Multi-protocol compatible multi-data analysis method

Abstract

The invention relates to the technical field of industrial equipment communication, and provides a multi-protocol compatible multi-data analysis method, which specifically comprises the following steps: determining to-be-analyzed industrial data of target industrial equipment through an industrial server; transmission path identification and behavior characteristic identification are carried out on the to-be-analyzed industrial data, and a data transmission mode and behavior characteristics are determined; wherein the transmission path identification is based on a preset communication path framework network, and the behavior feature identification is based on a preset industrial equipment behavior directory; according to the data transmission mode, determining a protocol type to which the to-be-analyzed industrial data belongs; determining a target analysis strategy in a preset analysis database according to the protocol type and the behavior characteristics; and according to the target analysis strategy, collecting to-be-analyzed industrial data of the industrial equipment through the industrial server for analysis processing, and performing analysis processing to obtain a visual data set. Based on the industrial server, a proper analysis strategy can be automatically selected according to a data transmission mode and a protocol type.

Description

Technical Field

[0001] The present invention relates to the field of industrial data collection, and in particular to a multi-protocol compatible multi-data parsing method. Background Art

[0002] At present, in the current industrial Internet environment, the diversity of industrial equipment and the complexity of communication protocols have led to major challenges in data parsing and integration. Traditional data parsing methods often rely on dedicated parsers developed for specific protocols, which not only complicates the system architecture, but also greatly reduces the scalability and flexibility of the system when faced with the coexistence of multiple protocols.

[0003] In addition, new types of industrial equipment are constantly emerging, and each device may adopt different data transmission standards and communication protocols, which further increases the difficulty of data analysis.

[0004] In the patent "CN202311566470.X A multi-protocol parsing method and system for industrial Internet of Things", the multi-protocol parsing method and system for industrial Internet of Things provided by it can support the parsing of multiple protocol types, solving the problems of difficulty in accessing industrial Internet of Things gateways, low parsing efficiency, and difficulty in protocol expansion. It is based on the Modbus TCP protocol, introduces a protocol parsing core representing multiple protocols to characterize simple protocol features, and realizes the expression of multi-source heterogeneous protocols through the protocol parsing core, greatly reducing the computing load, improving the efficiency of message processing and parsing, and completing the access and data parsing process of multi-protocol devices in the industrial Internet of Things. From an overall perspective, it improves the unified formatting process of messages and data of multi-source heterogeneous protocols of the industrial Internet of Things, improves the ability of data access equipment, and has great practical value in building smart factories to realize data interconnection. Through the gateway configuration equipment information and key acquisition parameter information, multiple protocols are parsed and data processed, key parameter information to be collected is obtained, and the formatting and parsing of heterogeneous industrial equipment communication protocols and data is realized, solving the data acquisition problem of heterogeneous equipment accessing the Internet of Things platform.

[0005] However, it configures parsing strategies through the protocol parsing core, and is unable to configure the most suitable parsing strategy and protocol switching method according to the data of industrial equipment or IoT devices. It can only perform parsing and switching within general protocols, and is unable to directly parse and convert the parsed data into a visual form. Moreover, when new protocols emerge, the parser needs to be redesigned, resulting in long maintenance and upgrade cycles, which seriously affects the efficient use and real-time analysis of industrial data. Summary of the invention

[0006] The present invention proposes a multi-protocol compatible multi-data parsing method to solve the problem that it is impossible to configure the most suitable parsing strategy and protocol switching method according to the data of industrial equipment or Internet of Things equipment. It can only perform parsing and switching within the general protocol, and it is impossible to directly parse and convert the parsed data into a visual form. Moreover, when a new protocol appears, it is necessary to redesign the parser, resulting in a long maintenance and upgrade cycle, which seriously affects the efficient use and real-time analysis of industrial data.

[0007] The present invention proposes a multi-protocol compatible multi-data parsing method, comprising: Determine the industrial data to be parsed of the target industrial equipment through the industrial server; Determine the data transmission mode and behavior characteristics of the industrial data to be analyzed through transmission path identification and behavior characteristic identification; wherein the transmission path identification includes a preset communication path framework network, and the behavior characteristic identification includes a preset industrial equipment behavior catalog; According to the data transmission mode, determine the protocol type to which the industrial data to be analyzed belongs; Determine the target parsing strategy in the preset parsing database according to the protocol type and behavior characteristics; According to the target parsing strategy, the industrial data to be parsed is converted into the target format and parsed into a visual data set.

[0008] Further, the industrial server includes a first analysis and processing server and a second analysis and processing server; The first analysis processing server is used to receive the monitoring result of the target industrial equipment, and when the monitoring result meets the preset analysis behavior, determine the target industrial equipment of the industrial data to be analyzed, and generate a first analysis work order for the target industrial equipment; The second parsing processing server is used to receive the parsing request from the management end, determine the target industrial equipment in the parsing request, and generate a second parsing work order for the target industrial equipment.

[0009] Furthermore, the first parsing processing server determines the target industrial equipment of the industrial data to be parsed, including the following steps: Receive monitoring results of industrial equipment by a monitoring mechanism preset in the industrial server, determine the data behavior entropy value of each industrial equipment, and determine the behavior trend change point corresponding to the data behavior entropy value of each industrial equipment; According to the behavior trend change points of each industrial equipment, determine the maximum and minimum trend change values ​​corresponding to each industrial equipment; According to the maximum and minimum trend changes corresponding to each industrial equipment, the data behavior entropy value corresponding to each industrial equipment is evaluated for distribution status and the distribution status map is determined; According to the distribution situation map, it is determined whether each industrial equipment conforms to the distribution area of ​​the preset analytical behavior entropy value, and the industrial equipment that conforms to the distribution area of ​​the preset analytical behavior entropy value is taken as the target industrial equipment.

[0010] Furthermore, the second resolution processing server determines the target industrial device in the resolution request, including the following steps: A list of industrial equipment capable of data parsing is pre-set; wherein the list of industrial equipment includes a pre-loaded list of Class I industrial equipment and a list of Class II industrial equipment whose data complexity attributes are within a preset data complexity attribute range during the self-check process, the industrial equipment in the Class I industrial equipment list generates a parsing request through an active approval mode, and the industrial equipment in the Class II industrial equipment list generates a parsing request through an automatic approval mode; A target industrial device in a category of industrial device list is used to initiate a first network request; When there is a request exception in the first network request, the target industrial equipment in the first category industrial equipment list is automatically classified into the second category industrial equipment list, and a second network request is initiated.

[0011] Furthermore, the transmission path identification comprises the following steps: According to the communication path framework network, collect the data log, network configuration information and application configuration information of the industrial data to be analyzed; According to the data log, determine the path nodes of the transmission path of the industrial data to be analyzed; According to the network configuration information, determine the routing path, network interface configuration information and DNS record of the industrial data to be parsed, and determine the configuration parameters of the transmission path based on the communication transmission node; According to the application configuration information and configuration parameters, the proxy settings, port mapping and protocol selection of the industrial data to be parsed are determined, and the transmission path is determined.

[0012] Furthermore, the feature recognition comprises the following steps: According to the data log, determine the set of behavioral events of the industrial data to be analyzed in the transmission path; According to the preset industrial equipment behavior catalog, determine whether the target behavior event in the behavior event set is in the industrial equipment behavior catalog; When there is a target behavior event in the industrial equipment behavior directory, obtain event information of the target behavior event; Extract behavioral features based on event information.

[0013] Furthermore, the step of determining the protocol type to which the industrial data to be parsed belongs according to the data transmission mode includes: Determine the transmission protocol of the industrial data to be parsed according to the data transmission mode; According to the transmission protocol, the corresponding data feature interval is determined; wherein the data feature interval is not unique, and each data feature interval corresponds to a unique industrial data type; According to the data feature value, traverse all data packets of the industrial data to be parsed in the target industrial equipment, and determine the industrial data type corresponding to each data packet; According to the type of industrial data, determine the protocol type to which the industrial data to be parsed belongs.

[0014] Furthermore, the target parsing strategy is determined in a preset parsing database according to the protocol type and behavior characteristics; According to the protocol type, determining the first parsing strategy list associated with the preset parsing database; wherein the sorting order of the first parsing strategy list is sorted according to the first priority, and the first priority sorting is based on the degree of association between the protocol type and different parsing strategies in the first parsing strategy list; According to the behavior characteristics, determine the associated second parsing strategy list in the preset parsing database; wherein the sorting order of the second parsing strategy list corresponds to the alternative setting according to the first priority sorting, and the parsing strategy of each sorting position in the first priority sorting has an alternative association with the same position in the second parsing strategy list; According to the first parsing strategy list and the second parsing strategy list, a dual parsing strategy for the industrial data to be parsed is formed; According to the dual parsing strategy and the preset parsing database, the parsing efficiency of the same sorting position in the first parsing strategy list and the second parsing strategy list is determined, and a second priority sorting is generated; According to the second priority sorting, determine the target resolution strategy.

[0015] Furthermore, the analysis process comprises the following steps: According to the target parsing strategy, the data attribute coding of the industrial data to be parsed is obtained; According to the data attribute coding, determine the data information field of each industrial data after parsing; According to the data field information, the parsing result data is mapped to determine the parsing content.

[0016] Furthermore, the parsing process is to visualize the data set, including: Obtain data analysis results of the industrial data to be analyzed; wherein the data analysis results are connected to corresponding visualization charts in the form of data sets; According to the visualization chart, the data analysis results are loaded through the preset calculation strategy to generate corresponding visualization content. The beneficial effects of the present invention are: The present invention adopts a data collection method based on industrial servers, which can be closer to industrial equipment and reduce network latency. Through the preset communication path framework network and behavior feature directory, automatic identification of transmission paths and behavior features is achieved. It can automatically select appropriate parsing strategies according to data transmission mode and protocol type, without the need to develop a separate parser for each protocol. The generated visual data set is easy for users to understand and analyze, improving the availability of data.

[0017] Other features and advantages of the present invention will be described in the following description, and partly become apparent from the description, or understood by practicing the present invention. The purpose and other advantages of the present invention can be realized and obtained by the structures particularly pointed out in the written description and the accompanying drawings.

[0018] The technical solution of the present invention is further described in detail below through the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings: Figure 1 It is a diagram of the implementation process of a multi-protocol compatible multi-data parsing method in an embodiment of the present invention; Figure 2 A schematic diagram of port execution and services of an industrial server in an embodiment of the present invention; Figure 3 It is a configuration diagram of the target parsing strategy in an embodiment of the present invention. DETAILED DESCRIPTION

[0020] The preferred embodiments of the present invention are described below in conjunction with the accompanying drawings. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present invention, and are not used to limit the present invention.

[0021] like Figure 1 As shown, this embodiment provides a multi-protocol compatible multi-data parsing method, including: Determine the industrial data to be parsed of the target industrial equipment through the industrial server; Determine the data transmission mode and behavior characteristics of the industrial data to be analyzed through transmission path identification and behavior characteristic identification; wherein the transmission path identification includes a preset communication path framework network, and the behavior characteristic identification includes a preset industrial equipment behavior catalog; According to the data transmission mode, determine the protocol type to which the industrial data to be analyzed belongs; Determine the target parsing strategy in the preset parsing database according to the protocol type and behavior characteristics; According to the target parsing strategy, the industrial data to be parsed is converted into the target format and parsed into a visual data set.

[0022] The principle of the above technical solution is: During the implementation of the present invention, an industrial server needs to be configured to receive the industrial data to be parsed from the target industrial equipment. The industrial server is connected to the industrial equipment. A monitoring mechanism is configured in the industrial server to monitor different behavioral events in the industrial equipment. During the existence of behavioral events, data parsing is performed. The configuration of the industrial server includes hardware and software settings to receive and process the industrial data to be parsed from different industrial equipment. Then, the industrial data to be parsed is collected from the target industrial equipment and parsed into the industrial server for visual display. The industrial server is connected to the industrial equipment network to process the data uploaded by the industrial equipment.

[0023] In traditional technologies, this needs to be achieved by using various communication protocols, such as HTTP, HTTPS, TCP / IP, etc. In addition, it is also necessary to ensure the integrity and security of the data to ensure that only authorized users can access and process the data.

[0024] In the specific implementation process of the present invention, the industrial data to be analyzed is first determined, and then the transmission path and behavior characteristics of the industrial data to be analyzed are identified, and then it is determined how to parse it and how to convert it into a data format that can be identified and processed by the industrial server.

[0025] In this process, the transmission path identification is based on the preset communication path framework network. The communication path framework network is a network model that includes a series of network connections and communication protocols. It is used to describe the transmission path of industrial data between different devices. At the same time, it can also determine the data format of the industrial data to be parsed in the industrial equipment and convert the industrial data to be parsed into a data format that can be parsed and processed by the industrial server. The task of transmission path identification is to determine the actual transmission path of the industrial data to be parsed from the source to the final destination, that is, the data source and data transmission process, as well as all intermediate nodes and interfaces on this path. Behavioral feature identification is based on the preset industrial equipment behavior directory. The industrial equipment behavior directory contains a directory of behavioral models of different industrial equipment, which is used to describe the industrial behavior of industrial equipment in different situations. Industrial behavior relies on data to achieve, and industrial behavior includes abnormal behavior and regular behavior. The task of behavioral feature identification is to determine the behavioral features carried in the industrial data to be parsed. After determining the transmission path of the industrial data to be parsed, the protocol type to which the industrial data to be parsed belongs is determined based on information such as the protocol and parameters in the path.

[0026] The data to be parsed is then converted into a standard, universal format or a format that can be processed by the industrial server. After determining the protocol type and behavior characteristics of the industrial data to be parsed, the corresponding parsing strategy is searched in a pre-set parsing database.

[0027] The parsing database stores the parsing rules and parsing algorithms corresponding to different industrial equipment and protocols, so that the parsing method and algorithm of the industrial data to be parsed can be quickly determined, as well as which protocols the industrial data to be parsed collected from industrial equipment must comply with. Once the target parsing strategy is determined, the industrial data to be parsed can be converted into a data format that can be parsed and processed, and then the parsing process is performed. The specific steps of the parsing process are determined according to the results that the user wants to obtain, including data format conversion, cleaning, analysis, and visualization.

[0028] The beneficial effects of the above technical solution are: The present invention adopts a data collection method based on industrial servers, which can be closer to industrial equipment and reduce network latency. Through the preset communication path framework network and behavior feature directory, automatic identification of transmission paths and behavior features is achieved. It can automatically select appropriate parsing strategies according to data transmission mode and protocol type, without the need to develop a separate parser for each protocol. The generated visual data set is easy for users to understand and analyze, improving the availability of data.

[0029] As an embodiment of the present invention: the industrial server includes a first analysis and processing server and a second analysis and processing server; The first analysis processing server is used to receive the monitoring result of the target industrial equipment, and when the monitoring result meets the preset analysis behavior, determine the target industrial equipment of the industrial data to be analyzed, and generate a first analysis work order for the target industrial equipment; The second parsing processing server is used to receive the parsing request from the management end, determine the target industrial equipment in the parsing request, and generate a second parsing work order for the target industrial equipment.

[0030] The principle of the above technical solution is: like Figure 2 As shown, in the actual implementation process, when the industrial server receives the industrial data to be analyzed, its first analysis processing server will receive the industrial data to be analyzed of the target industrial equipment and save it in the internal database. The first analysis processing server will analyze the received industrial data to be analyzed and process it using a preset analysis algorithm to identify the behavioral characteristics therein. The preset analysis algorithm includes a convolutional neural network based on deep learning features, a scale-invariant feature transformation model, or a directional gradient histogram.

[0031] If the monitoring results of the industrial data to be analyzed meet the preset analysis behavior, the first analysis processing server will pass these data to the second analysis processing server. The first analysis processing server will search for the corresponding analysis rules in the preset industrial equipment behavior directory based on the identified behavior characteristics, and determine the name and model of the target industrial equipment based on these rules, and configure the corresponding analysis code and the storage area of ​​the analysis data. Then, the first analysis processing server will generate the first analysis work order for the target industrial equipment and return it to the requester. In actual implementation, the first analysis processing server can visualize the generated first analysis work order for the target industrial equipment and present it to the management end in the form of a chart or text.

[0032] Receive parsing requests, which is an external instruction. According to the external instructions, parse the industrial data selected by the administrator: The second parsing processing server will receive the parsing request from the management end, which includes the name and model of the target industrial equipment to be parsed. Determine the target industrial equipment: The second parsing processing server will query the relevant information in its own database and use the preset parsing algorithm to determine the name and model of the target industrial equipment. If the target industrial equipment has been determined, the second parsing processing server will generate a second parsing work order for the target industrial equipment and return it to the requester. Otherwise, it will notify the requester that more information needs to be provided to determine the target industrial equipment.

[0033] The beneficial effects of the above technical solution are: Through the above scheme, the present invention can perform parsing processing for different industrial equipment by setting different parsing work orders.

[0034] As an embodiment of the present invention: the first parsing processing server determines the target industrial device of the industrial data to be parsed, including the following steps: Receive monitoring results of industrial equipment by a monitoring mechanism preset in the industrial server, determine the data behavior entropy value of each industrial equipment, and determine the behavior trend change point corresponding to the data behavior entropy value of each industrial equipment; According to the behavior trend change points of each industrial equipment, determine the maximum and minimum trend change values ​​corresponding to each industrial equipment; According to the maximum and minimum trend changes corresponding to each industrial equipment, the data behavior entropy value corresponding to each industrial equipment is evaluated for distribution status and the distribution status map is determined; According to the distribution situation map, it is determined whether each industrial equipment meets the distribution area of ​​the preset analytical behavior entropy value, and the industrial equipment that meets the distribution area of ​​the preset analytical behavior entropy value is taken as the target industrial equipment.

[0035] The principle of the above technical solution is: In the actual implementation process, the data of industrial equipment is analyzed for behavior, and the data behavior entropy value and the corresponding behavior trend change point of each device are determined. The data behavior entropy value refers to the sum of the occurrence frequency and probability of each value corresponding to different data behaviors in the data set, while the behavior trend change point refers to the corresponding point of the change trend of each value of different data behaviors in the data set. When a trend change point occurs, a behavior event exists at this time point or in this part of the data, and the need for the behavior event depends on the specific entropy value. There are trend change maximum and minimum values ​​in the data behavior entropy value and the behavior trend change point, that is, the behavior interval in the process of data behavior generation. According to the determined behavior trend change point, the trend change maximum and minimum values ​​corresponding to each industrial equipment are calculated; then the data change range and change amplitude of each industrial equipment are measured according to the trend change maximum and minimum values. The distribution situation of the data behavior entropy value corresponding to each industrial equipment is evaluated, and a distribution situation map is drawn. The distribution situation map is a visualization tool used to intuitively understand the distribution and overall trend of the data behavior entropy value of industrial equipment, so as to determine the specific data behavior information. Distribution maps can be drawn using different colors, line densities, etc. to highlight abnormal points and obvious trend changes.

[0036] The beneficial effects of the above technical solution are: The first analysis and processing server of the present invention can judge the industrial equipment with great changes in data, thereby determining the corresponding industrial equipment and the behavioral events generated by the corresponding industrial equipment.

[0037] As an embodiment of the present invention: the second resolution processing server determines the target industrial device in the resolution request, including the following steps: A list of industrial equipment capable of data parsing is pre-set; wherein the list of industrial equipment includes a pre-loaded list of Class I industrial equipment and a list of Class II industrial equipment whose data complexity attributes are within a preset data complexity attribute range during the self-check process, the industrial equipment in the Class I industrial equipment list generates a parsing request through an active approval mode, and the industrial equipment in the Class II industrial equipment list generates a parsing request through an automatic approval mode; A target industrial device in a category of industrial device list is used to initiate a first network request; When there is a request exception in the first network request, the target industrial equipment in the first category industrial equipment list is automatically classified into the second category industrial equipment list, and a second network request is initiated.

[0038] The principle of the above technical solution is: In the actual implementation of the present invention, the industrial equipment list includes some commonly used industrial equipment types and models, and should also include some specific types of equipment. For example, a pre-loaded industrial equipment list may include common industrial equipment types, such as PLC, DCS, SCADA system, etc.; During the self-check process, the list of Class II industrial equipment with data complexity attributes within the preset data complexity attribute range includes some relatively complex equipment types, such as robots, drones, smart factories, etc. For some common equipment types, the manual approval mode is used to send the parsing request; for some relatively complex equipment types, the automatic approval mode is used to send the parsing request.

[0039] In addition, some specific resolution request priorities can also be set. For example, a higher resolution request priority can be set for key equipment or equipment in emergency situations. During the sending of the resolution request, the response of the industrial equipment needs to be monitored and tracked. If after sending the resolution request, the device has an abnormal response, such as request timeout, incomplete returned data, unable to resolve, etc., it is necessary to take corresponding measures, such as resending the resolution request, notifying relevant personnel for maintenance, etc. At the same time, different resolution strategies need to be adopted according to the different types of equipment. In the present invention, when the first resolution request is issued, if the device cannot respond normally or the resolution fails, the resolution strategy will be triggered, so that the industrial equipment automatically belongs to the second category industrial equipment list and the resolution request is re-initiated.

[0040] The beneficial effects of the above technical solution are: The present invention can use different resolution strategies for different resolution requests. If there is a resolution request that cannot be responded to, it will switch to a channel for automatic resolution processing for processing.

[0041] As an embodiment of the present invention: the transmission path identification comprises the following steps: According to the communication path framework network, collect the data log, network configuration information and application configuration information of the industrial data to be analyzed; According to the data log, determine the path nodes of the transmission path of the industrial data to be analyzed; According to the network configuration information, determine the routing path, network interface configuration information and DNS record of the industrial data to be parsed, and determine the configuration parameters of the transmission path based on the communication transmission node; According to the application configuration information and configuration parameters, the proxy settings, port mapping and protocol selection of the industrial data to be parsed are determined, and the transmission path is determined.

[0042] The principle of the above technical solution is: In the specific implementation process, in the transmission path identification stage, the existing communication path framework network is used to obtain and analyze relevant data logs, network configuration information and application configuration information.

[0043] Then, the data log is used to determine the path nodes of the transmission path of the industrial data to be parsed. By finding all the nodes that the data passes through during the transmission process, and recording the location and order of all nodes. The specific location information of the nodes in the transmission path of the industrial data is represented by means of network topology diagrams and the like. Then, the network configuration information is used to determine the routing path, network interface configuration information and DNS records of the industrial data to be parsed, and the configuration parameters of the transmission path are determined based on the communication transmission nodes. Configuration parameters usually include network addresses, port numbers, encryption algorithms, cache settings, etc., which affect the behavior and behavioral characteristics of the data during the transmission process.

[0044] Finally, the application configuration information and configuration parameters are used to determine the proxy settings, port mapping, and protocol selection of the industrial data to be parsed, and ultimately determine the transmission path.

[0045] The beneficial effects of the above technical solution are: In the process of transmission path identification, the present invention can more quickly and accurately parse the corresponding data to be transmitted by acquiring configuration parameters such as network configuration information and application configuration information.

[0046] As an embodiment of the present invention: the feature recognition comprises the following steps: According to the data log, determine the set of behavioral events of the industrial data to be analyzed in the transmission path; According to the preset industrial equipment behavior catalog, determine whether the target behavior event in the behavior event set is in the industrial equipment behavior catalog; When there is a target behavior event in the industrial equipment behavior directory, obtain event information of the target behavior event; Extract behavioral features based on event information.

[0047] The principle of the above technical solution is: In the specific implementation process of the present invention, in the feature recognition stage, the existing data log is used to determine the set of behavioral events of the industrial data to be analyzed in the transmission path. It is necessary to find the behavioral events that occur during the data transmission process, and classify and organize them.

[0048] According to the preset industrial equipment behavior directory, it is determined whether the target behavior event in the behavior event set is in the industrial equipment behavior directory. That is, the target behavior event in the industrial data to be analyzed is quickly located to reduce the workload of subsequent feature extraction. If the behavior event already exists in the behavior directory, its related information can be directly obtained, otherwise it needs to be re-extracted and calculated.

[0049] If a behavioral event has been identified, behavioral features can be extracted based on the event information. Behavioral features are information used to describe the behavior and status of industrial equipment, and can be obtained by analyzing and processing event information. For example, behavioral features can be extracted based on factors such as the duration, frequency, and intensity of industrial events, or based on the contextual information of the event, such as the time, location, and participants of the industrial event.

[0050] The beneficial effects of the above technical solution are: In the process of identifying the behavioral characteristics of industrial equipment, the present invention can identify event information of industrial data with analysis during transmission and determine the behavioral characteristics, so as to more accurately configure the analysis strategy corresponding to the behavioral characteristics.

[0051] As an embodiment of the present invention, determining the protocol type to which the industrial data to be parsed belongs according to the data transmission mode includes: Determine the transmission protocol of the industrial data to be parsed according to the data transmission mode; According to the transmission protocol, the corresponding data feature interval is determined; wherein the data feature interval is not unique, and each data feature interval corresponds to a unique industrial data type; According to the data feature value, traverse all data packets of the industrial data to be parsed in the target industrial equipment, and determine the industrial data type corresponding to each data packet; According to the type of industrial data, determine the protocol type to which the industrial data to be parsed belongs.

[0052] The principle of the above technical solution is: In the actual implementation of the present invention, the transmission protocol refers to the protocol type followed by data transmission in the network. Different transmission protocols have different data feature intervals and feature value ranges, so the transmission protocol of the industrial data to be parsed needs to be determined according to the transmission mode.

[0053] That is: if it is determined that the data is transmitted on a specific network, such as HTTP or MQTT protocol, the transmission protocol can be determined according to the characteristics of the network. For example, HTTP protocol is usually used for request responses of web browsers, while MQTT protocol is often used for data transmission in IoT applications. The data feature interval refers to the value range of data feature values, which is closely related to the transmission protocol. Different transmission protocols correspond to different data feature intervals, so the corresponding data feature interval needs to be determined according to the transmission protocol. For example, if the data to be parsed is transmitted through the HTTP protocol, the data feature interval may include the request header, response header, body and other contents. For data transmitted through the MQTT protocol, the data feature interval may only include the Topic and Payload features of the message.

[0054] Then, all the data packets in the target industrial equipment are traversed, and the industrial data type to which it belongs is determined based on the data feature value of each data packet. This process can be done by pre-configuring a traversal listener, which reads all data packets from the target industrial equipment, then processes each data packet, extracts its data feature value, and compares it with the parsing database. If a matching data feature value is found, it indicates that the corresponding data packet belongs to the corresponding industrial data type. After determining the transmission protocol and data feature interval of the industrial data to be parsed, the protocol type to which the industrial data to be parsed belongs is determined based on its corresponding feature value range. For example, if the feature interval of the industrial data to be parsed is only related to the HTTP protocol, then it belongs to the HTTP protocol type data. Conversely, if the feature interval of the industrial data to be parsed is associated with multiple protocols, then it belongs to the general protocol type data.

[0055] The beneficial effects of the above technical solution are: The present invention can perform different parsing processes on different industrial data to be parsed by determining the protocol type of the industrial data to be parsed.

[0056] As an embodiment of the present invention: the target parsing strategy is determined in a preset parsing database according to the protocol type and the behavior characteristics; According to the protocol type, determining the first parsing strategy list associated with the preset parsing database; wherein the sorting order of the first parsing strategy list is sorted according to the first priority, and the first priority sorting is based on the degree of association between the protocol type and different parsing strategies in the first parsing strategy list; According to the behavior characteristics, determine the associated second parsing strategy list in the preset parsing database; wherein the sorting order of the second parsing strategy list corresponds to the alternative setting according to the first priority sorting, and the parsing strategy of each sorting position in the first priority sorting has an alternative association with the same position in the second parsing strategy list; According to the first parsing strategy list and the second parsing strategy list, a dual parsing strategy for the industrial data to be parsed is formed; According to the dual parsing strategy and the preset parsing database, the parsing efficiency of the same sorting position in the first parsing strategy list and the second parsing strategy list is determined, and a second priority sorting is generated; According to the second priority sorting, determine the target resolution strategy.

[0057] The principle of the above technical solution is: like Figure 3 As shown, in the actual implementation process, according to the protocol type and behavior characteristics, the corresponding target parsing strategy is found in the preset parsing database. The parsing database contains various parsing strategy information for different protocol types and behavior characteristics. According to the protocol type, the associated first parsing strategy list is found in the parsing database, and then the list is sorted. The principle of sorting is usually sorted according to the first priority, that is, the higher the parsing strategy, the higher the priority. At the same time, there is an alternative association between the parsing strategy of each sorting position of the first priority sorting and the same position in the second parsing strategy list. According to the behavior characteristics, we then judge the associated second parsing strategy list in the preset parsing database. Similarly, the list is sorted, and the principle of sorting is usually sorted according to the first priority sorting corresponding to the alternative setting, and there is an alternative association between the parsing strategy of each sorting position of the first priority sorting and the same position in the second parsing strategy list. With the first parsing strategy list and the second parsing strategy list, a dual parsing strategy for the industrial data to be parsed can be formed. The dual parsing strategy can realize that when the first parsing strategy does not respond or the effect is not good, the same data can be analyzed in different parsing ways according to the data type and event characteristics, so as to obtain the parsing result.

[0058] The beneficial effects of the above technical solution are: The present invention can use a dual parsing strategy to automatically switch the parsing strategy corresponding to the protocol type or the parsing strategy corresponding to the event feature according to adaptability and priority for the industrial data to be parsed.

[0059] As an embodiment of the present invention: the analysis process comprises the following steps: According to the target parsing strategy, the data attribute coding of the industrial data to be parsed is obtained; According to the data attribute coding, determine the data information field of each industrial data after parsing; According to the data field information, the parsing result data is mapped to determine the parsing content.

[0060] The principle of the above technical solution is: In the specific implementation process, the information described by the parsing strategy is encoded into the data by associating the parsing strategy with the data. For example, if the parsing strategy specifies a specific data format, this format needs to be encoded into the data. Then, the encoding of the data attributes is mapped back to the fields in the industrial data to ensure that all data can be parsed correctly. Finally, the parsed data is matched with the corresponding industrial data fields to obtain the final parsing results. This process usually includes operations such as data conversion, cleaning, and summarization.

[0061] As an embodiment of the present invention: the parsing process is a visualization data set, including: Obtain data analysis results of the industrial data to be analyzed; wherein the data analysis results are connected to corresponding visualization charts in the form of data sets; According to the visualization chart, the data analysis results are loaded through the preset calculation strategy to generate the corresponding visualization content.

[0062] The principle of the above technical solution is: In specific implementation, the data analysis results usually need to process the original data according to the target analysis strategy to obtain more readable data results. The data results exist in the form of tables, graphics or text. In this process, the data results are organized into a logically related and easy-to-understand set. Then, the visualization conversion is achieved through the preset calculation strategy. The preset calculation strategy refers to a set of algorithms or rules that have been set in advance to convert the data analysis results into visual charts.

[0063] The beneficial effects of the above technical solution are: The above methods can improve the readability and comprehensibility of data analysis results. Because all results are organized and displayed according to unified specifications and standards, manual intervention can also be reduced.

[0064] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A multi-data parsing method compatible with multiple protocols, characterized in that: include: Determine the industrial data to be parsed of the target industrial equipment through the industrial server; Determine the data transmission mode and behavior characteristics of the industrial data to be analyzed through transmission path identification and behavior characteristic identification; wherein the transmission path identification includes a preset communication path framework network, and the behavior characteristic identification includes a preset industrial equipment behavior catalog; According to the data transmission mode, determine the protocol type to which the industrial data to be analyzed belongs; Determine the target parsing strategy in the preset parsing database according to the protocol type and behavior characteristics; According to the target parsing strategy, the industrial data to be parsed is converted into the target format and parsed into a visual data set.

2. A multi-protocol compatible multi-data parsing method as claimed in claim 1, characterized in that: The industrial server includes a first analysis and processing server and a second analysis and processing server; The first analysis processing server is used to receive the monitoring result of the target industrial equipment, and when the monitoring result meets the preset analysis behavior, determine the target industrial equipment of the industrial data to be analyzed, and generate a first analysis work order for the target industrial equipment; The second parsing processing server is used to receive the parsing request from the management end, determine the target industrial equipment in the parsing request, and generate a second parsing work order for the target industrial equipment.

3. A multi-protocol compatible multi-data parsing method as claimed in claim 2, characterized in that: The first parsing processing server determines the target industrial equipment for the industrial data to be parsed, including the following steps: Receive monitoring results of industrial equipment by a monitoring mechanism preset in the industrial server, determine the data behavior entropy value of each industrial equipment, and determine the behavior trend change point corresponding to the data behavior entropy value of each industrial equipment; According to the behavior trend change points of each industrial equipment, determine the maximum and minimum trend change values ​​corresponding to each industrial equipment; According to the maximum and minimum trend changes corresponding to each industrial equipment, the data behavior entropy value corresponding to each industrial equipment is evaluated for distribution status and the distribution status map is determined; According to the distribution situation map, it is determined whether each industrial equipment conforms to the distribution area of ​​the preset analytical behavior entropy value, and the industrial equipment that conforms to the distribution area of ​​the preset analytical behavior entropy value is taken as the target industrial equipment.

4. A multi-protocol compatible multi-data parsing method as claimed in claim 2, characterized in that: The second resolution processing server determines the target industrial device in the resolution request, including the following steps: A list of industrial equipment capable of data parsing is pre-set; wherein the list of industrial equipment includes a pre-loaded list of Class I industrial equipment and a list of Class II industrial equipment whose data complexity attributes are within a preset data complexity attribute range during the self-check process, the industrial equipment in the Class I industrial equipment list generates a parsing request through an active approval mode, and the industrial equipment in the Class II industrial equipment list generates a parsing request through an automatic approval mode; A target industrial device in a category of industrial device list is used to initiate a first network request; When there is a request exception in the first network request, the target industrial equipment in the first category industrial equipment list is automatically classified into the second category industrial equipment list, and a second network request is initiated.

5. The multi-protocol compatible multi-data parsing method according to claim 1, characterized in that: The transmission path identification comprises the following steps: According to the communication path framework network, collect the data log, network configuration information and application configuration information of the industrial data to be analyzed; According to the data log, determine the path nodes of the transmission path of the industrial data to be analyzed; According to the network configuration information, determine the routing path, network interface configuration information and DNS record of the industrial data to be parsed, and determine the configuration parameters of the transmission path based on the communication transmission node; According to the application configuration information and configuration parameters, the proxy settings, port mapping and protocol selection of the industrial data to be parsed are determined, and the transmission path is determined.

6. A multi-protocol compatible multi-data parsing method as claimed in claim 5, characterized in that: The behavior feature recognition comprises the following steps: According to the data log, determine the set of behavioral events of the industrial data to be analyzed in the transmission path; According to the preset industrial equipment behavior catalog, determine whether the target behavior event in the behavior event set is in the industrial equipment behavior catalog; When there is a target behavior event in the industrial equipment behavior directory, obtain event information of the target behavior event; Extract behavioral features based on event information.

7. The multi-protocol compatible multi-data parsing method according to claim 1, characterized in that: Determining the protocol type to which the industrial data to be parsed belongs according to the data transmission mode includes: Determine the transmission protocol of the industrial data to be parsed according to the data transmission mode; According to the transmission protocol, the corresponding data feature interval is determined; wherein the data feature interval is not unique, and each data feature interval corresponds to a unique industrial data type; According to the data feature value, traverse all data packets of the industrial data to be parsed in the target industrial equipment, and determine the industrial data type corresponding to each data packet; According to the type of industrial data, determine the protocol type to which the industrial data to be parsed belongs.

8. The multi-protocol compatible multi-data parsing method according to claim 1, characterized in that: The target parsing strategy is determined in a preset parsing database according to the protocol type and behavior characteristics, including According to the protocol type, determining the first parsing strategy list associated with the preset parsing database; wherein the sorting order of the first parsing strategy list is sorted according to the first priority, and the first priority sorting is based on the degree of association between the protocol type and different parsing strategies in the first parsing strategy list; According to the behavior characteristics, determine the associated second parsing strategy list in the preset parsing database; wherein the sorting order of the second parsing strategy list corresponds to the alternative setting according to the first priority sorting, and the parsing strategy of each sorting position in the first priority sorting has an alternative association with the same position in the second parsing strategy list; According to the first parsing strategy list and the second parsing strategy list, a dual parsing strategy for the industrial data to be parsed is formed; According to the dual parsing strategy and the preset parsing database, the parsing efficiency of the same sorting position in the first parsing strategy list and the second parsing strategy list is determined, and a second priority sorting is generated; According to the second priority sorting, determine the target resolution strategy.

9. The multi-protocol compatible multi-data parsing method according to claim 1, characterized in that: The analysis process comprises the following steps: According to the target parsing strategy, the data attribute coding of the industrial data to be parsed is obtained; According to the data attribute coding, determine the data information field of each industrial data after parsing; According to the data field information, the parsing result data is mapped to determine the parsing content.

10. The multi-protocol compatible multi-data parsing method according to claim 1, characterized in that: The analysis process is to visualize the data set, including: Obtain data analysis results of the industrial data to be analyzed; wherein the data analysis results are connected to corresponding visualization charts in the form of data sets; According to the visualization chart, the data analysis results are loaded through the preset calculation strategy to generate the corresponding visualization content.

Images