Multi-protocol autonomous identification method and device based on edge computing gateway

Abstract

The invention provides a multi-protocol autonomous identification method and device based on an edge computing gateway, and relates to the technical field of the Internet of Things, and the method comprises the steps: collecting communication data streams of different protocols, extracting static features and dynamic features of the communication data streams of the different protocols, obtaining protocol features through feature fusion, and then carrying out multi-protocol autonomous identification based on the protocol features. According to the method, protocol types are identified through a plurality of trained neural network models, then each field in a protocol is analyzed through a trained deep learning analyzer, and a field type identification result is obtained. According to the multi-protocol autonomous identification method based on the edge computing gateway provided by the invention, the efficient and accurate identification of the edge computing gateway on the protocol type and the field type is realized, and the flexibility, the expansibility and the compatibility of the system are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of Internet of Things, and in particular to a multi-protocol autonomous identification method and device based on an edge computing gateway. Background Art

[0002] With the rapid development of Internet of Things technology, edge computing gateways are increasingly used and usually need to connect to multiple devices, which often use different communication protocols (such as Modbus, Ethernet protocol, serial port protocol, and MQTT, etc.).

[0003] Existing gateways usually require pre-configuration or manual setting of the communication protocol for each access device, which increases the complexity and configuration time of the system, makes it difficult to dynamically adapt to new protocols or changes in protocol features, and limits the flexibility, scalability and compatibility of the system. Summary of the invention

[0004] The present invention provides a multi-protocol autonomous identification method and device based on an edge computing gateway, which is used to solve the technical problem in the prior art that the edge computing gateway is difficult to dynamically adapt to new protocols or changes in protocol characteristics, resulting in poor flexibility, scalability and compatibility of the system.

[0005] The present invention provides a multi-protocol autonomous identification method based on an edge computing gateway, comprising the following steps: Collect communication data streams of different protocols; Based on the communication data streams of the different protocols, the overall characteristics of the byte streams and the distribution characteristics of the byte values ​​are obtained, and based on the communication data streams of the different protocols, the dynamic characteristics of the communication data streams of the different protocols are obtained; Based on the overall characteristics of the byte stream and the distribution characteristics of the byte values, obtaining the static characteristics of the communication data streams of the different protocols; Based on the static features and the dynamic features, obtaining protocol features of the different protocols through feature fusion; Based on the protocol features of the different protocols, a protocol type recognition result of each protocol is obtained through a plurality of trained neural network models; the neural network models are trained based on communication data streams of a plurality of historical protocols; Based on the communication data stream of each type of protocol, the field type recognition result of each field within each type of protocol is obtained through a trained deep learning parser; the deep learning parser is trained based on the communication data streams of multiple historical protocols; The deep learning parser includes a long short-term memory network model, a Transformer model, a convolutional neural network model and a multi-layer perceptron; the long short-term memory network model is used to extract the timing features between protocol fields; the Transformer model is used to extract the global features between protocol fields; the convolutional neural network model is used to extract the local features between protocol fields; the multi-layer perceptron is used to output the field types of each field within the protocol.

[0006] According to a multi-protocol autonomous identification method based on an edge computing gateway provided by the present invention, the communication data stream based on the different protocols obtains the overall characteristics of the byte stream and the distribution characteristics of the byte value, including: Based on the communication data streams of the different protocols, the mean and standard deviation of all byte values ​​in the byte stream are calculated to obtain the overall characteristics of the byte stream, and based on the communication data streams of the different protocols, the frequency of each byte value in the byte stream is calculated to obtain the distribution characteristics of the byte values.

[0007] According to a multi-protocol autonomous identification method based on an edge computing gateway provided by the present invention, the communication data streams based on the different protocols are used to obtain dynamic characteristics of the communication data streams of the different protocols, including: Based on the communication data streams of the different protocols, obtaining a high-dimensional dense vector corresponding to each field of each protocol; Input the high-dimensional dense vector corresponding to each field of each protocol into the long short-term memory network model to obtain the time series features output by the long short-term memory network model, and use the time series features as the dynamic features of the communication data streams of the different protocols; or, input the high-dimensional dense vector corresponding to each field of each protocol into the Transformer model to obtain the global features output by the Transformer model, and use the global features as the dynamic features of the communication data streams of the different protocols.

[0008] According to a multi-protocol autonomous identification method based on an edge computing gateway provided by the present invention, in the case where the global feature is used as the dynamic feature of the communication data flow of the different protocols, the method further includes: A position code is added to each byte vector in the global feature, so that the global feature after adding the position code is used as the dynamic feature of the communication data stream of the different protocols; the position code is used to represent the position information of each byte vector in the byte stream.

[0009] According to a multi-protocol autonomous identification method based on an edge computing gateway provided by the present invention, the protocol type identification result of each protocol is obtained through a plurality of trained neural network models based on the protocol features of the different protocols, including: The protocol features of different protocols are respectively input into a plurality of trained neural network models to obtain the protocol type classification results output by each trained neural network model; The weighted average of the protocol type classification results output by all trained neural network models is calculated to obtain the protocol type recognition result of each protocol.

[0010] According to a multi-protocol autonomous identification method based on an edge computing gateway provided by the present invention, the communication data stream based on each type of protocol obtains the field type identification result of each field within each type of protocol through a trained deep learning parser, including: The communication data stream of each type of protocol is input into the long short-term memory network model, the Transformer model and the convolutional neural network model respectively, to obtain the temporal features between the protocol fields output by the long short-term memory network model, the global features between the protocol fields output by the Transformer model and the local features between the protocol fields output by the convolutional neural network model; Based on the timing features, the global features, and the local features, a stacking method is used to integrate and obtain field features of each field within each type of protocol; The field features of each field within each type of protocol are input into a multi-layer perceptron to obtain a field type recognition result of each field within each type of protocol output by the multi-layer perceptron.

[0011] The present invention also provides a multi-protocol autonomous identification device based on an edge computing gateway, comprising the following modules: Acquisition module, used to collect communication data streams of different protocols; A first feature module is used to obtain the overall characteristics of the byte stream and the distribution characteristics of the byte value based on the communication data stream of the different protocols, and to obtain the dynamic characteristics of the communication data stream of the different protocols based on the communication data stream of the different protocols; A second feature module, used to obtain static features of the communication data streams of different protocols based on the overall features of the byte streams and the distribution features of the byte values; A third feature module is used to obtain the protocol features of the different protocols through feature fusion based on the static features and the dynamic features; A first identification module is used to obtain a protocol type identification result of each protocol based on the protocol features of the different protocols through a plurality of trained neural network models; the neural network models are trained based on communication data streams of a plurality of historical protocols; A second identification module is used to obtain field type identification results of each field within each type of protocol based on the communication data stream of each type of protocol through a trained deep learning parser; the deep learning parser is trained based on the communication data streams of multiple historical protocols; The deep learning parser includes a long short-term memory network model, a Transformer model, a convolutional neural network model and a multi-layer perceptron; the long short-term memory network model is used to extract the timing features between protocol fields; the Transformer model is used to extract the global features between protocol fields; the convolutional neural network model is used to extract the local features between protocol fields; the multi-layer perceptron is used to output the field types of each field within the protocol.

[0012] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, wherein when the processor executes the computer program, it implements any of the multi-protocol autonomous identification methods based on edge computing gateways as described above.

[0013] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the multi-protocol autonomous identification method based on an edge computing gateway as described in any one of the above is implemented.

[0014] The present invention also provides a computer program product, including a computer program, which, when executed by a processor, implements any of the multi-protocol autonomous identification methods based on an edge computing gateway as described above.

[0015] The present invention provides a multi-protocol autonomous identification method based on an edge computing gateway. The method collects communication data streams of different protocols, extracts static features and dynamic features of the communication data streams of different protocols, obtains protocol features through feature fusion, and then identifies the protocol type through a plurality of trained neural network models based on the protocol features. The static features and dynamic features are fully considered, and the semantic understanding and dynamic adaptability of the model to the fields in the communication data stream are improved. The accuracy of the protocol type identification result is improved by integrating the identification results of a plurality of trained neural network models. Then, the various fields in the protocol are parsed through a trained deep learning parser to obtain a field type identification result. The edge computing gateway is implemented to efficiently and accurately identify the protocol type and field type, and the flexibility, scalability and compatibility of the system are improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0017] Figure 1 This is one of the flow charts of a multi-protocol autonomous identification method based on an edge computing gateway provided by the present invention.

[0018] Figure 2 This is the second flow chart of a multi-protocol autonomous identification method based on an edge computing gateway provided by the present invention.

[0019] Figure 3 It is a structural schematic diagram of a multi-protocol autonomous identification device based on an edge computing gateway provided by the present invention.

[0020] Figure 4 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0021] In the prior art, there are mainly three methods for multi-protocol identification access of gateway devices: the first identification method is to compare through preset protocols, but the problem is poor scalability. Each new protocol or device needs to be manually updated and configured, which is insufficient in flexibility and limits the expansion capability of the system; the second method is to set it through manual configuration, and the manual configuration process is cumbersome, especially when there are many types of equipment or frequent changes, which increases the deployment and maintenance costs of the system; the third method is a classification method through artificial intelligence algorithms, but the disadvantage is that it requires a large number of data sets and has limited generalization ability. The model performs well on training data, but when faced with unseen protocols or changes in data distribution, the recognition accuracy may drop significantly and lacks sufficient robustness.

[0022] Therefore, existing methods are difficult to dynamically adapt to new protocols or changes in protocol characteristics, which limits the flexibility, scalability and compatibility of the system.

[0023] In response to the problems existing in the autonomous identification of multiple protocols in gateways, the present invention proposes a multi-protocol automatic parsing method based on the fusion of static and dynamic features of protocol byte streams and combined with multiple deep learning models. Relying on the support of the edge computing gateway hardware platform, the accuracy of protocol type identification and field-level parsing is improved, and automatic adaptation, rapid access and efficient parsing of multiple protocols are achieved, meeting the needs of access and communication of multiple devices in intelligent gateways.

[0024] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0025] Combine the following Figures 1 to 4 The present invention describes a multi-protocol autonomous identification method and device based on an edge computing gateway.

[0026] Figure 1 This is one of the flow charts of a multi-protocol autonomous identification method based on an edge computing gateway provided by the present invention, such as Figure 1 As shown, the method comprises the following steps: Step 101: Collect communication data streams of different protocols.

[0027] Specifically, in an embodiment of the present invention, a CPU with high-performance computing capabilities is used as a gateway processor. The gateway communicates with access devices through different data protocols, collects communication data streams of different protocols, and stores them in memory. The collected data is pre-processed, including denoising, frame segmentation, data standardization, etc., for subsequent feature extraction.

[0028] Step 102: Based on the communication data streams of different protocols, obtain the overall characteristics of the byte stream and the distribution characteristics of the byte values, and based on the communication data streams of different protocols, obtain the dynamic characteristics of the communication data streams of different protocols.

[0029] Specifically, in different communication protocols, the number of bytes in the byte stream, the byte arrangement, the position and length of specific fields, etc. are important bases for distinguishing protocol types.

[0030] In the embodiment of the present invention, by analyzing the characteristics of the byte stream in the protocol data, the overall characteristics of the byte stream and the distribution characteristics of the byte values ​​are extracted using traditional mathematical models, that is, the protocol data stream is vectorized using mathematical modeling and other methods to reflect the basic structural characteristics in the protocol data frame, and further statistics are made on the characteristics in the byte stream to construct a byte stream feature matrix to describe the feature distribution of different protocols, thereby capturing the unique characteristics of the protocol. The steps for extracting the overall characteristics of the byte stream and the distribution characteristics of the byte values ​​are as follows: (1) Byte feature vectorization Represent the protocol's byte stream as a vector

[0031] in, Indicates the first The value of a byte, the value range of the byte is [0, 255], representing an 8-bit binary number; The total length of the byte stream, indicating the number of bytes in the protocol frame, length It varies due to different protocols and different data frame types.

[0032] (2) Overall characteristics of the byte stream and distribution characteristics of byte values Overall characteristics of byte stream: Count the byte values ​​in the byte stream and extract specific statistics (such as mean, standard deviation, etc.) to represent the overall characteristics of the byte stream. and represent the mean and standard deviation of the byte values ​​respectively, then and The calculation expression is as follows:

[0033]

[0034] Distribution characteristics of byte values: Analyze the frequency distribution of each byte value in the byte stream and construct a frequency histogram ,in Indicates that the byte value is The frequency, The value range of is [0, 255]. In this way, the unique byte value distribution characteristics of different protocols are captured.

[0035] In the embodiment of the present invention, based on the communication data flows of different protocols, dynamic features of the communication data flows of different protocols are also extracted.

[0036] For the dynamic characteristics of communication data streams of different protocols, the dynamic changes in the protocol byte stream and the contextual relationship between fields can be captured through the time series modeling method, or by combining high-dimensional feature embedding and position encoding to capture its dynamic changes and contextual dependencies. Dynamic feature extraction methods include: (1) Use the embedding layer to convert each field of the protocol into a high-dimensional dense vector , which is similar to the word embedding representation of words in natural language processing. Through learning, the embedding layer can represent different fields in the protocol as vectors, thereby capturing their semantic information.

[0037]

[0038] Byte value indicating the protocol The corresponding high-dimensional dense vector, is the total length of the byte stream, indicating the number of bytes in the protocol frame. Each field in the protocol byte stream is input into the long short-term memory network model in the order in which it appears, and the embedding vectors of these fields form a time-series input sequence , and then output the timing features through the long short-term memory network model. Taking this timing feature as the dynamic feature of the communication data stream of different protocols, the dynamic changes in the protocol byte stream and the contextual relationship between fields can be captured.

[0039] (2) The global dependencies of the protocol fields are modeled through the Transformer model. The attention mechanism in the Transformer model is used to allow the representation of each field to interact with all other fields in the entire protocol, thereby capturing the global relationship and interdependence between the fields, and using position encoding to improve parsing capabilities. Field representation after multi-head attention mechanism processing is the global feature, The expression is as follows:

[0040] Contains the context information of the entire protocol. Byte value indicating the protocol The corresponding high-dimensional dense vector, Byte value indicating the protocol The corresponding high-dimensional dense vector. At this time, by adding position encoding , adding position information in the protocol byte stream to each byte vector, which can capture the sequential dependencies between bytes and add position encoding The global features can also be used as dynamic features of communication data streams of different protocols to capture the dynamic changes in the protocol byte stream and the contextual relationship between fields. In this case, the dynamic feature vector The expression is:

[0041] The embodiment of the present invention obtains the overall characteristics of the byte stream and the distribution characteristics of the byte values ​​based on the communication data stream of different protocols, provides a basic description of different protocols, and also proposes two methods to obtain the dynamic characteristics of the communication data stream of different protocols. The two methods are combined with different deep learning models, and both can realize the extraction of dynamic characteristics of communication data streams of different protocols, capture the dynamic changes in the protocol byte stream and the contextual relationship between fields, and achieve similar effects, thereby making the protocol parsing process more comprehensive, accurate and efficient. These two methods can also enable the edge computing gateway to have stronger adaptability and flexibility when facing complex multi-protocol scenarios.

[0042] Step 103: Based on the overall characteristics of the byte stream and the distribution characteristics of the byte values, obtain the static characteristics of the communication data streams of the different protocols.

[0043] Specifically, construct the feature matrix ,in represents the number of samples, Represents the number of features of each byte stream sample. Each protocol communication data stream corresponds to a row of vectors , including byte length, overall characteristics of the byte stream (i.e., byte value mean, standard deviation), and distribution characteristics of byte values ​​(i.e., frequency histogram), then the static feature vectors of communication data streams of different protocols are The expression is as follows:

[0044] The embodiment of the present invention constructs a feature matrix to fully represent multiple features such as byte length, overall characteristics of the byte stream (i.e., byte value mean and standard deviation), and distribution characteristics of byte values ​​(i.e., frequency histogram), which can comprehensively capture and describe the unique characteristics of different protocols, thereby improving the accuracy of subsequent models in identifying protocol types.

[0045] Step 104: Based on the static features and the dynamic features, protocol features of the different protocols are obtained by feature fusion.

[0046] Specifically, the dynamic feature vector is compared with the static feature vector The fusion method can be vector concatenation or weighted summation, and the fused features are the protocol features. For example, when the dynamic feature vector is In the case of The expression can be:

[0047] In this way, static features are combined with dynamic features. Since static features provide a basic description of the protocol, and dynamic features characterize the contextual relationship and dependency between fields, the fusion of static and dynamic features enables the protocol features to contain both the basic statistical information of the protocol fields and their dynamic contextual information.

[0048] The embodiment of the present invention obtains protocol features through feature fusion, so that subsequent models can have an in-depth semantic understanding of field data in communication data streams of different protocols, comprehensively obtain various information such as timing information, field information, and protocol tags, and realize accurate type identification and field parsing.

[0049] Step 105: Based on the protocol features of the different protocols, a protocol type recognition result of each protocol is obtained through a plurality of trained neural network models; the neural network models are trained based on communication data streams of a plurality of historical protocols.

[0050] Specifically, protocol type identification is to perform type identification based on the protocol characteristics of the protocol data, classify the entire protocol byte stream, and determine the type of the protocol.

[0051] The embodiment of the present invention uses a variety of trained neural network models to classify protocol types. Multiple models make predictions based on the input feature vectors to obtain preliminary classification results of the protocol types. Then, the preliminary classification results of each model are fused by weighted average method to generate the final protocol type recognition result. The steps are as follows: (1) Input the fused feature vector (i.e., protocol feature) into multiple trained neural network models for protocol classification; (2) Each model independently makes predictions based on the input feature vector and obtains a preliminary classification result of the protocol type; (3) The preliminary classification results of each model are integrated through the weighted average method to obtain the weighted average value, which is used as the final protocol type recognition result.

[0052] In addition, the neural network model is trained based on the communication data streams of multiple historical protocols. The specific training methods include: The device data connected to the edge computing gateway is obtained (including communication data streams of various historical protocols, such as Modbus protocol data stream, MQTT protocol data stream, and HTTP protocol data stream, etc.), and different types of protocol data streams are converted into vector representations. The static and dynamic features of the protocol are extracted, and the protocol features are obtained through feature fusion to form an original feature data set; then the original feature data set is divided into a training set and a test set in a ratio of 7:3 (other ratios can also be divided according to actual needs, such as 8:2 or 6:4, etc.), and each model is trained using the training set, and each model is tested using the test set; finally, a trained protocol type recognition model based on protocol features is obtained, among which the model can select a variety of models such as random forest, support vector machine, and convolutional neural network model.

[0053] The embodiment of the present invention reduces the classification error caused by a single model through the integrated learning method, and improves the accuracy of protocol type recognition.

[0054] Step 106: Based on the communication data stream of each type of protocol, obtain the field type recognition result of each field within each type of protocol through a trained deep learning parser; the deep learning parser is trained based on the communication data streams of multiple historical protocols.

[0055] The deep learning parser includes a long short-term memory network model, a Transformer model, a convolutional neural network model and a multi-layer perceptron; the long short-term memory network model is used to extract the timing features between protocol fields; the Transformer model is used to extract the global features between protocol fields; the convolutional neural network model is used to extract the local features between protocol fields; the multi-layer perceptron is used to output the field types of each field within the protocol.

[0056] Based on the above embodiment, after determining the protocol type, it is also necessary to parse each field within the protocol to determine the specific function and meaning of the field (such as function code, data field, etc.) in order to understand the contextual relationship and capture the sequential dependency and global dependency between fields.

[0057] The embodiment of the present invention integrates deep learning models, combines the characteristics of different models, builds and trains a deep learning semantic parser, and identifies the field type of each field within the protocol.

[0058] The deep learning parser includes a long short-term memory network model, a Transformer model, a convolutional neural network model, and a multi-layer perceptron; the long short-term memory network model is used to extract the temporal features between protocol fields; the Transformer model is used to extract the global features between protocol fields; the convolutional neural network model is used to extract the local features between protocol fields; and is used to output the field types of each field within the protocol.

[0059] The specific training method for the deep learning parser includes: dividing the above original feature data set into a training set (70%) and a test set (30%), training the deep learning parser, and obtaining a trained deep learning parser.

[0060] After the deep learning parser is trained, multiple trained neural network models and trained deep learning parsers are deployed to the edge computing gateway. The edge computing gateway is a low-latency and has certain computing capabilities. The model deployed in the gateway can process the received protocol data in real time, identify the protocol type through the deployed algorithm model, and further parse and semantically understand the protocol field, and finally complete the classified storage of data.

[0061] The embodiment of the present invention integrates multiple deep learning models, so that the edge computing gateway can make full use of static features and dynamic features in the protocol parsing process, accurately identify the protocol type, and effectively reduce the error rate of field type identification, improve the accuracy and generalization ability of field parsing, and accurately identify the field type, so as to adapt to the complex environment where multiple protocols coexist, and realize efficient, accurate and robust protocol parsing and identification.

[0062] The present invention provides a multi-protocol autonomous identification method based on an edge computing gateway. The method collects communication data streams of different protocols, extracts static features and dynamic features of the communication data streams of different protocols, obtains protocol features through feature fusion, and then identifies the protocol type through a plurality of trained neural network models based on the protocol features. The static features and dynamic features are fully considered, and the semantic understanding and dynamic adaptability of the model to the fields in the communication data stream are improved. The accuracy of the protocol type identification result is improved by integrating the identification results of a plurality of trained neural network models. Then, the various fields in the protocol are parsed through a trained deep learning parser to obtain a field type identification result. The edge computing gateway is implemented to efficiently and accurately identify the protocol type and field type, and the flexibility, scalability and compatibility of the system are improved.

[0063] Optionally, obtaining overall characteristics of byte streams and distribution characteristics of byte values ​​based on the communication data streams of different protocols includes: Based on the communication data streams of the different protocols, the mean and standard deviation of all byte values ​​in the byte stream are calculated to obtain the overall characteristics of the byte stream, and based on the communication data streams of the different protocols, the frequency of each byte value in the byte stream is calculated to obtain the distribution characteristics of the byte values.

[0064] Specifically, in different communication protocols, the number of bytes in the byte stream, the byte arrangement, the position and length of specific fields, etc. are important bases for distinguishing protocol types.

[0065] In the embodiment of the present invention, by analyzing the characteristics of the byte stream in the protocol data, the overall characteristics of the byte stream and the distribution characteristics of the byte values ​​are extracted using traditional mathematical models, that is, the protocol data stream is vectorized using mathematical modeling and other methods to reflect the basic structural characteristics in the protocol data frame, and further statistics are made on the characteristics in the byte stream to construct a byte stream feature matrix to describe the feature distribution of different protocols, thereby capturing the unique characteristics of the protocol. The steps for extracting the overall characteristics of the byte stream and the distribution characteristics of the byte values ​​are as follows: (1) Byte feature vectorization Represent the protocol's byte stream as a vector

[0066] in, Indicates the first The value of a byte, the value range of the byte is [0, 255], representing an 8-bit binary number; The total length of the byte stream, indicating the number of bytes in the protocol frame, length It varies due to different protocols and different data frame types.

[0067] (2) Overall characteristics of the byte stream and distribution characteristics of byte values Overall characteristics of byte stream: Count the byte values ​​in the byte stream and extract specific statistics (such as mean, standard deviation, etc.) to represent the overall characteristics of the byte stream. and represent the mean and standard deviation of the byte values ​​respectively, then and The calculation expression is as follows:

[0068]

[0069] Distribution characteristics of byte values: Analyze the frequency distribution of each byte value in the byte stream and construct a frequency histogram ,in Indicates that the byte value is The frequency, The value range of is [0, 255]. In this way, the unique byte value distribution characteristics of different protocols are captured.

[0070] The embodiment of the present invention obtains the overall characteristics of the byte stream and the distribution characteristics of the byte value based on the communication data stream of different protocols, and provides a basic description of different protocols, thereby providing a basis for subsequent models to identify protocol types.

[0071] Optionally, obtaining the dynamic characteristics of the communication data flows of the different protocols based on the communication data flows of the different protocols includes: Based on the communication data streams of the different protocols, obtaining a high-dimensional dense vector corresponding to each field of each protocol; Input the high-dimensional dense vector corresponding to each field of each protocol into the long short-term memory network model to obtain the time series features output by the long short-term memory network model, and use the time series features as the dynamic features of the communication data streams of the different protocols; or, input the high-dimensional dense vector corresponding to each field of each protocol into the Transformer model to obtain the global features output by the Transformer model, and use the global features as the dynamic features of the communication data streams of the different protocols.

[0072] Specifically, for the dynamic characteristics of communication data flows of different protocols, the dynamic changes in the protocol byte stream and the contextual relationship between fields can be captured through the timing modeling method, or by combining high-dimensional feature embedding and position encoding to capture its dynamic changes and contextual dependencies.

[0073] In some embodiments, the dynamic feature extraction method may be: Use an embedding layer to convert each field of the protocol into a high-dimensional dense vector , which is similar to the word embedding representation of words in natural language processing. Through learning, the embedding layer can represent different fields in the protocol as vectors, thereby capturing their semantic information.

[0074]

[0075] Byte value indicating the protocol The corresponding high-dimensional dense vector, is the total length of the byte stream, indicating the number of bytes in the protocol frame. Each field in the protocol byte stream is input into the long short-term memory network model in the order in which it appears, and the embedding vectors of these fields form a time-series input sequence , and then output the timing features through the long short-term memory network model. Taking this timing feature as the dynamic feature of the communication data stream of different protocols, the dynamic changes in the protocol byte stream and the contextual relationship between fields can be captured.

[0076] In some other embodiments, the dynamic feature extraction method may be: The Transformer model is used to model the global dependencies of the protocol fields. The attention mechanism in the Transformer model is used to allow the representation of each field to interact with all other fields in the entire protocol, thereby capturing the global relationship and interdependence between the fields, and using position encoding to improve parsing capabilities. Field representation after multi-head attention mechanism processing is the global feature, The expression is as follows:

[0077] Contains the context information of the entire protocol. Byte value indicating the protocol The corresponding high-dimensional dense vector, Byte value indicating the protocol The corresponding high-dimensional dense vector. At this time, by adding position encoding , adding position information in the protocol byte stream to each byte vector, which can capture the sequential dependencies between bytes and add position encoding The global features can also be used as dynamic features of communication data streams of different protocols to capture the dynamic changes in the protocol byte stream and the contextual relationship between fields. In this case, the dynamic feature vector The expression is:

[0078] Based on the communication data streams of different protocols, the embodiment of the present invention proposes two methods to obtain the dynamic characteristics of the communication data streams of different protocols. The two methods are combined with different deep learning models, and both can realize the extraction of dynamic characteristics of the communication data streams of different protocols, capture the dynamic changes in the protocol byte stream and the contextual relationship between fields, and achieve similar effects, thereby making the protocol parsing process more comprehensive, accurate and efficient. These two methods can also enable the edge computing gateway to have stronger adaptability and flexibility when facing complex multi-protocol scenarios.

[0079] Optionally, in the case where the global feature is used as the dynamic feature of the communication data stream of the different protocols, the method further includes: A position code is added to each byte vector in the global feature, so that the global feature after adding the position code is used as the dynamic feature of the communication data stream of the different protocols; the position code is used to represent the position information of each byte vector in the byte stream.

[0080] Specifically, the Transformer model is used to model the global dependencies of the protocol fields. The attention mechanism in the Transformer model is used to allow the representation of each field to interact with all other fields in the entire protocol, thereby capturing the global relationship and interdependence between the fields, and using position encoding to improve parsing capabilities. Field representation after multi-head attention mechanism processing is the global feature, The expression is as follows:

[0081] Contains the context information of the entire protocol. Byte value indicating the protocol The corresponding high-dimensional dense vector, Byte value indicating the protocol The corresponding high-dimensional dense vector.

[0082] In this case, by adding position encoding to the global feature , adding position information in the protocol byte stream to each byte vector, which can capture the sequential dependencies between bytes and add position encoding The global features can also be used as dynamic features of communication data streams of different protocols to capture the dynamic changes in the protocol byte stream and the contextual relationship between fields. In this case, the dynamic feature vector The expression is:

[0083] The embodiment of the present invention is based on the communication data streams of different protocols and combines the Transformer model to model the global dependencies of protocol fields. By supplementing the position encoding of the global features output by the Transformer model, the dynamic changes in the protocol byte stream and the contextual relationship between fields are captured, thereby making the protocol parsing process more comprehensive, accurate and efficient, and improving the adaptability and flexibility of the edge computing gateway in the face of complex multi-protocol scenarios.

[0084] Optionally, the protocol type identification result of each protocol is obtained by using a plurality of trained neural network models based on the protocol features of the different protocols, including: The protocol features of different protocols are respectively input into a plurality of trained neural network models to obtain the protocol type classification results output by each trained neural network model; The weighted average of the protocol type classification results output by all trained neural network models is calculated to obtain the protocol type recognition result of each protocol.

[0085] Specifically, protocol type identification is to perform type identification based on the protocol characteristics of the protocol data, classify the entire protocol byte stream, and determine the type of the protocol.

[0086] The embodiment of the present invention adopts multiple trained neural network models to classify protocol types. Multiple models make predictions based on the input feature vectors respectively to obtain preliminary classification results of the protocol types. Then, the preliminary classification results of each model are fused by the weighted average method to generate the final protocol type recognition result.

[0087] In the embodiment of the present invention, random forest, support vector machine and convolutional neural model are used as examples to classify the static and dynamic features of protocol data respectively. Each model independently outputs the classification result of the protocol type, and the weights of random forest, support vector machine and convolutional neural model are set as random forest (0.4), support vector machine (0.3) and convolutional neural model (0.3), respectively. The weighted average method is used to calculate according to the set weights to obtain the protocol type recognition result of each protocol.

[0088] In an embodiment of the present invention, experimental results show that by using the protocol features obtained by fusing static features and dynamic features and integrating multiple deep learning models, the accuracy of protocol type recognition reaches 95.7%, which is 3.8% higher than the accuracy of using a single convolutional neural network model. It can be seen that the embodiment of the present invention reduces the classification error caused by a single model through this integrated learning method and improves the accuracy of protocol type recognition.

[0089] Optionally, the communication data stream based on each type of protocol, through a trained deep learning parser, obtains the field type recognition result of each field within each type of protocol, including: The communication data stream of each type of protocol is input into the long short-term memory network model, the Transformer model and the convolutional neural network model respectively, to obtain the temporal features between the protocol fields output by the long short-term memory network model, the global features between the protocol fields output by the Transformer model and the local features between the protocol fields output by the convolutional neural network model; Based on the timing features, the global features, and the local features, a stacking method is used to integrate and obtain field features of each field within each type of protocol; The field features of each field within each type of protocol are input into a multi-layer perceptron to obtain a field type recognition result of each field within each type of protocol output by the multi-layer perceptron.

[0090] Specifically, after determining the protocol type, it is also necessary to parse each field within the protocol to determine the specific function and meaning of the field (such as function code, data field, etc.) in order to understand the context and capture the sequential dependencies and global dependencies between fields.

[0091] The embodiment of the present invention integrates deep learning models, combines the characteristics of different models, builds and trains a deep learning semantic parser, and identifies the field type of each field within the protocol.

[0092] The communication data stream of each type of protocol is input into the trained deep learning parser, and the temporal features between the protocol fields are extracted through the long short-term memory network model, the global features between the protocol fields are extracted through the transformer model, and the local features between the protocol fields are extracted through the convolutional neural network model. The outputs of the long short-term memory network model, the transformer model, and the convolutional neural network model are stacked and integrated using the stacking method as the input features of the multi-layer perceptron, which performs the final prediction and semantic understanding of the field type and outputs the field type recognition results of each field in the protocol. The experimental results show that the accuracy of field-level parsing (that is, field type recognition) reaches 93.4%.

[0093] The embodiment of the present invention integrates multiple models to build a deep learning parser, and then uses the trained deep learning parser to parse each field in the protocol to obtain a field type recognition result. The timing features, global features, and local features are stacked and integrated through the Stacking method to fully mine the feature information of each field in the protocol, effectively reducing the error rate of the model in identifying the field type, realizing efficient and accurate identification of the protocol type and field type by the edge computing gateway, and improving the flexibility, scalability, and compatibility of the system.

[0094] In some embodiments, after the trained model is deployed to the edge computing gateway, the model can also be updated through online learning. Figure 2 This is a second flow chart of a multi-protocol autonomous identification method based on an edge computing gateway provided by the present invention, such as Figure 2 shown.

[0095] First, data collection is performed to build a data set. The protocol data received or collected by the edge computing gateway includes: TCP protocol data, Modbus protocol data, MQTT protocol data, HTTP protocol data, LoRaWAN protocol data, OPCUA protocol data, CoAP protocol data, and non-standard protocol data.

[0096] Then the protocol features are extracted, and the protocol type is identified based on the protocol features. The various fields within the protocol are further identified to determine the specific function and meaning of the fields (such as function codes, data fields, etc.), and then the corresponding decision-making applications can be obtained.

[0097] Finally, various types of protocol data are received in real time by the edge computing gateway, and online learning is performed using incremental learning. According to the feature feedback provided by the real-time data, the model is continuously trained and adjusted to achieve dynamic updating and parameter optimization of the model, so that the model can adapt to the dynamic changes of protocol characteristics, thereby improving the accuracy and stability of protocol type identification and field identification.

[0098] Based on the above embodiments, the embodiments of the present invention provide a multi-protocol autonomous identification method based on an edge computing gateway, which can efficiently and accurately parse multiple protocols and adapt to complex feature changes in a multi-protocol environment, so that the edge computing gateway does not need to be manually configured, and realizes plug-and-play intelligent access management in a multi-protocol communication environment, thereby improving the flexibility, scalability and compatibility of the system.

[0099] The following is a description of a multi-protocol autonomous identification device based on an edge computing gateway provided by the present invention. The multi-protocol autonomous identification device based on an edge computing gateway described below and the multi-protocol autonomous identification method based on an edge computing gateway described above can be referenced to each other.

[0100] Based on any of the above embodiments, Figure 3 : is a structural diagram of a multi-protocol autonomous identification device based on an edge computing gateway provided by the present invention, such as Figure 3 The embodiment of the present invention provides a multi-protocol autonomous identification device based on an edge computing gateway, including a collection module 301, a first feature module 302, a second feature module 303, a third feature module 304, a first identification module 305 and a second identification module 306, wherein: The acquisition module 301 is used to acquire communication data streams of different protocols; the first feature module 302 is used to obtain the overall characteristics of the byte stream and the distribution characteristics of the byte value based on the communication data streams of the different protocols, and, based on the communication data streams of the different protocols, obtain the dynamic characteristics of the communication data streams of the different protocols; the second feature module 303 is used to obtain the static characteristics of the communication data streams of the different protocols based on the overall characteristics of the byte stream and the distribution characteristics of the byte value; the third feature module 304 is used to obtain the protocol characteristics of the different protocols through feature fusion based on the static characteristics and the dynamic characteristics; the first identification module 305 is used to obtain the protocol type identification result of each protocol through a plurality of trained neural network models based on the protocol characteristics of the different protocols; the neural network model is based on The second recognition module 306 is used to obtain the field type recognition result of each field within each type of protocol through a trained deep learning parser based on the communication data stream of each type of protocol; the deep learning parser is trained based on the communication data stream of multiple historical protocols; the deep learning parser includes a long short-term memory network model, a Transformer model, a convolutional neural network model and a multi-layer perceptron; the long short-term memory network model is used to extract the timing features between protocol fields; the Transformer model is used to extract the global features between protocol fields; the convolutional neural network model is used to extract the local features between protocol fields; the multi-layer perceptron is used to output the field type of each field within the protocol.

[0101] The present invention provides a multi-protocol autonomous identification device based on an edge computing gateway. The device collects communication data streams of different protocols, extracts static features and dynamic features of the communication data streams of different protocols, obtains protocol features through feature fusion, and then identifies the protocol type based on the protocol features through a variety of trained neural network models. The static features and dynamic features are fully considered, the semantic understanding and dynamic adaptability of the model to the fields in the communication data stream are improved, and the accuracy of the protocol type identification result is improved by integrating the identification results of a variety of trained neural network models. Then, the various fields in the protocol are parsed through a trained deep learning parser to obtain a field type identification result. The edge computing gateway realizes efficient and accurate identification of protocol types and field types, and improves the flexibility, scalability and compatibility of the system.

[0102] Figure 4 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 4 As shown, the electronic device may include: a processor 410, a communications interface 420, a memory 430 and a communication bus 440, wherein the processor 410, the communications interface 420, and the memory 430 communicate with each other through the communication bus 440. The processor 410 may call the logic instructions in the memory 430 to execute a multi-protocol autonomous identification method based on an edge computing gateway, the method comprising: Collect communication data streams of different protocols; Based on the communication data streams of the different protocols, the overall characteristics of the byte streams and the distribution characteristics of the byte values ​​are obtained, and based on the communication data streams of the different protocols, the dynamic characteristics of the communication data streams of the different protocols are obtained; Based on the overall characteristics of the byte stream and the distribution characteristics of the byte values, obtaining the static characteristics of the communication data streams of the different protocols; Based on the static features and the dynamic features, obtaining protocol features of the different protocols through feature fusion; Based on the protocol features of the different protocols, a protocol type recognition result of each protocol is obtained through a plurality of trained neural network models; the neural network models are trained based on communication data streams of a plurality of historical protocols; Based on the communication data stream of each type of protocol, the field type recognition result of each field within each type of protocol is obtained through a trained deep learning parser; the deep learning parser is trained based on the communication data streams of multiple historical protocols; The deep learning parser includes a long short-term memory network model, a Transformer model, a convolutional neural network model and a multi-layer perceptron; the long short-term memory network model is used to extract the timing features between protocol fields; the Transformer model is used to extract the global features between protocol fields; the convolutional neural network model is used to extract the local features between protocol fields; the multi-layer perceptron is used to output the field types of each field within the protocol.

[0103] In addition, the logic instructions in the above-mentioned memory 430 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0104] On the other hand, the present invention further provides a computer program product, the computer program product includes a computer program, the computer program can be stored on a non-transitory computer-readable storage medium, and when the computer program is executed by a processor, the computer can execute the multi-protocol autonomous identification method based on the edge computing gateway provided by the above methods, the method comprising: Collect communication data streams of different protocols; Based on the communication data streams of the different protocols, the overall characteristics of the byte streams and the distribution characteristics of the byte values ​​are obtained, and based on the communication data streams of the different protocols, the dynamic characteristics of the communication data streams of the different protocols are obtained; Based on the overall characteristics of the byte stream and the distribution characteristics of the byte values, obtaining the static characteristics of the communication data streams of the different protocols; Based on the static features and the dynamic features, obtaining protocol features of the different protocols through feature fusion; Based on the protocol features of the different protocols, a protocol type recognition result of each protocol is obtained through a plurality of trained neural network models; the neural network models are trained based on communication data streams of a plurality of historical protocols; Based on the communication data stream of each type of protocol, the field type recognition result of each field within each type of protocol is obtained through a trained deep learning parser; the deep learning parser is trained based on the communication data streams of multiple historical protocols; The deep learning parser includes a long short-term memory network model, a Transformer model, a convolutional neural network model and a multi-layer perceptron; the long short-term memory network model is used to extract the timing features between protocol fields; the Transformer model is used to extract the global features between protocol fields; the convolutional neural network model is used to extract the local features between protocol fields; the multi-layer perceptron is used to output the field types of each field within the protocol.

[0105] In another aspect, the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, which is implemented when the computer program is executed by a processor to execute the multi-protocol autonomous identification method based on edge computing gateway provided by the above methods, the method comprising: Collect communication data streams of different protocols; Based on the communication data streams of the different protocols, the overall characteristics of the byte streams and the distribution characteristics of the byte values ​​are obtained, and based on the communication data streams of the different protocols, the dynamic characteristics of the communication data streams of the different protocols are obtained; Based on the overall characteristics of the byte stream and the distribution characteristics of the byte values, obtaining the static characteristics of the communication data streams of the different protocols; Based on the static features and the dynamic features, obtaining protocol features of the different protocols through feature fusion; Based on the protocol features of the different protocols, a protocol type recognition result of each protocol is obtained through a plurality of trained neural network models; the neural network models are trained based on communication data streams of a plurality of historical protocols; Based on the communication data stream of each type of protocol, the field type recognition result of each field within each type of protocol is obtained through a trained deep learning parser; the deep learning parser is trained based on the communication data streams of multiple historical protocols; The deep learning parser includes a long short-term memory network model, a Transformer model, a convolutional neural network model and a multi-layer perceptron; the long short-term memory network model is used to extract the timing features between protocol fields; the Transformer model is used to extract the global features between protocol fields; the convolutional neural network model is used to extract the local features between protocol fields; the multi-layer perceptron is used to output the field types of each field within the protocol.

[0106] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0107] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0108] It should be noted that, in this article, the terms "comprise", "include" or any other variant thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise one..." do not exclude the presence of other identical elements in the process, method, article or device including the element. In addition, it should be pointed out that the scope of the methods and devices in the embodiments of the present application is not limited to performing functions in the order shown or discussed, and may also include performing functions in a substantially simultaneous manner or in reverse order according to the functions involved, for example, the described method may be performed in an order different from that described, and various steps may also be added, omitted, or combined. In addition, the features described with reference to certain examples may be combined in other examples.

[0109] It should also be noted that the terms "first", "second", etc. in the present invention are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the terms used in this way can be interchangeable under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described herein, and the objects distinguished by "first" and "second" are generally of the same type, and the number of objects is not limited. For example, the first object can be one or more.

[0110] "Determine B based on A" in the embodiments of the present application means that the factor A should be considered when determining B. It is not limited to "B can be determined based on A alone", but should also include: "Determine B based on A and C", "Determine B based on A, C and E", "Determine C based on A, and further determine B based on C", etc. In addition, it can also include taking A as a condition for determining B, for example, "When A meets the first condition, use the first method to determine B"; for another example, "When A meets the second condition, determine B", etc.; for another example, "When A meets the third condition, determine B based on the first parameter", etc. Of course, it can also be a condition that takes A as a factor for determining B, for example, "When A meets the first condition, use the first method to determine C, and further determine B based on C", etc.

[0111] In the present invention, the term "plurality" refers to two or more than two, and other quantifiers are similar to them.

[0112] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

[0113] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A multi-protocol autonomous identification method based on edge computing gateway, characterized in that: include: Collect communication data streams of different protocols; Based on the communication data streams of the different protocols, the overall characteristics of the byte streams and the distribution characteristics of the byte values ​​are obtained, and based on the communication data streams of the different protocols, the dynamic characteristics of the communication data streams of the different protocols are obtained; Based on the overall characteristics of the byte stream and the distribution characteristics of the byte values, obtaining the static characteristics of the communication data streams of the different protocols; Based on the static features and the dynamic features, obtaining protocol features of the different protocols through feature fusion; Based on the protocol features of the different protocols, a protocol type recognition result of each protocol is obtained through a plurality of trained neural network models; the neural network models are trained based on communication data streams of a plurality of historical protocols; Based on the communication data stream of each type of protocol, the field type recognition result of each field within each type of protocol is obtained through a trained deep learning parser; the deep learning parser is trained based on the communication data streams of multiple historical protocols; The deep learning parser includes a long short-term memory network model, a Transformer model, a convolutional neural network model and a multi-layer perceptron; the long short-term memory network model is used to extract the timing features between protocol fields; the Transformer model is used to extract the global features between protocol fields; the convolutional neural network model is used to extract the local features between protocol fields; the multi-layer perceptron is used to output the field types of each field within the protocol.

2. The multi-protocol autonomous identification method based on edge computing gateway according to claim 1 is characterized in that: The communication data stream based on the different protocols, obtaining the overall characteristics of the byte stream and the distribution characteristics of the byte value, includes: Based on the communication data streams of the different protocols, the mean and standard deviation of all byte values ​​in the byte stream are calculated to obtain the overall characteristics of the byte stream, and based on the communication data streams of the different protocols, the frequency of each byte value in the byte stream is calculated to obtain the distribution characteristics of the byte values.

3. The multi-protocol autonomous identification method based on edge computing gateway according to claim 1 is characterized in that: The obtaining of dynamic characteristics of the communication data flows of the different protocols based on the communication data flows of the different protocols comprises: Based on the communication data streams of the different protocols, obtaining a high-dimensional dense vector corresponding to each field of each protocol; Input the high-dimensional dense vector corresponding to each field of each protocol into the long short-term memory network model to obtain the time series features output by the long short-term memory network model, and use the time series features as the dynamic features of the communication data streams of the different protocols; or, input the high-dimensional dense vector corresponding to each field of each protocol into the Transformer model to obtain the global features output by the Transformer model, and use the global features as the dynamic features of the communication data streams of the different protocols.

4. The multi-protocol autonomous identification method based on edge computing gateway according to claim 3 is characterized in that: In the case where the global feature is used as the dynamic feature of the communication data stream of the different protocols, the method further includes: A position code is added to each byte vector in the global feature, so that the global feature after adding the position code is used as the dynamic feature of the communication data stream of the different protocols; the position code is used to represent the position information of each byte vector in the byte stream.

5. The multi-protocol autonomous identification method based on edge computing gateway according to claim 1 is characterized in that: The protocol type recognition result of each protocol is obtained based on the protocol features of the different protocols through a plurality of trained neural network models, including: The protocol features of different protocols are respectively input into a plurality of trained neural network models to obtain the protocol type classification results output by each trained neural network model; The weighted average of the protocol type classification results output by all trained neural network models is calculated to obtain the protocol type recognition result of each protocol.

6. The multi-protocol autonomous identification method based on edge computing gateway according to claim 1 is characterized in that: The communication data stream based on each type of protocol obtains the field type recognition results of each field within each type of protocol through the trained deep learning parser, including: The communication data stream of each type of protocol is input into the long short-term memory network model, the Transformer model and the convolutional neural network model respectively, to obtain the temporal features between the protocol fields output by the long short-term memory network model, the global features between the protocol fields output by the Transformer model and the local features between the protocol fields output by the convolutional neural network model; Based on the timing features, the global features, and the local features, a stacking method is used to integrate and obtain field features of each field within each type of protocol; The field features of each field within each type of protocol are input into a multi-layer perceptron to obtain a field type recognition result of each field within each type of protocol output by the multi-layer perceptron.

7. A multi-protocol autonomous identification device based on edge computing gateway, characterized in that: include: Acquisition module, used to collect communication data streams of different protocols; A first feature module is used to obtain the overall characteristics of the byte stream and the distribution characteristics of the byte value based on the communication data stream of the different protocols, and to obtain the dynamic characteristics of the communication data stream of the different protocols based on the communication data stream of the different protocols; A second feature module, used to obtain static features of the communication data streams of different protocols based on the overall features of the byte streams and the distribution features of the byte values; A third feature module is used to obtain the protocol features of the different protocols through feature fusion based on the static features and the dynamic features; A first identification module is used to obtain a protocol type identification result of each protocol based on the protocol features of the different protocols through a plurality of trained neural network models; the neural network models are trained based on communication data streams of a plurality of historical protocols; A second identification module is used to obtain field type identification results of each field within each type of protocol based on the communication data stream of each type of protocol through a trained deep learning parser; the deep learning parser is trained based on the communication data streams of multiple historical protocols; The deep learning parser includes a long short-term memory network model, a Transformer model, a convolutional neural network model and a multi-layer perceptron; the long short-term memory network model is used to extract the timing features between protocol fields; the Transformer model is used to extract the global features between protocol fields; the convolutional neural network model is used to extract the local features between protocol fields; the multi-layer perceptron is used to output the field types of each field within the protocol.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that: When the processor executes the computer program, the multi-protocol autonomous identification method based on the edge computing gateway is implemented as described in any one of claims 1 to 6.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the multi-protocol autonomous identification method based on the edge computing gateway is implemented as described in any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the multi-protocol autonomous identification method based on the edge computing gateway is implemented as described in any one of claims 1 to 6.

Images