Data message analysis method and equipment

Abstract

The invention relates to the field of data messages, and particularly discloses a data message analysis method and device, and the method comprises the steps: carrying out the pre-check of an initial data message, so as to obtain a target data message; extracting a message feature of a target data message, and generating a feature hash value corresponding to the target data message; based on the feature hash value and the message feature, matching a protocol parser corresponding to the target data message in a pre-constructed protocol feature library; and analyzing the target data message through the protocol analyzer to obtain a message analysis result. By extracting the message features of the data message and generating the byte-level Hash feature value, the Hash feature value can be matched with the known protocol based on the pre-constructed protocol feature library, and then the data message is analyzed according to the matched protocol. The characteristics of various complex data messages can be accurately identified, and the analysis accuracy is improved.

Description

Technical Field

[0001] This application relates to the field of data packets, and particularly to a method and device for parsing data packets. Background Art

[0002] In the intelligent Internet of Things platform, numerous different types of devices are interconnected and transmit data. The data packets generated by these devices are diverse in form, complex in format, and may be affected by factors such as encryption and encoding.

[0003] Traditional data packet parsing technologies rely on parsing the fixed format of protocol specifications, and cannot handle abnormal situations such as missing packets, misalignment, and encryption. Moreover, the parsing efficiency for multi-protocol nesting (such as mixed transmission of HTTP + CoAP + MQTT) is low. In addition, the protocols of Internet of Things devices are diverse (such as Modbus, OPC UA, MQTT, etc.), and the proportion of dynamically encrypted packets (TLS / SSL) increases, resulting in a high false alarm rate for traditional deep packet inspection (DPI) technologies. Summary of the Invention

[0004] In view of the above problems, the present disclosure provides a data packet parsing method and device that overcome or at least partially solve the above problems. The technical solutions are as follows: A data packet parsing method, characterized by including: pre-checking an initial data packet to obtain a target data packet; extracting the packet features of the target data packet and generating a feature hash value corresponding to the target data packet; based on the feature hash value and the packet features, matching a protocol parser corresponding to the target data packet in a pre-constructed protocol feature library; and parsing the target data packet through the protocol parser to obtain a packet parsing result.

[0005] Optionally, the pre-checking of the initial data packet specifically includes: performing integrity verification on the initial data packet through a preset verification algorithm to obtain a verification result; the preset verification algorithm includes at least one of a cyclic redundancy check algorithm and a message digest algorithm; deleting the initial data packets with a packet length lower than a preset length threshold and an unqualified verification result to obtain the target data packet.

[0006] When pre-checking the initial data packet, byte-level pre-checking of the initial data packet through a cyclic redundancy check algorithm or a message digest algorithm can eliminate damaged packets, reduce invalid calculations, thereby improving the calculation efficiency in the data packet parsing process and reducing the waste of computing resources.

[0007] Optionally, the message feature includes at least one of the recorded message length, arrival time, and transport layer protocol; generating the feature hash value corresponding to the target data message specifically includes: extracting a preset number of bytes from the target data message and generating a feature hash value based on the preset number of bytes.

[0008] Optionally, matching the protocol parser corresponding to the target data message in the pre-constructed protocol feature library based on the feature hash value and the message feature specifically includes: matching the set of candidate protocol parsers corresponding to the target data message in the pre-constructed protocol feature library based on the feature hash value; determining the matching result in the set of candidate protocol parsers based on the message feature; the matching result includes at least one of the protocol name and unsuccessful match; if the matching result is the protocol name, determining the protocol parser corresponding to the protocol name.

[0009] By extracting the front-end bytes of the message in the data message to generate a feature hash value, it is possible to match the target data message with the pre-stored data message protocol in the pre-constructed protocol feature library based on the feature hash value, so as to quickly determine the data message protocol corresponding to the target data message. In addition, by extracting the message features of the target data message, it is possible to assist in protocol inference when the target data message corresponds to multiple possible data message protocols, thereby improving the accuracy of protocol matching.

[0010] Optionally, the message feature further includes a timing feature, a fixed header, and a variable payload; the timing feature includes at least one of the message length distribution, the interval period, and the load change information; after determining the matching result in the set of candidate protocol parsers based on the message feature, the method further includes: determining that the matching result is an unsuccessful match; inputting the message feature into a pre-trained protocol prediction model to determine the predicted protocol type corresponding to the target data message; parsing the target data message based on the protocol parser corresponding to the predicted protocol type to obtain a message parsing result.

[0011] If the data message protocol corresponding to the target data message is not matched in the pre-constructed protocol feature library, unsupervised analysis is performed on the target data message based on the extracted message features, so as to infer the protocol type and field semantics of the target data message, thereby improving the recognition success rate of the target data message and supporting the recognition of more types of data messages.

[0012] Optionally, after determining the predicted protocol type corresponding to the target data message, the method further includes: determining the prediction confidence of the predicted protocol type; when the prediction confidence is higher than the first preset confidence threshold, updating the predicted protocol type to the protocol feature library.

[0013] If the data packet protocol corresponding to the target data packet is not matched in the pre-built protocol feature library, but there is a protocol type with a relatively high confidence level through unsupervised analysis of the target data packet, the corresponding protocol type can be updated to the protocol feature library, so as to realize the dynamic update of the protocol feature library and improve the speed of subsequent protocol matching.

[0014] Optionally, before matching the protocol parser corresponding to the target data packet in the pre-built protocol feature library based on the feature hash value and the packet feature, the method further includes: determining the protocol usage rate of existing Internet of Things protocols; obtaining the protocol features corresponding to the Internet of Things protocols whose protocol usage rates are higher than a preset usage rate threshold, where the protocol features include at least one of feature fields, regular expressions, binary sequences, and feature hash values; constructing the protocol feature library based on the protocol features.

[0015] By collecting the protocol features of mainstream Internet of Things protocols in advance to construct a protocol feature library, when matching protocols, the packet features of the target data packet can be collected and matched with the protocol features, so as to improve the speed of protocol matching.

[0016] Optionally, after parsing the target data packet through the protocol parser to obtain a packet parsing result, the method further includes: performing reverse verification on the packet parsing result to correct the packet parsing result; repairing packet misalignment and missing data in the packet parsing result through redundant field cross-verification.

[0017] After the parsing of the target data packet is completed, by performing reverse verification and redundant field cross-verification on the packet parsing result, the packet parsing result can be corrected, thereby improving the accuracy rate of the packet parsing result.

[0018] Optionally, after parsing the target data packet through the protocol parser to obtain a packet parsing result, the method further includes: determining the matching confidence level between the target data packet and the protocol parser; generating an alarm signal for the packet parsing result corresponding to the protocol parser whose matching confidence level is lower than a preset confidence level threshold; and giving an alarm through the alarm signal.

[0019] Determine the matching confidence level between the target data packet and each protocol, so as to reflect the credibility of the packet parsing results corresponding to different protocols according to the matching confidence level, and generate an alarm signal when the credibility is low, or delete the corresponding packet parsing result and no longer present it to the user, thereby improving the user experience.

[0020] A data packet parsing device, characterized by comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform: pre-checking an initial data packet to obtain a target data packet; extracting the packet features of the target data packet and generating a feature hash value corresponding to the target data packet; based on the feature hash value and the packet features, matching a protocol parser corresponding to the target data packet in a pre-constructed protocol feature library; and parsing the target data packet through the protocol parser to obtain a packet parsing result.

[0021] This application discloses a data packet parsing method and device. By extracting the packet features of a data packet and generating a byte-level hash feature value, it is possible to match the hash feature value with known protocols based on a pre-constructed protocol feature library, and then parse the data packet according to the matched protocol. It can accurately identify the features of various complex Internet of Things data packets, significantly improve the parsing accuracy, ensure the correctness and usability of Internet of Things data, and provide a reliable basis for data-based business decisions.

[0022] The above description is only an overview of the technical solution of the present disclosure. In order to be able to understand the technical means of the present disclosure more clearly, it can be implemented according to the content of the specification. And in order to make the above and other purposes, features and advantages of the present disclosure more obvious and understandable, the specific embodiments of the present disclosure are specifically exemplified below. Brief Description of the Drawings

[0023] The drawings described herein are used to provide a further understanding of the present application and form a part of the present application. The schematic embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation to the present application. In the drawings: Figure 1 It is a schematic flowchart of a data packet parsing method in an embodiment of the present application; Figure 2 It is a schematic structural diagram of a data packet parsing device in an embodiment of the present application. Detailed Description of the Embodiments

[0024] To make the purpose, technical solution and advantages of the present application clearer, the technical solution of the present application will be clearly and completely described below in conjunction with the specific embodiments of the present application and the corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present application.

[0025] The following describes in detail the technical solutions provided by various embodiments of the present application in conjunction with the accompanying drawings.

[0026] In smart IoT platforms, numerous different types of devices connect and transmit data. The data packets generated by these devices are diverse and complex, and may be affected by encryption and encoding. Traditional data packet parsing methods struggle to adapt to this complexity, resulting in low parsing efficiency and insufficient accuracy.

[0027] For example, for some emerging IoT device protocols or specially processed data packets, traditional methods are often unable to accurately extract key information, resulting in delays and errors in data transmission and processing, greatly limiting the performance and business expansion of the smart IoT platform.

[0028] Specifically, traditional data packet parsing technology relies on fixed-format parsing within protocol specifications, making it unable to handle anomalies such as missing, misplaced, and encrypted packets. Furthermore, parsing of multiple nested protocols is inefficient. Furthermore, with the increasing diversity of IoT device protocols and the increasing proportion of dynamically encrypted packets, traditional deep packet inspection technologies have a high false positive rate. Furthermore, malicious packets (such as malformed data and DDoS attacks) can easily paralyze parsing, and ensuring real-time performance is difficult in high-concurrency scenarios.

[0029] To this end, the present application provides a vehicle torque control system, such as Figure 1 As shown, Figure 1 This is a flow chart of a data message parsing method provided in one or more embodiments of this specification. This method can be applied to data messages in various business areas, such as internet finance, e-commerce, instant messaging, gaming, and official business. The process can be executed by computing devices in the corresponding field (e.g., risk control servers or smart mobile terminals for payment services). Certain input parameters or intermediate results in the process can be manually adjusted to help improve accuracy.

[0030] The analysis method involved in the embodiments of the present application can be implemented by a terminal device or a server, and the present application does not impose any special restrictions on this. For ease of understanding and description, the following embodiments are described in detail using a server as an example.

[0031] It should be noted that the server can be a single device or a system composed of multiple devices, that is, a distributed server, and this application does not make any specific restrictions on this.

[0032] like Figure 1 As shown, the embodiment of the present application provides a data message parsing method, including: S101: Pre-check the initial data message to obtain the target data message.

[0033] First, after receiving the initial data packet, the server performs byte-level pre-check on the initial data packet to eliminate damaged packets and reduce invalid calculations. Here, the initial data packet refers to the data packet received by the server, which can be a single data packet or multiple data packets. The target data packet refers to the data packet obtained after eliminating damaged packets through pre-check, and only the target data packet will be analyzed in subsequent analysis.

[0034] In one embodiment, when performing pre-check on the initial data packet, the integrity of the initial data packet can be verified through the cyclic redundancy check algorithm and the message digest algorithm to determine whether the initial data packet is complete. On this basis, it is also necessary to determine the packet length of the initial data packet, and delete the initial data packets with a packet length lower than the preset length threshold and unqualified verification results to obtain the target data packet. By verifying the integrity of the data packet and deleting packets with shorter byte counts based on the packet length of the initial data packet, damaged packets can be eliminated, invalid calculations can be reduced, thereby improving the calculation efficiency in the data packet parsing process and reducing the waste of computing resources.

[0035] S102: Extract the packet features of the target data packet and generate the feature hash value corresponding to the target data packet.

[0036] After obtaining the target data packet, it is necessary to extract the packet features of the target data packet and generate a feature hash value based on the target data packet. In subsequent processes, the feature hash value is used to match with the Internet of Things device protocol, and the packet features are used for assistance in the matching process. Here, the packet features include metadata such as packet length, arrival time, and transport layer protocol (TCP / UDP).

[0037] In one embodiment, when generating the feature hash value corresponding to the target data packet, a preset number of bytes (such as the first 20 bytes or the first 50 bytes of the target data packet) need to be extracted from the target data packet, and the feature hash value is generated based on the above bytes.

[0038] The implementation code for data pre-check of the initial data packet, generation of the feature hash value of the target data packet, and extraction of protocol features is as follows: def pre_check(packet): # Eliminate invalid packets (length < 20 bytes, checksum error) if len(packet)<MIN_LEN or not crc_valid(packet): return ABNORMAL_SCORE # Extract the first N bytes to generate the feature hash return hashlib.md5(packet[:HEADER_LEN]).hexdigest() S103: Match the protocol parser corresponding to the target data packet in the pre-constructed protocol feature library based on the feature hash value and the packet features.

[0039] After obtaining the feature hash value and packet features corresponding to the target data packet, the Internet of Things protocol corresponding to the target data packet can be matched in the pre-constructed protocol feature library, and then the protocol parser of this Internet of Things protocol can be used as the protocol parser of the target data.

[0040] In one embodiment, before matching the protocol parser corresponding to the target data packet in the pre-constructed protocol feature library, it is necessary to construct the protocol feature library. At this time, it is necessary to determine the protocol usage rate of existing Internet of Things protocols and obtain the protocol features corresponding to the Internet of Things protocols whose protocol usage rates are higher than the preset usage rate threshold. Here, the protocol features include feature fields, regular expressions, binary sequences, feature hash values, and other features. Then, based on the protocol features, the protocol feature library can be constructed. Specifically, the feature fields (such as fixed headers, delimiters, and payload signatures) of mainstream Internet of Things protocols (such as HTTP, MQTT, CoAP, Modbus) can be collected. Generate the protocol features corresponding to each protocol based on the feature fields and support fuzzy matching.

[0041] In one embodiment, when determining the protocol parser of the target data, the set of candidate protocol parsers corresponding to the target data packet can be matched in the pre-constructed protocol feature library based on the feature hash value first. It should be noted that here, the comparison is made through the feature hash value to determine whether the Internet of Things protocol of the target data packet is included in the constructed protocol feature library because using the feature hash value for matching is faster and can greatly improve the protocol matching speed. The set of candidate protocol parsers here may contain one Internet of Things protocol, may contain multiple Internet of Things protocols, or may not contain an Internet of Things protocol, that is, the Internet of Things protocol of the target data packet is not included in the pre-constructed protocol feature library. By pre-constructing the protocol feature library, multi-protocol nested recognition (such as TCP + HTTP + JSON mixed packets) can be supported.

[0042] When there is only one Internet of Things protocol in the set of candidate protocol parsers, it is possible to directly use this Internet of Things protocol as the Internet of Things protocol corresponding to the target data packet without the assistance of packet features, and then use the protocol parser of this Internet of Things protocol as the protocol parser for the target data. When there are multiple Internet of Things protocols in the set of candidate protocol parsers, at this time, with the assistance of packet features, the corresponding Internet of Things protocol can be selected from multiple Internet of Things protocols. For example, the transport layer protocols can be compared, and the Internet of Things protocol that meets the requirements among multiple Internet of Things protocols can be used as the Internet of Things protocol for the target data packet, and then the protocol parser of this Internet of Things protocol can be used as the protocol parser for the target data. When the set of candidate protocol parsers does not contain an Internet of Things protocol, the pre-built protocol feature library does not contain the Internet of Things protocol of the target data packet. At this time, the failure to match successfully can be directly used as the matching result. The matching result includes at least one of the protocol name and the failure to match successfully. When the matching result is the protocol name, it proves that there is an Internet of Things protocol corresponding to the target data packet in the pre-built protocol feature library. At this time, the protocol parser corresponding to the target data packet can be determined based on the protocol name of the Internet of Things protocol.

[0043] Protocol matching by using the feature hash value and packet features in the pre-built protocol feature library can be implemented through the following code: # Feature library example (Redis storage) PROTOCOL_FINGERPRINT = { "HTTP": ["474554 20", "3A"],# "GET " and ":" features "MQTT": ["192A003C", "04"]# MQTT fixed header identifier } def match_protocol(hash_val): for proto, fingerprints in PROTOCOL_FINGERPRINT.items(): if any(fp in hash_val for fp in fingerprints): return proto return "UNKNOWN" In one embodiment, if the protocol matching result of the target data packet is not successfully matched by the feature hash value, the packet features such as the timing feature, fixed header, and variable payload of the target data packet can be obtained at this time. The timing feature here includes features such as packet length distribution, interval period, and payload change information. At this time, unsupervised analysis can be performed on the packet features to infer the protocol type and field semantics. Specifically, the packet features can be input into a pre-trained protocol prediction model to determine the predicted protocol type corresponding to the target data packet, and then based on the protocol parser corresponding to the predicted protocol type, the target data packet can be parsed to obtain the packet parsing result. Among them, the protocol prediction model can construct a self-supervised learning model (such as Transformer) based on historical packets to learn the association between byte sequences and protocol types. When using the protocol prediction model, a feature vector (such as byte entropy, n-gram distribution) of the target data packet can be generated and input into the model to predict the protocol category.

[0044] Specifically, the implementation code for unsupervised analysis of packet features is as follows: # Simple model based on PyTorch class ProtocolClassifier(nn.Module): def __init__(self): super().__init__() self.lstm = nn.LSTM(input_size=256, hidden_size=128, num_layers=2) self.fc = nn.Linear(128, NUM_PROTOCOLS) def forward(self, x):# x: byte sequence vector out, _ = self.lstm(x) return self.fc(out[:, -1]) In one embodiment, after performing unsupervised analysis on the target data packet that fails to match successfully and obtaining the predicted protocol type of the target data packet, the prediction confidence of the predicted protocol type output by the protocol prediction model can be obtained. And when the prediction confidence is higher than the first preset confidence threshold, the predicted protocol type is updated to the protocol feature library, thereby realizing the dynamic update of the protocol feature library.

[0045] S104: Parse the target data packet through the protocol parser to obtain a packet parsing result.

[0046] After obtaining the protocol parser of the target data, the target data message can be parsed through the protocol parser to obtain the message parsing result. Different from the existing technology that cannot cope with protocol variation, encryption and multi-protocol mixed scenarios through fixed protocol parsing, this application uses byte-level precise detection and construction of a protocol feature library. It can be compatible with known / unknown protocols, has strong anti-anomaly capabilities, low latency and high throughput, and supports dynamic encryption parsing. This application can achieve ≤8ms parsing delay and <10MB memory usage on the edge side, supports parsing accuracy of MQTT, CoAP and other protocols and their variants of >95%, and is suitable for efficient communication and real-time security monitoring in scenarios such as industrial Internet of Things and smart homes.

[0047] In one embodiment, after obtaining the message parsing result, the message parsing result can be corrected through reverse verification (such as field legitimacy check), and misplaced or missing data can be repaired through redundant field cross-verification (such as the same identifier appears repeatedly in multiple fields).

[0048] In one embodiment, after generating multiple message parsing results, the matching confidence between the target data message and the protocol parser can be determined, thereby determining the credibility of the multiple message parsing results corresponding to the target data message. An alarm signal is generated for the message parsing result corresponding to the protocol parser whose matching confidence is lower than a preset confidence threshold. The alarm signal is used to notify the user of the message parsing result with lower credibility among the multiple message parsing results. At the same time, the matching confidence corresponding to each message parsing result can be sent to the user to inform the user of the credibility of each message parsing result.

[0049] like Figure 2 As shown, the embodiment of the present application also provides a data message parsing device, including: At least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to: Pre-check the initial data message to obtain the target data message; extract the message features of the target data message and generate a feature hash value corresponding to the target data message; match the protocol parser corresponding to the target data message in a pre-built protocol feature library based on the feature hash value and the message features; parse the target data message through the protocol parser to obtain a message parsing result.

[0050] The embodiment of the present application further provides a non-volatile computer storage medium storing computer-executable instructions, wherein the computer-executable instructions are configured to: Pre-check the initial data packet to obtain the target data packet; extract the packet features of the target data packet and generate a feature hash value corresponding to the target data packet; based on the feature hash value and the packet features, match the protocol parser corresponding to the target data packet in a pre-constructed protocol feature library; parse the target data packet through the protocol parser to obtain a packet parsing result.

[0051] Each embodiment in this application is described in a progressive manner. For the same or similar parts among the embodiments, reference can be made to each other. Each embodiment focuses on the differences from other embodiments. In particular, for the device and medium embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and reference can be made to the corresponding parts of the method embodiments for related content.

[0052] The devices and media provided in the embodiments of this application correspond one-to-one with the methods. Therefore, the devices and media also have beneficial technical effects similar to those of the corresponding methods. Since the beneficial technical effects of the methods have been described in detail above, the beneficial technical effects of the devices and media will not be elaborated here.

[0053] Those skilled in the art should understand that the embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, this application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0054] This application is described with reference to the flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to the embodiments of this application. It should be understood that each process and / or block in the flowcharts and / or block diagrams, as well as the combination of processes and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing devices to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing devices generate a device for realizing the functions specified in Figure 1 one process or multiple processes and / or blocks Figure 1 one block or multiple blocks.

[0055] These computer program instructions can also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable memory generate a manufactured article including an instruction device, and the instruction device realizes the functions in the processFigure 1 one or more processes and / or blocks Figure 1 the functions specified in one or more blocks

[0056] These computer program instructions can also be loaded onto a computer or other programmable data processing device, so that a series of operation steps are executed on the computer or other programmable device to generate a computer-implemented process, and thus the instructions executed on the computer or other programmable device provide for implementing in the process Figure 1 one or more processes and / or blocks Figure 1 the steps of the functions specified in one or more blocks

[0057] In a typical configuration, a computing device includes one or more processors (CPUs), an input / output interface, a network interface, and memory.

[0058] Memory may include non-permanent memory in the form of computer-readable media, random access memory (RAM) and / or non-volatile memory such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0059] Computer-readable media includes permanent and non-permanent, removable and non-removable media that can store information by any method or technology. The information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassette tapes, magnetic disk storage or other magnetic storage devices, or any other non-transmission media that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transitory media such as modulated data signals and carrier waves.

[0060] It should also be noted that the term "comprise", "include" or any other variant thereof is intended to cover non-exclusive inclusion, such that a process, method, commodity or device comprising a series of elements not only includes those elements but also includes other elements not expressly listed, or further includes elements inherent to such process, method, commodity or device. Without further limitation, an element defined by the statement "comprising one..." does not exclude the presence of additional identical elements in the process, method, commodity or device comprising said element.

[0061] The above are only examples of the present application and are not intended to limit the present application. For those skilled in the art, various modifications and changes can be made to the present application. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principle of the present application shall be included within the scope of the claims of the present application.

Claims

1. A method for parsing data packets, characterized in that Including: Pre-check the initial data packet to obtain the target data packet; Extract the packet features of the target data packet and generate a feature hash value corresponding to the target data packet; Based on the feature hash value and the packet features, match the protocol parser corresponding to the target data packet in a pre-constructed protocol feature library; Parse the target data packet through the protocol parser to obtain a packet parsing result.

2. The method according to claim 1, wherein The pre-check of the initial data packet specifically includes: Perform integrity check on the initial data packet through a preset check algorithm to obtain a check result; the preset check algorithm includes at least one of a cyclic redundancy check algorithm and a message digest algorithm; Delete the initial data packets with a packet length lower than a preset length threshold and an unqualified check result to obtain the target data packet.

3. The method according to claim 1, wherein The packet features include at least one of recording the packet length, arrival time, and transport layer protocol; The generation of the feature hash value corresponding to the target data packet specifically includes: Extract a preset number of bytes from the target data packet and generate a feature hash value based on the preset number of bytes.

4. The method according to claim 1, wherein The matching of the protocol parser corresponding to the target data packet in the pre-constructed protocol feature library based on the feature hash value and the packet features specifically includes: Based on the feature hash value, match a set of candidate protocol parsers corresponding to the target data packet in the pre-constructed protocol feature library; Based on the packet features, determine a matching result in the set of candidate protocol parsers; the matching result includes at least one of a protocol name and unsuccessful matching; If the matching result is a protocol name, determine the protocol parser corresponding to the protocol name.

5. The method according to claim 4, characterized in that The packet features further include a timing feature, a fixed header, and a variable payload; the timing feature includes at least one of a packet length distribution, an interval period, and a payload change information; After determining the matching result in the set of candidate protocol parsers based on the packet features, the method further includes: Determine that the matching result is unsuccessful; Input the packet features into a pre-trained protocol prediction model to determine the predicted protocol type corresponding to the target data packet; Parse the target data packet based on the protocol parser corresponding to the predicted protocol type to obtain a packet parsing result.

6. The method according to claim 5, wherein After determining the predicted protocol type corresponding to the target data packet, the method further includes: Determine the prediction confidence of the predicted protocol type; When the prediction confidence is higher than a first preset confidence threshold, update the predicted protocol type to the protocol feature library.

7. The method according to claim 1, wherein Before matching the protocol parser corresponding to the target data packet in the pre-constructed protocol feature library based on the feature hash value and the packet features, the method further includes: Determine the protocol usage rate of existing Internet of Things protocols; Obtain the protocol features corresponding to the Internet of Things protocols with a protocol usage rate higher than a preset usage rate threshold, where the protocol features include at least one of a feature field, a regular expression, a binary sequence, and a feature hash value; Based on the protocol features, construct the protocol feature library.

8. The method according to claim 1, wherein After the target data packet is parsed by the protocol parser to obtain a packet parsing result, the method further includes: Perform reverse verification on the packet parsing result to correct the packet parsing result; Repair packet misalignment and missing data in the packet parsing result through redundant field cross-verification.

9. The method according to claim 1, wherein After the target data packet is parsed by the protocol parser to obtain a packet parsing result, the method further includes: Determine the matching confidence between the target data packet and the protocol parser; Generate an alarm signal for the packet parsing result corresponding to the protocol parser whose matching confidence is lower than a preset confidence threshold; Perform an alarm through the alarm signal.

10. A data packet parsing device, characterized in that, Includes: At least one processor; And a memory communicatively connected to the at least one processor; wherein, The memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute: Perform pre-inspection on the initial data packet to obtain a target data packet; Extract the packet features of the target data packet and generate a feature hash value corresponding to the target data packet; Based on the feature hash value and the packet features, match the protocol parser corresponding to the target data packet in a pre-constructed protocol feature library; Parse the target data packet through the protocol parser to obtain a packet parsing result.

Images