Industrial control protocol analysis method and device, equipment, storage medium and program product

Abstract

The invention discloses an industrial control protocol analysis method and apparatus, a device, a storage medium and a program product. The method comprises the steps of obtaining a to-be-analyzed industrial control protocol; performing preliminary analysis on the to-be-analyzed industrial control protocol to obtain an initial protocol field corresponding to the to-be-analyzed industrial control protocol; inputting the initial protocol field into a target generation model to generate a target protocol field; and analyzing the target protocol field to obtain a type corresponding to the to-be-analyzed industrial control protocol. By adopting the method, the accuracy of industrial control protocol analysis can be improved.

Description

Technical Field

[0001] This application relates to the field of industrial control technologies, and in particular, to an industrial control protocol parsing method, apparatus, device, storage medium, and program product. Background Art

[0002] Industrial control systems are widely used in critical infrastructures such as power, oil, chemical industry, and manufacturing. Most of their communication protocols are proprietary protocols or variant protocols, and there is a lack of public documentation, which poses challenges to security analysis, traffic monitoring, and protocol simulation. Existing industrial control protocol parsing methods mainly directly process the protocols to be parsed, which results in relatively low parsing accuracy.

[0003] Therefore, how to improve the accuracy of industrial control protocol parsing has become an urgent problem to be solved. Summary of the Invention

[0004] Embodiments of this application provide an industrial control protocol parsing method, apparatus, device, storage medium, and program product, which can improve the accuracy of industrial control protocol parsing.

[0005] In a first aspect, embodiments of this application provide an industrial control protocol parsing method, which includes:

[0006] Obtain an industrial control protocol to be parsed;

[0007] Perform a preliminary parse on the industrial control protocol to be parsed to obtain initial protocol fields corresponding to the industrial control protocol to be parsed;

[0008] Input the initial protocol fields into a target generation model to generate target protocol fields;

[0009] Perform a parsing process on the target protocol fields to obtain the type corresponding to the industrial control protocol to be parsed.

[0010] In one of the embodiments, performing a parsing process on the target protocol fields to obtain the type corresponding to the industrial control protocol to be parsed includes: performing a masking process on some protocol fields in the target protocol fields to obtain masked protocol fields; calling a target protocol parsing model to perform a parsing process on the masked protocol fields to obtain the type corresponding to the industrial control protocol to be parsed; the target protocol parsing model is obtained by training an initial protocol parsing model using multiple different types of sample industrial control protocols.

[0011] In one embodiment, the target protocol parsing model includes a protocol field reconstruction module, a feature extraction module, and a parsing module; the target protocol parsing model is called to perform parsing processing on the masked protocol fields to obtain the type corresponding to the industrial control protocol to be parsed, including: inputting the masked protocol fields into the protocol field reconstruction module to obtain the reconstructed protocol fields; inputting the reconstructed protocol fields into the feature extraction module to obtain the features corresponding to the reconstructed protocol fields; and inputting the features into the parsing module to obtain the type corresponding to the industrial control protocol to be parsed.

[0012] In one embodiment, the method further includes: obtaining a training set; the training set includes multiple different types of sample industrial control protocols; using pattern matching and field length analysis methods to perform preliminary parsing on each sample industrial control protocol in the training set to obtain the initial sample protocol fields corresponding to each sample industrial control protocol; respectively inputting each initial sample protocol field into the target generation model to obtain multiple target sample protocol fields; and training the initial protocol parsing model based on the multiple target sample protocol fields to obtain the target protocol parsing model.

[0013] In one embodiment, training the initial protocol parsing model based on the multiple target sample protocol fields to obtain the target protocol parsing model includes: performing masking processing on the multiple target sample protocol fields respectively to obtain multiple masked sample protocol fields; in each training process, inputting the masked sample protocol fields corresponding to a sample industrial control protocol into the initial protocol parsing model to obtain the predicted type corresponding to the sample industrial control protocol; and training the initial protocol parsing model based on the similarity between the predicted type and the actual type corresponding to the sample industrial control protocol until the end condition is reached to obtain the target protocol parsing model.

[0014] In one embodiment, the target generation model is trained in the following manner: in each training process, inputting an initial sample protocol field into the initial generation model to obtain an initial sample protocol field generation value; and iteratively training the initial generation model with the goal of minimizing the difference between the initial sample protocol field generation value and the corresponding initial sample protocol field to obtain the target generation model.

[0015] In a second aspect, the present application provides an industrial control protocol parsing device, which includes:

[0016] An acquisition module, configured to acquire an industrial control protocol to be parsed;

[0017] A first parsing module, configured to perform preliminary parsing on the industrial control protocol to be parsed to obtain the initial protocol fields corresponding to the industrial control protocol to be parsed;

[0018] A generation module, configured to input an initial protocol field into a target generation model to generate a target protocol field;

[0019] A second parsing module, configured to perform parsing processing on the target protocol field to obtain the type corresponding to the industrial control protocol to be parsed.

[0020] In a third aspect, the present application provides a computer device, including a memory and a processor. The memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0021] Obtain the industrial control protocol to be parsed;

[0022] Perform preliminary parsing on the industrial control protocol to be parsed to obtain the initial protocol field corresponding to the industrial control protocol to be parsed;

[0023] Input the initial protocol field into the target generation model to generate a target protocol field;

[0024] Perform parsing processing on the target protocol field to obtain the type corresponding to the industrial control protocol to be parsed.

[0025] In a fourth aspect, the present application further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the following steps are implemented:

[0026] Obtain the industrial control protocol to be parsed;

[0027] Perform preliminary parsing on the industrial control protocol to be parsed to obtain the initial protocol field corresponding to the industrial control protocol to be parsed;

[0028] Input the initial protocol field into the target generation model to generate a target protocol field;

[0029] Perform parsing processing on the target protocol field to obtain the type corresponding to the industrial control protocol to be parsed.

[0030] In a fifth aspect, the present application further provides a computer program product, including a computer program. When the computer program is executed by a processor, the following steps are implemented:

[0031] Obtain the industrial control protocol to be parsed;

[0032] Perform preliminary parsing on the industrial control protocol to be parsed to obtain the initial protocol field corresponding to the industrial control protocol to be parsed;

[0033] Input the initial protocol field into the target generation model to generate a target protocol field;

[0034] Perform parsing processing on the target protocol field to obtain the type corresponding to the industrial control protocol to be parsed.

[0035] The above industrial control protocol parsing method, device, equipment, storage medium and program product enable a computer device to obtain an industrial control protocol to be parsed; perform a preliminary parse on the industrial control protocol to be parsed to obtain initial protocol fields corresponding to the industrial control protocol to be parsed; input the initial protocol fields into a target generation model to generate target protocol fields; and perform a parsing process on the target protocol fields to obtain the type corresponding to the industrial control protocol to be parsed. By adopting this method, the computer device can automatically complete unknown protocol fields in the industrial control protocol to be processed and optimize the initial protocol fields by inputting the initial protocol fields corresponding to the industrial control protocol to be parsed into the target generation model, so as to improve the accuracy of industrial control protocol parsing by performing a parsing process on the target protocol fields. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the following will briefly introduce the drawings required for describing the embodiments of the present application or related technologies. Obviously, the drawings in the following description are only some embodiments of the present application, and those of ordinary skill in the art can obtain other related drawings based on these drawings without creative efforts.

[0037] Figure 1 FIG. is a schematic diagram of an application scenario of an industrial control protocol parsing method provided by an embodiment of the present application;

[0038] Figure 2 FIG. is a schematic flowchart of an industrial control protocol parsing method provided by an embodiment of the present application;

[0039] Figure 3 FIG. is a schematic flowchart of another industrial control protocol parsing method provided by an embodiment of the present application;

[0040] Figure 4 FIG. is a schematic structural diagram of an industrial control protocol parsing device provided by an embodiment of the present application;

[0041] Figure 5 FIG. is a schematic structural diagram of a computer device provided by an embodiment of the present application. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0042] In order to make the objectives, technical solutions and advantages of the present application clearer, the following further describes the present application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0043] The following introduces the application scenario of the industrial control protocol parsing method provided by the embodiments of the present application.

[0044] Please refer toFigure 1 , Figure 1 is a schematic diagram of an application scenario of an industrial control protocol parsing method provided by an embodiment of the present application. As Figure 1 shown, it includes a computer device 101 ( Figure 1 in which the computer device 101 is drawn taking the terminal device as an example) and an industrial control device 102.

[0045] Among them, the computer device 101 can obtain the industrial control protocol to be parsed from the industrial control device 102; perform a preliminary parsing on the industrial control protocol to be parsed to obtain the initial protocol fields corresponding to the industrial control protocol to be parsed; input the initial protocol fields into the target generation model to generate the target protocol fields; perform a parsing process on the target protocol fields to obtain the type corresponding to the industrial control protocol to be parsed. In this way, by inputting the initial protocol fields corresponding to the industrial control protocol to be parsed into the target generation model, the computer device 101 can automatically complete the unknown protocol fields in the industrial control protocol to be processed and optimize the initial protocol fields to obtain the target protocol fields. Thus, by performing a parsing process on the target protocol fields, the accuracy of industrial control protocol parsing can be improved.

[0046] Optionally, the computer device 101 can be a terminal device or a server. Among them, the terminal device mentioned here can include but is not limited to: smart phones, tablet computers, laptop computers, desktop computers, smart watches, smart TVs, smart vehicle terminals, etc. The server mentioned here can be an independent physical server or a server cluster or a distributed system composed of multiple physical servers, etc.

[0047] Please refer to Figure 2 , Figure 2 is a schematic flow diagram of an industrial control protocol parsing method provided by an embodiment of the present application. This method can be executed by a computer device (such as the above computer device 101). As Figure 2 shown, the industrial control protocol parsing method can include but is not limited to the following steps:

[0048] S201. Obtain the industrial control protocol to be parsed.

[0049] In an optional implementation manner, the industrial control protocol to be parsed can include but is not limited to the industrial control protocol traffic data monitored in real time or the industrial control protocol packets monitored in real time, etc., which is not limited here.

[0050] Optionally, the data format of industrial control protocol traffic data can be the Packet Capture (PCAP) file format, or the Packet Capture Next Generation (PCAPNG) file format, etc., which is not limited here.

[0051] Among them, the PCAP file format is a commonly used network packet storage format for recording information about packets transmitted over the network, and has wide applications in fields such as network analysis, troubleshooting, and security auditing.

[0052] The PCAPNG file format is an extensible format for capturing and storing network packets obtained by improving and extending the PCAP file format, and it has scalability, portability, and data merging / attachment capabilities.

[0053] S202. Perform a preliminary parsing on the industrial control protocol to be parsed to obtain the initial protocol fields corresponding to the industrial control protocol to be parsed.

[0054] In an optional implementation manner, the computer device performs a preliminary parsing on the industrial control protocol to be parsed to obtain the initial protocol fields corresponding to the industrial control protocol to be parsed, which may be to use pattern matching and field length analysis methods to perform a preliminary parsing on the industrial control protocol to be parsed to obtain the initial protocol fields corresponding to the industrial control protocol to be parsed.

[0055] Optionally, the initial protocol fields may include but are not limited to the header, length, function code, and sequence number of the industrial control protocol to be parsed, etc.

[0056] S203. Input the initial protocol fields into the target generation model to generate target protocol fields.

[0057] In an optional implementation manner, the target generation model can be obtained by training the initial generation model using multiple different types of sample industrial control protocols. Optionally, the initial generation model can be a Diffusion Models.

[0058] Among them, the core idea of the Diffusion model is to simulate a diffusion process and an inverse diffusion process.

[0059] Diffusion process: In this process, the model gradually adds Gaussian noise to the original data (such as an image). After multiple iterations, the data will gradually become pure Gaussian noise, that is, the original information of the data is completely destroyed. This process is a Markov chain, and the amount of noise added at each step is controlled by a predefined noise schedule.

[0060] Inverse diffusion process: It is the inverse operation of the diffusion process. Starting from pure Gaussian noise, the model gradually removes the noise through learning and finally restores samples similar to the original data distribution. This process is also a Markov chain. The model needs to learn how to predict the added noise based on the current noisy sample and then subtract this noise to obtain a sample closer to the original data.

[0061] S204. Parse and process the target protocol field to obtain the type corresponding to the industrial control protocol to be parsed.

[0062] In an alternative embodiment, the computer device parses and processes the target protocol field to obtain the type corresponding to the industrial control protocol to be parsed, which may be to use a deep learning model to parse and process the target protocol field to obtain the type corresponding to the industrial control protocol to be parsed. Optionally, the deep learning model is, for example, a Bidirectional Encoder Representations from Transformers (BERT) model.

[0063] In the embodiments of the present application, the computer device can obtain the industrial control protocol to be parsed; perform a preliminary parse on the industrial control protocol to be parsed to obtain the initial protocol field corresponding to the industrial control protocol to be parsed; input the initial protocol field into the target generation model to generate the target protocol field; parse and process the target protocol field to obtain the type corresponding to the industrial control protocol to be parsed. By using this method, the computer device can automatically complete the unknown protocol fields in the industrial control protocol to be processed by inputting the initial protocol field corresponding to the industrial control protocol to be parsed into the target generation model, and optimize the initial protocol field to obtain the target protocol field. Thus, by parsing and processing the target protocol field, the accuracy of industrial control protocol parsing can be improved.

[0064] Please refer to Figure 3 , Figure 3 which is a schematic flowchart of another industrial control protocol parsing method provided by the embodiments of the present application. Different from the industrial control protocol parsing method shown in Figure 2 , the difference lies in that Figure 3 the method shown in specifically elaborates on how the computer device parses and processes the target protocol field to obtain the type corresponding to the industrial control protocol to be parsed. As shown in Figure 3 , the industrial control protocol parsing method may include but is not limited to the following steps:

[0065] S301. Obtain the industrial control protocol to be parsed.

[0066] S302. Perform a preliminary parse on the industrial control protocol to be parsed to obtain the initial protocol field corresponding to the industrial control protocol to be parsed.

[0067] In an alternative embodiment, the relevant descriptions of steps 301 and S302 can be respectively referred to the descriptions in the foregoing steps S201 and S202, and will not be elaborated herein.

[0068] S303. Input the initial protocol field into the target generation model to generate the target protocol field.

[0069] In an alternative embodiment, when the computer device inputs the initial protocol field into the target generation model to generate the target protocol field, it may input the initial protocol field into the target Diffusion model to generate the target protocol field.

[0070] Optionally, the process of the computer device inputting the initial protocol field into the target Diffusion model to generate the target protocol field may include a forward diffusion process and a reverse generation process.

[0071] Among them, in the process of forward diffusion, the computer device can gradually add Gaussian noise to the initial protocol field data x0 to evolve it into a standard normal distribution , and its expression is as follows formula (1).

[0072] (1)

[0073] In formula (1), x t represents the protocol field representation at time step t; x t-1 represents the protocol field representation at time step t - 1; β represents the diffusion rate, which is used to control the injection degree of Gaussian noise; I is the identity matrix, indicating that the Gaussian noise is independently and identically distributed in each dimension. Formula (1) means that given x t-1 , x t follows a normal distribution with a mean of and a variance of .

[0074] In the reverse generation process, the computer device can gradually recover the structure of the protocol field from the Gaussian noise, and its process can be expressed as the following formula (2).

[0075] (2)

[0076] In formula (2), represents the model parameter, which is used to predict the true distribution of the protocol field; θ is the subscript of the parameter representation; x t represents the protocol field representation at time step t; x t-1It represents the protocol field representation at time step t-1. Finally, this process can generate a field sequence that conforms to the protocol field, which can be used to supplement the unknown protocol fields in the initial protocol field and optimize the protocol structure of the initial protocol, thereby obtaining the target protocol field.

[0077] S304. Mask some of the protocol fields in the target protocol field to obtain the masked protocol field.

[0078] That is to say, the computer device can cover some of the protocol fields in the target protocol field to obtain the covered protocol field (i.e., the masked protocol field).

[0079] S305. Invoke the target protocol parsing model to parse the masked protocol field to obtain the type corresponding to the industrial control protocol to be parsed; the target protocol parsing model is obtained by training the initial protocol parsing model with multiple different types of sample industrial control protocols.

[0080] In an optional implementation manner, the target protocol parsing model includes a protocol field reconstruction module, a feature extraction module, and a parsing module; when the computer device invokes the target protocol parsing model to parse the masked protocol field to obtain the type corresponding to the industrial control protocol to be parsed, it may include: inputting the masked protocol field into the protocol field reconstruction module to obtain the reconstructed protocol field; inputting the reconstructed protocol field into the feature extraction module to obtain the features corresponding to the reconstructed protocol field; inputting the features into the parsing module to obtain the type corresponding to the industrial control protocol to be parsed.

[0081] In an optional implementation manner, the target protocol parsing model can be obtained by the computer device through the following steps:

[0082] Step 1. Obtain a training set; the training set includes multiple different types of sample industrial control protocols.

[0083] In an optional implementation manner, the number of multiple different types of sample industrial control protocols is N, and N is a positive integer greater than 1; before the computer device obtains the training set, it can also obtain the industrial control protocol standard document, the protocol implementation documents of different industrial control device manufacturers, and the real-time protocol data in the industrial control process; extract M sample industrial control protocols from the obtained industrial control protocol standard document, different protocol implementation documents, and real-time protocol data, where M is greater than N and M is a positive integer; divide the data set composed of M sample industrial control protocols into a training set, a validation set, and a test set; store the training set, the validation set, and the test set in the database. In this case, the computer device obtains the training set, which can be to obtain the training set from the database.

[0084] Optionally, the industrial control protocol standard documents may include, but are not limited to, official documents of protocols such as Modbus (a serial communication protocol that can be programmed for communication between controllers and with other devices on different networks), Distributed Network Protocol 3, IEC 104 (a communication protocol for remote monitoring and control systems developed by the International Electrotechnical Commission (IEC)), Building Automation and Control Network (BACnet) (a protocol specifically for communication and control of various mechanical and electrical equipment in intelligent buildings), and Siemens S7 Communication Protocol (S7Comm).

[0085] Optionally, the protocol implementation documents of different industrial control device manufacturers may include, but are not limited to, field definitions, parameter formats, and interaction modes of private protocols and variant protocols, etc.

[0086] Optionally, the real-time protocol data in the industrial control process can be captured by a computer device monitoring the communication traffic of a Supervisory Control and Data Acquisition (SCADA) system, a Programmable Logic Controller (PLC), and a Distributed Control System (DCS) through traffic probes deployed in the industrial control network.

[0087] Optionally, from the obtained industrial control protocol standard documents, different protocol implementation documents, and real-time protocol data, the computer device extracts M sample industrial control protocols, which can be obtained by separately performing data cleaning (such as removing redundant information) on the obtained industrial control protocol standard documents, different protocol implementation documents, and real-time protocol data. Exemplarily, for low-level protocol data such as Transmission Control Protocol / Internet Protocol (TCP / IP), the computer device only retains the industrial protocol data and extracts protocol fields.

[0088] Optionally, the computer device divides the dataset composed of M sample industrial control protocols into a training set, a validation set, and a test set. It can organize the M sample industrial control protocols according to elements such as field names, data types, value ranges, and function descriptions, and store the protocol field data in JSON format to obtain the dataset composed of M sample industrial control protocols; then divide the dataset into a training set, a validation set, and a test set. Exemplarily, when the computer device divides the dataset composed of M sample industrial control protocols into a training set, a validation set, and a test set, it can divide the dataset composed of M sample industrial control protocols into a training set, a validation set, and a test set according to a ratio of 7:1:2.

[0089] Step 2: Use the pattern matching and field length analysis methods to preliminarily parse each sample industrial control protocol in the training set to obtain the initial sample protocol fields corresponding to each sample industrial control protocol.

[0090] Step 3: Input each initial sample protocol field into the target generation model respectively to obtain multiple target sample protocol fields.

[0091] In some embodiments, the target generation model can be trained by the computer device in the following way: in each training process, input an initial sample protocol field into the initial generation model to obtain the generated value of the initial sample protocol field; aim to minimize the difference between the generated value of the initial sample protocol field and the corresponding initial sample protocol field, and perform iterative training on the initial generation model to obtain the target generation model.

[0092] Optionally, when the computer device aims to minimize the difference between the generated value of the initial sample protocol field and the corresponding initial sample protocol field and perform iterative training on the initial generation model to obtain the target generation model, it can perform iterative training on the initial generation model based on the loss function shown in the following formula (3) to obtain the target generation model.

[0093] (3)

[0094] In formula (3), L diffusion represents the loss value, that is, the difference between the generated value of the initial sample protocol field and the corresponding initial sample protocol field; x t-1 represents the initial protocol field input into the initial generation model at time step t - 1; G(x t ) represents the generated value of the initial protocol field corresponding to x t-1 input into the initial generation model. t-1

[0095] Step 4: Based on multiple target sample protocol fields, train the initial protocol parsing model to obtain the target protocol parsing model.

[0096] Taking Embodiment 1.1 and Embodiment 1.2 as examples, the process by which a computer device trains an initial protocol parsing model based on multiple target sample protocol fields to obtain a target protocol parsing model will be described below.

[0097] In Embodiment 1.1, for a computer device to train an initial protocol parsing model based on multiple target sample protocol fields to obtain a target protocol parsing model, it may include: performing mask processing on multiple target sample protocol fields respectively to obtain multiple masked sample protocol fields; in each training process, inputting the masked sample protocol fields corresponding to a sample industrial control protocol into the initial protocol parsing model to obtain the predicted type corresponding to the sample industrial control protocol; training the initial protocol parsing model based on the similarity between the predicted type and the actual type corresponding to the sample industrial control protocol until an end condition is reached to obtain the target protocol parsing model. Optionally, the target protocol parsing model may be a BERT model.

[0098] Optionally, the end condition may be that the similarity between the predicted type and the actual type corresponding to the sample industrial control protocol is greater than a preset similarity threshold.

[0099] Optionally, both the predicted type and the actual type may be represented by a protocol field sequence. In this case, the computer device can measure the similarity between the predicted type and the actual type corresponding to the sample industrial control protocol by calculating the longest common subsequence between the predicted protocol field sequence and the actual protocol field sequence. This is beneficial to improving the performance of the target protocol parsing model, thereby enhancing the accuracy of industrial control protocol parsing.

[0100] Optionally, the computer device may first calculate the longest common subsequence between the predicted protocol field sequence and the actual protocol field sequence using the following formula (4).

[0101] (4)

[0102] In formula (4), A represents the predicted protocol field sequence; B represents the actual protocol field sequence; LCS(A, B) represents the longest common subsequence between A and B.

[0103] After that, the computer device may calculate the similarity score of LCS using the following formula (5).

[0104] (5)

[0105] In formula (5), S LCSIt represents the LCS similarity score; LCS(A,B) represents the longest common subsequence between the predicted protocol field sequence A and the predicted protocol field sequence B; |A| represents the sequence length of the predicted protocol field sequence; |B| represents the sequence length of the actual protocol field sequence.

[0106] Finally, the computer device can train the initial protocol parsing model when the LCS similarity score is less than the preset similarity threshold until the LCS similarity score is greater than the preset similarity score threshold, and then obtain the target protocol parsing model.

[0107] Embodiment 1.2. The computer device trains the initial protocol parsing model based on multiple target sample protocol fields to obtain the target protocol parsing model, which may include: performing mask processing on multiple target sample protocol fields respectively to obtain multiple masked sample protocol fields; inputting the multiple masked sample protocol fields into the initial protocol parsing model to predict the masked protocol fields and obtain the predicted values corresponding to the masked protocol fields; training the initial protocol parsing model with the goal of maximizing the accuracy of the predicted values to obtain the first protocol parsing model; inputting the multiple target sample protocol fields into the feature extraction module of the first protocol parsing model to obtain the features of each target sample protocol field; inputting the features of each target sample protocol field into the parsing module of the first protocol parsing model to obtain the predicted types of the sample industrial control protocols corresponding to each target sample protocol field; and iteratively training the first protocol parsing model in the direction of reducing the difference between the predicted type and the actual type of each sample industrial control protocol to obtain the target protocol parsing model.

[0108] Optionally, the computer device trains the initial protocol parsing model with the goal of maximizing the accuracy of the predicted values to obtain the first protocol parsing model, which can be to train the initial protocol parsing model with the goal of determining the minimum value of the following formula (6) to obtain the first protocol parsing model.

[0109] (6)

[0110] In formula (6), x i represents the masked protocol field at the i-th position; represents the remaining unmasked protocol fields; M represents the set of positions of the masked protocol fields; θ represents the model parameters. Formula (6) can be used to maximize the accuracy of the protocol parsing model in predicting the masked protocol fields.

[0111] It should be noted that the absolute value of the minimum value calculated by formula (6) is the maximum value corresponding to the accuracy of the predicted value.

[0112] Optionally, the computer device inputs multiple target sample protocol fields into the feature extraction module of the first protocol parsing model to obtain the features of each target sample protocol field. The feature extraction module is constructed based on the attention mechanism.

[0113] Among them, the computer device can calculate the correlation between target sample protocol fields using the attention mechanism. For any two target sample protocol fields, their attention score A can be calculated by the following formula (7).

[0114] (7)

[0115] In formula (7), Q (Query) is the query matrix, representing the representation vector of the current target sample protocol field; K (Key) is the key matrix, representing the representation vectors of all target sample protocol fields; d k is the scaling factor used to stabilize the gradient; A represents the correlation score between the current target sample protocol field and each other target sample protocol field.

[0116] After that, the computer device can determine the features of each target sample protocol field based on the attention score using the following formula (8).

[0117] (8)

[0118] In formula (8), h i represents the feature of the i-th target sample protocol field; V j represents the value matrix (Value), which is used to calculate the final representation of the target protocol field; A ij represents the attention score between the i-th target sample protocol field and the j-th target sample protocol field.

[0119] Optionally, the computer device inputs the features of each target sample protocol field into the parsing module of the first protocol parsing model to obtain the predicted type of the sample industrial control protocol corresponding to each target sample protocol field. It can first calculate the probability distribution of the type to which each target sample protocol field belongs through the following formula (9), and then use the type corresponding to the maximum probability in the probability distribution of the type to which each target sample protocol field belongs as the predicted type of the sample industrial control protocol corresponding to the target sample protocol field.

[0120] (9)

[0121] In formula (9), represents the probability distribution of different types y to which the target sample protocol field x belongs; W represents the weight matrix; b represents the bias term; h xIt represents the feature of the target sample protocol field x, which can be determined by the following formula (10).

[0122] (10)

[0123] Optionally, the computer device takes the type corresponding to the maximum probability in the probability distribution of the type to which each target sample protocol field belongs as the predicted type of the sample industrial control protocol corresponding to the target sample protocol field, which can be expressed by the following formula (11).

[0124] (11)

[0125] In formula (11), represents the predicted type of the sample industrial control protocol corresponding to the target sample protocol field.

[0126] In some embodiments, during the process of training the target protocol parsing model, the computer device can monitor the loss value (i.e., the difference between the predicted type and the actual type of each sample industrial control protocol) curve in real time or periodically to determine whether the model has converged. If the change of the loss value is stable, it indicates that the model has reached the optimal state.

[0127] Optionally, the computer device can monitor the training state of the model through the following formula (12).

[0128] (12)

[0129] In formula (12), dL / dt represents the change rate of the loss value. Among them, if this change rate approaches 0, it indicates that the training state of the model has been stable. In this case, the computer device can stop training to obtain the target protocol parsing model, or adjust the learning rate to further optimize the model.

[0130] Optionally, during the process of training the target protocol parsing model, the computer device can also dynamically adjust the hyperparameters in the model.

[0131] For example, in the case where the loss value converges too slowly, the computer device can increase the learning rate; in the case where the loss value curve fluctuates too much, the computer device can decrease the learning rate. Among them, the learning rate can be determined by the computer device using the following formula (13).

[0132] (13)

[0133] In formula (13), represents the learning rate at time step t + 1; represents the learning rate at time step t; is a random number used to control the learning rate decay rate.

[0134] For another example, the computer device can also dynamically adjust the batch size of the input data according to the complexity of the training data to improve the stability of training. Among them, the training batch size can be determined by the computer device using the following formula (14).

[0135] (14)

[0136] In formula (14), represents the batch size of the input data corresponding to time step t + 1; represents the batch size of the input data corresponding to time step t; is a random number used to control the amplitude of batch adjustment.

[0137] In the embodiments of the present application, by inputting the initial protocol fields corresponding to the industrial control protocol to be parsed into the target generation model, the computer device can automatically complete the unknown protocol fields in the industrial control protocol to be processed and optimize the initial protocol fields. In this way, more accurate protocol fields (i.e., target protocol fields) can be obtained. After that, by masking some of the protocol fields in the target protocol fields, the masked protocol fields are obtained, and the target protocol parsing model obtained by training the initial protocol parsing model with multiple different types of sample industrial control protocols is called to perform parsing processing on the masked protocol fields. Since the target protocol parsing model has learned the characteristics of multiple different types of sample industrial control protocols, calling the target protocol parsing model to perform parsing processing on the masked protocol fields can obtain a more accurate parsing result of the industrial control protocol, that is, improve the accuracy of industrial control protocol parsing.

[0138] In addition, since the target protocol parsing model has learned the characteristics of multiple different types of sample industrial control protocols, calling the target protocol parsing model can parse different types of industrial control protocol standard documents, protocol implementation documents of different industrial control device manufacturers, and real-time protocol data in different types of industrial control processes, thereby improving the generalization ability and adaptability of industrial control protocol parsing.

[0139] It should be understood that although the steps in the flowcharts involved in the above-described embodiments are shown in sequence according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise clearly stated in this article, there is no strict order restriction for the execution of these steps, and these steps can be executed in other orders. Moreover, at least some of the steps in the flowcharts involved in the above-described embodiments may include multiple steps or multiple stages. These steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily sequential, but can be executed alternately or in turn with at least some of the steps or stages in other steps or other steps.

[0140] Based on the same inventive concept, an embodiment of the present application also provides an industrial control protocol parsing device for implementing the above-mentioned industrial control protocol parsing method. The solution provided by this device to solve the problem is similar to the solution described in the above method. Therefore, the specific limitations in one or more embodiments of the industrial control protocol parsing device provided below can refer to the limitations on the industrial control protocol parsing method in the above text, and will not be repeated here.

[0141] Please refer to Figure 4 , Figure 4 which is a schematic structural diagram of an industrial control protocol parsing device provided by an embodiment of the present application. As Figure 4 shown, the industrial control protocol parsing device may include but is not limited to:

[0142] An acquisition module 401, configured to acquire an industrial control protocol to be parsed;

[0143] A first parsing module 402, configured to perform a preliminary parsing on the industrial control protocol to be parsed to obtain an initial protocol field corresponding to the industrial control protocol to be parsed;

[0144] A generation module 403, configured to input the initial protocol field into a target generation model to generate a target protocol field;

[0145] A second parsing module 404, configured to perform a parsing process on the target protocol field to obtain the type corresponding to the industrial control protocol to be parsed.

[0146] In one embodiment, when the second parsing module 404 is used to parse the target protocol field to obtain the type corresponding to the industrial control protocol to be parsed, it is specifically used for: performing masking processing on some protocol fields in the target protocol field to obtain the masked protocol field; calling the target protocol parsing model to perform parsing processing on the masked protocol field to obtain the type corresponding to the industrial control protocol to be parsed; the target protocol parsing model is obtained by training an initial protocol parsing model with multiple different types of sample industrial control protocols.

[0147] In one embodiment, the target protocol parsing model includes a protocol field reconstruction module, a feature extraction module, and a parsing module; when the second parsing module 404 is used to call the target protocol parsing model to perform parsing processing on the masked protocol field to obtain the type corresponding to the industrial control protocol to be parsed, it is specifically used for: inputting the masked protocol field into the protocol field reconstruction module to obtain the reconstructed protocol field; inputting the reconstructed protocol field into the feature extraction module to obtain the features corresponding to the reconstructed protocol field; inputting the features into the parsing module to obtain the type corresponding to the industrial control protocol to be parsed.

[0148] In one embodiment, the device may further include a training module, and the training module is used for: obtaining a training set; the training set includes multiple different types of sample industrial control protocols; using the pattern matching and field length analysis method to perform preliminary parsing on each sample industrial control protocol in the training set to obtain the initial sample protocol field corresponding to each sample industrial control protocol; respectively inputting each initial sample protocol field into the target generation model to obtain multiple target sample protocol fields; based on the multiple target sample protocol fields, training the initial protocol parsing model to obtain the target protocol parsing model.

[0149] In one embodiment, when the training module is used to train the initial protocol parsing model based on multiple target sample protocol fields to obtain the target protocol parsing model, it is specifically used for: performing masking processing on the multiple target sample protocol fields respectively to obtain multiple masked sample protocol fields; in each training process, inputting the masked sample protocol field corresponding to a sample industrial control protocol into the initial protocol parsing model to obtain the predicted type corresponding to the sample industrial control protocol; based on the similarity between the predicted type and the actual type corresponding to the sample industrial control protocol, training the initial protocol parsing model until the end condition is reached to obtain the target protocol parsing model.

[0150] In one embodiment, the training module is further configured to: in each training process, input an initial sample protocol field into the initial generation model to obtain an initial sample protocol field generation value; and iteratively train the initial generation model with the goal of minimizing the difference between the initial sample protocol field generation value and the corresponding initial sample protocol field to obtain a target generation model.

[0151] Each module in the above industrial control protocol parsing device can be implemented in whole or in part by software, hardware, and their combination. Each of the above modules can be embedded in the processor in the terminal device in hardware form or be independent of it, or can be stored in the memory in the terminal device in software form for the processor to call and execute the operations corresponding to each of the above modules.

[0152] In an exemplary embodiment, the embodiment of the present application provides a computer device, which can be a terminal device, and its internal structure diagram can be as Figure 5 shown. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit, and an input device. Among them, the processor, the memory, and the input / output interface are connected through a system bus, and the communication interface, the display unit, and the input device are connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used for the processor to exchange information with external devices. The communication interface of the computer device is used to communicate with external terminals in a wired or wireless manner, and the wireless manner can be implemented through WIFI, a mobile cellular network, near field communication (NFC), or other technologies. The computer program, when executed by the processor, implements an industrial control protocol parsing method. The display unit of the computer device is used to form a visually visible picture, which can be a display screen, a projection device, or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen. The input device of the computer device can be a touch layer covering the display screen, or a button, a trackball, or a touchpad provided on the outer shell of the computer device, or an external keyboard, touchpad, or mouse, etc.

[0153] Those skilled in the art can understand that Figure 5 the structure shown in merely represents a block diagram of some structures related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine some components, or have a different component layout.

[0154] In an exemplary embodiment, the present application provides a computer device, including a memory and a processor. A computer program is stored in the memory, and when the processor executes the computer program, the steps in the above industrial control protocol parsing method are implemented.

[0155] In an exemplary embodiment, the present application provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above industrial control protocol parsing method are implemented.

[0156] In an exemplary embodiment, the present application provides a computer program product, including a computer program. When the computer program is executed by a processor, the steps in the above industrial control protocol parsing method are implemented.

[0157] It should be noted that the data involved in the present application (including but not limited to the industrial control protocol to be parsed, the initial protocol fields, the target protocol fields, etc.) are all information and data authorized by the user or fully authorized by all parties, and the collection, use, and processing of the relevant data need to comply with the relevant regulations.

[0158] Those of ordinary skill in the art can understand that all or part of the processes in the methods of the above embodiments can be completed by instructing relevant hardware through a computer program. The computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above methods. Among them, any reference to a memory, database, or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc. The databases involved in the embodiments provided in the present application can include at least one of relational databases and non-relational databases. Non-relational databases can include distributed databases based on blockchain, etc., without limitation. The processors involved in the embodiments provided in the present application can be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, data processing logics based on quantum computing, artificial intelligence (AI) processors, etc., without limitation.

[0159] The technical features of the above embodiments can be combined arbitrarily. For the sake of brevity in description, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, it should be considered as the scope recorded in the present application.

[0160] The above-described embodiments merely represent several implementation manners of the present application. The description thereof is relatively specific and detailed, but it should not be construed as a limitation on the scope of the patent of the present application. It should be noted that for those of ordinary skill in the art, without departing from the concept of the present application, several modifications and improvements can still be made, and these all fall within the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the appended claims.

Claims

1. An industrial control protocol parsing method, characterized in that, The method includes: Obtain the industrial control protocol to be parsed; Perform preliminary parsing on the industrial control protocol to be parsed to obtain the initial protocol fields corresponding to the industrial control protocol to be parsed; Input the initial protocol fields into a target generation model to generate target protocol fields; Perform parsing processing on the target protocol fields to obtain the type corresponding to the industrial control protocol to be parsed.

2. The method according to claim 1, wherein The performing parsing processing on the target protocol fields to obtain the type corresponding to the industrial control protocol to be parsed includes: Perform masking processing on some protocol fields in the target protocol fields to obtain masked protocol fields; Invoke a target protocol parsing model to perform parsing processing on the masked protocol fields to obtain the type corresponding to the industrial control protocol to be parsed; the target protocol parsing model is obtained by training an initial protocol parsing model with different types of sample industrial control protocols.

3. The method according to claim 2, wherein The target protocol parsing model includes a protocol field reconstruction module, a feature extraction module, and a parsing module; The invoking the target protocol parsing model to perform parsing processing on the masked protocol fields to obtain the type corresponding to the industrial control protocol to be parsed includes: Input the masked protocol fields into the protocol field reconstruction module to obtain reconstructed protocol fields; Input the reconstructed protocol fields into the feature extraction module to obtain the features corresponding to the reconstructed protocol fields; Input the features into the parsing module to obtain the type corresponding to the industrial control protocol to be parsed.

4. The method according to claim 2 or 3, characterized in that, The method further includes: Obtain a training set; the training set includes multiple different types of sample industrial control protocols; Use pattern matching and field length analysis methods to perform preliminary parsing on each of the sample industrial control protocols in the training set to obtain the initial sample protocol fields corresponding to each of the sample industrial control protocols; Input each of the initial sample protocol fields into the target generation model respectively to obtain multiple target sample protocol fields; Train the initial protocol parsing model based on the multiple target sample protocol fields to obtain the target protocol parsing model.

5. The method according to claim 4, wherein The training the initial protocol parsing model based on the multiple target sample protocol fields to obtain the target protocol parsing model includes: Perform masking processing on the multiple target sample protocol fields respectively to obtain multiple masked sample protocol fields; In each training process, input the masked sample protocol fields corresponding to a sample industrial control protocol into the initial protocol parsing model to obtain the predicted type corresponding to the sample industrial control protocol; Train the initial protocol parsing model based on the similarity between the predicted type and the actual type corresponding to the sample industrial control protocol until the end condition is reached to obtain the target protocol parsing model.

6. The method according to claim 4, wherein The target generation model is trained in the following manner: In each training process, input an initial sample protocol field into the initial generation model to obtain an initial sample protocol field generation value; Iteratively train the initial generation model with the goal of minimizing the difference between the generated value of the initial sample protocol field and the corresponding initial sample protocol field to obtain the target generation model.

7. An industrial control protocol parsing method and device, characterized in that The device includes: An acquisition module, configured to acquire an industrial control protocol to be parsed; A first parsing module, configured to perform a preliminary parsing on the industrial control protocol to be parsed to obtain an initial protocol field corresponding to the industrial control protocol to be parsed; A generation module, configured to input the initial protocol field into a target generation model to generate a target protocol field; A second parsing module, configured to perform a parsing process on the target protocol field to obtain the type corresponding to the industrial control protocol to be parsed.

8. A computer device, characterized in that, It includes a memory and a processor, the memory stores a computer program, and when the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images