An information interaction method based on DPI deep packet analysis

Abstract

The present application relates to the technical field of deep packet inspection, and in particular to a kind of information interaction method based on DPI deep packet analysis.The present application comprises data stream classification, and determines the analysis mode according to the classification result.The present application automatically monitors the network traffic of power system in real time, determines different analysis modes according to the classification result of data stream, analyzes the abnormal state of the second type of data stream, extracts the telemetry signal, identifies the characteristics of the telemetry signal, analyzes whether there are abnormal characteristics, if no abnormality is identified, analyzes the actual parameters of the power supply module to verify the characteristic identification result of the telemetry signal, determines whether to intercept the second type of data stream, effectively prevents potential security risks, improves the monitoring and analysis efficiency of data stream in power network, ensures the security and reliability of network traffic, discovers and responds to potential abnormalities or attacks in a timely manner, and enhances the network security protection capability of power system.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of deep packet detection, and in particular to an information interaction method based on DPI deep packet analysis. BACKGROUND

[0002] As a national critical infrastructure, the power system is not only related to the national economic security, but also closely related to people's life and social stability. In recent years, with the proposal of the "carbon peak and carbon neutral" goal and the large-scale integration of new energy, new energy storage and adjustable load, the system structure and form of the power system are undergoing profound changes. Compared with the traditional power system, the system structure of the new power system is more complex, and the production organization mode tends to be "fusion and interaction of source, network, load and storage". Digitalization is an important support for the construction and development of the new power system. With the support of various digital platforms, the new power system realizes the coordinated operation and intelligent interaction of source, network, load and storage, the multi-flow integration of energy flow, business flow and data flow, the continuous improvement of openness, the diversification of participating subjects, the intelligentization of interaction mode and the richness of fusion data, which also brings more network security risks to the new power system. Network security risks from terminal devices, network devices and digital platforms can easily be transmitted to the power system itself, thereby causing major security incidents. While the new power system is developing rapidly, the network security situation at home and abroad is also undergoing great and profound changes.

[0003] DPI technology is a traffic detection and control technology based on the application layer, known as "deep packet inspection". The so-called "deep" is compared with the ordinary packet analysis level. Ordinary packet detection only analyzes the content below layer 4 of the IP packet, including source address, destination address, source port, destination port and protocol type.

[0004] The patent document with the authorization announcement number CN111371655B discloses a deep packet detection method, a DPI device, a transit device, a system and a storage medium. The deep packet detection method is applied to a deep packet detection DPI device and includes: receiving a user packet sent by a transit device; wherein the transit device includes a broadband access server BRAS corresponding to a fixed network and a user plane function UPF network element corresponding to a mobile network; when it is determined that the user packet does not exceed a traffic threshold, the user packet is parsed to obtain a DPI analysis result; and the DPI analysis result is sent to the transit device. It can be seen that in the existing power system monitoring technology, there is a lack of clear discrimination criteria and indicators for data flow, and it is difficult to quickly capture attack events in massive historical data, resulting in low transmission efficiency of data flow. SUMMARY

[0005] To this end, the application provides an information interaction method based on DPI deep packet analysis, to overcome the problem of lack of correlation power module working state analysis telemetry signal characteristics in the prior art, so that the intrusion risk cannot be discovered in time, resulting in low monitoring efficiency.

[0006] To achieve the above object, the application provides an information interaction method based on DPI deep packet analysis, comprising detecting control data flow passing through a power network in a preset time period, generating a traffic file, analyzing the traffic file to obtain a plurality of initial correlation tables, the traffic file comprising a plurality of data packets;

[0007] Each of the initial correlation tables is matched with the data flow to classify the data flow and obtain a classification result, the classification result being divided into a first type of data flow and a second type of data flow;

[0008] The classification result of the data flow is used to determine an analysis mode, the analysis mode comprising protocol deep packet analysis and abnormal state analysis;

[0009] The data packets corresponding to the first type of data flow are subjected to response identification, and when the target detection device receives a response frame corresponding to the query request, the first type of data flow is subjected to protocol deep packet analysis;

[0010] The data packets corresponding to the second type of data flow are subjected to abnormal state analysis to extract telemetry signals, and the telemetry signals are subjected to feature identification and verification to determine whether to intercept the second type of data flow;

[0011] The control data flow is subjected to playback analysis, and the analysis result is output.

[0012] Further, the response identification of the data packets corresponding to the first type of data flow comprises,

[0013] The data packets are sent to the target detection device through a query request, and the target detection device is subjected to response identification determination after a standard response duration, if the target detection device receives a response frame corresponding to the query request, the first type of data flow is subjected to protocol deep packet analysis;

[0014] If the target detection device does not receive a response frame corresponding to the query request, it is determined that the first type of data flow is abnormal, and the first type of data flow is intercepted.

[0015] Further, the protocol deep packet analysis of the first type of data flow or the playback analysis of the control data flow to output the analysis result comprises,

[0016] The first type of data flow is split at a preset step size, and all zero bytes are deleted to obtain a plurality of data elements;

[0017] linking the data elements, constructing a feature tree, and establishing an index;

[0018] traversing the feature tree according to the pointer, and outputting a parsing result.

[0019] Further, matching each of the association tables with the data stream comprises,

[0020] When the information in the data stream matches any entry in the association table and meets a specific protocol feature, the data stream is determined as a first type of data stream;

[0021] When the information in the data stream does not match any entry in the association table, the data stream is determined as a second type of data stream.

[0022] Further, the feature recognition of the telemetry signal comprises,

[0023] acquiring a real-time duration of the telemetry signal for analysis, determining a loss condition of the telemetry signal according to an analysis result, and when it is determined that the telemetry signal is not lost, acquiring a real-time signal amplitude of the telemetry signal for analysis to analyze an abnormal condition of the telemetry signal;

[0024] when a first recognition result is obtained, comparing a real-time power supply temperature with a device temperature threshold to verify the first recognition result, and obtaining a verification result;

[0025] determining whether to intercept the second type of data stream according to the verification result.

[0026] Further, determining the loss condition of the telemetry signal according to the analysis result comprises,

[0027] acquiring a real-time duration of the telemetry signal, determining the real-time duration according to a first preset detection duration and a second preset detection duration,

[0028] when the real-time duration is less than the first preset detection duration, determining that the telemetry signal is completely lost;

[0029] when the real-time duration is greater than the first preset detection duration and less than the second preset detection duration, determining that the telemetry signal is partially lost;

[0030] when the real-time duration is greater than the second preset detection duration, determining that the telemetry signal is not lost, acquiring a real-time signal amplitude of the telemetry signal, and determining the real-time signal amplitude according to a standard signal amplitude interval.

[0031] Further, determining the real-time signal amplitude according to the standard signal amplitude interval comprises,

[0032] If the real-time signal amplitude does not fall into the standard signal amplitude interval, it is determined that the telemetry signal is abnormal, the telemetry signal not falling into the standard signal amplitude interval is marked to obtain a signal to be analyzed, and the change trend of the signal to be analyzed is analyzed to analyze the fault cause.

[0033] If the real-time signal amplitude falls into the standard signal amplitude interval, a first identification result is obtained, and a real-time power supply temperature is obtained to determine whether the first identification result is verified.

[0034] The first identification result is that the telemetry signal is not abnormal.

[0035] Further, analyzing the change trend of the signal to be analyzed includes,

[0036] If all the signals to be analyzed are greater than the maximum value of the standard signal amplitude interval, it is determined that the power module is damaged.

[0037] If there is a signal to be analyzed that is less than the minimum value of the standard signal amplitude interval, it is determined that the external loop is short-circuited.

[0038] Further, obtaining the real-time power supply temperature to determine includes,

[0039] If the real-time power supply temperature is less than or equal to the equipment temperature threshold, it is determined that the first identification result is verified, the second type of data stream is not intercepted, and the second type of data stream is stored as a control data stream.

[0040] If the real-time power supply temperature is greater than the equipment temperature threshold, it is determined that the first identification result is not verified, and the second type of data stream is intercepted.

[0041] Further, analyzing the change trend of the signal to be analyzed includes,

[0042] The DPI deep packet analysis is performed on the traffic file to obtain a plurality of IP addresses and port information, and the IP addresses and the port information are inserted into an association table to form an initial association table.

[0043] Compared with the prior art, the beneficial effects of the present application are that by automatically monitoring the network traffic of the power system in real time, different analysis modes are determined according to the classification results of the data flow, for a type of data flow, when the target detection device receives the response frame corresponding to the query request, protocol deep packet analysis is performed, the header and payload of the data packet are analyzed in detail to identify the protocol type, transmission layer information, etc., for a type of data flow, abnormal state analysis is performed, telemetry signals are extracted, feature recognition is performed on the telemetry signals, whether there is an abnormal feature is analyzed, if no abnormality is identified, the actual parameters of the power supply module are analyzed to verify the feature recognition result of the telemetry signal, whether the type of data flow is intercepted is determined, potential security risks are effectively prevented, the monitoring and analysis efficiency of the data flow in the power network is improved, the safety and reliability of the network traffic are ensured, potential abnormalities or attacks are discovered and responded in a timely manner, and the network security protection capability of the power system is enhanced.

[0044] Further, by acquiring and recognizing the features of the telemetry signals, whether there is a potential problem in the power system is analyzed, which not only can assist the operation and maintenance personnel to quickly locate the problem source and reduce the troubleshooting time, but also can verify the effectiveness of the signals, identify intrusion risks, enhance the monitoring capability of the system state, and through the correlation of the temperature data of the power supply module when no abnormal feature of the telemetry signal is found, the actual working state of the power supply module is verified, malicious attacks on the power monitoring system are captured, and the safe and stable operation of the power system is ensured. BRIEF DESCRIPTION OF DRAWINGS

[0045] Figure 1 A flowchart of an information interaction method based on DPI deep packet analysis of an embodiment of the present application is shown in the figure;

[0046] Figure 2 A logic decision diagram for classifying the data flow of an embodiment of the present application is shown in the figure;

[0047] Figure 3 A logic decision diagram for feature recognition of the telemetry signal of an embodiment of the present application is shown in the figure;

[0048] Figure 4 A logic decision diagram for verifying the telemetry signal of an embodiment of the present application is shown in the figure. DETAILED DESCRIPTION

[0049] In order to make the purpose and advantages of the present application clearer and more apparent, the present application is further described below in conjunction with embodiments; it should be understood that the specific embodiments described herein are only used to explain the present application and do not limit the present application.

[0050] The preferred embodiments of the present application will be described below with reference to the drawings. Those skilled in the art will appreciate that the embodiments are only used to explain the technical principles of the present application, and are not intended to limit the scope of protection of the present application.

[0051] It should be noted that, in the description of the present application, the terms indicating the direction or positional relationship of "upper", "lower", "left", "right", "inner", "outer" and the like are based on the direction or positional relationship shown in the drawings, which is only for the convenience of description, and does not indicate or imply that the device or element must have a particular orientation, be constructed and operated in a particular orientation, and therefore cannot be understood as a limitation on the present application.

[0052] In addition, it should also be noted that, in the description of the present application, unless otherwise explicitly specified and limited, the terms "mounting", "connecting", "connecting" should be understood broadly, for example, it can be fixedly connected, or it can be detachably connected, or integrally connected; it can be mechanically connected, or it can be electrically connected; it can be directly connected, or it can be indirectly connected through an intermediate medium; it can be the communication inside two elements. Those skilled in the art can understand the specific meaning of the above terms in the present application according to the specific circumstances.

[0053] Please refer to Figure 1 As shown in the figure, it is a flowchart of the information interaction method based on DPI deep packet analysis according to the embodiments of the present application. The present application provides an information interaction method based on DPI deep packet analysis, comprising,

[0054] Step S1, detecting the control data flow passing through the power network in a preset time period, generating a traffic file, and analyzing the traffic file to obtain a plurality of initial association tables, the traffic file comprising a plurality of data packets;

[0055] Step S2, matching each of the initial association tables with the data stream respectively to classify the data stream and obtain a classification result, the classification result being divided into a first type of data stream and a second type of data stream;

[0056] Step S3, determining an analysis mode according to the classification result of the data stream, the analysis mode comprising protocol deep packet analysis and abnormal state analysis;

[0057] Among them, the data packets corresponding to the first type of data stream are subjected to response identification, and when the target detection device receives a response frame corresponding to the query request, the first type of data stream is subjected to protocol deep packet analysis;

[0058] The data packets corresponding to the second type of data stream are subjected to abnormal state analysis to extract a telemetry signal, and the telemetry signal is subjected to feature recognition and verification to determine whether to intercept the second type of data stream;

[0059] Step S4, the control data stream is played back and parsed, and the parsed result is output.

[0060] In this embodiment, by automatically monitoring the network traffic of the power system in real time, different parsing modes are determined according to the classification result of the data stream. For a type of data stream, when the target detection device receives a response frame corresponding to a query request, protocol deep packet parsing is performed, and the header and payload of the data packet are analyzed in detail to identify the protocol type, transport layer information, etc. For a second type of data stream, abnormal state parsing is performed, telemetry signals are extracted, and feature recognition is performed on the telemetry signals to analyze whether there are abnormal features. If no abnormality is identified, the actual parameters of the power supply module are analyzed to verify the feature recognition result of the telemetry signal, and it is determined whether to intercept the second type of data stream. This effectively prevents potential security risks, improves the monitoring and analysis efficiency of data streams in the power network, ensures the security and reliability of network traffic, discovers and responds to potential abnormalities or attacks in a timely manner, and enhances the network security protection capability of the power system.

[0061] Deep analysis of network traffic is performed using DPI technology to identify and classify each network traffic data packet from layer 2 to layer 7, enabling analysis of application layer protocols. Feature recognition and regular expressions are used to accurately match traffic characteristics and improve identification performance.

[0062] Specifically, the response identification of the data message corresponding to the first type of data stream includes,

[0063] The data message is sent to the target detection device through a query request, and response identification is performed on the target detection device after a standard response time. If the target detection device receives a response frame corresponding to the query request, protocol deep packet parsing is performed on the first type of data stream.

[0064] If the target detection device does not receive a response frame corresponding to the query request, it is determined that the first type of data stream is abnormal, and the first type of data stream is intercepted.

[0065] In this embodiment, the standard response time is the longest actual response time of the response delay time in the target detection device. Generally, the standard response time is set between 50ms and 60ms, and is selected according to the characteristics of the actual target detection device.

[0066] If no corresponding response frame is detected within a set time, it is determined that an abnormal situation has occurred, and the corresponding first type of data stream is intercepted in a timely manner.

[0067] Specifically, the protocol deep packet parsing of the first type of data stream, or the playback and parsing of the control data stream, includes,

[0068] Splitting the data stream of the first type by a preset step length, deleting all zero bytes, and obtaining a plurality of data elements;

[0069] Linking the data elements, constructing a feature tree, and establishing an index;

[0070] According to the pointer, traversing the feature tree, and outputting a parsing result.

[0071] In the embodiment, the preset step length is set to 1 byte or 2 bytes; the feature tree is constructed by a protocol filtering rule, a communication node protocol type, a protocol dependency, and an application layer data extraction rule; the string in the parsing rule library is converted into a finite state machine mode by introducing a steering function, a failure function, and an output function; the three functions defined in the preprocessing stage are used to cross-compare the data packet, locate the position of the protocol parsing rule field in the data packet, and perform a deep traversal search through the goto special function; if the parsing rule fails, the failure function is used for jump matching, and the matching result is output by the output function; wherein, the filtering rule attribute includes a physical address, a communication address, a port, and a protocol, which are used to identify the key word segment of the industrial control protocol and detect the integrity of the data packet; the protocol dependency description is established according to the TCP / IP five-layer model, each layer has a corresponding dependent protocol, and the protocol application layer data extraction is based on the fixed format of the protocol to extract data fields such as function code and address code, so as to realize the correspondence between instruction semantics and operation instructions; the steering function and the failure function are used to jump the matching position when the parsing rule fails, including re-identification, port number identification, protocol identification, and protocol ID judgment; the output function returns the corresponding protocol rule string data after successful matching.

[0072] Through the efficient index and retrieval technology of the flow file, the attack event in the massive historical data is quickly captured, the PB-level flow file efficient index and retrieval technology is used, the single attack event capture in about 50 TB flow is completed in seconds, the data retrieval capability is greatly improved based on the two-level index technology, for any five-tuple query, the corresponding L2 index is located through the L1 index, the specified all data streams are queried through the search accompanying index.

[0073] Specifically, the flow file is parsed to obtain a plurality of initial association tables, including,

[0074] The flow file is subjected to DPI deep packet analysis to obtain a plurality of IP addresses and port information, the IP addresses and the port information are inserted into the association table to form the initial association table.

[0075] Referring to Figure 2 Fig. 1 is a logic decision diagram for classifying the data stream according to the embodiment of the application;

[0076] Specifically, matching each of the association tables with the data stream includes,

[0077] When the information in the data stream matches any entry in the association table and meets the specific protocol characteristics, the data stream is determined as a first type of data stream;

[0078] When the information in the data stream does not match any entry in the association table, the data stream is determined as a second type of data stream.

[0079] In the embodiment, the control data stream of a specific application protocol is parsed by using the identification technology of the application layer gateway, and the association table is used to match and manage the data stream. The application layer gateway is a network device or software working in the application layer of the OSI model, which is used to monitor and control the data stream entering and exiting the network. The multi-channel protocol refers to a protocol that can run on multiple communication channels, such as FTP (File Transfer Protocol), SIP (Session Initiation Protocol), H. 323 (a voice and video communication protocol), MSN (Microsoft Network Service, an instant messaging protocol), etc. The ALG understands the behavior of the application program by parsing the control data stream of these protocols. The control data stream usually contains instructions and parameters required for setting up communication. The IP address and port information obtained by parsing are inserted into an association table, which is a key data structure used by the ALG to track and manage data streams. The data stream of the next input system is monitored in real time, and the information in the association table is matched to identify the data stream meeting the specific protocol as a first type of data stream.

[0080] By identifying and distinguishing different types of data streams, effective identification and control of data streams are provided.

[0081] Referring to Figure 3 Fig. 2 shows a logic determination diagram for feature recognition of the telemetry signal according to an embodiment of the present application;

[0082] Specifically, the feature recognition of the telemetry signal includes obtaining and analyzing the real-time continuous duration of the telemetry signal to determine the loss condition of the telemetry signal. When it is determined that the telemetry signal is not lost, the real-time signal amplitude of the telemetry signal is obtained and analyzed to analyze the abnormal condition of the telemetry signal.

[0083] When a first recognition result is obtained, the real-time power supply temperature is compared with the device temperature threshold to verify the first recognition result and obtain a verification result.

[0084] According to the verification result, it is determined whether to intercept the second type of data stream.

[0085] The telesign data is a signal used for indicating the device state in the monitoring system, such as the state of the circuit breaker, and in the embodiment, the telesign signal is identified by acquiring the characteristics to analyze whether there is a potential problem in the power system, which can not only assist the operation and maintenance personnel to quickly locate the problem source and reduce the troubleshooting time, but also enhance the monitoring ability of the system state by verifying the effectiveness of the signal and identifying the intrusion risk, and by correlating the temperature data of the power module when no abnormal characteristics of the telesign signal are found to verify the actual working state of the power module, capture malicious attacks on the power monitoring system, and ensure the safe and stable operation of the power system.

[0086] Specifically, determining the loss of the telesign signal according to the analysis result comprises,

[0087] acquiring the real-time duration of the telesign signal, and determining the real-time duration according to the first preset detection duration and the second preset detection duration,

[0088] when the real-time duration is less than the first preset detection duration, determining that the telesign signal is completely lost;

[0089] when the real-time duration is greater than the first preset detection duration and less than the second preset detection duration, determining that the telesign signal is partially lost;

[0090] when the real-time duration is greater than the second preset detection duration, determining that the telesign signal is not lost, acquiring the real-time signal amplitude of the telesign signal, and determining the real-time signal amplitude according to the standard signal amplitude interval.

[0091] In the embodiment, the first preset detection duration is close to zero, and the second preset detection duration is close to the duration of the preset time period, which is set to be between several seconds and several minutes, and is adaptively selected and adjusted according to the system detection requirement.

[0092] By determining the real-time duration of the telesign signal, if it is determined that the real-time duration is less than the first preset detection duration, it means that the telesign signal is interrupted and completely lost, which is caused by the damage of the component, if it is determined that the real-time duration is greater than the first preset detection duration and less than the second preset detection duration, it means that the external power supply is interrupted, causing the signal loss, and if it is determined that the real-time duration is greater than the second preset detection duration, it means that the telesign signal is not lost, and the fault reason cannot be simply and directly determined according to the continuous duration of the signal, so the amplitude characteristics of the telesign signal need to be determined, the abnormal characteristics of the telesign signal are analyzed, potential problems are identified in time, and the monitoring ability of the system state is enhanced.

[0093] Specifically, determining the real-time signal amplitude according to the standard signal amplitude interval comprises,

[0094] If the real-time signal amplitude does not fall into the standard signal amplitude interval, it is determined that the telemetry signal is abnormal, the telemetry signal not falling into the standard signal amplitude interval is marked to obtain a signal to be analyzed, and the change trend of the signal to be analyzed is analyzed to analyze the fault cause.

[0095] If the real-time signal amplitude falls into the standard signal amplitude interval, a first identification result is obtained, and a real-time power supply temperature is obtained to determine the first identification result.

[0096] The first identification result is that the telemetry signal is not abnormal.

[0097] In the embodiment, the standard signal amplitude interval is affected by the type of the telemetry signal. For example, if the telemetry signal is a power signal, the rated power is 1000W, the standard signal amplitude interval is [700W, 1300W], if the telemetry signal is a current signal, the rated current is 10A, the standard signal amplitude interval is [5A, 15A], and if the telemetry signal is a voltage signal, the standard voltage is 220V, the standard signal amplitude interval is [176V, 264V]. The type, characteristics, and monitoring requirements of the actual monitored device are adjusted according to the actual monitored device.

[0098] Specifically, analyzing the change trend of the signal to be analyzed includes,

[0099] If the signal to be analyzed is greater than the maximum value of the standard signal amplitude interval, it is determined that the power module is damaged.

[0100] If the signal to be analyzed is less than the minimum value of the standard signal amplitude interval, it is determined that the external loop is short-circuited.

[0101] Referring to Figure 4 As shown in the figure, it is a logic determination diagram for verifying the telemetry signal according to the embodiment of the application.

[0102] Specifically, obtaining the real-time power supply temperature to determine includes,

[0103] If the real-time power supply temperature is less than or equal to the device temperature threshold, it is determined that the first identification result is verified, the second data stream is not intercepted, and the second data stream is stored as a control data stream.

[0104] If the real-time power supply temperature is greater than the device temperature threshold, it is determined that the first identification result is not verified, and the second data stream is intercepted.

[0105] In the embodiment, the device temperature threshold is the temperature threshold of the monitored device corresponding to the telemetry signal, which is set to 70℃, and the monitored device is a power module.

[0106] By identifying the abnormal characteristics of the telemetry signal, the abnormal reason of the equipment is analyzed, the rapid intelligent discrimination of the abnormal data is realized, the fault state of the equipment can be reflected in time, and when the abnormal characteristics of the telemetry signal are not found, the actual working state of the power module is verified by associating the temperature data of the power module, the validity of the remote signal data is verified, when the real-time power temperature is greater than the equipment temperature threshold, it indicates that the working state of the power module is abnormal, and the telemetry signal does not identify the abnormal characteristics, at this time, there is an invasion risk, the on-site staff needs to check, capture and deal with the malicious attack on the power monitoring system in time, so as to maintain the stability of the system.

[0107] So far, the technical scheme of the present application has been described in combination with the preferred embodiments shown in the drawings, but those skilled in the art can easily understand that the protection scope of the present application is obviously not limited to these specific embodiments. Those skilled in the art can make equivalent changes or replacements to the related technical features without departing from the principles of the present application, and the technical schemes after the changes or replacements will fall within the protection scope of the present application.

[0108] The above description is only the preferred embodiments of the present application and is not used to limit the present application; for those skilled in the art, the present application can have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. A method for information interaction based on DPI deep packet analysis, characterized in that, The method comprises the following steps: detecting control data flow passing through the power network within a preset time period, generating a traffic file, and parsing the traffic file to obtain a plurality of initial association tables, wherein the traffic file comprises a plurality of data packets; matching each initial association table with a data flow to classify the data flow and obtain a classification result, wherein the classification result is divided into a first type of data flow and a second type of data flow; determining a parsing mode according to the classification result of the data flow, wherein the parsing mode comprises protocol deep packet parsing and abnormal state parsing; wherein, the data packets corresponding to the first type of data flow are subjected to response identification, and when the target detection device receives a response frame corresponding to a query request, the first type of data flow is subjected to protocol deep packet parsing; the data packets corresponding to the second type of data flow are subjected to abnormal state parsing to extract a telemetry signal, and the telemetry signal is subjected to feature identification and verification to determine whether to intercept the second type of data flow; the control data flow is subjected to playback parsing, and the parsing result is output.

2. The information interaction method based on DPI deep packet analysis according to claim 1, characterized in that, The response identification of the data packets corresponding to the first type of data flow comprises: sending the data packets to the target detection device through a query request, and performing response identification determination on the target detection device after a standard response time; if the target detection device receives a response frame corresponding to the query request, the first type of data flow is subjected to protocol deep packet parsing; if the target detection device does not receive a response frame corresponding to the query request, it is determined that the first type of data flow is abnormal, and the first type of data flow is intercepted.

3. The information interaction method based on DPI deep packet analysis according to claim 2, characterized in that, The protocol deep packet parsing of the first type of data flow or the playback parsing of the control data flow to output the parsing result comprises: splitting the first type of data flow by a preset step length, deleting all zero bytes, and obtaining a plurality of data elements; linking the data elements, constructing a feature tree, and establishing an index; traversing the feature tree according to a pointer to output the parsing result.

4. The information interaction method based on DPI deep packet analysis according to claim 1, characterized in that, Matching each association table with a data flow comprises: when the information in the data flow matches any entry in the association table and meets the specific protocol characteristics, it is determined that the data flow is a first type of data flow; when the information in the data flow does not match all entries in the association table, it is determined that the data flow is a second type of data flow, the telemetry signal is extracted, and the telemetry signal is subjected to feature identification.

5. The information interaction method based on DPI deep packet analysis according to claim 4, characterized in that, The feature identification and verification of the telemetry signal comprises: obtaining the real-time duration of the telemetry signal for analysis, and determining the loss of the telemetry signal according to the analysis result; when it is determined that the telemetry signal is not lost, the real-time signal amplitude of the telemetry signal is obtained for analysis to analyze the abnormality of the telemetry signal; when a first identification result is obtained, the real-time power supply temperature is compared with the device temperature threshold to verify the first identification result and obtain a verification result; determining whether to intercept the second type of data flow according to the verification result.

6. The information interaction method based on DPI deep packet analysis according to claim 5, characterized in that, Determining the loss of the telemetry signal according to the analysis result comprises: obtaining the real-time duration of the telemetry signal, and determining the real-time duration according to a first preset detection time and a second preset detection time, when the real-time duration is less than the first preset detection duration, determining that the telemetry signal is completely lost; when the real-time duration is greater than the first preset detection duration and less than the second preset detection duration, determining that the telemetry signal is partially lost; when the real-time duration is greater than the second preset detection duration, determining that the telemetry signal is not lost, obtaining a real-time signal amplitude of the telemetry signal, and determining the real-time signal amplitude according to a standard signal amplitude interval.

7. The information interaction method based on DPI deep packet analysis according to claim 6, characterized in that, The determining the real-time signal amplitude according to the standard signal amplitude interval comprises, if there is a real-time signal amplitude not falling into the standard signal amplitude interval, determining that the telemetry signal is abnormal, marking the telemetry signal not falling into the standard signal amplitude interval as a to-be-analyzed signal, analyzing a change trend of the to-be-analyzed signal to analyze a fault cause; if all the real-time signal amplitudes fall into the standard signal amplitude interval, obtaining a real-time power supply temperature to determine a first identification result, and verifying the first identification result; wherein, the first identification result is that the telemetry signal is not abnormal.

8. The information interaction method based on DPI deep packet analysis according to claim 7, characterized in that, The analyzing the change trend of the to-be-analyzed signal comprises, if all the to-be-analyzed signals are greater than a maximum value of the standard signal amplitude interval, determining that a power module is damaged; if there is a to-be-analyzed signal less than a minimum value of the standard signal amplitude interval, determining that an external loop is short-circuited.

9. The information interaction method based on DPI deep packet analysis according to claim 7, characterized in that, The obtaining the real-time power supply temperature to determine comprises, if the real-time power supply temperature is less than or equal to a device temperature threshold, determining that the first identification result passes the verification, not intercepting the second data stream, and storing the second data stream as a control data stream; if the real-time power supply temperature is greater than the device temperature threshold, determining that the first identification result does not pass the verification, and intercepting the second data stream.

10. The information interaction method based on DPI deep packet analysis according to claim 1, characterized in that, The parsing the flow file to obtain a plurality of initial association tables comprises, performing DPI deep packet analysis on the flow file to obtain a plurality of IP addresses and port information, and inserting the IP addresses and the port information into an association table to form an initial association table.

Images