A protocol analysis method, device and medium based on multi-agent cooperation

Abstract

The application discloses a protocol analysis method and device based on multi-agent cooperation and a medium, and belongs to the technical field of industrial internet. The method comprises the following steps: constructing and associating a distributed agent cluster and a global protocol knowledge base; preprocessing an original internet of things protocol based on an analysis agent to generate a protocol analysis task package; processing the protocol analysis task package based on a scheduling agent to distribute the protocol analysis task package to a target analysis agent; performing feature extraction and protocol analysis on the analysis task package by the analysis agent, and outputting structured analysis data; if an unknown protocol format is identified, the unknown protocol format is extracted and sent to a management agent; the unknown feature vector is processed by the management agent to determine a new protocol analysis rule of the unknown protocol format, and the new protocol analysis rule is synchronized to the global protocol knowledge base. The application realizes the technical effect of efficient dynamic analysis and adaptation of industrial internet of things protocols through the above method.

Description

Technical Field

[0001] The present application relates to the technical field of industrial Internet, and in particular to a protocol parsing method, device and medium based on multi-agent collaboration. Background Art

[0002] The Industrial Internet of Things (IIoT) interconnects devices and systems through various communication protocols. Common industrial protocols include MQTT, CoAP, and Modbus. Existing technologies primarily employ centralized protocol parsing architectures, relying on predefined rule bases to standardize device data. These solutions match data fields using manually configured protocol templates or utilize fixed parsing pipelines to extract device status information. This model requires a complete predefined protocol structure and a parsing rule base covering all known protocol types to function effectively.

[0003] Therefore, existing technologies face the constant emergence of proprietary or non-standard protocols in industrial settings, and static rule bases are unable to automatically identify unknown protocol formats. Manual intervention is required to modify the parsing code and restart the service, resulting in interruptions to device access processes, which can seriously impact the flexibility and real-time performance of production systems. Centralized architectures are prone to task blocking due to uneven distribution of computing resources when processing large amounts of concurrent protocol data. Protocol rule updates require a complete replacement of the parsing engine, and poor cross-vendor device compatibility can lead to cumbersome adaptation efforts.

[0004] Therefore, how to achieve efficient dynamic parsing and adaptation of industrial Internet of Things protocols has become a technical problem that needs to be solved urgently. Summary of the Invention

[0005] The embodiments of the present application provide a protocol parsing method, device, and medium based on multi-agent collaboration to solve the following technical problem: how to achieve efficient dynamic parsing and adaptation of industrial Internet of Things protocols.

[0006] In the first aspect, an embodiment of the present application provides a protocol parsing method based on multi-agent collaboration, which is applied to industrial Internet of Things devices, and the method includes: constructing and associating a distributed agent cluster and a global protocol knowledge base; wherein, the distributed agent cluster includes a parsing agent, a scheduling agent and a management agent, and the global protocol knowledge base is used to store the parsing rules of known industrial Internet of Things protocols; obtaining the original Internet of Things protocol of the industrial Internet of Things device, and pre-processing the original Internet of Things protocol based on the parsing agent to generate a protocol parsing task package; wherein, the protocol parsing task package can be recognized by the distributed agent cluster; processing the protocol parsing task package based on the scheduling agent to assign the protocol parsing task package to the target parsing agent; performing feature extraction and protocol parsing on the parsing task package by the parsing agent, and outputting structured parsing data; wherein, the structured parsing data is a formatted format of the industrial Internet of Things device status information; if the parsing agent identifies an unknown protocol format during feature extraction and protocol parsing, the unknown protocol format is feature extracted, and the extracted unknown feature vector is sent to the management agent; processing the unknown feature vector by the management agent to determine a new protocol parsing rule for the unknown protocol format, and synchronizing the new protocol parsing rule to the global protocol knowledge base.

[0007] In one implementation of the present application, a distributed agent cluster and a global protocol knowledge base are constructed and associated, specifically including: deploying a lightweight parsing engine and loading a basic parsing rule set to construct multiple parsing agents; wherein, the basic parsing rule set includes at least: an MQTT protocol function code mapping table, a CoAP protocol option header parsing tree, and a Modbus register address conversion rule; deploying a load monitoring probe component to construct a scheduling agent including an agent load status table; wherein, the agent load status table is used to continuously record the CPU utilization, memory occupancy, and historical parsing accuracy of multiple parsing agents; initializing the global protocol knowledge base, and deploying a neural network incremental learning module to generate a management agent; wherein, the neural network incremental learning module includes a convolutional neural network layer and a back-propagation weight updater; associating the interfaces of the parsing agent, the scheduling agent, and the management agent to construct a distributed agent cluster, and associating the distributed agent cluster with the global protocol knowledge base.

[0008] In one implementation of the present application, the original IoT protocol of the industrial IoT device is obtained, and the original IoT protocol is preprocessed based on the parsing agent to generate a protocol parsing task package, specifically including: calling the protocol feature template in the global protocol knowledge base based on the parsing agent, matching the protocol type of the original IoT protocol to generate a grouped protocol data set; sharding the grouped protocol data set through the parsing agent to generate a standardized data shard set; and converting the format of the standardized data shard set through the parsing agent to generate a protocol parsing task package that can be recognized by the agent cluster.

[0009] In one implementation of the present application, the protocol parsing task package is processed based on the scheduling agent to allocate the protocol parsing task package to the target parsing agent, specifically including: parsing the protocol type of the protocol parsing task package through the scheduling agent; screening the parsing agents that support the protocol type based on the agent load status table to build a set of candidate parsing agents; calculating the execution load balancing scores of multiple parsing agents in the candidate parsing agent set based on the CPU utilization and memory occupancy of the candidate parsing agent set to generate a load score value set; and allocating the protocol parsing task package to the target parsing agent based on the load score value set and the preset historical parsing accuracy.

[0010] In one implementation of the present application, a parsing agent is used to perform feature extraction and protocol parsing on a parsing task package, and output structured parsing data, specifically including: performing field parsing on the parsing task package by a parsing agent to extract a key feature set of the parsing task package; wherein the key feature set includes a protocol version number, a function code, and a data length; performing protocol parsing on the key feature set by a lightweight parsing engine of the parsing agent to generate an intermediate parsing result set; and verifying the intermediate parsing result set by the parsing agent to generate structured parsing data.

[0011] In one implementation of the present application, if the parsing agent identifies an unknown protocol format during feature extraction and protocol parsing, the unknown protocol format is feature extracted and the extracted unknown feature vector is sent to the management agent, specifically including: when the key feature set does not match the parsing rules in the global protocol knowledge base, it is determined to be an unknown protocol format; feature vector extraction is performed on the unknown protocol format to generate an unknown feature vector containing the protocol header identifier, data length and check bit; and the unknown feature vector is sent to the management agent.

[0012] In one implementation of the present application, unknown feature vectors are processed by a management agent to determine new protocol parsing rules for unknown protocol formats, and the new protocol parsing rules are synchronized to a global protocol knowledge base, specifically including: receiving unknown feature vectors through a management agent; inputting unknown feature vectors into a preset convolutional neural network model for incremental learning to generate new protocol parsing rules; and writing the new protocol parsing rules into an unidentified protocol storage area of ​​the global protocol knowledge base.

[0013] In one implementation of the present application, after processing unknown feature vectors through a management agent to determine new protocol parsing rules for unknown protocol formats and synchronizing the new protocol parsing rules to a global protocol knowledge base, the method further includes: sending a protocol type agent mapping relationship update instruction to a scheduling agent through a management agent to update the agent load status table; and sending a lightweight parsing engine rule update instruction to a parsing agent through a management agent.

[0014] In a second aspect, the embodiments of the present application further provide an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the protocol analysis method based on multi-agent cooperation according to any one of the above implementation manners when executing the computer program.

[0015] In a third aspect, the embodiments of the present application further provide a computer-readable storage medium having a computer program stored thereon, wherein the computer program is executed by a processor to implement the protocol analysis method based on multi-agent cooperation according to any one of the above implementation manners.

[0016] The protocol analysis method, device and medium based on multi-agent cooperation provided by the embodiments of the present application at least have the following technical effects:

[0017] By constructing a distributed agent cluster composed of analysis agents, scheduling agents and management agents, and combining the cooperative working mechanism of the global protocol knowledge base, dynamic analysis and adaptation of massive industrial Internet of Things protocols are realized. The management agent automatically generates new protocol analysis rules based on convolutional neural network incremental learning of unknown protocol feature vectors and synchronously updates the global knowledge base, without the need for manual code modification or service interruption. This mechanism enables the present application to have adaptive capability for continuous expansion of protocol types, effectively solves the access problem of private protocols and non-standard protocols in industrial sites, and significantly improves device compatibility.

[0018] The analysis agent performs multi-stage protocol analysis through a lightweight analysis engine, the scheduling agent dynamically allocates tasks based on real-time load status table (CPU utilization, memory occupancy) and historical analysis accuracy, and uses a load balancing scoring algorithm to optimize target analysis agent selection. The distributed architecture avoids single-point performance bottlenecks, and the multi-agent parallel processing mechanism improves protocol analysis throughput. The task allocation strategy takes into account the actual load status of the nodes, ensuring efficient use of resources, thereby enhancing stability and response speed in high-concurrency scenarios.

[0019] The global protocol knowledge base supports centralized management and automatic synchronization of analysis rules, the management agent pushes lightweight engine update instructions to the analysis agent and synchronizes the mapping relationship between protocol types and agents to the scheduling agent. This realizes full-automatic distribution and hot update of new protocol rules, eliminating the need for manual maintenance of the analysis engine. Through autonomous cooperation of the agent cluster, protocol adaptation is completed, reducing enterprise operation and maintenance manpower investment and ensuring the sustainability of long-term operation of the industrial Internet of Things system to a certain extent. BRIEF DESCRIPTION OF DRAWINGS

[0020] The accompanying drawings, which are included to provide a further understanding of the application and are incorporated in and constitute a part of this application, illustrate embodiments of the application and together with the description serve to explain the application. In the drawings:

[0021] Figure 1 A protocol analysis method based on multi-agent cooperation provided by an embodiment of the application is shown in a flowchart.

[0022] Figure 2 An internal structure diagram of a protocol analysis device based on multi-agent cooperation provided by an embodiment of the application. DETAILED DESCRIPTION

[0023] To make the objects, technical solutions and advantages of the application clearer, the technical solutions of the application will be described below in detail with reference to the embodiments of the application and the accompanying drawings. Obviously, the described embodiments are only some of the embodiments of the application, but not all the embodiments of the application. Based on the embodiments in the application, all other embodiments obtained by those skilled in the art without creative work fall within the scope of protection of the application.

[0024] The embodiments of the application provide a protocol analysis method, device and medium based on multi-agent cooperation, to solve the technical problem of how to realize efficient dynamic analysis and adaptation of industrial Internet of Things protocols.

[0025] The technical solutions of the embodiments of the application will be described in detail below with reference to the accompanying drawings.

[0026] Figure 1 A protocol analysis flowchart based on multi-agent cooperation provided by an embodiment of the application is shown in FIG. 1. As shown in FIG. 1, the protocol analysis method based on multi-agent cooperation provided by an embodiment of the application specifically includes the following steps. Figure 1

[0027] Step 1, constructing and associating a distributed agent cluster and a global protocol knowledge base; wherein the distributed agent cluster includes an analysis agent, a scheduling agent and a management agent, and the global protocol knowledge base is used to store analysis rules of known industrial Internet of Things protocols.

[0028] This step is used to create a distributed cluster composed of three types of agents (analysis agent, scheduling agent and management agent) and establish a global protocol knowledge base. The global protocol knowledge base stores analysis rules of known industrial Internet of Things protocols (such as MQTT, CoAP and Modbus), and provides a protocol analysis benchmark for the agent cluster.

[0029] ​Step 1.1. Deploy a lightweight parsing engine and load the basic parsing rule set to build multiple parsing agents; the basic parsing rule set includes at least: MQTT protocol function code mapping table, CoAP protocol option header parsing tree, and Modbus register address conversion rules.

[0030] Lightweight parsing engine: A low-resource protocol parsing core module that can quickly process binary protocol data streams.

[0031] The basic parsing rule set is a predefined protocol parsing template, including:

[0032] MQTT protocol function code mapping table: maps MQTT message types (such as CONNECT / PUBLISH) to corresponding control instructions.

[0033] CoAP protocol option header parsing tree: parses the CoAP protocol option header field (such as URI path, content format) in a tree structure.

[0034] Modbus register address conversion rules: Convert a Modbus register address (such as 40001) to an actual data point (such as motor speed).

[0035] Deploy a parsing engine instance on the server node, load the above rule set, and generate multiple parsing agents that can work in parallel.

[0036] In a specific example, Factory A needs to connect 10 devices B (using the Modbus protocol) and 5 devices C (using the MQTT protocol). The system administrator deploys a lightweight parsing engine on three nodes in the server cluster, loading it with Modbus register address conversion rules (for example, register 40001 corresponds to "motor speed") and an MQTT function code mapping table (for example, PUBLISH messages correspond to "data reporting"). Each node generates two parsing agent instances, for a total of six parsing agents, forming an initial parsing capability pool.

[0037] Step 1.2: Deploy a load monitoring probe component to build a scheduling agent including an agent load status table; wherein the agent load status table is used to continuously record the CPU utilization, memory occupancy, and historical parsing accuracy of multiple parsing agents.

[0038] Load monitoring probe component: A lightweight monitoring program embedded in the parsing agent to collect performance indicators in real time.

[0039] Agent load status table: database table structure, records the following indicators:

[0040] CPU Utilization: The real-time CPU usage percentage of the parsing agent process.

[0041] Memory Usage: Peak memory usage of the parsing agent process.

[0042] Historical parsing accuracy: This is the statistical value of the accuracy of protocol parsing tasks for a certain number of times in the past. This certain number is usually set to more than 50 times.

[0043] Deploy the scheduling agent on the scheduling server, integrate the load monitoring probe component and create the agent load status table, and continuously receive and analyze the performance data of the agent.

[0044] Continuing with the example from step 1.1, the scheduling agent is deployed on a separate node. The load monitoring probe component is embedded in six parsing agents, collecting CPU and memory data every five seconds (for example, Agent 1's CPU utilization is 45% and its memory usage is 120MB). Historical parsing accuracy is calculated using a checksum (for example, if the number of parsing attempts is set to 100, and Agent 2's last 100 parsing attempts have an accuracy of 98%, Agent 1, if it has fewer than 100 attempts, will calculate based on the actual number of attempts, resulting in a parsing accuracy of 95%). The scheduling agent writes this data into the agent load status table, which forms the basis for its decision-making.

[0045] Step 1.3: Initialize the global protocol knowledge base and deploy a neural network incremental learning module to generate a management agent; the neural network incremental learning module includes a convolutional neural network layer and a back-propagation weight updater.

[0046] Initialize the global protocol knowledge base and preset the parsing rules of known industrial Internet of Things protocols, deploy the management agent on the management node, and bind the neural network incremental learning module.

[0047] Global protocol knowledge base: a distributed database (such as a Redis cluster) that stores protocol rule sets.

[0048] The neural network incremental learning module consists of two core components:

[0049] Convolutional neural network layer: extracts spatial features of protocol data (such as byte distribution patterns).

[0050] Backpropagation Weight Updater: Dynamically adjusts network weights based on prediction errors to adapt to new protocol characteristics.

[0051] Continuing with the example from step 1.2, Factory A's global protocol knowledge base is initialized with parsing rules for MQTT, CoAP, and Modbus. The management agent is deployed on a dedicated node, and its neural network incremental learning module is pre-trained with industrial protocol features (such as the fixed header length of Modbus data frames). When encountering an unknown protocol, the convolutional layer automatically extracts its byte distribution characteristics (such as the high frequency of 0x10-0x20), and the backpropagation weight updater adjusts the weights based on the predictions.

[0052] Step 1.4: Associate the interfaces of the parsing agent, the scheduling agent, and the management agent to build a distributed agent cluster, and associate the distributed agent cluster with the global protocol knowledge base.

[0053] Interface association: The communication interfaces of the three types of intelligent agents are connected through interfaces (such as REST API) and message queues (such as Kafka).

[0054] Bidirectional data synchronization channel: The distributed agent cluster can query the protocol rules of the global protocol knowledge base in real time (such as parsing agent request Modbus rules), and the global protocol knowledge base receives and manages the rule updates of the agent (such as the addition of LoRaWAN protocol parsing rules).

[0055] Configure API gateway and message middleware to establish communication links between intelligent entities and data channels between clusters and knowledge bases.

[0056] Continuing with the example from step 1.3, in the system of Factory A:

[0057] The parsing agent sends task requests to the scheduling agent via a message queue. The scheduling agent queries the knowledge base for a list of supported protocols through an interface. The management agent updates the global protocol knowledge base with newly learned protocol rules (such as device D's proprietary protocol) via message broadcasts. The parsing agent subscribes to update notifications from the global protocol knowledge base, allowing it to load new rules in real time.

[0058] Step 2: Obtain the original IoT protocol of the industrial IoT device and pre-process the original IoT protocol based on the parsing agent to generate a protocol parsing task package; wherein the protocol parsing task package can be recognized by the distributed agent cluster.

[0059] This step is used to implement standardized preprocessing of the original protocol data, converting the binary protocol stream generated by the IoT device into a unified format task package that can be processed by the distributed intelligent agent cluster, providing standardized input for subsequent parsing.

[0060] Step 2.1: Based on the parsing agent, the protocol feature template in the global protocol knowledge base is called to match the protocol type of the original IoT protocol to generate a grouped protocol dataset.

[0061] Protocol feature template: a set of protocol identification rules stored in the global protocol knowledge base;

[0062] The protocol feature templates include:

[0063] Header signature: protocol start flag byte sequence (such as 0x0001 in Modbus).

[0064] Length field position: The byte offset that identifies the length of the data.

[0065] Check digit rules: the location and calculation method of checksum algorithms such as CRC / MD5.

[0066] The parsing agent reads the protocol feature template and scans the feature area of ​​the original protocol data for matching.

[0067] In a specific example, sensor C in factory A continuously sends a binary data stream: [0x010x030x000x0A...]. The parsing agent calls the protocol feature template in the global protocol knowledge base:

[0068] Match header signature: 0x01 corresponds to the Modbus function code "read holding register";

[0069] Verification length field: The 3rd to 4th bytes 0x000A represent the following 10 bytes of valid data;

[0070] Check digit verification: The last 2 bytes comply with the Modbus CRC16 rule;

[0071] After a successful match, the data stream is marked as a "Modbus-03 command" group and a group protocol data set is generated.

[0072] Step 2.2: Slice the packet protocol dataset using a parsing agent to generate a standardized data slicing set.

[0073] Data sharding: Cutting the complete protocol data stream into fixed-size processing units.

[0074] Sharding rules:

[0075] Fixed-byte sharding: Each shard contains fixed-byte data, for example, 1024 bytes.

[0076] Protocol unit fragmentation: fragmentation based on complete protocol instructions (e.g. Modbus uses a 6-byte instruction header as a unit).

[0077] The parsing agent selects a sharding strategy based on the protocol type to ensure that single-piece data can be parsed independently.

[0078] Continuing with the example from step 2.1, the parsing agent uses protocol unit sharding to process the Modbus data from sensor C:

[0079] Identify the instruction unit: 0x01 0x03 0x00 0x0A 0x00 0x02 is a complete read instruction (6 bytes header and 4 bytes data).

[0080] Split data stream: split [0x010x03...] into multiple independent instruction units.

[0081] Generate a set of slices: each slice contains the complete byte sequence of a single instruction.

[0082] For the long CoAP message (1500 bytes) sent by device D, fixed 1024-byte fragmentation is used to ensure that a single fragment does not exceed the processing limit.

[0083] Step 2.3: Convert the format of the standardized data shard set through the parsing agent to generate a protocol parsing task package that can be recognized by the agent cluster.

[0084] Format conversion: unify the storage structure and metadata of sharded data.

[0085] Format conversion rules:

[0086] Byte order standardization: unified conversion to Big-Endian.

[0087] Metadata encapsulation: add header information such as protocol type, fragment sequence number, and timestamp.

[0088] Padding alignment: If the fragment is less than a certain number of bytes, it will be padded with bytes for alignment. For example, if the fragment is less than 128 bytes, it will be padded with 0x00 until it is aligned.

[0089] The parsing agent performs format conversion and encapsulates it into a task package object.

[0090] Continuing with the example from step 2.2, in the system of Factory A:

[0091] Byte order conversion: Convert the little-endian data (0x0A00) sent by device E to big-endian data (0x000A).

[0092] Add metadata: Add header information to each shard.

[0093] The format is as follows: [Protocol type: Modbus][Slice ID: 0003][Timestamp: 2025-05-15 14:05:32][Data: 0x010x03...].

[0094] Padding alignment: Fill 98-byte segments with 30 bytes of 0x00.

[0095] Finally, a standardized protocol parsing task package is generated and sent to the scheduling agent through the message queue.

[0096] Step 3: Process the protocol parsing task package based on the scheduling agent to allocate the protocol parsing task package to the target parsing agent.

[0097] This step implements intelligent scheduling of protocol parsing tasks. According to the protocol type and agent load status, the optimal parsing agent is dynamically selected to perform the task to ensure system load balancing and efficient parsing.

[0098] Step 3.1: The protocol type of the task package is parsed by the scheduling agent parsing protocol.

[0099] Protocol type parsing: extract the protocol identifier from the task packet header information.

[0100] The identifier types are:

[0101] Digital code: such as 01-Modbus, 02-CoAP, 03-MQTT;

[0102] Characteristic hash value: MD5 digest value of the protocol header bytes.

[0103] The scheduling agent reads the metadata header of the task packet and decodes the protocol type identifier.

[0104] In a specific example, the scheduling agent of factory A receives a task package, which is:

[0105] Parsing packet header: [Protocol type: 0x4D42][Fragment ID: 0057][...];

[0106] Decoding type: 0x4D42 corresponds to the "Modbus-RTU" protocol registered in the knowledge base;

[0107] Tag attribute: Identified as an industrial control protocol, requiring high priority processing.

[0108] Step 3.2: Filter the parsing agents that support the protocol type based on the agent load status table to build a candidate parsing agent set.

[0109] Agent load status table: a database table updated in real time, for example:

[0110] Agent ID; CPU utilization; memory usage; supported protocols list; historical accuracy.

[0111] Parsing agent 01; 45%; 120MB; 01,03; 98.7%.

[0112] Filtering rules:

[0113] Protocol support matching: The supported protocol list includes the current protocol type.

[0114] Health status check: manually set thresholds, such as CPU < 80% and memory < threshold (such as 500MB).

[0115] The scheduling agent queries the load status table and filters the agents that meet the conditions.

[0116] Continue with the example from step 3.1:

[0117] Query the load table: There are currently 8 parsing agents online.

[0118] Protocol matching: Filter the agents whose supported protocols include 0x4D42 (Modbus-RTU) (parse agent 02 / 05 / 07).

[0119] Health check: Exclude parsing agent 07 with CPU>80% (currently 85%).

[0120] Final candidate set: Parsing Agent 02 (CPU 62% / Memory 180MB), Parsing Agent 05 (CPU 57% / Memory 210MB).

[0121] Step 3.3: Based on the CPU utilization and memory occupancy of the candidate parsing agent set, calculate the execution load balancing scores of multiple parsing agents in the candidate parsing agent set to generate a load score value set.

[0122] The load rating formula is:

[0123] Score = α × (1-CPU utilization) + β × (1-memory usage / memory threshold).

[0124] Where α+β=1 (in this application, α=0.6, β=0.4 by default).

[0125] It is understandable that the weights of α and β can be dynamically adjusted to adapt to the system state, for example:

[0126] When the overall system load is > 70%, increase the CPU weight (α=0.8);

[0127] When the memory fragmentation rate is >30%, increase the memory weight (β=0.7).

[0128] The scheduling agent calculates the score of each agent in the candidate set in real time.

[0129] Continuing with the example from step 3.2, the scheduling agent of factory A calculates:

[0130] The thresholds are set as: memory threshold = 500MB, α = 0.6, and β = 0.4.

[0131] Analyzing the score of Agent 02: 0.6×(1-0.62)+0.4×(1-180 / 500)=0.6×0.38+0.4×0.64=0.228+0.256=0.484.

[0132] Analytical score of Agent 05: 0.6×(1-0.57)+0.4×(1-210 / 500)=0.6×0.43+0.4×0.58=0.258+0.232=0.490.

[0133] Generated scoring set: Parsing Agent 02 = 0.484, Parsing Agent 05 = 0.490.

[0134] Step 3.4: Based on the load score value set and the preset historical parsing accuracy, assign the protocol parsing task package to the target parsing agent.

[0135] The allocation rules are manually set, for example:

[0136] Select agents with a score ≥ 0.4 (to avoid overloading nodes). Among the qualified agents, select the one with the highest historical accuracy. If the accuracy difference is < 1%, select the one with a higher score.

[0137] Push the task package to the target parsing agent through the task queue.

[0138] Continuing with the example in step 3.3, in the system of Factory A:

[0139] Standard check: Analytical agent 02 (0.484) and analytical agent 05 (0.490) are both ≥ 0.4;

[0140] Accuracy comparison: Historical accuracy of analytical agent 02 = 98.2%, historical accuracy of analytical agent 05 = 97.8%.

[0141] Decision: Select parsing agent 02 with higher accuracy.

[0142] Task allocation: Push the task package to the exclusive queue of parsing agent 02.

[0143] Step 4: Perform feature extraction and protocol analysis on the parsing task package through the parsing agent, and output structured parsing data; wherein, the structured parsing data is the formatted format of the industrial Internet of Things device status information.

[0144] This step is used to achieve accurate parsing of protocol data, convert standardized task packages into structured device status data, and provide directly usable information for the Industrial Internet of Things platform.

[0145] Step 4.1: Perform field parsing on the parsing task package through the parsing agent to extract the key feature set of the parsing task package; wherein the key feature set includes the protocol version number, function code and data length.

[0146] Field parsing: disassemble and parse the hierarchical structure of the task package according to the protocol specifications.

[0147] The key feature set includes the following information:

[0148] Protocol version number: Identifies the version of the protocol specification (e.g., Modbus TCP v1.0);

[0149] Function code: Defines the operation type (e.g., 03 - Read Holding Registers, 06 - Write Single Register);

[0150] Data length: Number of bytes of the payload;

[0151] The parsing agent locates the position of the feature field according to the protocol structure template.

[0152] In a specific example, the parsing agent of Factory A processes the task package of Device E:

[0153] Locate the field position:

[0154] Bytes 0-1: Protocol version number (0x0100 → v1.0);

[0155] Byte 2: Function code (0x03 → Read Holding Registers);

[0156] Bytes 3-4: Data length (0x0008 → 8 bytes).

[0157] Step 4.2, Protocol parsing of the key feature set by the lightweight parsing engine of the parsing agent to generate the intermediate parsing result set.

[0158] Lightweight parsing engine: Embedded parsing core;

[0159] The lightweight parsing engine includes:

[0160] Rule matcher: Calls the corresponding parsing template according to the function code;

[0161] Data converter: Conversion logic from raw bytes to physical values.

[0162] The intermediate parsing result set includes:

[0163] Raw data segment: Unprocessed binary payload;

[0164] Conversion marker: Identifies complex fields that require collaborative processing.

[0165] Continue the example of Step 4.1:

[0166] Rule matching: Function code 03 triggers the "Read Holding Registers" template.

[0167] Data conversion:

[0168] Address resolution: Bytes 5-6 (0x0001 → Register 40001);

[0169] Value conversion: bytes 7-8 (0x1388 -> 5000 rpm).

[0170] Step 4.3, verify the intermediate parsing result set by the parsing agent to generate structured parsing data.

[0171] The verification mechanism includes:

[0172] Checksum verification: for example, recalculate CRC / MD5 and compare with the trailer check bits.

[0173] Value range verification: check if the data is within a reasonable range (e.g. 0-8000 rpm).

[0174] Structured parsing data: converted to standard JSON format in this application, including: device ID, timestamp, state parameter key-value pair.

[0175] Continue the case in step 4.2, in the system of factory A:

[0176] Checksum verification: recalculate CRC16 = 0x4B29, match trailer 0x4B29, then the result is passed,

[0177] Value range verification: 5000 rpm is within the reasonable range of 0-8000 rpm for the motor, then the result is passed.

[0178] Generate structured data.

[0179] Step 5, if the parsing agent identifies an unknown protocol format in feature extraction and protocol parsing, extract the unknown protocol format, and send the extracted unknown feature vector to the management agent.

[0180] This step is used to realize the automatic identification and feature extraction of unknown protocols, provide data basis for dynamic learning of protocol rules, and solve the protocol adaptation problem of new device access in industrial scenarios.

[0181] Step 5.1, when the key feature set does not match the parsing rules in the global protocol knowledge base, it is determined as an unknown protocol format.

[0182] Matching determination mechanism: compare the extracted key features (version number / function code / data length) with the parsing rules of the global protocol knowledge base one by one, and all core features must be completely matched.

[0183] Among them, there are many failure scenarios, simple examples are as follows:

[0184] Version number not registered (such as v2.5 not in v1.0-2.0 range);

[0185] Function code has no corresponding operation (such as 0x89 has no definition);

[0186] Data length exception (e.g. actual length > declared length).

[0187] In one specific case, factory A accesses a new device G:

[0188] First, extract the feature set of the new device G:

[0189] Version number: v2.5;

[0190] Function code: 0x89;

[0191] Data length: 120.

[0192] Match the above feature set with the parsing rules in the global protocol knowledge base, and find:

[0193] Version v3.2 is not registered (maximum support v2.3);

[0194] Function code 0x89 has no corresponding operation;

[0195] Data length 120 exceeds threshold 100.

[0196] Decision: Unknown protocol format (three features match failed).

[0197] Step 5.2, extract the feature vector of the unknown protocol format to generate an unknown feature vector containing the protocol header identification, data length and check bit.

[0198] Feature vector structure extraction example:

[0199] Feature type; extraction method; example;

[0200] Header identification; take the first 16 bytes hash value; SHA256 ("0x100xA3...") to hash value "f8d2...";

[0201] Data length; count the number of payload bytes; 120 bytes;

[0202] Check bit; locate and extract the check segment; last 4 bytes 0x3B29C1D0;

[0203] Byte distribution; calculate 0x00-0xFF frequency; [0x10:12%, 0x20:8%...].

[0204] Continue the case of step 5.1:

[0205] Header identification extraction: intercept the first 16 bytes as 0x100xA30x02...0xF1, generate SHA256 hash: "d4e5f6...".

[0206] Data length verification:

[0207] Declaration length: 120 bytes;

[0208] Actual payload: 118 bytes (including 2 bytes of padding).

[0209] Check digit extraction:

[0210] Locate the 4 bytes at the end of the packet: 0x3B 0x29 0xC1 0xD0;

[0211] Byte distribution analysis:

[0212] Count the frequency of occurrence of each byte;

[0213] Generate distribution matrix: {0x10:15,0x20:9,...};

[0214] Generate unknown feature vector: d4e5f6...;118;0x3B29C1D0;[15,9,....].

[0215] Step 5.3: Send the unknown feature vector to the management agent.

[0216] The sending method can be set according to the actual situation. In this application, the message queue transmission method is adopted, such as sending through Kafka / RabbitMQ.

[0217] It should be noted that the present application sets a priority tag when sending the position feature vector, and the priority tag is determined according to the device type.

[0218] Step 6: Process the unknown feature vectors through the management agent to determine the new protocol parsing rules for the unknown protocol format, and synchronize the new protocol parsing rules to the global protocol knowledge base.

[0219] This step is used to achieve intelligent learning and rule generation for unknown protocols, analyze protocol features through neural networks, dynamically expand the system's parsing capabilities, and solve the problem of private protocol adaptation in industrial scenarios.

[0220] Step 6.1: Receive unknown feature vectors through the management agent.

[0221] Corresponding to step 5.3, the management agent continuously monitors and checks the data integrity (CRC check) and source credibility, and processes it according to the device's criticality (high / medium / low). After receiving the data, it unpacks it and stores it in the buffer for processing.

[0222] Step 6.2: Input the unknown feature vector into the preset convolutional neural network model for incremental learning to generate new protocol parsing rules.

[0223] The received unknown feature vector is input into the preset convolutional neural network model, and new protocol parsing rules are generated through incremental learning.

[0224] The convolutional neural network model is pre-trained on a known protocol dataset and can be dynamically updated to accommodate new feature vectors. Incremental learning is achieved through model fine-tuning, avoiding full retraining.

[0225] The convolutional neural network model is a pre-built deep learning model deployed in the computing unit of the management agent. Its structure includes convolutional layers, pooling layers, and fully connected layers, which are used to learn protocol patterns from feature vectors. The model is initialized based on historical protocol data training, and the parameters are stored in the local storage module.

[0226] Incremental learning refers to a learning method in which a model is fine-tuned in small increments based on new feature vectors, rather than retraining the entire model. Specifically, the model adjusts weight parameters based on the input feature vectors to minimize the error rate. The learning process uses online optimization algorithms (such as stochastic gradient descent) to update the model in real time and generate new protocol parsing rules. The rule output format includes text rule files or binary logic descriptions.

[0227] After inputting the feature vector, the convolutional neural network analyzes the vector pattern to match known patterns or identify new features and outputs corresponding rules.

[0228] In a specific case, Factory A's system detected an unknown format that was not recognized by the existing protocol knowledge base. A feature vector was extracted. The management agent received this feature vector via a REST API. The incremental learning module employed a pre-trained convolutional neural network model based on historical HTTP and MQTT protocol data. After inputting the feature vector, the model fine-tuned layer weights to learn new features. The feature vector showed a high frequency of short message sequences, which the model inferred corresponded to a real-time streaming protocol format. New protocol parsing rules were then generated to handle the chunked transmission field.

[0229] Step 6.3: Write the new protocol parsing rule into the unidentified protocol storage area of ​​the global protocol knowledge base.

[0230] The management agent writes the generated new protocol parsing rules into a designated area of ​​the global protocol knowledge base, the unrecognized protocol storage area. The write operation is performed through the database interface to ensure that the rules are securely stored and available for synchronous use.

[0231] The management agent calls the storage API of the global agreement knowledge base to write rules in a transactional manner. Transactions refer to atomic operations that ensure write integrity or rollback. The API is defined as a set of standard database commands (such as SQL INSERT or NoSQL PUT) and supports rule format conversion (for example, from text files to database records).

[0232] The unidentified protocol storage area is a dedicated partition in the global protocol knowledge base, which is used to temporarily store newly identified rules and migrate them to the main library after subsequent verification.

[0233] This application also includes the following methods:

[0234] A1. Send a protocol type agent mapping relationship update instruction to the scheduling agent through the management agent to update the agent load status table.

[0235] In a specific example, a vibration sensor protocol, N, was newly added to the system at Factory A. The management agent detected the addition of this protocol to the global protocol knowledge base and, after querying the load status table, discovered that the CPU usage of agent 09 was only 35%, while the load of the original sensor protocol processing agent, agent 03, had reached 80%. The management agent generated an update instruction, "Bind protocol N to agent 09, high priority," and sent it to the scheduling agent via a message queue. Upon receiving the instruction, the scheduling agent updated the mapping index, automatically redirecting protocol N traffic to agent 09 and adding "Protocol C" to agent 09's "Bound Protocol" field.

[0236] A2. Send lightweight parsing engine rule update instructions to the parsing agent through the management agent.

[0237] In a specific example, the system at Plant A needs to handle a newly added emergency broadcast protocol, Protocol Z. The management agent extracts the protocol rules (including the message header flag 0x0101) from the global protocol knowledge base, compiles them into a 32-byte binary fragment recognizable by the lightweight engine, and appends the version number "V1.2" and the checksum 0x3A5B. This is then sent to the parsing agent at Node B via a dedicated data channel. After verification, the parsing agent inserts the rule fragment into the in-memory rule chain header. When the first Protocol Z packet (with header flag 0x0101) arrives, it identifies and extracts the broadcast content field.

[0238] The above is an embodiment of the method proposed in this application. Based on the same inventive concept, the embodiment of this application also provides a protocol parsing device based on multi-agent collaboration, the structure of which is as follows: Figure 2 shown.

[0239] Figure 2 The internal structure diagram of a protocol parsing device based on multi-agent collaboration provided in the embodiment of the present application is shown in FIG. Figure 2 As shown, the equipment includes:

[0240] at least one processor 201;

[0241] and, a memory 202 communicatively coupled to the at least one processor;

[0242] The memory 202 stores instructions that can be executed by at least one processor, and the instructions are executed by the at least one processor 201 to enable the at least one processor 201 to:

[0243] Construct and associate a distributed agent cluster and a global protocol knowledge base; wherein, the distributed agent cluster includes a parsing agent, a scheduling agent and a management agent, and the global protocol knowledge base is used to store the parsing rules of known industrial Internet of Things protocols; obtain the original Internet of Things protocol of the industrial Internet of Things device, and pre-process the original Internet of Things protocol based on the parsing agent to generate a protocol parsing task package; wherein, the protocol parsing task package can be recognized by the distributed agent cluster; process the protocol parsing task package based on the scheduling agent to assign the protocol parsing task package to the target parsing agent; perform feature extraction and protocol parsing on the parsing task package through the parsing agent, and output structured parsing data; wherein, the structured parsing data is the formatted format of the industrial Internet of Things device status information; if the parsing agent recognizes an unknown protocol format during feature extraction and protocol parsing, it extracts the unknown protocol format and sends the extracted unknown feature vector to the management agent; the unknown feature vector is processed by the management agent to determine a new protocol parsing rule for the unknown protocol format, and synchronizes the new protocol parsing rule to the global protocol knowledge base.

[0244] Some embodiments of the present application provide corresponding Figure 1 A non-volatile computer storage medium for protocol parsing based on multi-agent collaboration stores computer executable instructions, wherein the computer executable instructions are set to:

[0245] Construct and associate a distributed agent cluster and a global protocol knowledge base; wherein, the distributed agent cluster includes a parsing agent, a scheduling agent and a management agent, and the global protocol knowledge base is used to store the parsing rules of known industrial Internet of Things protocols; obtain the original Internet of Things protocol of the industrial Internet of Things device, and pre-process the original Internet of Things protocol based on the parsing agent to generate a protocol parsing task package; wherein, the protocol parsing task package can be recognized by the distributed agent cluster; process the protocol parsing task package based on the scheduling agent to assign the protocol parsing task package to the target parsing agent; perform feature extraction and protocol parsing on the parsing task package through the parsing agent, and output structured parsing data; wherein, the structured parsing data is the formatted format of the industrial Internet of Things device status information; if the parsing agent recognizes an unknown protocol format during feature extraction and protocol parsing, it extracts the unknown protocol format and sends the extracted unknown feature vector to the management agent; the unknown feature vector is processed by the management agent to determine a new protocol parsing rule for the unknown protocol format, and synchronizes the new protocol parsing rule to the global protocol knowledge base.

[0246] The various embodiments in this application are described in a progressive manner. Similar portions between the various embodiments can be referenced to each other. Each embodiment focuses on the differences from the other embodiments. In particular, the IoT device and media embodiments are generally similar to the method embodiments, so their description is relatively simple. For relevant portions, refer to the description of the method embodiments.

[0247] The system and medium provided in the embodiments of the present application correspond one-to-one to the method. Therefore, the system and medium also have similar beneficial technical effects to their corresponding methods. Since the beneficial technical effects of the method have been described in detail above, the beneficial technical effects of the system and medium will not be repeated here.

[0248] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0249] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0250] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0251] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0252] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0253] Memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

[0254] Computer-readable media includes permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory computer-readable media (transitory media), such as modulated data signals and carrier waves.

[0255] It should also be noted that the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, commodity, or apparatus that includes a series of elements includes not only those elements but also other elements not explicitly listed, or includes elements inherent to such process, method, commodity, or apparatus. In the absence of further limitations, an element defined by the phrase "comprises a ..." does not exclude the presence of other identical elements in the process, method, commodity, or apparatus that includes the element.

[0256] The above are merely embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application should all be included within the scope of the claims of the present application.

Claims

1. A protocol parsing method based on multi-agent collaboration, characterized in that: Applied to industrial IoT equipment, the method includes: Constructing and associating a distributed agent cluster and a global protocol knowledge base; wherein the distributed agent cluster includes a parsing agent, a scheduling agent, and a management agent, and the global protocol knowledge base is used to store parsing rules for known industrial Internet of Things protocols; Obtaining an original IoT protocol of the industrial IoT device, and preprocessing the original IoT protocol based on the parsing agent to generate a protocol parsing task packet; wherein the protocol parsing task packet can be recognized by a distributed agent cluster; Processing the protocol parsing task packet based on the scheduling agent to distribute the protocol parsing task packet to a target parsing agent; The parsing agent performs feature extraction and protocol parsing on the parsing task package and outputs structured parsing data; wherein the structured parsing data is a formatted format of the industrial Internet of Things device status information; If the parsing agent identifies an unknown protocol format during feature extraction and protocol parsing, it extracts the unknown protocol format and sends the extracted unknown feature vector to the management agent; The unknown feature vector is processed by the management agent to determine a new protocol parsing rule for the unknown protocol format, and the new protocol parsing rule is synchronized to the global protocol knowledge base.

2. A multi-agent collaboration-based protocol parsing method according to claim 1, characterized in that: Build and associate a distributed agent cluster with a global protocol knowledge base, specifically including: Deploy a lightweight parsing engine and load a basic parsing rule set to build multiple parsing agents; wherein the basic parsing rule set includes at least: an MQTT protocol function code mapping table, a CoAP protocol option header parsing tree, and a Modbus register address conversion rule; Deploy a load monitoring probe component to construct a scheduling agent including an agent load status table; wherein the agent load status table is used to continuously record the CPU utilization, memory occupancy and historical parsing accuracy of multiple parsing agents; Initializing the global protocol knowledge base and deploying a neural network incremental learning module to generate a management agent; wherein the neural network incremental learning module includes a convolutional neural network layer and a back-propagation weight updater; The interfaces of the parsing agent, the scheduling agent and the management agent are associated to construct the distributed agent cluster, and the distributed agent cluster is associated with the global protocol knowledge base.

3. A multi-agent collaboration-based protocol parsing method according to claim 1, characterized in that: Obtaining the original IoT protocol of the industrial IoT device and preprocessing the original IoT protocol based on the parsing agent to generate a protocol parsing task package, specifically including: Based on the parsing agent calling the protocol feature template in the global protocol knowledge base, the original Internet of Things protocol is matched with the protocol type to generate a group protocol data set; Slicing the packet protocol data set by the parsing agent to generate a standardized data slicing set; The standardized data segment set is format-converted by the parsing agent to generate a protocol parsing task package that can be recognized by the agent cluster.

4. A multi-agent collaboration-based protocol parsing method according to claim 2, characterized in that: Processing the protocol parsing task packet based on the scheduling agent to distribute the protocol parsing task packet to the target parsing agent specifically includes: Parsing the protocol type of the protocol parsing task packet by the scheduling agent; Filtering parsing agents that support the protocol type based on the agent load status table to construct a candidate parsing agent set; Calculating execution load balancing scores of a plurality of the parsing agents in the candidate parsing agent set based on the CPU utilization and memory occupancy of the candidate parsing agent set to generate a load score value set; Based on the load score value set and the preset historical parsing accuracy, the protocol parsing task package is allocated to the target parsing agent.

5. A multi-agent collaboration-based protocol parsing method according to claim 1, characterized in that: The parsing agent performs feature extraction and protocol parsing on the parsing task package and outputs structured parsing data, specifically including: Performing field parsing on the parsing task packet by the parsing agent to extract a key feature set of the parsing task packet; wherein the key feature set includes a protocol version number, a function code, and a data length; Performing protocol parsing on the key feature set by the lightweight parsing engine of the parsing agent to generate an intermediate parsing result set; The intermediate parsing result set is verified by the parsing agent to generate structured parsing data.

6. A multi-agent collaboration-based protocol parsing method according to claim 1, characterized in that: If the parsing agent identifies an unknown protocol format during feature extraction and protocol parsing, feature extraction of the unknown protocol format is performed, and the extracted unknown feature vector is sent to the management agent, specifically including: When the key feature set does not match the parsing rules in the global protocol knowledge base, it is determined to be an unknown protocol format; Extracting a feature vector from the unknown protocol format to generate an unknown feature vector including a protocol header identifier, data length, and a check bit; Send the unknown feature vector to the management agent.

7. A multi-agent collaboration-based protocol parsing method according to claim 4, characterized in that: Processing the unknown feature vector by the management agent to determine a new protocol parsing rule for the unknown protocol format, and synchronizing the new protocol parsing rule to the global protocol knowledge base, specifically includes: Receiving the unknown feature vector through the management agent; Inputting the unknown feature vector into a preset convolutional neural network model for incremental learning to generate new protocol parsing rules; The new protocol parsing rule is written into the unidentified protocol storage area of ​​the global protocol knowledge base.

8. A multi-agent collaboration-based protocol parsing method according to claim 7, characterized in that: After the management agent processes the unknown feature vector to determine a new protocol parsing rule for the unknown protocol format and synchronizes the new protocol parsing rule to the global protocol knowledge base, the method further includes: Sending a protocol type agent mapping relationship update instruction to the scheduling agent through the management agent to update the agent load status table; A lightweight parsing engine rule update instruction is sent to the parsing agent through the management agent.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, it implements a protocol parsing method based on multi-agent collaboration as described in any one of claims 1-8.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, it implements a protocol parsing method based on multi-agent collaboration as described in any one of claims 1 to 8.

Images