Industrial control protocol intelligent analysis method based on large model

Abstract

The invention discloses an industrial control protocol intelligent analysis method based on a large model, and relates to the field of protocol analysis, and the method comprises the steps: S1, collecting protocol data, and constructing a protocol template knowledge set; s2, dividing training data to obtain a training data set; s3, training and optimizing a Qwen model; s4, a classification head is added to the top of the optimized Qwen model, lightweight fine tuning is carried out, and a classification model is obtained; s5, obtaining data to be analyzed; s6, performing classification model analysis to obtain a classification result; s7, judging whether the knowledge belongs to the range in the protocol template knowledge set or not, and if so, entering S8; otherwise, proceeding to S9; s8, analyzing to obtain an analysis result; s9, deducing the boundary and the type of the functional region; s10, outputting an analysis result; analyzing a public industrial control protocol document by using a large language model, and constructing a protocol template knowledge set; a large language model and an expert voting algorithm are combined to realize automatic classification, identification and analysis of protocols; protocol format information such as protocol field types and field boundaries can be speculated by fusing protocol template knowledge.

Description

Technical Field

[0001] The present invention relates to the field of protocol analysis, and in particular to an intelligent parsing method for industrial control protocols based on a large model. Background Art

[0002] With the rapid development of Industry 4.0, smart manufacturing, and the Internet of Things (IoT), industrial control systems (ICS) are becoming a core component of modern industrial production. These systems monitor and control various equipment and process parameters throughout the production process, ensuring efficient, safe, and stable production. However, with the widespread adoption of ICS, security issues are becoming increasingly prominent. Industrial control protocols, as the foundation for communication between ICS devices, carry a large number of control commands and data transmission tasks. Due to historical reasons and technical limitations, many ICS protocols were not fully designed with security considerations in mind, resulting in security risks such as protocol parsing vulnerabilities, unauthorized access, and denial of service attacks. If maliciously exploited, these vulnerabilities can lead to serious consequences such as production interruptions, equipment damage, and even casualties. Therefore, intelligent parsing and security protection of industrial control protocols have become urgent issues in the field of industrial information security.

[0003] In addition to traditional manual analysis methods, protocol parsing can be broadly divided into two categories: message sequence analysis and binary instruction execution analysis. Message sequence analysis techniques analyze protocol session data streams captured by tools such as Wireshark and Ettercap. The most commonly used algorithms are multiple sequence alignment and sequence clustering. The core of these algorithms is the comparison of sequence similarity. Sequence clustering algorithms are primarily based on keywords, edit distance, and probabilistic models. However, a common problem with these algorithms is that they cannot provide accurate similarity evaluation criteria, and clustering algorithms typically require high-dimensional clustering calculations, which can be computationally challenging. Instruction execution analysis techniques analyze the terminal programs that parse or construct messages. They monitor the instruction sequence and propagation process of protocol data parsing through dynamic tracking. However, this technique requires access to the terminal program performing protocol parsing, making it difficult to implement in practical applications.

[0004] There are two major challenges in using traditional protocol parsing methods to analyze and process industrial protocols. First, the code used in industrial control systems is difficult to obtain, making code-based execution methods unsuitable for parsing industrial protocols. Second, industrial protocols differ significantly from network protocols, making them difficult to parse directly using network protocol reverse engineering tools. For example, most industrial protocols have a flat structure, with a protocol header containing all the information following an optional payload. Network protocol reverse engineering tools lack the ability to parse this type of protocol structure, making it difficult to effectively derive the structure of industrial protocols. Furthermore, most industrial protocols lack delimiters, making delimiter-based methods unsuitable for industrial protocol parsing. Therefore, efficient industrial protocol parsing solutions hold great research significance and broad application prospects.

[0005] Protocol parsing methods based on technologies like deep learning require the prior preparation of large quantities of actual communication data packets. Publicly available data packets for proprietary protocols are difficult to find. Collecting proprietary protocol data packets requires setting up a specific simulation environment and preparing specialized test equipment. Traditional protocol parsing is typically limited to parsing protocol field information, including field definitions and types, and rarely addresses the structural analysis and construction of protocols with complex format structures. Large language models, with their superior semantic understanding and contextual reasoning capabilities, have gained widespread application and attention in the field of natural language processing. By leveraging the textual semantic understanding capabilities of large language models, protocol format information can be extracted from protocol documents. This allows for the acquisition of some prior knowledge of the protocol before parsing, preventing a significant drop in output accuracy due to insufficient training data packets. Summary of the Invention

[0006] The purpose of the present invention is to design an intelligent parsing method for industrial control protocols based on a large model in order to solve the above problems.

[0007] The present invention achieves the above-mentioned purpose through the following technical solutions:

[0008] The intelligent parsing method of industrial control protocols based on large models includes:

[0009] S1. Collect protocol data and build a protocol template knowledge set;

[0010] S2. Obtain training data and divide the training data into training data sets;

[0011] S3. Optimize the Qwen model using the training data set to obtain the optimized Qwen model.

[0012] S4. Add a classification head on top of the optimized Qwen model and perform lightweight fine-tuning on the Qwen model to obtain a classification model. The classification head is a network architecture of a Dropout layer and a Linear layer.

[0013] S5. Obtain the data to be analyzed;

[0014] S6. Analyze the data to be analyzed using the classification model to obtain classification results;

[0015] S7, determine whether the classification result falls within the scope of the protocol template, if so, proceed to S8; otherwise, proceed to S9;

[0016] S8. Call the protocol template knowledge to parse the data to be analyzed, obtain the analysis results, and end;

[0017] S9. Decompose the data to be analyzed into a series of fields and infer the functional area boundaries and types of the protocol fields;

[0018] S10. Output the parsing result of the data to be analyzed according to the functional area boundary and type of the protocol field, and end.

[0019] The present invention utilizes a large language model to intelligently analyze publicly available industrial control protocol documents, outputting data in a specific format according to specified requirements, and constructing a knowledge set of protocol templates. Combining the large language model with an expert voting algorithm enables automatic classification, identification, and parsing of protocols. By integrating this knowledge with protocol templates, the present invention can infer protocol format information, such as field types and field boundaries. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 1 is a diagram showing a specific embodiment of the intelligent parsing method for industrial control protocols based on a large model of the present invention;

[0021] Figure 2 It is a flow chart of the intelligent parsing method of industrial control protocol based on large model of the present invention;

[0022] Figure 3 This is a schematic diagram of protocol common field extraction. DETAILED DESCRIPTION

[0023] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more apparent, the technical solutions of the embodiments of the present invention will be described clearly and completely below in conjunction with the accompanying drawings of the embodiments of the present invention. It should be understood that the described embodiments are only a portion of the embodiments of the present invention, not all of them. Generally, the components of the embodiments of the present invention described and illustrated in the drawings herein may be arranged and designed in a variety of different configurations.

[0024] Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the invention as claimed, but rather merely represents selected embodiments of the present invention. All other embodiments derived by persons of ordinary skill in the art based on the embodiments of the present invention without creative effort shall fall within the scope of protection of the present invention.

[0025] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, it does not need to be further defined or explained in subsequent drawings.

[0026] In the description of the present invention, it should be understood that the terms "upper", "lower", "inside", "outside", "left", "right", etc. indicate orientations or positional relationships based on the orientations or positional relationships shown in the accompanying drawings, or are the orientations or positional relationships in which the inventive product is conventionally placed when in use, or are the orientations or positional relationships conventionally understood by those skilled in the art. These are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the device or component referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore should not be understood as a limitation on the present invention.

[0027] Furthermore, the terms “first”, “second”, etc. are merely used for distinguishing descriptions and should not be understood as indicating or implying relative importance.

[0028] In the description of the present invention, it should also be noted that, unless otherwise expressly specified or limited, terms such as "disposed" and "connected" should be understood in a broad sense. For example, "connected" can mean a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection or an indirect connection through an intermediate medium; it can also mean internal communication between two components. Those skilled in the art will be able to understand the specific meanings of the above terms in the present invention based on specific circumstances.

[0029] The specific embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0030] The intelligent parsing method of industrial control protocols based on large models includes:

[0031] S1. Collect protocol data and build a protocol template knowledge set; specifically including:

[0032] S101. Collect public agreement information;

[0033] S102. Design prompt engineering to extract information from protocol data, and use contextual small sample learning and thought connection prompts to enhance the accuracy of Qwen model output results, and use self-consistency checks to verify the generated responses;

[0034] Contextual few-shot learning enhances the context with a small number of examples, enabling the Qwen model to better understand the syntax of prompts, recognize output patterns, and accurately extract information; thought chain prompts involve constructing prompts, and thought chains provide a series of prompts to guide the Qwen model to complete a series of logical steps, similar to the human thinking process, to achieve the desired output. Finally, self-consistency checks are used to improve and verify the generated responses to ensure the reliability of the results. Even with the above method, the model may still output answers containing some random information, although this is rare. In the present invention, multiple conversations were conducted with the Qwen model, and the majority of consistent answers were taken as the final result. In addition, to ensure that the Qwen model response follows the required format, the required output format part is added to the end of the prompt, and it is emphasized in the prompt not to fabricate information. Through these methods of designing prompts, information such as tuples and protocol status can be effectively obtained.

[0035] S103, design a tuple abstract representation of the state of the protocol, and construct a protocol state machine based on the extracted information; specifically: tuple M is , where Q represents a finite set of states, Indicates the initial state, represents the next target state, etc. represent a state change, where i represents the sequence number of a state change. Given a cluster, the large model is used to query each protocol reply or response information and generate tuples specific to the specified protocol reply or response information. All tuples are then combined to form a comprehensive tuple representing a protocol.

[0036] S104: Construct the extracted multiple protocol information into a protocol template knowledge set.

[0037] S2. Obtain training data and divide the training data into training data sets according to the training data. Specifically, when the amount of training data is not more than the preset amount, use leave-one-out cross-validation to divide the training data; when the amount of training data is more than the preset amount, use K-fold cross-validation to divide the training data;

[0038] Specifically, the training data is obtained as follows: industrial protocol data packets can be derived from PLCs of various manufacturers in the actual working conditions of the oil and gas gathering and transportation industrial simulation platform in the key laboratory of information security in the petrochemical industry. The data packets are captured using Wireshark sniffing software, and the entries of the industrial control system proprietary protocols are retained and output in binary form. Public industrial pcap data packets for testing are collected from GitHub projects and Wireshark wiki as training and test sets for subsequent steps. These include some commonly used industrial control system communication protocols such as S7comm, ModbusTCP, PROFIBUS, and IEC104.

[0039] Leave-One-Out Cross-Validation (LOOCV) treats each sample in the dataset as a test set, while all other samples constitute the training set. This method is repeated multiple times, equal to the dataset size, to ensure that each sample is used as a test set once, thereby fully utilizing the dataset for model training and evaluation. Leave-One-Out Cross-Validation can reduce the randomness of data partitioning, thereby improving the stability and reliability of evaluation results. Leave-One-Out Cross-Validation is particularly suitable for situations with very small data volumes because it ensures that every sample is fully utilized, providing an accurate estimate of model performance. K-fold cross-validation divides the training set multiple times; each time a partition is performed, training, testing, and evaluation are performed on a different dataset to produce an evaluation result. In the case of 5-fold cross-validation, this means that the original dataset is partitioned five times, with training and evaluation performed once for each partition. The final evaluation result after the five partitions is obtained, and the final score is generally averaged over these evaluation results. Here, k is generally 5 or 10. The steps are as follows: 1) Divide the data set into k folds; 2) Take the data set of each fold as the validation set, and the remaining part as the training set; 3) Calculate the error rate of each fold test; 4) Take the average of the K records here as the final result.

[0040] S3. Optimize the Qwen model using the training data set to obtain the optimized Qwen model.

[0041] When using leave-one-out cross-validation to divide the training data, the training process is as follows: 1) Determine the size of the dataset. 2) For each example in the dataset, repeat the following steps: use the current example as the test set; use all but one example as the training set; train the model on the training set and evaluate the model performance on the test set; 3) Average the model performance metrics (such as accuracy and mean squared error) obtained from each iteration to obtain the final model performance evaluation.

[0042] When the K-fold cross-validation method is used to divide the training data, the training process is as follows: 1) the data set is divided into k folds; 2) the data set of each fold is taken as the validation set, and the remaining part is used as the training set; 3) the error rate of each fold test is calculated; 4) the average of the K records here is taken as the final result.

[0043] Qwen1.5-7B-Chat is a large-scale language model based on deep learning, boasting approximately 7 billion parameters. This enables it to achieve greater flexibility and accuracy in handling complex language tasks. Based on the Transformer architecture, it features a hybrid of Swiglu activation, attentional QKV bias, group query attention, sliding window attention, and full attention. Based on the Transformer architecture, Qwen1.5-7B-Chat employs a self-attention mechanism, effectively capturing long-range dependencies. In text classification tasks, this means the model can better understand contextual information within the text, leading to more accurate classification decisions. Furthermore, the development team has improved the tokenizer for various natural languages and codes, enabling the model to handle text classification tasks in a variety of scenarios. The text classification method based on the Qwen1.5BChat model classifies information with the same format into the same cluster. The underlying principle is to determine the cluster to which it belongs by learning, understanding, and analyzing protocol field features and protocol characteristics. The software layer in the large model outputs cluster class probabilities for protocol information, mapping the model's abstract output representation to cluster labels. In the classified protocol clusters, the protocol formats of the protocol packets in the same cluster are inferred and predicted.

[0044] S4. Add a classification head on top of the optimized Qwen model and perform lightweight fine-tuning on the Qwen model to obtain a classification model. The classification head is a network architecture consisting of a Dropout layer and a Linear layer. Specifically, it includes:

[0045] S401. Add a classification head on top of the optimized Qwen model. The classification head is a network architecture consisting of a Dropout layer and a Linear layer (size = 1024).

[0046] S402, define the Qwen model with the classification head added as ,make For the connection of x and y, let represents the index sequence corresponding to x, represents the same index sequence as y, and the activation at time step i is ,That where is the connection of all activation layers in time step i, is the activation of the jth Transformer layer at time step i of the Qwen model with the classification head added; the Qwen model with the classification head added will As The function computation of and the past activation function in its left context is expressed as: ,in, The last layer is used to calculate the next The distribution of is expressed as: , is a pre-trained matrix, Will Logits mapped to vocabulary;

[0047] S403, based on the P-tuning fine-tuning method, in the process of fine-tuning the Qwen model with the classification head added, first Add a prefix ;

[0048] S404. Initialize a dimension The trainable matrix To store the prefix parameter, it is represented as: ; Among them, the parameters of the fixed Qwen model , prefix the parameter As the only trainable parameter;

[0049] S405. Perform gradient update on the log-likelihood target, expressed as: .

[0050] S5. Obtain the data to be analyzed.

[0051] S6. Use the classification model to analyze the data to be analyzed and obtain the classification results. Use the context understanding ability of the classification model to train the model to separate the message representation vectors of different clusters from each other in space, obtain the classification results, and thus achieve the purpose of message classification.

[0052] S7. Determine whether the classification result falls within the scope of the protocol template based on the protocol data learned by the Qwen model. If so, proceed to S8; otherwise, proceed to S9. The judgment condition is: if the similarity between the classification result and the protocol template knowledge is not less than a preset threshold, then the classification result falls within the scope of the protocol template.

[0053] S8. Call the protocol template knowledge to parse the data to be analyzed, obtain the analysis results, and end;

[0054] S9. Decompose the data to be analyzed into a series of fields, infer the functional area boundaries and types of the protocol fields, parse and output the analysis results of the data to be analyzed, and end; specifically including:

[0055] S901: Use a window of size L to slide across the data to be analyzed. Two voting experts use an expert voting algorithm to select fields within the protocol template knowledge set as common fields. During the selection process, a word search tree (Trie) with a depth of L+1 is used to store all possible field combinations in the data to be analyzed.

[0056] Two voting experts select common fields through voting and decision phases;

[0057] In the voting stage, according to the search tree Trie, the two experts and Voting on possible boundaries within a sliding window; and denote the interior voting point and boundary voting point at position i, respectively; Expressed as: , Expressed as:

[0058] In the judgment phase, according to Principles 1 and 2, it is determined whether point x in the sliding window is the protocol field boundary. If so, the common field is output and saved in the search tree Trie. Otherwise, it slides to the next window and performs the voting phase and judgment phase again to select the common field. Principle 1 means that the voting score obtained by point x is greater than the voting score of the adjacent points, and Principle 2 means that the voting score is greater than the preset threshold T. The voting score of point x is greater than the threshold T. Expressed as, .

[0059] S902,Qwen model classifies common fields with the same functions into the same cluster;

[0060] S903: Inferring the format of each cluster and the type of the protocol field. When inferring the format of the cluster, it is necessary to apply the voting expert algorithm to each cluster again to infer the field boundaries of the cluster;

[0061] S904: parse the combined cluster format and protocol field type to output the parsing result of the data to be analyzed, and end.

[0062] The internal entropy of the field represented by the first voting expert among the two voting experts , internal entropy If a field always appears as a whole in a binary message, the field should be retained as a whole. Expressed as: ,in, Represents a subsequence in a binary message The probability of occurrence; the second voting expert represents the boundary entropy of the field , boundary entropy If a field contains multiple types or contents, there should be a boundary between the field and the subsequent contents. Expressed as: , where c represents a subsequence The set of all possible nibbles that follow, Indicates that the nibble c in the sequence The probability of the subsequent occurrence is calculated, and the similarity between the field structure and the protocol template knowledge set is used to determine whether the context structure of a field conforms to the protocol characteristics. If the similarity is too low, the candidate boundary belongs to the wrong boundary, and the relocation method is used to improve the positioning accuracy of the candidate boundary.

[0063] The classification model is combined with the voting expert algorithm to predict all possible field division methods of the industrial protocol. The model's final classification layer outputs the probability of classification. Considering too many division possibilities, the computational complexity of solving the optimal division is large. For locally identical divisions, the local confidence is also the same. The probabilities corresponding to locally different division possibilities are used as the expert voting results. The average value of the probabilities of all predicted results being the same category is used as the standard to solve the field division and field classification with the highest confidence. The format information of the protocol is parsed by combining all field division results.

[0064] The protocol analysis result includes information such as the field length and type of the protocol.

[0065] The present invention utilizes a large language model to assist in protocol parsing. Traditional technologies often rely on manually written parsers or simple pattern matching algorithms when parsing industrial control protocols. These methods are not only time-consuming and costly, but also difficult to adapt quickly when faced with complex and changeable protocols. Manually writing a parser requires a large amount of technical manpower and time investment, and pattern matching algorithms often make misjudgments or misses when dealing with new or variant protocols. The technology of the present invention utilizes large language model technology to automatically extract semantic information from public industrial control protocol documents and efficiently construct protocol knowledge templates. The large language model can capture complex patterns and semantic relationships in the language, enabling it to handle different types or versions of protocols. This automated process shortens the parsing cycle of the parser and significantly improves the parsing speed, so that users, industrial control manufacturers, and security assessment companies can obtain protocol format information in a timely manner to support industrial control system security assessments or industrial control system vulnerability mining related work.

[0066] The present invention adopts large language models and self-consistency checking technologies to construct a protocol template knowledge set. The construction of the protocol template knowledge set has important technical significance and practical value. The protocol knowledge template provides a template with specific rules to support the large language model to quickly parse and infer different industrial protocols. The large language model reduces the workload of manual analysis, reduces time costs, and improves the efficiency of extracting and summarizing knowledge by automatically extracting protocol features. Secondly, the structured data in the knowledge set provides rich training materials for the large language model, which can enhance the reasoning ability of the model. In addition, the construction of the protocol template knowledge set makes the update and expansion of industrial protocol knowledge more flexible, and the knowledge set can be updated in time when new protocols or protocol versions appear.

[0067] This paper introduces an expert voting algorithm to delineate protocol field boundaries in an unsupervised environment and provide common fields. Each "expert" infers protocol field boundaries based on their own characteristics and rules. Finally, a voting mechanism combines the judgment results of each model to accurately locate field boundaries and extract key information. This approach significantly improves the automation of protocol parsing, reduces manual intervention, enhances adaptability to new and variant protocols, and improves the accuracy of parsing results and the system's fault tolerance.

[0068] The present invention introduces the P-tuning lightweight large language model fine-tuning method, freezes the parameters of the Qwen1.5-7B-Chat model, and only updates the prefix parameters. Traditional code vulnerability mining methods based on large language models are either based only on prompt engineering without model training. Or a full-parameter fine-tuning method is adopted, which has high requirements on hardware resources and slow model training time. Compared with these traditional fine-tuning techniques, the P-tuning fine-tuning method adopted in the present invention freezes the model parameters, only adds a classification layer to the model head, and updates the added prefix parameters. It can effectively reduce the model training parameter size and computational complexity, accelerate the fine-tuning process, and maintain a high protocol classification capability, making the large language model more practical and efficient in industrial control protocol parsing tasks. The present invention has broad application prospects in scenarios such as large-scale data sets and real-time processing.

[0069] The present invention utilizes the powerful understanding ability of the existing technology of large language models for natural language and protocol data, divides field boundaries and extracts common fields through an expert voting algorithm, performs lightweight fine-tuning on the large language model, and utilizes protocol template knowledge to enhance the intelligent parsing capability of industrial control protocols.

[0070] The technical solution of the present invention is not limited to the above-mentioned specific embodiments. Any technical variations made according to the technical solution of the present invention fall within the protection scope of the present invention.

Claims

1. An intelligent parsing method for industrial control protocols based on a large model, characterized by: include: S1. Collect protocol data and build a protocol template knowledge set; S2. Obtain training data and divide the training data into training data sets; S3. Optimize the Qwen model using the training data set to obtain the optimized Qwen model. S4. Add a classification head on top of the optimized Qwen model and perform lightweight fine-tuning on the Qwen model to obtain a classification model. The classification head is a network architecture of a Dropout layer and a Linear layer. S5. Obtain the data to be analyzed; S6. Analyze the data to be analyzed using the classification model to obtain classification results; S7, determine whether the classification result falls within the scope of the protocol template, if so, proceed to S8; otherwise, proceed to S9; S8. Call the protocol template knowledge to parse the data to be analyzed, obtain the analysis results, and end; S9. Decompose the data to be analyzed into a series of fields, infer the functional area boundaries and types of the protocol fields, parse and output the analysis results of the data to be analyzed, and end.

2. The method for intelligent parsing of industrial control protocols based on a large model according to claim 1 is characterized in that: Included in S1: S101. Collect public agreement information; S102. Design prompt engineering to extract information from protocol data and enhance the accuracy of Qwen model output results; S103. Design a tuple abstraction to represent the state of the protocol, and construct a protocol state machine based on the extracted information; S104: Construct the extracted multiple protocol information into a protocol template knowledge set.

3. The method for intelligent analysis of industrial control protocols based on a large model according to claim 1, characterized in that: In S2, the training data are divided according to the situation of the training data to obtain a training data set. Specifically, when the amount of training data is not higher than the preset amount, the training data are divided using the leave-one-out cross-validation method; when the amount of training data is higher than the preset amount, the training data are divided using the K-fold cross-validation method.

4. The method for intelligent analysis of industrial control protocols based on a large model according to claim 1, characterized in that: Included in S4: S401, adding a classification header on top of the optimized Qwen model; S402, define the Qwen model with the classification head added as ,make For the connection of x and y, let represents the index sequence corresponding to x, represents the same index sequence as y, and the activation at time step i is ,That where is the connection of all activation layers in time step i, is the activation of the jth Transformer layer at time step i of the Qwen model with the classification head added; the Qwen model with the classification head added will As The function computation of and the past activation function in its left context is expressed as: ,in, The last layer is used to calculate the next The distribution of is expressed as: , is a pre-trained matrix, Will Logits mapped to vocabulary; S403, based on the P-tuning fine-tuning method, in the process of fine-tuning the Qwen model with the classification head added, first Add a prefix , expressed as ; S404. Initialize a dimension The trainable matrix To store the prefix parameter, it is represented as: ; Among them, the parameters of the fixed Qwen model , prefix the parameter As the only trainable parameter; S405. Perform gradient update on the log-likelihood target, expressed as: .

5. The method for intelligent analysis of industrial control protocols based on a large model according to claim 1 is characterized in that: Included in the S9: S901: Use a window of size L to slide across the data to be analyzed. Two voting experts use an expert voting algorithm to select fields within the protocol template knowledge set as common fields. During the selection process, a word search tree (Trie) with a depth of L+1 is used to store all possible field combinations in the data to be analyzed. S902,Qwen model classifies common fields with the same functions into the same cluster; S903. Infer the format of each cluster and the type of the protocol field; S904: parse the combined cluster format and protocol field type to output the parsing result of the data to be analyzed, and end.

6. The method for intelligent analysis of industrial control protocols based on a large model according to claim 5 is characterized in that: The internal entropy of the field represented by the first voting expert among the two voting experts , internal entropy If a field always appears as a whole in a binary message, the field should be retained as a whole. Expressed as: ,in, Represents a subsequence in a binary message The probability of occurrence; the second voting expert represents the boundary entropy of the field , boundary entropy If a field contains multiple types or contents, there should be a boundary between the field and the subsequent contents. Expressed as: , where c represents a subsequence The set of all possible nibbles that follow, Indicates that the nibble c in the sequence The probability of the subsequent occurrence is calculated, and the similarity between the field structure and the protocol template knowledge set is used to determine whether the context structure of a field conforms to the protocol characteristics. If the similarity is too low, the candidate boundary belongs to the wrong boundary, and the relocation method is used to improve the positioning accuracy of the candidate boundary.

7. The method for intelligent analysis of industrial control protocols based on a large model according to claim 5, characterized in that: In S901, two voting experts go through the voting phase and the judgment phase to select a common field; In the voting stage, according to the search tree Trie, the two experts and Voting on possible boundaries within a sliding window; Expressed as: , Expressed as: ; In the judgment phase, according to Principles 1 and 2, it is determined whether point x in the sliding window is the protocol field boundary. If so, the common field is output and saved in the search tree Trie. Otherwise, it slides to the next window and performs the voting phase and judgment phase again to select the common field. Principle 1 means that the voting score obtained by point x is greater than the voting score of the adjacent points, and Principle 2 means that the voting score is greater than the preset threshold T. The voting score of point x is greater than the threshold T. Expressed as, .

Images