Network data intelligent tool system and method based on model context protocol MCP

Abstract

The invention discloses a network data intelligent tool system and method based on a model context protocol MCP, and relates to the technical field of computer networks. The system comprises an AI analysis main body, an MCP Pcap tool engine, context management, a Pcap data source, various MCP Pcap tools, a Pcap tool gateway interface, a Pcap tool interface and a data packet interface. The invention provides an interaction mechanism of direct embedding and bypass data forwarding in tool calling. According to the method, direct embedded transmission of small-size data in tool calling is supported, separation of data transmission and instruction calling is achieved, the technical bottleneck that large-size Pcap data cannot be efficiently exchanged through a text channel is effectively overcome, efficient processing of the AI model on network packet capture data is achieved, and the data transmission efficiency is improved. And the efficiency and the automation degree of large-scale network traffic analysis are improved.

Description

Technical Field

[0001] The present invention belongs to the field of computer network technology, and in particular relates to a network data intelligent tool system and method based on a Model Context Protocol (MCP). Background Art

[0002] Current mainstream network packet analysis tools (such as Wireshark, tcpdump, and Hami) have several limitations. First, tool functionality is fragmented, with each tool employing an independent and closed architecture and lacking a unified protocol parsing interface and collaborative mechanism. This results in the reliance on manual operations for data transfer and result integration when performing joint analysis with multiple tools, creating a "data island" phenomenon. Second, there is an imbalance between resource consumption and processing efficiency. Traditional tools use a full-scale parsing mode based on static rules, which requires a large amount of computing resources, while the actual analysis targets often focus only on specific protocols or abnormal traffic segments, resulting in a double waste of storage space and computing power. In addition, the dynamic adaptability is insufficient. The predefined analysis processes of existing tools are difficult to respond to dynamic changes in network topology (such as SDN policy updates and cloud environment service migration), making it difficult to achieve real-time policy adjustments and context-related analysis.

[0003] As networks continue to grow, these issues become increasingly prominent. Pcap files generated by a single packet capture often reach terabytes in size. Traditional text transfer protocols (such as HTTP / JSON) are limited by bandwidth and serialization overhead, making it difficult to efficiently transfer large files. Furthermore, network attacks exhibit cross-protocol, multi-stage characteristics, while fragmented toolchains lack intelligent orchestration capabilities, leading to response lags and logical gaps in threat analysis.

[0004] Artificial intelligence technology provides new ideas for solving the above problems, but the integration of existing AI models and network analysis tools still faces the bottleneck of lack of protocol standardization. The Model Context Protocol (MCP) was proposed by Anthropic in 2024. It is a communication protocol for standardized large language models (LLMs) to interact with external data sources and tools. MCP provides a foundation for heterogeneous system collaboration by defining a client-server interaction framework (Host-Client-Server three-layer architecture). The MCP Host implements user command parsing and resource coordination, the MCP Client establishes a standardized communication pipeline, and the MCP Server encapsulates external tool capabilities with a unified interface. The protocol supports dynamic tool registration and context-aware session management, and has flexibility in implementation methods, laying a technical foundation for building an intelligent and modular network analysis system. Summary of the Invention

[0005] The present invention provides a network data intelligent tool system and method based on the model context protocol MCP. The system includes an AI analysis subject, namely module A, an MCP Pcap tool engine, namely module B, a context management module, namely module C, a Pcap data source, namely module D, and multiple MCP Pcap tools, namely module E series. In this system, the AI ​​analysis subject, namely module A, communicates with the MCP Pcap tool engine, namely module B, through the MCP protocol. Module B uniformly manages and schedules multiple Pcap tools, namely module E series, to parse and process network data packets in the Pcap data source, namely module D. The context management module, namely module C, is used to maintain context information during the analysis process to ensure the continuity and consistency of the results during multiple rounds of interaction. In response to the problem that Pcap data files are large in size and are not suitable for direct transmission through the original MCP text exchange mechanism, the present invention proposes an interaction mechanism of "direct embedding in tool call + bypass data forwarding". This mechanism adds a data transmission gateway service outside the MCP interface, supporting the direct embedded transmission of small-volume data in tool calls. Large-volume data is pre-transmitted to the tool end through bypass channels such as file transfer protocol and streaming transmission, and then the call of the corresponding Pcap analysis tool is triggered through the MCP protocol, thereby achieving the separation of data transmission and instruction call, effectively overcoming the technical bottleneck of the inability to efficiently exchange large-volume Pcap data through text channels. Through this architectural design, the present invention realizes the efficient processing of network packet capture data by AI models, improving the efficiency and automation level of large-scale network traffic analysis; in summary, it solves the problems mentioned in the background technology.

[0006] To solve the above technical problems, the present invention is achieved through the following technical solutions:

[0007] The network data intelligent tool system based on the Model Context Protocol MCP of the present invention adopts a layered, decoupled and scalable module collaboration system as a whole. The present invention includes an AI analysis body (module A), an MCP Pcap tool engine (module B), context management (module C), a Pcap data source (module D), various MCP Pcap tools (modules E1, E2, E3, etc.) and a unified interface layer (interface 1, interface 2, interface 3, etc.). The system uses mature network communication technology to realize data transmission between modules: Interface 1 and Interface 2 provide reliable two-way communication based on the TCP / HTTP (or HTTP / 2) protocol stack, and support TLS / SSL encrypted transmission; the data transmission gateway service adopts a standard data fragmentation strategy (such as TCP segmentation, HTTP block transfer encoding), combined with CRC32 / SHA256 checksum mechanism to ensure data integrity, and realize automatic retransmission and fault recovery mechanism, which are all mature network transmission technologies in the industry.

[0008] The communication mechanism between the gateway service and the MCP protocol interface preferably adopts a layered architecture design: the transport layer is recommended to provide reliable transmission based on TCP connections (three-way handshake, sliding window, congestion control), and support HTTP / 2 multiplexing and flow control mechanisms; the application layer is recommended to adopt a RESTful API interface design, support the JSON-RPC 2.0 protocol format, and combine with WebSocket to achieve full-duplex real-time communication; the data sharding strategy is recommended to adopt an adaptive sharding mechanism: small data packets (<1MB) use single transmission, medium data packets (1MB-100MB) use fixed block size sharding (64KB recommended), and large data packets (>100MB) use dynamic block size sharding (1MB-10MB recommended). These are mature technologies in the field of network transmission. The recommended transmission reliability assurance mechanism is a multi-level verification strategy: TCP checksum is used at the link layer, CRC32 check is used at the application layer, and SHA256 hash check is recommended for large file transfers. The recommended retransmission mechanism is an exponential backoff algorithm (initial timeout 1s, maximum 3-5 retries), combined with fast retransmission and selective acknowledgment (SACK) to optimize network performance. Connection pool management is recommended for fault recovery (recommended default of 10-50 connections), supporting automatic reconnection and load balancing. These are mature technologies in the field of network reliability assurance.

[0009] The functions and roles of each module of the system are as follows:

[0010] Module A: AI analysis subject (MCP Host + MCP Client). The AI ​​analysis subject (module A) serves as the user's direct interaction environment and integrates the functions of the MCP Host and MCP Client. This module is responsible for receiving analysis tasks, initiating analysis processes, and interacting with the context management and tool coordination systems through the MCP protocol. The AI ​​analysis subject can dynamically allocate analysis tasks according to user needs and is responsible for summarizing and outputting the final analysis results. Its core capabilities include natural language understanding, MCP protocol calls, analysis decisions, result output and feedback, etc. The AI ​​analysis subject can obtain intelligent reasoning capabilities through online or locally deployed LLM, but the present invention does not involve the specific implementation of LLM.

[0011] Examples of AI capabilities include, but are not limited to:

[0012] Natural language understanding capabilities can parse the analysis objectives, constraints, and contextual information entered by the user, and generate preliminary analysis intentions based on this.

[0013] By calling the MCP protocol, you can invoke the analysis capabilities of the MCP Client and obtain the analysis results.

[0014] The decision-making ability of the analysis results can generate the final analysis report or alarm information based on the analysis results.

[0015] The ability to output analysis results can output analysis results in a way that is easy for users to understand, such as text, tables, charts, etc.

[0016] The feedback capability of analysis results can automatically determine whether to continue analysis based on user feedback, thus achieving a complete closed loop of the task.

[0017] Examples of ways to acquire AI capabilities include, but are not limited to:

[0018] Online: provided by online AI models, including but not limited to OpenAI, DeepSeek, Gemini, LLama, etc.

[0019] Local method: Provided through local deployment of open source AI large models, including but not limited to DeepSeek, Qwen, LLama, etc.; deployment methods and tools include but not limited to Docker containers, Ollama, Langchain, etc.

[0020] Module B: MCP Pcap Tool Engine (MCP Server). MCP Pcap Tool Engine Module B, acting as the MCP Server, provides a Pcap Tool Gateway Interface (Interface 1) to the AI ​​analysis subject, Module A, enabling standardized connections with various MCP Pcap tools, including Modules E1, E2, and E3. This engine also collaborates with Context Management, Module C, and Pcap Data Source, Module D, to provide Pcap data to various MCP Pcap tools, including Modules E1, E2, and E3.

[0021] The system supports flexible deployment architectures: Single-node deployment is suitable for small-scale analysis scenarios and utilizes local inter-process communication. Distributed deployments utilize a microservices architecture, enabling horizontal scalability through Kubernetes container orchestration. High availability is achieved through the Nginx load balancer (using round-robin, weighted round-robin, and least connections strategies) and service discovery mechanisms (such as Consul and Etcd). The tool (Module E) supports containerized deployment, cluster management through Docker Swarm or Kubernetes, and employs health checks and automatic failover mechanisms to ensure service stability.

[0022] Module C: Context Management. Context Management (Module C) manages and maintains contextual information during the analysis process. This contextual information includes, but is not limited to, the history of each tool call, Pcap data fragments used, input and output parameters of each tool, protocol identification results, IP address and domain name mappings, port and service inference results, and user feedback. By aggregating and storing this information, Module C constructs a complete analysis context, providing comprehensive status data for the AI ​​analysis process.

[0023] The context management module organizes and stores this information in a structured manner, leveraging proven storage technologies: JSON document stores (such as MongoDB) for flexible data structures, graph databases (such as Neo4j) for complex relational modeling, and key-value stores (such as Redis) for caching. The context data structure utilizes standard fields: session_id (session identifier), timestamp (timestamp), tool_calls (tool call history), data_fragments (data fragment references), ip_domain_mapping (IP domain name mapping table), port_service_mapping (port service mapping table), analysis_results (analysis result cache), and so on. This module employs distributed locking mechanisms (such as Redis distributed locks) and version control (optimistic locking) to ensure concurrency safety. It also combines B+ tree indexes and hash indexes for efficient queries and supports state synchronization between the AI ​​analysis agent and the MCP server. By continuously recording analysis history and accumulating intermediate state data, Module C ensures that the AI ​​analysis agent and the MCP server share consistent and up-to-date context information, maintaining context state consistency across the entire system.

[0024] The context data structure is preferably defined using a standardized JSON Schema. Recommended fields include session_id (session identifier), timestamp (timestamp), version (version number), tool_calls (tool call history), data_fragments (data fragment references), ip_domain_mapping (IP domain name mapping table), port_service_mapping (port service mapping table), analysis_results (analysis result cache), etc. The mapping relationship between IP addresses and domain names is preferably designed using a bidirectional association: forward mapping (IP → domain name list) supports fast domain name lookup, and reverse mapping (domain name → IP list) supports reverse resolution. Redis Hash structure storage is recommended. Port and service inference results are preferably stored in a hierarchical mapping structure: standard ports (0-1023) use a predefined service mapping table, and dynamic ports (1024-65535) are automatically inferred based on traffic characteristics. These are mature technologies in the field of network analysis.

[0025] Dynamic update and synchronization mechanisms should preferably utilize a multi-level concurrency control strategy: The RedisRedlock algorithm is recommended for distributed locks, the optimistic locking mechanism is recommended for version control, the read-write lock separation technology is recommended for concurrent access control, and the event-driven architecture is recommended for state synchronization mechanisms. These are all mature technologies in the field of distributed systems. Contextual data retrieval algorithms should preferably utilize a multi-index strategy: The B+ tree structure is recommended for primary key indexes, hash indexes are recommended for exact match queries, composite indexes are recommended for multi-field joint queries, and full-text indexes are recommended for text content searches. These are all mature technologies in the field of database optimization.

[0026] Effective maintenance of contextual information enables the system to achieve contextual convergence between multiple rounds of tasks, namely, leveraging relevant information from previous steps in subsequent analysis steps. Furthermore, the contextual information provided by Module C supports dynamic optimization of the tool chain. By utilizing this contextual data, the system can select or adjust subsequently called tools based on the current contextual state and determine dependencies between tasks, thereby supporting closed-loop execution of analysis tasks. It should be noted that Module C focuses on data preparation and organization and does not involve the specific AI reasoning process; by providing complete contextual data support, it ensures that the AI ​​analysis subject can continuously perform reasoning and analysis. Concurrency control of contextual data utilizes standard database transaction mechanisms (ACID characteristics), handles concurrent access through MVCC (multi-version concurrency control) and read-write lock separation technology, and optimizes storage efficiency by combining LRU caching strategies and TTL expiration mechanisms. These are all mature technologies in the database field.

[0027] Module D: Pcap Data Source. The Pcap Data Source (Module D) provides raw data input for the system, supports multiple network data collection methods, and enables flexible switching between real-time data streams and historical data. It provides efficient and stable Pcap data for various MCP Pcap tools (Modules E1, E2, E3, etc.), ensuring the data foundation for analysis tasks.

[0028] Modules E1, E2, E3, etc.: Various MCP Pcap tools (MCP Servers). These various MCP Pcap tools (Modules E1, E2, E3, etc.) act as MCP Servers, performing specific Pcap analysis tasks and returning analysis results. Each MCP Server exposes its analysis capabilities through a standardized interface, supports on-demand expansion, and (optionally) hot-swappable functionality. These tools include capabilities such as protocol parsing, network flow analysis, feature extraction, anomaly detection, data conversion, statistics, and visualization.

[0029] Examples of Pcap tool capabilities include (but are not limited to):

[0030] Protocol parsing tools: Provide capabilities similar to Wireshark, tcpdump, and Hami. They provide detailed protocol data, including detailed data for each protocol layer, such as HTTP request data, TLS handshake data, and DNS query data.

[0031] Network flow analysis tools: Provides flow analysis capabilities, including TCP / IP flow, HTTP flow, DNS flow, TLS flow, etc., and provides traffic statistics and flag statistics.

[0032] Feature Extraction Tools: Provides capabilities such as Deep Packet Inspection (DPI) feature extraction tools to identify characteristics of data packets, such as HTTP requests, TLS handshakes, DNS queries, etc.

[0033] Anomaly Detection Tools: These tools provide capabilities such as anomaly detection tools to identify data packet anomalies, such as abnormal TLS handshakes and DNS queries. Detection algorithms should preferably utilize a multi-layered detection architecture: threshold detection is recommended for the statistical analysis layer, ensemble classification models are recommended for the machine learning layer, and signature matching is recommended for the rule engine layer. These are all mature technologies in the field of network security. Conversion Tools: These tools provide capabilities such as data packet conversion tools to convert data packets into other formats, such as JSON, XML, and CSV.

[0034] Statistical tools: Provide statistical tools such as traffic statistics and flag statistics.

[0035] Visualization tools: Provide visualization tools such as flow charts, statistical charts, etc.

[0036] Anomaly detection is based on a multi-dimensional assessment strategy: TLS handshake anomaly recommendations are based on protocol compliance testing (handshake sequence integrity, certificate chain validation, and cipher suite security); DNS query anomaly recommendations are based on query pattern analysis (query frequency anomalies, domain name length anomalies, and query type distribution); and traffic behavior anomaly recommendations are based on statistical feature analysis (connection number anomalies, data transmission rate anomalies, and session duration anomalies). These are all mature technologies in the field of network protocol analysis. Feature extraction preferably uses layered feature engineering: network layer feature recommendations include IP address entropy, port usage distribution, and protocol type statistics; transport layer feature recommendations include TCP flag bit combinations, window size change rate, and sequence number continuity; and application layer feature recommendations include HTTP method distribution, User-Agent fingerprints, and payload length statistics. These are all mature technologies in the field of network traffic analysis.

[0037] The algorithm's training and update mechanism preferably adopts an adaptive learning strategy: an incremental learning algorithm is recommended for online learning (a learning rate of 0.01-0.1 is recommended for online stochastic gradient descent), a regular retraining mechanism is recommended for model updates (daily incremental updates and weekly full retraining are recommended), and a statistical significance test is recommended for feature drift detection (a p-value threshold of 0.05 is recommended). These are all mature technologies in the field of machine learning.

[0038] The system of the present invention uses three standardized interfaces to collaborate with other modules of the system to ensure efficient collaboration and flexible expansion, as detailed below:

[0039] Interface 1: Pcap Tool Gateway Interface. The Pcap Tool Gateway Interface (Interface 1) is implemented during the initialization phase through multiple registration and discovery mechanisms. It dynamically expands the toolset and exposes unified MCP Server capabilities, significantly improving system flexibility and maintainability. This unified service shields the heterogeneity of underlying tools and provides a consistent, scalable tool invocation experience for upper-level analysis processes.

[0040] Interface 2: Pcap tool interface; the Pcap tool interface (Interface 2) uses the MCP protocol and provides standard MCPServer capabilities to the MCP Pcap tool engine (module B) for implementation.

[0041] Interface 3: Data Packet Interface. This interface (Interface 3) allows various MCP Pcap tools (modules E1, E2, and E3, etc.) to access data packets. Interface 3 collaborates with the Pcap data source (module D) and utilizes standard network transmission technologies: reliable data transmission based on TCP sockets, support for UDP multicast for real-time data distribution, HTTP / HTTPS for RESTful API calls, WebSocket for full-duplex real-time communication, and asynchronous data transmission through message queues (such as RabbitMQ and Kafka). These are all mature network communication technologies in the industry. The data access logic utilizes an adapter model: database access supports MySQL / PostgreSQL (SQL query optimization and B+ tree indexing) and MongoDB / Elasticsearch (NoSQL aggregation queries and inverted indexing). The network data source utilizes standard socket protocols (TCP three-way handshake and UDP connectionless transmission), while custom protocols adhere to RFC-standard formats (such as Ethernet frames, IP headers, and TCP segments). The message queue utilizes Kafka partitioned consumption (consumer groups and offset management) and RabbitMQ switch routing (Direct / Topic / Fanout modes), all of which are mature technologies in the data access field.

[0042] The communication mechanism of interface 3 preferably adopts a multi-protocol support architecture: the transport layer is recommended to provide reliable transmission based on TCP connections, supporting HTTP / 2 multiplexing and flow control mechanisms; the data sharding strategy recommends the use of an adaptive sharding mechanism; the transmission reliability guarantee recommends the use of a multi-level verification strategy; the retransmission mechanism recommends the use of an exponential backoff algorithm, combined with fast retransmission and selective confirmation to optimize network performance; fault recovery recommends the use of connection pool management, supporting automatic reconnection and load balancing, all of which are mature technologies in the field of network transmission.

[0043] The data access logic preferably adopts the adapter mode: database access is recommended to support relational databases and NoSQL databases; the network data source is recommended to use the standard socket protocol, and the custom protocol is preferably in accordance with the RFC standard format; the message queue is recommended to adopt the partition consumption and switch routing mode, which are mature technologies in the field of data access.

[0044] Specific implementation methods include but are not limited to:

[0045] File: Reads Pcap data streams from the local file system. Support for the standard Pcap file format is recommended. Memory mapping is recommended for efficient reading of large files. File indexing is recommended for faster packet location. Incremental reading and streaming are also recommended.

[0046] Network: Read Pcap data streams from the network. Standard socket protocols are recommended: TCP connections for reliable transmission, UDP connectionless transmission for real-time data distribution, HTTP / HTTPS RESTful APIs for structured queries, and WebSockets for full-duplex real-time communication. Custom protocols are recommended to comply with RFC standards, which are mature standards for network protocol stacks.

[0047] Database: Read the Pcap data stream from the database. SQL query optimization is recommended for relational databases, while aggregate query is recommended for NoSQL databases. These are both mature technologies in the database field.

[0048] Message Queue: Reads PCAP data streams from a message queue. We recommend using the partition consumption mode and switch routing mode, both of which are mature technologies in the message queue field.

[0049] Memory: Reads Pcap data streams from memory-mapped files. It is recommended to use virtual memory management technology to support efficient random access of large files, combine it with page caching to optimize read performance, and use memory pools to reduce memory allocation overhead.

[0050] The above system architecture and process design are strictly based on MCP's open protocols and standard interfaces, breaking through the limitations of traditional Pcap analysis tools, realizing AI-led, context-aware, plug-in expansion and high-performance analysis, and meeting the needs of deep semantic understanding, dynamic protocol identification and intelligent analysis of Pcap traffic in complex network environments.

[0051] The data transmission gateway service adopts a layered architecture design, supports the dynamic selection of multiple transmission protocols (such as FTP, HTTP streaming, WebSocket, etc.), and has optimization functions such as data segmentation, compression, checksum and fault recovery, ensuring the efficient transmission of large-volume Pcap data. The data transmission gateway service adopts a layered architecture design, supports the dynamic selection of multiple transmission protocols (such as FTP, HTTP streaming, WebSocket, etc.), and has optimization functions such as data segmentation, compression, checksum and fault recovery, ensuring the efficient transmission of large-volume Pcap data. The communication between the gateway service and the MCP protocol interface adopts standard network technology: reliable transmission based on TCP connection, support for HTTP / 2 multiplexing and flow control, TLS encryption to protect data transmission security, flow control through the TCP sliding window mechanism, and transmission reliability guaranteed by combining the TCP retransmission timeout (RTO) and fast retransmit mechanism. These are all mature technical standards in the field of computer networks.

[0052] The system performance optimization solution preferably adopts a multi-level optimization strategy: data compression and sharded transmission are recommended for the data transmission layer, parallel computing and caching mechanisms are recommended for the computing processing layer, and index optimization and pre-reading strategies are recommended for the storage access layer. These are all mature technologies in the field of system performance optimization.

[0053] The context data structure preferably uses the standardized JSON format. The typical structure example is as follows:

[0054]

[0055]

[0056] The context synchronization mechanism preferably uses distributed locks and version control: the RedisRedlock algorithm is recommended for distributed locks to ensure concurrency safety, the optimistic locking mechanism is recommended for version control to avoid data conflicts, and the event-driven architecture is recommended for state synchronization to achieve real-time updates. These are all mature technologies in the field of distributed systems.

[0057] Retrieval index design preferably adopts a multi-level index strategy: the primary key index is recommended to use a B+ tree structure to support range queries, hash index is recommended for exact match queries, composite index is recommended for multi-field joint queries, and full-text index is recommended for text content search. These are all mature technologies in the field of database optimization.

[0058] The network data intelligence tool system execution method based on the Model Context Protocol (MCP) of the present invention comprises the following specific processing steps:

[0059] Step 1: System Initialization and Tool Registration. During the system initialization phase, the MCP Pcap tool engine (module B) aggregates the capabilities of all Pcap tools through a registration and discovery mechanism and provides them to the AI ​​analysis subject (module A) through the Pcap tool gateway interface (interface 1), ensuring the flexibility and scalability of subsequent task scheduling.

[0060] Step 2: Task Reception and Requirements Analysis. The AI ​​analysis agent (Module A) is responsible for receiving user tasks, including requirements, context, and data packets, and identifying analysis intent through natural language understanding and other technologies. The AI ​​analysis agent (Module A) calls the MCP Pcap tool engine (Module B) through the Pcap tool gateway interface (Interface 1).

[0061] Step 3: Tool Coordination and Data Processing. The MCP Pcap Tool Engine (Module B) selects the appropriate MCP Pcap tool (Modules E1, E2, E3, etc.) based on the registration list, executes the specific Pcap tool, and returns the tool results. Prior to this, the MCP Pcap Tool Engine also calls the Pcap Data Source (Module D) based on the context management (Module C) to provide the required data to the relevant tool.

[0062] Step 4: Analysis, Decision-Making, and Results Output. The AI ​​analysis agent (Module A) analyzes and makes decisions based on the tool results returned by the MCP Pcap tool engine (Module B), obtaining the task results. The MCP Host conducts comprehensive analysis and decision-making based on the tool results returned by the MCP Client, ultimately outputting a structured report or alarm information. If the task is not completed, the task execution process is re-entered based on the feedback information until the current analysis goal is achieved.

[0063] Step 5: Task closure and feedback phase. The system feeds back the analysis results to the user and automatically determines whether further analysis is needed based on user feedback, thus completing the task closure.

[0064] This process supports multiple rounds of task decomposition and contextual reasoning. The AI ​​analysis agent (Module A) dynamically adjusts the toolchain based on historical analysis results, enabling on-demand analysis and policy optimization. The Pcap Tool Gateway Interface (Interface 1) plays a key role in task distribution, interface standardization, and capability aggregation, ensuring efficient and consistent analysis.

[0065] The present invention "step 1: system initialization and tool registration" is performed during the system initialization phase, such as Figure 3 The specific processing steps are as follows:

[0066] Step 1.1: Discover available Pcap tools. The MCP Pcap tool engine (module B) actively executes the available tool discovery process during the system initialization phase to obtain the service address, capability description, and configuration metadata of each MCP Pcap tool (modules E1, E2, E3, etc.) in preparation for subsequent unified registration and invocation. This process includes two methods:

[0067] Manual configuration: Users or system administrators preset tool-related information in configuration files or startup parameters, including the tool's service address, MCP interface parameters, supported protocols, and task descriptions. This method is suitable for initial deployment, testing environments, or scenarios with high security requirements, offering controllable configuration and clear debugging.

[0068] Automatic scanning: During initialization or runtime, the tool engine automatically scans predefined network ports, service registries, configuration services, or broadcasts through the local area network to identify available MCP Pcap tools in the current environment. This method is suitable for cloud-native or plug-in deployment environments, supports dynamic expansion and hot swapping, and improves system flexibility and adaptability.

[0069] Automatic scanning prefers standard network discovery technology: Network protocol scanning is recommended to support UDP broadcast, multicast and TCP connection detection. The port range preferably covers commonly used service ports. SYN scanning and connection timeout mechanisms are recommended to ensure scanning efficiency. The service registry preferably follows standard protocols: Consul recommends the HTTP API, Eureka recommends the RESTful interface, Etcd recommends the gRPC protocol, and ZooKeeper recommends the ZAB protocol. These are all mature technologies in the field of service discovery. The hot plug detection mechanism preferably adopts multi-level monitoring: polling detection combined with event monitoring, it is recommended to support health checks, and it is recommended to use exponential backoff algorithms to optimize detection frequency. These are all mature technologies in the field of distributed systems. Step 1.2: Tool registry record. Register all tool capabilities in a unified registry to form a tool list. Typical fields are as follows:

[0070] tool_id (tool identifier): a unique identifier within the system, such as "pcap_analyzer".

[0071] name: A concise name, such as "PCAP Network Analysis Engine".

[0072] description: A brief description of the tool's functionality, such as "parses PCAP files for protocol identification and anomaly detection."

[0073] methods (method list): Lists the supported method names and functions. For Pcap analysis tools, you can register a group of related methods, for example:

[0074] extract_flows (traffic extraction): parses independent communication flows (such as sessions) from the input PCAP data and extracts information such as source IP, destination IP, port, and protocol of each flow.

[0075] identify_protocols (protocol identification): Analyzes network traffic content, identifies the protocol type used by each flow or packet (such as HTTP, DNS, etc.), and outputs a list or mapping of the discovered protocols.

[0076] detect_anomalies (anomaly detection): Detects abnormal patterns or suspicious behaviors (such as abnormally high traffic peaks, unknown protocol packets, etc.) based on network traffic statistical characteristics, and outputs reports on abnormal events.

[0077] Each method should have an independent name, input and output descriptions, and functional descriptions, including the following:

[0078] input_schema: describes the input structure required by each method, such as pcap_file_path (string) or pcap_data (binary).

[0079] output_schema: describes the output structure, such as a list of flow records, a list of protocols, or exception events.

[0080] capabilities: Use keywords to indicate tool functions, such as "protocol analysis" and "anomaly detection."

[0081] Through structured registration information, ensure that tools can be correctly identified and called by AI.

[0082] Step 1.3: Unified capability declaration. The MCP Pcap tool engine (module B) uses the Pcap tool gateway interface (interface 1) to provide a unified MCP service to the AI ​​analysis subject (module A), allowing the latter to clearly identify available functions and how to call them, ensuring that the AI ​​analysis subject (module A) can flexibly call all Pcap intelligent tools according to task requirements. This capability declaration uses a standardized format and includes:

[0083] Tool call path: declares the tool method level identifier (such as pcap_analyzer.identify_protocols) for routing and execution.

[0084] Parameter definition: defines required / optional parameters and their data type constraints, lists the parameters and types required for each method, and is derived from input_schema.

[0085] Input / output structure description: Declare the input and output formats based on JSON Schema to ensure machine parsability.

[0086] Capability declaration format: Transmitted using a standardized JSON structure, with fields including name, description, parameters, and output.

[0087] Protocol compatibility: Adhering to the MCP unified description framework, the AI ​​system can achieve self-description and dynamic discovery of tool capabilities. Through capability declaration, the AI ​​system can automatically discover, understand, and correctly call various Pcap tools, with unified management and consistent interfaces, in compliance with the MCP protocol specification.

[0088] The present invention "step 2: task reception and demand analysis" is performed in the task reception stage, such as Figure 4 The specific processing steps are as follows:

[0089] Step 2.1: Task Reception. The system of the present invention receives the analysis requirements, context, data packets and other information input by the user through the AI ​​analysis subject (module A) and conducts new analysis or continuous analysis. Specifically including but not limited to:

[0090] Requirement description: Analysis requirements entered by the user, including analysis objectives, data scope, and tool call statements.

[0091] Context: historical analysis results, analysis strategies, analysis knowledge, etc.

[0092] Data packets: Network data packets to be analyzed, which can be real-time data streams or historical data packets.

[0093] Step 2.2: Requirements Understanding and Intent Identification. The AI ​​analysis subject (Module A) uses natural language processing technology to analyze task requirements, identify analysis objectives and constraints, and generate preliminary analysis intent. This is an AI capability and is not within the scope of this invention.

[0094] Step 2.3: Intelligent Scheduling and Tool Invocation. Based on the analysis intent, the AI ​​analysis subject (Module A) intelligently schedules the appropriate Pcap tool and invokes the MCP Pcap tool engine (Module B) via the MCP protocol to initiate a tool invocation request, thus entering the subsequent analysis process. This is an AI capability and is not within the scope of this invention. However, the system of this invention does initiate a tool invocation request via the MCP Pcap tool engine (Module B) via the MCP protocol, thus entering the subsequent analysis process.

[0095] The present invention "Step 3: Tool coordination and data processing" is performed during the task receiving phase, such as Figure 5 The specific processing steps are as follows:

[0096] Step 3.1: Context Request Receiving. The MCP Pcap Tool Engine (Module B) receives the context request from the AI ​​Analysis Entity (Module A). The request is described by the MCP protocol of the Pcap Tool Gateway Interface (Interface 1).

[0097] Step 3.2: Call Decision. The MCP Pcap Tool Engine (Module B) enhances the request based on the context management (Module C). It also determines whether to transfer data to the target MCP Pcap Tool (Modules E1, E2, E3, etc.). If necessary, it proceeds to the data transfer phase; otherwise, it directly proceeds to the tool execution phase.

[0098] Ways to enhance requirements include (but are not limited to):

[0099] Based on the tools and their results that have been called in the historical context, infer whether the current requirements overlap with the previous analysis to avoid duplication of processing;

[0100] Analyze whether the five-tuple (source IP, destination IP, source port, destination port, protocol) in the Pcap data fragment is related to the key session recorded in the context;

[0101] Added metadata tags such as protocol type, time range, and traffic size for subsequent tool selection and execution parameter setting;

[0102] Mark the historical toolchain path that the current requirement depends on for subsequent decision path reuse or optimization.

[0103] Basis for determining whether to transmit data:

[0104] If the context already contains the raw or pre-processed data segments required by the target tool, they do not need to be retransmitted and can be directly executed by the tool;

[0105] If the time range, traffic direction, or protocol type of the Pcap data required by the target tool does not match the data already in the context, it must be pulled from the data source and transmitted;

[0106] When the data granularity required by the tool (e.g., complete TCP stream vs. single packet) is higher than the data granularity stored in the current context, data must be retrieved again;

[0107] If the task is executed for the first time or the user explicitly requests a reanalysis scenario, the latest data is always transferred.

[0108] Step 3.3: Data transmission. MCP Pcap selects a transmission method based on the data size: small data is directly transmitted inline through the MCP protocol, while large data is transmitted to the target MCP Pcap tool (modules E1, E2, E3, etc.) through the data transmission gateway service using a bypass channel.

[0109] The data transmission gateway service preferably adopts a layered transmission architecture: the transport protocol layer is recommended to support TCP / HTTP (or HTTP / 2) for reliable transmission, UDP for real-time data distribution, and WebSocket for full-duplex communication; the data fragmentation strategy recommends an adaptive fragmentation mechanism: small data packets (<1MB) use single transmission, medium data packets (1MB-100MB) use fixed block size fragmentation (64KB recommended), and large data packets (>100MB) use dynamic block size fragmentation (1MB-10MB recommended); a multi-level verification strategy is recommended to ensure transmission reliability: the link layer uses TCP checksum, the application layer uses CRC32 checksum, and the SHA256 hash checksum is recommended for large file transmission. The retransmission mechanism recommends an exponential backoff algorithm (initial timeout 1s, maximum 3-5 retries), combined with fast retransmission and selective acknowledgment (SACK) to optimize network performance, and fault recovery recommends connection pool management (recommended default 10-50 connections), supporting automatic reconnection and load balancing. These are mature technologies in the field of network transmission.

[0110] Step 3.4: Tool execution. The MCP Pcap tool engine (module B) uses the enhanced requirements to initiate specific analysis tasks to the target MCP Pcap tool (modules E1, E2, E3, etc.) through the Pcap tool interface (interface 2).

[0111] Step 3.5: Result Return and Context Update. After the target MCP Pcap tool (modules E1, E2, E3, etc.) completes its analysis, it returns the results to the MCP Pcap tool engine (module B). The engine writes the results of this round of tool execution, along with the data transfer record from step 3.3 (including data range, transmission method, protocol type, traffic direction, etc.), to the context management module (module C) to enrich the current context.

[0112] The context update mechanism preferably uses atomic transaction operations: database transactions (ACID characteristics) are recommended for update operations to ensure data consistency, atomic operations are recommended for version number increments to avoid concurrency conflicts, and JSON Schema validation is recommended for data verification to ensure the correct data format. The context enhancement strategy recommends the use of incremental update mechanisms: append mode is recommended for new data, foreign key references are recommended for data associations, and write-time update strategies are recommended for cache updates. These are all mature technologies in the field of database transactions.

[0113] After the context update is complete, the MCP Pcap tool engine performs a new round of context enhancement based on the newly accumulated information. This includes integrating analysis outputs, supplementing analysis tags, and marking new context dependency paths, resulting in a structured, enhanced context result. The context enhancement algorithm recommends graph structure analysis: Directed Acyclic Graph (DAG) modeling is used for dependency recommendations, the PageRank algorithm is used for label propagation recommendations, and the shortest path algorithm is used for path optimization recommendations—all mature technologies in the field of graph theory algorithms. Ultimately, this enhanced result is returned to the AI ​​analysis body (Module A) via the MCP protocol, providing complete and continuous contextual support for subsequent analysis and decision-making.

[0114] Compared with the prior art, the present invention has the following beneficial effects:

[0115] (1) Innovation of direct embedding + bypass data forwarding architecture in tool calls: Based on the MCP protocol, a separation mechanism is implemented for direct embedding transmission of small-volume data and bypass transmission of large-volume data, solving the problem of Pcap large file transmission efficiency. The data transmission gateway service supports efficient decoupling of analysis requests, tool scheduling and data return.

[0116] (2) Design of a heterogeneous tool collaboration engine: Integrate multi-source Pcap analysis tools into a unified platform, implement dynamic tool scheduling and parallel collaboration through standardized interfaces, combine tool capability registration with list management, and support AI to intelligently combine and call tools according to task requirements.

[0117] (3) Context-driven intelligent analysis mechanism: The analysis status is maintained through contextual elements such as quintuple features, protocol annotations, and historical tasks to achieve the consistency of multiple rounds of analysis, dynamically optimize the tool call path, and reuse the historical optimal strategy to ensure the consistency of results.

[0118] (4) Multimodal data access and processing: Provides unified data interfaces for multiple channels, such as files, networks, and databases, supports flexible input of real-time streams and historical data, and meets the needs of large-scale network data analysis and efficient real-time parsing through optimization mechanisms such as data segmentation, compression, and breakpoint resumption provided by data transmission gateway services.

[0119] Of course, any product implementing the present invention does not necessarily need to achieve all of the advantages described above at the same time. BRIEF DESCRIPTION OF THE DRAWINGS

[0120] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0121] Figure 1 This is a system module architecture diagram of the present invention;

[0122] Figure 2 The main flow chart for the execution of the task of the present invention;

[0123] Figure 3 A detailed flow chart of system initialization and tool registration in step 1 of the present invention;

[0124] Figure 4 This is a detailed flow chart of task reception and requirement analysis in step 2 of the present invention;

[0125] Figure 5 Detailed flow chart of tool coordination and data processing for step 3 of the invention. DETAILED DESCRIPTION

[0126] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making any creative efforts shall fall within the scope of protection of the present invention.

[0127] Problems to be solved by this technical solution:

[0128] (1) Resource waste caused by full analysis of traditional tools: Existing Pcap analysis tools are based on a full data processing mode based on static rules, which results in wasted storage space and computing power, while the actual analysis target only involves some key data fragments, resulting in insufficient resource utilization.

[0129] (2) Lack of in-depth analysis capabilities for complex network traffic: When faced with non-standard data such as encrypted traffic and private protocols, traditional tools rely on preset parsing rules and are unable to achieve protocol semantic understanding and dynamic feature extraction, resulting in a high rate of missed detection of key information.

[0130] (3) Tool fragmentation and lack of collaboration: Heterogeneous Pcap tools (such as Wireshark, tcpdump, Hami, etc.) adopt a closed architecture and lack a unified scheduling interface. Cross-tool analysis requires manual data transfer and result integration, resulting in reduced analysis efficiency.

[0131] (4) Insufficient adaptability to dynamic network environments: In dynamic topology scenarios such as SDN and cloud environments, traditional tools cannot associate network policy change contexts, protocol parsing rule updates are delayed by more than 15 minutes, and real-time analysis accuracy is low.

[0132] (5) Bottleneck of large-volume Pcap data transmission: When traditional text protocols (such as HTTP / JSON) transmit TB-level Pcap files, due to serialization overhead and bandwidth limitations, the data transmission time exceeds the total task duration, forming a bottleneck in the analysis process.

[0133] To illustrate the solution of the present invention, a local deployment example is briefly described below.

[0134] like Figure 1-5 As shown, the responsibilities of this instance module are:

[0135] The system is deployed locally. The AI ​​analysis subject (module A) loads the QWen2.5 model through Ollama and refers to the AnthropicClaude desktop version installation (see the official documentation for details) to implement natural language analysis and task scheduling.

[0136] Module B (MCP Tool Engine): Responsible for registering, managing, and calling local tools (E1-E3), unifying the interface, and forwarding requests and results. Module B receives tool call requests from Module A (e.g., via the tools / call method of JSON-RPC), matches the corresponding tool module E1-E3 based on the tool_id or name in the request, and forwards the input parameters to the tool for execution.

[0137] Module C (Context Management): Maintains the context and session state during the analysis process, records intermediate results, and ensures information consistency across multiple rounds of tasks. The context data structure is preferably defined using a standardized JSON Schema, supporting session isolation, versioning, and concurrency safety. Multi-level indexing strategies (B+ trees, hash indexes, and composite indexes) are employed for efficient queries. Distributed locking mechanisms (Redis Redlock) and optimistic locking (version number control) are recommended to ensure concurrency safety. These are mature technologies in database management.

[0138] Module D (data source): provides raw PCAP data to the tool, supports retrieval by file name or session ID, and does not require the tool to care about the underlying storage.

[0139] In this example, the MCP Pcap Tools service includes four native tools:

[0140] Module E1 (Flow Statistics Tool): Its function is to perform flow-level statistical analysis on given PCAP data. This tool parses the flow data provided by data source D, aggregates flows according to the five-tuple (source IP, source port, destination IP, destination port, protocol), and calculates key metrics for each flow (such as the total number of packets, the number of TCP reset packets (RST), session duration, etc.). In terms of the interface, E1 exposes an analysis method (for example, analyze_flow_stats), accepts input including PCAP file identifiers or data content, and outputs a list of statistical results (optionally JSON structured or text) for Module A to read. E1 is registered as a callable tool through MCP, and its output is returned to Module A through Module B.

[0141] Module E2 (Packet Search Tool): Its function is to perform packet searches for specific conditions in PCAP data. This tool scans the packet collection in data source D based on the input filtering parameters (such as quintuple identifiers, packet sequence numbers, protocol field values, or feature strings) to locate packet records that meet the conditions. The interface responsibilities include providing a search method (such as search_packets), which takes as input the search criteria (which can include PCAP file identifiers and filter expressions), and outputs a reference list or index set of the found packets. After E2 is registered as an MCP tool, module A can call it through module B and perform further analysis based on the returned packet index.

[0142] Module E3 (Packet decoding tool): Its function is to deeply decode and parse the specified original data packet. The tool receives the original message from the data source D (specified by message index or offset), parses its protocol header and payload, and converts the underlying binary data into easy-to-read structured information (for example, listing each field and value in the protocol hierarchy). E3 provides decoding methods (such as decode_packet). The input includes the PCAP file identifier and message locator as well as the protocol hierarchy to be parsed. The output is the message parsing result (which can be a JSON structure or text description). As an MCP tool, E3 is managed and scheduled by module B, and its decoding results will be fed back to module A for the AI ​​analysis model to comprehensively determine the cause of the network event.

[0143] Module E4 (Anomaly Detection Tool): This tool identifies network traffic anomalies based on a multi-layered detection architecture. This tool utilizes a collaborative detection mechanism comprised of a statistical analysis layer (threshold detection), a machine learning layer (an integrated classification model), and a rule engine layer (signature matching). Anomaly detection is preferably based on a multi-dimensional assessment strategy: TLS handshake anomaly recommendations are based on protocol compliance testing (handshake sequence integrity, certificate chain validation, and cipher suite security); DNS query anomaly recommendations are based on query pattern analysis (query frequency anomalies, domain name length anomalies, and query type distribution); and traffic behavior anomaly recommendations are based on statistical feature analysis (connection number anomalies, data transmission rate anomalies, and session duration anomalies). Feature extraction is preferably based on hierarchical feature engineering: network layer feature recommendations include IP address entropy, port usage distribution, and protocol type statistics; transport layer feature recommendations include TCP flag bit combinations, window size change rate, and sequence number continuity; and application layer feature recommendations include HTTP method distribution, User-Agent fingerprints, and payload length statistics. The algorithm training and update mechanism preferably utilizes an adaptive learning strategy: an incremental learning algorithm is recommended for online learning; a periodic retraining mechanism is recommended for model updates; and statistical significance testing is recommended for feature drift detection. E4 provides anomaly detection methods (such as detect_anomalies), whose input includes PCAP file identifiers and detection parameters, and outputs a list of anomaly events and confidence scores, which are mature technologies in the field of network security.

[0144] Tool registration and calling process of this instance

[0145] 1. Tool registration: Module B loads local tools E1, E2, E3, and E4, registers their capabilities, and forms an MCP tool list.

[0146] 2. Tool list acquisition: Module A searches the tool list to obtain available tools and parameters.

[0147] 3. Trigger call: The AI ​​model decides to call a tool, and module A requests module B to call it through the MCP protocol.

[0148] 4. Tool identification and invocation: Module B routes the request to the target tool, forwards the parameters and executes it.

[0149] 5. Analysis task execution: The tool module obtains data and performs analysis, and the results are returned to module B.

[0150] 6. Result return and integration: Module B returns the results in a unified format, and module C records the context, and the AI ​​model continues the analysis based on it.

[0151] 7. Multiple rounds of interaction: If further analysis is required, repeat the above process until the task is completed.

[0152] MCP tool capability declaration pseudocode for this example

[0153] When registering E1, E2, E3, and E4 tools, the capability declaration adopts the MCP specification. The example is as follows: Tool E1: Flow Statistics Tool

[0154]

[0155]

[0156] Tool E2: Packet Search Tool

[0157]

[0158] Tool E3: Packet decoding tool

[0159]

[0160] Tool E4: Anomaly Detection Tool

[0161]

[0162]

[0163]

[0164]

[0165]

[0166] The tool gateway of this instance

[0167] Module B serves as a unified gateway and is responsible for:

[0168] Unified task triggering: All tool calls are triggered through the same interface and automatically routed.

[0169] File Data Delivery: Coordinate file delivery to ensure tools can access the required data.

[0170] Status feedback and result return: track task progress and return results in a unified format.

[0171] The issue.pcap task flow of this example

[0172] 1. Task start: Module A receives the diagnostic request, module C records the context, and A decides to count the traffic first.

[0173] 2. Phase 1 - Traffic Statistics: A calls E1 to count the number of packets and RSTs in each flow of issue.pcap and finds that the RST of a certain quintuple is abnormally high.

[0174] 3. Phase 2 - Locating the message: A calls E2, searches by the quintuple and the RST flag, and obtains the index of the abnormal message.

[0175] 4. Phase 3 - Message decoding: A calls E3 to decode the abnormal message and confirm that the RST was initiated by the server.

[0176] 5. Abnormal determination: A comprehensively analyzes the decoding results and determines that the abnormality is caused by the server actively sending an RST.

[0177] This process demonstrates the advantages of AI-assisted multi-tool automatic analysis, improving the efficiency and accuracy of network fault diagnosis.

[0178] Competitive technology analysis

[0179] The following is a comparative analysis of the present invention and the prior art (including Wireshark, patents CN113347258A, CN103023725B, and CN115567503A), highlighting the innovations and differences of the present invention:

[0180] Wireshark: A localized protocol analysis tool

[0181] Related content: Wireshark is a widely used open-source network protocol analysis tool. Its primary functions include capturing and analyzing network packets, and it supports parsing multiple protocols. Its architecture is a local, monolithic one, with all data processing and analysis performed locally. It lacks remote call and modular scheduling capabilities.

[0182] Difference Analysis:

[0183] Architecture mechanism: This invention introduces the "direct embedding + bypass data forwarding in tool calls" mechanism, which supports the separation of direct embedded transmission of small-volume data and bypass transmission of large-volume data. It is suitable for distributed and cloud-native environments and is superior to Wireshark's local processing architecture.

[0184] Tool management: This invention supports dynamic registration and capability declaration of tools. AI can dynamically combine and call different Pcap analysis tools according to task requirements, improving flexibility and scalability. Wireshark uses a static plug-in mechanism and lacks dynamic scheduling capabilities at runtime.

[0185] Analysis process: This invention introduces a context management module to maintain context information during the analysis process, support multiple rounds of interaction and continuity of results, and improve the intelligence and accuracy of the analysis. Wireshark, on the other hand, performs each analysis independently and lacks memory of historical tasks or context.

[0186] Patent CN113347258A: Data collection, monitoring and analysis method in cloud environment

[0187] Related content: This patent proposes a data collection, monitoring, and analysis method in a cloud environment. It focuses on the collection, encapsulation, and transmission of data traffic within and outside the cloud, using encapsulation protocols (such as GRE and VXLAN) for traffic forwarding, but does not involve tool scheduling or the separation of control and data.

[0188] Difference Analysis:

[0189] Architecture mechanism: The present invention achieves decoupling of control and data through a protocolized dual-channel architecture, supports flexible tool scheduling and distributed deployment, and is superior to the fixed transmission architecture of CN113347258A.

[0190] Tool management: This invention supports dynamic registration and capability declaration of tools. AI can dynamically combine and call different Pcap analysis tools according to task requirements, while CN113347258A does not involve tool registration and capability declaration.

[0191] Analysis process: The present invention introduces a context management module to maintain context information during the analysis process, supporting multiple rounds of interaction and continuity of results, while the CN113347258A processing flow is a fixed single-round analysis.

[0192] Patent CN103023725B: Anomaly detection method based on network traffic analysis

[0193] Related content: This patent proposes an anomaly detection method based on network traffic analysis. Through in-depth analysis of IP data packets, it proposes a relatively complete initial feature set of network traffic and uses a Bayesian classifier for anomaly detection.

[0194] Difference Analysis:

[0195] Analysis method: This invention introduces an AI collaborative analysis mechanism and combines it with a context management module to intelligently analyze network traffic, thereby improving the accuracy and intelligence of anomaly detection. CN103023725B mainly relies on a static feature set and a Bayesian classifier and lacks an AI collaborative analysis mechanism.

[0196] Tool management: This invention supports dynamic registration and capability declaration of tools. AI can dynamically combine and call different Pcap analysis tools according to task requirements, while CN103023725B does not involve tool registration and capability declaration.

[0197] Architectural mechanism: The present invention achieves decoupling of control and data through a protocolized dual-channel architecture, supports flexible tool scheduling and distributed deployment, while CN103023725B does not involve such architectural design.

[0198] Patent CN115567503A: HTTPS protocol analysis method based on traffic analysis Related content: This patent proposes an HTTPS protocol analysis method based on traffic analysis, which mainly solves the problem of decrypting HTTPS traffic in the field of bypass mirror traffic analysis. It configures key system resources, collects traffic from the mirror port, and performs protocol parsing and decryption.

[0199] Difference Analysis:

[0200] Protocol parsing capability: The present invention achieves flexible parsing of multiple protocols through modular design and tool registration mechanism, improving the adaptability and scalability of the system. However, CN115567503A mainly focuses on the parsing of HTTPS protocol and lacks the flexible parsing capability of multiple protocols.

[0201] Tool management: This invention supports dynamic registration and capability declaration of tools. AI can dynamically combine and call different Pcap analysis tools according to task requirements, while CN115567503A does not involve tool registration and capability declaration.

[0202] Architectural mechanism: The present invention achieves decoupling of control and data through a protocolized dual-channel architecture, supports flexible tool scheduling and distributed deployment, while CN115567503A does not involve such architectural design.

[0203] In summary, the present invention is superior to existing Wireshark tools and related patents in terms of architectural mechanism, tool management, analysis process, protocol parsing capability, and AI collaborative analysis mechanism, and has significant innovation and practicality.

[0204] The preferred embodiments of the present invention disclosed above are intended only to help illustrate the present invention. These preferred embodiments do not exhaustively describe all details, nor do they limit the present invention to the specific embodiments described. Obviously, many modifications and variations are possible based on the content of this specification. These embodiments are selected and described in detail in this specification to better explain the principles and practical applications of the present invention, thereby enabling those skilled in the art to better understand and utilize the present invention. The present invention is limited only by the claims and their full scope and equivalents.

Claims

1. A network data intelligence tool system based on the Model Context Protocol (MCP), characterized by: include: Module A: The AI ​​analysis subject. Serving as the user's direct interaction environment, it integrates the functions of the MCP Host and MCP Client. Module A is responsible for receiving analysis tasks, initiating analysis processes, and interacting with the context management and tool coordination systems via the MCP protocol. The AI ​​analysis subject can dynamically allocate analysis tasks based on user needs and is responsible for summarizing and outputting the final analysis results. Its core capabilities include natural language understanding, MCP protocol invocation, analysis decision-making, and result output and feedback. The AI ​​analysis subject obtains intelligent reasoning capabilities through online or locally deployed LLMs. Module B: The MCP Pcap tool engine. Serving as the MCP Server, the MCP Pcap tool engine provides the AI ​​analysis subject with a Pcap tool gateway interface, interface 1, enabling standardized connections with MCP Pcap tools, including modules E1, E2, and E3. The engine also collaborates with context management and Pcap data sources to provide Pcap data to the MCP Pcap tools. Module C: context management; Context management is used to manage and maintain contextual information during the analysis process. This contextual information includes the history of each round of tool calls, the Pcap data fragments used, the input and output parameters of each tool, protocol identification results, the mapping relationship between IP addresses and domain names, port and service inference results, and user feedback. By aggregating and saving this information, Module C constructs a complete analysis context, providing comprehensive status data for the AI ​​analysis process. The context management module organizes and stores this information in a structured manner, supporting state synchronization between the AI ​​analysis subject and the MCP server. By continuously recording analysis history and accumulating intermediate state data, Module C ensures that the AI ​​analysis subject and the MCP server share consistent and up-to-date contextual information, thereby maintaining the consistency of contextual state throughout the system. Module D: Pcap data source; the Pcap data source provides raw data input for the system, supports multiple network data collection methods, supports flexible switching between real-time data streams and historical data, and provides efficient and stable Pcap data for the MCP Pcap tools including modules E1, E2, and E3, ensuring the data foundation for analysis tasks; Module E1, Module E2, and Module E3: Various MCP Pcap tools; each MCP Pcap tool acts as an MCP Server, performs specific Pcap analysis tasks, and returns analysis results; Interface 1: The Pcap tool gateway interface. This interface is implemented during the initialization phase through multiple registration and discovery mechanisms. It dynamically expands the toolset and exposes unified MCP Server capabilities, significantly improving system flexibility and maintainability. This unified service shields the heterogeneity of underlying tools and provides a consistent, scalable tool-calling experience for upper-level analysis processes. Interface 2: Pcap tool interface; the Pcap tool interface uses the MCP protocol and provides standard MCP Server capabilities to the MCP Pcap tool engine implementation; Interface 3: Data packet interface; The data packet interface is used to enable the MCP Pcap tool to obtain data packets. Interface 3 cooperates with the Pcap data source and is implemented using standard network transmission technology.

2. The network data intelligent tool system based on the Model Context Protocol (MCP) according to claim 1 is characterized in that: The effective maintenance of the context information enables the entire system to achieve contextual connection between multiple rounds of tasks, that is, to utilize the relevant information of the previous steps in the subsequent analysis steps; the context information provided by module C supports the dynamic optimization of the tool chain. By utilizing the context data, the system can select or adjust the tools for subsequent calls according to the current context status and determine the dependencies between tasks, thereby supporting the closed-loop execution of analysis tasks.

3. The network data intelligent tool system based on the Model Context Protocol (MCP) according to claim 1, characterized in that: The module C focuses on data preparation and organization and does not involve the specific AI reasoning process. Module C ensures that the AI ​​analysis subject can continuously perform reasoning and analysis by providing complete contextual data support.

4. The network data intelligent tool system based on the Model Context Protocol (MCP) according to claim 1, characterized in that: Each MCP Server exposes its analysis capabilities through a standardized interface, supporting on-demand expansion and hot plugging; the MCPPcap tool includes protocol parsing, network flow analysis, feature extraction, anomaly detection, data conversion, statistics and visualization capabilities.

5. A method for executing a network data intelligence tool system based on the Model Context Protocol (MCP), which is implemented using the network data intelligence tool system based on the Model Context Protocol (MCP) according to any one of claims 1 to 4, characterized in that: The steps include: Step 1: System initialization and tool registration: During the system initialization phase, the MCP Pcap tool engine aggregates the capabilities of all Pcap tools through a registration and discovery mechanism and provides them to the AI ​​analysis subject through the Pcap tool gateway interface, ensuring the flexibility and scalability of subsequent task scheduling. Step 2: Task Reception and Requirements Analysis: The AI ​​analysis agent is responsible for receiving user tasks, including requirements, context, and data packet information, and identifying analysis intent through natural language understanding technology. The AI ​​analysis subject calls the MCP Pcap tool engine through the Pcap tool gateway interface; Step 3: Tool coordination and data processing; The MCP Pcap tool engine selects the appropriate MCP Pcap tool based on the registration list to execute the specific Pcap tool and returns the tool results. Before that, the MCP Pcap tool engine also needs to call the Pcap data source based on the context management to provide the required data for the relevant tools. Step 4: Analysis, decision-making and result output: The AI ​​analysis subject makes analysis decisions based on the tool results returned by the MCP Pcap tool engine and obtains the task results; The MCP Host conducts comprehensive analysis and decision-making based on the tool results returned by the MCP Client, and ultimately outputs structured reports or alarm information; If the task is not completed, re-enter the task execution process based on the feedback information until the current analysis goal is achieved; Step 5: Task closure and feedback phase: The system feeds back the analysis results to the user and automatically determines whether further analysis is needed based on user feedback, thus completing the task closure. This method supports multi-round task decomposition and contextual reasoning. The AI ​​analysis subject dynamically adjusts the tool chain based on historical analysis results to achieve on-demand analysis and strategy optimization. The Pcap tool gateway interface plays a key role in task distribution, interface standardization, and capability aggregation in this process, ensuring the efficiency and consistency of the analysis process.

6. The method for executing a network data intelligence tool system based on the Model Context Protocol (MCP) according to claim 5, characterized in that: The system initialization and tool registration in step 1 are performed during the system initialization phase and include the following specific steps: Step 1.1: Discover available Pcap tools. The MCP Pcap tool engine proactively executes the available tool discovery process during system initialization to obtain the service address, capability description, and configuration metadata of each MCP Pcap tool, preparing for subsequent unified registration and invocation. This process includes two methods: Manual configuration: The user or system administrator presets tool-related information in the configuration file or startup parameters, including the tool's service address, MCP interface parameters, supported protocol types, and task descriptions. It is suitable for the initial deployment, test environment, or scenarios with high security requirements, and has the advantages of controllable configuration and clear debugging; Automatic scanning mode: During initialization or runtime, the tool engine automatically scans predefined network ports, service registries, configuration services, or broadcasts through the local area network to identify available MCP Pcap tools in the current environment. This mode is suitable for cloud-native or plug-in deployment environments, supports dynamic expansion and hot plugging, and improves system flexibility and adaptability. Step 1.2: Tool registry record; register all tool capabilities into a unified registry to form a tool list; Step 1.3: Unify capability statements; The MCP Pcap tool engine uses the Pcap tool gateway interface to provide unified MCP services for the AI ​​analysis subject, allowing the latter to clearly understand the available functions and their calling methods, ensuring that the AI ​​analysis subject can flexibly call all Pcap intelligent tools according to task requirements.

7. The method for executing a network data intelligence tool system based on the Model Context Protocol (MCP) according to claim 6, characterized in that: The typical fields corresponding to the tool list in step 1.2 include: tool_id: tool identifier, which is a unique identifier within the system; name: a concise name; description: a brief description of the tool function; methods: a list of supported method names and functions; each method should have an independent name, input and output descriptions, and function descriptions; input_schema: describes the input structure required for each method; output_schema: describes the output structure; capabilities: uses keywords to indicate tool functions; through structured registration information, ensure that the tool can be correctly identified and called by AI.

8. The method for executing a network data intelligence tool system based on the Model Context Protocol (MCP) according to claim 6, characterized in that: The capability declaration in step 1.3 adopts a standardized format, including: tool call path: declare the tool method hierarchy identifier; parameter definition: define required / optional parameters and their data type constraints, and list the parameters and types required for each method; input / output structure description: declare the input and output formats based on JSON Schema to ensure machine parsability; capability declaration format: adopts standardized JSON structure transmission, and the fields include name, description, parameters and output; protocol compatibility: follows the MCP unified description framework to achieve self-description and dynamic discovery of tool capabilities; through capability declaration, the AI ​​system can automatically discover, understand and correctly call various Pcap tools, with unified management and consistent interfaces, in compliance with the MCP protocol specification.

9. The method for executing a network data intelligence tool system based on the Model Context Protocol (MCP) according to claim 5, characterized in that: The task reception and requirement analysis in step 2 are performed during the task reception phase and include the following specific steps: Step 2.1: Task Reception: The system of the present invention receives the analysis requirements, context, and data packet information input by the user through the AI ​​analysis subject, and conducts new analysis or continuous analysis; specifically, it includes: Requirement description: analysis requirements entered by the user, including analysis objectives, data scope, and tool call statements; Context: historical analysis results, analysis strategies, and analysis knowledge; Data packets: Network data packets to be analyzed, using real-time data streams or historical data packets; Step 2.2: Requirements Understanding and Intent Identification: The AI ​​analysis agent uses natural language processing technology to analyze task requirements, identify analysis objectives and constraints, and generate preliminary analysis intent. Step 2.3: Intelligent scheduling and tool calling: According to the analysis intent, the AI ​​analysis subject intelligently schedules the appropriate Pcap tool, calls the MCP Pcap tool engine through the MCP protocol to initiate a tool call request, and enters the subsequent analysis process. The system calls the MCP Pcap tool engine through the MCP protocol to initiate a tool call request and enter the subsequent analysis process.

10. The method for executing a network data intelligence tool system based on the Model Context Protocol (MCP) according to claim 5, characterized in that: The tool coordination and data processing in step 3 are performed during the task reception phase and include the following specific steps: Step 3.1: Context requirement reception: The MCP Pcap tool engine receives the context requirements of the AI ​​analysis subject; the requirements are described by the MCP protocol of the Pcap tool gateway interface; Step 3.2: Call decision; The MCP Pcap tool engine enhances the requirements based on context management; at the same time, it determines whether to transfer data to the target MCP Pcap tool. If necessary, it enters the data transmission phase; otherwise, it directly enters the tool execution phase; Step 3.3: Data transmission; MCP Pcap selects the transmission method based on the data size: small-volume data is directly transmitted inline through the MCP protocol, and large-volume data is transmitted to the target MCP Pcap tool through the data transmission gateway service using a bypass channel; Step 3.4: Tool execution; The MCP Pcap tool engine uses the enhanced requirements to initiate specific analysis tasks to the target MCP Pcap tool through the Pcap tool interface; Step 3.5: Result return and context update; After the target MCP Pcap tool completes its analysis, it returns the analysis results to the MCP Pcap tool engine. The engine then writes the results of this round of tool execution and the data transmission record from step 3.3, including the data range, transmission mode, protocol type, and traffic direction, into the context management module to enrich the current context content. After the context update is completed, the MCP Pcap tool engine performs a new round of context enhancement based on the newly accumulated information, including integrating analysis outputs, supplementing analysis labels, and marking new context dependency paths to form a structured enhanced context result; Ultimately, the enhanced results are returned to the AI ​​analysis entity through the MCP protocol, providing complete and continuous contextual support for subsequent analysis and decision-making.

Images