An iot terminal protocol classification method

Abstract

The application discloses a kind of Internet of Things terminal protocol classification methods, it is related to electrical automation field, design packet capture scheme, capture data with the aid of packet capture tool to generate Pcap file;Based on prior knowledge analysis or asynchronous extraction network design feature extraction scheme, generate the feature representation of Pcap file;Based on decision tree or hyperbolic attention classification network design protocol classifier to realize label assignment, and through conventional method or 5-fold cross validation method is pre-trained to ensure protocol classifier performance;Unknown protocol type data is processed by packet capture scheme and feature extraction scheme, and is assigned label by protocol classifier, realizes the high-precision, high-efficiency and low-complexity adaptive classification of physical network protocol.

Description

Technical Field

[0001] This invention relates to the field of electrical automation, and more specifically to a method for classifying Internet of Things (IoT) terminal protocols. Background Technology

[0002] With the diversification of electrical equipment and the increasing demands for higher quality electricity services from consumers, higher requirements are being placed on the power grid management and maintenance personnel's power operation and maintenance services. The Power Internet of Things (IoT) can flexibly and efficiently connect power grid management and maintenance personnel with various enterprises and devices, providing unified access and information exchange services for both power grid maintenance personnel and power companies. However, with the increase in smart power IoT terminal devices, the protocols between devices vary (including but not limited to protocols such as 698, 645, and Modbus), and some device protocols are even unknown, leading to a rapidly increasing workload for power grid management and maintenance personnel. To strengthen the operation and maintenance management of power IoT terminal devices and meet the application needs of power grid management and maintenance users, it is necessary to automatically identify the protocol types of connected smart devices.

[0003] A Chinese patent application with publication number CN115729276B proposes a pre-parsing method for power Internet of Things (IoT) protocols. This method obtains all protocols supported by the power IoT system, establishes a protocol feature library to determine the value range of multiple key frames for different protocols, obtains and analyzes the power protocol messages sent by the terminal, and identifies the protocol type based on the value range of multiple key frames in the power protocol messages.

[0004] Existing technologies classify and identify IoT protocols by simply comparing the range of text feature values. The accuracy of classification and identification still has considerable room for improvement. Moreover, when identifying messages of unknown protocol types, it is necessary to traverse all protocol types in the protocol feature library and compare them one by one with multiple key frames of a single protocol type. This is too complex and increases the burden on IoT processing. Summary of the Invention

[0005] The purpose of this invention is to provide a method for classifying Internet of Things (IoT) terminal protocols to achieve high-precision automated protocol classification.

[0006] The technical solution to achieve the purpose of this invention is as follows:

[0007] A method for classifying IoT terminal protocols includes the following specific steps:

[0008] Design a packet capture scheme to capture data in the communication between the host computer and the terminal device using packet capture tools and save it as a Pcap file;

[0009] Based on prior knowledge analysis or deep learning, design feature extraction schemes to extract features from Pcap files and generate feature representations;

[0010] Design a protocol classifier based on machine learning or deep learning to assign labels, and pre-train it using conventional methods or 5-fold cross-validation.

[0011] Data of unknown protocol types is processed using packet capture and feature extraction methods, and then automatically labeled by a protocol classifier.

[0012] Furthermore, a Pcap file includes a header and data packets;

[0013] The file header is fixed at 24 bytes and includes the major version number, minor version number, timestamp precision, maximum storage length, and link type.

[0014] The data packet includes basic fields and hexadecimal payload data. The basic fields include the high byte of the timestamp, the low byte of the timestamp, the data packet length, and the actual data length.

[0015] Furthermore, the feature extraction scheme is implemented by selecting prior knowledge analysis, including the following specific steps:

[0016] Use Wireshark to parse the Pcap file to obtain data packets;

[0017] Feature analysis is performed based on prior knowledge, and N effective features closely related to length are selected, where N is the total number of effective features.

[0018] Calculate N valid features of a single data packet D, denoted as a. 1 ,a 2 ,…,a N ;

[0019] Take the N valid features a of data packet D 1 ,a 2 ,…,a N Zero-mean normalization is performed on each data packet D to generate an effective feature representation a.

[0020] Specifically, effective features closely related to length include single packet length, average packet length, the difference between single packet length and average packet length, the difference between single packet length and longest packet length, and the difference between single packet length and shortest packet length.

[0021] Furthermore, the pre-trained protocol classifier essentially involves constructing a decision tree, which includes the following specific steps:

[0022] Obtain M Pcap files, representing K protocol types, where M is the total number of files and K is the total number of types; obtain the effective feature representations of the M files based on the feature extraction scheme, and the m-th data packet D... m The effective feature is represented as a m ;

[0023] Assign K protocol types to K tags, denoted as y1, y2, ..., y K Then, the labels are assigned to the data packets of the corresponding protocol types to construct dataset D;

[0024] Calculate the information entropy H(D) of dataset D to indicate the purity of dataset D, and count the total number L values ​​of the nth valid feature in dataset D. n Calculate the information gain g(D,n) of the nth effective feature for dataset D, where n = 1, 2, ..., N, and N is the total number of effective features;

[0025] Select the effective feature with the largest information gain as the basis for partitioning, and divide the dataset D into multiple sub-datasets as separable nodes.

[0026] Perform a partitioning decision, determining whether a subset of data is a separable node or a leaf node based on whether the information entropy of each subset is less than the entropy threshold;

[0027] If the value is less than the entropy threshold, it indicates that the subset is a leaf node and no further division is needed. Otherwise, the subset is considered a separable node, and the effective feature with the largest information gain is selected as the basis for further division.

[0028] Repeat the partitioning decision until all partitioned subsets are leaf nodes, then determine if the total number of subsets L is greater than the total number of types K.

[0029] If the information gain is greater than the minimum, delete the leaf nodes of the smallest LK information gain partitions and obtain K leaf nodes; otherwise, retain all leaf nodes.

[0030] Furthermore, the pre-training protocol classifier process can be improved by introducing 5-fold cross-validation. The dataset D is uniformly and randomly divided into 5 subsets. One subset is selected as the test set, and the remaining subsets are used as the training set to build a decision tree. The test set is then input into the decision tree to calculate the evaluation index. The evaluation indexes are obtained when the 5 subsets are used as the test sets, and the decision tree protocol classifier with the best evaluation index is selected.

[0031] Specifically, by using packet capture and feature extraction methods, effective feature representations of data with unknown protocol types can be obtained. These representations are then input into a protocol classifier, adaptively placed into the leaf nodes of a decision tree, and the labels corresponding to the leaf nodes are assigned to the data with unknown protocol types.

[0032] Based on the above feature extraction scheme, a further improvement on the feature extraction scheme based on asynchronous extraction networks includes the following specific steps:

[0033] M Pcap files were obtained using a packet capture method, representing K protocol types, where M is the total number of files and K is the total number of types.

[0034] Wireshark is used to parse the Pcap file to obtain M data packets. The basic fields and hexadecimal payload data are extracted from the M data packets respectively, and the hexadecimal payload data is converted into decimal payload data.

[0035] The basic fields of a single data packet are used as the first data block, and the decimal payload data of the single data packet is filled to generate a second data block with the same dimensions.

[0036] The first data block is input into the shallow convolutional block, and convolution is performed using a 3×3 convolutional kernel with a stride of 1 to extract the structural features of the first data block. The shallow feature representation is generated by reducing the dimensionality through average pooling.

[0037] The second data block is input into the deep convolution block. First, a 3×3 convolution kernel is used to perform convolution with a stride of 1. Then, the dimensionality is reduced by max pooling to obtain the first-order features. Next, a 1×1 convolution kernel is used to perform one-dimensional convolution with a stride of 1 to generate the second-order features. The first-order features and the second-order features are superimposed through the residual layer to generate the deep feature representation.

[0038] Shallow and deep feature representations are concatenated to generate dual-view feature representations through a linear layer.

[0039] Based on the above-mentioned protocol classifier, further improvements are made through a hyperbolic attention classification network. The pre-training of the hyperbolic attention classification network includes the following specific steps:

[0040] Treat M data packets as graph nodes, and construct an edge with a value of 1 between any two graph nodes to build an unweighted graph;

[0041] Define the loss function as cross-entropy and select the Adam optimizer;

[0042] The m-th data packet D m Dual-view feature representation x m Through the exponential mapping function Projecting onto hyperbolic space generates hyperbolic feature representations.

[0043] Representing hyperbolic features q m Further through the weight sharing matrix W s Perform a linear transformation to convert it into a higher-order hidden representation. in, This represents Möbius multiplication;

[0044] Attention coefficients between graph nodes are obtained based on the hyperbolic distance between two graph nodes in hyperbolic space, and the importance of each graph node to each other graph node is assigned based on the attention coefficients.

[0045] Obtain the attention coefficients of the m-th graph node and the remaining M-1 graph nodes, and construct the attention vector e of the m-th graph node. m The edge value vector w of the m-th graph node is generated by aligning the edges using the Softmax function. m Update unauthorized images to authorized images;

[0046] Using the edge values ​​between the m-th graph node and the remaining M-1 graph nodes in the weighted graph, the m-th graph node is re-represented through weighted aggregation, generating an aggregated hyperbolic feature representation h′. m ;

[0047] Using logarithmic mapping function The aggregated hyperbolic feature representation h′ m Remapping back to Euclidean space generates the aggregated feature representation of the m-th graph node.

[0048] The aggregated feature is represented as x′ m The dimension is reduced to 1×K using a linear fully connected layer, and the probability distribution vector p of the m-th graph node is generated using the Softmax function. m And select the probability distribution vector p m The label corresponding to the highest probability in the graph is assigned to the m-th graph node;

[0049] Determine if the cross-entropy loss is less than the loss threshold. If it is, stop training; otherwise, adjust the hyperparameters of the hyperbolic attention classification network to retrain.

[0050] Preferably, a 5-fold cross-validation method is introduced for improvement. The cross-validation process is completely consistent with that in Example 1. The difference is that the processing steps during the training of the protocol classifier are replaced with the processing steps of the hyperbolic attention classification network. In addition, the unweighted graph initially established during training has only 0.8M graph nodes. Finally, the hyperbolic attention classification network with the best evaluation index among the 5 training and testing groups is selected as the protocol classifier.

[0051] Preferably, a 5-fold cross-validation method is introduced to improve the training process. Five training and test groups are constructed, and the hyperbolic attention classification network is trained sequentially and the evaluation index is calculated. It is worth noting that the unweighted graph initially established during training has only 0.8M graph nodes. The hyperbolic attention classification network with the best evaluation index among the five training and test groups is selected as the final protocol classifier.

[0052] Specifically, a packet capture scheme is used to process data of unknown protocol types. An improved feature extraction scheme is used to generate a dual-view feature representation, which is then input into an improved protocol classifier. A new graph node is added to the existing weighted graph with M graph nodes. The edge value between the added graph node and the existing M graph nodes is set to 1. After processing by the improved protocol classifier, the graph is updated to a weighted graph with M+1 graph nodes, and the data of unknown protocol types is assigned the corresponding label.

[0053] Compared with existing technologies, the significant advantages of this invention are as follows: It adopts a prior knowledge analysis or asynchronous extraction network design feature extraction scheme to deeply analyze the characteristics of data packets, extract data packet features to generate feature representations, replacing the simple method of directly using the key frame value range to represent the message in existing technologies. Furthermore, it adopts a decision tree or hyperbolic attention classification network to design a protocol classifier, relying on the excellent nonlinear fitting ability of the protocol classifier to establish a mapping relationship between feature representations and protocol types, and adaptively assigns labels corresponding to protocol types, replacing the simple comparison of key frame values ​​in existing technologies. This greatly improves the accuracy of IoT terminal protocol classification. At the same time, the neural network has the advantages of fast processing speed and low complexity after pre-training, reducing the processing burden of IoT. Attached Figure Description

[0054] Figure 1 A flowchart of a method for classifying IoT terminal protocols;

[0055] Figure 2 Flowchart for decision tree pre-training;

[0056] Figure 3 This is a schematic diagram of the 5-fold cross-validation method.

[0057] Figure 4 This is a flowchart of a feature extraction scheme based on an asynchronous extraction network.

[0058] Figure 5 Flowchart for pre-training a hyperbolic attention classification network. Detailed Implementation

[0059] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments.

[0060] Example 1

[0061] like Figure 1 As shown, the embodiment provided by the present invention: an IoT terminal protocol classification method, includes the following specific steps:

[0062] Design a packet capture scheme to capture data of various protocol types in the communication between the host computer and the terminal devices of the power smart IoT using packet capture tools, and save it as a Pcap file;

[0063] Based on prior knowledge analysis or deep learning, a feature extraction scheme is designed, the Pcap file is parsed and features are extracted, and the corresponding feature representations are obtained. The feature representations include effective feature representations and dual-view feature representations.

[0064] Design a protocol classifier based on machine learning or deep learning to analyze feature representations and assign labels, and pre-train it using conventional methods or 5-fold cross-validation.

[0065] Data of unknown protocol types is acquired, processed using packet capture and feature extraction methods, and then input into a pre-trained protocol classifier to automatically assign labels to the corresponding protocol types.

[0066] Furthermore, the host computer refers to a computer with an operating system and packet capture tools installed, which is connected to the terminal device through a router, and the host computer and the terminal device are always in the same network. The packet capture tools include tcpdump and Wireshark. The choice of packet capture tool is based on the operating system installed on the host computer. Among them, tcpdump is suitable for Linux systems, and Wireshark is suitable for Windows and Linux systems. In this embodiment, Wireshark is selected.

[0067] Furthermore, a Pcap file includes a header and data packets;

[0068] The file header is used to describe the basic information and parameters of the Pcap file. Its length is fixed at 24 bytes, including the major version number, minor version number, timestamp precision, maximum storage length, and link type.

[0069] The data packet includes basic fields and hexadecimal payload data. The basic fields include the high byte of the timestamp, the low byte of the timestamp, the data packet length, and the actual data length.

[0070] Specifically, the maximum storage length is the maximum number of bytes allowed when a data packet is captured. It is generally set to 65535 to indicate that there is no length limit and data packets of any length can be captured. The data packet length is equal to the number of bytes in the captured data packet. The actual data length refers to the number of bytes in the data packet before capture. In short, the actual data length is generally equal to the data packet length and less than the maximum storage length. The captured data packet is a truncated version of the data packet before capture if and only if the actual data length is greater than the maximum storage length. In this case, the data frame length is equal to the maximum storage length.

[0071] Furthermore, this embodiment selects prior knowledge analysis to implement the feature extraction scheme, including the following specific steps:

[0072] Use Wireshark to parse the Pcap file to obtain data packets;

[0073] Feature analysis is performed based on prior knowledge. N effective features closely related to length are selected, where N is the total number of effective features. Prior knowledge indicates that data packets of different protocol types differ greatly in terms of data packet length, which can be used as a basis for classifying protocol types. This is because different protocols have different formats when generating data packets, which is intuitively reflected in the large difference in data packet length.

[0074] Calculate the N valid features corresponding to a single data packet D, denoted as a. 1 ,a 2 ,…,a N ;

[0075] Take the N valid features a of data packet D 1 ,a 2 ,…,a N Zero-mean normalization is performed on each feature to ensure that the feature scales of different effective features are the same, thus generating the effective feature representation of data packet D. in, The nth valid feature a of data packet D n The normalized value is calculated using the following formula:

[0076]

[0077] in, and σ n These are the mean and standard deviation of the nth effective feature, respectively, which can be calculated from the dataset used by the pre-trained protocol classifier.

[0078] Specifically, effective features closely related to length include single packet length, average packet length, the difference between single packet length and average packet length, the difference between single packet length and longest packet length, and the difference between single packet length and shortest packet length.

[0079] like Figure 2 As shown, in this embodiment, a decision tree is chosen to implement the protocol classifier. As a classic machine learning algorithm, the decision tree has advantages such as strong interpretability, automatic feature selection, and good performance in handling nonlinear relationships. Pre-training the protocol classifier is essentially constructing a decision tree, including the following specific steps:

[0080] The packet capture method obtains no less than 5000 Pcap files for each protocol in the smart power IoT terminal device, for a total of M Pcap files. There are K different protocol types, and M≥5000×K, where M is the total number of files and K is the total number of types.

[0081] Data packets are acquired based on a feature extraction scheme. N effective features are calculated for each data packet, and the mean of the N effective features is obtained for each packet. and standard deviation σ 1 ,σ 2 ,…,σ N The mean of the nth effective feature and standard deviation σ n The specific formula is as follows:

[0082]

[0083] in, For the m-th data packet D m The nth effective feature;

[0084] For each data packet, zero-mean normalization is performed on the N valid features to obtain the valid feature representation corresponding to each data packet. Let the m-th data packet D... m For example, data packet D m Effective feature representation

[0085] Assign K protocol types to K tags, denoted as y1, y2, ..., y K Then, the labels are assigned to the data packets of the corresponding protocol types to construct dataset D;

[0086] Calculate the information entropy H(D) of dataset D. Information entropy H(D) indicates the purity of dataset D. The more protocol types the data packets in dataset D have, the greater the uncertainty of dataset D, and the larger the information entropy H(D). The specific formula is as follows:

[0087]

[0088] Among them, M k For the k-th label y in dataset D k The total number of corresponding k-type data packets satisfies

[0089] Count the total number of values ​​L for the nth valid feature in dataset D. n The total number of values ​​L n This indicates that the nth valid feature of M data packets in dataset D coexists at level L. n A number of different values;

[0090] If the dataset D is partitioned based on the nth valid feature, then based on the total number of values ​​L... n Data set D can be divided into L n There are sub-datasets, denoted as _ ... Calculate the information gain g(D,n) of the nth effective feature for dataset D. The information gain g(D,n) represents the benefit of partitioning dataset D based on the nth effective feature, i.e., the reduction of dataset D into subsets. The degree of information entropy decrease is calculated using the following formula:

[0091]

[0092] in, Indicates the lth n Subdatasets, For the l n Subdatasets The total number of data packets, For the l n Subdatasets The corresponding k-th label y k The total number of k-type sub-data packets, l n =1,2,…,L n ;

[0093] Selecting the effective feature with the largest information gain as the partitioning criterion, and treating dataset D as separable nodes for partitioning, assuming that the information gain g(D,n) of the nth effective feature is the largest among the information gains of the N effective features, then dataset D is partitioned into L... n Subdatasets And L n Subdatasets Located in the next layer below dataset D;

[0094] Perform a partitioning decision, determining whether a subset is a separable node or a leaf node based on the information entropy of each subset, starting with the l-th subset. n Subdatasets For example, determine a subset of data. Information entropy Is it less than the entropy threshold, l n =1,2,…,L n ;

[0095] If it is less than the entropy threshold, it indicates a subset of the dataset. The purity is high enough, that is, the subset of data. All data packets in the dataset are of the same protocol type and do not require further segmentation. As leaf nodes, conversely, further obtaining N effective features for the dataset... Based on information gain, the effective feature with the largest information gain is selected as the partitioning criterion, and the subset is divided into sub-datasets. As a separable node, further partitioning will divide the dataset into sub-datasets. The resulting subset is inserted into the subset. The next layer;

[0096] Repeatedly execute the partitioning decision, and decide whether to continue partitioning to generate multiple sub-datasets in the next layer based on whether the sub-datasets obtained in each partition are separable nodes or leaf nodes, until all sub-datasets are leaf nodes. Assume that a total of L sub-datasets are obtained, where L is the total number of sub-datasets. Determine whether the total number of sub-datasets L is greater than the total number of types K.

[0097] If the information gain is greater than the minimum LK information gain, delete the leaf nodes that are partitioned based on the minimum LK information gain, and obtain K leaf nodes to correspond to K protocol types. Otherwise, retain all leaf nodes, and the decision tree construction is complete.

[0098] like Figure 3 As shown in (a), the pre-training protocol classifier process can be further improved by introducing 5-fold cross-validation. Specifically, the dataset D is uniformly and randomly divided into 5 subsets. One unselected subset is chosen as the test set, and the remaining 4 subsets are used as the training set to construct a training-test set. Since there are 5 subsets, 5 different training-test sets can be constructed. The training sets from the 5 training-test sets are used to construct decision trees in sequence. The test sets are input into the constructed decision trees for label assignment. The evaluation metrics of the 5 test sets are calculated. The evaluation metrics include accuracy, precision, and recall. The decision tree with the best evaluation metrics among the 5 training-test sets is selected as the final protocol classifier.

[0099] Specifically, after the unknown protocol type data is processed by the packet capture scheme and feature extraction scheme, the effective feature representation of the unknown protocol type data is obtained and input into the protocol classifier. At each layer of the decision tree, based on the effective feature value corresponding to the effective feature representation, it is adaptively placed into the corresponding subset of the decision tree in the next layer until it is placed into the leaf node. The label corresponding to the leaf node is then assigned to the unknown protocol type data.

[0100] Compared with existing technologies, this embodiment provides an IoT terminal protocol classification method. By designing a packet capture scheme and generating Pcap files using packet capture tools, a feature extraction scheme is designed based on prior knowledge analysis. The Pcap files are parsed to extract the features that most easily distinguish different protocol types, and corresponding feature representations are obtained. A protocol classifier is designed based on a decision tree, and the feature representations are analyzed to achieve adaptive label assignment. At the same time, a 5-fold cross-validation method is introduced to improve the pre-training process and enhance the performance of the decision tree. Data of unknown protocol types is obtained, processed by the packet capture and feature extraction schemes, and then input into the pre-trained decision tree to automatically assign labels to the corresponding protocol types. This effectively solves the problems of high complexity and low accuracy caused by keyframe value range comparison in existing technologies.

[0101] Example 2

[0102] Based on Example 1, an improved feature extraction scheme and protocol classifier are proposed.

[0103] The feature extraction scheme based on prior knowledge considers the length of data packets of different protocol types to select effective features. On the one hand, feature selection depends on the prior knowledge of relevant technical personnel. On the other hand, in addition to the intuitive feature of length, there are other features that can be mined to help distinguish different protocol types. Considering the excellent feature mining performance of deep learning, this embodiment proposes an improved feature extraction scheme based on asynchronous extraction network.

[0104] like Figure 4 As shown, the preferred feature extraction scheme based on asynchronous extraction networks includes the following specific steps:

[0105] M Pcap files were obtained using a packet capture method, representing K protocol types, where M is the total number of files and K is the total number of types.

[0106] Wireshark is used to parse the Pcap file to obtain M data packets. The basic fields and hexadecimal payload data are extracted from the M data packets respectively, and the hexadecimal payload data is converted into decimal payload data.

[0107] Using the basic fields of a single data packet as the first data block, and filling the decimal payload data of the single data packet with the decimal value 256, a second data block of the same dimension is generated, using the m-th data packet D... m For example, data packet D m The corresponding first and second data blocks are denoted as d. m,1 and d m,2 ;

[0108] The first data block d m,1 Input a shallow convolutional block, perform convolution with a 3×3 kernel and a stride of 1, and extract the first data block d. m,1 The structural features are extracted, and then the dimensionality of the structural features is further reduced by average pooling to generate a shallow feature representation x. m,1 Since the basic fields of different protocol types have relatively fixed structures and contents, they are easily distinguishable and can be extracted through shallow convolution.

[0109] The second data block d m,2 The input deep convolutional block is first convolved with a 3×3 kernel at a stride of 1, and then max pooling is used to preserve key parts and reduce dimensionality to obtain primary features. Next, a 1×1 kernel is used for one-dimensional convolution with a stride of 1 to learn the semantic relationships between adjacent key features, generating secondary features. Finally, the primary and secondary features are superimposed through a residual layer to generate a deep feature representation x. m,2 ;

[0110] Representing shallow features as x m,1 and deep feature representation x m,2 The data packets are then concatenated and further reduced in dimensionality through a linear layer to generate data packet D. m Dual-view feature representation x m The purpose of dimensionality reduction is to accelerate the processing speed of subsequent protocol classifiers.

[0111] Because decision trees suffer from problems such as sensitivity to training data, lack of smoothness, and class imbalance, a hyperbolic attention classification network is used instead of the classic decision tree as an improved protocol classifier for pre-training in order to better utilize the dual-view feature representation generated by the asynchronous extraction network.

[0112] like Figure 5 As shown, the preferred pre-training of the hyperbolic attention classification network includes the following specific steps:

[0113] Treat M data packets as graph nodes, and establish an edge with a value of 1 between any two graph nodes to construct an unweighted graph. An unweighted graph means that the degree of association between any two graph nodes is considered to be the same, that is, all graph nodes cannot effectively distinguish the protocol type, and are temporarily regarded as having only one protocol.

[0114] Define the loss function as cross-entropy and select the Adam optimizer;

[0115] The m-th data packet D m Dual-view feature representation x m Through the exponential mapping function Projecting onto hyperbolic space, and leveraging the hierarchical modeling capabilities of hyperbolic geometry, we can fully explore the dual-view feature representation x. m The hierarchical structure generates hyperbolic feature representations. Hyperbolic feature representation q m The i-th hyperbolic feature q m,i The specific calculation formula is as follows:

[0116]

[0117] Where, x m,i For dual-view feature representation x m In the i-th dual-view feature, v is a point in hyperbolic space, usually taken as the origin, i.e., v = 0, and c is the negative reciprocal of the curvature of hyperbolic space, i.e., the curvature of hyperbolic space is -1 / c. Let Möbius signify addition, ||·|| denote the L2 norm, and m = 1, 2, ..., M;

[0118] To obtain better representation capabilities, the hyperbolic feature representation q m Furthermore, a weight-sharing matrix W is generated through random initialization and is trainable and adjustable.s Perform a linear transformation to transform the hyperbolic feature representation q m Convert to a higher-order hidden representation in, This represents Möbius multiplication;

[0119] Analogous to the attention mechanism in Euclidean space, the attention coefficients between graph nodes are obtained based on the hyperbolic distance between two graph nodes in hyperbolic space. These attention coefficients are then used to assign importance to each of the remaining graph nodes by a given graph node. The attention coefficient e between the m-th graph node and the j-th graph node is... m,j =f d (h m ,h j The specific calculation formula is as follows:

[0120]

[0121] Where c is the negative reciprocal of the curvature of the hyperbolic space, and when the attention coefficient e m,j The larger the value, the closer the hyperbolic distance between the m-th graph node and the j-th graph node is, the closer the Euclidean distance fed back into Euclidean space is, the higher the probability that the m-th graph node and the j-th graph node belong to the same protocol type, and the more the j-th graph node is worth the attention of the m-th graph node. j = 1, 2, ..., M, j ≠ m;

[0122] Obtain the attention coefficients of the m-th graph node and the remaining M-1 graph nodes, and construct the attention vector e of the m-th graph node. m The edge value vector w of the m-th graph node is generated by aligning the edges using the Softmax function and normalizing them to the range of 0-1. m Wherein, the boundary value w between the m-th graph node and the j-th graph node m,j The specific calculation formula is as follows:

[0123]

[0124] At this point, the unweighted graph is updated to a weighted graph. The weighted graph indicates the degree of association between the graph nodes. The closer the edge value between two graph nodes belonging to the same protocol type is to 1, the better.

[0125] By utilizing the edge values ​​between the m-th graph node and the remaining M-1 graph nodes in the weighted graph, and combining them with the hidden representations of the M-1 graph nodes, the m-th graph node is re-represented through weighted aggregation, generating an aggregated hyperbolic feature representation h′. m The specific formula is as follows:

[0126]

[0127] Among them, the aggregate hyperbolic feature representation h′ m Compared to the hidden representation hm While retaining strong representational capabilities, it enhances the correlation between the same protocol types, making it more conducive to classification;

[0128] Using logarithmic mapping function The aggregate hyperbolic feature representation h′ of the m-th graph node in hyperbolic space. m Remapping back to Euclidean space generates the aggregated feature representation of the m-th graph node. Aggregate feature representation x′ m The i-th aggregated feature x′ m,i The specific calculation formula is as follows:

[0129]

[0130] Where v is a point in hyperbolic space selected when projecting onto hyperbolic space, and h′ m,i For the aggregated hyperbolic feature representation h′ m The i-th aggregated hyperbolic feature;

[0131] The aggregated feature is represented as x′ m The dimension is reduced to 1×K using a linear fully connected layer, and the probability distribution vector p of the m-th graph node is generated using the Softmax function. m =Softmax(W c ·x′ m +b c ), probability distribution vector p m The k-th value in the graph represents that the m-th graph node belongs to the k-th label y. k The probability of choosing the probability distribution vector p m The label corresponding to the highest probability in the graph is assigned to the m-th graph node;

[0132] Calculate the cross-entropy loss and determine if it is less than the loss threshold. If it is, stop pre-training; otherwise, adjust the hyperparameters along the gradient direction of the decreasing loss function and train again.

[0133] like Figure 3 As shown in (b), preferably, a 5-fold cross-validation method is introduced to improve the training process. Five training and test groups are constructed, and the hyperbolic attention classification network is trained sequentially and the evaluation index is calculated. It is worth noting that the unweighted graph initially established during training has only 0.8M graph nodes. The hyperbolic attention classification network with the best evaluation index among the five training and test groups is selected as the final protocol classifier.

[0134] Specifically, a packet capture scheme is used to process data of unknown protocol types. An improved feature extraction scheme is used to process the data and generate a dual-view feature representation. This representation is then input into an improved protocol classifier. At this point, it is equivalent to adding a new graph node to a weighted graph with M existing graph nodes. The edge values ​​of the newly added graph node and the existing M graph nodes are set to 1, resulting in a partially unweighted graph with M+1 graph nodes. After processing by the improved protocol classifier, the graph is updated to a weighted graph with M+1 graph nodes, and the data of unknown protocol types is assigned the corresponding label.

[0135] Compared with Example 1, the improved feature extraction scheme and protocol classifier proposed in this example have the following advantages: the asynchronous extraction network takes into account both the basic fields and payload data in the data packet, and no longer only observes the features related to the length of the data packet. It fully considers features from multiple perspectives such as length, structure and semantics to represent the data packet, so that the feature representation contains richer information, which is conducive to classification and discrimination. At the same time, the hyperbolic attention classification network maps the feature representation to the hyperbolic space, further learns the hierarchical structure of the feature representation, and assigns the attention coefficients of the graph nodes based on the hyperbolic space distance. The graph nodes are re-represented through weighted aggregation, which strengthens the association between graph nodes of the same protocol type. Finally, it maps back to the original space to achieve higher accuracy classification.

[0136] The above description is merely a preferred embodiment of the present invention. The scope of protection of the present invention is not limited to the above embodiments. All technical solutions falling within the scope of the present invention's concept are within the scope of protection of the present invention. It should be noted that for those skilled in the art, any improvements and modifications made without departing from the principles of the present invention should also be considered within the scope of protection of the present invention.

Claims

1. A method for classifying Internet of Things (IoT) terminal protocols, characterized in that, The specific steps include the following: Design a packet capture scheme, use packet capture tools to capture data and save it as a Pcap file; Feature extraction schemes are designed based on prior knowledge analysis or asynchronous extraction networks, and feature representations are generated based on Pcap files; A protocol classifier based on hyperbolic attention classification network is designed to implement label assignment, and it is pre-trained using 5-fold cross-validation. Data of unknown protocol types is processed using packet capture and feature extraction methods, and then labeled using a protocol classifier. The pre-training of the hyperbolic attention classification network includes the following specific steps: Treat all data packets as graph nodes, and construct an edge with a value of 1 between any two graph nodes to build an unweighted graph; Cross-entropy and Adam were chosen as the loss function and optimizer, respectively. The dual-view feature representation of a single data packet is projected onto the hyperbolic space through an exponential mapping function to generate a hyperbolic feature representation; The hyperbolic feature representation is transformed into a hidden representation through a weight-sharing matrix using a linear transformation. Attention coefficients between graph nodes are obtained based on the hyperbolic distance between two graph nodes in hyperbolic space, and the attention coefficients are used to assign the importance of a single graph node to each of the other graph nodes. Obtain the attention coefficients of a single graph node and all other graph nodes to construct an attention vector, and align the edge value vectors of the single graph node using the Softmax function to update the unweighted graph to a weighted graph. By utilizing the boundary values ​​between a single graph node and all other graph nodes in a weighted graph, a single graph node is re-represented through weighted aggregation, generating an aggregated hyperbolic feature representation. The aggregated hyperbolic feature representation is remapped using a logarithmic mapping function to generate an aggregated feature representation; The aggregated feature representation is used to generate a probability distribution vector for a single graph node through a linear fully connected layer and a Softmax function, and the label corresponding to the highest probability in the probability distribution vector is assigned to the single graph node. Calculate the cross-entropy loss, and decide whether to stop training based on whether the cross-entropy loss is less than the loss threshold.

2. The IoT terminal protocol classification method as described in any one of claims 1, characterized in that, The pre-training is improved by the 5-fold cross-validation method, which uniformly and randomly divides the dataset into 5 subsets, selects 1 subset as the test set, and uses the remaining subset as the training set to pre-train the hyperbolic attention classification network. The test set is then input to calculate the evaluation index. The evaluation indexes are obtained when the 5 subsets are used as the test sets respectively, and the hyperbolic attention classification network with the best evaluation index is selected.

3. The IoT terminal protocol classification method as described in claim 1, characterized in that, The feature extraction scheme based on asynchronous extraction networks includes the following specific steps: The Pcap file is obtained by capturing packets, and the Pcap file is parsed to obtain data packets. The basic fields and hexadecimal payload data in the data packets are extracted, and the hexadecimal payload data is converted into decimal payload data. The basic fields of a single data packet are used as the first data block, and the decimal payload data of the single data packet is filled to generate the second data block; The first data block is input into the shallow convolutional block, and features are extracted and dimensionality reduced through convolution and average pooling to generate shallow feature representations. The second data block is input into the deep convolution block. First, the first feature is obtained through convolution and max pooling. Then, a second feature is generated by one-dimensional convolution. The first and second features are superimposed through the residual layer to generate a deep feature representation. Shallow and deep feature representations are concatenated and a dual-view feature representation is generated through a linear layer.

4. The IoT terminal protocol classification method as described in claim 1, characterized in that, The implementation methods for assigning data tags to unknown protocol types include: Processing data with unknown protocol types using packet capture techniques; A dual-view feature representation is generated by an asynchronous extraction network; Add a new graph node to the weighted graph, set the edge value between the new graph node and the existing graph nodes to 1, update the weighted graph using a hyperbolic attention classification network, and assign the corresponding label to the data of unknown protocol type.

5. A method for classifying IoT terminal protocols according to any one of claims 1 or 3, characterized in that, The Pcap file includes a header and data packets; The file header has a fixed length and includes the major version number, minor version number, timestamp precision, maximum storage length, and link type. The data packet includes basic fields and hexadecimal payload data.

Images