An auditing method and system for actively learning parsing rules of a custom protocol

Abstract

The present invention discloses an auditing method and system for actively learning parsing rules of a custom protocol, relating to the field of custom protocols. Specifically disclosed are: collecting packets of the custom protocol from network traffic; using deep learning algorithms and pattern matching techniques to identify the packet structure of the packets and the first occurrence positions of multiple key fields; obtaining preset encryption rules for each key field for encryption; sequentially splicing the encrypted key fields according to the first occurrence positions, marking the field numbers and field types to obtain a parsing key, and forming a preliminary parsing rule set of the parsing key; decrypting the packets of the custom protocol based on the parsing key and conducting threat review. The present invention improves the accuracy and automation degree of custom protocol parsing, provides an automatic parsing mechanism, and enhances the efficiency and detection ability of protocol auditing.

Description

Technical Field

[0001] The present invention relates to the field of custom protocols, and more particularly to an auditing method and system for actively learning parsing rules of custom protocols. Background Art

[0002] With the rapid development of Internet technology, communication methods are becoming increasingly complex, and various custom protocols are widely used, including some well-known application layer protocols such as TFTP, FTP, SIP, etc., as well as some private protocols defined by enterprises themselves. Existing security protection systems usually need to parse the custom protocols in the network to detect and defend against malicious traffic. To ensure that data is not tampered with or stolen during transmission, many communication protocols adopt encryption protection. Most of the existing custom protocol parsing methods are manual, which cannot keep up with the development of communication protocols, are time-consuming and laborious, and it is difficult to achieve real-time performance for massive data, prone to errors, and have high maintenance costs. After a new communication protocol is designed, it is usually first used for internal network communication and gradually promoted to external network use after it stabilizes. During this internal network stage, attackers often launch attacks against custom protocols, such as forging and tampering with protocol field contents to evade detection. Therefore, it is necessary to parse and audit custom protocols at this stage to discover malicious behaviors. Existing custom protocol parsing methods often adopt the following methods: 1. Completely parse the custom protocol, and then discover abnormal behaviors by analyzing the parsing results; 2. Manually define parsing rules according to the format of the custom protocol, and then discover abnormal behaviors according to the parsing rules; 3. Use machine learning algorithms to partially parse the custom protocol, and discover abnormal behaviors according to the parsing results and abnormal features; 4. Parsing methods based on association rule mining extract features by discovering the association relationships between data to identify malicious behaviors. The above solutions in the existing technologies have the following deficiencies: 1. The first solution is usually based on parsing methods of clustering and classification: These methods perform anomaly detection by dividing traffic data into different clusters, or classify traffic data into normal and abnormal categories. This method has a large amount of calculation, resulting in low detection efficiency; moreover, for complex and variable data traffic, especially in the case of polymorphic attacks, the robustness and accuracy of these methods are relatively low. 2. The second solution lacks flexibility and can only detect traffic that conforms to the parsing rules; 3. The third solution filters out malicious traffic by identifying these features; however, due to the lack of dynamics, this method is easily bypassed or overcome by adaptive attacks. For example, attackers can simply rearrange the protocol fields or modify the header length to avoid detection. And using machine learning algorithms requires a large amount of labeled training data. 4. Although the method based on association rule mining in the fourth solution can effectively reveal data features, when facing newly emerged protocols or mutated forms, it is necessary to continuously update and improve the association rule library, and these construction and maintenance works will bring additional overhead.

[0003] In the prior art, to solve the problem of parsing non-standard, unregulated, and unstable communication protocols, the key method is to use regular expressions to pre-analyze data packets to determine the key elements in the data packets, then construct a parsing template based on the relationship between the key elements and the content of the data packets, and finally match the parsing template with the content of the data packets to obtain the parsing result. The disadvantages of the above prior art are as follows: relying on data packet content matching for custom protocol parsing, still relying on manual participation in the analysis and parsing rules of key elements, requiring a large amount of manpower and time to study new protocols, and lacking sufficient popularity and ecological support. In view of this, the present invention provides an audit method and system for actively learning parsing rules of custom protocols that can automatically generate parsing rules based on deep learning. Summary of the Invention

[0004] The technical problem to be solved by the present invention is that the prior art cannot dynamically meet different custom protocols, relies on manual formulation of protocol parsing rules, and has low detection efficiency for custom protocols. The purpose is to provide an audit method and system for actively learning parsing rules of custom protocols, which improves the accuracy and automation of protocol parsing, provides an automatic parsing mechanism, improves the efficiency and detection ability of custom protocol auditing, and solves the above technical problems.

[0005] The present invention is realized through the following technical solutions:

[0006] An audit method for actively learning parsing rules of custom protocols includes:

[0007] Collect data packets of custom protocols from network traffic and remove noise data;

[0008] Use deep learning algorithms and pattern matching techniques to identify the data packet structure of the data packets and the first occurrence positions of multiple keyword fields;

[0009] Obtain the preset encryption rules for each of the above keyword fields, encrypt each of the above keyword fields; splice the encrypted keyword fields in sequence according to the above first occurrence positions, mark the field numbers and field types of each of the above keyword fields to obtain a parsing key, and form a preliminary parsing rule set for the above parsing key;

[0010] Decrypt the data packets of the custom protocol based on the above parsing key; conduct threat review on the data packets of the custom protocol.

[0011] The above collection of data packets of custom protocols from network traffic includes: receiving data packets containing port information, and using service port configuration items to generate a service acceleration table, which is stored in the form of a nested binary tree; through the above service acceleration table, identify the data packets of custom protocols that match the above port information.

[0012] Using the above deep learning algorithm and pattern matching technology to identify the packet structure of the data packet and the first occurrence positions of multiple key fields, including:

[0013] Identifying the packet structure of the data packet and the first occurrence positions of multiple key fields through the matching algorithm of regular expressions;

[0014] Obtaining the above packet structure of the data packet of the custom protocol and the above multiple key fields through the protocol feature model constructed by the deep learning algorithm.

[0015] The above decrypting the data packet of the custom protocol based on the above parsing key, including:

[0016] Searching the above preliminary parsing rule set according to the above field numbers and the above field types corresponding to each key field at the above first occurrence position to obtain the above parsing key, and decrypting the data packet of the custom protocol by using the above parsing key;

[0017] The above decrypting the data packet of the custom protocol based on the above parsing key further includes:

[0018] Establishing a search index of the above preliminary parsing rule set for the above parsing key that decrypts successfully to form a custom protocol search index table; when multiple parsing keys are found, decrypting sequentially by using each of the above parsing keys, and adding the above search index of the above parsing key that decrypts successfully to the above custom protocol search index table; when searching the above preliminary parsing rule set, searching according to the above search index of the above custom protocol.

[0019] The above decrypting the data packet of the custom protocol based on the above parsing key further includes:

[0020] When the above parsing key found cannot decrypt the data packet, obtaining the above preset encryption rules specified by each of the above key fields, encrypting each of the above key fields; sequentially splicing the encrypted each of the above key fields according to the above first occurrence position, marking the field numbers and field types of each of the above key fields, generating a temporary key; decrypting the data packet of the custom protocol based on the above temporary key.

[0021] The above performing threat review on the data packet of the custom protocol, including:

[0022] When the above parsing key cannot be found, intercepting the data packet and adding the IP address of the data packet sending port to the blacklist.

[0023] An audit system for actively learning parsing rules of a custom protocol, including:

[0024] An active learning module and a Suricata parsing module; the above-mentioned active learning module includes a traffic collection module, a feature extraction module, and a preliminary parsing rule generation module:

[0025] The above-mentioned traffic collection module collects data packets of a custom protocol from network traffic and removes noise data;

[0026] The above-mentioned feature extraction module uses deep learning algorithms and pattern matching techniques to identify the data packet structure of the data packet and the first occurrence positions of multiple key fields;

[0027] The above-mentioned preliminary parsing rule generation module obtains the preset encryption rules for each of the above-mentioned key fields, encrypts each of the above-mentioned key fields; sequentially splices the encrypted above-mentioned key fields according to the above-mentioned first occurrence positions, marks the field numbers and field types of each of the above-mentioned key fields to obtain a parsing key, and forms a preliminary parsing rule set for the above-mentioned parsing key;

[0028] The above-mentioned Suricata parsing module decrypts the data packets of the above-mentioned custom protocol based on the above-mentioned parsing key; performs threat review on the data packets of the above-mentioned custom protocol.

[0029] The above-mentioned system further includes a manual rule selection module; the above-mentioned manual rule selection module includes:

[0030] A rule viewing module for the user to view the rule set generated by active learning;

[0031] A rule editing and optimization module that allows the user to edit the above-mentioned parsing rules generated;

[0032] A multi-version rule management module for the user to save and switch different versions of the above-mentioned parsing rules.

[0033] An electronic device includes a memory, a processor, and a computer program running on the above-mentioned processor. When the above-mentioned processor executes the above-mentioned computer program, it implements the steps of any one of the above-mentioned auditing methods for active learning parsing rules of a custom protocol.

[0034] A computer-readable storage medium stores a computer program. When the above-mentioned computer program is executed by a processor, it implements the steps of any one of the above-mentioned auditing methods for active learning parsing rules of a custom protocol.

[0035] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0036] The present invention provides an auditing method for actively learning parsing rules of a custom protocol, which collects data packets of the custom protocol from network traffic and removes noise data; uses deep learning algorithms and pattern matching techniques to identify the data packet structure of the data packets and the first occurrence positions of multiple key fields, so as to obtain the structural and content features of the data packets; encrypts the key fields according to the preset encryption rules of each key field, sequentially splices the encrypted key fields according to the first occurrence positions, and marks the field numbers and field types of each key field to obtain a parsing key, and forms a preliminary parsing rule set of the parsing key; and realizes traffic parsing and threat review of the custom protocol based on the parsing rules. The present invention automatically extracts the traffic characteristics of the custom protocol, generates parsing rules for further traffic parsing and threat detection, improves the accuracy and automation of protocol parsing, provides an automatic parsing mechanism, and enhances the efficiency and detection ability of the protocol auditing system. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the technical solutions of the exemplary embodiments of the present invention, the following will briefly introduce the drawings required in the embodiments. It should be understood that the following drawings only show some embodiments of the present invention, and therefore should not be regarded as limiting the scope. For those of ordinary skill in the art, without creative efforts, other related drawings can also be obtained based on these drawings. In the drawings:

[0038] Figure 1 It is a flowchart of the auditing method for actively learning parsing rules of a custom protocol according to an embodiment of the present application. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0039] To make the purpose, technical solutions and advantages of the present invention clearer and more understandable, the present invention will be further described in detail below with reference to the embodiments and the drawings. The illustrative embodiments of the present invention and their descriptions are only used to explain the present invention and are not intended to limit the present invention.

[0040] Embodiment

[0041] As Figure 1 shown, the present invention will be further described below with reference to the drawings. An embodiment of the application provides an auditing method for actively learning parsing rules of a custom protocol, including:

[0042] Collect data packets of the custom protocol from network traffic and remove noise data;

[0043] Use deep learning algorithms and pattern matching techniques to identify the data packet structure of the data packets and the first occurrence positions of multiple key fields;

[0044] Obtain the preset encryption rules for each of the above keyword fields, and encrypt each of the above keyword fields; concatenate the encrypted keyword fields in sequence according to the above first occurrence positions, mark the field numbers and field types of each of the above keyword fields to obtain a parsing key, and form a preliminary parsing rule set for the above parsing key;

[0045] Decrypt the data packet of the above custom protocol based on the above parsing key; conduct a threat review on the data packet of the above custom protocol.

[0046] The data packet of the custom protocol usually consists of the following several data components: Frame header: Used to identify the start of the data packet, usually containing a special byte sequence to facilitate locating the starting position of the data packet in the data stream. Address information: Includes the source address and the destination address, used to identify the sender and receiver of the data. In a one-to-many communication system, it may only contain the destination address information; while in a many-to-many communication system, it contains both the source address and the destination address. Data type: Used to identify the type of data carried in the data packet, such as text, image, audio, etc. Data length: Indicates the number of bytes of the valid data, helping the receiving end to correctly parse the data packet. Data block: The actual data content, located after the data type and the data length. Checksum: Used to verify the integrity and correctness of the data. Common checksums include parity check, cyclic redundancy check (CRC), etc. Frame tail: Used to identify the end of the data packet. Similar to the frame header, the frame tail also contains a special byte sequence to facilitate locating the end position of the data packet in the data stream.

[0047] Identify the content of one or more of the above data components to obtain preset specific keyword fields, record the first occurrence positions of the keyword fields. Encrypt each keyword field, sort the encrypted keyword fields according to the first occurrence positions, and mark the field numbers and corresponding field types of each keyword field to generate a parsing key. Among them, the field types include numerical type, string type, date and time type, etc., and the parsing key can be represented in the form of an S-box. Optionally, specify the commonly used keyword fields and the corresponding field numbers according to the user's habits, and can be flexibly adjusted according to different periods to facilitate regular updating of the encryption key.

[0048] Optionally, the preset encryption rules for each key field can be all password rules except for the empty password, which are set separately for each key field. The preset encryption rules for each key field can be set randomly, and the same preset encryption rule can be selected for different key fields. The preset encryption rules can be conventional encryption algorithms applicable to the field type selected by those skilled in the art. Specific examples are as follows: 3DES (Triple DES): A symmetric algorithm based on DES that encrypts a block of data three times with three different keys, providing higher strength. RC2 and RC4: Symmetric algorithms that encrypt large amounts of data with variable-length keys and are faster than DES. IDEA (International Data Encryption Algorithm): An international data encryption algorithm that provides very strong security using a 128-bit key. RSA: A public-key algorithm that supports variable-length keys, and the length of the file block to be encrypted is also variable. It is an asymmetric algorithm. AES (Advanced Encryption Standard): The advanced encryption standard, a symmetric algorithm, is the next-generation encryption algorithm standard, with high speed and high security level.

[0049] Among them, when parsing the key by concatenating the encrypted key fields in the order of the first occurrence position and marking the field numbers and field types of the key fields, a multi-dimensional vector can be used to represent the field numbers and field types of each key field, so as to traverse each key field in turn.

[0050] Collecting packets of a custom protocol from network traffic as described above includes: receiving data packets containing port information and generating a service acceleration table using service port configuration items, which is stored in the form of a nested binary tree; identifying packets of the custom protocol that match the above port information through the above service acceleration table.

[0051] When removing noise data from data packets, a noise filter design can be adopted: Self-tracking filter solution: An intelligent controllable filter structure is adopted, whose signal input end receives the custom protocol data signal to be filtered, and the center frequency of the band-pass output of the filter is adjusted by controlling the input to receive a control signal. The control unit is coupled to the control input of the filter to generate a control signal in real time to ensure that the center frequency of the filter is basically consistent with the frequency of the input signal and dynamically tracks the change of the data. This design enables the filter to effectively remove the noise components in the data, especially in the data stream of the custom protocol, accurately capture and eliminate the disturbance signal, thereby improving the accuracy and stability of signal processing.

[0052] Through the service acceleration table, the custom protocol type can be quickly located, and the parsing speed of the custom protocol can also be accelerated. Among them, the conventional service port configuration items mainly include the following aspects: Determine the required ports: Based on the services and applications provided by the server, determine the port numbers that need to be opened. Common ports include port 80 for HTTP services, port 21 for FTP services, etc. Log in to the server: Use SSH or other remote login tools to log in to the server as an administrator. Open the firewall settings: According to the operating system and firewall software of the server, open the corresponding firewall settings interface. Add port rules: In the firewall settings interface, add new port rules. The rules should include the port number, protocol type (TCP or UDP), and the allow or deny operation. Save and apply the settings: Save the firewall settings and apply the new port rules. Ensure that the settings are still effective after the server restarts. Test port connectivity: Use telnet or other network tools to test whether the ports on the server are open and available. Security: When opening ports, be sure to pay attention to security issues. Avoid opening unnecessary ports to reduce potential security risks. Performance optimization: According to the actual requirements and performance of the server, reasonably set the number of ports and parameters. Too many open ports may affect the performance and stability of the server. Backup and recovery: Before making port settings, it is recommended to back up the relevant configuration files and settings.

[0053] The above uses deep learning algorithms and pattern matching techniques to identify the packet structure of packets and the first occurrence positions of multiple key fields, including: identifying the packet structure of packets and the first occurrence positions of multiple key fields through a regular expression matching algorithm; obtaining the above packet structure of packets of custom protocols and multiple above key fields through a protocol feature model constructed by deep learning algorithms.

[0054] The pattern matching technique can identify key fields in packets through regular expressions or specific matching algorithms. For example, regular expressions can be used to match specific protocol header information. Optionally, if the custom protocol is identified as an online banking transaction protocol, the key fields of this protocol can be the transaction type, main account number, secondary account number, etc. obtained by data block recognition. The protocol feature model is a deep neural network model pre-trained based on a large amount of data, which can accurately identify the category to which the components of the packet belong and the key field information contained. Using deep learning algorithms can better and faster identify artificially constructed feature rules, avoiding misjudgments and rule omissions caused by insufficient artificial experience. Optionally, the deep learning algorithm uses a stacked neural network because the network structure is not affected by the number of intermediate layer nodes, can solve the problem of reduced fitting accuracy of other machine learning algorithms on high-dimensional data, and improve the generalization ability.

[0055] Decrypting the data packet of the above custom protocol based on the above parsing key, including:

[0056] According to the above field numbers and the above field types corresponding to each keyword field at the above first occurrence position, search the above preliminary parsing rule set to obtain the above parsing key, and use the above parsing key to decrypt the data packet of the above custom protocol;

[0057] Decrypting the data packet of the above custom protocol based on the above parsing key, further including:

[0058] Establish a search index of the above preliminary parsing rule set for the above parsing key that decrypts successfully to form a custom protocol search index table; when multiple parsing keys are found, decrypt them sequentially using each of the above parsing keys, and add the above search index of the above parsing key that decrypts successfully to the above custom protocol search index table; when searching the above preliminary parsing rule set, search according to the above search index of the above custom protocol.

[0059] When a new custom protocol appears, only a corresponding retrieval index needs to be added.

[0060] Decrypting the data packet of the above custom protocol based on the above parsing key, further including:

[0061] When the above parsing key found cannot decrypt the data packet, obtain the above preset encryption rules specified by each of the above keyword fields, encrypt each of the above keyword fields; splice the encrypted above keyword fields in sequence according to the above first occurrence position, mark the field numbers and field types of each of the above keyword fields, generate a temporary key; decrypt the data packet of the above custom protocol based on the above temporary key.

[0062] Performing threat review on the data packet of the above custom protocol, including:

[0063] When the above parsing key cannot be found, intercept the data packet and add the IP address of the data packet sending port to the blacklist.

[0064] In summary, the embodiments of the present application provide an auditing method and system for actively learning parsing rules of a custom protocol:

[0065] The present invention proposes an auditing method for actively learning parsing rules of a custom protocol, which collects data packets of the custom protocol from network traffic and removes noise data; uses deep learning algorithms and pattern matching techniques to identify the data packet structure of the data packets and the first occurrence positions of multiple key fields, so as to obtain the structural and content features of the data packets; encrypts the key fields according to the preset encryption rules of each key field, sequentially splices the encrypted key fields according to the first occurrence positions, and marks the field numbers and field types of each key field to obtain a parsing key, and forms a preliminary parsing rule set of the parsing key; and realizes traffic parsing and threat review of the custom protocol based on the parsing rules. The present invention automatically extracts the traffic characteristics of the custom protocol, generates parsing rules, and is used for further traffic parsing and threat detection, improves the accuracy and automation degree of protocol parsing, provides an automatic parsing mechanism, and improves the efficiency and detection ability of the protocol auditing system.

[0066] The specific embodiments described above further elaborate on the purpose, technical solutions, and beneficial effects of the present invention. It should be understood that the above are only specific embodiments of the present invention and are not used to limit the protection scope of the present invention. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present invention shall be included in the protection scope of the present invention.

Claims

1. An auditing method for actively learning parsing rules of a custom protocol, characterized in that, including: collecting data packets of a custom protocol from network traffic and removing noise data; using deep learning algorithms and pattern matching techniques to identify the data packet structure of the data packets and the first occurrence positions of multiple key fields; obtaining the preset encryption rules for each of the key fields and encrypting each of the key fields; concatenating the encrypted key fields in sequence according to the first occurrence positions, marking the field numbers and field types of each of the key fields to obtain a parsing key, and forming a preliminary parsing rule set for the parsing key; decrypting the data packets of the custom protocol based on the parsing key, including: finding the parsing key by looking up the preliminary parsing rule set according to the field numbers and the field types corresponding to the key fields at the first occurrence positions, and decrypting the data packets of the custom protocol by using the parsing key; establishing a lookup index for the preliminary parsing rule set for the successfully decrypted parsing key to form a custom protocol lookup index table; when multiple parsing keys are found, decrypting them in sequence by using each of the parsing keys, and adding the lookup index of the successfully decrypted parsing key to the custom protocol lookup index table; when looking up the preliminary parsing rule set, performing the lookup according to the lookup index of the custom protocol; when the found parsing key cannot decrypt the data packets, obtaining the preset encryption rules specified for each of the key fields, encrypting each of the key fields; concatenating the encrypted key fields in sequence according to the first occurrence positions, marking the field numbers and field types of each of the key fields, generating a temporary key; decrypting the data packets of the custom protocol based on the temporary key; performing threat review on the data packets of the custom protocol.

2. The auditing method for actively learning and parsing rules of a custom protocol according to claim 1, characterized in that, The collecting data packets of a custom protocol from network traffic includes: receiving data packets containing port information, and generating a service acceleration table by using service port configuration items, which is stored in the form of a nested binary tree; identifying the data packets of the custom protocol that match the port information through the service acceleration table.

3. The auditing method for actively learning and analyzing rules of a custom protocol according to claim 1, wherein The using deep learning algorithms and pattern matching techniques to identify the data packet structure of the data packets and the first occurrence positions of multiple key fields includes: identifying the data packet structure of the data packets and the first occurrence positions of multiple key fields through a matching algorithm of regular expressions; obtaining the data packet structure of the data packets of the custom protocol and multiple of the key fields through a protocol feature model constructed by deep learning algorithms.

4. The auditing method for actively learning and analyzing rules of a custom protocol according to claim 1, characterized in that, The performing threat review on the data packets of the custom protocol includes: when the parsing key cannot be found, intercepting the data packets and adding the IP address of the data packet sending port to the blacklist.

5. An audit system for actively learning parsing rules of a custom protocol, characterized in that, including an active learning module and a Suricata parsing module; the active learning module includes a traffic collection module, a feature extraction module, and a preliminary parsing rule generation module: the traffic collection module collects data packets of a custom protocol from network traffic and removes noise data; The feature extraction module uses deep learning algorithms and pattern matching techniques to identify the data packet structure of the data packet and the first occurrence positions of multiple key fields; The preliminary parsing rule generation module obtains the preset encryption rules for each of the key fields and encrypts each of the key fields; Sequentially splice the encrypted key fields according to the first occurrence positions, mark the field numbers and field types of each of the key fields to obtain a parsing key, and form a preliminary parsing rule set for the parsing key; The Suricata parsing module decrypts the data packet of the custom protocol based on the parsing key, including: According to the field numbers and the field types corresponding to the key fields at the first occurrence positions, search the preliminary parsing rule set to obtain the parsing key, and use the parsing key to decrypt the data packet of the custom protocol; Establish a search index for the preliminary parsing rule set for the successfully decrypted parsing key to form a custom protocol search index table; when multiple parsing keys are found, decrypt them sequentially using each of the parsing keys, and add the search index of the successfully decrypted parsing key to the custom protocol search index table; when searching the preliminary parsing rule set, search according to the search index of the custom protocol; When the found parsing key cannot decrypt the data packet, obtain the preset encryption rules specified for each of the key fields, and encrypt each of the key fields; sequentially splice the encrypted key fields according to the first occurrence positions, mark the field numbers and field types of each of the key fields to generate a temporary key; decrypt the data packet of the custom protocol based on the temporary key; Conduct threat review on the data packet of the custom protocol.

6. The audit system for actively learning and parsing rules of a custom protocol according to claim 5, characterized in that, The system further includes a manual rule selection module; The manual rule selection module includes: A rule viewing module for the user to view the rule set generated by active learning; A rule editing and optimization module that allows the user to edit the generated parsing rules; A multi-version rule management module for the user to save and switch between different versions of the parsing rules.

7. An electronic device, comprising a memory, a processor, and a computer program running on the processor, characterized in that: When the processor executes the computer program, it implements the steps of an auditing method for an active learning parsing rule of a custom protocol as described in any one of claims 1 to 4.

8. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by the processor, it implements the steps of an auditing method for an active learning parsing rule of a custom protocol as described in any one of claims 1 to 4.

Images