Abnormal message identification method and device, electronic equipment and storage medium

Abstract

The invention discloses an abnormal message identification method and device, electronic equipment and a storage medium, and the method comprises the steps: setting a plurality of monitoring nodes in a target power line carrier communication network, obtaining n messages based on the plurality of monitoring nodes, determining protocol data corresponding to each message in the n messages, each protocol data comprises a protocol, a protocol source address and a protocol destination address, n messages are classified based on the n protocol data to obtain m classified data, the m classified data are subjected to feature extraction to obtain m feature data sets, and one feature data set corresponds to three feature data; and determining a target abnormal message in the n messages based on the m feature data groups. By adopting the embodiment of the invention, the messages are classified through the protocol data of the messages, and then the abnormal messages are determined according to the classification data, so that the efficiency of identifying the abnormal messages is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of message identification, and in particular to an abnormal message identification method, device, electronic equipment and storage medium. Background Art

[0002] The power line carrier communication network is an indispensable part of the power system. If the messages corresponding to the power line carrier communication network are abnormal, the data collected by the power system will be inaccurate, the monitoring will fail, and it may also cause power equipment failures. Although abnormal messages can be identified at present, the efficiency of identifying abnormal messages is relatively low. Therefore, how to improve the efficiency of identifying abnormal messages is an urgent problem to be solved. Summary of the invention

[0003] The embodiments of the present application provide a method, device, electronic device and storage medium for identifying abnormal messages, which classify messages according to the protocol data of the messages, and then determine the abnormal messages based on the classification data, thereby improving the efficiency of identifying abnormal messages.

[0004] In a first aspect, an embodiment of the present application provides a method for identifying abnormal messages, including:

[0005] Establishing a plurality of monitoring nodes in a target power line carrier communication network;

[0006] Obtain n messages based on multiple monitoring nodes; n is an integer greater than 1; one monitoring node corresponds to multiple messages;

[0007] Determine the protocol data corresponding to each of the n messages to obtain n protocol data; each protocol data includes a protocol, a protocol source address, and a protocol destination address;

[0008] Based on the protocol, the protocol source address, and the protocol destination address corresponding to each of the n protocol data, the n messages are classified to obtain m classified data; m is a positive integer less than or equal to n; and one classified data corresponds to at least one message;

[0009] Extract features from each of the m classified data to obtain m feature data groups;

[0010] A target abnormal message among n messages is determined based on the m feature data groups.

[0011] In a second aspect, an embodiment of the present application provides an abnormal message identification device, the device comprising: an acquisition unit and a processing unit;

[0012] A processing unit, used to establish a plurality of monitoring nodes in a target power line carrier communication network;

[0013] An acquisition unit, used for acquiring n messages based on multiple monitoring nodes; n is an integer greater than 1; one monitoring node corresponds to multiple messages;

[0014] Processing unit for

[0015] Determine the protocol data corresponding to each of the n messages to obtain n protocol data; each protocol data includes a protocol, a protocol source address, and a protocol destination address;

[0016] Based on the protocol, the protocol source address, and the protocol destination address corresponding to each of the n protocol data, the n messages are classified to obtain m classified data; m is a positive integer less than or equal to n; and one classified data corresponds to at least one message;

[0017] Extract features from each of the m classified data to obtain m feature data groups;

[0018] A target abnormal message among n messages is determined based on the m feature data groups.

[0019] In a third aspect, an embodiment of the present invention provides an electronic device, comprising: a processor, a memory, a communication interface, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the processor so that the electronic device executes the method of the first aspect.

[0020] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and the computer program is executed by a processor to implement the method of the first aspect.

[0021] In a fifth aspect, an embodiment of the present invention provides a computer program product, which includes a non-transitory computer-readable storage medium storing a computer program, so that a computer executes the method of the first aspect.

[0022] The implementation of the present invention has the following beneficial effects:

[0023] It can be seen that the abnormal message identification method described in the implementation mode of the present invention first sets up multiple monitoring nodes in the target power line carrier communication network, then obtains n messages based on the multiple monitoring nodes, and then determines the protocol data corresponding to each message in the n messages to obtain n protocol data, each protocol data includes a protocol, a protocol source address, and a protocol destination address, and then classifies the n messages based on the protocol, protocol source address, and protocol destination address corresponding to each protocol data in the n protocol data to obtain m classified data, and then performs feature extraction on each classified data in the m classified data to obtain m feature data groups, and finally determines the target abnormal message in the n messages based on the m feature data groups, thereby improving the efficiency of identifying abnormal messages. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the technical solutions in the implementation methods of the present application or the background technology, the drawings required for use in the implementation methods of the present application or the background technology will be described below.

[0025] Figure 1 It is a flow chart of an abnormal message identification method provided by an embodiment of the present application;

[0026] Figure 2 It is a flow chart of determining a target abnormal message provided by an implementation method of the present application;

[0027] Figure 3 It is a structural diagram of a 376.2 protocol frame format provided in an embodiment of the present application;

[0028] Figure 4 It is a structural diagram of a control domain C provided in an embodiment of the present application;

[0029] Figure 5 It is a structural diagram of a data domain provided by an implementation method of the present application;

[0030] Figure 6 It is a structural model diagram of a preset convolutional neural network model provided in an embodiment of the present application;

[0031] Figure 7 It is a structural schematic diagram of an abnormal message identification device provided in an embodiment of the present application;

[0032] Figure 8 It is a schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0033] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the implementation mode of the present application will be clearly and completely described below in conjunction with the drawings in the implementation mode of the present application. Obviously, the described implementation mode is only a part of the implementation mode of the present application, not all the implementation modes. Based on the implementation mode in the present application, all other implementation modes obtained by ordinary technicians in the field without creative work are within the scope of protection of the present application.

[0034] The terms "first", "second", etc. in the specification and claims of this application and the above-mentioned drawings are used to distinguish different objects, rather than to describe a specific order. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but optionally includes steps or units that are not listed, or optionally includes other steps or units inherent to these processes, methods, products or devices.

[0035] Reference to "embodiment" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiment may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0036] See also Figure 1 , Figure 1 This is a flowchart of an abnormal message identification method provided by an embodiment of the present application, including but not limited to the following steps:

[0037] S101: Establishing a plurality of monitoring nodes in a target power line carrier communication network.

[0038] In this embodiment, the monitoring node can be any device with power line carrier communication function, such as concentrator, smart meter, terminal device, etc. The concentrator usually plays the role of data aggregation in the power line carrier communication network. It can receive message information from multiple smart meters or other terminal devices, and then transmit these data upward. Taking the concentrator as a monitoring node, it can well monitor the summary of messages on many devices under its jurisdiction; the smart meter is a device directly related to the user's electricity consumption. It will continuously send data messages such as electricity metering and real-time power to the concentrator through power line carrier communication. Taking the smart meter as a monitoring node, it can monitor the message situation from the end user's end perspective; the terminal device can be a variety of devices connected to the power line carrier communication network for specific functions, such as some smart electrical appliance control devices, distributed energy access devices, etc. When such terminal devices are set as monitoring nodes, they can monitor the abnormality of messages related to specific electrical appliance control and status feedback.

[0039] Monitoring nodes can be set up at any location in the network as needed, such as near potential abnormal points such as transformers, branches, loads, or at key locations such as the edge or center of the network. Transformers are key equipment in the power system. Many power line carrier communication lines will pass through transformers. Monitoring nodes are set up near transformers. Whether it is a concentrator, smart meter or other terminal equipment, it can timely monitor the changes in messages before and after passing through the transformer; monitoring nodes are set up at the branch points of the power line, which can effectively monitor the flow and transmission of messages on different branch lines; loads are devices that consume electrical energy. The operating conditions of different loads may have an impact on power line carrier communication. Monitoring nodes are set up near the loads (such as smart meters or terminal equipment) to monitor the message changes related to the load changes; monitoring nodes are set up at the edge of the network. For example, user-end devices (such as smart meters) in some remote areas are used as monitoring nodes to monitor the message transmission quality in the edge area of ​​network coverage and understand whether there are message anomalies caused by factors such as long distance and signal attenuation. In the center of the network, for example, monitoring nodes (such as concentrators) are set up in substations, so that a large number of message aggregation and transmission in the core area of ​​the entire network can be monitored, and key problems that may affect the entire network communication can be discovered in time.

[0040] It can be seen that by setting concentrators, smart meters and terminal devices as monitoring nodes, the network can be monitored from multiple levels. Since the monitoring nodes are distributed in different locations and on different types of equipment, once a problem occurs in a certain area, the location of the abnormality can be quickly located. Multiple monitoring nodes can collect rich message data, including data transmitted by different protocol types, different functional uses and different locations.

[0041] S102: Obtain n messages based on multiple monitoring nodes.

[0042] In this implementation, n is an integer greater than 1, and one monitoring node corresponds to multiple messages.

[0043] The monitoring node communicates, receives or sends messages with other devices in the network through the power line carrier communication module. The power line carrier communication module uses the power line itself as the transmission medium, modulates the data signal onto a high-frequency carrier signal, and then transmits it through the power line. At the receiving end, the high-frequency carrier signal is demodulated and restored to the original data signal. The power line carrier communication module in the monitoring node follows this basic principle to achieve information interaction with smart meters, concentrators and other terminal devices in the network. As a device used to measure user power consumption and other data in the power system, smart meters will regularly send messages containing power readings, real-time power and other information to concentrators and other superior devices through power line carrier communication; when the monitoring node is a smart meter or other terminal device, they need to send the data or status information they have collected to the concentrator in the form of a message. Through the power line carrier communication module, these devices can accurately transmit the message to the concentrator, and the concentrator, as an important gathering point in the network, will also send some control command messages to each smart meter or terminal device through its power line carrier communication module; in the power line carrier communication network, there are also various other terminal devices, such as distributed energy access equipment (access control equipment for solar panels, wind turbines, etc.), smart appliance control equipment, etc., and the monitoring node and these terminal devices can also send and receive messages through the power line carrier communication module.

[0044] The message is the basic unit of power line carrier communication, which contains data and control information. The format and content of the message vary according to different protocol types, such as State Grid 376.2 protocol, 1376.2 protocol, Southern Grid 16 protocol, etc. State Grid 376.2 protocol messages usually have a more standardized format. Generally, it includes a frame header, a data area, and a frame trailer. The frame header contains information such as the start character, which is used to identify the beginning of the message and some basic attributes. The data area is the core part of the message. Its content varies according to the specific function and may contain meter data (such as electricity, voltage, current, etc.), equipment status information (such as switch position, equipment fault code, etc.). There is usually a checksum at the end of the frame to verify whether there is an error in the message during transmission; the format of the 1376.2 protocol message also has a clear layered structure, which includes the link layer, application layer, etc. The link layer is mainly responsible for the transmission of the message and link control, including frame synchronization, error Control and other functions, the format part may have link address, control field, etc., the application layer defines the data format according to specific business needs, for example, for messages related to power marketing business, the application layer may have fields such as user number and business type code; the format of the Southern Power Grid 16 protocol message focuses on the integrity and security of information. It may include a security authentication part, a data body part and an end mark. The security authentication part is used to ensure the legitimacy of the source of the message and the security of the data, such as using an encryption algorithm to sign the message. The data body part contains content such as power equipment monitoring data and power grid operation status data according to different business scenarios.

[0045] It can be seen that since these multiple monitoring nodes are distributed in different positions of the target power line carrier communication network, the n messages obtained by them can cover various areas in the target power line carrier communication network. The messages obtained by each monitoring node represent the communication conditions around its location or the equipment to which it belongs. When an abnormality occurs in a local area, the messages obtained by the corresponding monitoring node will change first.

[0046] S103: Determine the protocol data corresponding to each of the n messages to obtain n protocol data.

[0047] In this embodiment, each protocol data includes a protocol, a protocol source address, and a protocol destination address. The message analysis module extracts the protocol features of the message, such as a frame type, a control code, a check code, a frame length, etc., and determines the protocol, the protocol source address, and the protocol destination address of the message, that is, the protocol type of the message. Specifically, first, the detailed feature information of common power line carrier communication protocols (such as the State Grid 376.2 protocol, the 1376.2 protocol, the Southern Grid 16 protocol, etc.) is collected and sorted. These features include but are not limited to the aforementioned frame type (the format and content of the frame header and the frame tail), the control code, the check code, the frame length, etc., and the typical features of each protocol are stored in a protocol feature library as a basis for subsequent judgment, and then the key features of each message are extracted, and the extracted key features of the message are matched one by one with the various protocol features in the protocol feature library. The pattern matching algorithm can be used to check whether the frame header is consistent with the frame header pattern of the known protocol, and the possible matching protocol is found by the value and position of the control code. The range is further narrowed according to the algorithm and position of the check code, and the protocol type of the message is finally determined in combination with whether the frame length meets the protocol regulations.

[0048] It can be seen that by extracting and matching the protocol features of the message in detail to determine the protocol type, high-precision message classification can be achieved. Once the protocol type of the message is determined, different management strategies can be implemented for different types of messages. The causes and solutions to problems with different protocols are often targeted. By determining the message protocol type, the problem can be analyzed and solved based on the characteristics of each protocol.

[0049] S104: Classify the n messages based on the protocol, the protocol source address, and the protocol destination address corresponding to each of the n protocol data to obtain m classified data.

[0050] In this embodiment, m is a positive integer less than or equal to n, and one classification data corresponds to at least one message. Specifically, all messages whose protocol types have been determined are traversed, and for each message, it is placed in the corresponding classification set according to its protocol type. For example, if a message is determined to belong to the State Grid 376.2 protocol, it is placed in a classification set specifically used to store State Grid 376.2 protocol messages, and the classified results are sorted, and the number of messages, main features, and other information in each classification set are recorded. After classifying n messages based on the protocol, protocol source address, and protocol destination address corresponding to each protocol data in the n protocol data, m classification data can be obtained.

[0051] It can be seen that through classification, messages of the same protocol type can be put together. When an abnormality occurs in a message in a certain classification set, since these messages belong to the same protocol type, it is easier to find abnormal patterns related to the protocol. The abnormal situations in different classification sets can be compared to discover possible systemic problems in the network, and targeted management and maintenance measures can be taken for protocols of different classifications.

[0052] S105: Extract features from each of the m classified data to obtain m feature data groups.

[0053] In this embodiment, first, the message length-related features, time-related features, protocol-related features, and content-related features corresponding to all messages in each of the m classified data are extracted. Each classified data corresponds to a feature data group. By performing feature extraction on each of the m classified data, m feature data groups can be obtained.

[0054] It should be explained that each of the m feature data groups includes three types of feature data: a data unit field, an application function code and a data unit identifier.

[0055] S106: Determine a target abnormal message among the n messages based on the m feature data groups.

[0056] In this implementation, see Figure 2 , Figure 2 This is a flowchart of determining a target abnormal message provided by an embodiment of the present application, including but not limited to the following steps:

[0057] S201: Determine a feature database corresponding to a first feature data group.

[0058] In this embodiment, the first feature data group is any feature data group among the m feature data groups. The feature database is a collection that stores normal message features of various protocol types. It contains key information such as standard message length ranges, standard message transmission rate ranges, and standard message frame formats corresponding to different protocols. These standard information is obtained by analyzing and counting a large number of messages under normal communication conditions. Taking the State Grid 376.2 protocol as an example, the feature database will record that the typical length range of normal messages of the protocol may be [100, 200] bytes, and the normal transmission rate range may be an interval determined according to the network bandwidth and actual application scenarios, such as [10kbps, 20kbps]. The standard message frame format includes a specific frame header, frame tail format, and data field structure, etc. Please refer to Figure 3 , Figure 3It is a structural diagram of a 376.2 protocol frame format provided by an implementation method of the present application. The 376.2 protocol frame format is: start character (68H), length L, control field C, user data, checksum CS, end character (16H). Length L refers to the total length of the frame data, which consists of 1 byte, and the length L is not greater than 255. Among them, the start character (68H) and length L are used to represent the fixed message header, the control field C is used to represent the control field, the user data is used to represent the user data area, and the checksum CS is used to represent the frame checksum. Among them, the control field C represents the transmission direction of the message, the start flag, and the communication mode type information of the communication module, please refer to Figure 4 , Figure 4 This is a schematic diagram of the structure of a control domain C provided by an embodiment of the present application. The transmission direction includes the uplink direction and the downlink direction. D7 is the transmission direction bit DI R, D6 is the start flag bit PRM, and D5-D0 is the communication mode. Figure 5 , Figure 5 It is a structural diagram of a data domain provided in an implementation manner of the present application, wherein the data domain includes an information domain, an address domain, and an application data domain, wherein the information domain includes an information domain R, the address domain includes an address domain A, and the application data domain includes an application function code AFN and application data.

[0059] It can be seen that the normal message features corresponding to various protocol types stored in the feature database provide a clear and quantitative reference standard for judging whether the message is abnormal. In addition to the length range, it also includes key information such as the transmission rate range and frame format. These multi-dimensional standards can more comprehensively evaluate the status of the message.

[0060] S202: Determine at least one message corresponding to the first characteristic data group.

[0061] In this implementation, since each of the m feature data groups includes at least one message, at least one message corresponding to the first feature data group is determined.

[0062] S203: Determine the abnormal message corresponding to the first feature data group based on the feature database.

[0063] In this embodiment, specifically, the standard message features corresponding to the standard messages in the feature database are first determined, wherein the standard message features include a standard message length range, a standard message transmission rate range, and a standard message frame format, and then the standard message length center value corresponding to the standard message length range and the standard message transmission rate center value corresponding to the standard message transmission rate range are determined.

[0064] Exemplarily, an abnormal message in at least one message is determined based on a central value of a standard message length, a central value of a standard message transmission rate, and a standard message frame format. Specifically, a first message length, a first message transmission rate, and a first message frame format corresponding to a first message are first determined, wherein the first message is any one of the at least one message.

[0065] Exemplarily, the first similarity value is determined based on the first message length and the central value of the standard message length. Specifically, the message length difference between the first message length and the central value of the standard message length is first determined, and then the message length ratio value corresponding to the message length difference and the central value of the standard message length is calculated. The smaller the message length ratio value, the larger the first similarity value. It can be a mapping relationship between a preset message length ratio value and a similarity value. Based on the mapping relationship, the first similarity value corresponding to the message length ratio value can be determined.

[0066] Exemplarily, the second similarity value is determined based on the first message transmission rate and the center value of the standard message transmission rate. Specifically, the message transmission rate difference between the first message transmission rate and the center value of the standard message transmission rate is first determined, and then the message transmission rate ratio value corresponding to the message transmission rate difference and the center value of the standard message transmission rate is calculated. The smaller the message transmission rate ratio value, the larger the second similarity value. It can be a mapping relationship between a preset message transmission rate ratio value and a similarity value. Based on the mapping relationship, the second similarity value corresponding to the message transmission rate ratio value can be determined.

[0067] Exemplarily, a third similarity value is determined based on a standard message frame format and a first message frame format. Specifically, the standard frame header, standard frame trailer, and standard data field length corresponding to the standard message frame format are first determined, and the first frame header, first frame trailer, and first data field length corresponding to the first message frame format are determined. Then, the number of characters with the same position and the same characters in the standard frame header and the first frame header is determined to obtain a first character number, and a first matching degree is determined based on the first character number and the number of characters in the standard frame header. Specifically, the difference in the number of characters between the first character number and the number of characters in the standard frame header is first determined, and then the character number ratio value corresponding to the character number difference and the number of characters in the standard frame header is calculated. The smaller the character number ratio value, the larger the first matching value. It can be a mapping relationship between a preset character number ratio value and a matching value. Based on the mapping relationship, the first matching value corresponding to the character number ratio value can be determined.

[0068] Exemplarily, the number of characters with the same position and the same characters in the standard frame end and the first frame end is determined to obtain a second character number, and a second matching degree is determined based on the second character number and the character number of the standard frame end. Specifically, the character number difference between the second character number and the character number of the standard frame end is first determined, and then the character number ratio value corresponding to the character number difference and the character number of the standard frame end is calculated. The smaller the character number ratio value, the larger the second matching value. It can be a mapping relationship between a preset character number ratio value and a matching value, and the second matching value corresponding to the character number ratio value can be determined based on the mapping relationship.

[0069] Exemplarily, the field length difference between the standard data field length and the first data field length is determined, and a third matching degree corresponding to the field length difference is determined. Specifically, it may be a preset mapping relationship between the field length difference and the matching degree, and the third matching degree corresponding to the field length difference may be determined based on the mapping relationship.

[0070] Exemplarily, the third similarity value is determined based on the first matching degree, the second matching degree, and the third matching degree. Specifically, the first weight corresponding to the first matching degree, the second weight corresponding to the second matching degree, and the third weight corresponding to the third matching degree are first determined, and the sum of the first weight, the second weight, and the third weight is 1, and the first weight is greater than the second weight, and the second weight is greater than the third weight.

[0071] It should be explained that the third similarity value is calculated according to the following formula:

[0072] F=a×α+b×β+c×ε

[0073] Among them, F is the third similarity value, a is the first matching degree, b is the second matching degree, c is the third matching degree, α is the first weight, β is the second weight, and ε is the third weight.

[0074] It can be seen that by determining the standard message characteristics (including length range, transmission rate range and frame format) and comparing and analyzing each first message from multiple aspects (message length, transmission rate, frame format), it is possible to comprehensively evaluate whether the message is abnormal. The difference between the message and the standard message is quantified by calculating the first similarity value (message length), the second similarity value (transmission rate) and the third similarity value (frame format). When calculating the first similarity value and the second similarity value, the ratio of the message length difference to the central value of the standard message length and the ratio of the message transmission rate difference to the central value of the standard message transmission rate are used to determine the similarity value. This method based on central values ​​and ratios can better adapt to changes in message length and transmission rate under different protocols. When calculating the third similarity value, By comparing the frame formats, the matching degrees of the frame header, frame tail and data field length are determined respectively, and different weights are assigned to them (a first weight corresponding to the first matching degree, a second weight corresponding to the second matching degree, and a third weight corresponding to the third matching degree). This method fully considers the importance differences of different parts of the frame format in the judgment of message integrity and accuracy. Whether it is the mapping relationship between the message length ratio value and the similarity value in the process of calculating the similarity value, the mapping relationship between the message transmission rate ratio value and the similarity value, or the mapping relationship between the character number ratio value and the matching value when calculating the third similarity value, the mapping relationship between the field length difference and the matching degree, and the weights of each part of the frame format, they can be adjusted according to the actual network environment, protocol characteristics and tolerance to abnormalities.

[0075] It should be explained that if the first similarity value is less than the first similarity threshold, or the second similarity value is less than the second similarity threshold, or the third similarity value is less than the third similarity threshold, the first message is determined to be an abnormal message. Exemplarily, when the first similarity value is less than the first similarity threshold, the first alarm information is determined based on the first similarity value, wherein the first alarm information is used to characterize that the length of the first message is abnormal. Specifically, when the first similarity value is less than the first similarity threshold, it means that the length of the first message is different from the standard message length, which exceeds the normal acceptable range. This may be due to a variety of reasons, such as data loss or erroneous addition during network transmission, causing the message length to change, or the sending end device itself fails, resulting in the generated message length not meeting the standard. Therefore, in this case, the first message is determined to be an abnormal message, and the first alarm information is further determined based on the first similarity value. The purpose of the first alarm information is to clearly inform relevant personnel or systems that there is a problem with the length of the first message. The first alarm information may include a specific numerical value about the first similarity value so as to more intuitively understand the degree of abnormality in the message length. For example, the first similarity value is 0.3 (assuming the first similarity threshold is 0.6), and the first alarm information may be expressed as "the length of the first message is abnormal, the similarity value is 0.3, and it is significantly different from the standard message length." Exemplarily, when the second similarity value is less than the second similarity threshold, a second alarm message is determined based on the second similarity value, wherein the second alarm message is used to characterize that an abnormality has occurred in the first message transmission rate. Specifically, the second similarity threshold is used to measure whether the degree of similarity between the first message transmission rate and the standard message transmission rate is normal. When the second similarity value is less than the second similarity threshold, it means that the transmission rate of the first message is different from the standard message transmission rate, and there is a difference beyond the normal range. This may be due to network congestion, degradation of device transmission performance, or external interference. At this time, the first message is determined to be an abnormal message, and the second alarm message is determined based on the second similarity value. The second alarm message may be "The first message transmission rate is abnormal, the similarity value is 0.4, which is lower than the standard message transmission rate. There may be network congestion or equipment failure." Exemplarily, when the third similarity value is less than the third similarity threshold, a third alarm message is determined based on the third similarity value, wherein the third alarm message is used to characterize that there is an abnormality in the first message frame format. Specifically, the third similarity threshold is a standard for judging the degree of similarity between the first message frame format and the standard message frame format. When the third similarity value is less than the third similarity threshold, it indicates that there is a large difference between the frame format of the first message and the standard message frame format. This may be due to protocol mismatch, device configuration error, or malicious tampering. At this time, the first message is determined to be an abnormal message, and the third alarm message is determined based on the third similarity value. The third alarm message can be expressed as "the first message frame format is abnormal, the similarity value is 0.2, and it does not match the standard message frame format in many places. There may be protocol problems or malicious tampering."

[0076] It can be seen that by setting the first similarity threshold, the second similarity threshold and the third similarity threshold respectively to correspond to the three key dimensions of message length, transmission rate and frame format, as long as any of the similarity values ​​is less than its corresponding threshold, the first message is judged to be an abnormal message. This multi-dimensional judgment mechanism can comprehensively consider the abnormal situations that may occur in different aspects of the message, avoiding the problem of missing certain abnormal messages based on judgment based on a single factor. When a similarity value is less than its threshold, a corresponding alarm message will be generated based on the similarity value, clearly indicating which aspect of the message is abnormal. For example, the first alarm message is for abnormal message length, the second alarm message is for abnormal transmission rate, and the third alarm message is for abnormal frame format. In this way, after receiving the alarm message, the relevant personnel or system can quickly understand the specific level of the problem, without having to check each aspect of the message one by one, which greatly improves the efficiency of troubleshooting.

[0077] S204: Determine a target abnormal message among the n messages based on the abnormal message corresponding to each of the m characteristic data groups.

[0078] In this embodiment, the determination method of the abnormal message corresponding to each of the m feature data groups is the same as that of the first feature data group, so the abnormal message corresponding to each of the m feature data groups can be determined according to the determination method of the abnormal message corresponding to the first feature data group, which will not be repeated here. After determining the abnormal message corresponding to each of the m feature data groups, the abnormal message corresponding to each of the m feature data groups is used as the target abnormal message.

[0079] It should be noted that the embodiment of the present application also provides another method for determining the target abnormal message, first determining the abnormal message corresponding to the second feature data group, the second feature data group being any feature data group among the m feature data groups. Exemplarily, the abnormal probability threshold corresponding to the second feature data group is determined, and the determination of the abnormal probability threshold is usually based on the statistical analysis of the feature data groups of a large number of normal messages in the past and the empirical judgment of the network operation status. For example, for a message of a certain specific protocol type, by collecting and analyzing the relevant feature data groups of the protocol message under normal communication conditions in the past (such as message length, transmission rate, frame format related features, etc.), the normal distribution range of these feature data groups is understood, and then a suitable abnormal probability threshold is determined based on the sensitivity requirements of abnormal detection and acceptable misjudgment rate and other factors.

[0080] Exemplarily, at least one message corresponding to the second feature data group is determined, and at least one message is input into a preset convolutional neural network model to obtain at least one abnormal probability. Specifically, at least one message is first input into a preset convolutional neural network model to obtain at least one reference abnormal probability. Figure 6 , Figure 6 It is a structural model diagram of a preset convolutional neural network model provided in an embodiment of the present application. The preset convolutional neural network model consists of an input layer, two convolutional layers, two pooling layers, a fully connected layer and an output layer. The function of the input layer is to receive the feature data group of each classified data and convert it into a two-dimensional matrix as the input of the preset convolutional neural network model. The function of the convolutional layer is to extract the local features of the input data, and map the input data into multiple feature maps through convolution operations and activation functions. The parameters of the convolutional layer include the number, size, step size, padding, weight and bias of the convolution kernel. The weight and bias of the convolution kernel are randomly initialized and updated through the training process. The pooling layer is a layer that downsamples the feature map, which can reduce the dimension of the data, reduce the computational complexity, and prevent over-simulation. Combine and enhance the rotation and scaling invariance of data. Commonly used pooling operations include maximum pooling, average pooling, random pooling, etc., where maximum pooling refers to taking the maximum value as output in a small area of ​​the feature map, average pooling refers to taking the average value as output, and random pooling refers to taking the value as output according to a certain probability distribution. The fully connected layer is a layer composed of multiple neurons. It can be regarded as an ordinary neural network. Its input is the output of all neurons in the previous layer, and its output is the input of all neurons in the next layer. The function of the fully connected layer is to integrate the local features extracted by the convolution layer and the pooling layer, obtain the high-level features of the input data, and perform the final classification or regression. The function of the output layer is to obtain the abnormal probability after the output feature vector of the fully connected layer passes through a linear transformation function and then output it. Therefore, at least one message is input into the preset convolutional neural network model to obtain at least one reference abnormal probability, and one message corresponds to one reference abnormal probability.

[0081] Exemplarily, each reference abnormal probability in at least one reference abnormal probability is adjusted to obtain at least one abnormal probability. Specifically, since high data traffic can easily cause network congestion, in the power line carrier communication network, the network bandwidth is limited. When a large number of messages compete for this limited bandwidth resource at the same time, network congestion will occur. In the case of congestion, the cache area of ​​the network equipment (such as routers, switches, etc.) may overflow. When the cache area cannot accommodate more messages, the newly arrived messages will be discarded, resulting in message loss. Moreover, in a congested network, mutual interference between messages will also increase, further increasing the probability of message loss. Therefore, it is necessary to obtain the data traffic corresponding to the target power line carrier communication network and determine the target adjustment parameters corresponding to the data traffic. Specifically, it can be a mapping relationship between preset data traffic and adjustment parameters, and the target adjustment parameters corresponding to the data traffic can be determined based on the mapping relationship. Exemplarily, the first reference abnormality probability is adjusted according to the target adjustment parameter to obtain the first abnormality probability, wherein the first reference abnormality probability is any reference abnormality probability among at least one reference abnormality probability, and the first abnormality probability is the abnormality probability corresponding to the first reference abnormality probability. The specific calculation formula is as follows: first abnormality probability = first reference abnormality probability × (1 + target adjustment parameter); the first abnormality probability can be obtained according to the above formula.

[0082] It should be noted that the method for determining the abnormal probability corresponding to each reference abnormal probability in at least one reference abnormal probability is the same, so at least one abnormal probability can be determined according to the method for determining the first abnormal probability, which will not be repeated here.

[0083] Exemplarily, determine the abnormal probability greater than the abnormal probability threshold among at least one abnormal probability, obtain at least one target abnormal probability, and determine the abnormal message corresponding to the at least one target abnormal probability, and obtain the abnormal message corresponding to the second feature data group. Specifically, after obtaining the abnormal probability values ​​of all messages corresponding to the second feature data group, it is necessary to screen out those situations with higher abnormal probabilities and more likely to be abnormal messages according to the previously set abnormal probability threshold. Here, all abnormal probability values ​​greater than the abnormal probability threshold are to be found. These screened out values ​​will be regarded as target abnormal probabilities that are more likely to represent abnormal messages. Then, based on the corresponding relationship between the target abnormal probability and the message, find out the specific messages corresponding to the target abnormal probability. These messages are the abnormal messages associated with the second feature data group.

[0084] Exemplarily, the target abnormal message is determined based on the abnormal message corresponding to each of the m feature data groups. Specifically, after determining the abnormal message corresponding to each of the m feature data groups, the abnormal message corresponding to each of the m feature data groups is used as the target abnormal message.

[0085] It can be seen that the preset convolutional neural network model is used to process the message data. It is assumed that the convolutional neural network model has the ability to automatically learn data features. It can automatically extract complex local features and high-level features from the input message through structures such as convolutional layers and pooling layers. In the actual power line carrier communication network, network congestion is a common factor that will have a significant impact on message transmission. By obtaining the data flow corresponding to the target power line carrier communication network and dynamically adjusting the abnormal probability according to the mapping relationship between the data flow and the adjustment parameter, it can more truly reflect the current actual situation of the network. This method of dynamically adjusting the abnormal probability according to the network congestion situation helps to more accurately determine whether the message is abnormal. By performing the abnormal message determination process for each feature data group in the m feature data groups, the message can be analyzed and detected from multiple dimensions. Abnormality, finally, the abnormal message corresponding to each feature data group in the m feature data groups is used as the target abnormal message. This method of comprehensively considering multiple feature data groups to determine the target abnormal message makes the determined target abnormal message set more accurate and comprehensive.

[0086] In summary, the implementation of the present invention has the following beneficial effects:

[0087] It can be seen that the abnormal message identification method described in the implementation mode of the present invention first sets up multiple monitoring nodes in the target power line carrier communication network, then obtains n messages based on the multiple monitoring nodes, and then determines the protocol data corresponding to each message in the n messages to obtain n protocol data, each protocol data includes a protocol, a protocol source address, and a protocol destination address, and then classifies the n messages based on the protocol, protocol source address, and protocol destination address corresponding to each protocol data in the n protocol data to obtain m classified data, and then performs feature extraction on each classified data in the m classified data to obtain m feature data groups, and finally determines the target abnormal message in the n messages based on the m feature data groups, thereby improving the efficiency of identifying abnormal messages.

[0088] See also Figure 7 , Figure 7 It is a structural diagram of an abnormal message identification device provided in an embodiment of the present application. The abnormal message identification device 700 includes: an acquisition unit 701 and a processing unit 702;

[0089] The processing unit 702 is used to set up a plurality of monitoring nodes in the target power line carrier communication network;

[0090] The acquisition unit 701 is used to acquire n messages based on multiple monitoring nodes; n is an integer greater than 1; one monitoring node corresponds to multiple messages;

[0091] The processing unit 702 is used to determine the protocol data corresponding to each of the n messages to obtain n protocol data; each protocol data includes a protocol, a protocol source address, and a protocol destination address;

[0092] Based on the protocol, the protocol source address, and the protocol destination address corresponding to each of the n protocol data, the n messages are classified to obtain m classified data; m is a positive integer less than or equal to n; and one classified data corresponds to at least one message;

[0093] Extract features from each of the m classified data to obtain m feature data groups;

[0094] A target abnormal message among n messages is determined based on the m feature data groups.

[0095] In some possible implementations, in determining a target abnormal message among n messages based on m feature data groups, the processing unit 702 is specifically configured to:

[0096] According to the determination method in the following steps S1-S3, the abnormal message corresponding to each characteristic data group in the m characteristic data groups is determined, which specifically includes the following steps:

[0097] S1, determining a feature database corresponding to a first feature data group; the first feature data group is any feature data group among the m feature data groups;

[0098] S2. Determine at least one message corresponding to the first feature data group;

[0099] S3, determining the abnormal message corresponding to the first feature data group based on the feature database;

[0100] A target abnormal message among the n messages is determined based on the abnormal message corresponding to each of the m characteristic data groups.

[0101] In some possible implementations, in determining the abnormal message corresponding to the first feature data group based on the feature database, the processing unit 702 is specifically configured to:

[0102] Determine the standard message features corresponding to the standard messages in the feature database; the standard message features include a standard message length range, a standard message transmission rate range, and a standard message frame format;

[0103] Determine a central value of a standard message length corresponding to a standard message length range, and a central value of a standard message transmission rate corresponding to a standard message transmission rate range;

[0104] According to the determination method in the following steps A1-A6, an abnormal message in at least one message is determined based on the central value of the standard message length, the central value of the standard message transmission rate, and the standard message frame format, specifically the following steps:

[0105] A1. Determine a first message length, a first message transmission rate, and a first message frame format corresponding to a first message; the first message is any one of the at least one message;

[0106] A2. Determine a first similarity value based on the first message length and the central value of the standard message length;

[0107] A3. Determine a second similarity value based on the first message transmission rate and the center value of the standard message transmission rate;

[0108] A4. Determine a third similarity value based on the standard message frame format and the first message frame format;

[0109] A5. Determine a target similarity value corresponding to the first message and the standard message based on the first similarity value, the second similarity value, and the third similarity value;

[0110] A6. If the target similarity value is less than the similarity threshold, the first message is determined to be an abnormal message.

[0111] In some possible implementations, in determining the third similarity value based on the standard message frame format and the first message frame format, the processing unit 702 is specifically configured to:

[0112] Determine a standard frame header, a standard frame trailer, and a standard data field length corresponding to a standard message frame format, and determine a first frame header, a first frame trailer, and a first data field length corresponding to a first message frame format;

[0113] Determine the number of characters in the same position and characters in the standard frame header and the first frame header, and obtain the first character number;

[0114] Determining a first matching degree based on the number of the first characters and the number of characters in the standard frame header;

[0115] Determine the number of characters in the same position and characters in the standard frame tail and the first frame tail, and obtain the second character number;

[0116] Determining a second matching degree based on the number of second characters and the number of characters at the end of the standard frame;

[0117] determining a field length difference between a standard data field length and a first data field length;

[0118] Determining a third degree of match corresponding to the field length difference;

[0119] A third similarity value is determined based on the first matching degree, the second matching degree, and the third matching degree.

[0120] In some possible implementations, the processing unit 702 is further specifically configured to:

[0121] If the first similarity value is less than the first similarity threshold, or the second similarity value is less than the second similarity threshold, or the third similarity value is less than the third similarity threshold, then the first message is determined to be an abnormal message;

[0122] When the first similarity value is less than the first similarity threshold, first alarm information is determined based on the first similarity value; the first alarm information is used to indicate that the length of the first message is abnormal;

[0123] When the second similarity value is less than the second similarity threshold, second alarm information is determined based on the second similarity value; the second alarm information is used to indicate that the first message transmission rate is abnormal;

[0124] When the third similarity value is less than the third similarity threshold, third alarm information is determined based on the third similarity value; the third alarm information is used to indicate that an abnormality occurs in the first message frame format.

[0125] In some possible implementations, in determining a target abnormal message among n messages based on m feature data groups, the processing unit 702 is specifically configured to:

[0126] According to the determination method in the following steps Q1-Q5, the abnormal message corresponding to each feature data group in the m feature data groups is determined, which is specifically the following steps:

[0127] Q1, determine the abnormal probability threshold corresponding to the second feature data group; the second feature data group is any feature data group among the m feature data groups;

[0128] Q2. Determine at least one message corresponding to the second feature data group;

[0129] Q3. Input at least one message into a preset convolutional neural network model to obtain at least one abnormal probability;

[0130] Q4. Determine an abnormal probability greater than an abnormal probability threshold among at least one abnormal probability, and obtain at least one target abnormal probability;

[0131] Q5. Determine an abnormal message corresponding to at least one target abnormal probability, and obtain an abnormal message corresponding to the second feature data group;

[0132] A target abnormal message is determined based on the abnormal message corresponding to each of the m characteristic data groups.

[0133] In some possible implementations, in inputting at least one message into a preset convolutional neural network model to obtain at least one abnormal probability, the processing unit 702 is specifically configured to:

[0134] Inputting at least one message into a preset convolutional neural network model to obtain at least one reference abnormality probability;

[0135] Adjusting each reference abnormal probability in at least one reference abnormal probability to obtain at least one abnormal probability;

[0136] The step of adjusting each reference abnormal probability in at least one reference abnormal probability to obtain at least one abnormal probability includes:

[0137] Obtaining data flow corresponding to the target power line carrier communication network;

[0138] Determining target adjustment parameters corresponding to data traffic;

[0139] The first reference abnormal probability is adjusted according to the target adjustment parameter to obtain a first abnormal probability; the first reference abnormal probability is any reference abnormal probability of at least one reference abnormal probability, and the first abnormal probability is the abnormal probability corresponding to the first reference abnormal probability.

[0140] See also Figure 8 , Figure 8 Schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. Figure 8 As shown, the electronic device 800 includes a transceiver 801, a processor 802 and a memory 803. They are connected via a bus 804. The memory 803 is used to store computer programs and data, and the transceiver 801 can transmit the data stored in the memory 803 to the processor 802. The above program includes instructions for executing the following steps:

[0141] Establishing a plurality of monitoring nodes in a target power line carrier communication network;

[0142] Obtain n messages based on multiple monitoring nodes; n is an integer greater than 1; one monitoring node corresponds to multiple messages;

[0143] Determine the protocol data corresponding to each of the n messages to obtain n protocol data; each protocol data includes a protocol, a protocol source address, and a protocol destination address;

[0144] Based on the protocol, the protocol source address, and the protocol destination address corresponding to each of the n protocol data, the n messages are classified to obtain m classified data; m is a positive integer less than or equal to n; and one classified data corresponds to at least one message;

[0145] Extract features from each of the m classified data to obtain m feature data groups;

[0146] A target abnormal message among n messages is determined based on the m feature data groups.

[0147] In some possible implementations, in terms of determining a target abnormal message among n messages based on m feature data groups, the program includes instructions for performing the following steps:

[0148] According to the determination method in the following steps S1-S3, the abnormal message corresponding to each characteristic data group in the m characteristic data groups is determined, which specifically includes the following steps:

[0149] S1, determining a feature database corresponding to a first feature data group; the first feature data group is any feature data group among the m feature data groups;

[0150] S2. Determine at least one message corresponding to the first feature data group;

[0151] S3, determining the abnormal message corresponding to the first feature data group based on the feature database;

[0152] A target abnormal message among the n messages is determined based on the abnormal message corresponding to each of the m characteristic data groups.

[0153] In some possible implementations, in terms of determining the abnormal message corresponding to the first feature data group based on the feature database, the program includes instructions for performing the following steps:

[0154] Determine the standard message features corresponding to the standard messages in the feature database; the standard message features include a standard message length range, a standard message transmission rate range, and a standard message frame format;

[0155] Determine a central value of a standard message length corresponding to a standard message length range, and a central value of a standard message transmission rate corresponding to a standard message transmission rate range;

[0156] According to the determination method in the following steps A1-A6, an abnormal message in at least one message is determined based on the central value of the standard message length, the central value of the standard message transmission rate, and the standard message frame format, specifically the following steps:

[0157] A1. Determine a first message length, a first message transmission rate, and a first message frame format corresponding to a first message; the first message is any one of the at least one message;

[0158] A2. Determine a first similarity value based on the first message length and the central value of the standard message length;

[0159] A3. Determine a second similarity value based on the first message transmission rate and the center value of the standard message transmission rate;

[0160] A4. Determine a third similarity value based on the standard message frame format and the first message frame format;

[0161] A5. Determine a target similarity value corresponding to the first message and the standard message based on the first similarity value, the second similarity value, and the third similarity value;

[0162] A6. If the target similarity value is less than the similarity threshold, the first message is determined to be an abnormal message.

[0163] In some possible implementations, in terms of determining the third similarity value based on the standard message frame format and the first message frame format, the program includes instructions for performing the following steps:

[0164] Determine a standard frame header, a standard frame trailer, and a standard data field length corresponding to a standard message frame format, and determine a first frame header, a first frame trailer, and a first data field length corresponding to a first message frame format;

[0165] Determine the number of characters in the same position and characters in the standard frame header and the first frame header, and obtain the first character number;

[0166] Determining a first matching degree based on the number of the first characters and the number of characters in the standard frame header;

[0167] Determine the number of characters in the same position and characters in the standard frame tail and the first frame tail, and obtain the second character number;

[0168] Determining a second matching degree based on the number of second characters and the number of characters at the end of the standard frame;

[0169] determining a field length difference between a standard data field length and a first data field length;

[0170] Determining a third degree of match corresponding to the field length difference;

[0171] A third similarity value is determined based on the first matching degree, the second matching degree, and the third matching degree.

[0172] In some possible implementations, the above program includes instructions for performing the following steps:

[0173] If the first similarity value is less than the first similarity threshold, or the second similarity value is less than the second similarity threshold, or the third similarity value is less than the third similarity threshold, then the first message is determined to be an abnormal message;

[0174] When the first similarity value is less than the first similarity threshold, first alarm information is determined based on the first similarity value; the first alarm information is used to indicate that the length of the first message is abnormal;

[0175] When the second similarity value is less than the second similarity threshold, second alarm information is determined based on the second similarity value; the second alarm information is used to indicate that the first message transmission rate is abnormal;

[0176] When the third similarity value is less than the third similarity threshold, third alarm information is determined based on the third similarity value; the third alarm information is used to indicate that an abnormality occurs in the first message frame format.

[0177] In some possible implementations, in terms of determining a target abnormal message among n messages based on m feature data groups, the program includes instructions for performing the following steps:

[0178] According to the determination method in the following steps Q1-Q5, the abnormal message corresponding to each feature data group in the m feature data groups is determined, which is specifically the following steps:

[0179] Q1, determine the abnormal probability threshold corresponding to the second feature data group; the second feature data group is any feature data group among the m feature data groups;

[0180] Q2. Determine at least one message corresponding to the second feature data group;

[0181] Q3. Input at least one message into a preset convolutional neural network model to obtain at least one abnormal probability;

[0182] Q4. Determine an abnormal probability greater than an abnormal probability threshold among at least one abnormal probability, and obtain at least one target abnormal probability;

[0183] Q5. Determine an abnormal message corresponding to at least one target abnormal probability, and obtain an abnormal message corresponding to the second feature data group;

[0184] A target abnormal message is determined based on the abnormal message corresponding to each of the m characteristic data groups.

[0185] In some possible implementations, in terms of inputting at least one message into a preset convolutional neural network model to obtain at least one abnormal probability, the program includes instructions for performing the following steps:

[0186] Inputting at least one message into a preset convolutional neural network model to obtain at least one reference abnormality probability;

[0187] Adjusting each reference abnormal probability in at least one reference abnormal probability to obtain at least one abnormal probability;

[0188] The step of adjusting each reference abnormal probability in at least one reference abnormal probability to obtain at least one abnormal probability includes:

[0189] Obtaining data flow corresponding to the target power line carrier communication network;

[0190] Determining target adjustment parameters corresponding to data traffic;

[0191] The first reference abnormal probability is adjusted according to the target adjustment parameter to obtain a first abnormal probability; the first reference abnormal probability is any reference abnormal probability of at least one reference abnormal probability, and the first abnormal probability is the abnormal probability corresponding to the first reference abnormal probability.

[0192] It should be understood that the electronic devices in this application may include smart phones (such as Android phones, iOS phones, Windows Phone phones, etc.), tablet computers, PDAs, laptops, mobile Internet devices MID (Mobile Internet Devices, MID for short) or wearable devices or servers, edge computing nodes, etc. The above electronic devices are only examples, not exhaustive, and include but are not limited to the above electronic devices.

[0193] The embodiment of the present application also provides a computer-readable storage medium, which stores a computer program. The computer program is executed by a processor to implement part or all of the steps of any abnormal message identification method recorded in the above method embodiment.

[0194] The embodiment of the present application also provides a computer program product, which includes a non-transitory computer-readable storage medium storing a computer program, and the computer program is operable to cause a computer to execute part or all of the steps of any abnormal message identification method recorded in the above method embodiment.

[0195] It should be noted that, for the above-mentioned various method implementations, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that this application is not limited by the order of the actions described, because according to this application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the implementations described in the specification are all optional implementations, and the actions and modules involved are not necessarily required by this application.

[0196] In the above-mentioned embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0197] In the several embodiments provided in this application, it should be understood that the disclosed device can be implemented in other ways. For example, the device implementation described above is only schematic, such as the division of units, which is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, and the indirect coupling or communication connection of devices or units can be electrical or other forms.

[0198] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0199] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above integrated unit may be implemented in the form of hardware or in the form of a software program module.

[0200] If the integrated unit is implemented in the form of a software program module and sold or used as an independent product, it can be stored in a computer-readable memory. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or all or part of the technical solution, can be embodied in the form of a software product, which is stored in a memory and includes several instructions for a computer device (which can be a personal computer, server or network device, etc.) to execute all or part of the steps of each implementation method of the present application. The aforementioned memory includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk and other media that can store program codes.

[0201] A person skilled in the art can understand that all or part of the steps in the various methods of the above-mentioned embodiments can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable memory, and the memory can include: a flash drive, a read-only memory (English: Read-Only Memory, abbreviated as: ROM), a random access memory (English: Random Access Memory, abbreviated as: RAM), a magnetic disk or an optical disk, etc.

[0202] The above is a detailed introduction to the implementation methods of the present application. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above implementation methods is only used to help understand the method and core idea of ​​the present application. At the same time, for general technical personnel in this field, according to the idea of ​​the present application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A method for identifying abnormal messages, characterized in that: include: Establishing a plurality of monitoring nodes in a target power line carrier communication network; Acquire n messages based on the multiple monitoring nodes; n is an integer greater than 1; One monitoring node corresponds to a plurality of messages; Determine the protocol data corresponding to each of the n messages to obtain n protocol data; each of the protocol data includes a protocol, a protocol source address, and a protocol destination address; Classify the n messages based on the protocol, the protocol source address, and the protocol destination address corresponding to each of the n protocol data to obtain m classified data; m is a positive integer less than or equal to n; One of the classification data corresponds to at least one of the messages; Extracting features from each of the m classified data to obtain m feature data groups; A target abnormal message among the n messages is determined based on the m feature data groups.

2. The method according to claim 1, characterized in that The determining the target abnormal message among the n messages based on the m characteristic data groups includes: According to the determination method in the following steps S1-S3, determining the abnormal message corresponding to each of the m characteristic data groups specifically includes the following steps: S1, determining a feature database corresponding to a first feature data group; the first feature data group is any feature data group among the m feature data groups; S2. Determine at least one message corresponding to the first feature data group; S3. Determine the abnormal message corresponding to the first feature data group based on the feature database; The target abnormal message among the n messages is determined based on the abnormal message corresponding to each characteristic data group in the m characteristic data groups.

3. The method according to claim 2, characterized in that The determining, based on the feature database, the abnormal message corresponding to the first feature data group includes: Determine the standard message features corresponding to the standard message in the feature database; the standard message features include a standard message length range, a standard message transmission rate range, and a standard message frame format; Determine a central value of a standard message length corresponding to the standard message length range, and a central value of a standard message transmission rate corresponding to the standard message transmission rate range; According to the determination method in the following steps A1-A6, determining an abnormal message in the at least one message based on the central value of the standard message length, the central value of the standard message transmission rate, and the standard message frame format, specifically the following steps: A1. Determine a first message length, a first message transmission rate, and a first message frame format corresponding to a first message; the first message is any one of the at least one message; A2. Determine a first similarity value based on the first message length and the central value of the standard message length; A3. Determine a second similarity value based on the first message transmission rate and the central value of the standard message transmission rate; A4. determining a third similarity value based on the standard message frame format and the first message frame format; A5. Determine a target similarity value corresponding to the first message and the standard message based on the first similarity value, the second similarity value, and the third similarity value; A6. If the target similarity value is less than the similarity threshold, determine that the first message is the abnormal message.

4. The method according to claim 3, characterized in that The determining a third similarity value based on the standard message frame format and the first message frame format includes: Determine a standard frame header, a standard frame trailer, and a standard data field length corresponding to the standard message frame format, and determine a first frame header, a first frame trailer, and a first data field length corresponding to the first message frame format; Determine the number of characters having the same position and characters in the standard frame header and the first frame header, and obtain a first character number; Determining a first matching degree based on the first number of characters and the number of characters in the standard frame header; Determine the number of characters having the same position and characters in the standard frame tail and the first frame tail, and obtain a second number of characters; Determining a second matching degree based on the second number of characters and the number of characters at the end of the standard frame; determining a field length difference between the standard data field length and the first data field length; Determining a third matching degree corresponding to the field length difference; The third similarity value is determined based on the first matching degree, the second matching degree, and the third matching degree.

5. The method according to claim 3 or 4, characterized in that The method further comprises: If the first similarity value is less than a first similarity threshold, or the second similarity value is less than a second similarity threshold, or the third similarity value is less than a third similarity threshold, determining that the first message is the abnormal message; When the first similarity value is less than a first similarity threshold, determining first alarm information based on the first similarity value; the first alarm information is used to indicate that the first message length is abnormal; When the second similarity value is less than a second similarity threshold, determining second alarm information based on the second similarity value; the second alarm information is used to indicate that the first message transmission rate is abnormal; When the third similarity value is less than a third similarity threshold, third alarm information is determined based on the third similarity value; the third alarm information is used to indicate that an abnormality occurs in the format of the first message frame.

6. The method according to claim 1, characterized in that The determining the target abnormal message among the n messages based on the m characteristic data groups includes: According to the determination method in the following steps Q1-Q5, the abnormal message corresponding to each of the m characteristic data groups is determined, specifically the following steps: Q1, determine the abnormal probability threshold corresponding to the second feature data group; the second feature data group is any feature data group among the m feature data groups; Q2. Determine at least one message corresponding to the second feature data group; Q3. Inputting the at least one message into a preset convolutional neural network model to obtain at least one abnormal probability; Q4. Determine an abnormal probability greater than the abnormal probability threshold among the at least one abnormal probability, and obtain at least one target abnormal probability; Q5. Determine the abnormal message corresponding to the at least one target abnormal probability, and obtain the abnormal message corresponding to the second feature data group; The target abnormal message is determined based on the abnormal message corresponding to each of the m characteristic data groups.

7. The method according to claim 6, characterized in that The step of inputting the at least one message into a preset convolutional neural network model to obtain at least one abnormality probability includes: Inputting the at least one message into the preset convolutional neural network model to obtain at least one reference abnormality probability; Adjusting each reference abnormal probability in the at least one reference abnormal probability to obtain the at least one abnormal probability; The adjusting each reference abnormal probability in the at least one reference abnormal probability to obtain the at least one abnormal probability includes: Obtaining data flow corresponding to the target power line carrier communication network; Determining a target adjustment parameter corresponding to the data flow; The first reference abnormal probability is adjusted according to the target adjustment parameter to obtain a first abnormal probability; the first reference abnormal probability is any reference abnormal probability among the at least one reference abnormal probability, and the first abnormal probability is the abnormal probability corresponding to the first reference abnormal probability.

8. An abnormal message identification device, characterized in that: The device comprises: an acquisition unit and a processing unit; The processing unit is used to set up a plurality of monitoring nodes in the target power line carrier communication network; The acquisition unit is used to acquire n messages based on the multiple monitoring nodes; n is an integer greater than 1; one monitoring node corresponds to multiple messages; The processing unit is used to determine the protocol data corresponding to each of the n messages to obtain n protocol data; each of the protocol data includes a protocol, a protocol source address, and a protocol destination address; Classifying the n messages based on the protocol, the protocol source address, and the protocol destination address corresponding to each of the n protocol data to obtain m classified data; m is a positive integer less than or equal to n; one of the classified data corresponds to at least one of the messages; Extracting features from each of the m classified data to obtain m feature data groups; A target abnormal message among the n messages is determined based on the m feature data groups.

9. An electronic device, characterized in that: The method comprises a processor, a memory, a communication interface and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the processor, and the one or more programs include instructions for executing the steps in the method described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and the computer program is executed by a processor to implement the method according to any one of claims 1 to 7.

Images