Implementation System and Method for Long Inference of Network Protocol Analysis Model

Abstract

The present invention provides a system and method for implementing long-term inference in a network protocol analysis model. The system includes: a Pcap packet information extraction device for extracting and outputting relevant information from an input Pcap packet; a Pcap packet long-term inference synthesis and collection device for processing the relevant information output by the Pcap packet information extraction device and outputting a data set; the data set includes a set of two-tuple data consisting of the extracted Pcap packet information and the long-term inference synthesis data; and a Pcap packet long-term inference scoring and optimization device for inputting the data set and outputting a trained network protocol long-term inference model. The present invention designs a "protocol inference rationality formula" based on the business knowledge of network protocol analysis to reinforce learning scoring, making protocol analysis more reasonable. Based on a high-quality protocol analysis language model, the labor cost of Pcap packet analysis is greatly reduced.

Description

Technical Field

[0001] The present invention relates to the technical field of computer network monitoring and management, and in particular to a system and method for implementing long-term inference of a network protocol analysis model. Background Art

[0002] Pcap packet analysis is an important method for locating network faults, but it requires specialized network protocol knowledge and experience and is typically performed by experienced network engineers. By analyzing Pcap packets, network engineers can obtain detailed network traffic information, such as traffic statistics, TCP / UDP session details, HTTP / DNS / TLS protocol content parsing, and potential abnormal behavior. However, this type of analysis typically requires in-depth network protocol knowledge and extensive practical experience, which limits its scope and effectiveness.

[0003] In recent years, the development of artificial intelligence (AI), particularly the application of large language models (LLMs), has opened up new possibilities for automated network protocol analysis. By feeding information from Pcap packets into a well-trained LLM, intelligent diagnosis of network issues can be achieved, reducing reliance on specialized human resources and improving analysis speed and accuracy. However, existing solutions still have shortcomings in handling complex network protocol reasoning, particularly in optimizing efficient reasoning over long links while ensuring reasonableness and accuracy.

[0004] The present invention aims to design a "protocol reasoning rationality formula" based on the business knowledge of network protocol analysis, which is used to reinforce learning scoring and make protocol analysis more reasonable; based on a high-quality protocol analysis language model, the labor cost of pcap packet analysis is greatly reduced.

[0005] In the Chinese patent document with publication number CN119182838A, a network device user identification method and system based on network protocol analysis is disclosed. The method includes: collecting network protocol data generated when users interact with network devices; performing protocol parsing on the network protocol data to obtain protocol features; labeling the network protocol data with user categories based on the protocol features; differentially encoding and splicing the protocol features to form a network protocol feature vector; constructing a network device user identification model based on a deep neural network, and predicting the user category based on the network protocol feature vector; comparing the user category prediction result with the user category labeling result, and iteratively training the network device user identification model; collecting real-time network protocol data generated when users interact with network devices, and converting it into a real-time network protocol feature vector; identifying unknown user categories through the trained network device user identification model. However, the document uses traditional neural networks to identify network features, and the analysis process does not involve the large language model used in this application.

[0006] Chinese patent publication CN116915679A discloses a computer network protocol analysis system, comprising a port access system, a port analysis system, a network connection system, a network analysis system, a protocol retrieval system, a protocol analysis system, a layered requirements system, a standard data repository, and an exception handling system. However, this patent document is unrelated to the large language model technology used in the present invention, and the two technologies are fundamentally different. Summary of the Invention

[0007] In view of the defects in the prior art, the purpose of the present invention is to provide a method and system for implementing long-term reasoning of a network protocol analysis model.

[0008] According to the present invention, a system for implementing long-term reasoning of a network protocol analysis model includes:

[0009] Pcap packet information extraction device, used to extract relevant information from the input Pcap packet and output it; the relevant information includes traffic statistics information, TCP / UDP session information, HTTP / DNS / TLS protocol content analysis and abnormal behavior information;

[0010] A Pcap packet long reasoning synthesis collection device is used to process the relevant information output by the Pcap packet information extraction device and output a data set; the data set includes a set of two-tuple data of the pcap packet extraction information and the long reasoning synthesis data;

[0011] The Pcap packet length inference scoring and optimization device inputs the data set and outputs a trained network protocol long inference model.

[0012] Preferably, the Pcap packet information extraction device includes:

[0013] Traffic statistics extraction module, used to extract the statistical information of the flow of pcap packets;

[0014] TCP / UDP session extraction module, used to extract TCP / UDP session information in pcap packets;

[0015] HTTP / DNS / TLS payload information extraction module, used to extract HTTP / DNS / TLS payload information in pcap packets;

[0016] The network abnormal behavior information extraction module is used to extract network abnormality information in the pcap package.

[0017] Preferably, the output information of the traffic statistics information extraction module includes the total traffic size, the number of data packets, statistics of each IP, protocol distribution, port distribution and traffic timing;

[0018] The output information of the TCP / UDP session extraction module includes TCP three-way handshake success rate, packet loss rate, retransmission rate, whether there is a reset anomaly, UDP session request-response success rate, TLS handshake success rate and whether there is an abnormal alert detection;

[0019] The output information of the HTTP / DNS / TLS load information extraction module includes HTTP target, User-Agent, Host, error rate, DNS resolution domain name, TLS encryption algorithm and whether there is a certificate anomaly;

[0020] The output information of the network abnormal behavior information extraction module includes whether there is scanning, whether there is DDOS, and TLS certificate forgery.

[0021] Preferably, it also includes:

[0022] The information summary module records all the extracted information texts and forms a tuple with the original pcap package;

[0023] The tuple includes {pcap package, extract_info}, wherein extract_info is the extraction information corresponding to the pcap package.

[0024] Preferably, the Pcap packet length reasoning synthesis collection device includes:

[0025] The Pcap packet length inference prompt word preparation module inputs the two-tuple to form a prompt word data set;

[0026] The long inference data synthesis module calls a large language model, inputs the corresponding prompt words into the large language model one by one, and obtains the long inference synthetic data set output by the model;

[0027] Each element in the long reasoning synthetic data set is a two-tuple.

[0028] Preferably, the input of the Pcap packet length inference prompt word preparation module is the prompt word constituted by extract_info in the output binary tuple of the information summary module to form a prompt word data set, and each record in the data is a binary tuple {pcap, pcap_reference_prompt}, where pcap_reference_prompt is the prompt word corresponding to pcap;

[0029] The large language models called by the long reasoning data synthesis module include deepseek and Qwen, denoted as LLM pcap_analysis , input the pcap_reference_prompt part in the prompt word dataset into the large language model one by one, obtain the long inference output by the model, and form a long inference synthetic data set; each element in the data set is a two-tuple {pcap, pcap_reference_result}.

[0030] Preferably, the Pcap packet length reasoning scoring and optimization device includes:

[0031] The unreasonable protocol field extraction module for long reasoning takes as input the binary data in the long reasoning synthetic data set and outputs the proportion of unreasonable protocol fields.

[0032] The unreasonable protocol level extraction module for long reasoning takes as input the binary data in the long reasoning synthetic data set and outputs the ratio of unreasonable protocol levels.

[0033] The long inference scoring and training module inputs the bigrams, unreasonable protocol field ratio, and unreasonable protocol level ratio in the long inference synthetic data set, and outputs a score between 0 and 1.

[0034] Preferably, the input of the unreasonable protocol field extraction module of the long reasoning is the tuple {pcap, pcap_reference_result}, and the output is the ratio of unreasonable protocol fields; the reasonable protocol fields contained in the pcap are recorded as the variable valid_vars, and the characters in the form of protocol.field in the pcap_reference_result are extracted through regular expressions. The protocol fields that do not exist in valid_vars are unreasonable fields, and the rest are reasonable fields; the ratio of unreasonable fields is calculated and recorded as invalid_field_ratio.

[0035] Preferably, the input of the unreasonable protocol layer extraction module of the long reasoning is a two-tuple {pcap, pcap_reference_result}, and the extraction process is completed by comparing the network protocol layer rule list;

[0036] The long reasoning scoring and training module includes checking whether the content of pcap_reference_result conforms to the XML format defined by the Pcap packet long reasoning prompt word preparation module, which is recorded as is_valid_format. If it conforms, it is 1, and if it does not conform, it is 0. The long reasoning score is calculated according to the following formula:

[0037]

[0038] in, ;

[0039] It is a decimal between 0 and 1. Indicates whether it is a valid format, 1 indicates valid, 0 indicates invalid; invalid_field_ratio indicates the ratio of unreasonable fields, ranging from 0 to 1, the larger the value, the higher the proportion of unreasonable fields; Indicates the ratio of invalid protocol nested formats, with a value ranging from 0 to 1. A larger value indicates a higher ratio of invalid protocol nested formats.

[0040] Using GRPO algorithm to analyze LLM pcap_analysis During training and optimization, the reward value of the GPRO algorithm uses the long inference score and the reward of the training module.

[0041] According to the present invention, a method for implementing long inference of a network protocol analysis model includes:

[0042] Step S1: extracting traffic statistics, TCP / UDP session information, HTTP / DNS / TLS protocol content analysis and abnormal behavior information from the input Pcap packet through the Pcap packet information extraction device;

[0043] Step S2: Use the Pcap packet length reasoning synthesis collection device to process the above information and generate a two-tuple {pcap, pcap_reference_result} containing long reasoning synthesis data;

[0044] Step S3: The long inference synthetic data is scored and optimized by the Pcap packet long inference scoring and optimization device, and finally a trained network protocol long inference model is output.

[0045] Compared with the prior art, the present invention has the following beneficial effects:

[0046] 1. This invention proposes a long-term inference implementation method for network protocol analysis. The LLM (large language model) trained based on this method can replace network engineers to complete PCAP analysis tools. This invention designs a "protocol reasoning rationality formula" based on the business knowledge of network protocol analysis to reinforce learning scoring, making protocol analysis more reasonable. Based on the high-quality protocol analysis language model, the labor cost of PCAP packet analysis is greatly reduced.

[0047] 2. The present invention first uses tools to extract Pcap package information (including traffic statistics, TCP / UDP session information, HTTP / DNS / TLS analysis, and abnormal behavior information), and then inputs the information into a basic large model (such as deepseek, Qwen, etc.) to synthesize inference data. The synthesized data is scored using the "protocol inference rationality formula", and finally the GRPO method is used to optimize the long inference function, thereby realizing the long inference function of network protocol analysis.

[0048] 3. This invention improves the reward function of the GRPO algorithm, takes "unreasonable protocol fields" into consideration, improves the rationality of the protocol field description of large models in long network protocol reasoning, and improves the quality of long network protocol analysis reasoning.

[0049] 4. This invention takes "unreasonable protocol hierarchy" into consideration by improving the reward function of the GRPO algorithm, thereby improving the rationality of protocol hierarchy reasoning in long-term network protocol reasoning of large models and improving the quality of long-term reasoning of network protocol analysis.

[0050] Other beneficial effects of the present invention will be explained through the introduction of specific technical features and technical solutions in the specific implementation methods. Those skilled in the art should be able to understand the beneficial technical effects brought about by the introduction of these technical features and technical solutions. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Other features, objects and advantages of the present invention will become more apparent upon reading the detailed description of non-limiting embodiments with reference to the following drawings:

[0052] Figure 1 It is the operation flow chart of the Pcap packet information extraction device in the present invention.

[0053] Figure 2 This is an operation flow chart of the Pcap packet length reasoning, synthesis and collection device in the present invention.

[0054] Figure 3 This is an operation flow chart of the Pcap packet length reasoning, scoring and optimization device in the present invention.

[0055] Figure 4Flow chart of the method of the present invention. DETAILED DESCRIPTION

[0056] The present invention will be described in detail below with reference to specific embodiments. The following examples will help those skilled in the art to further understand the present invention, but are not intended to limit the present invention in any form. It should be noted that, for those skilled in the art, several changes and improvements can be made without departing from the scope of the present invention. These all fall within the scope of protection of the present invention.

[0057] Reference Figure 4 As shown, a method for implementing long inference of a network protocol analysis model includes:

[0058] Step 1: Reference Figure 1 As shown, a Pcap packet information extraction device is used, which inputs Pcap packets and outputs traffic statistics, TCP / UDP session information, HTTP / DNS / TLS protocol content analysis, and abnormal behavior information. The output information will be input into the large model in step 2 for the synthesis of long inference data;

[0059] Step 1.1: Traffic statistics extraction module. This module extracts the statistics of the flow of pcap packets. The module output information includes:

[0060] Traffic statistics: record total traffic size, number of packets, and statistics for each IP;

[0061] Protocol distribution: (for example) TCP 70%, UDP 20%, ICMP 5%;

[0062] Port distribution: (e.g.) HTTP (80) 40%, DNS (53) 20%, others 40%;

[0063] Traffic timing: average RTT (round-trip time), packet loss rate, and number of TCP connections;

[0064] Step 1.2: TCP / UDP session extraction module. This module extracts the TCP / UDP session information in the pcap packet. The module output information includes:

[0065] -TCP three-way handshake success rate;

[0066] -Packet loss rate and retransmission rate of TCP connections;

[0067] -Whether TCP reset exception occurs;

[0068] -Request-response success rate of UDP sessions;

[0069] -TLS handshake success rate;

[0070] - Whether there is an abnormal TLS Alert.

[0071] Step 1.3: HTTP / DNS / TLS Payload Information Extraction Module. This module extracts the HTTP / DNS / TLS payload information in the pcap packet. The output information of the module includes:

[0072] HTTP: GET / POST target, User-Agent, Host, 403 / 404 / 500 error ratio;

[0073] DNS: Resolved domain name, whether there is NXDOMAIN;

[0074] TLS: Encryption algorithm used (such as TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256), whether there is a certificate exception;

[0075] Step 1.4: Network Abnormal Behavior Information Extraction Module. This module extracts the network abnormal information in the pcap packet. The output information of the module includes:

[0076] Whether there is a scan: The number of SYN packets;

[0077] Whether there is a DDOS: Whether there is a SYN Flood, whether there is an ICMP Flood;

[0078] TLS certificate forgery: Detect whether there is a certificate issued by an uncommon CA (for example, using the Suricata tool);

[0079] Step 1.5: Information Aggregation Module. Record the extraction information text of Steps 1.1 - 1.4, and form a binary tuple <pcap packet, extract_info> with the original pcap packet, where extract_info is the extraction information corresponding to the pcap packet.

[0080] Step 2: Refer to Figure 2 As shown, use the Pcap Packet Length Inference Synthesis Collection Device. The input of this device is the extraction information of the Pcap packet, that is, the output information of the "Pcap Packet Information Extraction Device"; the output of this device is a set of binary tuple data <extraction information of the pcap packet, length inference synthesis data>. The output data of this device will be used in Step 3 to optimize the long inference function of the model;

[0081] Step 2.1: Pcap packet length inference prompt word preparation module. The input of this module is the prompt word composed of extract_info in the output binary tuple of step 1.5, which constitutes the "prompt word dataset". Each record in the data is a binary tuple.<pcap, pcap_reference_prompt> , where pcap_reference_prompt is the prompt word corresponding to the pcap package. The prompt word template is as follows (the {extract_info} in the template is replaced with the actual pcap package extraction information):

[0082] # Please diagnose network problems based on the "various extracted information" in the pcap package below. The extracted information is:

[0083] {extract_info}

[0084] # Output requirements:

[0085] ## The output format is xml, containing multiple thinking nodes and one answer node, the format is:

[0086] <analysis>

[0087] <think> <id> 1< / id> <protocal> HTTP< / protocal> …< / think>

[0088] <think> <id> 2< / id> <protocal> TCP carries 1< / protocal> …< / think>

[0089] …

[0090] <think> <id> n< / id> <protocal> UDP over k< / protocal> …< / think>

[0091] <answer> …< / answer>

[0092] < / analysis>

[0093] Note: Each think has a unique, incremental ID number. Each think relates to a protocol. If a think's protocol is derived from an analysis of an existing think's protocol, the protocol over / carries ID is used, and the ID corresponds to the existing think. In the above example, 1, 2, k, and n are the think's IDs.

[0094] ## Protocol field description specification:

[0095] Must be described as protocol.field, for example: tcp.ack, tcp.flags, udp.dst_port

[0096] ## Protocol layer description specification:

[0097] In the protocal node, if the current think protocol is derived from an existing think protocol, use carries / over to indicate a reasonable protocol relationship.

[0098] Step 2.2: Long Inference Data Synthesis Module. This module calls a large language model (such as deepseek, Qwen, etc.), denoted as LLMpcap_analysis, and inputs the pcap_reference_prompt part in the dataset output by Step 2.1 into the large language model one by one to obtain the long inferences output by the model, which constitute the "Long Inference Synthetic Data Set". Each element in the data set is a binary tuple <pcap, pcap_reference_result>.

[0099] Step 3: Refer to Figure 3 As shown, use the Pcap Packet Long Inference Scoring and Optimization Device. The input of this device is a data set of <extracted information of the Pcap packet, long inference synthetic data>, that is, the output information of Step 2; the output of this device is the trained network protocol long inference model.

[0100] Step 3.1: "Unreasonable Protocol Field" Extraction Module for Long Inference. The input of this module is the binary tuple data <pcap, pcap_reference_result> in the data generated by Step 2.2, and the output is the ratio of "unreasonable protocol fields". The valid protocol fields included in pcap are denoted as the variable valid_vars. Extract the characters in the form of protocal.field in pcap_reference_result through regular expressions. The protocol fields that do not exist in valid_vars are unreasonable fields, and the rest are reasonable fields. Calculate the ratio of unreasonable fields, denoted as invalid_field_ratio.

[0101] The method for obtaining protocol fields can be achieved through the following command:

[0102] tshark -r demo.pcap -T json

[0103] Collect all the protocol fields in the execution result of the above command, denoted as the variable valid_vars. The possible contents in valid_vars are, for example:

[0104] tcp.ack, tcp.ack_raw, tcp.hdr_len, tcp.flags … tcp.flags_tree

[0105] Step 3.2: The "Unreasonable Agreement Level" extraction module for long reasoning. The input of this module is the two-tuple data in the data generated in step 2.2<pcap, pcap_reference_result> The output is the proportion of "unreasonable protocol levels". The extraction process is completed by comparing the list of "network protocol level rules". "Network protocol level rules" are as follows:

[0106] ARP over Ethernet, ARP over PPP, ARP over Wi-Fi, DHCP over UDP, DNSover TCP, DNS over UDP, FTP over TCP, HTTPS over TLS, HTTP over TCP, ICMPover IP, IP over Ethernet, IP over PPP, IP over Wi-Fi, IPv6 over Ethernet,IPv6 over PPP, IPv6 over Wi-Fi, QUIC over UDP, RTP over UDP, SMTP over TCP,SSH over TCP, TCP over IP, TCP over IPv6, TLS over TCP, UDP over IP, UDP overIPv6 …

[0107] Ethernet carries ARP, Ethernet carries IP, Ethernet carries IPv6, PPPcarries ARP, PPP carries IP, PPP carries IPv6, Wi-Fi carries ARP, Wi-Ficarries IP, Wi-Fi carries IPv6, IP carries ICMP, IP carries TCP, IP carriesUDP, IPv6 carries TCP, IPv6 carries UDP, TCP carries DNS, TCP carries FTP,TCP carries HTTP, TCP carries SMTP, TCP carries SSH, TCP carries TLS, TLScarries HTTPS, UDP carries DHCP, UDP carries DNS, UDP carries QUIC, UDPcarries RTP …

[0108] Based on the content of each think's protocol node in the XML output from step 2.1, if it contains a node ID, replace it with the corresponding protocol. For example, if the protocol of a think is "IP carries 6", and the protocol of the think with ID 6 is TCP or "TCP carries HTTP", the replacement result is "IP carries TCP". For the protocol layer description "IP carries TCP", if the same rule cannot be found in the "Network Protocol Layer Rules" list, it is an unreasonable rule. Calculate the ratio of unreasonable rules and record it as invalid_nested_protocol_ratio.

[0109] Step 3.3: Long Reasoning Scoring and Training Module. This module takes as input the outputs of Steps 2.2, 3.1, and 3.2, and outputs a score between 0 and 1. Check whether the content of pcap_reference_result conforms to the XML format defined in Step 2.1, using the value is_valid_format. If it does, the score is 1; if it doesn't, the score is 0. The long reasoning score is calculated using the following formula:

[0110]

[0111]

[0112] It is a decimal between 0 and 1. The larger the value, the greater the influence of the factor in the item.

[0113] Indicates whether it is a valid format, 1 indicates valid, 0 indicates invalid.

[0114] invalid_field_ratio indicates the ratio of unreasonable fields, ranging from 0 to 1. A larger value indicates a higher proportion of unreasonable fields.

[0115] Indicates the ratio of invalid protocol nested formats. The value ranges from 0 to 1. A larger value indicates a higher ratio of invalid protocol nested formats.

[0116] Using GRPO algorithm to calculate LL Mpcap_analysisTraining is carried out, and the reward value of the GPRO algorithm in the optimization process uses the Reward in step 3.3. The GRPO algorithm is a large model optimization algorithm proposed in "DeepSeekMath: Pushing the Limits of Mathematical Reasoning in Open Language Models".

[0117] The GRPO algorithm optimizes the model's parameters according to the reward. The effect after the algorithm acts is to make the model more inclined to produce outputs with high Reward and less likely to produce outputs with low Reward.

[0118] An implementation system for long inference of a network protocol analysis model, including:

[0119] A Pcap packet information extraction device, a Pcap packet long inference synthesis collection device, and a Pcap packet long inference scoring and optimization device.

[0120] The Pcap packet information extraction device inputs the Pcap packet and outputs traffic statistical information, TCP / UDP session information, parsing of protocol content such as HTTP / DNS / TLS, and abnormal behavior information. The output information will be input into the large model in the Pcap packet long inference synthesis collection device for the synthesis of long inference data;

[0121] The input of the Pcap packet long inference synthesis collection device is the extraction information of the Pcap packet, that is, the output information of the "Pcap packet information extraction device"; the output of this device is a set of binary data of <extraction information of the pcap packet, long inference synthesis data>. The output data of this device will be used in the Pcap packet long inference scoring and optimization device for the optimization of the model's long inference function;

[0122] The Pcap packet long inference scoring and optimization device. The input of this device is a set of data of <extraction information of the pcap packet, long inference synthesis data>, that is, the output information of the Pcap packet long inference synthesis collection device; the output of this device is a trained network protocol long inference model.

[0123] Those skilled in the art will appreciate that, in addition to implementing the system and its various devices, modules, and units provided by the present invention in purely computer-readable program code, it is entirely possible to implement the same functions of the system and its various devices, modules, and units provided by the present invention in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers by logically programming the method steps. Therefore, the system and its various devices, modules, and units provided by the present invention can be considered a hardware component, and the devices, modules, and units included therein for implementing various functions can also be considered as structures within the hardware component; the devices, modules, and units for implementing various functions can also be considered as both software modules implementing the method and structures within the hardware component.

[0124] The above describes specific embodiments of the present invention. It should be understood that the present invention is not limited to the specific embodiments described above, and those skilled in the art may make various changes or modifications within the scope of the claims, which do not affect the essence of the present invention. The embodiments of this application and the features in the embodiments may be combined with each other in any manner unless there is a conflict.

Claims

1. A system for implementing long-term reasoning of a network protocol analysis model, characterized in that: include: Pcap packet information extraction device, used for extracting relevant information from the input Pcap packet and outputting it; The relevant information includes traffic statistics, TCP / UDP session information, HTTP / DNS / TLS protocol content analysis and abnormal behavior information; A Pcap packet length reasoning synthesis collection device is used to process the relevant information output by the Pcap packet information extraction device and output a data set; The data set includes a set of binary data of the extracted information of the pcap package and the long reasoning synthetic data; A Pcap packet length inference scoring and optimization device, which inputs the data set and outputs a trained network protocol length inference model; The Pcap packet length reasoning scoring and optimization device includes: The unreasonable protocol field extraction module for long reasoning takes as input the binary data in the long reasoning synthetic data set and outputs the proportion of unreasonable protocol fields. The unreasonable protocol level extraction module for long reasoning takes as input the binary data in the long reasoning synthetic data set and outputs the ratio of unreasonable protocol levels. The long inference scoring and training module inputs the bigrams, unreasonable protocol field ratio, and unreasonable protocol level ratio from the long inference synthetic data set, and outputs a score between 0 and 1; The input of the unreasonable protocol layer extraction module of the long reasoning is the two-tuple {pcap, pcap_reference_result}, and the extraction process is completed by comparing the network protocol layer rule list; The long reasoning scoring and training module includes checking whether the content of pcap_reference_result conforms to the XML format defined by the Pcap packet long reasoning prompt word preparation module, which is recorded as is_valid_format. If it conforms, it is 1, and if it does not conform, it is 0. The long reasoning score is calculated according to the following formula: in, ; It is a decimal between 0 and 1. Indicates whether it is a valid format, 1 indicates valid, 0 indicates invalid; invalid_field_ratio indicates the ratio of unreasonable fields, ranging from 0 to 1, the larger the value, the higher the proportion of unreasonable fields; Indicates the ratio of invalid protocol nested formats, with a value ranging from 0 to 1. A larger value indicates a higher ratio of invalid protocol nested formats. Using GRPO algorithm to analyze LLM pcap_analysis During training and optimization, the reward value of the GPRO algorithm uses the long inference score and the reward of the training module.

2. The long inference implementation system of the network protocol analysis model according to claim 1 is characterized in that: Described Pcap packet information extraction device comprises: Traffic statistics extraction module, used to extract the statistical information of the flow of pcap packets; TCP / UDP session extraction module, used to extract TCP / UDP session information in pcap packets; HTTP / DNS / TLS payload information extraction module, used to extract HTTP / DNS / TLS payload information in pcap packets; The network abnormal behavior information extraction module is used to extract network abnormal information in the pcap package.

3. The long inference implementation system of the network protocol analysis model according to claim 2 is characterized in that: The output information of the traffic statistics extraction module includes the total traffic size, number of packets, statistics of each IP, protocol distribution, port distribution and traffic timing; The output information of the TCP / UDP session extraction module includes TCP three-way handshake success rate, packet loss rate, retransmission rate, whether there is a reset anomaly, UDP session request-response success rate, TLS handshake success rate and whether there is an abnormal alert detection; The output information of the HTTP / DNS / TLS load information extraction module includes HTTP target, User-Agent, Host, error rate, DNS resolution domain name, TLS encryption algorithm and whether there is a certificate anomaly; The output information of the network abnormal behavior information extraction module includes whether there is scanning, whether there is DDOS, and TLS certificate forgery.

4. The long inference implementation system of the network protocol analysis model according to claim 2, characterized in that: Also includes: The information summary module records all the extracted information texts and forms a tuple with the original pcap package; The tuple includes {pcap package, extract_info}, wherein extract_info is the extraction information corresponding to the pcap package.

5. The long inference implementation system of the network protocol analysis model according to claim 4 is characterized in that: The Pcap packet length reasoning synthesis collection device includes: The Pcap packet length inference prompt word preparation module inputs the two-tuple to form a prompt word data set; The long inference data synthesis module calls a large language model, inputs the corresponding prompt words into the large language model one by one, and obtains the long inference synthetic data set output by the model; Each element in the long reasoning synthetic data set is a two-tuple.

6. The long inference implementation system of the network protocol analysis model according to claim 5, characterized in that: The input of the Pcap packet length inference prompt word preparation module is the prompt word composed of extract_info in the output binary tuple of the information summary module to form a prompt word dataset, and each record in the data is a binary tuple {pcap, pcap_reference_prompt}, where pcap_reference_prompt is the prompt word corresponding to pcap; The large language models called by the long reasoning data synthesis module include deepseek and Qwen, denoted as LLM pcap_analysis , input the pcap_reference_prompt part in the prompt word dataset into the large language model one by one, obtain the long inference output by the model, and form a long inference synthetic data set; each element in the data set is a two-tuple {pcap, pcap_reference_result}.

7. The long inference implementation system of the network protocol analysis model according to claim 1 is characterized in that: The input of the unreasonable protocol field extraction module of the long reasoning is the tuple {pcap, pcap_reference_result}, and the output is the ratio of unreasonable protocol fields; the reasonable protocol fields contained in the pcap are recorded as the variable valid_vars, and the characters in the form of protocol.field in pcap_reference_result are extracted through regular expressions. The protocol fields that do not exist in valid_vars are unreasonable fields, and the rest are reasonable fields; the ratio of unreasonable fields is calculated and recorded as invalid_field_ratio.

8. A method for implementing long-term inference of a network protocol analysis model, using the system for implementing long-term inference of a network protocol analysis model according to any one of claims 1 to 7, characterized in that: include: Step S1: extracting traffic statistics, TCP / UDP session information, HTTP / DNS / TLS protocol content analysis and abnormal behavior information from the input Pcap packet through the Pcap packet information extraction device; Step S2: Use the Pcap packet length reasoning synthesis collection device to process the above information and generate a two-tuple {pcap, pcap_reference_result} containing long reasoning synthesis data; Step S3: The long inference synthetic data is scored and optimized by the Pcap packet long inference scoring and optimization device, and finally a trained network protocol long inference model is output.

Images