obtained, the real-time power supply temperature is compared with the device temperature threshold to verify the primary identification result and obtain a verification result; Determine whether to intercept the second type of data flow according to the verification result.

6. The information interaction method based on DPI deep packet analysis according to claim 5 is characterized in that: The loss of the telemetry signal determined according to the analysis results includes: Obtaining the real-time duration of the telemetry signal, and determining the real-time duration according to the first preset detection duration and the second preset detection duration, When the real-time continuous duration is less than the first preset detection duration, it is determined that the telemetry signal is completely lost; When the real-time continuous duration is greater than the first preset detection duration and less than the second preset detection duration, it is determined that the telemetry signal is partially lost; When the real-time continuous duration is greater than the second preset detection duration, it is determined that the telemetry signal is not lost, the real-time signal amplitude of the telemetry signal is obtained, and the real-time signal amplitude is determined according to the standard signal amplitude range.

7. The information interaction method based on DPI deep packet analysis according to claim 6 is characterized in that: Determining the real-time signal amplitude according to the standard signal amplitude range includes: If there is a real-time signal amplitude that does not fall into the standard signal amplitude interval, it is determined that the telemetry signal is abnormal, the telemetry signal that does not fall into the standard signal amplitude interval is marked, and the signal to be analyzed is obtained, and the change trend of the signal to be analyzed is analyzed to analyze the cause of the fault; If the real-time signal amplitudes all fall within the standard signal amplitude range, a primary identification result is obtained, and the real-time power supply temperature is obtained for determination to verify the primary identification result; Among them, the primary identification result is that there is no abnormality in the telemetry signal.

8. The information interaction method based on DPI deep packet analysis according to claim 7 is characterized in that: Analyzing the change trend of the signal to be analyzed includes: If the signals to be analyzed are all greater than the maximum value of the standard signal amplitude range, it is determined that the power module is damaged; If the signal to be analyzed is smaller than the minimum value of the standard signal amplitude range, it is determined that the external circuit is short-circuited.

9. The information interaction method based on DPI deep packet analysis according to claim 7 is characterized in that: Obtaining real-time power supply temperature for determination includes: If the real-time power supply temperature is less than or equal to the device temperature threshold, it is determined that the primary identification result passes the verification, the second type of data flow is not intercepted, and the second type of data flow is stored as a control data flow; If the real-time power supply temperature is greater than the device temperature threshold, it is determined that the primary identification result has not passed the verification, and the second type of data flow is intercepted.

10. The information interaction method based on DPI deep packet analysis according to claim 1, characterized in that: Parse the traffic file to obtain several initial association tables including: Perform DPI deep packet analysis on the traffic file to obtain a number of IP addresses and port information, insert the IP address and the port information into an association table to form an initial association table.

Images