ARINC739 protocol aviation bus data analysis method and system

Abstract

The invention relates to the technical field of bus protocol analysis and network monitoring, provides an ARINC739 protocol aviation bus data analysis method and system, and solves the problems of low accuracy and poor real-time performance of aviation bus network fault diagnosis. The method comprises the following steps: acquiring a protocol data stream of an aviation bus, node connection data of an aviation bus network and delay index data; performing graph embedding on the node connection data and the delay index data to obtain a topological feature matrix, and generating a modulation feature flow based on the topological feature matrix; aggregating the modulation feature flow by using a graph neural network to generate enhanced topological features; extracting a message header identification field from the protocol data stream, and performing hierarchical analysis on the message header identification field through dynamic template matching; and fusing the enhanced topological features and a hierarchical analysis result, performing anomaly detection on a fusion result, and identifying a link fault mode. According to the invention, the accuracy and real-time performance of aviation bus network fault diagnosis are improved.

Description

Technical Field

[0001] The present application relates to the technical field of bus communication protocol parsing and network health monitoring in avionics systems, and in particular to a method and system for parsing ARINC739 protocol aviation bus data. Background Art

[0002] Modern avionics systems rely on bus protocols to achieve efficient communication between onboard devices. They require real-time parsing of multiple types of data messages and monitoring of network status to ensure reliable transmission of flight control commands and stable system operation.

[0003] The current mainstream solution uses static parsing rules combined with an independent network monitoring module, matching protocol fields through a preset message format dictionary, and using independently collected network status indicators for offline fault analysis.

[0004] Static parsing rules are difficult to adapt to protocol expansion and dynamic message changes. Independent monitoring modules lead to insufficient data correlation. The overall solution has obvious bottlenecks in real-time and accuracy in complex aviation environments. Summary of the Invention

[0005] The present application provides an ARINC739 protocol aviation bus data analysis method and system to solve the problems of low accuracy and poor real-time performance of aviation bus network fault diagnosis in the prior art.

[0006] In a first aspect, the present application provides an ARINC 739 protocol aviation bus data parsing method, comprising: Collect the protocol data stream of the aviation bus, the node connection data and delay index data of the aviation bus network; Performing graph embedding processing on the node connection data and the delay index data to obtain a topological feature matrix, and generating a modulation feature flow based on the topological feature matrix; A graph neural network is used to aggregate the modulated feature stream to generate enhanced topological features; Extracting a message header identification field from the protocol data stream, and performing a hierarchical parsing operation on the message header identification field through dynamic template matching; The enhanced topology features are fused with the hierarchical analysis results, and anomaly detection processing is performed on the fusion results to identify link failure modes.

[0007] Optionally, performing a hierarchical parsing operation on the message header identification field through dynamic template matching includes: In the first layer, extracting the type identifier, length value and priority level from the common header area corresponding to the message header identifier field; Selecting a parsing template with the highest matching degree with the type identifier from a pre-stored parsing template library; According to the parsing template, a second layer and a third layer hierarchical parsing operation is performed on the message header identification field.

[0008] Optionally, performing layer 2 and layer 3 parsing operations on the message header identification field according to the parsing template includes: Parsing the encoded format data from the payload area adjacent to the common header area according to the priority level and in combination with the parsing template; In the third layer, the storage boundary of the variable-length data segment in the payload area is determined based on the length value and the encoding format data, and a boundary verification operation is performed based on the storage boundary to confirm the valid data range of the variable-length data segment according to the boundary verification result.

[0009] Optionally, parsing the encoded format data from the payload area adjacent to the common header area according to the priority level and in combination with the parsing template includes: Customizing and extending the parsing template according to the priority level to obtain an extended parsing template; Extracting a binary data stream from a payload area adjacent to the public header based on the expanded parsing template; Locating a format identifier in the binary data stream; According to the format identifier, a coded data block is intercepted from the binary data stream, and the coded data block is mapped according to a preset structure mapping rule to generate coded format data.

[0010] Optionally, fusing the enhanced topology features with the hierarchical analysis results and performing anomaly detection processing on the fusion results to identify link failure modes includes: Combining the enhanced topological features with a type identifier, a length value, and coordinate position data in the hierarchical parsing result to generate a fusion result, the coordinate position data being another data parsed from a payload region adjacent to the common header region; Performing a multi-dimensional scan on the fusion result, and locating the abnormal data location based on the inconsistencies in the scan result; Based on the distribution characteristics of the abnormal data positions, a link failure mode is output.

[0011] Optionally, performing graph embedding processing on the node connection data and the delay index data to obtain a topology feature matrix, and generating a modulation feature stream based on the topology feature matrix includes: Converting the node connection data into a connection relationship matrix, and mapping the delay index data into a delay matrix; Superimposing the connection relationship matrix and the delay matrix to generate a topological feature matrix; Performing modulation transformation processing on the topological characteristic matrix to obtain modulation characteristic parameters; Based on the modulation feature parameters, a modulation feature sequence is generated, and the modulation feature sequence is used as a modulation feature stream.

[0012] Optionally, the utilizing a graph neural network to aggregate the modulated feature stream to generate enhanced topological features includes: Extracting the wavelength characteristic value corresponding to each node from the modulation characteristic stream; Through multiple rounds of iterative aggregation operations of the graph neural network, the wavelength feature value of each node is aggregated with the wavelength feature values ​​of adjacent nodes, and the result of each round of aggregation is used as the updated wavelength feature value of the corresponding node; When the aggregation round reaches the preset round threshold, the updated wavelength feature values ​​of all nodes are output as enhanced topology features.

[0013] In a second aspect, the present application provides an ARINC 739 protocol aviation bus data parsing system, comprising: The acquisition module is used to collect the protocol data stream of the aviation bus, the node connection data of the aviation bus network, and the delay index data; A generating module, configured to perform graph embedding processing on the node connection data and the delay index data to obtain a topological feature matrix, and generate a modulation feature flow based on the topological feature matrix; an aggregation module, configured to aggregate the modulated feature stream using a graph neural network to generate enhanced topological features; An extraction module, configured to extract a message header identification field from the protocol data stream, and perform a hierarchical parsing operation on the message header identification field through dynamic template matching; The fusion module is used to fuse the enhanced topology features with the hierarchical analysis results, and perform anomaly detection processing on the fusion results to identify link failure modes.

[0014] In a third aspect, the present application provides a computing device comprising a processor and a memory, wherein the memory stores a computer program, and the processor is configured to run the computer program to execute an ARINC739 protocol aviation bus data parsing method as described in any one of the first aspects.

[0015] In a fourth aspect, the present application provides a computer storage medium having computer program instructions stored thereon, wherein the computer program instructions, when executed by a processor, implement an ARINC739 protocol aviation bus data parsing method as described in any one of the first aspects.

[0016] In the present application, a method for parsing ARINC739 protocol aviation bus data is provided, which includes: collecting the protocol data stream of the aviation bus, the node connection data and the delay index data of the aviation bus network; performing graph embedding processing on the node connection data and the delay index data to obtain a topological feature matrix, and generating a modulation feature stream based on the topological feature matrix; using a graph neural network to aggregate the modulation feature stream to generate enhanced topological features; extracting a message header identification field from the protocol data stream, and performing a hierarchical parsing operation on the message header identification field through dynamic template matching; fusing the enhanced topological features with the hierarchical parsing results, and performing anomaly detection processing on the fusion results to identify link failure modes.

[0017] The technical solution provided by this application has the following beneficial effects: This application collects protocol data streams and network data to achieve comprehensive perception of the communication status and network topology of the avionics system; graph embedding processing and modulation feature stream generation convert network topology relationships into processable feature representations; graph neural aggregation enhances the expressiveness of topological features and improves the accuracy of network status representation; dynamic template matching and hierarchical parsing achieve accurate recognition and structured extraction of multiple types of messages; feature fusion and anomaly detection establish correlation analysis between protocol data and network status, improving fault identification capabilities.

[0018] Furthermore, the present application also implements a three-layer parsing operation on the message header identification field by dynamically matching the parsing templates in the pre-stored template library, extracting the common header metadata, payload content and variable-length field information in sequence to achieve complete parsing of the ARINC739 protocol message.

[0019] Moreover, this method breaks through the limitations of fixed template parsing and can adaptively process various standard and private messages, improving the accuracy and adaptability of protocol parsing in complex avionics environments.

[0020] These and other aspects of the present application will become more readily apparent from the description of the following embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0022] Figure 1 A flowchart of a method for parsing ARINC 739 protocol aviation bus data provided in an embodiment of the present application; Figure 2 A schematic diagram of the structure of an ARINC 739 protocol aviation bus data parsing system provided in an embodiment of the present application; Figure 3 A schematic diagram of the structure of a computing device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0023] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.

[0024] In some of the processes described in the specification and claims of this application and the above-mentioned figures, multiple operations that appear in a specific order are included, but it should be clearly understood that these operations may not be executed in the order in which they appear in this document or may be executed in parallel. The serial numbers of the operations, such as 101, 102, etc., are only used to distinguish between different operations, and the serial numbers themselves do not represent any order of execution. In addition, these processes may include more or fewer operations, and these operations may be executed in sequence or in parallel. It should be noted that the descriptions of "first", "second", etc. in this document are used to distinguish different messages, devices, modules, etc., and do not represent a sequential order, nor do they limit "first" and "second" to being different types.

[0025] Existing avionics bus data parsing solutions utilize a combination of static parsing rules and independent network monitoring modules, which presents limitations. Static parsing rules rely on a pre-set message format dictionary, making it difficult to adapt to protocol extensions and dynamic changes in vendor-specific fields. This results in a sharp decline in message recognition efficiency as protocol complexity increases. Furthermore, the separation of network status monitoring and protocol parsing results in a lack of data relevance, making it difficult to accurately locate the root cause of link failures in a timely manner, given the high real-time requirements of avionics systems. This drawback stems from the traditional solution's separation of protocol dynamics from network topology awareness, making it unable to meet the stringent requirements of modern avionics systems for communication reliability and state observability.

[0026] In response to the above problems, this application proposes a method for parsing ARINC739 protocol aviation bus data. Its innovation lies in the deep coupling of network topology features with the protocol parsing process. The topology feature matrix and modulation feature stream generated in real time through graph embedding processing dynamically reflect the network connection status; at the same time, a hierarchical parsing mechanism is adopted, combined with dynamic template matching to adaptively process various message structures. This method achieves the spatiotemporal alignment of protocol data and network status by enhancing the collaborative analysis of topology features and parsing results. It not only solves the problem of insufficient adaptability of static parsing rules to protocol changes, but also overcomes the data association deficiency of independent monitoring modules, enabling the system to accurately identify link failure modes and maintain high real-time performance, thereby improving the reliability of aviation bus communication and the accuracy of fault diagnosis.

[0027] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without making creative efforts are within the scope of protection of this application.

[0028] Figure 1 A flowchart of a method for parsing ARINC739 protocol aviation bus data provided in an embodiment of the present application is shown in FIG. Figure 1 As shown, the method includes: Step 101: Collect the protocol data stream of the aviation bus, the node connection data of the aviation bus network, and the delay index data.

[0029] In step 101, the avionics bus refers to the communication channel (physical layer transmission medium) used to transmit ARINC 739 protocol data between electronic devices within an aircraft. The avionics bus network is a complete communication system (including topology and transmission metrics) consisting of multiple avionics buses and their connected node devices. The relationship between the two is as follows: the avionics bus is the network's transmission medium, and the network is the logical collection of buses and their connected devices. The protocol data stream refers to the raw data sequence transmitted by the ARINC 739 bus, including message headers, payloads, and checksum information. Node connection data describes the physical connections between devices (such as flight management computers and display terminals) in the avionics bus network, indicating which devices communicate directly. Latency metrics reflect the time delay in data transmission between nodes in the network and are used to assess communication efficiency.

[0030] In this embodiment of the present application, a bus monitoring device is used to capture protocol data streams in real time. It also collects the connection status of each device in the network (e.g., whether device A and device B are directly connected) and the communication delay between them (e.g., the time it takes for data to be transmitted from device A to device B). This data forms the basis for subsequent analysis and fault diagnosis.

[0031] For example, in an avionics system, a bus monitoring device continuously records protocol data streams, detects the connection relationships between devices A, B, and C (e.g., AB, BC), and measures the delay from A to B to a certain value (calculated from the actual communication time). This data is used for subsequent topology analysis and protocol parsing.

[0032] Step 102: Perform graph embedding processing on the node connection data and the delay index data to obtain a topology feature matrix, and generate a modulation feature stream based on the topology feature matrix.

[0033] In step 102, graph embedding involves converting the network topology (nodes and connections) into a mathematical matrix representation for computation and analysis. The topology feature matrix represents a numerical matrix in which rows and columns represent devices in the network, and the matrix elements represent the connection strength or latency impact between devices. The modulation feature stream converts the topology feature matrix into analog optical signal data that can be used for subsequent neural network processing.

[0034] In an embodiment of the present application, first, the node connection data is converted into an adjacency matrix, where a matrix element of 1 indicates a direct connection between devices and a 0 indicates no connection. Then, the delay index data is mapped into a weight matrix. The higher the delay, the larger the corresponding matrix element value. Next, the adjacency matrix and the weight matrix are superimposed to generate a topological feature matrix. Finally, the matrix is ​​converted into a modulated feature stream through optical signal modulation technology for subsequent graph neural network processing.

[0035] For example, in an avionics network, the connections between devices A, B, and C form an adjacency matrix. Device A and B have higher latency, so the corresponding element in the weight matrix has a larger value. This is then superimposed to create a topological feature matrix, which is then converted into a modulation feature stream using optical modulation technology for use in subsequent steps.

[0036] Step 103: Utilize a graph neural network to aggregate the modulated feature stream to generate enhanced topological features.

[0037] In step 103, a graph neural network (GNN) is a deep learning model that can process graph-structured data and is used to extract deep features of the network topology. The enhanced topological features represent the topological representation optimized by the neural network, which can more accurately reflect the network status.

[0038] In this embodiment, the modulated feature stream is fed into a graph neural network, which, through multiple layers of computation, gradually aggregates the feature information of adjacent nodes. For example, the features of device A are updated by combining the features of devices B and C, ultimately outputting enhanced topological features that more comprehensively describe the health of the network.

[0039] For example, in an avionics system, after processing the modulated feature stream using a graph neural network, it discovered that the communication characteristics of device B were abnormal, potentially indicating a potential fault. The enhanced topological features were then used for subsequent fault diagnosis.

[0040] Step 104: extracting a message header identification field from the protocol data stream, and performing a hierarchical parsing operation on the message header identification field through dynamic template matching.

[0041] In step 104, the message header identification field indicates the beginning of the protocol data stream and contains information such as message type and length. Dynamic template matching dynamically selects parsing rules based on message type to improve adaptability. Layered parsing extracts different parts of the message, such as the header and payload, in stages.

[0042] In this embodiment, the header identification field is first extracted from the beginning of the protocol data stream to determine the message type. A matching parsing template is then selected from a pre-stored template library based on the type. Next, the parsing process is performed layer by layer according to the template: the first layer extracts common header information (e.g., type, length), the second layer parses the payload (e.g., coordinate data), and the third layer processes variable-length fields (e.g., dynamic data blocks).

[0043] For example, when parsing an ARINC739 message, after dynamically matching the template, the type identifier (such as display instructions) and coordinate data (such as screen position) are extracted in sequence, and finally the variable-length field (such as dynamic text content) is parsed.

[0044] Step 105: Fuse the enhanced topology features with the hierarchical analysis results, and perform anomaly detection processing on the fusion results to identify link failure modes.

[0045] In step 105, the fusion results represent the integration of network topology features with protocol parsing data to form comprehensive analysis data. Anomaly detection processing involves using algorithms to identify abnormal patterns in the data, such as communication interruptions or data errors. Link failure modes refer to communication failure types in the aviation bus network caused by physical connection anomalies or protocol parsing errors. These include four typical failure states: link interruption (complete inability to communicate between nodes), packet loss (partial message loss), latency anomaly (transmission time exceeds a threshold), and data corruption (parsing results do not match expectations). These failure modes are determined based on the fusion analysis results of the enhanced topology features and the hierarchical parsing results.

[0046] In this embodiment, enhanced topology features (such as device B's communication anomaly) are combined with layered analysis results (such as a message length anomaly) to analyze data consistency using an anomaly detection algorithm. For example, if a device has high communication latency and its sent message fails verification, it is determined to be a link failure.

[0047] For example, in a certain avionics system, fusion analysis found that the delay of device B increased and its message verification was incorrect. The system determined that the connection of device B was faulty and triggered an alarm.

[0048] This method achieves efficient analysis of ARINC 739 bus data and precise fault location by collecting protocol data and network status in real time, combined with graph embedding and dynamic parsing techniques. Compared to traditional solutions, this method can adapt to protocol changes and simultaneously correlate network topology with protocol data, improving the reliability of avionics system communications and fault diagnosis capabilities.

[0049] In order to solve the adaptability problem of ARINC739 protocol message parsing, in some embodiments, step 104: performing a hierarchical parsing operation on the message header identification field through dynamic template matching includes: Step 201: In the first layer, extract the type identifier, length value and priority level from the common header area corresponding to the message header identifier field.

[0050] In step 201, the common header area refers to the fixed-format data segment at the beginning of the message. It contains a type identifier (a code that identifies the message's purpose), a length value (indicating the total length of the message), and a priority level (determining the processing order). The type identifier is used to match the parsing template. The length value is used for subsequent variable-length field processing. The priority level affects the parsing order.

[0051] In the embodiment of the present application, fixed byte data is read from the starting position of the message header identification field, and three key parameters, namely type identification, length value and priority level, are separated according to the predefined common header structure. These parameters serve as the basic control information for subsequent analysis.

[0052] Step 202: Selecting a parsing template with the highest matching degree with the type identifier from a pre-stored parsing template library.

[0053] In step 202, the parsing template library is a pre-stored set of multiple message format rules, each template containing parsing rules for a specific type of message. The highest matching degree means that the similarity between the type identifier of the template and the message type identifier is the best.

[0054] In the embodiment of the present application, the extracted type identifier is compared with the type identifiers of all templates in the template library, and the template with the smallest matching error is selected as the current parsing template. The matching process takes into account the binary bit matching degree of the type identifier.

[0055] Step 203: Perform layer 2 and layer 3 parsing operations on the message header identification field according to the parsing template.

[0056] In step 203, the second level of parsing refers to extracting payload data according to template rules, and the third level of parsing refers to processing additional data segments of variable length. The second level of parsing relies on the field position information defined by the template, and the third level of parsing relies on the length value extracted by the first level.

[0057] In this embodiment, according to the rules of the selected template, the coordinate data and encoded data in the payload are first extracted from the specified location of the message; then, the boundary position of the variable-length data segment is calculated based on the length value to extract the dynamic content data. The two layers of parsing are performed in sequence to ensure complete data extraction.

[0058] Here's a specific example: In a specific avionics system, a bus monitoring device captures a protocol data stream sent by device B. It first extracts the common header area from the beginning of the data and identifies a type identifier of a flight parameter update instruction, a length of 180 bytes, and an urgent priority level. The system compares this type identifier with multiple instruction templates in a pre-stored template library and finds the highest match with the flight parameter template, selecting it for subsequent parsing. Following the rules defined by the template, the system first extracts fixed-format parameters such as flight altitude and speed from a specified location in the data. Then, based on the length value extracted from the header, it parses the subsequent dynamic parameter group, including real-time updated environmental monitoring data, starting at byte 60.

[0059] In the embodiment of the present application, the layered parsing method can adapt to the changes in the private message formats of different manufacturers through dynamic matching and sequential extraction, while ensuring the parsing efficiency of standard messages, thereby improving the accuracy and reliability of protocol parsing in complex avionics environments.

[0060] In order to improve the accuracy and reliability of ARINC 739 protocol message parsing, in some embodiments, step 203: performing layer 2 and layer 3 parsing operations on the message header identification field according to the parsing template includes: Step 301: According to the priority level and in combination with the parsing template, parse the encoded format data from the payload area adjacent to the public header area.

[0061] In step 301, the payload area immediately adjacent to the common header refers to the data segment in the ARINC 739 protocol data stream that follows the common header and stores the actual transmitted content. Its starting position is directly determined by the length field in the common header and is specifically derived from the continuous data storage area following the header identification field in the protocol data stream. The encoding format data refers to the control information in the payload area that describes the data organization, including data type, arrangement order, and special flags.

[0062] In this embodiment, the system first determines the processing order of the current message based on its priority level. Then, according to the rules defined by the parsing template, it reads and identifies the encoding format descriptor byte by byte from the data area following the common header. Based on the descriptor content, it determines the subsequent data arrangement and special processing requirements, completing the extraction of the encoding format data.

[0063] Step 302: In the third layer, the storage boundary of the variable-length data segment in the payload area is determined based on the length value and the encoding format data, and a boundary verification operation is performed based on the storage boundary to confirm the valid data range of the variable-length data segment according to the boundary verification result.

[0064] In step 302, a variable-length data segment refers to a data region of variable length within the protocol data stream. Its range is defined by the "length value" extracted at the first layer and is derived from the variable-length content immediately following the encoded format data in the protocol data stream. Storage boundaries refer to the start and end positions of a variable-length data segment within a message. Boundary verification checks the relationship between the data segment length and the total message length to confirm the validity of the data range. The valid data range refers to the data interval that has been verified to be safe for use.

[0065] In this embodiment of the present application, the system uses the length values ​​extracted in the first layer and the encoding format data obtained in this step to calculate the theoretical boundary positions of the variable-length data segments. The correctness of the boundary positions is then verified by comparing the actual message length with the calculated values. If the verification passes, the final valid data range is determined; otherwise, the segment is marked as an abnormal data segment.

[0066] Here's a specific example: In a specific avionics system, a bus monitoring device captured an emergency flight parameter update command message from device B. The message was 180 bytes long. The system first extracted the common header information from the beginning of the message, identifying the type as a flight parameter command and the highest priority. After matching the results of a pre-stored template library, the system selected a dedicated flight parameter parsing template and immediately prioritized the message. Following the template's defined rules, the system parsed the payload area starting at byte 20 after the common header. It first identified the encoding format descriptor and confirmed that the data was arranged in a "fixed first, then dynamic" structure. The fixed portion, containing key parameters such as flight altitude and speed, occupied 40 bytes. Based on the extracted 180-byte header length and the encoding format information, the system calculated that the variable-length data segment theoretically started at byte 60 and ended at byte 180. During boundary verification, the system discovered that the actual message ended at byte 175, a 5-byte discrepancy from the theoretical calculation. Verification confirmed that the last 5 bytes were anomalous, and the valid data range was determined to be between bytes 60 and 175.

[0067] In the embodiment of the present application, the hierarchical parsing method ensures timely processing of key data and effectively identifies abnormal data segments through priority scheduling and boundary verification mechanisms, thereby improving the security of protocol parsing and data reliability.

[0068] To improve the flexibility and accuracy of ARINC 739 protocol message parsing, in some embodiments, step 301: parsing the encoded format data from the payload area adjacent to the common header area based on the priority level and in combination with the parsing template includes: Step 401: Customize and extend the parsing template according to the priority level to obtain an extended parsing template.

[0069] In step 401, custom extension refers to the process of adaptively adjusting the parsing template according to the priority level. The extended parsing template includes basic parsing rules and newly added extended rules.

[0070] In this embodiment, the system first reads the message's priority level. If a high priority level is identified, the system adds extended rules, such as data parity check, to the basic parsing template. For messages with a normal priority level, the basic template remains unchanged. This extension process ensures that important messages receive more rigorous parsing.

[0071] Step 402: Based on the expanded parsing template, extract the binary data stream from the payload area adjacent to the public header.

[0072] In step 402, the binary data stream refers to the original data sequence of the payload area.

[0073] In the embodiment of the present application, binary data is sequentially read from the data area after the common header according to the starting offset and read length defined by the extended template. The reading process strictly follows the byte order and bit width requirements specified by the template.

[0074] Step 403: Locate the format identifier in the binary data stream.

[0075] In step 403, the format identifier is a special mark in the binary data stream that identifies the encoding format and is usually located at the beginning of the data. The positioning process requires matching a predefined identifier feature pattern.

[0076] In the embodiment of the present application, the system starts scanning from the starting position of the binary data stream, compares the data with multiple pre-stored format identifier features, and confirms the format identifier position when a specific feature pattern is matched.

[0077] Step 404: According to the format identifier, a coded data block is intercepted from the binary data stream, and the coded data block is mapped according to a preset structure mapping rule to generate coded format data.

[0078] In step 404, the coded data block is a binary data segment containing complete coding format information. The preset structure mapping rule defines how to convert the binary data into a usable coding format description.

[0079] In the embodiment of the present application, starting from the located format identifier, the coded data block is intercepted according to the length indicated by the identifier, and then the binary data is mapped into coded format data containing information such as data type and arrangement order according to preset rules.

[0080] Here's a specific example: In a specific avionics system, a bus monitoring device captured an emergency flight parameter update message from device B. The message was 180 bytes long and marked as the highest priority. The system first extended the standard flight parameter parsing template based on priority levels, adding a double-check mechanism and a fast parsing channel to form a dedicated extended template. Following the rules defined in the extended template, the system extracted a 150-byte binary data stream starting at the 20th byte after the common header. This length was determined by the maximum read range specified in the template. At the beginning of the data stream, the system identified the 4-byte format identifier Flight Parameter Specific Tag through feature matching. This tag contains a specific binary combination. Based on the format information indicated by the tag, the system extracted a 16-byte coded data block starting at the 24th byte. The length of this block is determined by the value of the format length field following the tag. Following the flight parameter-specific structure mapping rules, the coded data block was converted into a complete format description, including the data arrangement (fixed parameters first, dynamic parameters last), and the byte length of each field.

[0081] In the embodiment of the present application, the encoding format parsing method ensures the reliable parsing of key messages and accurately identifies various data formats through priority-driven template expansion and strict format identification process, thereby improving the adaptability of protocol parsing and data extraction accuracy.

[0082] To improve the comprehensiveness and accuracy of aviation bus network fault diagnosis, in some embodiments, step 105: fusing the enhanced topology features with the hierarchical analysis results and performing anomaly detection processing on the fusion results to identify link failure modes, includes: Step 501: Combine the enhanced topological features with the type identifier, length value and coordinate position data in the hierarchical parsing result to generate a fusion result. The coordinate position data is another data parsed from the payload area adjacent to the common header area.

[0083] In step 501, the purpose of the coordinate position data is described as follows: in an avionics scenario, the coordinate position data is used for display terminal rendering (such as a flight instrument interface).

[0084] In an embodiment of the present application, the system combines the parameters such as message type, data length and display coordinates obtained through analysis with the network connection status data obtained through topology analysis to form a multi-dimensional data set containing protocol characteristics and network status, providing complete input for subsequent anomaly analysis.

[0085] Step 502: Perform a multi-dimensional scan on the fusion result, and locate the abnormal data position based on the inconsistent items in the scan result.

[0086] In step 502, multi-dimensional scanning is a process that checks the correlation of various parameters in the fused data. Inconsistencies in the scan results are identified by comparing the consistency of three sets of correlations: the mapping relationship between the physical connection status and the protocol length value in the fusion results, the path accessibility of the coordinate location data in the network status data, and the matching of the type identifier and the physical connection path. Inconsistencies are identified as contradictory parameter combinations. Inconsistencies refer to abnormal combinations that are inconsistent or outside the normal range. The abnormal data location is the specific location of the detected problematic data in the message or network topology.

[0087] In this embodiment of the application, the system first checks the compatibility of the message length with the network transmission capacity, then verifies the rationality of the displayed coordinates and the actual location of the terminal, and finally verifies the suitability of the message type and communication path. If any discrepancies are found between the parameters, the specific location and type of the abnormal data are recorded.

[0088] Step 503: Output a link failure mode based on the distribution characteristics of the abnormal data locations.

[0089] In step 503, the distribution characteristics of the abnormal data locations represent the spatial distribution patterns of all abnormal data locations marked as inconsistent in the aviation bus network topology, including but not limited to spatial correlation characteristics such as abnormal points being concentrated in a specific physical path, showing a periodic distribution, or being associated with a specific node.

[0090] In this embodiment, the system collects the location information of each anomaly point and analyzes its distribution characteristics in the network connection diagram. When the anomaly is concentrated in a certain physical link, it is determined to be a link outage. When the anomaly is scattered across the same field of different messages, it is determined to be data corruption. Ultimately, the system outputs a specific fault mode diagnosis result.

[0091] Here's a specific example: In a specific avionics system, a bus monitoring device continuously monitored the communication status between devices A, B, and C and detected an anomaly in a display command message sent by device B. The system first combined device B's enhanced topology features (indicating increased communication delay with device C) with the hierarchical parsing results of the message (including a type identifier of display command, a length of 200 bytes, and coordinate location data in the upper right area of ​​the screen) to generate a fusion result. During a multi-dimensional scan, the system discovered three key inconsistencies: the message length did not match device B's current communication capabilities (normally, device B should send shorter messages when latency increases); the coordinate location data did not match the valid display area of ​​device C's display terminal (the upper right area of ​​the screen was corrupted); and the message type conflicted with device B's role permissions (device B should not directly send display commands). Analysis of the locations of these anomalies revealed that they were concentrated on the communication link from device B to device C, coinciding with the location of the communication delay anomaly indicated by the topology features. Based on this distribution feature, the system determines that the link from device B to device C has a dual fault of data tampering and transmission delay. It immediately triggers an alarm and marks the link as unavailable, while automatically switching to the backup communication path.

[0092] In the embodiment of the present application, the fault diagnosis method realizes the coordinated detection of network status and protocol data through multi-source data fusion and correlation analysis, can accurately identify the root causes of various link failures, and improves the accuracy and response speed of avionics system fault location.

[0093] To improve the accuracy and usability of topological feature extraction of aviation bus networks, in some embodiments, step 102: performing graph embedding processing on the node connection data and the delay index data to obtain a topological feature matrix, and generating a modulation feature stream based on the topological feature matrix, includes: Step 601: Convert the node connection data into a connection relationship matrix, and map the delay index data into a delay matrix.

[0094] In step 601, the connection relationship matrix is ​​a square matrix that describes the physical connection status between devices. A matrix element of 1 indicates a direct connection between the two devices, while a matrix element of 0 indicates no connection. The delay matrix is ​​a square matrix that reflects the degree of communication delay between devices. Higher delays correspond to larger matrix element values. The rows and columns of the two matrices correspond to the same device nodes.

[0095] In this embodiment, the system first constructs a device list and assigns each device to a matrix row and column number in a fixed order. For connection data, directly connected device pairs are marked as 1 in the matrix, and otherwise as 0. For delay data, measured delay values ​​are proportionally mapped to matrix element values ​​to form a delay matrix.

[0096] Step 602: superimpose the connection relationship matrix and the delay matrix to generate a topology feature matrix.

[0097] In this embodiment, the system adds the connection matrix and the delay matrix with equal weights to generate a new composite matrix. The delay matrix is ​​normalized before addition to ensure that the two types of data are of the same magnitude. The superimposed matrix simultaneously reflects the device connection status and communication delay.

[0098] Step 603: performing modulation transformation processing on the topological characteristic matrix to obtain modulation characteristic parameters.

[0099] In step 603, modulation conversion is the process of converting matrix data into characteristic parameters suitable for optical signal transmission. Modulation characteristic parameters include optical signal characteristic values ​​such as wavelength and amplitude.

[0100] In the embodiment of the present application, the system performs eigenvalue decomposition on the topological characteristic matrix to extract the main eigenvectors. The eigenvectors are then converted into corresponding optical wavelength and amplitude parameters, which can fully characterize the characteristic information of the original matrix.

[0101] Step 604: Generate a modulation feature sequence based on the modulation feature parameters, and use the modulation feature sequence as a modulation feature stream.

[0102] In step 604, the modulation feature sequence is a set of modulation feature parameters arranged in time sequence.

[0103] In the embodiment of the present application, the system arranges and combines the modulation characteristic parameters of each device according to the time sequence of device communication to form a continuous characteristic sequence. This sequence generates an analog optical signal through digital-to-analog conversion and is output as a modulation characteristic stream.

[0104] Here's a specific example: In a specific avionics system, a bus monitoring device continuously monitors the communication status between devices A, B, and C. It first converts the detected physical connections into a connection matrix, where connections between devices A and B and between devices B and C are marked as 1 in the corresponding matrix positions, and all other positions are marked as 0. Simultaneously, the measured communication delay data is converted into a delay matrix. Where the delay from device A to B is high, the corresponding matrix element values ​​are set to larger values ​​proportional to the delay time. Where the delay from device B to C is normal, the corresponding values ​​are set to smaller values. The system then superimposes the two matrices with equal weights to generate a topological feature matrix that comprehensively reflects the connection status and communication quality. Feature analysis of this matrix extracts three key characteristic parameters, with the eigenvalue corresponding to device B being significantly abnormal. The system then converts these characteristic parameters into optical signal wavelength and amplitude data. The abnormal eigenvalue for device B corresponds to an optical signal with a specific wavelength. Finally, a modulation feature stream containing the three device characteristic parameters is generated. The abnormal wavelength characteristic of device B is subsequently identified as a potential fault node during graph neural network processing.

[0105] In the embodiment of the present application, the topological feature processing method converts complex network status information into efficient feature representation through matrix fusion and optical signal modulation, providing an accurate and easy-to-process data basis for subsequent fault diagnosis, and improving the real-time and reliability of avionics system status monitoring.

[0106] In order to improve the representation capability of aviation bus network topology features, in some embodiments, step 103: aggregating the modulated feature stream using a graph neural network to generate enhanced topology features includes: Step 701: extracting the wavelength characteristic value corresponding to each node from the modulation characteristic stream.

[0107] In step 701, wavelength characteristic values ​​are optical signal parameters extracted from the modulation characteristic stream that reflect the communication status of the node. Different wavelengths correspond to different network connection qualities. A node refers to a specific device in the avionics network, such as a flight management computer.

[0108] In an embodiment of the present application, the system first parses the optical signal sequence in the modulated feature stream, extracts the characteristic wavelength value corresponding to each device from the wavelength distribution of the optical signal according to a preset device node order, and forms an initial node feature set.

[0109] Step 702: Through multiple rounds of iterative aggregation operations of the graph neural network, the wavelength feature value of each node is aggregated with the wavelength feature values ​​of adjacent nodes, and the result after each round of aggregation is used as the updated wavelength feature value of the corresponding node.

[0110] In step 702, multiple rounds of iterative aggregation are performed to continuously update node features through the graph neural network. Adjacent nodes are device nodes that are directly connected in the connection matrix. The updated wavelength feature value contains comprehensive information about the node itself and its neighboring nodes.

[0111] In this embodiment of the present application, after the system initializes the graph neural network, in each round of aggregation, it first determines the neighbor set of each node. Then, it performs a weighted fusion of the node's own wavelength eigenvalue with the eigenvalues ​​of all its neighboring nodes to generate a new eigenvalue. This process is repeated, allowing the node features to gradually include a wider range of network information.

[0112] Step 703: When the aggregation round reaches a preset round threshold, the updated wavelength feature values ​​of all nodes are output as enhanced topology features.

[0113] In step 703, the preset round threshold is a preset number of aggregation iterations, and the calculation is stopped after reaching this number.

[0114] In an embodiment of the present application, the system sets fixed aggregation rounds. After all rounds are completed, the final feature values ​​of each node are sorted and output according to the device number to form an enhanced topological feature description, which can simultaneously reflect local connections and global network status.

[0115] Here's a specific example: In a specific avionics system, after a bus monitoring device acquires the modulation signature streams of devices A, B, and C, it first parses the optical signal sequence to determine the characteristic wavelength values ​​corresponding to the three devices. Device A's characteristic wavelength is standard, device B's is significantly deviated, and device C's is within the normal range. The system then initiates feature aggregation using a graph neural network. In the first round of processing, the characteristic wavelength of device B is weighted and fused with the characteristic wavelength of device A, to which it is directly connected, to generate the first updated signature for device B. In the second round of processing, the updated signature of device B is fused with the signature of device C. After multiple rounds of iteration, the final output signature of device B retains its original abnormal signature while incorporating information about the influence of neighboring devices A and C. Furthermore, the signatures of devices A and C also incorporate the influence of device B's abnormal signature due to the aggregation process. After a preset five rounds of aggregation, the system outputs the final signature values ​​of the three devices as an enhanced topological signature. Device B's signature is the most abnormal, reflecting not only its own problem but also the extent of its impact on the entire network.

[0116] In an embodiment of the present application, the feature enhancement method uses iterative aggregation of graph neural networks to ensure that the features of each node contain information about its network neighbors. The generated enhanced topological features can more comprehensively and accurately reflect the true state of the avionics network, providing a more reliable basis for fault diagnosis.

[0117] Figure 2 A schematic diagram of the structure of an ARINC739 protocol aviation bus data analysis system provided in an embodiment of the present application is shown as follows: Figure 2 As shown, the system includes: The acquisition module 21 is used to acquire the protocol data stream of the aviation bus, the node connection data of the aviation bus network, and the delay index data.

[0118] The generating module 22 is configured to perform graph embedding processing on the node connection data and the delay index data to obtain a topology feature matrix, and generate a modulation feature flow based on the topology feature matrix.

[0119] The aggregation module 23 is used to aggregate the modulated feature flow using a graph neural network to generate enhanced topological features.

[0120] The extraction module 24 is configured to extract a message header identification field from the protocol data stream and perform a hierarchical parsing operation on the message header identification field through dynamic template matching.

[0121] The fusion module 25 is configured to fuse the enhanced topology features with the hierarchical analysis results, and perform anomaly detection processing on the fusion results to identify link failure modes.

[0122] Figure 2 The ARINC739 protocol aviation bus data analysis system can execute Figure 1 The implementation principle and technical effects of the ARINC 739 protocol aviation bus data parsing method described in the illustrated embodiment are not further elaborated. The specific manner in which each module and unit performs operations in the ARINC 739 protocol aviation bus data parsing system in the above embodiment has been described in detail in the embodiment of the method and will not be further elaborated here.

[0123] In one possible design, Figure 2 An ARINC739 protocol aviation bus data analysis system of the embodiment shown can be implemented as a computing device, such as Figure 3 As shown, the computing device may include a storage component 31 and a processing component 32; The storage component 31 stores one or more computer instructions, wherein the one or more computer instructions are called and executed by the processing component 32 .

[0124] The processing component 32 is used to perform the above Figure 1 The embodiment provides an ARINC739 protocol aviation bus data parsing method.

[0125] The processing component 32 may include one or more processors to execute computer instructions to complete all or part of the steps in the above method. Of course, the processing component may also be implemented as one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to perform the above method.

[0126] The storage component 31 is configured to store various types of data to support operations on the terminal. The storage component can be implemented by any type of volatile or non-volatile memory device, or a combination thereof, such as static random-access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk, or optical disk.

[0127] Of course, a computing device may also include other components, such as input / output interfaces, display components, communication components, etc.

[0128] The input / output interface provides an interface between the processing component and the peripheral interface module, which can be an output device, an input device, etc.

[0129] The communication component is configured to facilitate, among other things, wired or wireless communications between the computing device and other devices.

[0130] Among them, the computing device can be a physical device or an elastic computing host provided by a cloud computing platform, etc. In this case, the computing device can refer to a cloud server, and the above-mentioned processing components, storage components, etc. can be basic server resources rented or purchased from the cloud computing platform.

[0131] The present application also provides a computer storage medium storing a computer program, wherein the computer program can achieve the above-mentioned Figure 1 The embodiment shown is a method for parsing ARINC739 protocol aviation bus data.

[0132] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0133] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e., they may be located in one location or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of the present embodiment. Persons of ordinary skill in the art will be able to understand and implement the present invention without inventive effort.

[0134] Through the above description of the embodiments, those skilled in the art will clearly understand that each embodiment can be implemented using software plus a necessary general-purpose hardware platform, or of course, hardware. Based on this understanding, the essence of the above technical solution, or the portion that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, or an optical disk, and includes a number of instructions for causing a computer device (such as a personal computer, server, or network device) to execute the methods described in each embodiment or certain portions of the embodiments.

[0135] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for analyzing ARINC739 protocol aviation bus data, characterized in that: include: Collect the protocol data stream of the aviation bus, the node connection data and delay index data of the aviation bus network; Performing graph embedding processing on the node connection data and the delay index data to obtain a topological feature matrix, and generating a modulation feature flow based on the topological feature matrix; A graph neural network is used to aggregate the modulated feature stream to generate enhanced topological features; Extracting a message header identification field from the protocol data stream, and performing a hierarchical parsing operation on the message header identification field through dynamic template matching; The enhanced topology features are fused with the hierarchical analysis results, and anomaly detection processing is performed on the fusion results to identify link failure modes.

2. The ARINC739 protocol aviation bus data analysis method according to claim 1, characterized in that: The hierarchical parsing operation of the message header identification field by dynamic template matching includes: In the first layer, extracting the type identifier, length value and priority level from the common header area corresponding to the message header identifier field; Selecting a parsing template with the highest matching degree with the type identifier from a pre-stored parsing template library; According to the parsing template, a second layer and a third layer hierarchical parsing operation is performed on the message header identification field.

3. The ARINC739 protocol aviation bus data analysis method according to claim 2, characterized in that: The performing layer 2 and layer 3 parsing operations on the message header identification field according to the parsing template includes: Parsing the encoded format data from the payload area adjacent to the common header area according to the priority level and in combination with the parsing template; In the third layer, the storage boundary of the variable-length data segment in the payload area is determined based on the length value and the encoding format data, and a boundary verification operation is performed based on the storage boundary to confirm the valid data range of the variable-length data segment according to the boundary verification result.

4. The ARINC739 protocol aviation bus data analysis method according to claim 3, characterized in that: The step of parsing the encoded format data from the payload area adjacent to the common header area according to the priority level and in combination with the parsing template includes: Customizing and extending the parsing template according to the priority level to obtain an extended parsing template; Extracting a binary data stream from a payload area adjacent to the public header based on the expanded parsing template; Locating a format identifier in the binary data stream; According to the format identifier, a coded data block is intercepted from the binary data stream, and the coded data block is mapped according to a preset structure mapping rule to generate coded format data.

5. The ARINC739 protocol aviation bus data analysis method according to claim 1, characterized in that: The fusing of the enhanced topology features with the hierarchical analysis results and performing anomaly detection processing on the fusion results to identify link failure modes includes: Combining the enhanced topological features with a type identifier, a length value, and coordinate position data in the hierarchical parsing result to generate a fusion result, the coordinate position data being another data parsed from a payload region adjacent to the common header region; Performing a multi-dimensional scan on the fusion result, and locating the abnormal data location based on the inconsistencies in the scan result; Based on the distribution characteristics of the abnormal data positions, a link failure mode is output.

6. The ARINC739 protocol aviation bus data analysis method according to claim 1, characterized in that: The performing graph embedding processing on the node connection data and the delay index data to obtain a topology feature matrix, and generating a modulation feature stream based on the topology feature matrix, includes: Converting the node connection data into a connection relationship matrix, and mapping the delay index data into a delay matrix; Superimposing the connection relationship matrix and the delay matrix to generate a topological feature matrix; Performing modulation transformation processing on the topological characteristic matrix to obtain modulation characteristic parameters; Based on the modulation feature parameters, a modulation feature sequence is generated, and the modulation feature sequence is used as a modulation feature stream.

7. The ARINC739 protocol aviation bus data analysis method according to claim 1, characterized in that: The method of aggregating the modulated feature stream using a graph neural network to generate enhanced topological features includes: Extracting the wavelength characteristic value corresponding to each node from the modulation characteristic stream; Through multiple rounds of iterative aggregation operations of the graph neural network, the wavelength feature value of each node is aggregated with the wavelength feature values ​​of adjacent nodes, and the result of each round of aggregation is used as the updated wavelength feature value of the corresponding node; When the aggregation round reaches the preset round threshold, the updated wavelength feature values ​​of all nodes are output as enhanced topology features.

8. An ARINC739 protocol aviation bus data analysis system, characterized in that: include: The acquisition module is used to collect the protocol data stream of the aviation bus, the node connection data of the aviation bus network, and the delay index data; A generating module, configured to perform graph embedding processing on the node connection data and the delay index data to obtain a topological feature matrix, and generate a modulation feature flow based on the topological feature matrix; an aggregation module, configured to aggregate the modulated feature stream using a graph neural network to generate enhanced topological features; An extraction module, configured to extract a message header identification field from the protocol data stream, and perform a hierarchical parsing operation on the message header identification field through dynamic template matching; The fusion module is used to fuse the enhanced topology features with the hierarchical analysis results, and perform anomaly detection processing on the fusion results to identify link failure modes.

Images