Network protocol identification method and apparatus, and electronic device

Abstract

The invention discloses a network protocol identification method and device and electronic equipment, and relates to the field of network security. The method comprises the following steps: preprocessing banner information to obtain target banner information; the target banner information is clustered, and a plurality of clusters are obtained; a representative banner sample in each cluster is determined, and all the representative banner samples form a representative set; performing protocol identification on the target representative banner sample to obtain a corresponding target network protocol type, and taking the target network protocol type as the network protocol type corresponding to each piece of target banner information included in the target cluster, the target representative banner sample being any representative banner sample in the representative set, and the representative banner sample being any representative banner sample in the representative set; the target cluster is a cluster where the target representative banner sample is located. By implementing the technical scheme provided by the invention, the network protocol category identification efficiency is improved.

Description

Technical Field

[0001] The present application relates to the field of network security, and specifically to a network protocol identification method, device, and electronic device. Background Art

[0002] With the rapid development of network technology and the widespread adoption of internet applications, network environments are becoming increasingly complex and dynamic. The variety of network services and applications continues to increase, and the types of network protocols involved are also expanding. As the foundation of network communications, the identification and analysis of network protocols are crucial for maintaining network security, optimizing network performance, and monitoring network status. Effective network protocol identification technology can help network administrators quickly identify network traffic types, promptly detect and address potential security threats, and optimize the allocation of network resources.

[0003] Currently, traditional network protocol identification methods typically rely on analyzing network packets individually or sending probe packets to identify network protocols. This piecemeal approach is significantly inefficient when dealing with large or complex network traffic volumes. For example, some methods require in-depth analysis of each packet to extract specific features for protocol identification. This approach is particularly time-consuming and computationally intensive in real-time or high-load network environments, resulting in low efficiency.

[0004] Therefore, there is an urgent need for a network protocol identification method, device and electronic device. Summary of the Invention

[0005] The present application provides a network protocol identification method, device and electronic device, which improve the efficiency of network protocol category identification.

[0006] In a first aspect of the present application, a network protocol identification method is provided, the method comprising: obtaining banner information; preprocessing the banner information to obtain target banner information; clustering the target banner information to obtain multiple clusters, wherein one cluster represents a network protocol type; determining a representative banner sample in each cluster, and forming each representative banner sample into a representative set; performing protocol identification on the target representative banner sample to obtain a target network protocol type corresponding to the target representative banner sample, and using the target network protocol type as the network protocol type corresponding to each target banner information included in the target cluster, wherein the target representative banner sample is any representative banner sample in the representative set, and the target cluster is the cluster in which the target representative banner sample is located.

[0007] By adopting the above technical solution, efficient, accurate and automated network protocol identification is achieved by obtaining banner information, preprocessing it, clustering it, selecting representative samples and identifying protocols. Specifically, the method first obtains the banner information returned by the network device or service, and performs necessary preprocessing on it to obtain standardized target banner information. Then, the method automatically groups the target banner information and aggregates similar banner information together. Each cluster represents a potential network protocol type. Next, the method selects the most representative banner samples from each cluster to form a streamlined representative set for subsequent protocol identification. Finally, the method performs protocol identification on the samples in the representative set, identifies the corresponding specific protocol type, and marks the type on all banner information of the corresponding cluster, completing the entire network protocol identification process. The method automatically groups massive banner information and aggregates similar banners together, avoiding the inefficiency of one-by-one identification. In addition, by selecting representative samples in the cluster for identification, the method not only reduces the number of identification times and improves efficiency, but also can cope with problems such as protocol version changes and customized modifications, and has good generalization. Optionally, the preprocessing of the banner information to obtain target banner information specifically includes: performing character encoding conversion on the banner information to convert the banner information into banner information in a preset encoding format; performing word segmentation processing on the converted banner information to obtain network banner keyword information; performing part-of-speech tagging on the network banner keyword information according to a preset network banner keyword dictionary to obtain tagged network banner keyword information, and using the tagged network banner keyword information as the target banner information.

[0008] By adopting the above-mentioned technical solution, this method converts unstructured, diversely formatted raw banner information into structured, standardized target banner information, laying the foundation for subsequent processing. This method utilizes character encoding conversion to eliminate differences in encoding formats, improving the consistency and accuracy of processing. Through word segmentation and part-of-speech tagging, this method extracts the banner's key information and assigns it clear semantics and categories, significantly reducing the interference of useless information and highlighting the banner's key features. Furthermore, because the preprocessed target banner information is structured and standardized, it can be directly used for subsequent clustering, recognition, and other processing, eliminating the need for tedious format conversion and manual parsing, greatly improving the automation and efficiency of processing.

[0009] Optionally, clustering the target banner information to obtain multiple clusters specifically includes: counting the word frequency of each keyword included in each target banner information according to a preset network protocol keyword dictionary to obtain a keyword word frequency vector of each target banner information; normalizing the digital characters included in each target banner information to obtain a digital feature vector of each target banner information; counting the character length, character entropy and character distribution characteristics of each target banner information to obtain a character statistical feature vector of each target banner information; splicing the keyword word frequency vector, digital feature vector and character statistical feature vector corresponding to each target banner information to obtain a network banner feature vector corresponding to each target banner information; clustering the target banner information according to the similarity between the network banner feature vectors to obtain a preset number of clusters.

[0010] By adopting this technical solution, we fully leverage the multifaceted characteristics of banner information, taking into account both keyword information, numerical information, and statistical information, enabling a comprehensive characterization of the patterns and characteristics of banner information. By integrating multi-faceted features, we improve clustering accuracy and discrimination, allowing banner information of the same protocol type to be clustered together while effectively separating banner information of different protocol types. Furthermore, by setting a preset number of clusters, we can control the granularity and complexity of clustering, ensuring it is neither too fragmented nor too coarse, facilitating subsequent protocol identification and analysis.

[0011] Optionally, clustering the target banner information according to the similarity between the network banner feature vectors to obtain a preset number of clusters specifically includes: randomly selecting a preset number of initial cluster centers from each target banner information; calculating the Euclidean distance between the network banner feature vector corresponding to each target banner information and the initial cluster center, and dividing each target banner information into a cluster corresponding to the initial cluster center closest to the corresponding network banner feature vector; and calculating the distance between each cluster according to the network banner feature vector corresponding to the target banner information included in each cluster. A new cluster center point of the cluster, wherein the new cluster center point is the geometric center of the network banner feature vector included in the corresponding cluster; determining whether the cluster center point of each cluster has changed; if so, iteratively executing the step of calculating the Euclidean distance between the network banner feature vector corresponding to each target banner information and the initial cluster center point, and dividing each target banner information into the cluster corresponding to the initial cluster center point closest to the corresponding network banner feature vector, until the cluster center point of each cluster no longer changes, thereby obtaining the preset number of clusters; if not, determining the current clustering result, and obtaining the preset number of clusters.

[0012] By adopting the above technical solution, a preset number of initial cluster centers are randomly selected. The Euclidean distance between the feature vector of each target network banner information and the initial cluster center is then calculated, and each banner information is divided into the cluster with the closest distance. Next, new cluster centers are calculated based on the banner feature vectors in each cluster, and a determination is made as to whether the cluster center has changed. If so, the division and update steps are iteratively performed until the cluster center stabilizes. Through iterative optimization, the division and center points of the clusters are continuously adjusted to maximize the similarity within the cluster and the difference between clusters. This algorithm can automatically discover the inherent distribution and patterns of banner information without the need to pre-specify the protocol type, and has strong adaptability and flexibility. By setting a preset number of clusters, the fine-grainedness of clustering can be controlled, making the clustering results more accurate and interpretable.

[0013] Optionally, the determining of the representative banner sample in each cluster specifically includes: for each cluster, calculating the cosine similarity between the network banner feature vector corresponding to each target banner information in the cluster and the cluster center of the cluster, and determining the target banner information corresponding to the maximum cosine similarity as the first candidate representative banner sample of the cluster; in each cluster, counting the frequency of occurrence of each target banner information, and determining the target banner information corresponding to the most frequent word as the second candidate representative banner sample of the cluster; in each cluster, calculating the average edit distance of each target banner information, and the average The average edit distance is the average of the edit distances between the target banner information and other target banner information in the cluster, and the target banner information corresponding to the minimum average edit distance is determined as the third candidate representative banner sample of the cluster; for each cluster, the comprehensive scores of the first candidate representative banner sample, the second candidate representative banner sample, and the third candidate representative banner sample of the cluster are compared, and the candidate representative banner sample with the highest comprehensive score is determined as the representative banner sample of the cluster, and the comprehensive score is calculated based on the cosine similarity, occurrence frequency, and average edit distance of the candidate representative banner samples.

[0014] By adopting the above technical solution and a multi-index evaluation and selection mechanism, we not only consider the representativeness of candidate samples in feature space, probability distribution and string form, but also balance the importance of different indicators through weighted fusion. This allows us to select the banner sample with the strongest overall representativeness, thereby improving the accuracy and reliability of protocol recognition.

[0015] Optionally, performing protocol identification on the target representative banner sample to obtain the target network protocol type corresponding to the target representative banner sample specifically includes: inputting the target representative banner sample into a large language model, and using the large language model to perform semantic understanding and analysis on the target representative banner sample; constructing prompt words for the network protocol identification task based on a preset prompt word template to guide the large language model to focus on key information related to the network protocol identification task; using the large language model to generate a first search statement, calling a search engine tool to obtain search results related to the target representative banner sample; performing relevance judgment on the search results, filtering out information related to the network protocol identification task, and adding the information to the knowledge base of the large language model; performing a comprehensive analysis of the target representative banner sample, the prompt words and the search results through the large language model, and outputting the target network protocol type corresponding to the target representative banner sample.

[0016] By adopting the above technical solution, a large language model is used to perform semantic understanding and in-depth analysis of representative target banner samples, which can identify implicit protocol information and feature details. With the help of preset prompt word templates, the large language model focuses on the key content of the network protocol identification task, thereby reducing the interference of irrelevant information and further improving the accuracy of identification. By generating search statements and calling the search engine to obtain additional external information, the latest protocol-related data can be obtained from the dynamically updated knowledge base. The search results are added to the knowledge base of the large language model, allowing the model to directly utilize this external information in subsequent tasks and enrich its understanding of network protocols. Through the interactive cycle of the large language model's automated semantic analysis and the search engine, the protocol identification task can be completed without human intervention. Even if the initial search results are insufficient to support the judgment, optimized search statements can be automatically generated, gradually converging to the final result.

[0017] Optionally, it is characterized in that after performing relevance judgment on the first search result and filtering out information related to the network protocol identification task, the method also includes: if information related to the network protocol identification task is not filtered out, generating a second search statement and iteratively calling the search engine tool until information related to the network protocol identification task is filtered out or the number of iterations is reached.

[0018] By employing this technical solution, if the initial search results fail to provide relevant information for the network protocol identification task, a new search statement is automatically generated and the search engine tool is called again. This iterative mechanism effectively avoids recognition failures caused by incomplete initial input or inaccurate search statements, significantly improving the recognition success rate.

[0019] In a second aspect of the present application, a network protocol identification device is provided, which includes: an information acquisition module, a preprocessing module, a clustering module, a sample determination module and a protocol identification module, wherein: the information acquisition module is used to acquire banner information; the preprocessing module is used to preprocess the banner information to obtain target banner information; the clustering module is used to cluster the target banner information to obtain multiple clusters, wherein one cluster represents a network protocol type; the sample determination module is used to determine a representative banner sample in each cluster and form each representative banner sample into a representative set; the protocol identification module is used to perform protocol identification on the target representative banner sample to obtain a target network protocol type corresponding to the target representative banner sample, and use the target network protocol type as the network protocol type corresponding to each target banner information included in the target cluster, the target representative banner sample is any representative banner sample in the representative set, and the target cluster is the cluster where the target representative banner sample is located.

[0020] In the third aspect of the present application, an electronic device is provided, including a processor, a memory, a user interface and a network interface, the memory is used to store instructions, the user interface and the network interface are both used to communicate with other devices, and the processor is used to execute the instructions stored in the memory so that the electronic device performs any of the methods described above.

[0021] In a fourth aspect of the present application, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores instructions. When the instructions are executed, any one of the methods described above is executed.

[0022] In summary, one or more technical solutions provided in the embodiments of the present application have at least the following technical effects or advantages: 1. Automatically grouping massive amounts of banner information, aggregating similar banners together, avoiding the inefficiency of individual identification. Furthermore, by selecting representative samples from clusters for identification, this method not only reduces the number of identification attempts and improves efficiency, but also adapts to protocol version changes and customizations, demonstrating good generalization. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 This is a flow chart of a network protocol identification method disclosed in an embodiment of the present application; Figure 2This is a module diagram of a network protocol identification device disclosed in an embodiment of the present application; Figure 3 This is a structural diagram of an electronic device disclosed in an embodiment of the present application.

[0024] Explanation of the accompanying drawings: 201, information acquisition module; 202, preprocessing module; 203, clustering module; 204, sample determination module; 205, protocol identification module; 300, electronic device; 301, processor; 302, communication bus; 303, user interface; 304, network interface; 305, memory. DETAILED DESCRIPTION

[0025] In order to enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below in conjunction with the drawings in the embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this application, not all of the embodiments.

[0026] In the description of the embodiments of this application, words such as "for example" or "for instance" are used to indicate examples, illustrations, or explanations. Any embodiment or design described as "for example" or "for instance" in the embodiments of this application should not be construed as being preferred or advantageous over other embodiments or designs. Rather, the use of words such as "for example" or "for instance" is intended to present the relevant concepts in a concrete manner.

[0027] In the description of the embodiments of the present application, the term "multiple" means two or more. For example, multiple systems refer to two or more systems, and multiple screen terminals refer to two or more screen terminals. In addition, the terms "first" and "second" are used for descriptive purposes only and are not to be understood as indicating or implying relative importance or implicitly indicating the indicated technical features. Thus, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features. The terms "including", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized.

[0028] This application provides a network protocol identification method, referring to Figure 1 , Figure 1 This is a flow chart of a network protocol identification method provided in an embodiment of the present application. The method is applied to a server, which is a server that executes a network protocol identification program. The server can be a single server, a server cluster consisting of multiple servers, or a cloud computing service center. The method includes steps S101 to S109, which are as follows: Step S101: Obtain banner information.

[0029] In step S101, the server, as the executing entity, is responsible for obtaining banner information. Banner information refers to a piece of data sent from the server to the client during network communication that identifies the server's identity, version number, supported functions, and other information. The server can obtain banner information in various ways. One method is active scanning. The server can use network scanning tools such as Nmap and Zmap to actively scan devices within the target network segment, send probe packets, and extract banner information from the response packets returned by the devices. Another method is passive monitoring. The server can be deployed at a network egress, such as a gateway or a mirrored port on a switch, to passively monitor network traffic passing through that location and extract banner information. When devices on the network communicate, the server can capture the corresponding network packets and extract banner information based on the payload content of the packets, such as HTTP response headers, FTP welcome messages, and SSH version numbers. A third method is honeypot capture. The server can deploy a honeypot system to simulate the behavior of a real system to attract attackers to conduct probing. When an attacker interacts with the honeypot system, the server can record the attacker's network requests and extract banner information from the request data.

[0030] Step S102: pre-process the banner information to obtain target banner information.

[0031] In step S102, the banner information is preprocessed to obtain target banner information, specifically including: performing character encoding conversion on the banner information to convert the banner information into banner information in a preset encoding format; performing word segmentation processing on the converted banner information to obtain network banner keyword information; performing part-of-speech tagging on the network banner keyword information according to a preset network banner keyword dictionary to obtain tagged network banner keyword information, and using the tagged network banner keyword information as the target banner information.

[0032] Specifically, the server preprocesses the acquired banner information to obtain the target banner information. The purpose of preprocessing is to normalize and structure the banner information, extract key features, and prepare for subsequent analysis and recognition. The server specifically performs the following steps: The server first performs character encoding conversion. Since banner information returned by network devices may use different character encodings, the server must convert these encodings to a predefined encoding format for unified processing. UTF-8 is typically chosen as the predefined encoding due to its multilingual support and compatibility. The server can automatically detect the original encoding of the banner information using an encoding detection algorithm, such as Chardet, and then convert it to UTF-8 using an encoding conversion library.

[0033] The server then performs word segmentation. Banner information typically consists of multiple words or phrases. To extract key information, the server performs word segmentation on the banner, breaking it down into independent semantic units. The word segmentation method can be designed based on the grammatical characteristics of the banner, such as using delimiters such as spaces, slashes, and parentheses.

[0034] The server then performs part-of-speech tagging. The segmented banner keyword information contains different types of vocabulary, such as software names, version numbers, and operating systems. To distinguish the semantic roles of these words, the server tags them with part-of-speech. A pre-built dictionary of online banner keywords (pre-set online banner keyword dictionary) is built within the server, containing common software and hardware names, version number formats, operating system types, and so on. The server then matches the segmented keywords with the dictionary and tags their parts of speech.

[0035] Finally, the server uses the annotated network banner keyword information as the target banner information for subsequent feature extraction and protocol recognition. The target banner information is represented in a structured form.

[0036] Step S103: clustering the target banner information to obtain multiple clusters, wherein one cluster represents one network protocol type.

[0037] In step S103, the target banner information is clustered to obtain a plurality of clusters, specifically including: counting the frequency of each keyword included in each target banner information according to a preset network protocol keyword dictionary to obtain a keyword frequency vector of each target banner information; normalizing the digital characters included in each target banner information to obtain a digital feature vector of each target banner information; counting the character length, character entropy and character distribution characteristics of each target banner information to obtain a character statistical feature vector of each target banner information; concatenating the keyword frequency vector, digital feature vector and character statistical feature vector corresponding to each target banner information to obtain a network banner feature vector corresponding to each target banner information; and clustering the target banner information according to the similarity between the network banner feature vectors to obtain a preset number of clusters.

[0038] Specifically, the server clusters the target banner information, placing similar banner information into the same cluster. Each cluster represents a network protocol type. The purpose of clustering is to discover the inherent structure and patterns of banner information, providing a basis for protocol identification. The server performs the following steps: The server counts the frequency of keywords appearing in each target banner message based on a preset network protocol keyword dictionary. The keyword dictionary contains characteristic terms for various common network protocols, such as "HTTP," "SSL," and "SSH." The server segmented the banner message and matched it against the dictionary, recording the number of occurrences of each keyword and generating a keyword frequency vector. For example, for an HTTP server banner message like "Apache / 2.4.1 (Unix) PHP / 5.6.3," its keyword frequency vector might be {"Apache": 1, "Unix": 1, "PHP": 1}. Furthermore, network protocol banner messages often contain numeric characters such as version numbers, and the range of numeric values can vary significantly between banners. To facilitate comparison, the server normalizes the numbers. Normalization methods include maximum-minimum normalization and zero-mean normalization. For example, the version number "2.4.1" can be normalized to 0.241, and "5.6.3" can be normalized to 0.563. Normalized digital feature vectors can reflect the numerical differences between different banners while eliminating dimensionality effects. Besides keywords and numbers, the character composition of banner information can also reflect protocol characteristics. The server calculates characteristics such as character length, character entropy, and character distribution for each target banner information. Character length indicates the total number of characters in the banner; character entropy measures the degree of randomness in the banner content; higher entropy values indicate more complex banners; and character distribution reflects the proportions of different character types (e.g., letters, numbers, and special symbols). These statistical features can characterize the overall characteristics of a banner and help distinguish different protocol types.

[0039] The server concatenates the keyword frequency vector, numerical feature vector, and character statistical feature vector of each target banner into a complete network banner feature vector. This concatenated feature vector integrates multiple aspects of the banner, providing a more comprehensive representation of its characteristics. For example, the banner feature vector of an SSH server might be {keyword frequency vector, numerical feature vector, character length, character entropy, character distribution}. Finally, the server clusters the target banner information based on the similarity between the network banner feature vectors. Clustering algorithms can include K-means, hierarchical clustering, DBSCAN, and others.

[0040] In a possible implementation, target banner information is clustered according to the similarity between network banner feature vectors to obtain a preset number of clusters, specifically comprising: randomly selecting a preset number of initial cluster centers from each target banner information; calculating the Euclidean distance between the network banner feature vector corresponding to each target banner information and the initial cluster center, and dividing each target banner information into a cluster corresponding to the initial cluster center closest to the corresponding network banner feature vector; and calculating the network banner feature vector corresponding to the target banner information included in each cluster according to the network banner feature vector corresponding to the target banner information. Calculate the new cluster center point of each cluster cluster, where the new cluster center point is the geometric center of the network banner feature vector included in the corresponding cluster cluster; determine whether the cluster center point of each cluster cluster has changed; if so, iteratively perform the steps of calculating the Euclidean distance between the network banner feature vector corresponding to each target banner information and the initial cluster center point, and divide each target banner information into the cluster cluster corresponding to the initial cluster center point closest to the corresponding network banner feature vector, until the cluster center point of each cluster cluster no longer changes and a preset number of cluster clusters are obtained; if not, determine the current clustering result and obtain a preset number of cluster clusters.

[0041] Specifically, the server divides the target banner information into a preset number of clusters based on the similarity between network banner feature vectors. The banner information features within each cluster are similar, representing a potential network protocol type. The server specifically performs the following steps: The server randomly selects a preset number (denoted as K) of vectors from the feature vectors corresponding to all target banners as initial cluster centers. These K centers serve as the initial representatives of the clusters, around which the remaining banners are clustered. Next, the server calculates the Euclidean distance between the feature vector of each target banner and the K initial cluster centers. Euclidean distance measures the similarity between vectors; smaller distances indicate closer vectors and more similar banners. The server assigns each banner to the cluster containing the cluster center closest to its feature vector. This step forms K initial clusters, each with the banner features closest to the cluster center. After completing the initial banner assignment, the server updates the center of each cluster. The new center better represents the features of all banners within the cluster. The server calculates the geometric center of the banner feature vectors within each cluster, taking the mean of each vector in each dimension as the new cluster center. For example, assuming that there are three eigenvectors in a cluster: (1, 2, 3), (2, 3, 4), and (3, 4, 5), then the new center point is ((1+2+3) / 3, (2+3+4) / 3, (3+4+5) / 3) = (2, 3, 4). The server determines whether the updated cluster center point has changed from the center point of the previous round. If the center point has changed, it means that the cluster division is not stable enough and needs further optimization. The server uses the updated center point as the new cluster center and repeats the above steps, that is, recalculating the distance between the banner and the center point, assigning the banner to the nearest cluster, and updating the center point of the cluster. This process iterates continuously until the cluster center point no longer changes or the preset number of iterations is reached.

[0042] Once the cluster centers stabilize, the server determines the final clustering results, resulting in a preset number of K clusters. The banner information within each cluster is similar in characteristics, representing a network protocol type. The server analyzes the banner information within each cluster and summarizes the characteristics of the protocol type, such as keyword distribution, number range, and character patterns, to provide reference for subsequent protocol identification.

[0043] For example, suppose the server clusters 100 target banners, with a preset number of clusters, K = 3. The server first extracts the feature vector of each banner and then randomly selects three vectors as initial cluster centers. Next, the server calculates the Euclidean distance from each banner feature vector to the three centers and assigns them to the nearest cluster. The server then calculates the geometric center of each feature vector within each cluster and updates the cluster centers. The server determines whether the cluster centers have changed. If so, it repeats the banner assignment and cluster center update steps until the cluster centers stabilize. Ultimately, the server outputs three clusters, each containing banners representing a protocol type, such as the HTTP protocol cluster, the SSH protocol cluster, or the FTP protocol cluster. By analyzing the similarities and differences between the banners within each cluster, the server can summarize the characteristic patterns of different protocol types, laying the foundation for subsequent protocol identification.

[0044] Step S104: Determine the representative banner samples in each cluster, and group the representative banner samples into a representative set.

[0045] In step S104, the representative banner sample in each cluster is determined, specifically including: for each cluster, calculating the cosine similarity between the network banner feature vector corresponding to each target banner information in the cluster and the cluster center of the cluster, and determining the target banner information corresponding to the maximum cosine similarity as the first candidate representative banner sample of the cluster; in each cluster, counting the frequency of occurrence of each target banner information, and determining the target banner information corresponding to the most frequent word as the second candidate representative banner sample of the cluster; in each cluster, calculating the average edit distance of each target banner information, and averagely calculating the average edit distance of each target banner information. The average edit distance is the average of the edit distances between the target banner information and other target banner information in the cluster. The target banner information corresponding to the minimum average edit distance is determined as the third candidate representative banner sample of the cluster. For each cluster, the comprehensive scores of the first candidate representative banner sample, the second candidate representative banner sample, and the third candidate representative banner sample of the cluster are compared, and the candidate representative banner sample with the highest comprehensive score is determined as the representative banner sample of the cluster. The comprehensive score is calculated based on the cosine similarity, occurrence frequency, and average edit distance of the candidate representative banner samples.

[0046] Specifically, the server selects the most representative banner samples (representative banner samples) from each cluster to form a representative set. Representative banner samples can better reflect the characteristics of the cluster, facilitating subsequent protocol identification of the entire cluster. The server comprehensively considers multiple indicators and determines the representative banner samples for each cluster through three rounds of screening. Specifically, the following steps are performed: In the first round of screening, the server calculates the cluster center of each cluster—the geometric center of all target banner feature vectors within that cluster. For each cluster, the server calculates the cosine similarity between each target banner feature vector within the cluster and the cluster center. Cosine similarity measures the angle between two vectors and ranges from [0, 1]. Larger values indicate closer orientations and more similar banner features. The server selects the banner with the highest cosine similarity as the first candidate representative banner sample for that cluster. This sample is closest to the cluster center in feature space and best represents the overall characteristics of the cluster.

[0047] The second round of screening involves frequency of occurrence. The server counts the frequency of occurrence of each banner within each cluster, specifically the number of times the banner appears in the original dataset. For each cluster, the server selects the banner with the highest frequency as the second candidate representative banner sample for that cluster. High-frequency banners are both universal and representative, reflecting common characteristics of the protocol type.

[0048] The third round of screening involves average edit distance. The server calculates the edit distance between each banner in each cluster and the other banners in that cluster, then averages these distances to obtain the average edit distance for that banner. The edit distance measures the degree of difference between two strings, including the number of insertions, deletions, and substitutions required. The smaller the average edit distance, the smaller the difference between the banner and other samples in the cluster, and the more representative it is. For each cluster, the server selects the banner with the smallest average edit distance as the third candidate representative banner sample for that cluster. This sample is most similar in string format to the other samples in the cluster and embodies the typical characteristics of that protocol type.

[0049] The server comprehensively scores the three candidate representative banner samples for each cluster and selects the final representative banner sample. The comprehensive score is calculated using a weighted combination of the candidate representative banner samples' cosine similarity, frequency of occurrence, and average edit distance. The server presets weights for each metric, such as 0.5 for similarity, 0.3 for frequency, and 0.2 for edit distance. The server then multiplies the three metrics by their corresponding weights and adds them together to create a comprehensive score. The weights can be adjusted based on actual needs to balance the importance of different metrics.

[0050] For each cluster, the server selects the candidate sample with the highest overall score as the representative banner sample for that cluster. This sample demonstrates strong representativeness across multiple metrics and fully reflects the characteristics of the cluster. The server organizes these representative banner samples from each cluster into a representative set for subsequent protocol identification. The number of samples in the representative set equals the number of clusters, with each sample corresponding to one cluster. These samples are optimally representative within their respective clusters and can represent different protocol types.

[0051] Step S105: Perform protocol identification on the target representative banner sample to obtain the target network protocol type corresponding to the target representative banner sample, and use the target network protocol type as the network protocol type corresponding to each target banner information included in the target cluster. The target representative banner sample is any representative banner sample in the representative set, and the target cluster is the cluster where the target representative banner sample is located.

[0052] In a possible implementation, the method further includes: obtaining historical network traffic and historical network types corresponding to historical banner information; extracting traffic statistical features, packet length distribution features, and message arrival time interval features of the historical network traffic; and training the historical network types based on the traffic statistical features, packet length distribution features, and message arrival time interval features to obtain a network protocol classifier.

[0053] Specifically, the server obtains historical network traffic and network types corresponding to historical banner information. Historical network traffic refers to network communication data associated with the banner information, including packet content, length, and timestamps. Historical network types refer to known protocol types associated with this network traffic, such as HTTP, SSH, and FTP. This data can be obtained through manual annotation or other methods. Historical data can be collected from the server's own logs or from external data sources, such as network traffic storage systems and protocol analysis tools. The server analyzes historical network traffic and extracts traffic statistics, packet length distribution, and packet arrival time characteristics that reflect protocol characteristics. Traffic statistics include the total number of packets, number of bytes, average packet length, and maximum packet length, reflecting differences in data volume and packet size across different protocols. Packet length distribution describes the distribution of packet lengths, such as the proportion of packets in different length ranges, the mean and standard deviation of packet lengths, and can reflect the data transmission patterns of different protocols. Packet arrival time characteristics describe the temporal patterns of packet arrivals, such as the average time interval between consecutive packets and the distribution of these time intervals. They can reflect the interaction methods and real-time requirements of different protocols.

[0054] The server uses the extracted traffic features and the corresponding historical network types to train the network protocol classifier. The classifier can be based on machine learning algorithms such as decision trees, support vector machines, neural networks, etc., and by learning the feature-type mapping relationship in historical data, it builds a model that can map traffic features to protocol types. The server divides the historical data into a training set and a test set. The training set is used to train the classifier model, and the test set is used to evaluate the accuracy of the model. The server can try different machine learning algorithms and parameter settings, and select the classifier model with the best performance through methods such as cross-validation. During the training process, the server continuously adjusts the parameters and structure of the classifier to continuously improve its classification accuracy on the training set. At the same time, it avoids overfitting through regularization and other techniques to improve the classifier's generalization ability on unknown data.

[0055] The server uses the test set data to evaluate the performance of the trained protocol classifier, including metrics such as accuracy, precision, recall, and F1 value. Accuracy measures the correctness of the classifier's judgment of the overall sample size, while precision and recall measure the accuracy and completeness of each category's judgment, respectively. The F1 value is the harmonic average of precision and recall, comprehensively reflecting the classifier's performance.

[0056] For example, suppose the server has collected a batch of historical network data, including 10,000 HTTP traffic, 5,000 SSH traffic, and 2,000 FTP traffic, as well as the corresponding banner information. The server first extracts the statistical features of each traffic (such as the number of packets, total bytes), packet length distribution features (such as average packet length, maximum packet length), and message arrival time interval features (such as average time interval, maximum time interval). The server then uses these features and the corresponding protocol type labels (HTTP, SSH, FTP) as training data to train a decision tree classifier. Through 10-fold cross-validation, the server found that the classifier achieved an accuracy of 95% on the training set and 93% on the test set, indicating that the classifier can effectively learn the traffic characteristic patterns of different protocols.

[0057] In step S105, protocol identification is performed on the target representative banner sample to obtain the target network protocol type corresponding to the target representative banner sample, specifically including: vectorizing the target representative banner sample to obtain a feature vector corresponding to the target representative banner sample; inputting the feature vector into the input layer of the network protocol classifier and propagating it to the hidden layer; in the hidden layer, performing a nonlinear transformation on the feature vector through an activation function to extract high-level features of the target representative banner sample; passing the extracted high-level features to the output layer of the network protocol classifier; in the output layer, normalizing the high-level features through a softmax function to obtain a probability distribution of the target representative banner sample belonging to each network protocol type, and taking the network protocol type corresponding to the maximum probability in the probability distribution as the target network protocol type.

[0058] Specifically, the server uses a trained network protocol classifier to identify the target representative banner sample, determine the target network protocol type it belongs to, and mark this type on all banner information in the target cluster. The server extracts features and classifies and predicts the target representative banner sample, leveraging the generalization capability of the classifier to achieve protocol type identification for the entire cluster. The server specifically performs the following steps: The server vectorizes the target representative banner sample, converting it into a numerical feature vector. This vectorization can be based on methods such as the bag-of-words model, TF-IDF, and Word2Vec, mapping keywords, character sequences, and other information in the banner sample into a fixed-length real-value vector. The server inputs the feature vector of the target representative banner sample into the input layer of the network protocol classifier, beginning feature propagation and classification prediction. The number of nodes in the classifier's input layer matches the dimensionality of the feature vector, with each node receiving a single feature value.

[0059] After receiving the feature vector, the input layer passes it to the classifier's hidden layer. This hidden layer consists of multiple neuron nodes. Each node receives signals from the input layer through weighted connections and applies an activation function to the weighted sum, performing a nonlinear transformation. Activation functions include sigmoid, tanh, and ReLU, which enhance the classifier's expressiveness and the nonlinearity of its decision boundary.

[0060] In the hidden layer, the server applies a nonlinear transformation to the feature vector using an activation function to extract high-level features of the target representative banner sample. High-level features are an abstraction and combination of the original features, better capturing the semantic patterns and protocol characteristics of the banner sample. The hidden layer can contain multiple levels, and the neurons in each level progressively extract more abstract and robust feature representations through nonlinear transformations and weighted transfer. Through these multiple layers of feature transformation and transfer, the classifier can automatically learn the inherent patterns and discriminative features of the banner sample.

[0061] The server passes the high-level features extracted from the hidden layer to the output layer of the classifier for final classification prediction. The number of nodes in the output layer is the same as the number of network protocol types, and each node represents a possible protocol type. In the output layer, the server normalizes the high-level features using the softmax function and converts them into a probability distribution. The softmax function maps the output value to the interval (0, 1) and ensures that the sum of all output values is 1, indicating the probability that the sample belongs to each category. The server selects the protocol type with the largest probability value in the probability distribution as the target network protocol type for the target representative banner sample. The larger the probability value, the higher the probability that the sample belongs to that type, and the higher the confidence of the classifier. The server marks the identified target network protocol type on all banner information in the target cluster. Since the target representative banner sample can represent the characteristics of the entire cluster, the protocol type to which it belongs can also be generalized to the entire cluster.

[0062] By identifying the protocol type of a representative target banner sample, the server can identify the protocol type of the entire cluster, avoiding the redundancy and overhead of identifying each banner sample individually. This identification method based on clustering and representative samples improves recognition efficiency and coverage.

[0063] For example, suppose the server selects a banner sample "HTTP / 1.1 200 OK" from cluster A as the target representative banner sample. First, the server vectorizes this sample, extracting keyword features (such as "HTTP," "1.1," "200," and "OK") and converting them into a real number vector [0.8, 0.6, 0.9, 0.7]. The server then inputs this feature vector into a trained network protocol classifier. After propagation and transformation through the input, hidden, and output layers, the server obtains the probability distribution of this sample across various protocol types: for example, HTTP: 0.95, SSH: 0.02, and FTP: 0.03. The server selects HTTP, which has the highest probability, as the target network protocol type for this sample. Finally, the server tags all banner information in cluster A with HTTP, thereby completing protocol type identification for the entire cluster.

[0064] In step S105, protocol identification is performed on the target representative banner sample to obtain the target network protocol type corresponding to the target representative banner sample, specifically including: inputting the target representative banner sample into a large language model, and using the large language model to perform semantic understanding and analysis on the target representative banner sample; constructing prompt words for the network protocol identification task based on a preset prompt word template to guide the large language model to focus on key information related to the network protocol identification task; using the large language model to generate a first search statement, calling a search engine tool to obtain search results related to the target representative banner sample; performing relevance judgment on the search results to filter out information related to the network protocol identification task, and adding the information to the knowledge base of the large language model; and performing a comprehensive analysis of the target representative banner sample, the prompt words, and the search results through the large language model to output the target network protocol type corresponding to the target representative banner sample.

[0065] Specifically, the server first inputs the target representative banner sample into a pre-trained large language model. The large language model has powerful semantic understanding and analysis capabilities, capable of extracting key information from the input text content and performing inference. The server leverages this capability to allow the large language model to deeply analyze the content of the banner sample and identify the network protocol-related information contained therein, such as the protocol name, version number, key fields, etc. The server then constructs prompt words for the network protocol identification task based on a preset prompt word template. The prompt word can be thought of as a task description, telling the large language model what information to focus on and how to use this information to make judgments. For example, the prompt word might be "Please analyze the following banner information to determine the type of network protocol it uses." The server inputs the prompt word along with the banner sample into the large language model, guiding it to focus on keywords and semantic fragments related to protocol identification.

[0066] Next, the server uses the large language model to generate the first search statement. This search statement typically consists of keywords and aims to obtain supplementary information related to the current banner sample from an external knowledge base. For example, for a sample containing "HTTP / 1.1," the generated search statement might be "HTTP protocol version 1.1 features." The server passes the generated search statement to search engine tools, such as search engines and knowledge base query interfaces, to obtain search results. The server determines the relevance of the returned search results and filters them, retaining content closely related to network protocols. This information is supplemented into the large language model's knowledge base, enriching its understanding of different protocols and improving the accuracy of subsequent judgments.

[0067] Finally, the server performs a comprehensive analysis using the large language model. It considers the banner sample, the prompt word, and the retrieved relevant information, leveraging the large language model's reasoning capabilities to determine the network protocol used in the sample. For example, for a sample containing "HTTP / 1.1 200 OK," combining the task requirements in the prompt word with the HTTP protocol information in the knowledge base, the large language model can output the target network protocol type, such as "The network protocol used in this banner is HTTP, version 1.1."

[0068] In one possible implementation, after performing a relevance judgment on the first search result and filtering out information related to the network protocol identification task, the method further includes: if information related to the network protocol identification task is not filtered out, generating a second search statement and iteratively calling the search engine tool until information related to the network protocol identification task is filtered out or the number of iterations is reached.

[0069] Specifically, if the server finds that the first round of search screening is unsuccessful, it triggers the generation of a secondary search statement. The server then reanalyzes the content of the target representative banner sample, extracting additional information beyond the keywords included in the first search statement, such as special field names and status codes that appear in the sample. Simultaneously, the server also consults the knowledge base of the large language model to identify background knowledge related to this additional information, thereby broadening the search scope.

[0070] For example, for a banner sample containing "FTP / 1.0 331 User name okay, need password," the first search query might be "FTP protocol version 1.0 features," but the results are unsatisfactory. The server then extracts the FTP status code "331" from the sample and searches the knowledge base, finding that it represents "Username OK, password required." Based on this, the server generates a second search query: "FTP protocol user authentication 331 status code," shifting the search focus from protocol features to the more specific semantics of the status code.

[0071] The server then feeds the newly generated second search statement into the search engine tool, obtaining a second round of search results and performing another relevance check and screening. If relevant information related to the network protocol identification task is extracted, it is added to the knowledge base of the large language model and the subsequent comprehensive analysis steps are continued.

[0072] If the second search still fails to retrieve relevant information, the server will iterate, generating third and fourth search statements until one of the following two conditions is met: A search successfully identifies information relevant to the network protocol identification task. The number of iterations reaches a preset upper limit, such as 3 or 5. This upper limit is set to prevent the server from consuming excessive resources through repeated searches. Once these conditions are met, the server terminates the iterative search process.

[0073] Reference Figure 2The present application also provides a network protocol identification device, which is a server. The server includes an information acquisition module 201, a preprocessing module 202, a clustering module 203, a sample determination module 204, and a protocol identification module 205, wherein: the information acquisition module 201 is used to obtain banner information; the preprocessing module 202 is used to preprocess the banner information to obtain target banner information; the clustering module 203 is used to cluster the target banner information to obtain multiple clusters, wherein a cluster represents a network protocol type; the sample determination module 204 is used to determine a representative banner sample in each cluster and form each representative banner sample into a representative set; the protocol identification module 205 is used to perform protocol identification on the target representative banner sample to obtain a target network protocol type corresponding to the target representative banner sample, and use the target network protocol type as the network protocol type corresponding to each target banner information included in the target cluster, the target representative banner sample is any representative banner sample in the representative set, and the target cluster is the cluster where the target representative banner sample is located.

[0074] In one possible implementation, the preprocessing module 202 preprocesses the banner information to obtain target banner information, specifically including: the preprocessing module 202 performs character encoding conversion on the banner information to convert the banner information into banner information in a preset encoding format; the preprocessing module 202 performs word segmentation processing on the converted banner information to obtain network banner keyword information; the preprocessing module 202 performs part-of-speech tagging on the network banner keyword information according to a preset network banner keyword dictionary to obtain tagged network banner keyword information, and uses the tagged network banner keyword information as the target banner information.

[0075] In one possible implementation, the clustering module 203 clusters the target banner information to obtain a plurality of cluster clusters, specifically including: the clustering module 203 counts the frequency of each keyword included in each target banner information according to a preset network protocol keyword dictionary to obtain a keyword frequency vector of each target banner information; the clustering module 203 normalizes the digital characters included in each target banner information to obtain a digital feature vector of each target banner information; the clustering module 203 counts the character length, character entropy, and character distribution characteristics of each target banner information to obtain a character statistical feature vector of each target banner information; the clustering module 203 concatenates the keyword frequency vector, digital feature vector, and character statistical feature vector corresponding to each target banner information to obtain a network banner feature vector corresponding to each target banner information; the clustering module 203 clusters the target banner information according to the similarity between the network banner feature vectors to obtain a preset number of cluster clusters.

[0076] In a possible implementation, the clustering module 203 clusters the target banner information according to the similarity between the network banner feature vectors to obtain a preset number of clusters, specifically including: the clustering module 203 randomly selects a preset number of initial cluster centers from each target banner information; the clustering module 203 calculates the Euclidean distance between the network banner feature vector corresponding to each target banner information and the initial cluster center, and divides each target banner information into the cluster corresponding to the initial cluster center closest to the corresponding network banner feature vector; the clustering module 203 clusters the target banner information according to the network banner feature vector corresponding to each cluster; vector, calculates a new cluster center point for each cluster cluster, where the new cluster center point is the geometric center of the network banner feature vector included in the corresponding cluster cluster; the clustering module 203 determines whether the cluster center point of each cluster cluster has changed; if so, the clustering module 203 iteratively executes the steps of calculating the Euclidean distance between the network banner feature vector corresponding to each target banner information and the initial cluster center point, and dividing each target banner information into the cluster cluster corresponding to the initial cluster center point closest to the corresponding network banner feature vector, until the cluster center point of each cluster cluster no longer changes and a preset number of cluster clusters are obtained; if not, the clustering module 203 determines the current clustering result and obtains a preset number of cluster clusters.

[0077] In a possible implementation, the sample determination module 204 determines the representative banner sample in each cluster, specifically including: the sample determination module 204 calculates the cosine similarity between the network banner feature vector corresponding to each target banner information in the cluster and the cluster center of the cluster for each cluster, and determines the target banner information corresponding to the maximum cosine similarity as the first candidate representative banner sample of the cluster; the sample determination module 204 counts the frequency of occurrence of each target banner information in each cluster, and determines the target banner information corresponding to the most frequent word as the second candidate representative banner sample of the cluster; the sample determination module 204 calculates the frequency of occurrence of each target banner information in each cluster, and determines the target banner information corresponding to the most frequent word as the second candidate representative banner sample of the cluster; nner information, where the average edit distance is the average of the edit distances between the target banner information and other target banner information in the cluster, and the target banner information corresponding to the minimum average edit distance is determined as the third candidate representative banner sample of the cluster; for each cluster, the sample determination module 204 compares the comprehensive scores of the first candidate representative banner sample, the second candidate representative banner sample, and the third candidate representative banner sample of the cluster, and determines the candidate representative banner sample with the highest comprehensive score as the representative banner sample of the cluster, where the comprehensive score is calculated based on the cosine similarity, occurrence frequency, and average edit distance of the candidate representative banner samples.

[0078] In one possible implementation, the protocol identification module 205 performs protocol identification on a target representative banner sample to obtain a target network protocol type corresponding to the target representative banner sample. Specifically, the protocol identification module 205 inputs the target representative banner sample into a large language model and uses the large language model to perform semantic understanding and analysis on the target representative banner sample. The protocol identification module 205 constructs prompt words for the network protocol identification task based on a preset prompt word template to guide the large language model to focus on key information related to the network protocol identification task. The protocol identification module 205 generates a first search statement using the large language model and calls a search engine tool to obtain search results related to the target representative banner sample. The protocol identification module 205 performs relevance judgment on the search results, filters out information related to the network protocol identification task, and adds the information to the knowledge base of the large language model. The protocol identification module 205 performs a comprehensive analysis of the target representative banner sample, the prompt words, and the search results using the large language model to output the target network protocol type corresponding to the target representative banner sample.

[0079] In one possible embodiment, after the protocol identification module 205 performs a relevance judgment on the first search result and filters out information related to the network protocol identification task, the method further includes: if the protocol identification module 205 does not filter out information related to the network protocol identification task, the protocol identification module 205 generates a second search statement and iteratively calls the search engine tool until information related to the network protocol identification task is filtered out or the number of iterations is reached.

[0080] It should be noted that the above embodiments provide devices that implement their functions using only the division of the above functional modules as examples. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. In addition, the device and method embodiments provided in the above embodiments are based on the same concept. The specific implementation process is detailed in the method embodiment and will not be repeated here.

[0081] This application also provides an electronic device. Figure 3 , Figure 3 3. This is a schematic diagram of the structure of an electronic device provided by an embodiment of the present application. The electronic device 300 may include: at least one processor 301, at least one network interface 304, a user interface 303, a memory 305, and at least one communication bus 302.

[0082] The communication bus 302 is used to implement the connection and communication between these components.

[0083] The user interface 303 may include a display screen (Display) and a camera (Camera). Optionally, the user interface 303 may also include a standard wired interface and a wireless interface.

[0084] The network interface 304 may optionally include a standard wired interface or a wireless interface (such as a WI-FI interface).

[0085] The processor 301 may include one or more processing cores. Using various interfaces and circuits, the processor 301 connects to various components within the server. It executes instructions, programs, code sets, or instruction sets stored in the memory 305, as well as accesses data stored in the memory 305, to perform various server functions and process data. Optionally, the processor 301 may be implemented using at least one of the following hardware forms: a digital signal processing (DSP), a field-programmable gate array (FPGA), or a programmable logic array (PLA). The processor 301 may integrate one or a combination of a central processing unit (CPU), a graphics processing unit (GPU), and a modem. The CPU primarily processes the operating system, user interface, and application programs; the GPU is responsible for rendering and drawing content displayed on the display screen; and the modem handles wireless communications. It is understood that the modem may not be integrated into the processor 301 but implemented as a separate chip.

[0086] Among them, the memory 305 may include a random access memory (RAM) or a read-only memory (Read-Only Memory). Optionally, the memory 305 includes a non-transitory computer-readable storage medium. The memory 305 can be used to store instructions, programs, codes, code sets or instruction sets. The memory 305 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function (such as a touch function, a sound playback function, an image playback function, etc.), instructions for implementing the above-mentioned various method embodiments, etc.; the data storage area may store data involved in the above-mentioned various method embodiments, etc. The memory 305 may also optionally be at least one storage device located away from the aforementioned processor 301. Refer to Figure 3 , the memory 305 as a computer storage medium may include an operating system, a network communication module, a user interface module and an application program of a network protocol identification method.

[0087] exist Figure 3In the electronic device 300 shown, the user interface 303 is mainly used to provide an input interface for the user and obtain the data input by the user; and the processor 301 can be used to call an application program storing a network protocol identification method in the memory 305. When executed by one or more processors 301, the electronic device 300 executes one or more of the methods described in the above embodiments. It should be noted that for the aforementioned method embodiments, for the sake of simplicity of description, they are all expressed as a series of action combinations, but those skilled in the art should know that this application is not limited to the order of the actions described, because according to this application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also know that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required for this application.

[0088] The present application further provides a computer-readable storage medium storing instructions, which, when executed by one or more processors 301 , enable the electronic device 300 to perform one or more of the methods described in the above embodiments.

[0089] In the above embodiments, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0090] In the several embodiments provided in this application, it should be understood that the disclosed devices can be implemented in other ways. For example, the device embodiments described above are merely schematic, such as the division of units, which is only a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some service interface, and the indirect coupling or communication connection of devices or units can be electrical or other forms.

[0091] Units described as separate components may or may not be physically separate, and components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0092] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0093] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable memory. Based on this understanding, the technical solution of this application, or the portion that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a memory and includes several instructions for causing a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the various embodiments of the method of this application. The aforementioned memory includes various media that can store program code, such as USB flash drives, mobile hard drives, magnetic disks, or optical disks.

[0094] The foregoing is merely an exemplary embodiment of the present disclosure and is not intended to limit the scope of the present disclosure. In other words, any equivalent variations and modifications made in accordance with the teachings of the present disclosure are still within the scope of the present disclosure. Those skilled in the art will readily conceive of other embodiments of the present disclosure after considering the disclosure and the practical implications thereof.

[0095] This application is intended to cover any variations, uses, or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary techniques in the art not described herein. The description and examples are to be considered as exemplary only, and the scope and spirit of the present disclosure are to be defined by the claims.

Claims

1. A network protocol identification method, characterized in that: The method comprises: Get banner information; Preprocessing the banner information to obtain target banner information; Clustering the target banner information to obtain a plurality of clusters, wherein each cluster represents a network protocol type; Determine a representative banner sample in each of the clusters, and group the representative banner samples into a representative set; Perform protocol identification on the target representative banner sample to obtain the target network protocol type corresponding to the target representative banner sample, and use the target network protocol type as the network protocol type corresponding to each target banner information included in the target cluster. The target representative banner sample is any representative banner sample in the representative set, and the target cluster is the cluster where the target representative banner sample is located.

2. The method according to claim 1, characterized in that The preprocessing of the banner information to obtain target banner information specifically includes: Performing character encoding conversion on the banner information to convert the banner information into banner information in a preset encoding format; Perform word segmentation on the converted banner information to obtain network banner keyword information; According to a preset network banner keyword dictionary, the network banner keyword information is tagged by part of speech to obtain tagged network banner keyword information, and the tagged network banner keyword information is used as the target banner information.

3. The method according to claim 1, characterized in that Clustering the target banner information to obtain multiple clusters specifically includes: According to a preset network protocol keyword dictionary, counting the word frequency of each keyword included in each of the target banner information to obtain a keyword word frequency vector for each of the target banner information; Normalizing the digital characters included in each target banner information to obtain a digital feature vector of each target banner information; Counting the character length, character entropy, and character distribution characteristics of each target banner information to obtain a character statistical feature vector of each target banner information; Concatenate the keyword frequency vectors, digital feature vectors, and character statistical feature vectors corresponding to each target banner information to obtain a network banner feature vector corresponding to each target banner information; The target banner information is clustered according to the similarity between the network banner feature vectors to obtain a preset number of clusters.

4. The method according to claim 3, characterized in that Clustering the target banner information according to the similarity between the network banner feature vectors to obtain a preset number of clusters specifically includes: Randomly select a preset number of initial cluster centers from each target banner information; Calculating the Euclidean distance between the network banner feature vector corresponding to each target banner information and the initial cluster center point, and dividing each target banner information into the cluster corresponding to the initial cluster center point with the shortest distance to the corresponding network banner feature vector; Calculating a new cluster center point of each cluster according to the network banner feature vector corresponding to the target banner information included in each cluster, wherein the new cluster center point is the geometric center of the network banner feature vector included in the corresponding cluster; Determine whether the cluster center point of each cluster has changed; If so, iteratively performing the steps of calculating the Euclidean distance between the network banner feature vector corresponding to each target banner information and the initial cluster center point, and dividing each target banner information into the cluster corresponding to the initial cluster center point closest to the corresponding network banner feature vector, until the cluster center points of each cluster no longer change, thereby obtaining the preset number of clusters; If not, the current clustering result is determined to obtain the preset number of clusters.

5. The method according to claim 1, characterized in that The determining of a representative banner sample in each of the clusters specifically includes: For each cluster, calculating the cosine similarity between the network banner feature vector corresponding to each target banner information in the cluster and the cluster center of the cluster, and determining the target banner information corresponding to the maximum cosine similarity as the first candidate representative banner sample of the cluster; In each of the clusters, the frequency of occurrence of each target banner information is counted, and the target banner information corresponding to the most frequent word is determined as the second candidate representative banner sample of the cluster; In each of the clusters, calculating an average edit distance of each target banner information, where the average edit distance is the average of the edit distances between the target banner information and other target banner information in the cluster, and determining the target banner information corresponding to the minimum average edit distance as the third candidate representative banner sample of the cluster; For each of the clusters, the comprehensive scores of the first candidate representative banner sample, the second candidate representative banner sample, and the third candidate representative banner sample of the cluster are compared, and the candidate representative banner sample with the highest comprehensive score is determined as the representative banner sample of the cluster, wherein the comprehensive score is calculated based on the cosine similarity, occurrence frequency, and average edit distance of the candidate representative banner samples.

6. The method according to claim 1, characterized in that The protocol identification of the target representative banner sample to obtain the target network protocol type corresponding to the target representative banner sample specifically includes: Inputting the target representative banner sample into the large language model, and using the large language model to perform semantic understanding and analysis on the target representative banner sample; Constructing prompt words for the network protocol recognition task based on a preset prompt word template to guide the large language model to focus on key information related to the network protocol recognition task; Generate a first search statement using the large language model, and call a search engine tool to obtain search results related to the target representative banner sample; Performing relevance judgment on the search results, screening out information related to the network protocol identification task, and adding the information to the knowledge base of the large language model; The target representative banner sample, the prompt word and the search result are comprehensively analyzed by the large language model, and the target network protocol type corresponding to the target representative banner sample is output.

7. The method according to claim 6, characterized in that After performing relevance judgment on the first search result and filtering out information related to the network protocol identification task, the method further includes: If no information related to the network protocol identification task is screened out, a second search statement is generated, and the search engine tool is iteratively called until information related to the network protocol identification task is screened out or the number of iterations is reached.

8. A network protocol identification device, characterized in that: The device comprises an information acquisition module (201), a pre-processing module (202), a clustering module (203), a sample determination module (204) and a protocol identification module (205), wherein: The information acquisition module (201) is used to acquire banner information; The pre-processing module (202) is used to pre-process the banner information to obtain target banner information; The clustering module (203) is used to cluster the target banner information to obtain a plurality of clusters, wherein one cluster represents a type of network protocol; The sample determination module (204) is used to determine the representative banner samples in each of the clusters and form a representative set of the representative banner samples; The protocol identification module (205) is used to perform protocol identification on the target representative banner sample, obtain the target network protocol type corresponding to the target representative banner sample, and use the target network protocol type as the network protocol type corresponding to each target banner information included in the target cluster, wherein the target representative banner sample is any representative banner sample in the representative set, and the target cluster is the cluster where the target representative banner sample is located.

9. An electronic device, characterized in that: The electronic device (300) comprises a processor (301), a memory (305), a user interface (303) and a network interface (304), wherein the memory (305) is used to store instructions, the user interface (303) and the network interface (304) are used to communicate with other devices, and the processor (301) is used to execute the instructions stored in the memory (305) so that the electronic device (300) executes the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores instructions, and when the instructions are executed, the method according to any one of claims 1 to 7 is executed.

Images