Double-layer progressive unknown protocol semantic recognition method and device

Abstract

The embodiment of the invention discloses an unknown protocol semantic recognition method and device based on a double-layer progressive mode. A specific embodiment of the method comprises the steps of performing feature recognition on an acquired protocol field set to generate a recognition protocol field set; generating a combined non-associated field set and a verification associated field sequence according to the identification protocol field set; according to the obtained semantic annotation field data set, generating a semantic tag annotation feature vector set; performing feature standardization on the semantic tag mark feature vector set to generate a spliced feature vector; according to a preset field feature vector and the splicing feature vector, protocol field recognition semantics are determined; and combining the protocol field recognition semantics, the combined non-associated field set and the verification associated field sequence to obtain a combined recognition result. According to the embodiment, the field recognition coverage rate is increased, and the semantic recognition quality is improved.

Description

Technical Field

[0001] The embodiments of the present disclosure relate to the field of computer technology, and more particularly to a method and device for identifying unknown protocol semantics based on a double-layer progressive approach. Background Art

[0002] In the fields of network security and communications, reverse engineering of unknown protocols is crucial. Semantic recognition is a key step in determining the effectiveness of protocol analysis and generating protocol state machines. Currently, heuristic strategies and machine learning algorithms are commonly used for semantic recognition of unknown protocols based on a two-layer, progressive approach.

[0003] However, the inventors have discovered that when the above-mentioned method is used to identify unknown protocol semantics based on a two-layer progressive approach, the following technical problems often arise: Heuristic strategies often rely on predefined rules. When faced with a large number of unknown protocols, many protocol fields cannot be recognized, resulting in low field recognition coverage. Although machine learning methods can recognize some fields that cannot be defined using heuristic strategies, they are prone to feature confusion, resulting in poor semantic recognition quality.

[0004] The above information disclosed in this Background section is only for enhancement of understanding of the background of the inventive concept and therefore it may contain information that does not form the prior art that is already known to a person of ordinary skill in the art. Summary of the Invention

[0005] The content of this disclosure is used to briefly introduce concepts that will be described in detail in the detailed description section below. The content of this disclosure is not intended to identify key features or essential features of the claimed technical solution, nor is it intended to limit the scope of the claimed technical solution.

[0006] Some embodiments of the present disclosure propose a method and device for identifying unknown protocol semantics based on a two-layer progressive approach to solve the technical problems mentioned in the above background technology section.

[0007] In the first aspect, some embodiments of the present disclosure provide a method for identifying unknown protocol semantics based on a two-layer progressive approach, the method comprising: performing feature recognition on an acquired protocol field set to generate an identified protocol field set, wherein the identified protocol field set comprises: at least one associated field and at least one non-associated field; based on the identified protocol field set, generating a merged non-associated field set and verifying an associated field sequence; based on the acquired semantic annotation field data set, generating a semantic label marking feature vector set; performing feature normalization on the semantic label marking feature vector set to generate a spliced ​​feature vector, wherein the spliced ​​feature vector comprises: multiple field feature vectors and corresponding multiple field feature vector labels; determining the protocol field identification semantics based on a preset field feature vector and the spliced ​​feature vector; merging the protocol field identification semantics, the merged non-associated field set and the verification associated field sequence to obtain a merged identification result.

[0008] In the second aspect, some embodiments of the present disclosure provide an unknown protocol semantic recognition device based on a two-layer progressive method, the device including: an identification unit, configured to perform feature recognition on an acquired protocol field set to generate an identified protocol field set, wherein the identified protocol field set includes: at least one associated field and at least one non-associated field; a first generation unit, configured to generate a merged non-associated field set and a verification associated field sequence based on the identified protocol field set; a second generation unit, configured to generate a semantic label marking feature vector set based on the acquired semantic annotation field data set; a standardization unit, configured to perform feature standardization on the semantic label marking feature vector set to generate a spliced ​​feature vector, wherein the spliced ​​feature vector includes: multiple field feature vectors and corresponding multiple field feature vector labels; a determination unit, configured to determine the protocol field recognition semantics based on a preset field feature vector and the spliced ​​feature vector; a merging unit, configured to merge the protocol field recognition semantics, the merged non-associated field set and the verification associated field sequence to obtain a merged recognition result.

[0009] In a third aspect, some embodiments of the present disclosure provide an electronic device comprising: one or more processors; a storage device on which one or more programs are stored, and when the one or more programs are executed by one or more processors, the one or more processors implement the method described in any implementation of the first aspect above.

[0010] In a fourth aspect, some embodiments of the present disclosure provide a computer-readable medium having a computer program stored thereon, wherein when the program is executed by a processor, the method described in any implementation of the first aspect is implemented.

[0011] The above-mentioned various embodiments of the present disclosure have the following beneficial effects: through the unknown protocol semantic recognition method based on a two-layer progressive method in some embodiments of the present disclosure, the field recognition coverage is improved and the quality of semantic recognition is improved. Specifically, the reason for the low field recognition coverage and poor quality of semantic recognition is that the heuristic strategy often relies on predefined rules. When faced with a large number of unknown protocols, many protocol fields cannot be recognized, resulting in low field recognition coverage. Although the machine learning method can recognize some fields that cannot be defined by the heuristic strategy, it is prone to feature confusion, resulting in poor quality of semantic recognition. Based on this, some embodiments of the present disclosure are based on the unknown protocol semantic recognition method based on a two-layer progressive method, and a rule base based on domain knowledge is constructed to identify specific fields according to the structural characteristics, semantic characteristics and contextual relationships of the fields. For related fields, such as length fields, protocol message identification fields, etc., identification is performed by analyzing the numerical relationship, positional relationship and logical connection between fields; for non-related fields, such as fixed constant fields, serial number fields, etc., identification is performed based on their own typical characteristics. An over-partitioning optimization mechanism is introduced to merge adjacent static fields and semantically identical fields, reducing redundant recognition. A semantic conflict decision mechanism is designed, and a priority system for field recognition criteria is established to resolve field recognition conflicts and improve semantic recognition accuracy. After heuristically identifying some fields, training is performed using annotated protocol datasets to extract protocol features of known semantic fields, including byte value statistics, field length features, and other dimensions. The extracted features are normalized, including scaling, unifying feature types, and concatenating feature vectors. The KNN (K-Nearest Neighbor) algorithm is applied to compare the features of unrecognized fields with those of known fields. The semantic categories of the remaining fields are identified based on similarity, improving the completeness of semantic inference. This improves field recognition coverage and enhances the quality of semantic recognition. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] The above and other features, advantages, and aspects of the various embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and that components and elements are not necessarily drawn to scale.

[0013] Figure 1 is a flowchart of some embodiments of the unknown protocol semantic recognition method based on a double-layer progressive approach according to the present disclosure; Figure 2 1 is a schematic structural diagram of some embodiments of a double-layer progressive unknown protocol semantic recognition device according to the present disclosure; Figure 3is a diagram of a double-layer progressive semantic recognition architecture based on a double-layer progressive unknown protocol semantic recognition method according to some embodiments of the present disclosure; Figure 4 Schematic diagram of heuristic semantic recognition based on a double-layer progressive unknown protocol semantic recognition method in some embodiments of the present disclosure; Figure 5 1 is a schematic diagram of field merging based on a two-layer progressive unknown protocol semantic recognition method in some embodiments of the present disclosure; Figure 6 This is a KNN-based semantic recognition framework diagram of a two-layer progressive unknown protocol semantic recognition method according to some embodiments of the present disclosure; Figure 7 Schematic diagram of a KNN algorithm based on a double-layer progressive unknown protocol semantic recognition method in some embodiments of the present disclosure; Figure 8 Schematic diagram of the Euclidean distance of the unknown protocol semantic recognition method based on a double-layer progressive approach in some embodiments of the present disclosure; Figure 9 Schematic diagram of a cross-validation method based on a two-layer progressive unknown protocol semantic recognition method in some embodiments of the present disclosure; Figure 10 It is a structural diagram of an electronic device suitable for implementing some embodiments of the present disclosure. DETAILED DESCRIPTION

[0014] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments described herein. On the contrary, these embodiments are provided to provide a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are for illustrative purposes only and are not intended to limit the scope of protection of the present disclosure.

[0015] It should also be noted that, for ease of description, only the parts related to the invention are shown in the drawings. In the absence of conflict, the embodiments and features in the embodiments of the present disclosure may be combined with each other.

[0016] It should be noted that the concepts of "first" and "second" mentioned in this disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0017] It should be noted that the modifications of "one" and "multiple" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, they should be understood as "one or more".

[0018] The names of the messages or information exchanged between multiple devices in the embodiments of the present disclosure are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0019] The present disclosure will be described in detail below with reference to the accompanying drawings and in conjunction with embodiments.

[0020] Figure 1 This is a process 100 of some embodiments of the method for identifying unknown protocol semantics based on a double-layer progressive approach in some embodiments of the present disclosure. The method for identifying unknown protocol semantics based on a double-layer progressive approach includes the following steps: Step 101: perform feature recognition on the acquired protocol field set to generate an identified protocol field set.

[0021] In some embodiments, an execution subject (e.g., a computing device) of a two-layer progressive unknown protocol semantic recognition method can perform feature recognition on an acquired protocol field set through a wired connection or a wireless connection to generate an identified protocol field set, wherein the identified protocol field set includes: at least one associated field and at least one non-associated field.

[0022] Here, the at least one associated field may include but is not limited to at least one of the following: a length field, an identification field, a checksum field, and an address field. The at least one non-associated field may include but is not limited to at least one of the following: a constant field, a separator field, and a timestamp field. The composition of the associated field and the non-associated field is as follows: Figure 4 shown.

[0023] As an example, the execution entity may obtain a protocol field set via a wired or wireless connection. Feature extraction is then performed on the protocol field set to generate an extracted protocol field set. Finally, field recognition is performed on the extracted protocol field set using a recurrent neural network (RNN) to generate an identified protocol field set. Feature extraction may include extracting field length features.

[0024] It should be noted that the above wireless connection methods may include but are not limited to 3G / 4G connection, WiFi connection, Bluetooth connection, WiMAX connection, Zigbee connection, UWB (ultra wideband) connection, and other wireless connection methods currently known or to be developed in the future.

[0025] Step 102: Generate a merged non-associated field set and verify an associated field sequence based on the above-mentioned identification protocol field set.

[0026] In some embodiments, the execution entity may generate a merged non-associated field set and verify an associated field sequence based on the identification protocol field set.

[0027] Here, the above-mentioned merged non-associated field set may refer to a set of partially adjacent static non-associated fields merged together. For example, when two fields remain consistent in multiple messages and lack obvious separators, they can be merged into one field, similar to integrating multiple reserved fields or version number fields into a single field. The above-mentioned verification associated field sequence may refer to a set of associated fields sorted from high to low priority. Generate the merged non-associated field set and the verification associated field sequence as follows Figure 4 shown.

[0028] Optionally, the execution entity may generate a merged non-associated field set and verify an associated field sequence based on the identification protocol field set by performing the following steps: The first step is to generate a merged non-related field set based on at least one non-related field in the above-mentioned identification protocol field set.

[0029] Optionally, the execution entity may generate a merged non-related field set according to at least one non-related field in the identification protocol field set by performing the following steps: The first sub-step is to perform template matching on at least one non-correlated field in the above-mentioned identification protocol field set to generate a matching non-correlated field set.

[0030] Here, the template may refer to "a value range of [0, 65535]. When at least one non-associated field in the identification protocol field set conforms to the template, it is identified as a port number field.

[0031] As an example, the execution entity may match each non-associated field in the at least one non-associated field in the identification protocol field set with a template to generate matching non-associated fields and obtain a matching non-associated field set.

[0032] In a second sub-step, in response to determining that the adjacent fields in the matching non-correlated field set meet a preset first merging condition, at least one adjacent field meeting the preset first merging condition is merged to obtain a first merged non-correlated field set.

[0033] Here, the first merged non-related field set may refer to a non-related field set that meets a preset first merge condition. The preset first merge condition may refer to a preset "adjacent fields are static and have no separators." The merge may refer to a combination.

[0034] In a third sub-step, in response to determining that the adjacent fields in the matching non-correlated field set meet the preset second merging condition, at least one adjacent field meeting the preset second merging condition is merged to obtain a second merged non-correlated field set.

[0035] Here, the second merged non-related field set may refer to a non-related field set that meets the preset second merge condition. The preset second merge condition may refer to the preset "semantic identity and no separators". The merge may refer to a combination. Field merging is as follows: Figure 5 shown.

[0036] In a fourth sub-step, the first merged non-correlated field set and the second merged non-correlated field set are determined as a merged non-correlated field set.

[0037] The second step is to generate a verification associated field sequence based on at least one associated field in the above identification protocol field set.

[0038] Optionally, the execution entity may generate a verification associated field sequence according to at least one associated field in the identification protocol field set by performing the following steps: The first sub-step is to perform contextual association verification on at least one associated field in the above-mentioned identification protocol field set to generate a verification associated field set.

[0039] The second sub-step is to sort the verification-related field set according to the preset field priority to generate a verification-related field sequence.

[0040] Here, the above-mentioned preset field priority may refer to the pre-set "1: checksum field, 2: fixed constant field, 3: protocol message identification field, 4: sequence number field, 5: length field, 6: address field, 7: timestamp field, 8: floating point field, 9: discrete value field, 10: separator field, 11: padding field". Among them, the larger the sequence number, the lower the field priority. Figure 4 The priority is shown in the conflict decision table.

[0041] Step 103: Generate a semantic label feature vector set based on the acquired semantic annotation field dataset.

[0042] In some embodiments, the execution entity may generate a semantic label marking feature vector set based on the acquired semantic annotation field data set.

[0043] Here, the semantically annotated field dataset obtained above can be a data set of semantically annotated protocol fields obtained using a network packet capture tool (such as Wireshark). A semantically labeled feature vector set can refer to a set of feature vectors with semantic labels. These semantic labels can include, but are not limited to, at least one of the following: "source port, sequence number, destination port."

[0044] Optionally, the execution entity may generate a semantic label feature vector set based on the acquired semantic annotation field dataset by performing the following steps: The first sub-step is to perform the following processing steps for each semantically annotated field data in the acquired semantically annotated field dataset: Sub-step 1: extracting semantic features from the semantically annotated field data to generate a semantic feature group.

[0045] As an example, the execution entity may perform byte value statistical feature extraction on the semantically annotated field data to generate a byte value statistical feature group. The byte value statistical features include, but are not limited to, at least one of the following: the mean, standard deviation, and entropy of the field bytes. For example, the mean is 1234, the standard deviation is 0, and the entropy is 0. Next, field length feature extraction is performed on the semantically annotated field data to generate a field length feature group. The field length feature includes, but is not limited to, at least one of the following: the length of the field. For example, the length of the field is 2 bytes. Next, value range feature extraction is performed on the semantically annotated field data to generate a value range feature group. The value range feature includes the numerical range of the field. For example, the numerical range of the field is [0, 65535]. Finally, data type feature extraction is performed on the semantically annotated field data to generate a data type feature group. The data type feature includes the data type of the field value. For example, the data type of the field value can be an integer. Protocol hierarchy feature extraction is performed on the semantically annotated field data to generate a protocol hierarchy feature group. The protocol hierarchy feature represents the protocol level of the field. For example, the protocol hierarchy feature is "located at the source port position of the TCP protocol". The above byte value statistical feature group, the above data type feature group, the above value range feature group, the above protocol hierarchy feature set and the above field length feature group are determined as a semantic feature group. Figure 6 The protocol field feature library on the left is shown.

[0046] Sub-step 2: performing feature standardization processing on the above semantic feature group to generate a standardized semantic feature group.

[0047] As an example, the execution entity may standardize the byte value statistical features and field length features in the semantic feature group to generate a standardized semantic feature group. For example, the byte value statistical features and field length features may be standardized to ensure that all features are on a uniform scale.

[0048] Sub-step three: concatenate the standardized semantic features in the above-mentioned standardized semantic feature group to generate a concatenated semantic feature vector.

[0049] Here, the above-mentioned splicing may refer to merging.

[0050] Sub-step four: semantically label the concatenated semantic feature vector to generate a semantically labeled feature vector.

[0051] Here, the semantic label may refer to a port name, for example, a "source port".

[0052] The second sub-step is to determine the obtained semantic label feature vectors as a semantic label feature vector set.

[0053] Step 104 : normalize the features of the semantic tag feature vector set to generate a concatenated feature vector.

[0054] In some embodiments, the execution entity may perform feature normalization on the semantic tag feature vector set to generate a concatenated feature vector, wherein the concatenated feature vector includes: a plurality of field feature vectors and a plurality of corresponding field feature vector labels.

[0055] Optionally, the execution entity may perform feature normalization on the semantic label feature vector set to generate a concatenated feature vector by the following steps: In the first step, the above semantic label feature vector set is scale-normalized to generate a normalized feature vector set.

[0056] As an example, the execution entity may determine the field length features in the semantic tag feature vector set using a preset byte and normalize the byte value statistical features to generate a standardized feature vector set. The preset byte may be 2 bytes. The byte value statistical feature normalization may be "mean 1234, standard deviation 0, and entropy 0."

[0057] In the second step, feature type conversion is performed on the above-mentioned standardized feature vector set to generate a feature type feature vector group set, wherein the feature types of each feature type feature vector group in the above-mentioned feature type feature vector group set are different, and the feature types of each feature type feature vector of the feature type feature vector group in the above-mentioned feature type feature vector group set are the same.

[0058] Here, the feature type of each feature type feature vector group in the feature type feature vector group set may include but is not limited to at least one of the following: a numerical feature, a categorical feature, and a sequence feature.

[0059] The third step is to perform numerical conversion on the above feature type feature vector set to generate a numerical feature vector set.

[0060] As an example, the execution entity can analyze frequency features. If the features are discrete categorical data, they can be converted into numerical features by calculating their ratios. Bit pattern analysis can convert the frequency of 0s and 1s at each bit position into numerical features. Categorical features, due to their discrete nature, cannot be directly used in numerical calculations and therefore require one-hot encoding to convert them into numerical features.

[0061] The fourth step is to perform vector splicing on each numerical feature vector in the above numerical feature vector set to obtain a spliced ​​feature vector.

[0062] Here, each field is converted into a feature vector containing all semantic features and assigned a corresponding label. The above splicing can also refer to merging. Figure 6 Feature normalization is shown in the upper right.

[0063] Step 105: Determine the protocol field identification semantics based on the preset field feature vector and the above-mentioned concatenated feature vector.

[0064] In some embodiments, the execution entity may determine the protocol field identification semantics based on a preset field feature vector and the concatenated feature vector.

[0065] Here, the above-mentioned preset field feature vector may refer to the pre-set [0.15, 0.25, 0.35, 0.45].

[0066] Optionally, the execution entity may determine the protocol field identification semantics based on the preset field feature vector and the concatenated feature vector through the following steps: In the first step, the similarity between each field feature vector in the concatenated feature vector and the preset field feature vector is determined to generate a field feature vector distance and obtain a field feature vector distance set.

[0067] As an example, the execution subject can determine the similarity between each field feature vector in the above-mentioned spliced ​​feature vector and the preset field feature vector by using the Euclidean distance to generate the field feature vector distance and obtain the field feature vector distance set. For example, the above-mentioned Euclidean distance formula is ,in, and are the first two eigenvectors of Components. Assume that the feature vectors of each field in the above concatenated feature vector are {field 1: [0.1, 0.2, 0.3, 0.4]: "source port", field 2: [0.2, 0.3, 0.4, 0.5]: "destination port"}. Then the distance between the preset field feature vector and field 1 is The distance between the preset field feature vector and field 2 is: . Euclidean distance is as follows Figure 8 shown.

[0068] In the second step, the field feature vector distance set is subjected to preset nearest neighbor selection to obtain a field feature vector distance group.

[0069] Here, the above-mentioned preset nearest neighbor value is obtained through the following steps: First, the field feature vector distance set is divided into several subsamples as the training set, and then each subsample is used as the validation set in turn. The remaining data is used for K-Nearest Neighbor (KNN) model training. By looping through this process, the optimal K value is finally selected as the preset nearest neighbor value based on the comprehensive evaluation of each validation result. Assume that the preset nearest neighbor value is 2. Then the two nearest neighbors are {field 1: distance = 0.0707, label = "source port", field 2: distance = 0.0707, label = "destination port"}. The cross-validation method is as follows Figure 9 As shown in the figure, the K-Nearest Neighbor (KNN) algorithm measures the proximity of the target object to samples of known categories in the feature space for the sample to be identified. It then selects the nearest observation instances based on the preset K value and predicts the label of the new sample based on the labels of these K neighbors.

[0070] The third step is to perform semantic label statistics on the above field feature vector distance groups to generate statistical semantic label frequency groups.

[0071] As an example, the execution entity may count the semantic labels of each field feature vector distance in the field feature vector distance group to generate a statistical semantic label frequency, thereby obtaining a statistical semantic label frequency group. For example, the statistical semantic label frequency group may be "source port": 1 time, "destination port": 1 time.

[0072] In the fourth step, in response to determining that the frequencies of the statistical semantic tags in the above statistical semantic tag frequency group are the same, the field feature vector and field feature vector label corresponding to the smallest field feature vector distance in the above field feature vector distance group are determined as the protocol field identification semantics.

[0073] Here, the protocol field identification semantics may refer to the identification semantics of a preset field feature vector. The smallest field feature vector distance in the field feature vector distance group is field 1 or field 2.

[0074] Step 106: Merge the protocol field recognition semantics, the merged non-associated field set, and the verification associated field sequence to obtain a merged recognition result.

[0075] In some embodiments, the execution entity may combine the protocol field recognition semantics, the merged non-associated field set, and the verification associated field sequence to obtain a combined recognition result.

[0076] As an example, the execution subject may combine the protocol field recognition semantics, the merged non-associated field set and the verification associated field sequence to obtain a combined recognition result as the merged recognition result. Figure 3 As shown in FIG, the output result of the heuristic semantic recognition and the output result of the KNN semantic recognition are merged to obtain a merged recognition result.

[0077] Further references Figure 2 As an implementation of the methods shown in the above figures, the present disclosure provides some embodiments of a double-layer progressive unknown protocol semantic recognition device. These device embodiments are similar to Figure 1 Corresponding to the method embodiments shown, the unknown protocol semantic recognition device based on a double-layer progressive approach can be specifically applied to various electronic devices.

[0078] like Figure 2As shown, the unknown protocol semantic recognition device 200 based on a double-layer progressive approach in some embodiments includes: a recognition unit 201 , a first generation unit 202 , a second generation unit 203 , a standardization unit 204 , a determination unit 205 and a merging unit 206 . Among them, the identification unit 201 is configured to perform feature identification on the acquired protocol field set to generate an identification protocol field set, wherein the above-mentioned identification protocol field set includes: at least one associated field and at least one non-associated field; the first generation unit 202 is configured to generate a merged non-associated field set and a verification associated field sequence based on the above-mentioned identification protocol field set; the second generation unit 203 is configured to generate a semantic label marking feature vector set based on the acquired semantic annotation field data set; the standardization unit 204 is configured to perform feature standardization on the above-mentioned semantic label marking feature vector set to generate a spliced ​​feature vector, wherein the above-mentioned spliced ​​feature vector includes: multiple field feature vectors and corresponding multiple field feature vector labels; the determination unit 205 is configured to determine the protocol field identification semantics based on the preset field feature vector and the above-mentioned splicing feature vector; the merging unit 206 is configured to merge the above-mentioned protocol field identification semantics, the above-mentioned merged non-associated field set and the above-mentioned verification associated field sequence to obtain a merged identification result.

[0079] It can be understood that the units recorded in the unknown protocol semantic recognition device 200 based on the double-layer progressive method are similar to the reference Figure 1 Therefore, the operations, features and beneficial effects described above for the method are also applicable to the unknown protocol semantic recognition device 200 based on the double-layer progressive method and the units contained therein, and will not be repeated here.

[0080] Reference below Figure 10 , which shows a structural schematic diagram of an electronic device (eg, a computing device) suitable for implementing some embodiments of the present disclosure. Figure 10 The electronic device shown is only an example and should not limit the functions and scope of use of the embodiments of the present disclosure. Figure 10 As shown, the computer device includes a processor, a memory and a network interface connected via a system bus, wherein the memory may include a non-volatile storage medium and an internal memory. The non-volatile storage medium may store an operating system and a computer program. The computer program includes program instructions, which, when executed, may enable the processor to execute any of the above methods. The processor is used to provide computing and control capabilities to support the operation of the entire computer device. The internal memory provides an environment for the operation of the computer program in the non-volatile storage medium, which, when executed by the processor, may enable the processor to execute any of the above methods. The network interface is used for network communication, such as sending assigned tasks, etc. Those skilled in the art will understand that Figure 10The structure shown in the figure is merely a block diagram of a portion of the structure related to the solution of the present disclosure, and does not constitute a limitation on the computer device to which the solution of the present disclosure is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0081] It should be understood that the processor may be a central processing unit (CPU), other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor, etc.

[0082] In one embodiment, the processor is used to run a computer program stored in a memory to implement the following steps: performing feature recognition on the acquired protocol field set to generate an identified protocol field set, wherein the identified protocol field set includes: at least one associated field and at least one non-associated field; based on the identified protocol field set, generating a merged non-associated field set and verifying an associated field sequence; based on the acquired semantic annotation field data set, generating a semantic label marking feature vector set; performing feature normalization on the semantic label marking feature vector set to generate a spliced ​​feature vector, wherein the spliced ​​feature vector includes: multiple field feature vectors and corresponding multiple field feature vector labels; determining the protocol field identification semantics based on the preset field feature vector and the spliced ​​feature vector; merging the protocol field identification semantics, the merged non-associated field set and the verification associated field sequence to obtain a merged identification result.

[0083] An embodiment of the present disclosure further provides a computer-readable storage medium, on which a computer program is stored. The computer program includes program instructions. The method implemented when the program instructions are executed can refer to the various embodiments of the method described above in the present disclosure.

[0084] The computer-readable storage medium may be an internal storage unit of the computer device described in the aforementioned embodiment, such as a hard disk or memory of the computer device. The computer-readable storage medium may also be an external storage device of the computer device, such as a plug-in hard disk, a SmartMedia Card (SMC), a Secure Digital (SD) card, a flash memory card, etc., provided on the computer device.

[0085] It should be noted that, in this document, the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or system comprising a series of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or system. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or system comprising the element.

[0086] The above descriptions are merely some preferred embodiments of the present disclosure and illustrate the underlying technical principles. Those skilled in the art should understand that the scope of the invention encompassed by the embodiments of the present disclosure is not limited to technical solutions formed by specific combinations of the aforementioned technical features. It also encompasses other technical solutions formed by any combination of the aforementioned technical features or their equivalents, without departing from the aforementioned inventive concept. For example, a technical solution formed by replacing the aforementioned features with (but not limited to) technical features with similar functions disclosed in the embodiments of the present disclosure.

Claims

1. A method for semantic recognition of unknown protocols based on a two-layer progressive approach, characterized in that: include: Performing feature recognition on the acquired protocol field set to generate an identification protocol field set, wherein the identification protocol field set includes: at least one associated field and at least one non-associated field; Generate a merged non-associated field set and verify an associated field sequence based on the identification protocol field set; Generate a semantic label feature vector set based on the acquired semantic annotation field dataset; Normalizing the semantic label feature vector set to generate a concatenated feature vector, wherein the concatenated feature vector includes: a plurality of field feature vectors and a plurality of corresponding field feature vector labels; Determining the protocol field identification semantics based on the preset field feature vector and the concatenated feature vector; The protocol field recognition semantics, the merged non-associated field set and the verification associated field sequence are merged to obtain a merged recognition result.

2. The method according to claim 1, characterized in that The step of generating a merged non-associated field set and verifying an associated field sequence according to the identification protocol field set includes: generating a merged non-associated field set according to at least one non-associated field in the identification protocol field set; A verification associated field sequence is generated according to at least one associated field in the identification protocol field set.

3. The method according to claim 2, characterized in that The step of generating a verification associated field sequence according to at least one associated field in the identification protocol field set includes: Performing contextual verification on at least one associated field in the identification protocol field set to generate a verification associated field set; The verification-related field set is sorted according to preset field priorities to generate a verification-related field sequence.

4. The method according to claim 2, characterized in that The generating a merged non-associated field set according to at least one non-associated field in the identification protocol field set includes: performing template matching on at least one non-associated field in the identification protocol field set to generate a matching non-associated field set; In response to determining that the adjacent fields in the matching non-associated field set meet a preset first merging condition, merging at least one adjacent field that meets the preset first merging condition to obtain a first merged non-associated field set; In response to determining that the adjacent fields in the matching non-associated field set meet the preset second merging condition, merging at least one adjacent field that meets the preset second merging condition to obtain a second merged non-associated field set; The first merged non-associated field set and the second merged non-associated field set are determined as a merged non-associated field set.

5. The method according to claim 1, wherein Generating a semantic label feature vector set based on the acquired semantic annotation field data set includes: For each semantically annotated field data in the obtained semantically annotated field dataset, perform the following processing steps: Extracting semantic features from the semantically annotated field data to generate a semantic feature group; performing feature standardization processing on the semantic feature group to generate a standardized semantic feature group; splicing the standardized semantic features in the standardized semantic feature group to generate a spliced ​​semantic feature vector; Performing semantic label marking on the concatenated semantic feature vector to generate a semantic label marked feature vector; The obtained semantic label marking feature vectors are determined as a semantic label marking feature vector set.

6. The method according to claim 1, wherein The step of normalizing the semantic label feature vector set to generate a concatenated feature vector includes: Performing scale normalization processing on the semantic label marked feature vector set to generate a normalized feature vector set; Performing feature type conversion on the standardized feature vector set to generate a feature type feature vector group set, wherein the feature types of the feature type feature vector groups in the feature type feature vector group set are different, and the feature types of the feature type feature vectors of the feature type feature vector groups in the feature type feature vector group set are the same; Performing numerical conversion on the feature type feature vector set to generate a numerical feature vector set; Perform vector splicing on each numerical feature vector in the numerical feature vector set to obtain a spliced ​​feature vector.

7. The method according to claim 1, characterized in that The determining of the protocol field identification semantics according to the preset field feature vector and the concatenated feature vector includes: Determining the similarity between each field feature vector in the concatenated feature vector and a preset field feature vector to generate a field feature vector distance, thereby obtaining a field feature vector distance set; Performing preset nearest neighbor selection on the field feature vector distance set to obtain a field feature vector distance group; Performing semantic label statistics on the field feature vector distance group to generate a statistical semantic label frequency group; In response to determining that the statistical semantic tag frequencies in the statistical semantic tag frequency group are the same, the field feature vector and field feature vector label corresponding to the smallest field feature vector distance in the field feature vector distance group are determined as protocol field identification semantics.

8. A device for identifying unknown protocol semantics based on a double-layer progressive approach, characterized in that: include: an identification unit configured to perform feature identification on the acquired protocol field set to generate an identification protocol field set, wherein the identification protocol field set includes: at least one associated field and at least one non-associated field; a first generating unit configured to generate a merged non-associated field set and a verification associated field sequence according to the identification protocol field set; A second generating unit is configured to generate a semantic label marking feature vector set based on the acquired semantic annotation field data set; a normalization unit configured to perform feature normalization on the semantic tag feature vector set to generate a concatenated feature vector, wherein the concatenated feature vector includes: a plurality of field feature vectors and a plurality of corresponding field feature vector labels; a determining unit configured to determine the protocol field identification semantics based on the preset field feature vector and the concatenated feature vector; The merging unit is configured to merge the protocol field recognition semantics, the merged non-associated field set and the verification associated field sequence to obtain a merged recognition result.

9. An electronic device, characterized in that: include: one or more processors; a storage device having one or more programs stored thereon; When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 7.

10. A computer-readable medium, characterized in that A computer program is stored thereon, wherein when the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images