A method and system for parsing ARINC739 protocol avionics bus data

Abstract

This application relates to the field of bus protocol parsing and network monitoring technology, providing a method and system for parsing ARINC739 protocol avionics bus data, solving the problems of low accuracy and poor real-time performance in avionics bus network fault diagnosis. The method includes: collecting protocol data streams, node connection data, and latency index data of the avionics bus network; performing graph embedding on the node connection data and latency index data to obtain a topology feature matrix; generating a modulation feature stream based on the topology feature matrix; aggregating the modulation feature stream using a graph neural network to generate enhanced topology features; extracting the packet header identifier field from the protocol data stream; performing hierarchical parsing of the packet header identifier field through dynamic template matching; fusing the enhanced topology features and the hierarchical parsing results; and performing anomaly detection on the fused results to identify link failure modes. This application improves the accuracy and real-time performance of avionics bus network fault diagnosis.

Description

Technical Field

[0001] This application relates to the field of bus communication protocol parsing and network health monitoring technology in avionics systems, and in particular to an ARINC739 protocol avionics bus data parsing method and system. Background Technology

[0002] Modern avionics systems rely on bus protocols to achieve efficient communication between airborne devices. They require real-time parsing of various data packets and monitoring of network status to ensure reliable transmission of flight control commands and stable system operation.

[0003] The current mainstream solution uses static parsing rules combined with an independent network monitoring module. It matches protocol fields through a pre-set message format dictionary and uses independently collected network status indicators for offline fault analysis.

[0004] Static parsing rules are difficult to adapt to protocol expansion and dynamic message changes, and independent monitoring modules result in insufficient data correlation. The overall solution has obvious bottlenecks in real-time performance and accuracy in complex aviation environments. Summary of the Invention

[0005] This application provides an ARINC739 protocol avionics bus data parsing method and system to solve the problems of low accuracy and poor real-time performance in avionics bus network fault diagnosis in the prior art.

[0006] Firstly, this application provides a method for parsing ARINC739 protocol avionics bus data, including:

[0007] Collect protocol data streams from the avionics bus, node connection data from the avionics bus network, and latency metrics.

[0008] The node connection data and the delay index data are subjected to graph embedding processing to obtain a topology feature matrix, and a modulation feature stream is generated based on the topology feature matrix;

[0009] The modulation feature stream is aggregated using a graph neural network to generate enhanced topological features;

[0010] Extract the message header identifier field from the protocol data stream, and perform a layered parsing operation on the message header identifier field through dynamic template matching;

[0011] The enhanced topology features and hierarchical parsing results are fused together, and anomaly detection processing is performed on the fused results to identify link failure modes.

[0012] Optionally, the hierarchical parsing operation of the message header identifier field through dynamic template matching includes:

[0013] In the first layer, the type identifier, length value, and priority level are extracted from the common header area corresponding to the message header identifier field;

[0014] Select the parsing template with the highest matching degree to the type identifier from the pre-stored parsing template library;

[0015] Based on the parsing template, the message header identifier field is subjected to second-level and third-level hierarchical parsing operations.

[0016] Optionally, the step of performing second-level and third-level hierarchical parsing operations on the message header identifier field according to the parsing template includes:

[0017] Based on the priority level and the parsing template, the encoded format data is parsed from the payload area adjacent to the common header area;

[0018] In the third layer, the storage boundary of the variable-length data segment in the payload area is determined based on the length value and the encoding format data. A boundary verification operation is performed based on the storage boundary to confirm the valid data range of the variable-length data segment according to the boundary verification result.

[0019] Optionally, the step of parsing encoded format data from the payload region adjacent to the common header region according to the priority level and in conjunction with the parsing template includes:

[0020] Based on the priority level, the parsing template is customized and extended to obtain the extended parsing template;

[0021] Based on the extended parsing template, a binary data stream is extracted from the payload region immediately adjacent to the common header;

[0022] Locate the format identifier in the binary data stream;

[0023] Based on the format identifier, encoded data blocks are extracted from the binary data stream, and the encoded data blocks are mapped according to a preset structure to generate encoded format data.

[0024] Optionally, the process of fusing the enhanced topology features and the hierarchical parsing results, and performing anomaly detection processing on the fused results to identify link failure modes, includes:

[0025] The enhanced topological features are combined with the type identifier, length value, and coordinate position data in the hierarchical parsing results to generate a fusion result. The coordinate position data is another data parsed from the payload region adjacent to the common head region.

[0026] The fusion result is scanned in multiple dimensions, and the location of abnormal data is located based on the inconsistencies in the scan result;

[0027] Based on the distribution characteristics of the abnormal data locations, the link failure mode is output.

[0028] Optionally, the step of performing graph embedding processing on the node connection data and the delay index data to obtain a topology feature matrix, and generating a modulation feature stream based on the topology feature matrix, includes:

[0029] The node connection data is converted into a connection relationship matrix, and the latency index data is mapped into a latency matrix.

[0030] By superimposing the connection matrix and the delay matrix, a topological feature matrix is ​​generated;

[0031] The topological feature matrix is ​​subjected to modulation transformation to obtain modulation feature parameters;

[0032] Based on the modulation feature parameters, a modulation feature sequence is generated, and the modulation feature sequence is used as a modulation feature stream.

[0033] Optionally, the step of using a graph neural network to aggregate the modulated feature stream to generate enhanced topological features includes:

[0034] Extract the wavelength feature values ​​corresponding to each node from the modulation feature stream;

[0035] Through multi-round iterative aggregation operations of graph neural networks, the wavelength feature values ​​of each node are aggregated with the wavelength feature values ​​of adjacent nodes, and the result of each round of aggregation is used as the updated wavelength feature value of the corresponding node.

[0036] When the aggregation round reaches the preset round threshold, the updated wavelength feature values ​​of all nodes are output as enhanced topology features.

[0037] Secondly, this application provides an ARINC739 protocol avionics bus data parsing system, comprising:

[0038] The acquisition module is used to acquire protocol data streams of the avionics bus, node connection data of the avionics bus network, and latency index data.

[0039] The generation module is used to perform graph embedding processing on the node connection data and the delay index data to obtain a topology feature matrix, and generate a modulation feature stream based on the topology feature matrix;

[0040] An aggregation module is used to aggregate the modulation feature stream using a graph neural network to generate enhanced topological features;

[0041] The extraction module is used to extract the packet header identifier field from the protocol data stream and perform hierarchical parsing operation on the packet header identifier field through dynamic template matching;

[0042] The fusion module is used to fuse the enhanced topology features and the hierarchical parsing results, and to perform anomaly detection processing on the fusion results in order to identify link failure modes.

[0043] Thirdly, this application provides a computing device including a processor and a memory, wherein the memory stores a computer program, and the processor is configured to run the computer program to execute an ARINC739 protocol avionics bus data parsing method as described in any of the first aspects.

[0044] Fourthly, this application provides a computer storage medium storing computer program instructions thereon, which, when executed by a processor, implement an ARINC739 protocol avionics bus data parsing method as described in any one of the first aspects.

[0045] This application provides a method for parsing ARINC739 protocol avionics bus data. The method includes: collecting protocol data streams of the avionics bus, node connection data of the avionics bus network, and delay index data; performing graph embedding processing on the node connection data and the delay index data to obtain a topology feature matrix; generating a modulation feature stream based on the topology feature matrix; aggregating the modulation feature stream using a graph neural network to generate enhanced topology features; extracting a packet header identifier field from the protocol data stream; performing hierarchical parsing on the packet header identifier field through dynamic template matching; fusing the enhanced topology features with the hierarchical parsing results; and performing anomaly detection processing on the fused results to identify link failure modes.

[0046] The technical solution provided in this application has the following beneficial effects:

[0047] This application acquires protocol data streams and network data to achieve comprehensive perception of the communication status and network topology of avionics systems; graph embedding processing and modulation feature stream generation transform network topology relationships into processable feature representations; graph neural aggregation enhances the expressive power of topology features and improves the accuracy of network status representation; dynamic template matching and hierarchical parsing enable accurate identification and structured extraction of multiple types of messages; feature fusion and anomaly detection establish a correlation analysis between protocol data and network status, improving fault identification capabilities.

[0048] Furthermore, this application also performs a three-layer parsing operation on the message header identifier field by dynamically matching the parsing template in the pre-stored template library, sequentially extracting the common header metadata, payload content and variable length field information, thereby achieving complete parsing of ARINC739 protocol messages.

[0049] Furthermore, this method overcomes the limitations of fixed template parsing, and can adaptively process various standard and private messages, improving the accuracy and adaptability of protocol parsing in complex avionics environments.

[0050] These or other aspects of this application will become more apparent in the following description of the embodiments. Attached Figure Description

[0051] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0052] Figure 1 A flowchart illustrating an ARINC739 protocol avionics bus data parsing method provided in this application embodiment;

[0053] Figure 2 A schematic diagram of the structure of an ARINC739 protocol avionics bus data parsing system provided in this application embodiment;

[0054] Figure 3 This is a schematic diagram of the structure of a computing device provided in an embodiment of this application. Detailed Implementation

[0055] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings.

[0056] In some of the processes described in the specification, claims, and accompanying drawings of this application, multiple operations appearing in a specific order are included. However, it should be clearly understood that these operations may not be executed in the order they appear herein, or may be executed in parallel. The operation numbers, such as 101, 102, etc., are merely used to distinguish different operations and do not themselves represent any execution order. Furthermore, these processes may include more or fewer operations, and these operations may be executed sequentially or in parallel. It should be noted that the descriptions such as "first," "second," etc., in this document are used to distinguish different messages, devices, modules, etc., and do not represent a chronological order, nor do they limit "first" and "second" to different types.

[0057] Existing avionics bus data parsing schemes employ a combined architecture of static parsing rules and independent network monitoring modules, which has limitations: static parsing rules rely on pre-built message format dictionaries, making it difficult to adapt to dynamic changes in protocol extensions and vendor-specific fields, resulting in a sharp decline in message recognition efficiency as protocol complexity increases; simultaneously, the separation of network status monitoring and protocol parsing leads to a lack of data correlation, making it difficult to accurately and promptly locate the root cause of link failures under the high real-time requirements of avionics systems. This deficiency essentially stems from the traditional scheme's fragmented handling of protocol dynamism and network topology awareness, failing to meet the stringent requirements of modern avionics systems for communication reliability and status observability.

[0058] To address the aforementioned issues, this application proposes an ARINC739 protocol avionics bus data parsing method. Its innovation lies in the deep coupling of network topology features with the protocol parsing process. By using graph embedding processing to generate a real-time topology feature matrix and modulation feature stream, the network connection status is dynamically reflected. Simultaneously, a hierarchical parsing mechanism is employed, combined with dynamic template matching for adaptive processing of various message structures. This method, by enhancing the collaborative analysis of topology features and parsing results, achieves spatiotemporal alignment between protocol data and network status—solving both the problem of insufficient adaptability of static parsing rules to protocol changes and overcoming the data association deficiencies of independent monitoring modules. This enables the system to accurately identify link failure modes and maintain high real-time performance, improving the reliability of avionics bus communication and the accuracy of fault diagnosis.

[0059] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0060] Figure 1 A flowchart of an ARINC739 protocol avionics bus data parsing method provided for embodiments of this application is shown below. Figure 1 As shown, the method includes:

[0061] Step 101: Collect protocol data streams of the avionics bus, node connection data of the avionics bus network, and latency index data.

[0062] In step 101, the avionics bus refers to the communication channel (physical layer transmission medium) for transmitting ARINC 739 protocol data between various electronic devices within the aircraft. The avionics bus network is a complete communication system (including topology and transmission metrics) composed of multiple avionics buses and their connected node devices. The relationship between the two is as follows: the avionics bus is the transmission carrier of the network, and the network is the logical collection of buses and their connected devices. The protocol data stream refers to the raw data sequence transmitted by the ARINC 739 bus, including message headers, payloads, and checksum information. Node connection data describes the physical connection relationships between various devices in the avionics bus network (such as flight management computers, display terminals, etc.), for example, which devices communicate directly. Latency metric data reflects the time delay of data transmission between nodes in the network and is used to evaluate communication efficiency.

[0063] In this embodiment, a bus monitoring device captures protocol data streams in real time, while simultaneously collecting the connection status of each device in the network (e.g., whether device A and device B are directly connected) and their communication latency (e.g., the data transmission time from device A to device B). These data collectively form the basis for subsequent analysis and fault diagnosis.

[0064] For example, in a certain avionics system, a bus monitoring device continuously records the protocol data stream, detects the connection relationships between devices A, B, and C (such as AB and BC), and measures the delay from A to B as a certain value (calculated from the actual communication time). This data will be used for subsequent topology analysis and protocol parsing.

[0065] Step 102: Perform graph embedding processing on the node connection data and the delay index data to obtain a topology feature matrix, and generate a modulation feature stream based on the topology feature matrix.

[0066] In step 102, the graph embedding process represents the conversion of the network topology (nodes and connections) into a mathematical matrix representation for computation and analysis. The topology feature matrix is ​​a numerical matrix where rows and columns represent devices in the network, and matrix elements represent the connection strength or latency effects between devices. The modulation feature stream represents the conversion of the topology feature matrix into analog optical signal data that can be used for subsequent neural network processing.

[0067] In this embodiment, firstly, the node connection data is converted into an adjacency matrix, where a matrix element of 1 indicates a direct connection between devices, and 0 indicates no connection. Then, the latency index data is mapped into a weight matrix; the higher the latency, the larger the corresponding matrix element value. Next, the adjacency matrix and the weight matrix are superimposed to generate a topological feature matrix. Finally, using optical signal modulation technology, this matrix is ​​converted into a modulation feature stream for subsequent graph neural network processing.

[0068] For example, in a certain avionics network, the connections between devices A, B, and C form an adjacency matrix. Since AB has a higher latency, the corresponding element values ​​in the weight matrix are larger. These are then superimposed to generate a topological feature matrix, which is then converted into a modulated feature stream using optical modulation technology for use in subsequent steps.

[0069] Step 103: Using a graph neural network, aggregate the modulation feature stream to generate enhanced topological features.

[0070] In step 103, the graph neural network represents a deep learning model capable of processing graph-structured data to extract deep features of the network topology. Enhanced topology features represent the topology representation optimized by the neural network, which more accurately reflects the network state.

[0071] In this embodiment, the modulated feature stream is input into a graph neural network, which aggregates the feature information of adjacent nodes through multi-layer computation. For example, the features of device A are updated by combining the features of devices B and C, and finally, the enhanced topology features are output, which can more comprehensively describe the network health status.

[0072] For example, in a certain avionics system, after processing the modulated feature stream, a graph neural network detects anomalies in the communication characteristics of device B, which may indicate a potential fault. The enhanced topology features will then be used for subsequent fault diagnosis.

[0073] Step 104: Extract the message header identifier field from the protocol data stream, and perform a layered parsing operation on the message header identifier field through dynamic template matching.

[0074] In step 104, the message header identifier field indicates the beginning of the protocol data stream and includes information such as message type and length. Dynamic template matching means dynamically selecting parsing rules based on the message type to improve adaptability. Layered parsing means extracting different parts of the message in stages, such as the header and payload.

[0075] In this embodiment, firstly, the header identifier field is extracted from the start of the protocol data stream to determine the message type. Then, a matching parsing template is selected from a pre-stored template library according to the type. Next, the parsing is performed layer by layer according to the template: the first layer extracts common header information (such as type and length), the second layer parses the payload (such as coordinate data), and the third layer processes variable-length fields (such as dynamic data blocks).

[0076] For example, when parsing an ARINC739 message, after dynamically matching the template, the type identifier (such as display instructions), coordinate data (such as screen position), and finally the variable-length fields (such as dynamic text content) are extracted in sequence.

[0077] Step 105: Combine the enhanced topology features with the hierarchical parsing results, and perform anomaly detection processing on the combined results to identify link failure modes.

[0078] In step 105, the fusion result represents the combination of network topology features and protocol parsing data to form comprehensive analysis data. Anomaly detection processing refers to the identification of abnormal patterns in the data, such as communication interruptions or data errors, through algorithms. Link failure modes refer to the types of communication failures in the aviation bus network caused by physical connection anomalies or protocol parsing errors. Specifically, they include four typical failure states: link interruption (complete inability to communicate between nodes), data packet loss (partial packet loss), latency anomalies (transmission time exceeding the threshold), and data corruption (parsing results not matching expectations). The determination is based on the fusion analysis results of enhanced topology features and hierarchical parsing results.

[0079] In this embodiment, enhanced topology features (such as communication anomalies in device B) are combined with hierarchical parsing results (such as abnormal message length), and data consistency is analyzed using an anomaly detection algorithm. For example, if a device has high communication latency and its sent message verification fails, it is determined to be a link failure.

[0080] For example, in a certain avionics system, fusion analysis found that the latency of device B was increased and its message verification was incorrect. The system determined that device B had a connection failure and triggered an alarm.

[0081] This method achieves efficient parsing and precise fault location of ARINC739 bus data by real-time acquisition of protocol data and network status, combined with graph embedding and dynamic parsing techniques. Compared to traditional solutions, this method can adapt to protocol changes and simultaneously correlate network topology with protocol data, thereby improving the reliability of avionics system communication and fault diagnosis capabilities.

[0082] To address the adaptability issue in ARINC739 protocol message parsing, in some embodiments, step 104: the hierarchical parsing operation of the message header identifier field through dynamic template matching, includes:

[0083] Step 201: In the first layer, extract the type identifier, length value, and priority level from the common header area corresponding to the message header identifier field.

[0084] In step 201, the common header area refers to the fixed-format data segment at the beginning of the message, which includes a type identifier (an encoding that distinguishes the purpose of the message), a length value (indicating the total length of the message), and a priority level (a level that determines the processing order). The type identifier is used to match the parsing template. The length value is used for subsequent processing of variable-length fields. The priority level affects the parsing order.

[0085] In this embodiment, a fixed number of bytes of data are read from the beginning of the message header identifier field, and three key parameters—type identifier, length value, and priority level—are separated according to a predefined common header structure. These parameters serve as the basic control information for subsequent parsing.

[0086] Step 202: Select the parsing template with the highest matching degree with the type identifier from the pre-stored parsing template library.

[0087] In step 202, the parsing template library is a pre-stored set of various message format rules, with each template containing parsing rules for a specific type of message. The highest matching degree refers to the optimal similarity between the template's type identifier and the message type identifier.

[0088] In this embodiment, the extracted type identifier is compared with the type identifiers of all templates in the template library, and the template with the smallest matching error is selected as the current parsing template. The matching process considers the degree of binary bit matching of the type identifier.

[0089] Step 203: Based on the parsing template, perform second-level and third-level hierarchical parsing operations on the message header identifier field.

[0090] In step 203, the second-level parsing refers to extracting the payload data according to the template rules, and the third-level parsing refers to processing the additional data segments with variable lengths. The second-level parsing depends on the field position information defined in the template, and the third-level parsing depends on the length values ​​extracted in the first level.

[0091] In this embodiment, following the rules of the selected template, coordinate data and encoded data are first extracted from the specified location in the message payload; then, the boundary position of the variable-length data segment is calculated based on the length value to extract the dynamic content data. The two layers of parsing are executed sequentially to ensure complete data extraction.

[0092] Here is a specific example:

[0093] In a certain avionics system, the bus monitoring device captures the protocol data stream sent by device B. It first extracts the common header area from the beginning of the data, obtaining a type identifier of "Flight Parameter Update Instruction," a length of 180 bytes, and a priority level of "Emergency." The system compares this type identifier with various instruction templates in a pre-stored template library and finds that it matches the flight parameter template with the highest degree of match. Therefore, this template is selected for subsequent parsing. According to the rules defined in the template, the system first parses fixed-format parameters such as flight altitude and speed from the specified position in the data. Then, based on the length value extracted from the header, it parses the subsequent dynamic parameter group, including real-time updated environmental monitoring data, starting from the 60th byte.

[0094] In this embodiment of the application, the hierarchical parsing method, through dynamic matching and sequential extraction, can adapt to the changes in the proprietary message formats of different manufacturers, while ensuring the parsing efficiency of standard messages, and improving the accuracy and reliability of protocol parsing in complex avionics environments.

[0095] To improve the accuracy and reliability of ARINC739 protocol message parsing, in some embodiments, step 203: performing second-level and third-level layered parsing operations on the message header identifier field according to the parsing template, includes:

[0096] Step 301: Based on the priority level and the parsing template, parse the encoded format data from the payload area adjacent to the common header area.

[0097] In step 301, the payload area immediately adjacent to the common header refers to the data segment in the ARINC 739 protocol data stream that is located after the message common header and stores the actual transmitted content. Its starting position is directly determined by the length field of the common header, specifically originating from the continuous data storage area after the header identifier field in the protocol data stream. Encoded format data refers to the control information in the payload area that describes the data organization method, including data type, arrangement order, and special markers.

[0098] In this embodiment, the system first determines the processing order of the current message based on its priority level. Then, according to the rules defined in the parsing template, it reads and identifies the encoding format descriptor byte by byte from the data area following the common header. Based on the descriptor content, it determines the arrangement pattern and special processing requirements of the subsequent data, thus completing the extraction of the encoding format data.

[0099] Step 302: In the third layer, the storage boundary of the variable-length data segment in the payload area is determined based on the length value and the encoding format data. A boundary verification operation is performed based on the storage boundary to confirm the effective data range of the variable-length data segment according to the boundary verification result.

[0100] In step 302, a variable-length data segment refers to a data region in the protocol data stream with a variable length. Its range is defined by the "length value" extracted from the first layer and originates from the variable-length content portion immediately following the encoded format data in the protocol data stream. Storage boundaries refer to the start and end positions of the variable-length data segment within the message. Boundary verification operations confirm the reasonableness of the data range by checking the relationship between the data segment length and the total message length. The valid data range refers to the data interval determined to be safe for use after verification.

[0101] In this embodiment, the system uses the length value extracted in the first layer and the encoding format data obtained in this step to calculate the theoretical boundary position of the variable-length data segment. Then, the correctness of the boundary position is verified by comparing the actual length of the message with the calculated value. If the verification passes, the final valid data range is determined; otherwise, it is marked as an abnormal data segment.

[0102] Here is a specific example:

[0103] In a certain avionics system, the bus monitoring device captured an emergency-level flight parameter update command message sent by device B. The message was 180 bytes long. The system first extracted the common header information from the beginning of the message, identifying it as a flight parameter command with the highest priority. Based on the matching results of the pre-stored template library, a dedicated parsing template for flight parameters was selected, and the system immediately prioritized processing the message. Following the template definition rules, the system began parsing the payload area from the 20th byte after the common header. It first identified the encoding format descriptor, confirming the data arrangement as a "fixed-then-dynamic" structure, where the fixed portion contained key parameters such as flight altitude and speed, occupying 40 bytes. Based on the extracted total length of 180 bytes and the encoding format information, the system calculated the theoretical start position of the variable-length data segment to be byte 60 and the end position to be byte 180. During boundary verification, the system found that the actual message ended at byte 175, a 5-byte difference from the theoretical calculation. After verification, the last 5 bytes were confirmed to be abnormal data; therefore, the valid data range was determined to be between bytes 60 and 175.

[0104] In this embodiment of the application, the hierarchical parsing method, through priority scheduling and boundary verification mechanisms, not only ensures the timely processing of critical data, but also effectively identifies abnormal data segments, thereby improving the security and data reliability of protocol parsing.

[0105] To improve the flexibility and accuracy of ARINC739 protocol message parsing, in some embodiments, step 301: parsing the encoded format data from the payload area adjacent to the common header area according to the priority level and the parsing template includes:

[0106] Step 401: Based on the priority level, customize and extend the parsing template to obtain the extended parsing template.

[0107] In step 401, the custom extension refers to the process of adaptively adjusting the parsing template according to the priority level. The extended parsing template includes basic parsing rules and newly added extended rules.

[0108] In this embodiment, the system first reads the priority level of the message. When a high priority is identified, extended rules such as data check bit checks are added to the basic parsing template; for ordinary priority messages, the basic template remains unchanged. This extension process ensures that important messages receive more stringent parsing processing.

[0109] Step 402: Based on the extended parsing template, extract the binary data stream from the payload region immediately adjacent to the common header.

[0110] In step 402, the binary data stream refers to the original data sequence of the payload area.

[0111] In this embodiment, binary data is read sequentially from the data area following the common header, according to the starting offset and read length defined in the extended template. The reading process strictly follows the byte order and bit width requirements specified in the template.

[0112] Step 403: Locate the format identifier in the binary data stream.

[0113] In step 403, the format identifier is a special marker in the binary data stream that identifies the encoding format, typically located at the beginning of the data. The location process requires matching a predefined identifier feature pattern.

[0114] In this embodiment of the application, the system starts scanning from the beginning of the binary data stream, compares the data with the features of various pre-stored format identifiers, and confirms the position of the format identifier when a specific feature pattern is matched.

[0115] Step 404: Based on the format identifier, extract encoded data blocks from the binary data stream, and generate encoded format data by mapping the encoded data blocks according to a preset structure rule.

[0116] In step 404, the encoded data block is a binary data segment containing complete encoding format information. Predefined structure mapping rules define how binary data is converted into a usable encoding format description.

[0117] In this embodiment, starting from the located format identifier, encoded data blocks are truncated according to the length indicated by the identifier. Then, binary data is mapped into encoded format data containing information such as data type and arrangement order according to preset rules.

[0118] Here is a specific example:

[0119] In a certain avionics system, the bus monitoring device captures an emergency-level flight parameter update command message sent by device B. This message is 180 bytes long and has the highest priority. The system first extends the standard flight parameter parsing template based on the priority level, adding a double check mechanism and a fast parsing channel to form a dedicated extended template. Following the rules defined in the extended template, the system extracts a 150-byte binary data stream starting from the 20th byte after the common header; this length is determined by the maximum read range specified in the template. At the beginning of the data stream, the system identifies a format identifier, a flight parameter-specific marker, through feature comparison. This marker occupies 4 bytes and contains a specific binary combination. Based on the format information indicated by the identifier, the system extracts a 16-byte coded data block starting from the 24th byte; this length is determined by the subsequent format length field value of the identifier. Following the flight parameter-specific structure mapping rules, the coded data block is converted into a complete format description containing a data arrangement where fixed parameters precede dynamic parameters, and the byte length of each field.

[0120] In this embodiment of the application, the encoding format parsing method, through priority-driven template expansion and a strict format identification process, not only ensures the reliable parsing of key messages, but also accurately identifies various data formats, thereby improving the adaptability of protocol parsing and the accuracy of data extraction.

[0121] To improve the comprehensiveness and accuracy of fault diagnosis in aviation bus networks, in some embodiments, step 105: fusing the enhanced topology features and hierarchical parsing results, and performing anomaly detection processing on the fused results to identify link fault modes, includes:

[0122] Step 501: Combine the enhanced topology features with the type identifier, length value and coordinate position data in the hierarchical parsing result to generate a fusion result. The coordinate position data is another data parsed from the payload region adjacent to the common head region.

[0123] In step 501, the purpose of the coordinate position data is explained as follows: In avionics scenarios, the coordinate position data is used for display terminal rendering (such as flight instrument interface).

[0124] In this embodiment, the system combines the parsed message type, data length, and display coordinates with the network connection status data obtained from topology analysis to form a multi-dimensional dataset containing protocol features and network status, providing complete input for subsequent anomaly analysis.

[0125] Step 502: Perform a multi-dimensional scan on the fusion result, and locate the abnormal data based on the inconsistencies in the scan results.

[0126] In step 502, the multi-dimensional scan is a process of checking the correlation of various parameters in the fused data. The criteria for judging inconsistencies in the scan results are: by comparing the consistency of three sets of correlations—the mapping relationship between physical connection status and protocol length values ​​in the fused results, the path reachability of coordinate location data in network status data, and the matching of type identifier and physical connection path—mutually contradictory parameter combinations are identified as inconsistencies. Inconsistencies refer to abnormal combinations of parameters that contradict each other or exceed the normal range. The location of abnormal data is the specific location of the detected problematic data within the packet or network topology.

[0127] In this embodiment, the system first checks the matching between the message length and the network transmission capacity, then verifies the rationality of the displayed coordinates and the actual location of the terminal, and finally checks the applicability of the message type and the communication path. When a contradiction is found between parameters, the specific location and type of the abnormal data are recorded.

[0128] Step 503: Based on the distribution characteristics of the abnormal data locations, output the link failure mode.

[0129] In step 503, the distribution characteristics of abnormal data locations represent the spatial distribution patterns of all abnormal data locations marked as inconsistent in the aviation bus network topology, including but not limited to spatial association characteristics such as abnormal points being concentrated on specific physical paths, exhibiting periodic distribution, or being associated with specific nodes.

[0130] In this embodiment, the system statistically analyzes the location information of each anomaly point and its distribution characteristics in the network connection diagram. When anomalies are concentrated on a certain physical link, it is determined to be a link interruption; when anomalies are scattered in the same field of different packets, it is determined to be data corruption. Finally, the specific fault mode diagnosis result is output.

[0131] Here is a specific example:

[0132] In a certain avionics system, a bus monitoring device continuously monitors the communication status between devices A, B, and C, and detects an anomaly in the display command message sent by device B. The system first combines the enhanced topology characteristics of device B (indicating increased communication latency with device C) with the layered parsing results of the message (containing a type identifier of display command, a length of 200 bytes, and coordinates of the upper right area of ​​the screen) to generate a fused result. During multi-dimensional scanning, the system finds three key inconsistencies: first, the message length does not match device B's current communication capabilities (under normal circumstances, device B should send shorter messages when latency increases); second, the coordinates do not match the effective display area of ​​device C's display terminal (the upper right area of ​​the screen is damaged); and third, the message type conflicts with device B's role permissions (device B should not directly send display commands). By analyzing the locations of these abnormal data, the system finds that they are all concentrated on the communication link from device B to device C, and consistent with the abnormal communication latency locations indicated by the topology characteristics. Based on this distribution characteristic, the system determines that the link from device B to device C has both data tampering and transmission delay faults, immediately triggers an alarm and marks the link as unavailable, and automatically switches to the backup communication path.

[0133] In this embodiment of the application, the fault diagnosis method achieves collaborative detection of network status and protocol data through multi-source data fusion and correlation analysis, which can accurately identify the root causes of various link faults and improve the accuracy and response speed of avionics system fault location.

[0134] To improve the accuracy and usability of topology feature extraction in aviation bus networks, in some embodiments, step 102: performing graph embedding processing on the node connection data and the delay index data to obtain a topology feature matrix, and generating a modulation feature stream based on the topology feature matrix, includes:

[0135] Step 601: Convert the node connection data into a connection relationship matrix and map the delay index data into a delay matrix.

[0136] In step 601, the connection matrix is ​​a square matrix describing the physical connection status between devices. A matrix element of 1 indicates that the two devices are directly connected, and 0 indicates that they are not connected. The delay matrix is ​​a square matrix reflecting the communication delay between devices; the higher the delay, the larger the corresponding matrix element value. The rows and columns of both matrices correspond to the same device nodes.

[0137] In this embodiment, the system first constructs a device list, assigning each device a row and column number to a matrix in a fixed order. For connection relationship data, directly connected device pairs are marked as 1 in the matrix, otherwise as 0. For delay data, the measured delay values ​​are mapped proportionally to matrix element values ​​to form a delay matrix.

[0138] Step 602: Superimpose the connection relationship matrix and the delay matrix to generate a topological feature matrix.

[0139] In this embodiment, the system adds the connection matrix and the delay matrix with equal weights to generate a new composite matrix. Before addition, the delay matrix is ​​normalized to ensure that the two types of data are of the same magnitude. The superimposed matrix simultaneously reflects both device connection status and communication latency.

[0140] Step 603: Perform modulation transformation on the topological feature matrix to obtain modulation feature parameters.

[0141] In step 603, the modulation transformation process is the process of converting the matrix data into characteristic parameters suitable for optical signal transmission. The modulation characteristic parameters include optical signal characteristic values ​​such as wavelength and amplitude.

[0142] In this embodiment, the system performs eigenvalue decomposition on the topological feature matrix to extract the main eigenvectors. These eigenvectors are then converted into corresponding optical wavelength and amplitude parameters, which can fully characterize the feature information of the original matrix.

[0143] Step 604: Based on the modulation feature parameters, generate a modulation feature sequence and use the modulation feature sequence as a modulation feature stream.

[0144] In step 604, the modulation feature sequence is a set of modulation feature parameters arranged in chronological order.

[0145] In this embodiment, the system arranges and combines the modulation characteristic parameters of each device according to the time sequence of device communication to form a continuous characteristic sequence. This sequence is converted into an analog optical signal through digital-to-analog conversion and output as a modulation characteristic stream.

[0146] Here is a specific example:

[0147] In a certain avionics system, a bus monitoring device continuously monitors the communication status between devices A, B, and C. First, the detected physical connections are converted into a connection matrix, where connections between devices A and B, and between B and C, are marked as 1 at their respective positions, with the remaining positions marked as 0. Simultaneously, measured communication delay data is converted into a delay matrix. The delay from device A to B is higher, so the corresponding matrix element values ​​are set to larger values ​​proportional to the delay time; the delay from device B to C is normal, so smaller values ​​are set. The system superimposes the two matrices with equal weights to generate a topology feature matrix that comprehensively reflects the connection status and communication quality. After feature analysis of this matrix, three main feature parameters are extracted, with the feature value corresponding to device B showing significant anomalies. The system converts these feature parameters into optical signal wavelength and amplitude data; the abnormal feature value of device B corresponds to an optical signal of a specific wavelength. Finally, a modulation feature stream containing the feature parameters of the three devices is generated, where the abnormal wavelength feature of device B is identified as a potential fault node in subsequent graph neural network processing.

[0148] In this embodiment, the topology feature processing method transforms complex network state information into an efficient feature representation through matrix fusion and optical signal modulation, providing an accurate and easy-to-process data foundation for subsequent fault diagnosis and improving the real-time performance and reliability of avionics system status monitoring.

[0149] To improve the representation capability of aviation bus network topology features, in some embodiments, step 103: the aggregation of the modulation feature stream using a graph neural network to generate enhanced topology features includes:

[0150] Step 701: Extract the wavelength feature values ​​corresponding to each node from the modulation feature stream.

[0151] In step 701, the wavelength characteristic value is an optical signal parameter extracted from the modulation characteristic stream that reflects the communication status of the node; different wavelengths correspond to different network connection qualities. A node refers to a specific device in the avionics network, such as a flight management computer.

[0152] In this embodiment of the application, the system first parses the optical signal sequence in the modulation feature stream, and extracts the characteristic wavelength value corresponding to each device from the wavelength distribution of the optical signal according to the preset device node order, forming an initial node feature set.

[0153] Step 702: Through multiple rounds of iterative aggregation operations of the graph neural network, the wavelength feature values ​​of each node are aggregated with the wavelength feature values ​​of adjacent nodes, and the result of each round of aggregation is used as the updated wavelength feature value of the corresponding node.

[0154] In step 702, the multi-round iterative aggregation operation is a process of continuously updating node features through a graph neural network. Neighboring nodes refer to device nodes directly connected in the connection matrix. The updated wavelength feature value contains comprehensive information about itself and its neighboring nodes.

[0155] In this embodiment, after initializing the graph neural network, the system first determines the neighbor set of each node in each aggregation round, and then weights and fuses the node's own wavelength feature value with the feature values ​​of all neighboring nodes to generate new feature values. This process is executed cyclically, so that the node features gradually include a wider range of network information.

[0156] Step 703: When the aggregation round reaches the preset round threshold, output the updated wavelength feature values ​​of all nodes as enhanced topology features.

[0157] In step 703, the preset round threshold is a pre-set number of aggregation iterations, and the calculation stops after reaching this number.

[0158] In this embodiment of the application, the system sets a fixed number of aggregation rounds. After all rounds are completed, the final feature values ​​of each node are sorted and output according to the device number to form an enhanced topology feature description. This feature can reflect both local connectivity and global network status.

[0159] Here is a specific example:

[0160] In a certain avionics system, after the bus monitoring device acquires the modulation feature streams of devices A, B, and C, it first parses the characteristic wavelength values ​​corresponding to the three devices from the optical signal sequence. Device A's characteristic wavelength is the standard value, device B's characteristic wavelength is significantly off-target, and device C's characteristic wavelength is within the normal range. The system then initiates a graph neural network for feature aggregation. In the first round of processing, the characteristic wavelength of device B is weighted and fused with the characteristic wavelength of its directly connected device A to generate the first updated feature of device B. In the second round, the updated feature of device B is fused with the feature of device C. After multiple iterations, the final output feature of device B retains its original abnormal features while incorporating the influence information from neighboring devices A and C. Simultaneously, the features of devices A and C also include the abnormal features of device B due to the aggregation process. After reaching a preset number of five aggregation rounds, the system outputs the final feature values ​​of the three devices as enhanced topology features. Among these, device B's feature is the most abnormal, reflecting not only its own problems but also the degree of impact on the entire network.

[0161] In this embodiment, the feature enhancement method uses iterative aggregation of graph neural networks to ensure that the features of each node contain information about its network neighbors. The generated enhanced topology features can more comprehensively and accurately reflect the true state of the avionics network, providing a more reliable basis for fault diagnosis.

[0162] Figure 2 A schematic diagram of an ARINC739 protocol avionics bus data parsing system provided in this application embodiment is shown below. Figure 2 As shown, the system includes:

[0163] The acquisition module 21 is used to acquire protocol data streams of the aviation bus, node connection data of the aviation bus network, and latency index data.

[0164] The generation module 22 is used to perform graph embedding processing on the node connection data and the delay index data to obtain a topology feature matrix, and generate a modulation feature stream based on the topology feature matrix.

[0165] The aggregation module 23 is used to aggregate the modulation feature stream using a graph neural network to generate enhanced topological features.

[0166] The extraction module 24 is used to extract the message header identifier field from the protocol data stream and perform hierarchical parsing operation on the message header identifier field through dynamic template matching.

[0167] The fusion module 25 is used to fuse the enhanced topology features and the hierarchical parsing results, and to perform anomaly detection processing on the fusion results to identify link failure modes.

[0168] Figure 2 The ARINC739 protocol avionics bus data parsing system described above can perform... Figure 1 The implementation principle and technical effects of the ARINC739 protocol avionics bus data parsing method described in the illustrated embodiment will not be repeated here. The specific methods by which each module and unit performs operations in the ARINC739 protocol avionics bus data parsing system described in the above embodiments have been described in detail in the embodiments related to this method, and will not be elaborated upon here.

[0169] In one possible design, Figure 2 The ARINC739 protocol avionics bus data parsing system of the embodiment shown can be implemented as a computing device, such as... Figure 3 As shown, the computing device may include a storage component 31 and a processing component 32;

[0170] The storage component 31 stores one or more computer instructions, wherein the one or more computer instructions are invoked and executed by the processing component 32.

[0171] The processing component 32 is used to perform the above. Figure 1 The embodiment describes a method for parsing ARINC739 protocol avionics bus data.

[0172] The processing component 32 may include one or more processors to execute computer instructions to complete all or part of the steps in the above-described method. Alternatively, the processing component may be implemented as one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to perform the above-described method.

[0173] Storage component 31 is configured to store various types of data to support operations at the terminal. The storage component can be implemented from any type of volatile or non-volatile storage device or a combination thereof, such as Static Random-Access Memory (SRAM), Electrically Erasable Programmable Read Only Memory (EEPROM), Erasable Programmable Read Only Memory (EPROM), Programmable Read Only Memory (PROM), Read Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0174] Of course, computing devices may also include other components, such as input / output interfaces, display components, communication components, etc.

[0175] Input / output interfaces provide interfaces between processing components and peripheral interface modules, which can be output devices, input devices, etc.

[0176] The communication components are configured to facilitate wired or wireless communication between computing devices and other devices.

[0177] The computing device can be a physical device or an elastic computing host provided by a cloud computing platform. In this case, the computing device can refer to a cloud server, and the aforementioned processing components, storage components, etc., can be basic server resources rented or purchased from the cloud computing platform.

[0178] This application also provides a computer storage medium storing a computer program, which, when executed by a computer, can perform the above-described functions. Figure 1 The embodiment shown illustrates a method for parsing ARINC739 protocol avionics bus data.

[0179] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0180] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0181] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0182] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A method for parsing ARINC739 protocol avionics bus data, characterized in that, include: Collect protocol data streams from the avionics bus, node connection data from the avionics bus network, and latency metrics. The node connection data and the delay index data are subjected to graph embedding processing to obtain a topology feature matrix, and a modulation feature stream is generated based on the topology feature matrix; The modulation feature stream is aggregated using a graph neural network to generate enhanced topological features; Extract the message header identifier field from the protocol data stream, and perform a layered parsing operation on the message header identifier field through dynamic template matching; The enhanced topology features and hierarchical parsing results are fused together, and anomaly detection processing is performed on the fused results to identify link failure modes; The step of performing hierarchical parsing of the message header identifier field through dynamic template matching includes: In the first layer, the type identifier, length value, and priority level are extracted from the common header area corresponding to the message header identifier field; Select the parsing template with the highest matching degree to the type identifier from the pre-stored parsing template library; Based on the parsing template, perform second-level and third-level hierarchical parsing operations on the message header identifier field; The step of performing second-level and third-level hierarchical parsing operations on the message header identifier field according to the parsing template includes: Based on the priority level and the parsing template, the encoded format data is parsed from the payload area adjacent to the common header area; In the third layer, the storage boundary of the variable-length data segment in the payload area is determined based on the length value and the encoding format data. A boundary verification operation is performed based on the storage boundary to confirm the valid data range of the variable-length data segment according to the boundary verification result.

2. The ARINC739 protocol avionics bus data parsing method according to claim 1, characterized in that, The step of parsing encoded format data from the payload region adjacent to the common header region based on the priority level and the parsing template includes: Based on the priority level, the parsing template is customized and extended to obtain the extended parsing template; Based on the extended parsing template, a binary data stream is extracted from the payload region immediately adjacent to the common header; Locate the format identifier in the binary data stream; Based on the format identifier, encoded data blocks are extracted from the binary data stream, and the encoded data blocks are mapped according to a preset structure to generate encoded format data.

3. The ARINC739 protocol avionics bus data parsing method according to claim 1, characterized in that, The process of fusing the enhanced topology features with the hierarchical parsing results and performing anomaly detection processing on the fused results to identify link failure modes includes: The enhanced topological features are combined with the type identifier, length value, and coordinate position data in the hierarchical parsing results to generate a fusion result. The coordinate position data is another data parsed from the payload region adjacent to the common head region. The fusion result is scanned in multiple dimensions, and the location of abnormal data is located based on the inconsistencies in the scan result; Based on the distribution characteristics of the abnormal data locations, the link failure mode is output.

4. The ARINC739 protocol avionics bus data parsing method according to claim 1, characterized in that, The process of performing graph embedding processing on the node connection data and the delay index data to obtain a topology feature matrix, and generating a modulation feature stream based on the topology feature matrix, includes: The node connection data is converted into a connection relationship matrix, and the latency index data is mapped into a latency matrix. The connection matrix and the delay matrix are superimposed to generate a topological feature matrix; The topological feature matrix is ​​subjected to modulation transformation to obtain modulation feature parameters; Based on the modulation feature parameters, a modulation feature sequence is generated, and the modulation feature sequence is used as a modulation feature stream.

5. The ARINC739 protocol avionics bus data parsing method according to claim 1, characterized in that, The process of aggregating the modulation feature stream using a graph neural network to generate enhanced topological features includes: Extract the wavelength feature values ​​corresponding to each node from the modulation feature stream; Through multi-round iterative aggregation operations of graph neural networks, the wavelength feature values ​​of each node are aggregated with the wavelength feature values ​​of adjacent nodes, and the result of each round of aggregation is used as the updated wavelength feature value of the corresponding node. When the aggregation round reaches the preset round threshold, the updated wavelength feature values ​​of all nodes are output as enhanced topology features.

6. An ARINC739 protocol avionics bus data parsing system, characterized in that, include: The acquisition module is used to acquire protocol data streams of the avionics bus, node connection data of the avionics bus network, and latency index data. The generation module is used to perform graph embedding processing on the node connection data and the delay index data to obtain a topology feature matrix, and generate a modulation feature stream based on the topology feature matrix; An aggregation module is used to aggregate the modulation feature stream using a graph neural network to generate enhanced topological features; The extraction module is used to extract the packet header identifier field from the protocol data stream and perform hierarchical parsing operation on the packet header identifier field through dynamic template matching; The fusion module is used to fuse the enhanced topology features and the hierarchical parsing results, and to perform anomaly detection processing on the fusion results in order to identify link failure modes; The step of performing hierarchical parsing of the message header identifier field through dynamic template matching includes: In the first layer, the type identifier, length value, and priority level are extracted from the common header area corresponding to the message header identifier field; Select the parsing template with the highest matching degree to the type identifier from the pre-stored parsing template library; Based on the parsing template, perform second-level and third-level hierarchical parsing operations on the message header identifier field; The step of performing second-level and third-level hierarchical parsing operations on the message header identifier field according to the parsing template includes: Based on the priority level and the parsing template, the encoded format data is parsed from the payload area adjacent to the common header area; In the third layer, the storage boundary of the variable-length data segment in the payload area is determined based on the length value and the encoding format data. A boundary verification operation is performed based on the storage boundary to confirm the valid data range of the variable-length data segment according to the boundary verification result.

Images