Communication protocol identification method and device, computer equipment, storage medium and product

Abstract

The invention relates to the technical field of communication identification, and discloses a communication protocol identification method and device, computer equipment, a storage medium and a product, and the communication protocol identification method comprises the steps: obtaining message data of a communication protocol; inputting the message data into a trained protocol identification model, wherein the protocol identification model comprises a feature analysis module and a time sequence analysis module; acquiring local features of the message data based on a feature analysis module, and outputting a message feature vector; and performing time sequence analysis on the message feature vector based on a time sequence analysis module, and outputting a protocol identification result. According to the invention, the communication protocol identification efficiency and accuracy can be improved.

Description

Technical Field

[0001] The present invention relates to the field of communication identification technology, and in particular to a communication protocol identification method, device, computer equipment, storage medium and product. Background Art

[0002] Currently, for data collection of old equipment, without the support of technical documents, we directly intercept the messages between the equipment and the external system, use tools (such as Wireshark, BusMaster) to analyze the data packets, and try to find patterns from them. For example, by comparing the communication data in different situations, we can analyze the correlation between the data field and the equipment status or operation, and then infer the protocol structure and content format.

[0003] The message analysis process relies on the analyst's experience and intuition, which is easily affected by subjective bias and may misunderstand or ignore certain key details. At the same time, manual analysis and comparison of data messages requires a lot of time and manpower investment, especially for complex protocols, which may require repeated trial and error and adjustment, resulting in low recognition efficiency and accuracy. Summary of the invention

[0004] In view of this, the present invention provides a communication protocol identification method, apparatus, computer equipment, storage medium and product to improve the efficiency and accuracy of communication protocol identification.

[0005] In the first aspect, the present invention provides a communication protocol identification method, which includes: obtaining message data of the communication protocol; inputting the message data into a trained protocol identification model, the protocol identification model including a feature analysis module and a timing analysis module; taking local features of the message data based on the feature analysis module, and outputting a message feature vector; performing timing analysis on the message feature vector based on the timing analysis module, and outputting a protocol identification result.

[0006] In this implementation, the feature analysis module can automatically extract key features from the message data, and the timing analysis module can process the timing relationship and contextual information of these key features. By combining the feature analysis module and the timing analysis module, automated feature extraction and timing analysis greatly reduce the reliance on analyst experience and intuition, so that the protocol recognition model of the present application can more accurately identify and parse complex communication protocols, reduce errors caused by human subjective judgment, reduce recognition errors and omissions, and can improve recognition efficiency while improving recognition accuracy.

[0007] In an optional embodiment, the feature analysis module is a convolutional neural network, the long short-term memory network includes a second input layer, a long short-term memory layer and a second output layer, and the local features of the message data are obtained based on the feature analysis module, and the output message feature vector includes: converting the message data into a message vector based on the first input layer; extracting the local message features of the message vector based on the convolution layer to generate a message feature map; performing dimensionality reduction processing on the message feature map based on the pooling layer to generate a pooling feature map; integrating the message features of the pooling feature map based on the first output layer, and performing message feature classification to output a message feature vector.

[0008] In an optional embodiment, the timing analysis module is a long short-term memory network, which includes a second input layer, a long short-term memory layer and a second output layer. The timing analysis module performs timing analysis on the message feature vector, and the output protocol recognition result includes: converting the message feature vector into a message sequence vector based on the second input layer; extracting the timing dependency between the message sequence vectors based on the long short-term memory layer, predicting the message type based on the second output layer, and obtaining the protocol recognition result.

[0009] In this implementation, the temporal memory characteristics of the long short-term memory network enable the model to capture the order and correlation between messages, helping to understand the complex dependencies in the protocol.

[0010] In an optional embodiment, the step of training a protocol recognition model includes: collecting multiple training data, the training data including communication message data of different types of messages and devices; labeling and cleaning the training data to generate labeling information; using the training data and the corresponding labeling information to train an initial protocol recognition model to generate a trained protocol recognition model.

[0011] In this implementation, through the training of deep learning models, we can make full use of existing historical communication data, explore potential patterns, and improve the ability to parse unseen protocols, thereby improving the efficiency and effectiveness of data utilization.

[0012] In an optional embodiment, the initial protocol recognition model is trained using the training data and the corresponding annotation information to generate the trained protocol recognition model, including: constructing a data set based on the training data and the corresponding annotation information; dividing the data set into a training set and a validation set in proportion; based on a loss function and an optimizer, the initial protocol recognition model is trained using the training set, the parameter information of the initial protocol recognition model is adjusted, and the trained protocol recognition model is generated, the loss function includes a cross entropy loss function, and the optimizer includes an Adam optimizer.

[0013] In an optional embodiment, based on a loss function and an optimizer, an initial protocol recognition model is trained using a training set, and after generating a trained protocol recognition model, the following further includes: calculating the accuracy and processing time of the trained protocol recognition model on different devices based on a validation set; and evaluating the trained protocol recognition model based on multiple accuracy rates and processing times.

[0014] In this implementation, the deep learning model that has been trained with a large amount of data has a certain generalization ability, can adapt to different devices and protocols, has stronger scalability, and is easy to apply to other similar old devices or unknown protocol parsing scenarios.

[0015] In the second aspect, the present invention provides a communication protocol identification device, which includes: an acquisition module for acquiring message data of a communication protocol; an input module for inputting the message data into a trained protocol identification model, the protocol identification model including a feature analysis module and a timing analysis module; a feature analysis module for taking local features of the message data based on the feature analysis module and outputting a message feature vector; a timing analysis module for performing timing analysis on the message feature vector based on the timing analysis module and outputting a protocol identification result.

[0016] In a third aspect, the present invention provides a computer device, comprising: a memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, and the processor executing the communication protocol identification method of the first aspect or any corresponding embodiment thereof by executing the computer instructions.

[0017] In a fourth aspect, the present invention provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to enable a computer to execute the communication protocol identification method of the first aspect or any corresponding embodiment thereof.

[0018] In a fifth aspect, the present invention provides a computer program product, comprising computer instructions for causing a computer to execute the communication protocol identification method of the first aspect or any corresponding embodiment thereof. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0020] Figure 1is a flow chart of a communication protocol identification method according to an embodiment of the present invention;

[0021] Figure 2 is a flow chart of a protocol identification model training method according to an embodiment of the present invention;

[0022] Figure 3 is a flow chart of another communication protocol identification method according to an embodiment of the present invention;

[0023] Figure 4 is a structural block diagram of a communication protocol identification device according to an embodiment of the present invention;

[0024] Figure 5 It is a schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0025] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0026] According to an embodiment of the present invention, an embodiment of a communication protocol identification method is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0027] In this embodiment, a communication protocol identification method is provided. Figure 1 is a flow chart of a communication protocol identification method according to an embodiment of the present invention. It should be noted that if there are substantially the same results, this embodiment does not use Figure 1 The process sequence shown is limited. Figure 1 As shown, the process includes the following steps:

[0028] Step S101, obtaining message data of the communication protocol.

[0029] Message data is a unit of data transmitted in the form of messages or messages in a computer network, communication system or software application. Message data contains a structured set of information used to transmit specific types of instructions, requests, responses or other content between network entities.

[0030] Among them, based on the different application layer protocols and context environments, message data has multiple forms of expression, such as text, binary stream, XML document, etc.

[0031] Specifically, the message data of the communication protocol is obtained through a network sniffing tool.

[0032] Exemplarily, Wireshark is used to configure the sniffer, select a network interface, and set a filter such as tcp.port == 2404 to capture communication messages of the IEC 104 protocol.

[0033] Step S102, inputting the message data into the trained protocol recognition model.

[0034] Prior to this implementation, a model training method is used to train and update parameters of an initial protocol recognition model to obtain a trained protocol recognition model.

[0035] The protocol identification model includes a feature analysis module and a timing analysis module.

[0036] The feature analysis module is used to identify the message data and extract the meaningful patterns and information in the message data. The timing analysis module is used to further analyze and identify the semantic information identified by the feature analysis module.

[0037] Specifically, the feature analysis module can be a convolutional neural network model, a recursive neural network model, a self-attention mechanism model, etc. The time series analysis module can be a long short-term memory network model, a gated recurrent network model, etc.

[0038] Step S103: extract local features of the message data based on the feature analysis module and output a message feature vector.

[0039] The feature analysis module is used to extract information from the message data, including header information, payload content information, and tail information, etc. Header information includes source address, destination address, length, type, version number, checksum, etc., payload content information includes files, command parameters, query results, URL paths and parameters in HTTP requests; data packets in JSON or XML format; or specific encoding rules in binary streams, etc., and tail information includes additional checksum information or other auxiliary data.

[0040] Specifically, the model in the model of the feature analysis module is used to extract local features of the message data, and the extracted feature information is converted into a vector form to generate a corresponding message feature vector.

[0041] Step S104, performing timing analysis on the message feature vector based on the timing analysis module, and outputting a protocol recognition result.

[0042] The timing analysis module is used to identify the timing information of the message feature vector output by the feature analysis module.

[0043] The communication protocol identification method provided in this embodiment has a feature analysis module that can automatically extract key features from message data, and a timing analysis module that can process the timing relationship and context information of these key features. By combining the feature analysis module and the timing analysis module, automated feature extraction and timing analysis greatly reduce the reliance on analyst experience and intuition, so that the protocol identification model of the present application can more accurately identify and parse complex communication protocols, reduce errors caused by human subjective judgment, reduce identification errors and omissions, and can improve identification accuracy while improving identification efficiency.

[0044] In this embodiment, a protocol recognition model training method is provided. Figure 2 is a flowchart of a protocol identification model training method according to an embodiment of the present invention. It should be noted that if there are substantially the same results, this embodiment does not use Figure 2 The process sequence shown is limited. Figure 2 As shown, the process includes the following steps:

[0045] Step S201, collecting multiple training data.

[0046] Use network sniffing tools to collect different types of messages and communication message data of devices in different states. The types of communication message data include single-point information, dual-point information, measurement values, etc.

[0047] Specifically, taking the IEC 60870-5-104 protocol as an example, in one implementation, communication message samples between a plurality of slave stations and a master station are obtained.

[0048] In another implementation, Wireshark is used to configure a sniffer, select a network interface, and set a filter such as tcp.port==2404 to capture communication message data of the IEC 104 protocol, and the communication message data is saved as a PCAP file, such as iec104_capture.pcap.

[0049] In another implementation, the communication message data is extracted from a historical log file or a database, such as extracting communication records from a log file / var / log / iec104_logs.txt, or extracting IEC 104 message data from a database through SQL query.

[0050] Step S202: label and clean the training data to generate label information.

[0051] Label the fields of the training data to clarify the structure of each message, including:

[0052] Label the fields of each message, parse the structure of the message manually or semi-automatically, including the start character, length field, control and application service data unit ASDU, and use Python scripts to automatically label the fields according to the structure of the protocol.

[0053] Exemplarily, the structure of the IEC 104 message is manually or semi-automatically parsed, including the start character 0x68, indicating the start of the APDU, the length field 0x14, indicating the message length, the control field 0x00000601, including the sending sequence number and the receiving sequence number, the application service data unit 0x03 0x00 0x01 0x00 0x14 0x00, including key parts such as the type identifier, the transmission reason, the public address, and the information object, and the fields are automatically labeled according to the structure of the IEC 104 protocol using a Python script.

[0054] Label the training data by type to clarify the function of each message, including:

[0055] Use Python and pandas libraries for classification and annotation, such as single point information (M_SP_NA_1), double point information (M_DP_NA_1), measurement value (M_ME_NA_1), etc.

[0056] Clean and format the training data, including:

[0057] Check the duplicate and incomplete messages in the training data and clean them.

[0058] Exemplarily, the drop_duplicates() function of the pandas library is used to delete duplicate data.

[0059] Among them, the missing fields in the training data are obtained, and the messages corresponding to the missing fields are deleted, or the missing fields are filled using filling strategies such as forward filling.

[0060] The cleaned message is formatted into a uniform length. Specifically, according to the preset length, the message is split into byte sequences of a fixed preset length, and for byte sequences whose length is less than the preset length, zero padding is used to unify the message length. For example, the message length is unified to 100 bytes.

[0061] For example, an original IEC 104 message is: 0x68 0x14 0x00 0x00 0x06 0x01 0x03 0x00 0x01 0x00 0x14 0x00 ..., after cleaning, redundant data is removed, and the formatted message length is unified to 100 bytes, and the insufficient part is filled with zero.

[0062] Step S203, training the initial protocol recognition model using the training data and the corresponding annotation information to generate a trained protocol recognition model.

[0063] Construct an initial protocol recognition model. Specifically, the convolutional neural network and the long short-term memory network are connected in series. The convolutional neural network is used to extract features from the original message, and the long short-term memory network is used to perform time series modeling on these features.

[0064] By connecting a convolutional neural network and a long short-term memory network in series, the present application can first extract important local features from the data, and then model the temporal dependencies of these features to ensure that the model can capture the timing and contextual information in the message.

[0065] Construct a data set and divide it. Specifically, a data set is constructed based on the training data and the corresponding annotation information, and the data set is divided into a training set and a validation set in proportion. Among them, the training set is used to learn the initial protocol recognition model, and the validation set is used to evaluate the generalization performance of the trained protocol recognition model. The partitioning method of the present application can help detect whether the model is overfitting, and guide the adjustment of the model through the performance of the validation set.

[0066] When dividing the data, ensure that the distribution of data of different categories in the training set and the validation set is similar to avoid the model being biased towards one type of data.

[0067] For example, the labeled data set contains 1000 samples. According to the ratio of 8:2, the data set is divided into 800 training samples and 200 validation samples. The initial protocol recognition model can learn the patterns in the training set and test its generalization ability in the validation set.

[0068] A loss function and an optimizer are selected to optimize the parameters of the initial protocol recognition model. The loss function includes a cross entropy loss function, and the optimizer includes an Adam optimizer. Based on the loss function and the optimizer, the initial protocol recognition model is trained using the training set, the parameter information of the initial protocol recognition model is adjusted, and a trained protocol recognition model is generated.

[0069] Specifically, the calculation formula of the cross entropy loss function is:

[0070]

[0071] Among them, C is the number of categories, y i is the true label (one-hot encoding), is the probability predicted by the model.

[0072] For example, the output of the model is [0.1, 0.7, 0.2], and the true label is [0, 1, 0], then the cross entropy loss is -1log(0.7)≈0.357.

[0073] Specifically, the formula for updating parameters of the Adam optimizer is:

[0074]

[0075] Among them, θ t is a parameter, η is the learning rate, m t and v t are the estimates of the first-order momentum and the second-order momentum, respectively.

[0076] For example, the learned value is 0.001, the momentum of the current gradient is 0.01, the second-order momentum is 0.001, and the parameter update is:

[0077] Among them, the cross entropy loss is used for classification tasks, which can quantify the gap between the predicted probability and the true label; the Adam optimizer combines the advantages of momentum and adaptive learning rate, allowing the model to converge faster.

[0078] Hyperparameter tuning is performed based on the validation set. Specifically, the model performance is optimized by adjusting the hyperparameters to find the best parameter combination. Hyperparameters for optimizing model performance include convolution kernel size, number of LSTM layers, and learning rate.

[0079] Specifically, adjust the convolution kernel size in the convolutional neural network, such as 3x3, 5x5, to determine the kernel size that can best capture the data features; try different numbers of LSTM layers, such as 1 layer, 2 layers, and observe their impact on model performance; adjust the learning rate of the Adam optimizer, such as 0.001, 0.0001, to find the optimal learning rate.

[0080] For example, it is found through experiments that when the convolution kernel of CNN is 3x3, the number of LSTM layers is 2, and the learning rate is 0.0001, the accuracy on the validation set is the highest, reaching 95%.

[0081] The choice of hyperparameters in this application directly affects the learning ability and generalization performance of the model. Through experimental tuning, the best hyperparameter combination can be found to make the model perform best on the validation set.

[0082] In one implementation, after the protocol recognition model is trained, the model is verified and optimized. The accuracy and processing time of the trained protocol recognition model on different devices are calculated based on the verification set, and the trained protocol recognition model is evaluated based on multiple accuracy rates and processing times.

[0083] Evaluate the prediction accuracy of the protocol identification model on the validation set, especially the identification effect of different types of messages.

[0084] Specifically, the accuracy is calculated, which is the ratio of the number of samples correctly predicted by the model to the total number of samples.

[0085] For example, the validation set contains 200 samples, of which the protocol recognition model correctly predicts 180 samples. The accuracy calculation formula is:

[0086]

[0087] The accuracy of the protocol recognition model is 90%.

[0088] Specifically, the category accuracy is calculated, and the category accuracy is to calculate the classification accuracy for each message type.

[0089] For example, the validation set contains 200 samples, 50 of which belong to category A, of which 45 are correctly predicted. The accuracy of category A is:

[0090]

[0091] Evaluating the recognition ability of the model through the overall accuracy and the accuracy of each category can help find out whether the model has deviations in certain types of messages.

[0092] Evaluate the generalization ability of the protocol recognition model. Evaluate the performance of the model on unseen data to ensure that it can effectively handle data from different devices and protocols.

[0093] Specifically, use a test set, which should be independent of the training and validation sets and contain unseen data.

[0094] For example, the test set contains 100 samples, and the model's performance on the test set is 85 correct predictions, with an accuracy of:

[0095]

[0096] Specifically, if your data involves multiple devices or protocols, make sure your test set covers that diversity and evaluate the model's performance on different devices or protocols.

[0097] Exemplarily, the accuracy of the model is calculated for different devices A, B, and C respectively, such as the accuracy of device A is 90%, the accuracy of device B is 80%, and the accuracy of device C is 85%.

[0098] By evaluating on the test set and cross-device data, we can confirm whether the model can generalize effectively, that is, it still performs well on unseen data.

[0099] Evaluate the timeliness of the protocol identification model. Evaluate the running speed of the model to ensure that it can process data in real time in actual applications.

[0100] Specifically, the processing time is calculated. For each data sample, the time from when the model receives the input to when it outputs the prediction result is recorded.

[0101] For example, it takes 10 seconds to process 100 samples, and the average processing time for each sample is:

[0102]

[0103] Specifically, evaluate real-time performance and determine whether the model meets the real-time requirements based on the needs of the actual application scenario.

[0104] For example, if the actual scenario requires processing 50 messages per second, and the model's processing speed is 0.1 seconds per message, then 10 messages can be processed per second, which is far below the requirement. In this case, the model is optimized to increase the speed.

[0105] After evaluating the model, model optimization is performed, which includes data enhancement, model simplification, and iterative training to improve the model's generalization ability, operating efficiency, and performance.

[0106] In one implementation, data augmentation techniques are used to increase the diversity of training data, thereby improving the robustness and generalization ability of the model.

[0107] Specifically, noise is added to the original message data.

[0108] For example, a random small offset is added to each message byte, and the formula is as follows:

[0109] Augmented Date=Original Date+∈×Noise.

[0110] Assuming that the original data of the message is [0.7, 0.3, 0.8] and the noise is [0.01, -0.02, 0.01], the enhanced data is [0.71, 0.28, 0.81].

[0111] Specifically, the message is transformed by translation, scaling, flipping, etc.

[0112] Exemplarily, assuming that the message data is [0.7, 0.3, 0.8], data shift may be performed, that is, the order of the messages may be adjusted to obtain new data [0.3, 0.8, 0.7].

[0113] Among them, data enhancement can effectively prevent model overfitting and improve the performance of the model on unseen data by generating more diverse training data.

[0114] In one implementation, the model is pruned or quantized to reduce the amount of computation and improve operating efficiency while maintaining the performance of the model as much as possible.

[0115] Specifically, neurons or weights in the model that contribute less to the prediction are removed.

[0116] For example, in a convolutional neural network, convolution kernels with smaller weights are deleted. The amount of computation of the pruned model is reduced and the running speed is improved. The calculation formula is:

[0117] W′={w∈W||w|>λ}.

[0118] Among them, W is the original weight set, λ is the pruning threshold, and W′ is the pruned weight set.

[0119] Specifically, the model parameters are converted from floating point numbers to a lower precision format (such as 8-bit integers) to reduce the storage and computation requirements of the model.

[0120] For example, the floating point weight 0.1234 is quantized to an 8-bit integer 12 and scaled accordingly during inference. The calculation formula is:

[0121] W quant =round(w×2 b ).

[0122] Among them, W quant is the quantized weight, and b is the number of bits.

[0123] Through pruning and quantization, the computing and storage requirements of the model are greatly reduced, which helps to deploy it in resource-constrained environments, while significantly improving operating efficiency.

[0124] Based on feedback from actual applications, the model is continuously iteratively trained and optimized to gradually improve its performance.

[0125] Collect feedback and, in actual applications, record the differences between the model’s predictions and actual conditions to identify deficiencies in the model.

[0126] For example, if the model performs poorly on data from certain special devices, special training can be performed on this data.

[0127] Retraining: Add the collected feedback data to the training set and retrain the model.

[0128] For example, assume that the accuracy of the model after initial training is 85% on device A and 90% on device B. After adding more data from device A for iterative training, the accuracy of the model on device A is improved to 92%.

[0129] Adjust the model. Depending on the feedback, you may need to adjust the model structure or hyperparameters. You can try increasing the number of LSTM layers to better capture temporal dependencies, or adjust the learning rate to better adapt to new data.

[0130] Iterative training is a dynamic optimization process in which the model is adjusted based on its performance in actual applications to ensure that its performance is continuously improved to adapt to new environments and needs.

[0131] Through the training of deep learning models, this application can make full use of existing historical communication data, explore potential rules, and improve the ability to parse unseen protocols, thereby improving the efficiency and effectiveness of data utilization. Deep learning models trained with a large amount of data have a certain generalization ability, can adapt to different devices and protocols, have stronger scalability, and are easy to apply to other similar old devices or unknown protocol parsing scenarios.

[0132] In this embodiment, a communication protocol identification method is provided. Figure 3 is a flowchart of another communication protocol identification method according to an embodiment of the present invention. It should be noted that if there are substantially the same results, this embodiment does not use Figure 3 The process sequence shown is limited. Figure 3 As shown, the process includes the following steps:

[0133] Step S301, obtaining message data of the communication protocol.

[0134] For details, please see Figure 1 Step S101 of the illustrated embodiment will not be described in detail here.

[0135] Step S302: input the message data into the trained protocol recognition model.

[0136] The protocol identification model includes a feature analysis module and a timing analysis module.

[0137] In one implementation, the feature analysis module is a convolutional neural network, and the timing analysis module is a long short-term memory network.

[0138] Step S303: extract local features of the message data based on the feature analysis module and output a message feature vector.

[0139] The local features of the message data are extracted based on the convolutional neural network, and the message feature vector is output. Specifically, the convolutional neural network includes a first input layer, a convolution layer, a pooling layer and a first output layer.

[0140] Specifically, the above step S303 includes:

[0141] Step S3031, converting the message data into a message vector based on the first input layer.

[0142] The first input layer is used to convert each message data into a set of sequence data.

[0143] Exemplarily, the length of each message data is 100 bytes, and the message data is input into the first input layer, and the message data is converted into a message vector [104, 20, 0, 0, 6, 1, 3, 0, 1, 0, 20, 0, ...], where 104 represents the start character of the message data, 20 represents the length of the message data, and other fields include a control field, ASDU, etc.

[0144] Step S3032: extract local message features of the message vector based on the convolution layer to generate a message feature map.

[0145] Among them, the convolution layer includes multiple one-dimensional convolution kernels (filters).

[0146] Specifically, the convolution operation is slid on the message vector, and multiple one-dimensional convolution kernels (filters) are used to extract the features in the message vector to generate a message feature map, which is used to reflect the local pattern of the message data, such as the relationship between field elements or bit sequence characteristics.

[0147] Among them, the convolution calculation formula is:

[0148] y i =W1x i +W2x i+1 +W3x i+2 +b.

[0149] Among them, x i is the i-th element of the input message vector, W is the weight of the convolution kernel, b is the bias value, and y i The result of convolution calculation.

[0150] For example, the convolution kernel is 3, the weight of the convolution kernel is W = [0.2, 0.5, -0.3,], the size of the sliding window is 1, for the first 3 bytes of the message vector (104, 20, 0), the bias value is 0.1, and the convolution calculation is:

[0151] y1=0.2×104+0.5×20-0.3×0+0.1=30.9.

[0152] Step S3033, performing dimensionality reduction processing on the message feature map based on the pooling layer to generate a pooled feature map.

[0153] The message feature map is simplified based on the pooling layer to obtain a pooling feature map.

[0154] Specifically, by selecting the maximum value in the local window to reduce the dimension of the message feature map while retaining important features, the computational complexity of the model can be reduced.

[0155] Exemplarily, the message feature map is [30.9, 12.5, 32.1, 5.6, 23.7], the pooling window size is 2, and the output pooling feature map after the pooling operation is [30.9, 32.1, 23.7].

[0156] Step S3034: Based on the first output layer, the message features of the pooled feature map are integrated, and the message features are classified to output a message feature vector.

[0157] The first output layer is a fully connected layer. The pooled feature map is flattened into a one-dimensional vector and input into the fully connected layer.

[0158] For example, the pooled feature map vector after the flattening operation is expressed as [30.9, 32.1, 23.7]. In the fully connected layer, the pooled feature map vector is processed using the weight matrix and the bias vector. The output formula of the fully connected layer is expressed as:

[0159] Output=σ(W fc Flattened Features+b fc ).

[0160] Here, σ is the ReLU activation function.

[0161] Among them, Features represents the pooled feature map extracted by the pooling operation. The pooled feature map reflects the pattern, structure or useful information in the input data and is used for classification or other tasks in the convolutional neural network.

[0162] Flattened refers to the process of converting a multi-dimensional pooled feature map into a one-dimensional one. After the pooling layer, the generated pooled feature map is usually a two-dimensional (or three-dimensional) matrix, but the input of the fully connected layer usually requires a one-dimensional vector. This step "flattens" the pooled feature map into a one-dimensional vector.

[0163] The fully connected layer integrates the pooled feature maps into a higher-level feature representation, laying the foundation for subsequent classification and recognition tasks. The final output message feature vector representation will be used for classification tasks or for anomaly detection, such as classifying messages into different categories such as single-point information (M_SP_NA_1) and dual-point information (M_DP_NA_1).

[0164] The convolutional neural network of this application can automatically extract low-level features of messages, such as field patterns and bit sequences, without manually defining complex rules. Through the convolution operation, local patterns in the message are identified, and the pooling layer simplifies these patterns and retains the most critical information. The fully connected layer integrates these patterns into a higher-level feature representation, allowing the model to effectively identify or classify message types.

[0165] The convolutional neural network extracts and analyzes features from complex IEC104 communication messages through the collaborative work of the input layer, convolution layer, pooling layer and fully connected layer, realizing automatic communication protocol recognition and abnormal message detection. The architecture of this application not only improves efficiency, but also enhances the accuracy and adaptability of the model.

[0166] Step S304: perform timing analysis on the message feature vector based on the timing analysis module and output a protocol recognition result.

[0167] Based on the Long Short Term Memory (LSTM) network, the message feature vector is subjected to time series analysis to output the protocol recognition result. Specifically, the LSTM network includes a second input layer, a LSTM layer and a second output layer.

[0168] Specifically, the above step S304 includes:

[0169] Step S3041, converting the message feature vector into a message sequence vector based on the second input layer.

[0170] The message feature vector output by the convolutional neural network is input into the second input layer as an input sequence.

[0171] Exemplarily, the convolutional neural network outputs a message feature vector [f_1, f_2, ..., f_N] of length N. For example, a message feature vector [0.8, 0.3, 0.5, 0.9, 0.2] of length 5. The message feature vector will be used as the input sequence of the long short-term memory (LSTM) layer. The input of LSTM is a sequence data, which can be multi-dimensional or one-dimensional. In this implementation, the feature vector generated by CNN is regarded as an input sequence with a time step of 1.

[0172] Step S3042, extracting the temporal dependency between message sequence vectors based on the long short-term memory layer.

[0173] The long short-term memory (LSTM) layer is used to process the message sequence vector to capture the temporal dependencies in the message data.

[0174] Specifically, the LSTM layer includes multiple LSTM units, each of which processes a time step in the message sequence vector and passes the information to the next LSTM unit. The core of the LSTM unit is the memory unit, which controls the flow of information through a gating mechanism. The gating mechanism includes an input gate, a forget gate, and an output gate. The forget gate is used to determine how much memory of the previous step is retained, the input gate is used to determine the input of new information, and the output gate is used to determine the output of the current time step.

[0175] For each time step t, the forget gate is calculated as follows:

[0176] f t =σ(W f ·[h t-1 , x t ]+b f ).

[0177] Among them, W f is the weight matrix of the forget gate, h t-1 is the hidden state of the previous time step, x t is the input of the current time step, b f is the bias value.

[0178] Furthermore, the calculation formula of the input gate is as follows:

[0179] i t =σ(W i ·[h t-1 , x t ]+b i );

[0180]

[0181] Among them, i t is the activation value of the input gate, is the new candidate memory, b i , b c is the bias value.

[0182] Furthermore, the state of the memory unit is updated as follows:

[0183] Furthermore, the calculation formula of the output gate is as follows:

[0184] o t =σ(W o ·[h t-1 , x t ]+b o );

[0185] h t =o t tanh(Ct ).

[0186] Among them, h t is the output state of the current time step, b o is the bias value.

[0187] For example, the input message sequence vector is [0.8, 0.3, 0.5, 0.9, 0.2]. After being processed by the LSTM layer, a new feature vector is output. Each time step processes the feature value separately, and updates the memory unit and output state of the LSTM. Assuming that the initial state of the LSTM is 0, after a series of calculations, the final hidden state generated may be [0.7, 0.6, 0.8].

[0188] The LSTM layer of this application can capture the long-term and short-term dependencies in the input sequence, which is very effective for parsing message data containing time series information. The LSTM layer can not only understand the current input features, but also combine the previous context information to improve the accuracy of message parsing.

[0189] Step S3043, predicting the message type based on the second output layer to obtain a protocol identification result.

[0190] Among them, the output layer is a fully connected layer. The output vector of the LSTM layer is passed to a fully connected layer for processing and finally outputs the prediction result.

[0191] Specifically, the fully connected layer converts the output of the LSTM layer into target predictions, such as the type of protocol field, the category of the message, or the intent of the operation. The calculation formula of the fully connected layer is:

[0192] Prediction = σ(W out ·[h t ]+b out ).

[0193] Among them, W out is the weight matrix of the output layer, b out is the bias value, and σ is the activation function, such as the softmax function.

[0194] Exemplarily, the output feature of the LSTM layer is [0.7, 0.6, 0.8]. After being processed by the fully connected layer, the final predicted output may be [0.1, 0.7, 0.2]. The feature value represents the probability distribution of the message belonging to a certain category, that is, the probability of the message data belonging to the first category is 0.1, the probability of belonging to the second category is 0.7, and the probability of belonging to the third category is 0.2. The final protocol identification result is output.

[0195] The long short-term memory network of this application is suitable for understanding the sequential relationship between message sequences and can capture contextual information, thereby improving the accuracy of parsing. By combining historical data, LSTM can not only understand the current input, but also infer future input, reducing the necessity of manual trial and error, and ultimately improving the accuracy and efficiency of message parsing.

[0196] The communication protocol identification method provided in this embodiment, the combined model of CNN and LSTM realizes automated feature extraction and timing analysis, which greatly reduces the reliance on the experience and intuition of analysts and reduces the errors caused by human subjective judgment. The objectivity and consistency of the analysis results can be ensured. At the same time, a large amount of communication data can be quickly processed, and the parsing and protocol identification of the message can be automatically completed, which greatly shortens the time and manpower required for the entire process. The automated processing capability of the model makes the identification and parsing process of the communication protocol more intelligent. It not only reduces the reliance on professionals, but also allows faster adaptation and adjustment when equipment is updated or protocols change.

[0197] In the present embodiment, a communication protocol identification device is also provided, which is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions that have been made will not be repeated. As used below, the term "module" can implement a combination of software and / or hardware of a predetermined function. Although the device described in the following embodiments is preferably implemented in software, the implementation of hardware, or a combination of software and hardware is also possible and conceived.

[0198] This embodiment provides a communication protocol identification device, such as Figure 4 As shown, including:

[0199] The acquisition module 401 is used to acquire the message data of the communication protocol;

[0200] An input module 402 is used to input message data into a trained protocol recognition model, wherein the protocol recognition model includes a feature analysis module and a timing analysis module;

[0201] A feature analysis module 403, used for obtaining local features of message data based on the feature analysis module and outputting a message feature vector;

[0202] The timing analysis module 404 is used to perform timing analysis on the message feature vector based on the timing analysis module and output a protocol identification result.

[0203] The further functional description of each of the above modules is the same as that of the above corresponding embodiments and will not be repeated here.

[0204] The communication protocol identification device in this embodiment is presented in the form of a functional unit, where the unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that executes one or more software or fixed programs, and / or other devices that can provide the above functions.

[0205] The embodiment of the present invention also provides a computer device having the above Figure 4 The communication protocol identification device shown.

[0206] See also Figure 5 , Figure 5 is a schematic diagram of the structure of a computer device provided by an optional embodiment of the present invention, such as Figure 5 As shown, the computer device includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components are connected to each other using different buses for communication, and can be installed on a common mainboard or installed in other ways as needed. The processor can process the instructions executed in the computer device, including instructions stored in or on the memory to display the graphical information of the GUI on an external input / output device (such as, a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple computer devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 5 A processor 10 is taken as an example.

[0207] The processor 10 may be a central processing unit, a network processor or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be a dedicated integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0208] The memory 20 stores instructions executable by at least one processor 10, so that the at least one processor 10 executes the method shown in the above embodiment.

[0209] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the computer device, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely arranged relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0210] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memory.

[0211] The computer device also includes an input device 30 and an output device 40. The processor 10, the memory 20, the input device 30 and the output device 40 may be connected via a bus or other means. Figure 5 The example of connecting through bus is taken in the following.

[0212] The input device 30 can receive input digital or character information, and generate key signal input related to the user settings and function control of the computer device, such as a touch screen, a keypad, a mouse, a track pad, a touch pad, an indicator bar, one or more mouse buttons, a trackball, a joystick, etc. The output device 40 may include a display device, an auxiliary lighting device (e.g., an LED) and a tactile feedback device (e.g., a vibration motor), etc. The above-mentioned display device includes but is not limited to a liquid crystal display, a light emitting diode, a display and a plasma display. In some optional embodiments, the display device can be a touch screen.

[0213] The embodiment of the present invention also provides a computer-readable storage medium. The method according to the embodiment of the present invention can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium through a network download, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state hard disk, etc.; further, the storage medium can also include a combination of the above types of memories. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor, or hardware, the method shown in the above embodiment is implemented.

[0214] A part of the present invention may be applied as a computer program product, such as a computer program instruction, which, when executed by a computer, can call or provide the method and / or technical solution according to the present invention through the operation of the computer. Those skilled in the art should understand that the existence of the computer program instruction in a computer-readable medium includes, but is not limited to, a source file, an executable file, an installation package file, etc., and accordingly, the way in which the computer program instruction is executed by the computer includes, but is not limited to: the computer directly executes the instruction, or the computer compiles the instruction and then executes the corresponding compiled program, or the computer reads and executes the instruction, or the computer reads and installs the instruction and then executes the corresponding installed program. Here, the computer-readable medium may be any available computer-readable storage medium or communication medium accessible to the computer.

[0215] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A communication protocol identification method, characterized in that: The method comprises: Get the message data of the communication protocol; Inputting the message data into a trained protocol recognition model, wherein the protocol recognition model includes a feature analysis module and a timing analysis module; Taking local features of the message data based on the feature analysis module, and outputting a message feature vector; Based on the timing analysis module, the message feature vector is subjected to timing analysis, and a protocol recognition result is output.

2. The communication protocol identification method according to claim 1, characterized in that: The feature analysis module is a convolutional neural network, which includes a first input layer, a convolution layer, a pooling layer and a first output layer. The local features of the message data are taken based on the feature analysis module, and the output message feature vector includes: Converting the message data into a message vector based on the first input layer; Extracting local message features of the message vector based on the convolutional layer to generate a message feature graph; Performing dimensionality reduction processing on the message feature graph based on the pooling layer to generate a pooling feature graph; Based on the first output layer, the message features of the pooled feature map are integrated, and the message features are classified, and the message feature vector is output.

3. The communication protocol identification method according to claim 1, characterized in that: The timing analysis module is a long short-term memory network, and the long short-term memory network includes a second input layer, a long short-term memory layer, and a second output layer. The timing analysis is performed on the message feature vector based on the timing analysis module, and the output protocol recognition result includes: Converting the message feature vector into a message sequence vector based on the second input layer; Extracting the temporal dependency between the message sequence vectors based on the long short-term memory layer; The protocol identification result is obtained by predicting the message type based on the second output layer.

4. The communication protocol identification method according to claim 1, characterized in that: The steps of training the protocol recognition model include: Collecting a plurality of training data, wherein the training data includes communication message data of different types of messages and devices; Labeling and cleaning the training data to generate labeling information; The initial protocol recognition model is trained using the training data and the corresponding annotation information to generate the trained protocol recognition model.

5. The communication protocol identification method according to claim 4, characterized in that: The training of the initial protocol recognition model using the training data and the corresponding annotation information to generate the trained protocol recognition model comprises: Constructing a data set based on the training data and the corresponding annotation information; Dividing the data set into a training set and a validation set according to a ratio; Based on the loss function and the optimizer, the initial protocol identification model is trained using the training set, the parameter information of the initial protocol identification model is adjusted, and the trained protocol identification model is generated, the loss function includes a cross entropy loss function, and the optimizer includes an Adam optimizer.

6. The communication protocol identification method according to claim 5, characterized in that: The method further comprises: training the initial protocol recognition model using the training set based on the loss function and the optimizer to generate the trained protocol recognition model; Calculate the accuracy and processing time of the trained protocol recognition model on different devices based on the verification set; The trained protocol recognition model is evaluated based on a plurality of the accuracy rates and the processing time.

7. A communication protocol identification device, characterized in that: The device comprises: An acquisition module, used to acquire message data of the communication protocol; An input module, used for inputting the message data into a trained protocol recognition model, wherein the protocol recognition model includes a feature analysis module and a timing analysis module; A feature analysis module, used for obtaining local features of the message data based on the feature analysis module and outputting a message feature vector; A timing analysis module is used to perform timing analysis on the message feature vector based on the timing analysis module and output a protocol recognition result.

8. A computer device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the communication protocol identification method according to any one of claims 1 to 6 by executing the computer instructions.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the communication protocol identification method according to any one of claims 1 to 6.

10. A computer program product, characterized in that The method comprises computer instructions for causing a computer to execute the communication protocol identification method according to any one of claims 1 to 6.

Images