Internet of Things terminal protocol classification method

Abstract

The invention discloses an Internet of Things terminal protocol classification method, which relates to the field of electrical automation, and comprises the following steps: designing a packet capture scheme, and capturing data by virtue of a packet capture tool to generate a Pcap file; designing a feature extraction scheme based on prior knowledge analysis or an asynchronous extraction network, and generating feature representation of the Pcap file; designing a protocol classifier based on a decision tree or a hyperbolic attention classification network to realize label endowing, and performing pre-training through a conventional method or a 5-fold cross validation method to ensure the performance of the protocol classifier; unknown protocol type data are processed through a packet capture scheme and a feature extraction scheme, and labels are given through a protocol classifier, so that high-precision, high-efficiency and low-complexity adaptive classification of physical network protocols is realized.

Description

Technical Field

[0001] The present invention relates to the field of electrical automation, and in particular to a method for classifying protocols of Internet of Things terminals. Background Art

[0002] With the diversification of power-using equipment and the improvement of consumers' demand for power service quality, higher requirements are placed on the power operation and maintenance services of power grid management and operation and maintenance personnel. The power Internet of Things can flexibly and efficiently connect power grid management and operation and maintenance personnel with various enterprises and equipment, and provide unified access and information exchange services for power grid operation and maintenance personnel and power companies. However, with the increase in smart power Internet of Things terminal devices, the protocols between devices are different (including but not limited to 698 protocol, 645 protocol, modbus protocol, etc.), and even some device protocols are unknown, resulting in an increasing workload for power grid management and operation and maintenance personnel. In order to strengthen the operation and maintenance management of power Internet of Things terminal devices and meet the application needs of power grid management and operation and maintenance users, it is necessary to automatically identify the protocol type connected to the smart device.

[0003] The existing Chinese patent application with announcement number CN115729276B proposes a pre-parsing method for the power Internet of Things protocol, obtains all protocols supported by the power Internet of Things system, establishes a protocol feature library to determine the value ranges of multiple key frames of different protocols, obtains the power protocol message sent by the terminal and performs an overall analysis, and identifies the protocol type based on the value ranges of multiple key frames of the power protocol message.

[0004] The existing technology only implements the classification and identification of IoT protocols through a simple comparison of the value range of text features. The accuracy of classification and identification still has considerable room for improvement. Moreover, when identifying messages of unknown protocol types, it is necessary to traverse all protocol types in the protocol feature library and compare them one by one with multiple key frames of a single protocol type. The complexity is too high, which increases the burden of IoT processing. Summary of the invention

[0005] The purpose of the present invention is to provide a method for classifying protocols of Internet of Things terminals to achieve high-precision automated protocol classification.

[0006] The technical solution to achieve the purpose of the present invention is:

[0007] A method for classifying protocols of IoT terminals comprises the following specific steps:

[0008] Design a packet capture solution, use the packet capture tool to capture data in the communication between the host computer and the terminal device and save it as a Pcap file;

[0009] Design feature extraction scheme based on prior knowledge analysis or deep learning, extract features from Pcap files and generate feature representations;

[0010] Design a protocol classifier based on machine learning or deep learning to achieve label assignment, and pre-train it through conventional methods or 5-fold cross-validation method;

[0011] The unknown protocol type data is processed through packet capture and feature extraction schemes, and labels are automatically assigned by the protocol classifier.

[0012] Furthermore, the Pcap file includes a file header and a data packet;

[0013] The file header length is fixed at 24 bytes, including the major version number, minor version number, timestamp precision, maximum storage length, and link type;

[0014] The data packet includes basic fields and hexadecimal payload data. The basic fields include timestamp high bit, timestamp low bit, data packet length and actual data length.

[0015] Furthermore, the feature extraction scheme is implemented by selecting prior knowledge analysis, which includes the following specific steps:

[0016] Use Wireshark to parse the Pcap file to obtain data packets;

[0017] Based on prior knowledge, feature analysis is performed to select N valid features that are closely related to length, where N is the total number of valid features;

[0018] Calculate the N valid features of a single data packet D, denoted as a 1 ,a 2 ,…,a N ;

[0019] The N valid features a of data packet D 1 ,a 2 ,…,a N Zero-mean normalization is performed respectively to generate effective feature representation a of data packet D.

[0020] Specifically, effective features closely related to length include the length of a single data packet, the average length of data packets, the difference between a single data packet and the average length of data packets, the difference between the length of a single data packet and the longest data packet, and the difference between the length of a single data packet and the shortest data packet.

[0021] Furthermore, the pre-training protocol classifier is essentially to build a decision tree, including the following specific steps:

[0022] Get M Pcap files with K protocol types, where M is the total number of files and K is the total number of types; get M valid feature representations based on the feature extraction scheme, and the mth data packet D m The effective feature is represented as a m ;

[0023] Set K protocol types as K labels, denoted as y1, y2, …, y K , and assign labels to data packets of corresponding protocol types to construct data set D;

[0024] Calculate the information entropy H(D) of data set D to indicate the purity of data set D, and count the total number of values ​​L of the nth valid feature in data set D n , calculate the information gain g(D,n) of the nth effective feature for the data set D, n = 1, 2, ..., N, N is the total number of effective features;

[0025] Select the effective feature with the largest information gain as the basis for division, and divide the data set D into multiple sub-data sets as divisible nodes;

[0026] Execute the partitioning decision, and decide whether the sub-dataset is a separable node or a leaf node based on whether the information entropy of each sub-dataset is less than the entropy threshold;

[0027] If it is less than the entropy threshold, it indicates that the sub-dataset is a leaf node and does not need to be further divided. Otherwise, the sub-dataset is regarded as a divisible node, and the effective feature with the largest information gain is selected as the basis for further division.

[0028] Repeat the partitioning decision until all the sub-datasets obtained by the partitioning are leaf nodes, and then determine whether the total number of sub-datasets L is greater than the total number of types K;

[0029] If it is greater than, delete the leaf nodes of the smallest LK information gain partitions and obtain K leaf nodes. Otherwise, retain all leaf nodes.

[0030] Furthermore, the pre-training protocol classifier process can be improved by introducing a 5-fold cross-validation method, where the data set D is evenly and randomly divided into five subsets, one subset is selected as a test set, and the remaining subsets are used as training sets to build a decision tree. The test set is input into the decision tree to calculate the evaluation index, and the evaluation index is obtained when the five subsets are used as test sets respectively, and the decision tree protocol classifier with the best evaluation index is selected.

[0031] Specifically, effective feature representation of unknown protocol type data can be obtained through packet capture and feature extraction processing, and further input into the protocol classifier, adaptively placed into the leaf nodes of the decision tree, and the labels corresponding to the leaf nodes are assigned to the unknown protocol type data.

[0032] Based on the further improvement of the above feature extraction scheme, the feature extraction scheme based on the asynchronous extraction network includes the following specific steps:

[0033] Obtain M Pcap files through the packet capture solution, with a total of K protocol types, where M is the total number of files and K is the total number of types;

[0034] Wireshark is used to parse the Pcap file to obtain M data packets, and the basic fields and hexadecimal payload data in the M data packets are extracted respectively, and the hexadecimal payload data is converted into decimal payload data;

[0035] Using the basic fields of a single data packet as the first data block, filling the decimal payload data of the single data packet to generate a second data block with the same dimension;

[0036] The first data block is input into the shallow convolution block, and convolution is performed with a 3×3 convolution kernel with a step size of 1 to extract the structural features of the first data block, and the dimension is reduced by average pooling to generate a shallow feature representation;

[0037] The second data block is input into the deep convolution block, and a 3×3 convolution kernel is first used for convolution with a step size of 1, and the dimension is reduced by maximum pooling to obtain the primary feature. A 1×1 convolution kernel is further used for one-dimensional convolution with a step size of 1 to generate the secondary feature. The primary feature and the secondary feature are superimposed through the residual layer to generate the deep feature representation;

[0038] The shallow feature representation and the deep feature representation are concatenated, and a dual-view feature representation is generated through a linear layer.

[0039] Based on the further improvement of the above protocol classifier, it is realized through the hyperbolic attention classification network. The pre-training of the hyperbolic attention classification network includes the following specific steps:

[0040] Treat M data packets as graph nodes, establish an edge with an edge value of 1 between any two graph nodes, and construct an unweighted graph;

[0041] Define the loss function as cross entropy and select Adam optimizer;

[0042] The mth data packet D m The dual-view feature representation x m Through the exponential mapping function Project to hyperbolic space to generate hyperbolic feature representation

[0043] The hyperbolic characteristic q m Further through the weight sharing matrix W s Perform linear transformation to a higher-order hidden representation in, represents the Möbius multiplication;

[0044] The attention coefficient between graph nodes is obtained based on the hyperbolic distance between two graph nodes in the hyperbolic space, and the importance of the graph node to each other graph node is allocated through the attention coefficient;

[0045] Get the attention coefficients of the mth graph node and the remaining M-1 graph nodes, and construct the attention vector e of the mth graph node m , and align them through the Softmax function to generate the edge value vector w of the mth graph node m , update the unweighted graph to a weighted graph;

[0046] Using the edge values ​​between the mth graph node and the remaining M-1 graph nodes in the weighted graph, the mth graph node is re-represented through weighted aggregation to generate an aggregated hyperbolic feature representation h′ m ;

[0047] Using logarithmic mapping function The aggregated hyperbolic feature is represented as h′ m Remap back to Euclidean space to generate the aggregate feature representation of the mth graph node

[0048] The aggregate feature is represented as x′ m The linear fully connected layer is used to reduce the dimension to 1×K, and the Softmax function is used to generate the probability distribution vector p of the mth graph node. m , and choose the probability distribution vector p m The label corresponding to the maximum probability is assigned to the mth graph node;

[0049] Determine whether the cross entropy loss is less than the loss threshold. If so, stop training. Otherwise, adjust the hyperparameters of the hyperbolic attention classification network to retrain.

[0050] Preferably, a 5-fold cross-validation method is introduced for improvement, and the cross-validation process is exactly the same as that of Example 1, except that the processing steps during protocol classifier training are replaced by the processing steps of a hyperbolic attention classification network, and the unweighted graph initially established for training has only 0.8M graph nodes. Finally, the hyperbolic attention classification network with the best evaluation index among the 5 training and test groups is selected as the protocol classifier.

[0051] Preferably, a 5-fold cross-validation method is introduced to improve the training process. Similarly, 5 training and test groups are constructed, and the hyperbolic attention classification network is trained in turn and the evaluation indicators are calculated. It is worth noting that the unweighted graph initially established for training has only 0.8M graph nodes. The hyperbolic attention classification network with the best evaluation indicators among the 5 training and test groups is selected as the final protocol classifier.

[0052] Specifically, a packet capture scheme is adopted to process unknown protocol type data, a dual-view feature representation is generated through an improved feature extraction scheme, and further input into an improved protocol classifier, a new graph node is added to the weighted graph of M existing graph nodes, and the edge value of the newly added graph node and the existing M graph nodes is set to 1. After processing by the improved protocol classifier, it is updated to a weighted graph of M+1 graph nodes, and the label corresponding to the unknown protocol type data is assigned.

[0053] Compared with the prior art, the present invention has the following significant advantages: adopting a priori knowledge analysis or asynchronous extraction network to design a feature extraction scheme, deeply analyzing the characteristics of data packets, extracting data packet features to generate feature representation, replacing the simple method of directly using the key frame value range to represent the message in the prior art, and further adopting a decision tree or a hyperbolic attention classification network to design a protocol classifier, relying on the excellent nonlinear fitting ability of the protocol classifier to establish a mapping relationship between the feature representation and the protocol type, adaptively assigning labels corresponding to the protocol type, replacing the simple comparison of key frame values ​​in the prior art, greatly improving the accuracy of the Internet of Things terminal protocol classification, and at the same time, the neural network has the two major advantages of fast processing speed and low complexity after pre-training, reducing the processing burden of the Internet of Things. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Figure 1 It is a flow chart of a classification method of IoT terminal protocols;

[0055] Figure 2 Flowchart for pre-training decision trees;

[0056] Figure 3 This is a schematic diagram of the 5-fold cross validation method;

[0057] Figure 4 This is a flow chart of the feature extraction solution based on the asynchronous extraction network;

[0058] Figure 5 Flowchart for pre-training a hyperbolic attention classification network. DETAILED DESCRIPTION

[0059] The present invention is further described in detail below in conjunction with the accompanying drawings and embodiments.

[0060] Example 1

[0061] like Figure 1 As shown, the embodiment provided by the present invention: a method for classifying protocols of IoT terminals, comprising the following specific steps:

[0062] Design a packet capture solution, use the packet capture tool to capture data of various protocol types in the communication between the host computer and the terminal devices of the power smart Internet of Things, and save it as a Pcap file;

[0063] Design feature extraction scheme based on prior knowledge analysis or deep learning, parse Pcap file and extract features, obtain corresponding feature representation, which includes effective feature representation and dual-view feature representation;

[0064] Design a protocol classifier based on machine learning or deep learning to analyze feature representation and assign labels, using conventional methods or 5-fold cross-validation for pre-training;

[0065] Obtain data of unknown protocol types, process them through packet capture and feature extraction schemes, and then input them into the pre-trained protocol classifier to automatically assign labels of corresponding protocol types.

[0066] Furthermore, the host computer refers to a computer with an operating system and a packet capture tool installed, which is connected to the terminal device through a router, and the host computer and the terminal device are always in the same network. The packet capture tools include tcpdump and Wireshark. The selection of the packet capture tool is based on the operating system installed on the host computer. Among them, tcpdump is applicable to Linux system, and Wireshark is applicable to Windows and Linux systems. Wireshark is selected in this embodiment.

[0067] Furthermore, the Pcap file includes a file header and a data packet;

[0068] The file header is used to describe the basic information and parameters of the Pcap file. The length is fixed to 24 bytes, including the major version number, minor version number, timestamp accuracy, maximum storage length, and link type.

[0069] The data packet includes basic fields and hexadecimal payload data. The basic fields include timestamp high bit, timestamp low bit, data packet length and actual data length.

[0070] Specifically, the maximum storage length is the maximum number of bytes allowed when a data packet is captured. It is generally set to 65535 to indicate that there is no length limit, and data packets of any length can be captured. The data packet length is equal to the number of bytes of the data packet after capture. The actual data length refers to the number of bytes of the data packet before capture. In short, the actual data length is generally equal to the data packet length and less than the maximum storage length. If and only if the actual data length is greater than the maximum storage length, the captured data packet is a truncated version of the data packet before capture. At this time, the data frame length is equal to the maximum storage length.

[0071] Furthermore, this embodiment selects prior knowledge analysis to implement a feature extraction solution, including the following specific steps:

[0072] Use Wireshark to parse the Pcap file to obtain data packets;

[0073] Based on prior knowledge, feature analysis is performed and N valid features that are closely related to length are selected, where N is the total number of valid features. Prior knowledge indicates that packets of different protocol types have large differences in packet length, which can be used as a basis for classifying protocol types. This is because different protocols have different formats when generating packets, which is intuitively reflected in the large differences in packet lengths.

[0074] Calculate the N valid features corresponding to a single data packet D, denoted as a 1 ,a 2 ,…,a N ;

[0075] The N valid features a of data packet D 1 ,a 2 ,…,a N Zero-mean normalization is performed separately to ensure that the feature scales of different effective features are the same, generating effective feature representations of data packet D in, is the nth valid feature a of data packet D n The normalized value of is calculated as follows:

[0076]

[0077] in, and σ n are the mean and standard deviation of the nth valid feature, respectively, which can be calculated using the data set used by the pre-trained protocol classifier.

[0078] Specifically, effective features closely related to length include the length of a single data packet, the average length of data packets, the difference between a single data packet and the average length of data packets, the difference between the length of a single data packet and the longest data packet, and the difference between the length of a single data packet and the shortest data packet.

[0079] like Figure 2 As shown, further, in this embodiment, a decision tree is selected to implement a protocol classifier. As a classic machine learning algorithm, the decision tree has the advantages of strong interpretability, automatic feature selection, and good performance in handling nonlinear relationships. The pre-trained protocol classifier is essentially to build a decision tree, including the following specific steps:

[0080] Obtain no less than 5,000 Pcap files of each protocol in the smart power IoT terminal device through the packet capture solution, and obtain a total of M Pcap files. There are K different protocol types, and M≥5000×K, where M is the total number of files and K is the total number of types.

[0081] Based on the feature extraction scheme, obtain the data packet, calculate the N effective features of each data packet, and obtain the mean of the N effective features respectively. and standard deviation σ 1 ,σ 2 ,…,σ N , the mean of the nth effective feature and standard deviation σ n The specific formula is as follows

[0082]

[0083] in, For the mth data packet D m The nth valid feature of ;

[0084] The N valid features of each data packet are normalized to zero mean respectively to obtain the valid feature representation corresponding to each data packet. m For example, data packet D m Effective feature representation

[0085] Set K protocol types as K labels, denoted as y1, y2, …, y K , and assign labels to data packets of corresponding protocol types to construct data set D;

[0086] Calculate the information entropy H(D) of data set D. Information entropy H(D) indicates the purity of data set D. The more protocol types of data packets in data set D, the greater the uncertainty of data set D, and the greater the information entropy H(D). The specific formula is as follows:

[0087]

[0088] Among them, M k is the kth label y in the dataset D k The total number of corresponding k-type packets satisfies

[0089] Count the total number of values ​​L of the nth valid feature in the data set D n , the total number of values ​​L n It indicates that the nth valid features of M data packets in data set D exist in L n different values;

[0090] If the data set D is divided according to the nth valid feature, based on the total number of values ​​L n The dataset D can be divided into L n sub-datasets, respectively Calculate the information gain g(D,n) of the nth effective feature for the data set D. The information gain g(D,n) indicates the benefit of dividing the data set D according to the nth effective feature, that is, dividing the data set D into sub-data sets The specific formula is as follows:

[0091]

[0092] in, Indicates the first n sub-datasets, For the first n Sub-datasets The total number of packets, For the first n Sub-datasets The corresponding k-th label y k The total number of k-type sub-packets, l n =1,2,…,L n ;

[0093] Select the effective feature with the largest information gain as the basis for division, and divide the data set D as a divisible node. Assuming that the information gain g(D,n) of the nth effective feature is the largest among the information gains of N effective features, the data set D is divided into L n Sub-datasets And L n Sub-datasets Located in the next layer of dataset D;

[0094] Execute the partitioning decision, and decide whether the sub-dataset is a separable node or a leaf node based on the information entropy of each sub-dataset. n Sub-datasets For example, determine the sub-dataset Information entropy Is it less than the entropy threshold, l n =1,2,…,L n ;

[0095] If it is less than the entropy threshold, it means that the sub-dataset The purity of the sub-dataset is high enough, that is, The data packets in the same protocol type do not need to be further divided. As a leaf node, on the contrary, further obtain N effective features for the data set The information gain of the sub-dataset is selected as the effective feature with the largest information gain as the basis for division. As a divisible node, further division will divide the sub-dataset The resulting subdataset is placed into the subdataset The next level;

[0096] Repeat the partitioning decision, and decide whether to continue partitioning to generate multiple sub-datasets of the next layer based on whether the sub-datasets obtained each time are separable nodes or leaf nodes, until all sub-datasets are leaf nodes, and stop. Assuming that a total of L sub-datasets are obtained, L is the total number of sub-datasets, and determine whether the total number of sub-datasets L is greater than the total number of types K;

[0097] If it is greater than, the leaf nodes divided based on the smallest LK information gains are deleted, and K leaf nodes are obtained to correspond to K protocol types. Otherwise, all leaf nodes are retained and the decision tree is constructed.

[0098] like Figure 3 As shown in (a), further, the pre-training protocol classifier process can be improved by introducing a 5-fold cross-validation method. Specifically, the data set D is evenly and randomly divided into 5 subsets, and 1 unselected subset is selected as the test set. The remaining 4 subsets are used as training sets to construct a training test group. Since there are 5 subsets in total, 5 different training test groups can be constructed. The training sets in the 5 training test groups are used to construct the decision tree in turn, and the test set is input into the constructed decision tree for label assignment. The evaluation indicators of the 5 test sets are calculated. The evaluation indicators include accuracy, precision and recall. The decision tree with the best evaluation indicators in the 5 training test groups is selected as the final protocol classifier.

[0099] Specifically, after the unknown protocol type data is processed by the packet capture scheme and the feature extraction scheme, the effective feature representation of the unknown protocol type data is obtained and input into the protocol classifier. At each layer of the decision tree, based on the corresponding effective feature value in the effective feature representation, it is adaptively placed into the corresponding sub-data set of the next layer of the decision tree until the leaf node is placed and the label corresponding to the leaf node is assigned to the unknown protocol type data.

[0100] Compared with the prior art, the present embodiment provides a method for classifying protocols for IoT terminals. By designing a packet capture scheme, a Pcap file is generated with the help of a packet capture tool. A feature extraction scheme is designed through prior knowledge analysis. The Pcap file is parsed and the features that are most easily distinguished between different protocol types are extracted to obtain corresponding feature representations. A protocol classifier is designed based on a decision tree. The feature representation is analyzed and adaptive label assignment is achieved. At the same time, a 5-fold cross-validation method is introduced to improve the pre-training process, improve the performance of the decision tree, obtain unknown protocol type data, and after being processed by the packet capture scheme and the feature extraction scheme, the data is input into the pre-trained decision tree to automatically assign labels for the corresponding protocol types, thereby effectively solving the problems of high complexity and low precision caused by the comparison of key frame value ranges in the prior art.

[0101] Example 2

[0102] Based on the optimization of Example 1, an improved feature extraction scheme and protocol classifier are proposed.

[0103] The feature extraction scheme implemented by feature analysis based on prior knowledge considers the length of packets of different protocol types to select effective features. On the one hand, feature selection relies on the prior knowledge of relevant technical personnel. On the other hand, in addition to the intuitive feature of the length of the packet, there are other minable features that can assist in distinguishing different protocol types. Considering the excellent feature mining performance of deep learning, this embodiment proposes an improved feature extraction scheme based on an asynchronous extraction network.

[0104] like Figure 4 As shown, preferably, the feature extraction scheme based on the asynchronous extraction network includes the following specific steps:

[0105] Obtain M Pcap files through the packet capture solution, with a total of K protocol types, where M is the total number of files and K is the total number of types;

[0106] Wireshark is used to parse the Pcap file to obtain M data packets, and the basic fields and hexadecimal payload data in the M data packets are extracted respectively, and the hexadecimal payload data is converted into decimal payload data;

[0107] The basic fields of a single data packet are regarded as the first data block, and the decimal value 256 is used to fill the decimal payload data of the single data packet to generate a second data block of the same dimension. m For example, data packet D m The corresponding first data block and second data block are denoted as d m,1 and d m,2 ;

[0108] The first data block d m,1 Input the shallow convolution block, use a 3×3 convolution kernel with a step size of 1 to perform convolution, and extract the first data block d m,1 The structural features in , and further reduce the dimension of the structural features through average pooling to generate shallow feature representation x m,1 ,Since the basic fields of different protocol types have relatively fixed ,structures and contents, the distinguishability is relatively intuitive and can be ,extracted through shallow convolution;

[0109] The second data block d m,2 Input deep convolution block, first use 3×3 convolution kernel with step size 1 for convolution, and retain the key part and reduce the dimension through maximum pooling to obtain primary features, and further use 1×1 convolution kernel with step size 1 for one-dimensional convolution to learn the semantic relationship between adjacent key features and generate secondary features. The residual layer is used to superimpose the primary and secondary features to generate deep feature representation x m,2 ;

[0110] The shallow feature representation x m,1 and the deep feature representation x m,2 Splicing is performed and further dimension reduction is performed through the linear layer to generate data packet D m The dual-view feature representation x m ,The purpose of dimensionality reduction is to accelerate the processing speed of the subsequent ,protocol classifier.

[0111] Since decision trees have problems such as sensitivity to training data, lack of smoothness and category imbalance, in order to better utilize the dual-view feature representation generated by the asynchronous extraction network, a hyperbolic attention classification network is used instead of the classic decision tree as an improved protocol classifier for pre-training.

[0112] like Figure 5 As shown, preferably, the pre-training of the hyperbolic attention classification network includes the following specific steps:

[0113] Consider M data packets as graph nodes, and establish an edge with a value of 1 between any two graph nodes to construct an unweighted graph. An unweighted graph means that the degree of association between any two graph nodes is considered the same, that is, all graph nodes cannot effectively distinguish the protocol type, and it is temporarily considered that there is only one protocol.

[0114] Define the loss function as cross entropy and select Adam optimizer;

[0115] The mth data packet D m The dual-view feature representation x m Through the exponential mapping function Projecting to the hyperbolic space, using the hierarchical modeling capability of hyperbolic geometry, fully exploiting the dual-view feature representation x m The hierarchical structure generates a hyperbolic feature representation Hyperbolic characteristic representation q m The i-th hyperbolic characteristic q m,i The specific calculation formula is as follows

[0116]

[0117] Among them, x m,i is the dual-view feature representation x m The i-th dual-view feature in the hyperbolic space, v is a point in the hyperbolic space, usually the origin, that is, v = 0, c is the negative reciprocal of the curvature of the hyperbolic space, that is, the curvature of the hyperbolic space is -1 / c, represents the Möbius addition, ||·|| represents the two-norm, m=1,2,…,M;

[0118] In order to obtain better representation ability, the hyperbolic feature is represented as q m Further, the weight sharing matrix W generated by random initialization and trainable adjustments Perform a linear transformation and represent the hyperbolic feature q m Transform to a higher order hidden representation in, represents the Möbius multiplication;

[0119] Analogous to the attention mechanism in Euclidean space, the attention coefficient between graph nodes is obtained based on the hyperbolic distance between two graph nodes in hyperbolic space. The attention coefficient is used to allocate the importance of each graph node to the remaining graph nodes. The attention coefficient e between the mth graph node and the jth graph node is m,j =f d (h m ,h j The specific calculation formula of ) is as follows

[0120]

[0121] Where c is the negative inverse of the curvature of the hyperbolic space. When the attention coefficient e m,j When the value is larger, it indicates that the hyperbolic distance between the mth graph node and the jth graph node is closer, the Euclidean distance fed back to the Euclidean space is also closer, the probability that the mth graph node and the jth graph node belong to the same protocol type is higher, and the jth graph node is more worthy of the attention of the mth graph node, j = 1, 2, …, M, j ≠ m;

[0122] Get the attention coefficients of the mth graph node and the remaining M-1 graph nodes, and construct the attention vector e of the mth graph node m , and align them through the Softmax function, normalize them to the range of 0-1, and generate the edge value vector w of the mth graph node m , where the edge value w between the mth graph node and the jth graph node is m,j The specific calculation formula is as follows

[0123]

[0124] At this time, the unweighted graph is updated to a weighted graph. The weighted graph indicates the degree of association between each graph node. The closer the edge value between two graph nodes of the same protocol type is to 1;

[0125] Using the edge value between the mth graph node and the remaining M-1 graph nodes in the weighted graph, combined with the hidden representation of the M-1 graph nodes, the mth graph node is re-represented through weighted aggregation to generate the aggregated hyperbolic feature representation h′ m The specific formula is as follows

[0126]

[0127] Among them, the aggregated hyperbolic feature represents h′ m Compared to the hidden representation hm ,While retaining strong representation capabilities, it enhances the correlation between the same protocol types, which is more conducive to classification;

[0128] Using logarithmic mapping function The aggregated hyperbolic feature of the mth graph node in the hyperbolic space is represented as h′ m Remap back to Euclidean space to generate the aggregate feature representation of the mth graph node Aggregate feature representation x′ m The i-th aggregate feature x′ in m,i The specific calculation formula is as follows

[0129]

[0130] Among them, v is the point in the hyperbolic space selected when projecting to the hyperbolic space, h′ m,i is the aggregate hyperbolic feature representation h′ m The i-th aggregate hyperbolic feature in ;

[0131] The aggregate feature is represented as x′ m The linear fully connected layer is used to reduce the dimension to 1×K, and the Softmax function is used to generate the probability distribution vector p of the mth graph node. m =Softmax(W c ·x′ m +b c ), probability distribution vector p m The kth value in represents the mth graph node belonging to the kth label y k The probability of choosing the probability distribution vector p m The label corresponding to the maximum probability is assigned to the mth graph node;

[0132] Calculate the cross entropy loss and determine whether the cross entropy loss is less than the loss threshold. If so, stop pre-training. Otherwise, adjust the hyperparameters along the gradient direction of the loss function to reduce and train again.

[0133] like Figure 3 As shown in (b), preferably, a 5-fold cross-validation method is introduced to improve the training process. Similarly, 5 training and test groups are constructed, and the hyperbolic attention classification network is trained in turn and the evaluation indicators are calculated. It is worth noting that the unweighted graph initially established for training has only 0.8M graph nodes. The hyperbolic attention classification network with the best evaluation indicators among the 5 training and test groups is selected as the final protocol classifier.

[0134] Specifically, a packet capture scheme is used to process unknown protocol type data, which is processed through an improved feature extraction scheme to generate a dual-view feature representation, and further input into the improved protocol classifier. At this time, it is equivalent to adding a new graph node to the weighted graph with M graph nodes, and setting the edge values ​​of the newly added graph node and the existing M graph nodes to 1, which becomes a partial unweighted graph of M+1 graph nodes. After being processed by the improved protocol classifier, it is updated to a weighted graph of M+1 graph nodes, and the label corresponding to the unknown protocol type data is assigned.

[0135] Compared with Example 1, the improved feature extraction scheme and protocol classifier proposed in this embodiment have the beneficial effect that the asynchronous extraction network takes into account the basic fields and payload data in the data packet, and no longer only observes the features related to the length of the data packet. It fully considers the features from multiple angles such as length, structure and semantics to represent the data packet, so that the feature representation contains richer information, which is conducive to classification and discrimination. At the same time, the hyperbolic attention classification network maps the feature representation to the hyperbolic space, further learns the hierarchical structure of the feature representation, and allocates the attention coefficients of the graph nodes based on the hyperbolic space distance, re-represents the graph nodes through weighted aggregation, strengthens the association between graph nodes of the same protocol type, and finally maps back to the original space to achieve higher-precision classification.

[0136] The above is only a preferred embodiment of the present invention, and the protection scope of the present invention is not limited to the above embodiments. All technical solutions under the concept of the present invention belong to the protection scope of the present invention. It should be pointed out that for ordinary technicians in this technical field, some improvements and modifications without departing from the principle of the present invention should also be regarded as the protection scope of the present invention.

Claims

1. A method for classifying Internet of Things terminal protocols, characterized in that: The specific steps include: Design a packet capture solution, use the packet capture tool to capture data and save it as a Pcap file; Design feature extraction scheme based on prior knowledge analysis or asynchronous extraction network, and generate feature representation based on Pcap file; Design a protocol classifier based on a decision tree or hyperbolic attention classification network to achieve label assignment, and pre-train it using conventional methods or 5-fold cross-validation; The unknown protocol type data is processed through packet capture and feature extraction schemes, and labels are assigned by the protocol classifier.

2. A method for classifying Internet of Things terminal protocols as claimed in claim 1, characterized in that: The hyperbolic attention classification network is pre-trained using a conventional method and includes the following specific steps: Treat all data packets as graph nodes, establish an edge with an edge value of 1 between any two graph nodes, and construct an unweighted graph; Select cross entropy and Adam as the loss function and optimizer respectively; The dual-view feature representation of a single data packet is projected into the hyperbolic space through an exponential mapping function to generate a hyperbolic feature representation; The hyperbolic feature representation is transformed linearly through the weight sharing matrix into a hidden representation; The attention coefficient between graph nodes is obtained based on the hyperbolic distance between two graph nodes in the hyperbolic space, and the importance of a single graph node to each of the remaining graph nodes is allocated through the attention coefficient; Get the attention coefficients of a single graph node and all other graph nodes to construct an attention vector, and align the edge value vector of a single graph node through the Softmax function to update the unweighted graph to a weighted graph; Using the edge values ​​between a single graph node and all other graph nodes in the weighted graph, the single graph node is re-represented through weighted aggregation to generate an aggregated hyperbolic feature representation; The aggregated hyperbolic feature representation is remapped to generate an aggregated feature representation using a logarithmic mapping function; The aggregated feature representation is passed through a linear fully connected layer and a Softmax function to generate a probability distribution vector of a single graph node, and the label corresponding to the maximum probability in the probability distribution vector is selected and assigned to the single graph node; Calculate the cross entropy loss and decide whether to stop training based on whether the cross entropy loss is less than the loss threshold.

3. The method for classifying Internet of Things terminal protocols according to claim 1, characterized in that: The decision tree is pre-trained using a conventional method and includes the following specific steps: Get all Pcap files and determine the total number of files and types; Based on the feature extraction scheme, the effective feature representation of all data packets is obtained, corresponding labels are set for all protocol types, and the labels are assigned to the data packets of the corresponding protocol types to construct the data set; Calculate the information entropy of the data set, count the total number of values ​​of a single effective feature in the data set, and calculate the information gain of a single effective feature for the data set; The single effective feature with the largest information gain is used as the basis for division, and the data set is divided into multiple sub-data sets as divisible nodes; Execute the partitioning decision, and decide whether the sub-dataset is a separable node or a leaf node based on whether the information entropy of each sub-dataset is less than the entropy threshold; When the sub-dataset is a separable node, a single effective feature with the largest information gain is further selected as the basis for division, and further division is performed; The partitioning decision is repeated until all sub-datasets are leaf nodes. Leaf nodes are deleted based on whether the total number of sub-datasets is greater than the total number of types. If so, the leaf nodes of the minimum information gain partition are deleted in turn until the total number of leaf nodes is equal to the total number of types.

4. A method for classifying Internet of Things terminal protocols as described in any one of claims 1 to 3, characterized in that: The pre-training can be improved by a 5-fold cross-validation method, where the data set is evenly and randomly divided into 5 subsets, one subset is selected as a test set, and the remaining subsets are used as training sets to pre-train a decision tree or a hyperbolic attention classification network, and the test set is input to calculate the evaluation index, and the evaluation index when the 5 subsets are used as test sets is obtained, and the decision tree or hyperbolic attention classification network with the best evaluation index is selected.

5. The method for classifying Internet of Things terminal protocols according to claim 1, characterized in that: The feature extraction scheme based on the asynchronous extraction network includes the following specific steps: Obtain the Pcap file through the packet capture solution, parse the Pcap file to obtain the data packet, extract the basic fields and hexadecimal payload data in the data packet, and convert the hexadecimal payload data into decimal payload data; Using the basic fields of a single data packet as the first data block, filling the decimal payload data of the single data packet to generate a second data block; The first data block is input into the shallow convolution block, and features are extracted and reduced in dimension through convolution and average pooling to generate shallow feature representation; The second data block is input into the deep convolution block, and the primary features are first obtained through convolution and maximum pooling, and the secondary features are further generated by one-dimensional convolution. The primary features and the secondary features are superimposed through the residual layer to generate a deep feature representation; The shallow feature representation and the deep feature representation are concatenated and a dual-view feature representation is generated through a linear layer.

6. The method for classifying Internet of Things terminal protocols according to claim 1, characterized in that: The feature extraction scheme based on prior knowledge analysis includes the following specific steps: Use Wireshark to parse the Pcap file to obtain data packets; Perform feature analysis based on prior knowledge and select multiple effective features that are closely related to length; Calculate all valid features of a single data packet; All valid features of a single data packet are normalized to zero mean to generate a valid feature representation of a single data packet.

7. The method for classifying Internet of Things terminal protocols according to claim 1, characterized in that: The implementation method of assigning a label to data of unknown protocol type includes: Process unknown protocol type data through packet capture solution; Generate dual-view feature representation through asynchronous extraction network; Add a new graph node to the weighted graph, set the edge value of the newly added graph node and the existing graph node to 1, use the hyperbolic attention classification network to update the weighted graph, and assign the label corresponding to the unknown protocol type data.

8. The method for classifying Internet of Things terminal protocols according to claim 1, characterized in that: The implementation method of assigning a data tag of an unknown protocol type also includes: Process unknown protocol type data through packet capture solution; Obtain effective feature representation through prior knowledge analysis; The decision tree is input and adaptively placed into leaf nodes, and the labels corresponding to the leaf nodes are assigned to the unknown protocol type data.

9. A method for classifying Internet of Things terminal protocols as described in any one of claims 1, 3, 5, and 6, characterized in that: The Pcap file includes a file header and a data packet; The file header has a fixed length and includes a major version number, a minor version number, a timestamp precision, a maximum storage length, and a link type; The data packet consists of basic fields and hexadecimal payload data.

10. A method for classifying Internet of Things terminal protocols as claimed in claim 6, characterized in that: The effective features include the length of a single data packet, the average length of a data packet, the difference between a single data packet and the average length of a data packet, the difference between the length of a single data packet and the longest data packet, and the difference between the length of a single data packet and the shortest data packet.

Images