Intelligent substation intrusion detection method based on hidden Markov model

Abstract

An intrusion detection method for smart substations based on Hidden Markov Models includes the following steps: S1: Segmenting network traffic according to time scale, extracting packet identifiers, packet measurement data, and packet throughput to construct an intrusion detection dataset; S2: Calculating the difference between state variables and measurement values ​​based on the unscented Kalman filter method to establish a state model capable of calculating the attack detection index; S3: Establishing an ARIMA model, selecting the optimal traffic model, determining the detection confidence interval, and establishing a traffic throughput detection model; S4: Establishing multiple protocol compliance detection rules and, based on the Hamming distance calculation method, establishing a standardized detection model; S5: Real-time detection of network traffic in the smart substation, calculating detection vectors based on the models established in S2, S3, and S4 respectively, and using them as input variables for the Hidden Markov Model, comprehensively analyzing system anomaly characteristics, and achieving final discrimination.

Description

TECHNICAL FIELD

[0001] The application belongs to the field of industrial control safety, and particularly relates to an intelligent substation intrusion detection method based on a hidden Markov model. BACKGROUND

[0002] An intelligent substation is a core infrastructure of a smart power grid transmission and distribution system. The intelligent substation is based on networked interactive data transmission and standardized sharing, uses embedded devices with computing capabilities, and autonomously completes the control, protection, information measurement and other conventional substation tasks of power equipment. With the application of a large number of advanced information technologies in intelligent substations, the number of connected intelligent devices has increased significantly, and information security vulnerabilities and potential intrusion points have increased. Intelligent substations are facing many potential information security threats. At the same time, intelligent substations involve the integration of power equipment, communication networks, and data analysis systems at multiple levels. This complexity provides attackers with opportunities to attack at different levels and affect various aspects of the power system, inducing power system instability or power outages, and causing serious impacts on political stability and the economy. Therefore, it is necessary to build a standard and effective intrusion detection system to accurately identify attack behaviors through real-time monitoring and abnormal data analysis to cope with the increasing information security threats.

[0003] An intrusion detection system can effectively identify false data attacks, denial-of-service attacks and other common network attacks. In recent years, intrusion detection technology has been widely applied in the information security protection of intelligent substations, and has assumed the functions of real-time monitoring of network traffic and identification of abnormal data. Through the cooperation of security modules such as identity authentication, access control and log analysis, intrusion detection technology has significantly improved the overall security protection capability of intelligent substations. The IEC 61850 standard defines GOOSE, SV and other special communication messages with different functions, but the complexity of its design and real-time requirements pose new challenges to intrusion detection systems. Due to the diversity of nodes and the complexity of scenarios under the IEC 61850 standard, traditional intrusion detection methods are often limited to single-node or single-dimensional detection modes, making it difficult to capture the full picture of distributed attack behaviors. There are problems such as the deployment of isolated single intrusion detection systems and the lack of coordination and interaction. The detection methods have problems such as the difficulty in balancing the false negative rate and the false positive rate. For comprehensive coverage of network attacks, it is necessary to consider multiple dimensions such as network traffic changes and message feature abnormalities, and design more adaptable intrusion detection algorithms to improve the ability to judge complex attack behaviors. SUMMARY

[0004] In view of the problems of small detection coverage of a single detection method for complex attack behaviors and high false alarm rate in high real-time scenarios, the application provides an intelligent substation intrusion detection method based on a hidden Markov model.

[0005] In order to achieve the above-mentioned purpose, the application adopts the following technical solutions:

[0006] An intelligent substation intrusion detection method based on a hidden Markov model comprises the following steps:

[0007] S1: segmentally cutting continuous network traffic according to a time scale, extracting a message identifier, measurement data of message transmission and message throughput size capable of representing message protocol compliance in a same time window, and constructing a complete intrusion detection data set;

[0008] S2: extracting measurement data of a node, calculating a difference value between a state variable and a measurement value based on an unscented Kalman filtering method, and establishing a state model capable of calculating an attack detection index reflecting a variable deviation degree;

[0009] S3: regarding real-time traffic of a message as time series data and modeling through an ARIMA model, screening a traffic model with the optimal fitting effect from the traffic models after multiple fittings based on a traffic change law, determining a detection confidence interval based on a screening rule, and establishing a time sequence model capable of calculating traffic throughput;

[0010] S4: establishing multiple protocol compliance detection rules according to an IEC 61850 protocol specification, and establishing a specification detection model capable of judging whether a message conforms to a communication protocol specification based on a Hamming distance calculation method;

[0011] S5: real-time detection of intelligent substation network traffic, calculation of a data integrity detection vector, a traffic throughput detection vector and a protocol compliance detection vector according to the models established in S2, S3 and S4 respectively, normalization, input of the variables into a hidden Markov model, combination with observation sequence data, comprehensive analysis of system abnormal characteristics and final discrimination.

[0012] Compared with the prior art, the application has the following beneficial effects:

[0013] The present application is directed to a variety of potential attack modes existing in the intelligent substation communication network, and a fusion intrusion detection method combining traffic characteristics, measurement data and protocol specifications is designed. Compared with the traditional single dimension or single model intrusion detection method, the present application fully fuses multi-dimensional characteristics, which can effectively avoid the false negative or false positive problem of single detection method to complex attack behavior. In addition, by using the hidden Markov model to fuse and classify the state of the multi-dimensional detection results, compared with the single dimension detection method, the present application is optimized according to the complexity characteristics of the intelligent substation protocol, which can effectively identify the attack behavior, reduce the false positive and false negative in complex scene, and has higher robustness and accuracy, and reduces the dependence on single rule or expert knowledge. BRIEF DESCRIPTION OF DRAWINGS

[0014] Figure 1 It is a whole flow chart of the intelligent substation intrusion detection method based on the hidden Markov model;

[0015] Figure 2 It is a specific flow chart of the intelligent substation intrusion detection method based on the hidden Markov model. DETAILED DESCRIPTION

[0016] The technical solutions in the present application will be described clearly and completely in combination with the drawings and embodiments. Obviously, the described embodiments are only a part of the embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor belong to the protection scope of the present application. Specific embodiment one:

[0018] The present application provides an intelligent substation intrusion detection method based on the hidden Markov model, as shown in Figure 1 The method comprises the following steps:

[0019] S1: The historical network traffic of the intelligent substation is counted, different messages are classified, the detection accuracy of the intelligent substation and the size of real-time data are considered, a suitable time window is selected, the messages are divided in time scale, and the protocol field information, time characteristics and traffic characteristic data of the historical messages are extracted.

[0020] S2: The key electrical parameters of the observable intelligent substation are modeled, the voltage amplitude state equation, the voltage phase angle state equation and the node current state equation are established.

[0021] S3: The three state equations are discretized to obtain the state equation of a single node, wherein F is the state transition matrix, which identifies the evolution relationship of the system state with time.

[0022] S4: The observation equation Z k=HX k +V s ,in Z k Let H be the observation vector, H be the observation matrix, and V be the observation vector. s To measure noise, X k For state vectors, These are sensor measurements of voltage, phase angle, and current, respectively.

[0023] S5: Set the initial state vector estimate X0, the initial state covariance matrix P0, the process noise covariance matrix Q, and the measurement noise covariance matrix R; establish the UKF model, state prediction equation: X k|k-1 =f(X) k-1 )+ω k Measurement prediction equation: Z k|k-1 =h(X) k|k-1 )+v k Where f(·) is the data state equation, h(·) is the measurement nonlinearity equation, and ω k ,v k These are normally distributed noises.

[0024] S6: Establish a smart substation flow model, divide the original message data according to the selected time window size, and perform stationarity detection through ADF test. If it is not stationary, perform differential operation until it passes the ADF test.

[0025] S7: Establish an ARIMA model to predict changes in traffic throughput, estimate the model parameters according to the Akaike Information Criterion, select the optimal model parameters, and train the model based on historical traffic data.

[0026] S8: Generate models multiple times based on historical data, set rules to filter the models, and generate detection thresholds based on the multiple generated models. The filtering rules are as follows:

[0027]

[0028] Among them, y max Represents the maximum observed value in historical data. This represents the j-th observation predicted by the model. X represents the mean of all predicted values. t This represents the true value of historical observation data.

[0029] in accordance with Determine the confidence interval for the model detection, where P is the confidence level and S is the confidence level. inside S is the number of sequences within the flow threshold range. total The total number of sequences predicted in the simulation is calculated; a time series model capable of calculating throughput is established.

[0030] S9: Analyze the field characteristics and communication rules of the GOOSE and SV message protocols defined in the IEC-61850 standard, and generate a protocol specification detection rule base.

[0031] S10: Based on the detection results of a single message against multiple rules, generate a message specification detection vector Y. n =[y1,...,y n Perform protocol compliance checks on different fields of the message; output 1 if the check passes, and output 0 if it fails; establish a protocol compliance check model: Where P H For the protocol compliance of the message, y i For Y n The i-th element in the vector is y0, which is the standard message protocol specification detection vector.

[0032] S11: Combine the feature vectors obtained from the above models under the same time window to establish a hidden Markov model. Continue training based on the feature vectors of historical data and calculate the model parameters λ = (π, A, B); where π is the initial state probability distribution, A is the state transition probability matrix, and B is the observation probability matrix.

[0033] S12: Capture network traffic from process layer and interval layer switches, perform preliminary classification of different packets, determine packet traffic size, select appropriate time window size, and divide packets.

[0034] S13: Extract the features of each field in the message. For the measurement message, extract the voltage amplitude V. k Voltage phase angle θ k and the magnitude I of the current flowing through this node k Generate state vector X k =[V k ,θ k ,I k ];

[0035] S14: Predict the state vector at time k+1 based on the UKF model established in S5. And error covariance matrix P k+1|k ;Calculate the Kalman gain K based on the observed data and predicted values. k Update the state estimation vector The covariance matrix P k+1|k+1 Based on the optimal estimate Compared with the actual measured value Z k+1 The system calculates the difference between the state variable and the measured value, and the difference between the predicted value and the measured value. It further calculates the attack detection index and generates a data integrity detection vector ADI = [r1,...r2] for multiple nodes within a fixed time period. n ].

[0036] S15: Based on the aggregated packet traffic data, predict the current packet traffic, calculate the difference between the measured packet traffic value and the detection threshold, and generate the traffic throughput detection vector TDV = [Δf1,...,Δf n ].

[0037] S16: Calculate the Hamming distance between each message and the canonical message, and generate a message protocol compliance detection vector PNV = [d1,...,d] per unit time based on the time aggregation scale. n ].

[0038] S17: In the aforementioned detection phase, detection vectors ADI, TDV, and PNV are obtained, and a message feature sequence O = [o1, o2, ..., o n ].

[0039] S18: Calculate the probability of message sequence using the forward algorithm. Where P(O|λ) is the probability of O occurring under the model parameter λ, N represents the total number of hidden states, and α T (i) represents the probability of being in state i at time T; a detection threshold T is set. p If P(O|λ)<T p If P(O|λ)≥T, then the current message sequence is determined to be abnormal, indicating an attack. p If so, the current message sequence is determined to be normal.

[0040] Example 1:

[0041] like Figure 2 As shown in the figure, the specific implementation steps of the intelligent substation intrusion detection method based on the Hidden Markov Model in this embodiment are as follows:

[0042] S1: Statistically analyze the historical network traffic of the smart substation, classify different packets, consider the detection accuracy of the smart substation and the size of real-time data, select an appropriate time window, divide the packets into time scales, and extract the protocol field information, time characteristics and traffic feature data of historical packets.

[0043] S2: Model the electrical observations of the intelligent substation and establish the voltage amplitude state equation, voltage phase angle state equation, and node current state equation.

[0044] In this embodiment, the voltage amplitude state equation is V k+1 =V k -aV k Δt+bI k Δt+W V,s The voltage phase angle state equation is: The node current state equation is Ik+1 =GV k cosθ k +BV k sinθ k +W I,s .

[0045] Among them W V,s For voltage amplitude process noise, W θ,s For noise in the phase angle measurement process, W I,s Noise during current measurement, P k This indicates the active power injected by the node, where Δt is the time step, a = 0.95, b = 0.02.

[0046] W V,s ~N(0,0.01), c=0.9, W θ,s ~N(0,0.01), W I ,s~N(0,0.01), G=0.01, B=0.05.

[0047] S3: Discretize the three state equations to obtain the state equations of a single node, where F is the state transition matrix, which identifies the evolution of the system state over time.

[0048] In this embodiment, the state equation of a single node is X. k+1 =FX k +W k X k Represents the state vector, W k Representing process noise, the state transition matrix F is:

[0049]

[0050] S4: Establish the observation equation Z k =HX k +V s ,in H is the observation matrix, V s To measure noise, These are sensor measurements of voltage, phase angle, and current, respectively.

[0051] In this embodiment, the observation matrix Measurement noise V s ~N(0,R k ), where R k The covariance matrix represents the observation noise, and the diagonal elements of the matrix represent the variance of the measurement noise for each of the different observation variables.

[0052] S5: Set the initial state vector estimate X0, the initial state covariance matrix P0, the process noise covariance matrix Q, and the measurement noise covariance matrix R. Establish the UKF model, with the state prediction equation: X k|k-1 =f(X) k-1 )+ω k Measurement prediction equation: Z k|k-1 =h(X) k|k-1 )+v k Where f(·) is the data state equation, h(·) is the measurement nonlinearity equation, and ω k ,v k These are normally distributed noises;

[0053] In this embodiment, the initial state vector estimate X0 is set as the first set of received measurement values, the initial covariance matrix P0 = diag(0.01, 0.1, 0.2), the process noise covariance matrix Q is calculated from historical data, Q = diag(0.0023, 0.0012, 0.0073), and the observation noise covariance matrix R = diag(0.0017, 0.00027, 0.093).

[0054] S6: Establish a smart substation flow model, select the time window size according to the substation flow characteristics, divide the original message data according to the time window, and perform stationarity detection through ADF test. If it is not stationary, perform differential operation until it passes the ADF test.

[0055] In this embodiment, after the historical traffic data is first-order differencing, the ADF verification result p = 0.0000183 < 0.05, indicating that the data can pass the time series stationarity verification after first-order differencing.

[0056] S7: Establish an ARIMA model to predict changes in traffic throughput, estimate the model parameters according to the Akaike Information Criterion, select the optimal model parameters, and train the model based on historical traffic data.

[0057] In this embodiment, after aggregating historical traffic data on a 1-second time scale, the traffic data model is as follows:

[0058] in,

[0059] y t-i ε represents the flow data for the first i time periods. t This represents random noise.

[0060] S8: Generate models multiple times based on historical data, set rules to filter the models, and generate detection thresholds based on the multiple generated models. Determine the confidence interval for model detection; establish a time series model capable of calculating throughput.

[0061] In this embodiment, the filtering rules are as follows:

[0062]

[0063] The detection threshold is generated as follows:

[0064]

[0065] Among them, y max Represents the maximum observed value in historical data. This represents the j-th observation predicted by the model. X represents the mean of all predicted values. t Y represents the true value of historical observation data. j Let represent the predicted value for the j-th observation, and k represent the total number of time steps.

[0066] In 1000 model generation experiments, 97.32% of the sequences met the requirements after being selected using the filtering rules. Based on this proportion, a 95% confidence interval was set, a threshold that can cover the vast majority of normal traffic fluctuations.

[0067] S9: Compile statistics on the protocol specifications of various messages in IEC-61850, generate multiple protocol detection rules, and establish a message protocol specification detection rule library.

[0068] In this embodiment, 37 detection rules were generated based on the IEC-61850 protocol: such as the first four bytes of the MAC address of the (#R1) message must be 01-0c-cd-01 or 01-0c-cd-04, and the TPID field value of the (#R2) message must be 0x8100.

[0069] S10: Based on the detection results of a single message against multiple rules, generate a message specification detection vector Y. n =[y1,...,y n ]; Perform validity checks on different fields of the message. If the check passes, output 1; otherwise, output 0.

[0070] In this embodiment, taking the 6th message at 30 seconds as an example, this message violates #R27, #R53, and #R54, and the rule detection vector is Y. n =[0,...,y 27 ,...,0,...,y 53 ,y 54 ,...,0].

[0071] Establish a protocol compliance detection model: Where P H For the protocol compliance of the message, y i For Y n The i-th element in the vector is y0, which is the standard message protocol specification detection vector.

[0072] S11: Combine the feature vectors obtained from the above models under the same time window to establish a Hidden Markov Model, continue training based on the feature vectors of historical data, and calculate the model parameters.

[0073] In this embodiment, the model parameters are π = [0.8973, 0.0619, 0.0253, 0.0155].

[0074]

[0075] S12: Capture network traffic from process layer and interval layer switches, perform preliminary classification of different packets, determine packet traffic size, select appropriate time window size, and divide packets.

[0076] S13: Extract the features of each field in the message. For the measurement message, extract the voltage amplitude V. k Voltage phase angle θ k and the current amplitude I flowing through this node k Generate state vector X k =[V k ,θ k ,I k ];

[0077] S14: Predict the state vector at time k+1 based on the UKF model established in S5. And error covariance matrix P k+1|k Based on the observed data and predicted values, the Kalman gain K is calculated. k Update the state estimation vector The covariance matrix P k+1|k+1 According to the optimal estimate Compared with the actual measured value Z k+1 The system calculates the difference between the state variable and the measured value, and the difference between the predicted value and the measured value. It further calculates the attack detection index and generates a data integrity detection vector ADI = [r1,...r2] for multiple nodes within a fixed time period. n ].

[0078] In this embodiment, the data integrity detection value Taking the 30th second of detection as an example, the generated data integrity detection vector

[0079] ADI 30= [0.1023, 0.2354, 0.1231, 0.2674, 0.5112, 0.77245, 0.1983, 0.0945, 0.3146, 0.0987]. Where... Let be the static state estimate at time i+1. Let x' be the mixed prediction value of the state at time i+1, and let x' be the deviation vector from time i=1 to time i+1. Let x′ be the average value.

[0080] S15: Based on the aggregated packet traffic data, predict the current packet traffic, calculate the difference between the measured packet traffic value and the detection threshold, and generate the traffic throughput detection vector TDV = [Δf1,...,Δf n ].

[0081] In this embodiment, the detection threshold is the 95% confidence interval of the predicted value. Taking the 30th second as an example, the generated throughput detection vector...

[0082] TDV 30 =[0.1023,0.0854,0.1231,0.0674,0.0912,0.1245,0.0983,0.0945,0.1146,0.0987]

[0083] S16: Calculate the Hamming distance between each message and the canonical message, and generate the message canonical detection vector PNV = [d1,...,d] per unit time according to the time aggregation scale. n ];

[0084] In this embodiment, taking the 30th second as an example, the normalized message canonical detection vector PNV = [0,0,0,0,0,0.723,...,0,0,0.103,0]

[0085] S17: In the aforementioned detection phase, detection vectors ADI, TDV, and PNV are obtained, and a message feature sequence O = [o1, o2, ..., o n ].

[0086] S18: Calculate the probability of message sequence using the forward algorithm. Set detection threshold T p If P(O|λ)<T p If P(O|λ)≥T, then the current message sequence is determined to be abnormal, indicating an attack. p If so, the current message sequence is determined to be normal.

[0087] In this embodiment, the fused feature vector at the 30th second, after being calculated by the Hidden Markov Model, P(O 30 |λ inject) = 0.734 > T p Therefore, the system determined that a fake data injection attack occurred during the 30-second detection.

[0088] Furthermore, it should be understood that although this specification describes embodiments, not every embodiment contains only one independent technical solution. This narrative style is merely for clarity. Those skilled in the art should consider the specification as a whole, and the technical solutions in each embodiment can also be appropriately combined to form other embodiments that can be understood by those skilled in the art.

Claims

1. A method for intrusion detection in smart substations based on hidden Markov models, characterized in that, The method includes the following steps: S1: Segment continuous network traffic according to time scale, extract message identifiers, message transmission measurement data and message throughput size that can characterize the compliance of message protocols within the same time window, and construct a complete intrusion detection dataset; S2: Extract the measurement data of the nodes, calculate the difference between the state variables and the measurement values ​​based on the unscented Kalman filter method, and establish a state model that can calculate an attack detection index that reflects the degree of deviation of the variables; the specific steps of S2 are as follows: S2.1: Model the electrical observations of the intelligent substation and establish the voltage amplitude state equation, voltage phase angle state equation, and node current state equation; S2.2: Discretize the three state equations to obtain the state equations for a single node; S2.3: Establish the observation equation ,in , For the observation vector, For the observation matrix, To measure noise, For state vectors, , , These are sensor measurements of voltage, phase angle, and current, respectively. S2.4: Establish the UKF model, state prediction equation: Measurement prediction equation: ,in For the data state equation, To measure nonlinear equations, Noise that is normally distributed; S3: Treat real-time packet traffic as time series data and model it using the ARIMA model. Based on the traffic change pattern, select the traffic model with the best fit among the traffic models after multiple fittings, and determine the confidence interval of the detection based on the selection rules to establish a time series model that can calculate the traffic throughput. S4: Based on the IEC 61850 protocol specification, establish multiple protocol compliance detection rules, and based on the Hamming distance calculation method, establish a specification detection model that can determine whether a message conforms to the communication protocol specification; S5: Real-time detection of network traffic in the intelligent substation. Based on the models established in S2, S3, and S4, calculate data integrity detection vector, traffic throughput detection vector, and protocol compliance detection vector respectively. After normalization, these vectors are used as input variables for the Hidden Markov Model. Combined with the observed sequence data, a comprehensive analysis of system anomaly characteristics is performed to achieve the final judgment. The specific steps of S5 are as follows: S5.1: Combine the feature vectors obtained from the above models within the same time window to establish a Hidden Markov Model. Continue training based on the feature vectors from historical data and calculate the model parameters. ,in The initial state probability distribution, Here is the state transition probability matrix. The observation probability matrix; S5.2: Capture real-time network traffic from switches at the process layer and interval layer, and extract message identifiers, data transmitted in messages, and message throughput from real-time messages that can characterize the compliance of message protocols. S5.3: Extract voltage amplitude from multiple node measurement messages Voltage phase angle and the amplitude of the current flowing through the node Generate state vector ; S5.4: Predict the current time based on the UKF model established in S2.

4. state vector And error covariance matrix Based on the observed data and predicted values, the Kalman gain is calculated. Update the state estimation vector Covariance Matrix Based on the state estimation vector Compared with actual measured value The system calculates the difference between the state variable and the measured value, and the difference between the predicted value and the measured value, and further calculates the attack detection index to generate data integrity detection vectors for multiple nodes within a fixed time period. ; S5.5: Based on the aggregated packet traffic data, predict the current packet traffic, calculate the difference between the measured real-time packet traffic value and the detection threshold, and generate a traffic throughput detection vector. ; S5.6: Calculate the Hamming distance between each message and the standard message, and generate a message protocol compliance detection vector per unit time based on the time aggregation scale. ; S5.7: Obtaining the detection vector in the aforementioned detection phase. , , Construct message feature sequence ; S5.8: Calculate the probability of message sequence using the forward algorithm. ,in In model parameters Lower-order sequencing The probability of occurrence Indicates the total number of hidden states. Indicates time In state The probability; setting a detection threshold ,like If the current message sequence is abnormal, it is determined that an attack has occurred. If so, the current message sequence is determined to be normal.

2. The detection method according to claim 1, characterized in that: The steps in S1 for segmenting continuous network traffic according to the time scale are as follows: statistical analysis of historical network traffic of the smart substation, classification of different messages, selection of time window size based on the detection accuracy requirements of the smart substation and the real-time data volume, segmenting continuous network traffic to ensure that the traffic in each time unit has temporal correlation and behavioral consistency.

3. The detection method according to claim 1, characterized in that: The specific steps of S3 are as follows: S3.1: Establish a smart substation flow model, select the time window size according to the substation flow characteristics, divide the original message data according to the time window, and perform stationarity detection through ADF test. If it is not stationary, perform differential operation until it passes the ADF test. S3.2: Establish an ARIMA model to predict changes in flow throughput, determine the model order based on the Akaike Information Criterion, and fit the model parameters using the exact maximum likelihood method based on historical flow throughput data. S3.3: Multiple model fittings are performed, and rules are set to filter the models. A detection threshold is generated based on the multiple model fittings. The filtering rules are as follows: in, Represents the maximum observed value in historical data. The model predicts the first The second observation value, This represents the mean of all predicted values. This represents the true value of historical observation data. in accordance with Determine the confidence interval for the model detection, where For confidence level, The number of sequences within the flow threshold range. The total number of sequences predicted in the simulation is calculated; a time series model capable of calculating throughput is established.

4. The detection method according to claim 1, characterized in that: The specific steps of S4 are as follows: S4.1: Statistically analyze the protocol specifications of various messages in IEC-61850, generate multiple detection rules for protocol compliance testing of message identifiers, and establish a message protocol specification detection rule library; S4.2: Generate a message specification detection vector based on the detection results of a single message for multiple rules. Perform protocol compliance checks on different fields of the message; output 1 if the check passes, and output 0 if it fails; establish a protocol compliance check model: ,in For the protocol compliance of the message, for The Middle One element, This is a detection vector for the standard message protocol specification.

Images