Protocol analysis method and intelligent collection device for production line

Abstract

The present invention relates to a production line-oriented protocol parsing method and intelligent data collection device. The method establishes a bag-of-words model for known protocol messages, calculates the word weight of each word in the message using a word frequency-reverse file frequency algorithm, mines keywords in the message based on all word weights, calculates the word frequency of each keyword in the known protocol message, and forms a word frequency matrix. The word frequency matrix is ​​used as a feature vector of the known protocol message and inputs it into an online wide-band learning recognition model. The method then preprocesses protocol data packets captured from the network environment where the target protocol message resides, performs a similarity assessment on the unknown protocol content and the known protocol content of the preprocessed protocol data, obtains a field sequence of the unknown protocol content based on the assessment results, and adds the field sequence to an online wide-band learning template library. In this way, data interaction between different production equipment and CNC machine tools on an industrial production line is achieved, achieving cross-device and cross-system data collection on the production line.

Description

Technical Field

[0001] The present invention relates to the industrial field, and in particular to a production line-oriented protocol analysis method and an intelligent collection device. Background Art

[0002] In industrial production, the efficient operation of production lines (or production lines) relies on the monitoring and coordination of each production link. This requires not only monitoring the operating efficiency of production equipment, but also promptly detecting and addressing anomalies and failures of production line equipment. Therefore, data collection technology for production line equipment in industrial workshops plays a key role.

[0003] However, existing industrial production line equipment and CNC lathe data acquisition often do not provide data acquisition interfaces, or use their own unique data transmission methods, making it impossible to uniformly collect and monitor data. It is difficult to achieve cross-device and cross-system data collection needs between different production equipment on the production line, reducing the efficiency of collecting operating data for industrial production line equipment. Summary of the Invention

[0004] The first technical problem to be solved by the present invention is to provide a production line-oriented protocol parsing method suitable for cross-device and cross-system data collection in a production line, in response to the above-mentioned prior art.

[0005] The second technical problem to be solved by the present invention is to provide an intelligent collection device for implementing the above-mentioned production line-oriented protocol parsing method.

[0006] The technical solution adopted by the present invention to solve the first technical problem is: a production line-oriented protocol parsing method, suitable for collecting production data of production line equipment, characterized by comprising the following steps:

[0007] Step 1: Build a bag-of-words model to process known protocol messages into a series of word sets, and convert known protocol messages into word vectors through N-grams.

[0008] Step 2: Use the word frequency-inverse file frequency algorithm to calculate the word weight of each word in the known protocol message, and mine the keywords in the known protocol message based on all the obtained word weights;

[0009] Step 3: Calculate the word frequency of each keyword in the corresponding known protocol message, form a word frequency matrix with all the calculated word frequencies, and use the word frequency matrix as the feature vector of the known protocol message;

[0010] Step 4: Input the feature vector into the online width learning recognition model; wherein the protocol with the highest consistency with the current message is identified as a representative sample;

[0011] Step 5: Use a network packet capture tool to capture protocol data packets from the network environment where the target protocol message is located, and preprocess the captured protocol data packets to obtain preprocessed protocol data;

[0012] Step 6: Perform similarity evaluation on the unknown protocol content and the known protocol content in the preprocessed protocol data:

[0013] When the unknown protocol content is a protocol with high similarity to the known protocol content, go to step 7; otherwise, go to step 8;

[0014] Step 7: Based on the specifications and information of the known protocol content, a bidirectional LSTM-CRF model is established to identify the fields in the unknown ICP, obtain the field sequence corresponding to the unknown protocol content, and proceed to step 9.

[0015] Step 8: Calculate the information entropy of each byte in the unknown protocol content and the mutual information between the two adjacent bytes. Use the information entropy peak point and the mutual information minimum point as the cut point to obtain the optimal field cut point in the absence of prior knowledge, and obtain the field sequence corresponding to the unknown protocol content. Then proceed to step 9.

[0016] Step 9: Add the obtained field sequence of the unknown protocol content to the template library of online width learning.

[0017] Improved, in the production line-oriented protocol parsing method, the frequency of any keyword in the known protocol message is calculated as follows:

[0018]

[0019] Among them, TF ij For known protocol message d j Keyword w j The word frequency, c ij For keyword w j In the known protocol message d j The total number of occurrences in

[0020] The inverse file frequency of any keyword in the known protocol message is calculated as follows:

[0021]

[0022] Among them, IDF j Indicates keyword w j The inverse document frequency of |D| represents the total number of documents in the corpus, |{i:w j ∈d i}| indicates the total number of documents containing keywords;

[0023] TF-IDFij =TF ij *IDF j ;

[0024] TF-IDF ij Indicates keyword w j For known protocol packets d j the importance of.

[0025] As a further improvement, in the production line-oriented protocol parsing method, the preprocessing includes removing the Ethernet header, IP header and TCP header of the data packet to retain only the protocol content to be identified; the protocol data after preprocessing is a mixed flow containing the target protocol.

[0026] Furthermore, in the production line-oriented protocol parsing method, the preprocessed protocol data includes known protocol content and unknown protocol content. After the known protocol content is input into a pre-trained online width learning model, the online width learning model uses a representative sample of the known protocol content for parsing. After the unknown protocol content is input into the pre-trained online width learning model, format extraction processing is performed.

[0027] Further improved, in the production line-oriented protocol parsing method, in step 8, the information entropy of any byte in the unknown protocol content is calculated as follows:

[0028]

[0029] Among them, H(D) represents the information entropy of any byte D in the unknown protocol content, and the value set of byte D is {x1,x2,…,x n}, p(x i ) is byte D with value x i The corresponding probability.

[0030] Furthermore, in the production line-oriented protocol parsing method, in step 8, the mutual information between two adjacent bytes in the unknown protocol content is calculated as follows:

[0031]

[0032] Among them, D x and D y Indicates the two adjacent bytes before and after the unknown protocol content, byte D x The value set is {x1,x2,…,x n}, byte D y The value set is {y1,y2,…,y n}, p(x i ) is byte D x The value is xi The corresponding probability, p(y j ) is byte D y The value is y j The corresponding probability.

[0033] The technical solution adopted by the present invention to solve the second technical problem is: an intelligent acquisition device, characterized in that it implements any of the production line-oriented protocol parsing methods described above.

[0034] Furthermore, in this invention, the intelligent collection device includes:

[0035] The MCU module is configured to process data and control other modules in the intelligent acquisition device;

[0036] Ethernet network module, configured for communication between production equipment and a local area network or the Internet, and supporting remote data transmission;

[0037] The DTU module is configured to send the collected production equipment data to the cloud platform;

[0038] A wireless network module is configured to implement wireless network connection of the production equipment;

[0039] The power module is configured to provide power supply for the intelligent collection device.

[0040] Improved, in this invention, the intelligent collection device further includes:

[0041] SWD debugging module, used for programming and debugging of MCU, supports program uploading and troubleshooting;

[0042] LED lights to display the operating status of the device and perform buzzer alarms;

[0043] RS-485 module, used for communication between devices in industrial environments, and for controlling screens and LED lights to display device operating status in real time;

[0044] The screen module displays the data interaction between the production equipment on the production line and the intelligent collection device, displays the operating status of the production equipment in real time, and realizes human-computer interaction.

[0045] Furthermore, in the intelligent acquisition device, the production equipment data collected by the DTU module includes: equipment operation mode, operating status, spindle speed, spindle load, spindle temperature, spindle current, spindle ratio, feed speed, feed ratio, current tool number, number of workpieces, running time, number of alarms, current coordinates, machine coordinates, workpiece coordinates and at least one of the remaining distance.

[0046] Compared with the prior art, the advantages of the present invention are:

[0047] First, the production line-oriented protocol parsing method of the invention establishes a bag-of-words model for known protocol messages in turn, calculates the word weight of each word in the known protocol message using the word frequency-reverse file frequency algorithm, and mines the keywords in the known protocol message based on all the obtained word weights, and then calculates the word frequency of each keyword in the corresponding known protocol message and forms a word frequency matrix and inputs the word frequency matrix as the feature vector of the known protocol message into the online width learning recognition model, and then preprocesses the protocol data packet captured from the network environment where the target protocol message is located to obtain preprocessed protocol data, and then performs a similarity evaluation and judgment on the unknown protocol content and the known protocol content in the preprocessed protocol data, and obtains the field sequence of the unknown protocol content based on the similarity evaluation results of the two, and then adds the obtained field sequence of the unknown protocol content to the template library of the online width learning. In this way, data interaction between different production equipment and CNC machine tools on the industrial production line can be realized, and data collection work across equipment and systems on the production line can be realized;

[0048] Secondly, the intelligent collection device of this invention can enhance its data perception, acquisition and transmission capabilities of industrial production line equipment and CNC lathes by executing the production line-oriented protocol parsing method in this invention, realize real-time collection capabilities of the operating status of equipment on the production line, effectively improve the monitoring and response capabilities of the production process of the production line, and enhance production safety and efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Figure 1 Schematic diagram of the process flow of the production line-oriented protocol parsing method according to an embodiment of the present invention;

[0050] Figure 2 This is a schematic diagram showing the connections of the main components of the intelligent data collection device in an embodiment of the present invention. DETAILED DESCRIPTION

[0051] The present invention will be described in further detail below with reference to the accompanying drawings and embodiments.

[0052] This embodiment provides a production line-oriented protocol parsing method. Figure 1 As shown, the production line-oriented protocol parsing method of this embodiment includes the following steps:

[0053] Step 1: Establish a bag-of-words model to process the known protocol message into a series of word sets, and convert the known protocol message into a word vector through N-gram (or N-gram model); wherein, in this technical field, the N-gram model here is a conventional technical means and will not be described here;

[0054] Step 2: Calculate the word weight of each word in the known protocol message using the term frequency-inverse document frequency (TF-IDF) algorithm, and mine the keywords in the known protocol message based on all the obtained word weights. Those skilled in the art are familiar with the fact that term frequency (TF) refers to the frequency with which a given word appears in a document, and inverse document frequency (IDF) is a measure of the general importance of a word. TF-IDF reflects the importance of a word to a document in a document collection and is often used as a weighting factor in text data mining and information extraction. The IDF of a specific word can be obtained by dividing the total number of documents by the number of documents containing the word and taking the logarithm of the quotient.

[0055] Step 3: Calculate the word frequency of each keyword in the corresponding known protocol message, form a word frequency matrix from all the calculated word frequencies, and use the word frequency matrix as the feature vector of the known protocol message; wherein, in this embodiment, the word frequency of any keyword in the known protocol message is calculated as follows:

[0056]

[0057] Among them, TF ij For known protocol message d j Keyword w j The word frequency, c ij For keyword w j In the known protocol message d j The total number of occurrences in

[0058] The inverse file frequency of any keyword in a known protocol message is calculated as follows:

[0059]

[0060] Among them, IDF j Indicates keyword w j The inverse document frequency of |D| represents the total number of documents in the corpus, |{i:w j ∈d i} represents the total number of documents containing keywords;

[0061] TF-IDF ij =TF ij *IDF j ;

[0062] TF-IDF ij Indicates keyword w j For known protocol packets d j the importance of

[0063] Step 4: Input the feature vector into the online width learning recognition model; wherein the protocol with the highest consistency with the current message is identified as a representative sample;

[0064] Step 5: Use a network packet capture tool to capture protocol data packets from the network environment where the target protocol message is located, and preprocess the captured protocol data packets to obtain preprocessed protocol data; wherein, in this embodiment, the preprocessing here includes removing the Ethernet header, IP header, and TCP header of the data packet to retain only the protocol content to be identified; the preprocessed protocol data is a mixed flow containing the target protocol; the preprocessed protocol data includes known protocol content and unknown protocol content. After the known protocol content is input into a pretrained online width learning model, the online width learning model uses a representative sample of the known protocol content for parsing; after the unknown protocol content is input into the pretrained online width learning model, format extraction processing is performed;

[0065] Step 6: Perform similarity evaluation on the unknown protocol content and the known protocol content in the preprocessed protocol data:

[0066] When the unknown protocol content is a protocol with high similarity to the known protocol content, go to step 7; otherwise, go to step 8;

[0067] In step 7, based on the specifications and information of the known protocol content, a bidirectional LSTM-CRF model is established to identify the fields in the unknown ICP and obtain the field sequence corresponding to the unknown protocol content. The process then proceeds to step 9. The LSTM-CRF model here is prior art and will not be described in detail here.

[0068] Step 8: Calculate the information entropy of each byte in the unknown protocol content and the mutual information between the two adjacent bytes, and use the information entropy peak point and the mutual information minimum point as the cutting point to obtain the optimal field cutting point in the absence of prior knowledge, and obtain the field sequence corresponding to the unknown protocol content, and then go to step 9; wherein, in this embodiment:

[0069] The information entropy of any byte in the unknown protocol content is calculated as follows:

[0070]

[0071] Among them, H(D) represents the information entropy of any byte D in the unknown protocol content, and the value set of byte D is {x1,x2,…,x n}, p(x i ) is byte D with value x i The corresponding probability when

[0072] The mutual information between two adjacent bytes in the unknown protocol content is calculated as follows:

[0073]

[0074] Among them, D x and D y Indicates the two adjacent bytes before and after the unknown protocol content, byte D x The value set is {x1,x2,…,x n}, byte D y The value set is {y1,y2,…,y n}, p(x i ) is byte D x The value is x i The corresponding probability, p(y j ) is byte D y The value is y j The corresponding probability when

[0075] Step 9: Add the obtained field sequence of the unknown protocol content to the template library of online width learning.

[0076] This embodiment also provides an intelligent collection device for implementing the above-mentioned production line-oriented protocol analysis method. Figure 2 As shown, the intelligent data acquisition device of this embodiment includes an MCU module 1 and an Ethernet module 2, a DTU module 3, a wireless network module 4, a power module 5, an SWD debugging module 6, an LED light 7, an RS-485 module 8, and a screen module 9, which are respectively connected to the MCU module 1. The Ethernet module 2, the DTU module 3, the wireless network module 4, and the power module 5 are respectively connected to the MCU module 1.

[0077] The MCU module 1 is configured to process data and control other modules in the intelligent acquisition device;

[0078] The Ethernet network module 2 is configured for communication between the production equipment and the local area network or the Internet, and supports remote data transmission;

[0079] The DTU module 3 (an IoT wireless data transmission module) is configured to send the collected production equipment data to the cloud platform. The production equipment data collected by the DTU module includes: equipment operation mode, operating status, spindle speed, spindle load, spindle temperature, spindle current, spindle override, feed speed, feed override, current tool number, number of workpieces, operating time, number of alarms, current coordinates, machine coordinates, workpiece coordinates, and remaining distance.

[0080] The wireless network module 4 is configured to realize wireless network connection of the production equipment;

[0081] The power module 5 is configured to provide power supply for the intelligent collection device.

[0082] The SWD debugging module 6 is configured for programming and debugging the single-chip microcomputer, supporting program uploading and troubleshooting; the LED light 7 is configured to display the operating status of the device and perform a buzzer alarm;

[0083] RS-485 module 8 is configured to communicate between devices in an industrial environment, as well as to control screens and LED lights to display the operating status of the devices in real time;

[0084] The screen module 9 is configured to display the data interaction between the production equipment on the production line and the intelligent acquisition device, display the operating status of the production equipment in real time, and realize human-computer interaction.

[0085] Although the preferred embodiments of the present invention have been described in detail above, it should be clearly understood that various modifications and variations are possible for those skilled in the art. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention are intended to be included within the scope of protection of the present invention.

Claims

1. The production line-oriented protocol parsing method is suitable for collecting production data of production line equipment, which is characterized by: The following steps are involved: Step 1: Build a bag-of-words model to process known protocol messages into a series of word sets, and convert known protocol messages into word vectors through N-grams. Step 2: Use the word frequency-inverse file frequency algorithm to calculate the word weight of each word in the known protocol message, and mine the keywords in the known protocol message based on all the obtained word weights; Step 3: Calculate the word frequency of each keyword in the corresponding known protocol message, form a word frequency matrix with all the calculated word frequencies, and use the word frequency matrix as the feature vector of the known protocol message; Step 4: Input the feature vector into the online width learning recognition model; wherein the protocol with the highest consistency with the current message is identified as a representative sample; Step 5: Use a network packet capture tool to capture protocol data packets from the network environment where the target protocol message is located, and preprocess the captured protocol data packets to obtain preprocessed protocol data; Step 6: Perform similarity evaluation on the unknown protocol content and the known protocol content in the preprocessed protocol data: When the unknown protocol content is a protocol with high similarity to the known protocol content, go to step 7; otherwise, go to step 8; Step 7: Based on the specifications and information of the known protocol content, a bidirectional LSTM-CRF model is established to identify the fields in the unknown ICP, obtain the field sequence corresponding to the unknown protocol content, and proceed to step 9. Step 8: Calculate the information entropy of each byte in the unknown protocol content and the mutual information between the two adjacent bytes. Use the information entropy peak point and the mutual information minimum point as the cut point to obtain the optimal field cut point in the absence of prior knowledge, and obtain the field sequence corresponding to the unknown protocol content. Then proceed to step 9. Step 9: Add the obtained field sequence of the unknown protocol content to the template library of online width learning.

2. The production line-oriented protocol analysis method according to claim 1, characterized in that: The frequency of any keyword in the known protocol message is calculated as follows: Among them, TF ij For known protocol message d j Keyword w j The word frequency, c ij For keyword w j In the known protocol message d j The total number of occurrences in The inverse file frequency of any keyword in the known protocol message is calculated as follows: Among them, IDF j Indicates keyword w j The inverse document frequency, |D| represents the total number of documents in the corpus, |{i:w j ∈d i } represents the total number of documents containing keywords; TF-IDF ij =TF ij *IDF j ; TF-IDF ij Indicates keyword w j For known protocol packets d j the importance of.

3. The production line-oriented protocol analysis method according to claim 1, characterized in that: The pre-processing includes removing the Ethernet header, IP header and TCP header of the data packet to retain only the protocol content to be identified; After preprocessing, the protocol data is mixed traffic containing the target protocol.

4. The production line-oriented protocol analysis method according to claim 3, characterized in that: The preprocessed protocol data includes known protocol content and unknown protocol content. After the known protocol content is input into a pre-trained online width learning model, the online width learning model uses a representative sample of the known protocol content for parsing. After the unknown protocol content is input into the pre-trained online width learning model, format extraction processing is performed.

5. The production line-oriented protocol analysis method according to claim 3, characterized in that: In step 8, the information entropy of any byte in the unknown protocol content is calculated as follows: Among them, H(D) represents the information entropy of any byte D in the unknown protocol content, and the value set of byte D is {x1,x2,…,x n }, p(x i ) is byte D with value x i The corresponding probability.

6. The production line-oriented protocol analysis method according to claim 5, characterized in that: In step 8, the mutual information between two adjacent bytes in the unknown protocol content is calculated as follows: Among them, D x and D y Indicates the two adjacent bytes before and after the unknown protocol content, byte D x The value set is {x1,x2,…,x n }, byte D y The value set is {y1,y2,…,y n }, p(x i ) is byte D x The value is x i The corresponding probability, p(y j ) is byte D y The value is y j The corresponding probability.

7. Intelligent collection device, characterized in that, Implement the production line-oriented protocol parsing method described in any one of claims 1 to 6.

8. The intelligent data collection device according to claim 7, characterized in that: include: An MCU module (1) is configured to process data and control other modules in the intelligent acquisition device; An Ethernet network module (2) configured to communicate between the production equipment and a local area network or the Internet, and to support remote data transmission; A DTU module (3), configured to send the collected production equipment data to a cloud platform; A wireless network module (4) configured to implement wireless network connection of the production equipment; The power module (5) is configured to provide power supply for the intelligent collection device.

9. The intelligent data collection device according to claim 8, characterized in that: Also includes: SWD debugging module (6), used for programming and debugging of the microcontroller, supporting program uploading and troubleshooting; LED light (7), indicating the operating status of the device and executing buzzer alarm; RS-485 module (8), used for communication between devices in industrial environments, and for controlling screens and LED lights to display the operating status of devices in real time; The screen module (9) displays the data interaction between the production equipment on the production line and the intelligent acquisition device, displays the operating status of the production equipment in real time, and realizes human-computer interaction.

10. The intelligent data collection device according to claim 8, characterized in that: The production equipment data collected by the DTU module includes: equipment operation mode, operating status, spindle speed, spindle load, spindle temperature, spindle current, spindle override, feed speed, feed override, current tool number, number of workpieces, running time, number of alarms, current coordinates, machine coordinates, workpiece coordinates and at least one of the remaining distance.

Images