Multi-protocol autonomous identification method and device based on edge computing gateway

Abstract

The application provides a multi-protocol autonomous identification method and device based on an edge computing gateway, relates to the technical field of Internet of Things, and collects communication data streams of different protocols, extracts static features and dynamic features of the communication data streams of different protocols, obtains protocol features through feature fusion, then identifies protocol types based on the protocol features through a plurality of trained neural network models, and then parses each field in the protocol through a trained deep learning parser to obtain a field type identification result. The multi-protocol autonomous identification method based on the edge computing gateway realizes efficient and accurate identification of protocol types and field types by the edge computing gateway, and improves the flexibility, expansibility and compatibility of the system.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of Internet of Things, and in particular to a multi-protocol autonomous identification method and device based on an edge computing gateway. BACKGROUND

[0002] With the rapid development of Internet of Things technology, edge computing gateway applications are increasingly widespread, and usually need to access multiple devices, and these devices often use different communication protocols (such as Modbus, Ethernet protocol, serial port protocol, and MQTT, etc.).

[0003] The existing gateway usually needs to pre-configure or manually set the communication protocol of each access device, which increases the complexity and configuration time of the system, and it is difficult to dynamically adapt to changes in new protocols or protocol features, which limits the flexibility, scalability and compatibility of the system. SUMMARY

[0004] The present application provides a multi-protocol autonomous identification method and device based on an edge computing gateway to solve the technical problem that the edge computing gateway in the prior art is difficult to dynamically adapt to changes in new protocols or protocol features, resulting in poor flexibility, scalability and compatibility of the system.

[0005] The present application provides a multi-protocol autonomous identification method based on an edge computing gateway, comprising the following steps:

[0006] Collecting communication data streams of different protocols;

[0007] Based on the communication data streams of different protocols, obtaining the overall characteristics of the byte stream and the distribution characteristics of the byte value, and based on the communication data streams of different protocols, obtaining the dynamic characteristics of the communication data streams of different protocols;

[0008] Based on the overall characteristics of the byte stream and the distribution characteristics of the byte value, obtaining the static characteristics of the communication data streams of different protocols;

[0009] Based on the static characteristics and the dynamic characteristics, obtaining the protocol characteristics of the different protocols through feature fusion;

[0010] Based on the protocol characteristics of the different protocols, obtaining the protocol type identification result of each protocol through a plurality of trained neural network models; the neural network model is trained based on the communication data streams of a plurality of historical protocols;

[0011] Based on the communication data streams of each type of protocol, obtaining the field type identification result of each field inside each type of protocol through a trained deep learning parser; the deep learning parser is trained based on the communication data streams of a plurality of historical protocols;

[0012] The deep learning parser comprises a long short-term memory network model, a Transformer model, a convolutional neural network model, and a multi-layer perceptron; the long short-term memory network model is used to extract timing features between protocol fields; the Transformer model is used to extract global features between protocol fields; the convolutional neural network model is used to extract local features between protocol fields; and the multi-layer perceptron is used to output field types of respective fields in a protocol.

[0013] According to the application, a multi-protocol autonomous identification method based on an edge computing gateway is provided, which comprises the following steps:

[0014] According to the application, a multi-protocol autonomous identification method based on an edge computing gateway is provided, which comprises the following steps:

[0015] According to the application, a multi-protocol autonomous identification method based on an edge computing gateway is provided, which comprises the following steps:

[0016] According to the application, a multi-protocol autonomous identification method based on an edge computing gateway is provided, which comprises the following steps:

[0017] According to the application, a multi-protocol autonomous identification method based on an edge computing gateway is provided, which comprises the following steps:

[0018] According to the application, a multi-protocol autonomous identification method based on an edge computing gateway is provided, which comprises the following steps:

[0019] According to the application, a multi-protocol autonomous identification method based on an edge computing gateway is provided, which comprises the following steps:

[0020] According to the present invention, a multi-protocol autonomous identification method based on an edge computing gateway is provided, wherein the method obtains the protocol type identification result of each protocol based on the protocol characteristics of the different protocols through multiple trained neural network models, including:

[0021] The protocol features of different protocols are input into multiple trained neural network models to obtain the protocol type classification results output by each trained neural network model.

[0022] Calculate the weighted average of the protocol type classification results output by all trained neural network models to obtain the protocol type identification result for each protocol.

[0023] According to the present invention, a multi-protocol autonomous identification method based on an edge computing gateway is provided, wherein the communication data stream based on each type of protocol is processed by a trained deep learning parser to obtain the field type identification results of each field within each type of protocol, including:

[0024] The communication data streams of each type of protocol are input into a Long Short-Term Memory Network model, a Transformer model, and a Convolutional Neural Network model, respectively, to obtain the temporal features between protocol fields output by the Long Short-Term Memory Network model, the global features between protocol fields output by the Transformer model, and the local features between protocol fields output by the Convolutional Neural Network model.

[0025] Based on the time-series features, global features, and local features, the Stacking method is used to integrate them to obtain the field features of each field within each type of protocol.

[0026] The field features of each field within each type of protocol are input into a multilayer perceptron to obtain the field type identification results of each field within each type of protocol output by the multilayer perceptron.

[0027] The present invention also provides a multi-protocol autonomous identification device based on an edge computing gateway, comprising the following modules:

[0028] The acquisition module is used to acquire communication data streams using different protocols;

[0029] The first feature module is used to obtain the overall features of the byte stream and the distribution features of the byte values ​​based on the communication data streams of the different protocols, and to obtain the dynamic features of the communication data streams of the different protocols based on the communication data streams of the different protocols.

[0030] The second feature module is used to obtain the static features of the communication data streams of the different protocols based on the overall features of the byte stream and the distribution features of the byte values.

[0031] The third feature module is configured to obtain protocol features of the different protocols through feature fusion based on the static features and the dynamic features.

[0032] The first identification module is configured to obtain protocol type identification results of each protocol through a plurality of trained neural network models based on the protocol features of the different protocols.

[0033] The second identification module is configured to obtain field type identification results of each field inside each type of protocol through a trained deep learning parser based on the communication data flow of each type of protocol.

[0034] The deep learning parser comprises a long short-term memory network model, a Transformer model, a convolutional neural network model and a multi-layer perceptron. The long short-term memory network model is configured to extract time sequence features between protocol fields. The Transformer model is configured to extract global features between protocol fields. The convolutional neural network model is configured to extract local features between protocol fields. The multi-layer perceptron is configured to output field types of each field inside a protocol.

[0035] The application further provides an electronic device comprising a memory, a processor and a computer program stored in the memory and running on the processor. The processor implements the multi-protocol autonomous identification method based on an edge computing gateway when executing the computer program.

[0036] The application further provides a non-transitory computer readable storage medium having a computer program stored thereon. The computer program is executed by a processor to implement the multi-protocol autonomous identification method based on an edge computing gateway.

[0037] The application further provides a computer program product comprising a computer program. The computer program is executed by a processor to implement the multi-protocol autonomous identification method based on an edge computing gateway.

[0038] The application provides a multi-protocol autonomous identification method based on an edge computing gateway. BRIEF DESCRIPTION OF DRAWINGS

[0039] In order to more clearly illustrate the technical solutions in the application or the prior art, the drawings needed to be used in the embodiments or the prior art description will be briefly introduced. Obviously, the drawings in the following description are some embodiments of the application, and other drawings can be obtained by those skilled in the art without any creative effort on the basis of these drawings.

[0040] Figure 1 Fig. 1 is one of flow diagrams of a multi-protocol autonomous identification method based on an edge computing gateway provided by the application.

[0041] Figure 2 Fig. 2 is another of flow diagrams of a multi-protocol autonomous identification method based on an edge computing gateway provided by the application.

[0042] Figure 3 Fig. 3 is a structural diagram of a multi-protocol autonomous identification device based on an edge computing gateway provided by the application.

[0043] Figure 4 Fig. 4 is a structural diagram of an electronic device provided by the application. DETAILED DESCRIPTION

[0044] In the prior art, the multi-protocol identification access of the gateway device mainly has the following three methods: the first identification method compares through preset protocols, and the problems are poor scalability, manual update and configuration are required for each newly added protocol or device, insufficient flexibility, and limited system expansion capability; the second method is set through manual configuration, and the manual configuration process is tedious, especially in the case of a large number of devices or frequent replacement, which increases the deployment and maintenance cost of the system; the third method is a classification method through an artificial intelligence algorithm, and the disadvantages are that a large amount of data set is required, and the generalization ability is limited, the model performs well on the training data, but when facing unknown protocols or data distribution changes, the recognition accuracy may decrease significantly, and there is a lack of sufficient robustness.

[0045] Therefore, the existing method is difficult to dynamically adapt to changes in new protocols or protocol features, which limits the flexibility, scalability and compatibility of the system.

[0046] In view of the problems existing in the multi-protocol autonomous identification of the gateway, the present application provides a multi-protocol automatic analysis method based on the fusion of static features and dynamic features of protocol byte streams and combined with multiple deep learning models, relying on the support of the edge computing gateway hardware platform, improving the accuracy of protocol type identification and field level analysis, realizing multi-protocol automatic adaptation, rapid access and efficient analysis, and meeting the needs of multiple device access and communication in the intelligent gateway.

[0047] In order to make the purpose, technical scheme and advantages of the present application clearer, the technical scheme in the present application will be described clearly and completely in combination with the drawings in the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor belong to the scope of protection of the present application.

[0048] The technical scheme of the present application will be described below in combination with Figures 1 to 4 The present application provides a multi-protocol autonomous identification method and device based on an edge computing gateway.

[0049] Figure 1 is one of the flowcharts of the multi-protocol autonomous identification method based on the edge computing gateway provided by the present application, as Figure 1 shown, the method comprises the following steps:

[0050] Step 101, collect communication data streams of different protocols.

[0051] Specifically, in the embodiment of the present application, a CPU with high-performance computing capability is used as a gateway processor, the gateway communicates with access devices through different data protocols, collects communication data streams of different protocols, and stores them in the memory, and pre-processes the collected data, including denoising, frame segmentation, data standardization, etc., so as to be used for subsequent feature extraction.

[0052] In step 102, overall features of the byte stream and distribution features of the byte value are obtained based on the communication data streams of different protocols, and dynamic features of the communication data streams of different protocols are obtained based on the communication data streams of different protocols.

[0053] Specifically, in different communication protocols, the number of bytes in the byte stream, the arrangement of bytes, the position and length of specific fields, etc. are important bases for distinguishing protocol types.

[0054] In the embodiment of the present application, through analysis of the byte stream features in the protocol data, the overall features of the byte stream and the distribution features of the byte value are extracted by using a traditional mathematical model, that is, the basic structural characteristics in the protocol data frame are reflected by using mathematical modeling to vectorize the protocol data stream, and further statistics of the features in the byte stream are made to construct a byte stream feature matrix to describe the feature distribution of different protocols, so that the unique characteristics of the protocol can be captured. The extraction steps of the overall features of the byte stream and the distribution features of the byte value are as follows:

[0055] (1) Vectorization representation of byte features

[0056] The byte stream of the protocol is represented as a vector

[0057] wherein, represents the value of the i-th byte in the byte stream of the protocol, the value range of the byte is [0, 255], representing an 8-bit binary number; is the total length of the byte stream, representing the number of bytes in the protocol frame, the length is different for different protocols and different data frame types.

[0058] (2) Overall features of the byte stream and distribution features of the byte value

[0059] Overall features of the byte stream: the byte values in the byte stream are counted, and specific statistical quantities (such as mean, standard deviation, etc.) are extracted to represent the overall features of the byte stream. Let and represent the mean and standard deviation of the byte value respectively, then and The calculation expressions are as follows:

[0060] ​

[0061]

[0062] Distribution characteristics of byte values: Analyze the frequency distribution of each byte value in the byte stream and construct a frequency histogram. ,in Indicates that the byte value is frequency, The value range is [0, 255]. In this way, the unique byte value distribution characteristics of different protocols can be captured.

[0063] In this embodiment of the invention, based on communication data streams of different protocols, dynamic features of the communication data streams of different protocols are also extracted.

[0064] To capture the dynamic characteristics of communication data streams from different protocols, time-series modeling methods can be used to capture dynamic changes and contextual relationships between fields in the protocol byte stream. Alternatively, a combination of high-dimensional feature embedding and positional encoding can be employed to capture dynamic changes and contextual dependencies. Dynamic feature extraction methods include:

[0065] (1) Use an embedding layer to convert each field of the protocol into a high-dimensional dense vector. This is similar to word embedding representation in natural language processing. The embedding layer learns to represent different fields in the protocol as vectors, thereby capturing their semantic information.

[0066]

[0067] Byte values ​​representing the protocol The corresponding high-dimensional dense vector, The total length of the byte stream represents the number of bytes in the protocol frame. Each field in the protocol byte stream is input into the Long Short-Term Memory (LSTM) network model in the order of its appearance; the embedding vectors of these fields form a temporal input sequence. Furthermore, by outputting temporal features through a long short-term memory network model, these temporal features can be used as dynamic features of communication data streams of different protocols, thereby capturing dynamic changes in protocol byte streams and contextual relationships between fields.

[0068] (2) The global dependencies of protocol fields are modeled using the Transformer model. The attention mechanism in the Transformer model allows the representation of each field to interact with all other fields in the entire protocol, thereby capturing the global relationships and interdependencies between fields. Positional encoding is used to improve parsing capabilities. The field representation after multi-head attention processing... That is, global features. The expression is as follows:

[0069]

[0070] The context information in the whole protocol is contained, The byte value of the protocol The corresponding high-dimensional dense vector, The byte value of the protocol The corresponding high-dimensional dense vector. At this time, the position coding is added The position information of each byte vector in the protocol byte stream is added, so that the order dependency between bytes can be captured, and the position coding is added The global feature after the position coding can also be used as the dynamic feature of the communication data stream of different protocols, and the dynamic changes in the protocol byte stream and the context relationship between fields can be captured. At this time, the expression of the dynamic feature vector is as follows:

[0071]

[0072] The embodiment of the application obtains the overall feature of the byte stream and the distribution feature of the byte value based on the communication data stream of different protocols, provides a basic description of different protocols, and further proposes two methods to obtain the dynamic feature of the communication data stream of different protocols. The two methods respectively combine different deep learning models, and both can realize the extraction of the dynamic feature of the communication data stream of different protocols, capture the dynamic changes in the protocol byte stream and the context relationship between fields, achieve similar effects, so that the protocol analysis process is more comprehensive, accurate and efficient. The two methods can also make the edge computing gateway have stronger adaptability and flexibility when facing complex multi-protocol scenarios.

[0073] Step 103, based on the overall feature of the byte stream and the distribution feature of the byte value, obtaining the static feature of the communication data stream of the different protocols.

[0074] Specifically, the feature matrix is constructed, wherein represents the number of samples, represents the number of features of each byte stream sample. The communication data stream of each protocol corresponds to a row vector , containing byte length, overall feature of the byte stream (i.e. mean and standard deviation of byte value), and distribution feature of the byte value (i.e. frequency histogram) multiple features, then the expression of the static feature vector of the communication data stream of different protocols is as follows:

[0075]

[0076] The embodiment of the application can fully capture and describe the unique characteristics of different protocols by constructing a feature matrix to represent multiple features of byte length, overall features of byte flow (i.e., mean value and standard deviation of byte value) and distribution features of byte value (i.e., frequency histogram), thereby improving the accuracy of subsequent model in protocol type identification.

[0077] In step 104, the protocol features of the different protocols are obtained by feature fusion based on the static features and the dynamic features.

[0078] Specifically, the dynamic feature vector and the static feature vector are fused. The fusion mode can be vector splicing or weighted summation, and the fused features are protocol features . For example, in the case of the dynamic feature vector , the expression of the protocol feature may be:

[0079]

[0080] In this way, the static features and the dynamic features are combined. Since the static features provide basic description of the protocol, and the dynamic features represent the context relationship and dependency between fields, the fusion of the static and dynamic features enables the protocol features to contain both the basic statistical information of the protocol fields and the dynamic context information thereof.

[0081] The embodiment of the application obtains the protocol features by feature fusion, so that the subsequent model can perform in-depth semantic understanding on the field data in the communication data flow of different protocols, comprehensively acquire various information such as timing information, field information and protocol markers, and realize accurate type identification and field parsing.

[0082] In step 105, the protocol type identification results of each protocol are obtained by using multiple trained neural network models based on the protocol features of the different protocols. The neural network models are trained based on the communication data flow of multiple historical protocols.

[0083] Specifically, the protocol type identification is type identification according to the protocol features of the protocol data, classification of the entire protocol byte flow, and determination of the type of the protocol.

[0084] The embodiment of the application uses multiple trained neural network models for protocol type classification. Multiple models perform prediction according to the input feature vectors to obtain preliminary classification results of the protocol type. Then, the preliminary classification results of each model are fused by a weighted average method to generate the final protocol type identification result. The steps are as follows:

[0085] (1) input the fused feature vector (i.e. protocol feature) into a plurality of trained neural network models for protocol classification;

[0086] (2) each model independently predicts according to the input feature vector to obtain a preliminary classification result of the protocol type;

[0087] (3) the preliminary classification results of each model are fused by a weighted average method to obtain a weighted average value, which is used as the final protocol type recognition result.

[0088] In addition, the neural network model is trained based on a plurality of historical protocol communication data streams, and the specific training method includes:

[0089] Obtain device data accessed by an edge computing gateway (containing a plurality of historical protocol communication data streams, such as Modbus protocol data stream, MQTT protocol data stream, and HTTP protocol data stream, etc.), convert different types of protocol data streams into vector representation, extract static and dynamic features of the protocol, and obtain protocol features through feature fusion to form an original feature data set; then divide the original feature data set into a training set and a test set according to a ratio of 7:3 (other ratios can also be divided according to actual needs, such as 8:2 or 6:4, etc.), use the training set to train each model, and use the test set to test each model; finally, a trained protocol type recognition model based on protocol features is obtained, wherein the model can select a plurality of models such as random forest, support vector machine, and convolutional neural network model.

[0090] The embodiment of the application reduces the classification error caused by a single model through the integrated learning method, and improves the accuracy of protocol type recognition.

[0091] Step 106, based on the communication data stream of each type of protocol, the field type recognition result of each field in each type of protocol is obtained through a trained deep learning parser; the deep learning parser is trained based on a plurality of historical protocol communication data streams.

[0092] The deep learning parser includes a long short-term memory network model, a Transformer model, a convolutional neural network model, and a multi-layer perceptron; the long short-term memory network model is used to extract the time sequence features between the protocol fields; the Transformer model is used to extract the global features between the protocol fields; the convolutional neural network model is used to extract the local features between the protocol fields; and the multi-layer perceptron is used to output the field type of each field in the protocol.

[0093] Based on the above embodiment, after determining the protocol type, it is also necessary to parse each field inside the protocol to determine the specific role and meaning of the field (such as function code, data field, etc.) in order to understand the context relationship and capture the sequential dependence and global dependence between fields.

[0094] The embodiment of the application constructs and trains a deep learning semantic parser by integrating deep learning models, combining the characteristics of different models, to identify the field types of each field inside the protocol.

[0095] The deep learning parser includes a long short-term memory network model, a Transformer model, a convolutional neural network model, and a multi-layer perceptron; the long short-term memory network model is used to extract the timing features between protocol fields; the Transformer model is used to extract the global features between protocol fields; the convolutional neural network model is used to extract the local features between protocol fields; and the multi-layer perceptron is used to output the field types of each field inside the protocol.

[0096] The specific training method of the deep learning parser includes: dividing the above-mentioned original feature data set into a training set (70%) and a test set (30%), training the deep learning parser, and obtaining the trained deep learning parser.

[0097] After the deep learning parser is trained, the various trained neural network models and the trained deep learning parser are deployed in the edge computing gateway. The edge computing gateway is a low-latency and certain computing power device, and the models deployed in the gateway can perform real-time processing on the received protocol data, identify the protocol type through the deployed algorithm model, further parse and understand the semantics of the protocol field, and finally complete the classified storage of data.

[0098] The embodiment of the application integrates multiple deep learning models, so that the edge computing gateway can fully utilize static and dynamic features during protocol parsing, accurately identify the protocol type, effectively reduce the error rate of field type identification, improve the field parsing accuracy and generalization ability, accurately identify the field type, and thus can adapt to complex environments where multiple protocols coexist, and achieve efficient, accurate and robust protocol parsing and identification.

[0099] This invention provides a multi-protocol autonomous identification method based on an edge computing gateway. It collects communication data streams from different protocols and extracts their static and dynamic features. Protocol features are obtained through feature fusion. Then, based on these features, multiple trained neural network models are used to identify the protocol type. By fully considering both static and dynamic features, the method improves the model's semantic understanding and dynamic adaptability of fields in the communication data stream. By integrating the identification results of multiple trained neural network models, the accuracy of protocol type identification is improved. Finally, a trained deep learning parser is used to parse each field within the protocol to obtain field type identification results. This method enables efficient and accurate identification of protocol and field types by the edge computing gateway, improving the system's flexibility, scalability, and compatibility.

[0100] Optionally, obtaining the overall characteristics of the byte stream and the distribution characteristics of the byte values ​​based on the communication data streams of the different protocols includes:

[0101] Based on the communication data streams of the different protocols, the mean and standard deviation of all byte values ​​in the byte stream are calculated to obtain the overall characteristics of the byte stream. Furthermore, based on the communication data streams of the different protocols, the frequency of each byte value in the byte stream is calculated to obtain the distribution characteristics of the byte values.

[0102] Specifically, in different communication protocols, the number of bytes in the byte stream, the byte arrangement, and the position and length of specific fields are important criteria for distinguishing protocol types.

[0103] In this embodiment of the invention, by analyzing the byte stream features in the protocol data, the overall features of the byte stream and the distribution features of byte values ​​are extracted using traditional mathematical models. That is, mathematical modeling and other methods are used to vectorize the protocol data stream to reflect the basic structural characteristics of the protocol data frame. Furthermore, the characteristics of the byte stream are statistically analyzed to construct a byte stream feature matrix, describing the feature distribution of different protocols, thereby capturing the unique characteristics of the protocols. The steps for extracting the overall features of the byte stream and the distribution features of byte values ​​are as follows:

[0104] (1) Byte feature vectorization representation

[0105] Represent the protocol's byte stream as a vector

[0106] in, Indicates the first byte in the protocol byte stream The value of each byte is [0, 255], representing an 8-bit binary number; The total length of the byte stream, representing the number of bytes in the protocol frame, length. It varies depending on the protocol and the type of data frame.

[0107] (2) Overall characteristics of byte stream and distribution characteristics of byte value

[0108] Overall characteristics of byte stream: statistics of byte values in byte stream are performed, and specific statistical quantities (such as mean, standard deviation, etc.) are extracted to represent the overall characteristics of the byte stream. Let and respectively represent the mean and standard deviation of the byte value, then and The calculation expression is as follows:

[0109]

[0110]

[0111] Distribution characteristics of byte value: the frequency distribution of each byte value in the byte stream is analyzed, and a frequency histogram is constructed , where represents the frequency of the byte value , and The value range of is [0, 255]. In this way, the distribution characteristics of the byte value specific to different protocols are captured.

[0112] The embodiment of the application obtains the overall characteristics of the byte stream and the distribution characteristics of the byte value based on the communication data stream of different protocols, and basically describes different protocols, providing a basis for subsequent model protocol type recognition.

[0113] Optionally, the dynamic characteristics of the communication data stream of different protocols are obtained based on the communication data stream of different protocols, including:

[0114] Based on the communication data stream of different protocols, a high-dimensional dense vector corresponding to each field of each protocol is obtained;

[0115] The high-dimensional dense vector corresponding to each field of each protocol is input into a long short-term memory network model, and the time sequence characteristics output by the long short-term memory network model are obtained. The time sequence characteristics are used as the dynamic characteristics of the communication data stream of different protocols; or the high-dimensional dense vector corresponding to each field of each protocol is input into a Transformer model, and the global characteristics output by the Transformer model are obtained. The global characteristics are used as the dynamic characteristics of the communication data stream of different protocols.

[0116] Specifically, the dynamic characteristics of the communication data stream of different protocols can capture the dynamic changes in the protocol byte stream and the context relationship between fields through time series modeling method, or capture the dynamic changes and context dependency by combining high-dimensional feature embedding and position encoding.

[0117] In some embodiments, the dynamic feature extraction method can be:

[0118] Each field of the protocol is converted into a high-dimensional dense vector using an embedding layer , similar to the word embedding representation of words in natural language processing. The embedding layer can represent different fields in the protocol as vectors through learning, thereby capturing their semantic information.

[0119]

[0120] The byte value of the protocol The corresponding high-dimensional dense vector, is the total length of the byte stream, indicating the number of bytes in the protocol frame. Each field in the protocol byte stream is input into the long short-term memory network model in the order of its occurrence, and the embedding vectors of these fields form a time sequence input sequence , and then the long short-term memory network model outputs the time sequence feature. Using this time sequence feature as the dynamic feature of the communication data stream of different protocols, the dynamic changes in the protocol byte stream and the context relationship between fields can be captured.

[0121] In other embodiments, the dynamic feature extraction method can be:

[0122] The global dependency of the protocol fields is modeled by the Transformer model, and the attention mechanism in the Transformer model is used to let the representation of each field interact with all other fields in the entire protocol, thereby capturing the global relationship and mutual dependency between fields, and using position encoding to improve the parsing ability. The field representation after multi-head attention mechanism processing is the global feature, The expression is as follows:

[0123]

[0124] The context information in the entire protocol is included in The byte value of the protocol The corresponding high-dimensional dense vector, The byte value of the protocol The corresponding high-dimensional dense vector. At this time, by adding position encoding , the position information of each byte vector in the protocol byte stream is added, which can capture the sequential dependency between bytes. The global feature after adding position encoding can also be used as the dynamic feature of the communication data stream of different protocols, capturing the dynamic changes in the protocol byte stream and the context relationship between fields. At this time, the dynamic feature vector The expression of the global feature is:

[0125]

[0126] The embodiments of the present application propose two methods to obtain the dynamic characteristics of the communication data streams of different protocols based on the communication data streams of different protocols. The two methods combine different deep learning models, respectively, and can both achieve the extraction of the dynamic characteristics of the communication data streams of different protocols, capture the dynamic changes in the protocol byte stream and the context relationship between fields, achieve similar effects, so that the protocol analysis process is more comprehensive, accurate and efficient. The two methods can also enable the edge computing gateway to have stronger adaptability and flexibility when facing complex multi-protocol scenarios.

[0127] Optionally, in the case of using the global feature as the dynamic characteristic of the communication data stream of the different protocol, further comprising:

[0128] The position encoding is added to each byte vector in the global feature, and the global feature after adding the position encoding is used as the dynamic characteristic of the communication data stream of the different protocol. The position encoding is used to represent the position information of each byte vector in the byte stream.

[0129] Specifically, the global dependency of the protocol field is modeled by the Transformer model, the attention mechanism in the Transformer model is used to make the representation of each field interact with all other fields in the entire protocol, so as to capture the global relationship and mutual dependency between fields, and the position encoding is used to improve the parsing ability. The field representation after processing by the multi-head attention mechanism is the global feature, The expression of the global feature is as follows:

[0130]

[0131] The global feature contains the context information in the entire protocol, the byte value of the protocol corresponds to a high-dimensional dense vector, the byte value of the protocol corresponds to a high-dimensional dense vector.

[0132] In this case, the position encoding is added to the global feature to add the position information of each byte vector in the protocol byte stream, which can capture the order dependency between bytes. The global feature after adding the position encoding can also be used as the dynamic characteristic of the communication data stream of the different protocol, to capture the dynamic changes in the protocol byte stream and the context relationship between fields. At this time, the dynamic characteristic vector The expression is:

[0133]

[0134] This invention, based on communication data streams of different protocols, combines the Transformer model to model the global dependencies of protocol fields. By supplementing the positional encoding of the global features output by the Transformer model, it captures the dynamic changes in the protocol byte stream and the contextual relationships between fields, thereby making the protocol parsing process more comprehensive, accurate and efficient, and improving the adaptability and flexibility of edge computing gateways in the face of complex multi-protocol scenarios.

[0135] Optionally, the step of obtaining the protocol type identification result for each protocol based on the protocol features of the different protocols through multiple trained neural network models includes:

[0136] The protocol features of different protocols are input into multiple trained neural network models to obtain the protocol type classification results output by each trained neural network model.

[0137] Calculate the weighted average of the protocol type classification results output by all trained neural network models to obtain the protocol type identification result for each protocol.

[0138] Specifically, protocol type identification is to identify the type of protocol based on the protocol characteristics of the protocol data, classify the entire protocol byte stream, and determine the type of protocol.

[0139] In this embodiment of the invention, multiple trained neural network models are used to classify protocol types. Each model makes a prediction based on the input feature vector to obtain a preliminary classification result of the protocol type. Then, the preliminary classification results of each model are fused by a weighted average method to generate the final protocol type identification result.

[0140] In this embodiment of the invention, random forest, support vector machine, and convolutional neural network model are used as examples to classify the static and dynamic features of protocol data. Each model independently outputs the classification result of the protocol type, and the weights of random forest, support vector machine, and convolutional neural network model are set as follows: random forest (0.4), support vector machine (0.3), and convolutional neural network model (0.3). The weighted average method is used to calculate the protocol type identification result for each protocol according to the set weights.

[0141] In the embodiment of the present application, the experimental results show that, by using the protocol features obtained by fusing static features and dynamic features, and integrating various deep learning models, the accuracy of protocol type identification reaches 95.7%, which is 3.8% higher than the accuracy of using a single convolutional neural network model. It can be seen that, by using the integrated learning method, the classification error caused by a single model is reduced, and the accuracy of protocol type identification is improved.

[0142] Optionally, the communication data stream of each type of protocol is input into a long short-term memory network model, a Transformer model and a convolutional neural network model respectively to obtain time sequence features between protocol fields output by the long short-term memory network model, global features between protocol fields output by the Transformer model and local features between protocol fields output by the convolutional neural network model.

[0143] Optionally, the communication data stream of each type of protocol is input into a long short-term memory network model, a Transformer model and a convolutional neural network model respectively to obtain time sequence features between protocol fields output by the long short-term memory network model, global features between protocol fields output by the Transformer model and local features between protocol fields output by the convolutional neural network model.

[0144] Based on the time sequence features, the global features and the local features, the Stacking method is used for integration to obtain field features of each field in each type of protocol.

[0145] The field features of each field in each type of protocol are input into a multilayer perceptron to obtain field type identification results of each field in each type of protocol output by the multilayer perceptron.

[0146] Specifically, after determining the protocol type, it is also necessary to parse each field in the protocol to determine the specific role and meaning (such as function code, data field, etc.) of the field, so as to understand the context relationship and capture the order dependence and global dependence between fields.

[0147] The embodiment of the present application integrates deep learning models, combines the characteristics of different models, constructs and trains a deep learning semantic parser to identify the field types of each field in the protocol.

[0148] The communication data stream of each type of protocol is input into the trained deep learning parser, the time sequence features between the protocol fields are extracted through the long short-term memory network model, the global features between the protocol fields are extracted through the Transformer model, the local features between the protocol fields are extracted through the convolutional neural network model, the outputs of the long short-term memory network model, the Transformer model and the convolutional neural network model are stacked and integrated by using the Stacking method, and the stacked and integrated outputs are used as the input features of the multilayer perceptron, the final prediction and semantic understanding of the field type are performed by the multilayer perceptron, and the field type recognition results of the fields in the protocol are output. Experimental results show that the accuracy of field-level parsing (i.e., field type recognition) reaches 93.4%.

[0149] The embodiment of the application builds a deep learning parser by integrating multiple models, then uses the trained deep learning parser to parse each field in the protocol and obtain the field type recognition result, and stacks and integrates the time sequence features, global features and local features by using the Stacking method, so as to fully mine the feature information of each field in the protocol and effectively reduce the error rate of the model for field type recognition, thereby realizing efficient and accurate identification of the protocol type and the field type by the edge computing gateway and improving the flexibility, expansibility and compatibility of the system.

[0150] In some embodiments, after the trained model is deployed into the edge computing gateway, the model can also be updated through online learning. Figure 2 is a flowchart of a multi-protocol autonomous identification method based on an edge computing gateway provided by the application, as shown in Figure 2 .

[0151] First, data collection is performed to build a data set, wherein the protocol data received or collected by the edge computing gateway includes TCP protocol data, Modbus protocol data, MQTT protocol data, HTTP protocol data, LoRaWAN protocol data, OPCUA protocol data, CoAP protocol data and non-standard protocol data, etc.

[0152] Then, protocol features are extracted, the protocol type is identified according to the protocol features, and each field in the protocol is further identified to determine the specific function and meaning of the field (such as function code, data field, etc.), and then the corresponding decision application can be obtained.

[0153] Finally, the incremental learning method is used for online learning through the various types of protocol data received by the edge computing gateway in real time, the model is continuously trained and adjusted according to the feature feedback provided by the real-time data, the dynamic update and parameter optimization of the model are realized, the model can adapt to the dynamic changes of the protocol features, and thus the accuracy and stability of the protocol type identification and field identification are improved.

[0154] Based on the above-mentioned embodiments, the multi-protocol autonomous identification method based on the edge computing gateway provided by the embodiments of the present application can efficiently and accurately analyze various protocols, adapt to complex feature changes in a multi-protocol environment, so that the edge computing gateway does not need to be manually configured, realizes intelligent access management in a plug-and-play multi-protocol communication environment, and improves the flexibility, expansibility and compatibility of the system.

[0155] Next, a multi-protocol autonomous identification device based on an edge computing gateway provided by the present application will be described. The multi-protocol autonomous identification device based on an edge computing gateway described below can be mutually referred to the multi-protocol autonomous identification method based on an edge computing gateway described above.

[0156] Based on any of the above-mentioned embodiments, Figure 3 is a structural schematic diagram of a multi-protocol autonomous identification device based on an edge computing gateway provided by the present application, as Figure 3 shown. The embodiments of the present application provide a multi-protocol autonomous identification device based on an edge computing gateway, which comprises a collection module 301, a first feature module 302, a second feature module 303, a third feature module 304, a first identification module 305 and a second identification module 306, wherein:

[0157] The collection module 301 is used for collecting communication data streams of different protocols;The first feature module 302 is used for obtaining the overall feature of the byte stream and the distribution feature of the byte value based on the communication data streams of different protocols, and obtaining the dynamic feature of the communication data streams of different protocols based on the communication data streams of different protocols;The second feature module 303 is used for obtaining the static feature of the communication data streams of different protocols based on the overall feature of the byte stream and the distribution feature of the byte value;The third feature module 304 is used for obtaining the protocol feature of different protocols by feature fusion based on the static feature and the dynamic feature;The first identification module 305 is used for obtaining the protocol type identification result of each protocol by a plurality of trained neural network models based on the protocol feature of different protocols;The neural network model is trained based on the communication data streams of a plurality of historical protocols;The second identification module 306 is used for obtaining the field type identification result of each field in each type protocol by a trained deep learning parser based on the communication data streams of each type protocol;The deep learning parser is trained based on the communication data streams of a plurality of historical protocols;The deep learning parser includes a long short-term memory network model, a Transformer model, a convolutional neural network model and a multilayer perception;The long short-term memory network model is used for extracting the time sequence feature between protocol fields;The Transformer model is used for extracting the global feature between protocol fields;The convolutional neural network model is used for extracting the local feature between protocol fields;The multilayer perception is used for outputting the field type of each field in the protocol.

[0158] The application provides a multi-protocol autonomous identification device based on an edge computing gateway, which collects communication data streams of different protocols, extracts static features and dynamic features of the communication data streams of different protocols, obtains protocol features through feature fusion, identifies protocol types through a plurality of trained neural network models based on the protocol features, fully considers the static features and the dynamic features, improves semantic understanding and dynamic adaptability of the model to fields in the communication data streams, improves the accuracy of the protocol type identification result by comprehensively considering the identification results of a plurality of trained neural network models, and analyzes each field in the protocol through a trained deep learning parser to obtain a field type identification result, so that efficient and accurate identification of protocol types and field types by the edge computing gateway is realized, and flexibility, expansibility and compatibility of the system are improved.

[0159] Figure 4 An example of an entity structure diagram of an electronic device is shown in Figure 4As shown, the electronic device can include a processor 410, a communications interface 420, a memory 430, and a communications bus 440, wherein the processor 410, the communications interface 420, and the memory 430 complete mutual communication through the communications bus 440. The processor 410 can invoke a logic instruction in the memory 430 to execute an edge computing gateway-based multi-protocol autonomous identification method, which includes:

[0160] Collecting communication data streams of different protocols;

[0161] Based on the communication data streams of different protocols, obtaining the overall characteristics of the byte stream and the distribution characteristics of the byte value, and based on the communication data streams of different protocols, obtaining the dynamic characteristics of the communication data streams of different protocols;

[0162] Based on the overall characteristics of the byte stream and the distribution characteristics of the byte value, obtaining the static characteristics of the communication data streams of different protocols;

[0163] Based on the static characteristics and the dynamic characteristics, the protocol characteristics of the different protocols are obtained through feature fusion;

[0164] Based on the protocol characteristics of the different protocols, the protocol type identification result of each protocol is obtained through a plurality of trained neural network models; the neural network model is trained based on the communication data streams of a plurality of historical protocols;

[0165] Based on the communication data streams of each type of protocol, the field type identification result of each field inside each type of protocol is obtained through a trained deep learning parser; the deep learning parser is trained based on the communication data streams of a plurality of historical protocols;

[0166] The deep learning parser includes a long short-term memory network model, a Transformer model, a convolutional neural network model, and a multi-layer perceptron; the long short-term memory network model is used to extract the time sequence characteristics between protocol fields; the Transformer model is used to extract the global characteristics between protocol fields; the convolutional neural network model is used to extract the local characteristics between protocol fields; and the multi-layer perceptron is used to output the field type of each field inside the protocol.

[0167] Moreover, the logic instructions in the memory 430 described above can be implemented in the form of software functional units and sold or used as independent products, and can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present application essentially or the parts that contribute to the prior art or parts of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, and includes several instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various media that can store program codes.

[0168] In another aspect, the present application also provides a computer program product, which comprises a computer program, the computer program can be stored on a non-transitory computer readable storage medium, and the computer program can be executed by a processor to enable a computer to execute the multi-protocol autonomous identification method based on an edge computing gateway provided by the above-mentioned method, the method comprises:

[0169] Collecting communication data streams of different protocols;

[0170] Based on the communication data streams of different protocols, obtaining the overall characteristics of the byte stream and the distribution characteristics of the byte value, and based on the communication data streams of different protocols, obtaining the dynamic characteristics of the communication data streams of different protocols;

[0171] Based on the overall characteristics of the byte stream and the distribution characteristics of the byte value, obtaining the static characteristics of the communication data streams of different protocols;

[0172] Based on the static characteristics and the dynamic characteristics, obtaining the protocol characteristics of the different protocols through feature fusion;

[0173] Based on the protocol characteristics of the different protocols, obtaining the protocol type identification result of each protocol through a plurality of trained neural network models; the neural network model is trained based on the communication data streams of a plurality of historical protocols;

[0174] Based on the communication data streams of each type of protocol, obtaining the field type identification result of each field inside each type of protocol through a trained deep learning parser; the deep learning parser is trained based on the communication data streams of a plurality of historical protocols;

[0175] The deep learning parser comprises a long short-term memory network model, a Transformer model, a convolutional neural network model, and a multilayer perceptron; the long short-term memory network model is used to extract timing features between protocol fields; the Transformer model is used to extract global features between protocol fields; the convolutional neural network model is used to extract local features between protocol fields; and the multilayer perceptron is used to output field types of respective fields inside a protocol.

[0176] In another aspect, the present application also provides a non-transitory computer-readable storage medium having stored thereon a computer program, which, when executed by a processor, implements the method for multi-protocol autonomous identification based on an edge computing gateway provided by the above method, and the method comprises:

[0177] Collecting communication data streams of different protocols;

[0178] Based on the communication data streams of different protocols, obtaining overall features of byte streams and distribution features of byte values, and based on the communication data streams of different protocols, obtaining dynamic features of the communication data streams of different protocols;

[0179] Based on the overall features of byte streams and the distribution features of byte values, obtaining static features of the communication data streams of different protocols;

[0180] Based on the static features and the dynamic features, obtaining protocol features of different protocols through feature fusion;

[0181] Based on the protocol features of different protocols, obtaining protocol type identification results of each protocol through a plurality of trained neural network models; the neural network models are trained based on communication data streams of a plurality of historical protocols;

[0182] Based on the communication data streams of each type of protocol, obtaining field type identification results of respective fields inside each type of protocol through a trained deep learning parser; the deep learning parser is trained based on communication data streams of a plurality of historical protocols;

[0183] The deep learning parser comprises a long short-term memory network model, a Transformer model, a convolutional neural network model, and a multilayer perceptron; the long short-term memory network model is used to extract timing features between protocol fields; the Transformer model is used to extract global features between protocol fields; the convolutional neural network model is used to extract local features between protocol fields; and the multilayer perceptron is used to output field types of respective fields inside a protocol.

[0184] The device embodiments described above are merely illustrative, wherein the units described as separate components can or can not be physically separate, and the components shown as units can or can not be physical units, i.e., can be located in one place, or can be distributed on multiple network units. Part or all of the modules can be selected to achieve the purposes of the embodiments according to actual needs. Those skilled in the art can understand and implement without creative labor.

[0185] Through the description of the above embodiments, those skilled in the art can clearly understand that the embodiments can be realized by means of software and necessary universal hardware platforms, and of course can also be realized by hardware. Based on such understanding, the above technical solutions can be embodied in the form of a software product, which can be stored in a computer readable storage medium, such as a ROM / RAM, a magnetic disk, an optical disk, etc., and includes a plurality of instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute the methods described in the embodiments or some parts of the embodiments.

[0186] It should be noted that in this document, the terms "comprise", "comprising", or any other variant thereof are intended to cover non-exclusive inclusion, so that processes, methods, articles, or devices that include a series of elements not only include those elements, but also include other elements not explicitly listed, or other elements inherent to such processes, methods, articles, or devices. Without more limitations, the element defined by the statement "comprising a" does not exclude the presence of additional identical elements in the process, method, article, or device that includes the element. In addition, it should be pointed out that the scope of the methods and devices in the embodiments of the present application is not limited to the order of performing the functions as shown or discussed, but can also include performing the functions in a substantially simultaneous manner or in reverse order, for example, the described method can be performed in an order different from the described order, and various steps can also be added, omitted, or combined. In addition, the features described with reference to certain examples can be combined in other examples.

[0187] In addition, it should be noted that the terms "first", "second", etc. in the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the terms used in this way can be interchanged under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than that illustrated or described here, and the objects distinguished by "first", "second" are usually a class, and are not limited to the number of objects, for example, the first object can be one or more.

[0188] The "determining B based on A" in the embodiments of the present application means that A is considered as a factor when determining B. It is not limited to "determining B based on A only", but also includes "determining B based on A and C", "determining B based on A, C and E", "determining C based on A, and determining B based on C further", and the like. In addition, it can also include taking A as a condition for determining B, for example, "when A meets the first condition, determining B using the first method"; for example, "when A meets the second condition, determining B"; for example, "when A meets the third condition, determining B based on the first parameter"; and the like. Of course, it can also be that A is taken as a condition for determining B, for example, "when A meets the first condition, determining C using the first method, and determining B further based on C"; and the like.

[0189] The term "plurality" in the present application refers to two or more, and other quantifiers are similar.

[0190] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, and not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that: it can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement for part of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

[0191] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, and not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that: it can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement for part of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A multi-protocol autonomous identification method based on an edge computing gateway, characterized in that, include: Collect communication data streams using different protocols; Based on the communication data streams of the different protocols, the overall characteristics of the byte stream and the distribution characteristics of the byte values ​​are obtained, and the dynamic characteristics of the communication data streams of the different protocols are obtained. Based on the overall characteristics of the byte stream and the distribution characteristics of the byte values, the static characteristics of the communication data streams of the different protocols are obtained; Based on the static and dynamic features, the protocol features of the different protocols are obtained through feature fusion. Based on the protocol characteristics of the different protocols, the protocol type identification result of each protocol is obtained through multiple trained neural network models; the neural network models are trained based on the communication data streams of multiple historical protocols. Based on the communication data stream of each protocol type, a trained deep learning parser is used to obtain the field type identification results of each field within each protocol type; the deep learning parser is trained based on the communication data streams of multiple historical protocols. The deep learning parser includes a Long Short-Term Memory (LSTM) network model, a Transformer model, a Convolutional Neural Network (CNN) model, and a Multilayer Perceptron (MLP). The LSM model is used to extract temporal features between protocol fields; the Transformer model is used to extract global features between protocol fields; the CNN model is used to extract local features between protocol fields; and the MLP is used to output the field type of each field within the protocol. Based on the protocol features of the different protocols, the protocol type identification result for each protocol is obtained through multiple trained neural network models, including: The protocol features of different protocols are input into multiple trained neural network models to obtain the protocol type classification results output by each trained neural network model. Calculate the weighted average of the protocol type classification results output by all trained neural network models to obtain the protocol type identification result for each protocol; The communication data stream based on each protocol type, through a trained deep learning parser, obtains the field type identification results for each field within each protocol type, including: The communication data streams of each type of protocol are input into a Long Short-Term Memory Network model, a Transformer model, and a Convolutional Neural Network model, respectively, to obtain the temporal features between protocol fields output by the Long Short-Term Memory Network model, the global features between protocol fields output by the Transformer model, and the local features between protocol fields output by the Convolutional Neural Network model. By integrating the temporal features, global features, and local features using the Stacking method, the field features of each field within each type of protocol are obtained. The field features of each field within each type of protocol are input into a multilayer perceptron to obtain the field type identification results of each field within each type of protocol output by the multilayer perceptron.

2. The multi-protocol autonomous identification method based on an edge computing gateway according to claim 1, characterized in that, The communication data streams based on the different protocols obtain the overall characteristics of the byte stream and the distribution characteristics of the byte values, including: Based on the communication data streams of the different protocols, the mean and standard deviation of all byte values ​​in the byte stream are calculated to obtain the overall characteristics of the byte stream. Furthermore, based on the communication data streams of the different protocols, the frequency of each byte value in the byte stream is calculated to obtain the distribution characteristics of the byte values.

3. The multi-protocol autonomous identification method based on an edge computing gateway according to claim 1, characterized in that, The method for obtaining the dynamic characteristics of the communication data streams based on the different protocols includes: Based on the communication data streams of the different protocols, a high-dimensional dense vector corresponding to each field of each protocol is obtained; The high-dimensional dense vector corresponding to each field of each protocol is input into a Long Short-Term Memory (LSTM) network model to obtain the temporal features output by the LSM network model, and the temporal features are used as the dynamic features of the communication data streams of the different protocols; or, the high-dimensional dense vector corresponding to each field of each protocol is input into a Transformer model to obtain the global features output by the Transformer model, and the global features are used as the dynamic features of the communication data streams of the different protocols.

4. The multi-protocol autonomous identification method based on an edge computing gateway according to claim 3, characterized in that, In the case where the global feature is used as the dynamic feature of the communication data stream of the different protocols, the method further includes: A positional encoding is added to each byte vector in the global feature, and the global feature with the added positional encoding is used as the dynamic feature of the communication data stream of the different protocols; the positional encoding is used to represent the position information of each byte vector in the byte stream.

5. A multi-protocol autonomous identification device based on an edge computing gateway, characterized in that, include: The acquisition module is used to acquire communication data streams using different protocols; The first feature module is used to obtain the overall features of the byte stream and the distribution features of the byte values ​​based on the communication data streams of the different protocols, and to obtain the dynamic features of the communication data streams of the different protocols based on the communication data streams of the different protocols. The second feature module is used to obtain the static features of the communication data streams of the different protocols based on the overall features of the byte stream and the distribution features of the byte values. The third feature module is used to obtain the protocol features of the different protocols by feature fusion based on the static features and the dynamic features; The first identification module is used to obtain the protocol type identification result of each protocol based on the protocol characteristics of the different protocols through multiple trained neural network models; the neural network models are trained based on the communication data streams of multiple historical protocols. The second identification module is used to obtain the field type identification results of each field within each type of protocol based on the communication data stream of each type of protocol through a trained deep learning parser; the deep learning parser is trained based on the communication data streams of multiple historical protocols. The deep learning parser includes a Long Short-Term Memory (LSTM) network model, a Transformer model, a Convolutional Neural Network (CNN) model, and a Multilayer Perceptron (MLP). The LSM model is used to extract temporal features between protocol fields; the Transformer model is used to extract global features between protocol fields; the CNN model is used to extract local features between protocol fields; and the MLP is used to output the field type of each field within the protocol. Based on the protocol features of the different protocols, the protocol type identification result for each protocol is obtained through multiple trained neural network models, including: The protocol features of different protocols are input into multiple trained neural network models to obtain the protocol type classification results output by each trained neural network model. Calculate the weighted average of the protocol type classification results output by all trained neural network models to obtain the protocol type identification result for each protocol; The communication data stream based on each protocol type, through a trained deep learning parser, obtains the field type identification results for each field within each protocol type, including: The communication data streams of each type of protocol are input into a Long Short-Term Memory Network model, a Transformer model, and a Convolutional Neural Network model, respectively, to obtain the temporal features between protocol fields output by the Long Short-Term Memory Network model, the global features between protocol fields output by the Transformer model, and the local features between protocol fields output by the Convolutional Neural Network model. By integrating the temporal features, global features, and local features using the Stacking method, the field features of each field within each type of protocol are obtained. The field features of each field within each type of protocol are input into a multilayer perceptron to obtain the field type identification results of each field within each type of protocol output by the multilayer perceptron.

6. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the processor executes the computer program, it implements the multi-protocol autonomous identification method based on an edge computing gateway as described in any one of claims 1 to 4.

7. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the multi-protocol autonomous identification method based on the edge computing gateway as described in any one of claims 1 to 4.

8. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the multi-protocol autonomous identification method based on the edge computing gateway as described in any one of claims 1 to 4.

Images