Connection anomaly detection method, electronic equipment and computer readable storage medium

Abstract

The invention provides a connection anomaly detection method, electronic equipment and a computer readable storage medium, and the method can comprise the steps: screening obtained service traffic, so as to determine a to-be-recognized service message; identifying the to-be-identified service message, and determining whether a source port of the to-be-identified service message is changed or not; and when it is determined that a source port of a to-be-identified service message is not changed and a reset message is received, establishing data based on a current session of a target protocol used by the to-be-identified service message, and determining a connection abnormality reason. By means of the method, the reason of the link breakage or reconnection phenomenon of the communication protocol between the devices can be determined more accurately.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a connection anomaly detection method, an electronic device, and a computer-readable storage medium. Background Art

[0002] Industrial communication protocols are usually used on the Industrial Internet to connect two devices. During the use of industrial communication protocols, some anomalies, such as network jitter or abnormality of connected devices, may cause the industrial communication protocol to be disconnected or reconnected.

[0003] However, the current broken link reconnection detection technology is difficult to identify transmission problems encountered during industrial control Internet transmission. Summary of the invention

[0004] The purpose of the present application is to provide a connection anomaly detection method, an electronic device and a computer-readable storage medium, which can better realize the cause of the disconnection or reconnection phenomenon.

[0005] In a first aspect, the present invention provides a connection anomaly detection method, comprising: screening the obtained business traffic to determine the business message to be identified; identifying the business message to be identified to determine whether the source port of the business message to be identified has changed; when it is determined that the source port of the business message to be identified has not changed and a reset message has been received, determining the cause of the connection anomaly based on the current session establishment data of the target protocol used by the business message to be identified.

[0006] Through the above-mentioned implementation method, when it is determined that the source port of the service message to be identified has not changed, further judging the cause of the connection abnormality is no longer limited to whether the port of the protocol connection has changed, but is based on the identification of whether there is a reset message to achieve the determination of the cause of the connection abnormality, so as to facilitate clearer determination of the cause of the disconnection and reconnection, and reduce the probability of missed judgment or misjudgment.

[0007] In an optional implementation, the current session establishment data of the target protocol used by the business message to be identified is used to determine the cause of the connection abnormality, including: detecting whether the current session of the target protocol is successfully established; if the current session of the target protocol is not successfully established, the cause of the connection abnormality is determined to be an application layer disconnection event; if the current session of the target protocol is successfully established, the cause of the connection abnormality is determined to be an application layer reconnection event.

[0008] In an optional embodiment, the detecting whether the current session of the target protocol is successfully established includes: monitoring the status of the current session of the target protocol, the status including the connection duration and whether the connection is successful; judging whether the connection duration exceeds a first specified duration, if the current session of the target protocol is not successfully established within the first specified duration, determining that the current session of the target protocol is not successfully established.

[0009] In the above implementation, it is also possible to determine whether the abnormality is caused by the application based on the situation of the session established by the target protocol, so that the location of the target protocol disconnection or reconnection can be more precise.

[0010] In an optional embodiment, the step of determining whether the connection duration exceeds a first specified duration also includes: during establishment of the current session of the target protocol, determining whether the current session of the target protocol is successfully established at intervals of a second specified duration; if the current session of the target protocol is not successfully established within the second specified duration, then executing the step of determining whether the connection duration exceeds the first specified duration; wherein the second specified duration is shorter than the first specified duration.

[0011] In the above implementation, two time thresholds are set. By limiting the second specified time, it is possible to find out whether the session is successfully established in a more timely manner, and then determine whether it can be established successfully by the first specified time, thereby avoiding being in the process of session establishment all the time and improving the efficiency of locating the cause of the connection abnormality.

[0012] In an optional embodiment, the method further includes: when the abnormal connection state of the target protocol reaches a set state, sending a network detection status to the electronic device connected to the target protocol to determine whether there is a network abnormality in the electronic device connected to the target protocol; if there is a network abnormality in any electronic device connected to the target protocol, determining that the cause of the connection abnormality is a network abnormality.

[0013] In the above implementation, the location of network anomalies can also be achieved based on network detection of devices connected to the target protocol.

[0014] In an optional implementation, the set status includes the number of connection anomalies reaching a number threshold; the method further includes: updating the number of connection anomalies each time a connection anomaly occurs in the target protocol.

[0015] In an optional implementation, the method further includes: parsing the business message to be identified to obtain business data corresponding to the business message to be identified; determining whether the business data is an abnormal response based on the business data; if it is determined that the business data is an abnormal response, determining that the cause of the connection abnormality is a protocol layer abnormality.

[0016] In an optional embodiment, before determining the cause of the connection abnormality based on the current session establishment data of the target protocol used by the business message to be identified, the method also includes: when the source port of the business message to be identified changes, the cause of the connection abnormality is determined to be an application layer reconnection event, and the port of the main device to which the target protocol is connected is updated.

[0017] In the above implementation, the abnormality can also be located based on the change of the port, and the cause of the disconnection or reconnection can be identified from multiple angles.

[0018] In a second aspect, the present invention provides an electronic device, comprising: a processor and a memory, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the machine-readable instructions are executed by the processor to perform the steps of the method described in any one of the aforementioned implementations.

[0019] In a third aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps of the method described in any one of the aforementioned embodiments are executed.

[0020] In a fourth aspect, the present invention provides a computer program product, wherein the computer program product comprises a computer program, and when the computer program is executed by a processor, the method described in any one of the aforementioned embodiments is implemented. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0022] Figure 1 A schematic diagram of the interaction between the server and the local terminal provided in the embodiment of the present application;

[0023] Figure 2 A block diagram of an electronic device provided in an embodiment of the present application;

[0024] Figure 3 A flowchart of a connection anomaly detection method provided in an embodiment of the present application;

[0025] Figure 4 Another flow chart of the connection anomaly detection method provided in an embodiment of the present application;

[0026] Figure 5Another flow chart of the connection anomaly detection method provided in an embodiment of the present application. DETAILED DESCRIPTION

[0027] The technical solutions in the embodiments of the present application will be described below in conjunction with the accompanying drawings in the embodiments of the present application.

[0028] It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0029] Currently, the Transmission Control Protocol (TCP) connection is often used in the industrial Internet, such as serial port servers or some instruments that support the MODBUS protocol. In the past, after the industrial protocol using the serial port server was connected to the Internet, the TCP protocol disconnection and reconnection problem may also occur in the industrial Internet transmission environment. In the traditional Internet, the disconnection and reconnection detection technology is performed by the transport layer TCP service, which cannot intuitively display the transmission problems encountered during the industrial control Internet transmission process. In order to solve the transmission problem of the industrial control protocol, it is necessary to detect the disconnection and reconnection situation that occurs in the industrial control Internet in a more timely manner.

[0030] At present, the problem of industrial communication protocol disconnection and reconnection is usually detected by whether the source port of the industrial communication protocol has changed. However, if the port may not change when multiple identical industrial control protocol services are running on the detection device, the reconnection phenomenon may be missed. In addition, the current detection of disconnection and reconnection usually only issues an alarm, and the alarm only indicates that a disconnection or reconnection has occurred, but does not know the cause.

[0031] Based on the above research, the embodiments of the present application provide a connection anomaly detection method, an electronic device and a computer-readable storage medium, which can achieve more accurate, timely and comprehensive detection of industrial communication protocol disconnection or reconnection.

[0032] To facilitate understanding of this embodiment, the operating environment of a connection anomaly detection method disclosed in an embodiment of the present application is first introduced in detail.

[0033] like Figure 1, which is a schematic diagram of the operating environment of the connection anomaly detection method provided in an embodiment of the present application. The operating environment includes a master device 110 and a slave device 120. The master device 110 and the slave device 120 can communicate through an industrial communication protocol. Exemplarily, the industrial communication protocol can be a TCP protocol. Based on this, the master device 110 communicates with the slave device 120 through TCP port 502.

[0034] The master device 110 may be a personal computer (PC), a tablet computer, a smart phone, a personal digital assistant (PDA), an industrial computer, a programmable logic controller (PLC), a remote terminal unit (RTU), etc. The slave device 120 may be a personal computer (PC), a tablet computer, a smart phone, a personal digital assistant (PDA), an industrial computer, a programmable logic controller, a remote terminal unit, etc.

[0035] The master device 110 and the slave device 120 can communicate based on the TCP / IP protocol stack. For example, in a factory automation scenario, the master device 110 can be a MODBUS host, and the MODBUS host performs data acquisition and control instruction transmission with multiple slave devices 120 through the MODBUS-TCP protocol. The multiple slave devices 120 can be used as MODBUS slave stations, and the multiple slave devices 120 can be devices such as programmable logic controllers and remote terminal units.

[0036] like Figure 1 As shown, the operating environment may further include a security device 130. The security device 130 may monitor the communication status between the master device 110 and the slave device 120 to improve the security of the communication between the master device 110 and the slave device 120. Figure 1 As shown, the security device 130 may be a firewall. The firewall may control network traffic based on information such as source IP address, destination IP address, port number, protocol type, etc. The firewall may also identify and block common network attack methods, such as denial of service (DoS) and distributed denial of service (DDoS). When a large number of abnormal requests from the same source IP address or multiple coordinated source IP addresses are detected in an attempt to paralyze the main device 110, the firewall may protect the normal operation of the main device 110 by limiting traffic or directly blocking these requests.

[0037] like Figure 2, which is a block diagram of an electronic device. The electronic device 200 may include a memory 211 and a processor 213. A person skilled in the art may understand that Figure 2 The structure shown is only for illustration and does not limit the structure of the electronic device 200. For example, the electronic device 200 may further include Figure 2 More or fewer components as shown, or with Figure 2 Different configurations are shown. Figure 1 The master device 110, the slave device 120 and the security device 130 shown are a type of electronic device. The master device 110, the slave device 120 and the security device 130 may include Figure 2 Of course, based on different actual usage scenarios, the master device 110, the slave device 120 and the security device 130 may also include more than Figure 2 The electronic device shown has more components. For example, the master device 110 needs to present some data trends, needs to display some alarm information, etc., then the master device 110 may also include a display unit for displaying data trends, alarm information, etc. For another example, the slave device 120 needs to input some data, and the slave device 120 may also include an input-output unit for obtaining data input by the user.

[0038] The above-mentioned memory 211 and processor 213 are electrically connected to each other directly or indirectly to realize data transmission or interaction. For example, these elements can be electrically connected to each other through one or more communication buses or signal lines. The above-mentioned processor 213 is used to execute the executable module stored in the memory.

[0039] The memory 211 may be, but is not limited to, a random access memory (RAM), a read only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable read-only memory (EEPROM), etc. The memory 211 is used to store programs, and the processor 213 executes the program after receiving the execution instruction. The method executed by the electronic device 200 defined by the process disclosed in any embodiment of the present application can be applied to the processor 213, or implemented by the processor 213.

[0040] The processor 213 may be an integrated circuit chip with signal processing capability. The processor 213 may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it may also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA), or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps, and logic block diagrams disclosed in the embodiments of the present application may be implemented or executed. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0041] The electronic device 200 in this embodiment can be used to execute each step in each method provided in the embodiments of the present application. The implementation process of the connection anomaly detection method is described in detail below through several embodiments.

[0042] See also Figure 3 , is a flow chart of a connection anomaly detection method provided in an embodiment of the present application. The connection anomaly detection method provided in an embodiment of the present application can be applied to a security device, for example, the security device can be a firewall, and the steps in the connection anomaly detection method are performed by the firewall. The following is an introduction using a firewall as an example of a security device.

[0043] Combination Figure 3 The example shown is used to explain in detail the specific process of the connection anomaly detection method provided in the embodiment of the present application.

[0044] Step 210: Screen the acquired service traffic to determine the service messages to be identified.

[0045] Exemplarily, data can be obtained or control commands can be issued in a polling manner. When the network jitters or there is an abnormality in the slave device. For example, the slave device restarts, the slave device is reset, the slave device cannot respond, etc. The firewall can detect the business traffic and match the business traffic with the service rules. When it is confirmed that a certain business message can successfully match the above service rules, it can be determined that the business message is a business message to be identified. Then, the business message to be identified can be subsequently detected based on step 220.

[0046] For example, after confirming that the service flow is service flow under the target protocol, the cause of the abnormal disconnection or reconnection is identified based on the subsequent process. The target protocol may be the TCP protocol.

[0047] Exemplarily, the service rules include: one or more of source IP, destination IP, destination port, and transport layer protocol. The source IP may represent the source IP address of the service traffic in the industrial scene that currently needs to be detected; the destination IP may represent the destination IP address of the service traffic in the industrial scene that currently needs to be detected. The destination port may represent the destination port of the service traffic in the industrial scene that currently needs to be detected; and the transport layer protocol may represent the transport layer protocol of the industrial protocol of the industrial scene that currently needs to be detected.

[0048] Exemplarily, after the business traffic successfully matches the above service rules, the cause of the abnormal disconnection or reconnection is identified based on subsequent steps.

[0049] Step 220: Identify the service message to be identified and determine whether the source port of the service message to be identified has changed.

[0050] If it is determined that the source port of the target protocol used by the service message to be identified has not changed, step 230 is executed. If it is determined that the source port of the target protocol used by the service message to be identified has changed, it can be determined that the target protocol may be abnormal.

[0051] Exemplarily, the source port connected to the target protocol can be port 502 of the main device, but if it is determined that the source port connected to the target protocol carried in the current service message to be identified is not port 502, and the source port is not 0, it can be confirmed that the source port of the target protocol has changed.

[0052] In the case where the source port of the service message to be identified changes, the cause of the abnormal connection can be determined as an application layer reconnection event, and the port of the main device to which the target protocol is connected is updated.

[0053] Step 230, determining whether a reset message is received.

[0054] When it is determined that the reset message is received, step 240 may be executed.

[0055] Taking the target protocol as TCP protocol as an example, the reset message may be a TCP RST message. When a master device and a slave device connected based on the TCP protocol communication are disconnected, the slave device may send a TCP RST message to the master device, or the master device may send a TCP RST message to the slave device.

[0056] When the firewall detects a reset message, it may indicate that a link has been broken.

[0057] Step 240: Determine the cause of the abnormal connection based on the current session establishment data of the target protocol used by the service message to be identified.

[0058] Exemplarily, if a session still exists for the target protocol used by the service message to be identified, it can be determined as an application layer reconnection event.

[0059] Exemplarily, if there is no session for the target protocol used by the service message to be identified, the timestamp used to record the target protocol exception can be updated first, and if the session is not successfully reestablished within a certain period of time, it can be determined as an application layer disconnection event.

[0060] The TCP protocol connections of the industrial Internet and the traditional Internet are similar. When the link break reconnection occurs in the slave device, the master device is in a "half-open" connection state after the slave device restarts. In this half-open state, the following situations may exist: In one case, if no data packet is sent on the half-open connection, as long as the "keep-alive" timer is still counting, from the master side, this connection is half-open. Then an error will be returned to the management layer corresponding to the TCP protocol, which will reset the connection. At this time, the source port of the connection will remain unchanged. In another case, if the slave device opens a new connection before the "keep-alive" timer is completed, this situation can also be divided into two cases: In the first case, the connection opened by the slave device has the same characteristics as the half-open connection of the master device (for example, the same source port and destination port, the same source IP and destination IP). Therefore, after the connection establishment timeout, the TCP stack layer will not be able to open the connection. In order to avoid communication failure during a long timeout period, after the slave device restarts, a connection is established using a source port different from the original connection. In the second case, the opened connection has different characteristics from the half-opened connection on the master side (different source ports, same destination ports, same source IP and destination IP). Based on this, a connection is opened on the TCP stack layer and a signal is sent to the TCP management layer of the master.

[0061] Based on the above analysis, it can be determined that if the TCP management layer of the master device only supports the connection of one IP address of the slave device, then the original half-open connection can be closed and a new connection can be used. At this time, the broken link reconnection detection mechanism based on the change of the source port can be effectively detected. If the TCP management layer of the server supports the connection of multiple IP addresses of slave devices (i.e., multiple identical industrial protocol connections are running on the detected master device), then the new connection remains open and the original connection also remains half-open until the "keep connected" timer expires, at which time an error will be returned to the TCP management layer. Afterwards, the TCP management layer will be able to reset the original connection. At this time, the original connection source port will remain unchanged, and the broken link reconnection mechanism based on the change of the source port will not detect this broken link reconnection event. The above method used in the embodiment of the present application can determine whether a broken link or reconnection event has occurred at the application layer based on the reset message even if it is determined that the source port has not changed, which can improve the comprehensiveness and accuracy of the broken link or reconnection identification of the target protocol.

[0062] In an optional implementation, the above step 240 may include step 241, detecting whether the current session of the target protocol is successfully established.

[0063] If the current session of the target protocol is not successfully established, the cause of the connection abnormality is determined to be an application layer disconnection event; if the current session of the target protocol is successfully established, the cause of the connection abnormality is determined to be an application layer reconnection event.

[0064] Optionally, the above step 241 may include: step 2411 to step 2413.

[0065] Step 2411, monitor the status of the current session of the target protocol.

[0066] The status includes the connection duration and whether the connection is successful or not. The connection duration may indicate the time from when the target protocol between the master device and the slave device is detected to the current time. Whether the connection is successful or not may indicate whether the session between the master device and the slave device based on the target protocol is successfully established.

[0067] Step 2413, determine whether the connection duration exceeds the first specified duration.

[0068] If the current session of the target protocol is not successfully established within the first specified time period, it is determined that the current session of the target protocol is not successfully established.

[0069] Exemplarily, the first specified duration may be a pre-set duration. The first specified duration may be a duration between 25s and 40s. For example, the first specified duration may be 25s, 30s, 35s, 40s, etc.

[0070] Optionally, the first specified duration may be a default value, or a value independently set by the user in an interactive manner.

[0071] Optionally, step 2412 may be included before step 2413, in which, during the establishment of the current session of the target protocol, it is determined whether the current session of the target protocol is successfully established every second specified time period.

[0072] If the current session of the target protocol is not successfully established within the second specified time period, the above step 2413 is executed again.

[0073] The second specified duration may be a duration shorter than the first specified duration. Exemplarily, the second specified duration may be a pre-set duration. The second specified duration may be a duration between 3s and 10s. For example, the second specified duration may be 3s, 5s, 8s, 10s, etc.

[0074] Optionally, the second specified duration may be a default value, or a value independently set by the user in an interactive manner.

[0075] In this embodiment, if a session between the master device and the slave device based on the target protocol is not detected, it can be determined that the target protocol between the current master device and the slave device is disconnected, and the current connection anomaly detection process can be terminated.

[0076] Exemplarily, a data stack may be pre-set to store the connection anomaly detection tasks that need to be processed. When the cause of the target protocol anomaly between the master device and the slave device is determined, the corresponding connection anomaly detection task in the data stack may be deleted.

[0077] In the above implementation, the cause of the disconnection and reconnection can be identified by the establishment of the session of the target protocol between the master device and the slave device. Furthermore, based on the setting of the time threshold, the situation where the master device and the slave device cannot communicate continuously due to the failure to successfully establish a session for a long time and the failure to find the cause of the disconnection can be reduced.

[0078] When the target protocol between the master device and the slave device is disconnected multiple times or cannot be connected continuously, it may not only be caused by reasons at the application layer. Figure 4 As shown, the connection anomaly detection method may also include: step 250, when the abnormal connection state of the target protocol reaches a set state, sending a network detection situation to the electronic device connected to the target protocol to determine whether there is a network anomaly in the electronic device connected to the target protocol.

[0079] If any electronic device connected to the target protocol has a network anomaly, the cause of the connection anomaly is determined to be the network anomaly.

[0080] For example, network anomalies may include different IP routing, port blocking, and other anomalies.

[0081] The above-mentioned setting status may include: the number of link-break events of the target protocol between the master device and the slave device reaches a number threshold, and the duration of the link-break event of the target protocol between the master device and the slave device reaches a duration threshold.

[0082] Exemplarily, the number threshold may be a preset value. The number threshold may be a value between 3 and 10. For example, the number threshold may be 3, 5, 8, 10, etc.

[0083] Optionally, the number threshold may be a default value, or a value independently set by the user in an interactive manner.

[0084] The duration threshold may be the same value as the aforementioned first specified duration, or may be a value greater than the first specified duration.

[0085] In this embodiment, in order to facilitate better monitoring of the link-break state, each link-break event may be counted. For example, each time a connection anomaly occurs in the target protocol, the number of connection anomalies is updated.

[0086] Optionally, a timestamp for recording the connection anomaly of the target protocol between the master device and the slave device may be preset. Each time a connection anomaly occurs, the timestamp may be incremented by one. The initial value of the timestamp may be zero.

[0087] By counting the link breaks, you can better understand the on / off status of the target protocol between the master device and the slave device.

[0088] If it is found that the network connection between the master device and the slave device is normal and the protocol port remains open, the cause of the disconnection of the target protocol between the master device and the slave device can be further analyzed from other perspectives. Figure 5 As shown, the connection anomaly detection method provided by the present application may further include step 260 and step 270.

[0089] Step 260: parse the service message to be identified to obtain service data corresponding to the service message to be identified.

[0090] Step 270: Determine whether the business data is an abnormal response based on the business data.

[0091] When it is determined that the business data is an abnormal response, it is determined that the cause of the connection abnormality is a protocol layer abnormality.

[0092] Exemplarily, the master device sends a read register command, and when the slave device returns a response frame with an error code, it can be determined as an abnormal response. For example, the master device sends a read register command with function code 3, and the slave device returns a response frame with an error code, such as exception code 02: illegal address.

[0093] In this case, error information in the target protocol can be recorded and determined to be an abnormality in the industrial protocol layer.

[0094] Based on the above steps 260 to 270, the detection of connection anomalies can be achieved from more dimensions.

[0095] Furthermore, in order to better troubleshoot connection anomalies, when it is determined that an industrial protocol layer anomaly occurs, an audit log is reported.

[0096] In the embodiment of the present application, a detection mechanism for reset messages is introduced, which can accurately detect the reconnection of a broken link even if the source port has not changed. Furthermore, when the number of abnormal connection of the broken link reconnection exceeds the set number threshold or the length of the broken link exceeds the set length threshold, the cause of the abnormal connection can be further determined based on the network by initiating a network scan on the master device and the slave device at both ends. If the network connection is abnormal, the cause of the broken link reconnection can be determined. Furthermore, the specific cause can also be reported based on the abnormal code in the message transmitted by the industrial protocol.

[0097] Furthermore, the traditional communication protocol disconnection and reconnection detection mechanism between devices is usually only able to determine the occurrence of disconnection and reconnection, and issues an alarm based on the occurrence of disconnection and reconnection, but does not detect and give the reason why the industrial equipment may have a disconnection and reconnection. In the embodiments of the present application, various analyses can be performed on the causes of the disconnection and reconnection phenomenon of the target protocol between the master device and the slave device. Take the industrial protocol MODBUS as an example: when the number of disconnection and reconnection exceeds the threshold set by the user or the disconnection duration exceeds the set time, the firewall will initiate a network scan to the IP of the slave device and the IP of the master device to detect whether the network of the devices at both ends can be PING-connected. If it cannot be PING-connected, it can be determined that the network is not connected; if the PING delay is too large, it can be determined that the network is unstable; if PING is connected, it can be further scanned to see whether the 502 ports of the MODBUS protocol of the master device and the slave device are open or occupied.

[0098] Unlike the traditional Internet, TCP transmission in the industrial Internet is based on industrial protocols. To ensure the correctness of industrial protocol transmission, when a link break occurs, the application layer of the message often carries an error code for abnormal transmission. The embodiments of the present application can also analyze the cause of the link break and reconnection phenomenon based on the error code information and messages in different protocol standard documents. Taking the MODBUS-TCP industrial protocol as an example, when a link break and reconnection phenomenon occurs, the message from the session connection within the specified time length is cached, and the application layer of the message is analyzed to see if it contains a MODBUS exception code. The cause of the link break and reconnection alarm is given according to the exception code. For example, exception code 04 represents a slave device failure.

[0099] In addition, an embodiment of the present application further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the connection anomaly detection method described in the above method embodiment are executed.

[0100] The computer program product of the connection anomaly detection method provided in the embodiment of the present application includes a computer-readable storage medium storing program code, and the instructions included in the program code can be used to execute the steps of the connection anomaly detection method described in the above method embodiment. For details, please refer to the above method embodiment, which will not be repeated here.

[0101] In several embodiments provided in the present application, it should be understood that the disclosed method can also be implemented in other ways. The method embodiments described above are merely schematic, for example, the flowcharts and block diagrams in the accompanying drawings show the possible implementation architecture, functions and operations of the methods and computer program products according to multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the module, a program segment or a part of a code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or the flowchart, and the combination of boxes in the block diagram and / or the flowchart can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0102] In addition, each method step in each embodiment of the present application can be integrated together to form an independent part for execution, or each method step can be executed by a separate module, or two or more steps can be formed into an independent part for execution.

[0103] If the function is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a disk or an optical disk. It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply that there is any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprises" or any other variation thereof are intended to cover non-exclusive inclusion, so that a process, method, article or apparatus that includes a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or apparatus. In the absence of more restrictions, the elements defined by the sentence "includes..." do not exclude the presence of other identical elements in the process, method, article or apparatus that includes the elements.

[0104] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application. It should be noted that similar numbers and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings.

[0105] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A connection anomaly detection method, characterized in that: include: The obtained business traffic is screened to determine the business messages to be identified; Identify the service message to be identified, and determine whether the source port of the service message to be identified has changed; When it is determined that the source port of the service message to be identified has not changed and a reset message has been received, the cause of the abnormal connection is determined based on the current session establishment data of the target protocol used by the service message to be identified.

2. The method according to claim 1, characterized in that The determining the cause of the abnormal connection based on the current session establishment data of the target protocol used by the service message to be identified includes: Detecting whether the current session of the target protocol is successfully established; If the current session of the target protocol is not successfully established, the cause of the abnormal connection is determined to be an application layer disconnection event; if the current session of the target protocol is successfully established, the cause of the abnormal connection is determined to be an application layer reconnection event.

3. The method according to claim 2, characterized in that The detecting whether the current session of the target protocol is successfully established includes: Monitoring the status of the current session of the target protocol, the status including the connection duration and whether the connection is successful or not; It is determined whether the connection duration exceeds a first specified duration; if the current session of the target protocol is not successfully established within the first specified duration, it is determined that the current session of the target protocol is not successfully established.

4. The method according to claim 3, characterized in that: The determining whether the connection duration exceeds the first specified duration also includes: During the process of establishing the current session of the target protocol, at every second specified time period, it is determined whether the current session of the target protocol is successfully established. If the current session of the target protocol is not successfully established within the second specified time period, the step of determining whether the connection duration exceeds the first specified time period is performed; wherein the second specified time period is shorter than the first specified time period.

5. The method according to any one of claims 1 to 4, characterized in that: The method further comprises: When the abnormal connection state of the target protocol reaches a set state, sending a network detection situation to the electronic device connected to the target protocol to determine whether the electronic device connected to the target protocol has a network abnormality; If any electronic device connected to the target protocol has a network anomaly, it is determined that the cause of the connection anomaly is the network anomaly.

6. The method according to claim 5, characterized in that The set state includes the number of connection anomalies reaching a threshold number; the method further includes: Each time a connection exception occurs in the target protocol, the number of connection exceptions is updated.

7. The method according to any one of claims 1 to 4, characterized in that: The method further comprises: Parsing the service message to be identified to obtain service data corresponding to the service message to be identified; Determining, according to the business data, whether the business data is an abnormal response; When it is determined that the service data is an abnormal response, it is determined that the cause of the connection abnormality is a protocol layer abnormality.

8. The method according to any one of claims 1 to 4, characterized in that: Before determining the cause of the abnormal connection based on the current session establishment data of the target protocol used by the service message to be identified, the method further includes: In the case where the source port of the service message to be identified changes, the cause of the abnormal connection is determined to be an application layer reconnection event, and the port of the main device to which the target protocol is connected is updated.

9. An electronic device, characterized in that: include: A processor and a memory, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the machine-readable instructions are executed by the processor to perform the steps of the method according to any one of claims 1 to 8.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, which, when executed by a processor, performs the steps of the method according to any one of claims 1 to 8.

11. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 8 is implemented.

Images