A network protocol intelligent extraction method based on a large language model and application thereof

Abstract

This invention relates to a method and application for intelligent extraction of network protocols based on a large language model. Taking network protocol specification text as the analysis object, it initializes various candidate prompt words and constructs a large language model to evaluate accuracy, format compliance, and coverage based on these candidate prompt words. Through iterative iteration combined with a preset prompt word variation mechanism, it optimizes the acquisition of various target prompt words. Furthermore, based on these target prompt words, it deepens the analysis and extraction of graphical descriptions. The large language model is applied to achieve efficient and accurate acquisition of target network protocol text regarding protocol message formats and protocol interaction processes. Compared with traditional methods, this design has significant advantages in accuracy, generalization ability, information utilization, and handling complex protocols, providing a more efficient and reliable approach for protocol specification extraction.

Description

Technical Field

[0001] This invention relates to a method and application for intelligent extraction of network protocols based on a large language model, belonging to the field of network protocol text extraction technology. Background Technology

[0002] Industrial control protocols are a key component of network-based collaborative manufacturing. While significantly improving the efficiency of interaction, organization, control, and management of numerous devices in a manufacturing system, they also face increasingly serious security risks. Industrial control systems use proprietary protocols to achieve communication between components, thereby controlling various industrial control devices within the network. The security of these protocols is crucial to the overall security of the entire industrial control system. Network protocols are the foundation of communication between devices and systems, but their analysis and implementation are complex. Furthermore, network protocols are diverse and complex, and traditional manual analysis and implementation are time-consuming and prone to errors.

[0003] Existing methods for extracting protocol message formats from protocol specification texts (such as RFC documents) rely on manual analysis, but can also utilize automated methods such as rule engines, natural language processing techniques (such as lexical and syntactic analysis, named entity recognition), formal methods, and deep learning (such as convolutional neural networks, recurrent neural networks) to extract protocol message formats from protocol specification texts.

[0004] Rule-based methods match and extract protocol specification text by defining a series of rules related to the protocol message format. Specifically, these rules can be defined based on the protocol's standard documentation or common format patterns, including message header structure, message body structure, and field types. When processing protocol specification text, the rule engine scans and parses the text according to these rules, identifying the message format parts that conform to the rules. The advantage of this method is that the extraction process has clear logic and interpretability, and it can efficiently and accurately extract message formats for protocols with well-defined rules. The disadvantage is that it requires significant upfront effort to develop comprehensive rules, and it has poor adaptability to protocol changes; if the protocol changes, the rules may need to be readjusted.

[0005] Natural Language Processing (NLP) methods include lexical analysis and syntactic analysis. Lexical analysis breaks down the protocol specification text into individual words or symbols, identifying key terms and vocabulary. Syntactic analysis parses the grammatical structure of sentences, understanding the relationships between their components. By analyzing these structures, information related to message format can be inferred, such as how message fields are combined.

[0006] Named Entity Recognition (NER) is specifically designed to identify entities with specific meanings in text, such as message types, field names, and data types in protocols. In protocol specification text, NER can accurately locate these key entities, providing a foundation for subsequent extraction of the complete message format. Furthermore, combined with other NLP techniques, it can extract protocol message formats more comprehensively. The advantage of NLP technology lies in its powerful processing capabilities for natural language text and its ability to adapt to a certain degree of text variation; however, for highly specialized and complex texts like protocol specifications, a large amount of training data and meticulous model tuning may be required to achieve ideal extraction results.

[0007] Deep learning-based methods, such as Convolutional Neural Networks (CNNs), have achieved great success in image processing and can also be applied to text processing. Specifically, protocol specification text can be transformed into a format suitable for CNN processing. CNNs can automatically extract local features from the text through convolutional layers. These features may correspond to key parts of the protocol message format, such as identifying specific recurring structural patterns in the text, thereby inferring the message format. The advantages of CNNs are their ability to automatically learn features and their strong ability to process large-scale data; however, training CNNs requires a large amount of labeled data, and the interpretability of the model is relatively poor. On the other hand, Recurrent Neural Networks (RNNs) and their variants (such as LSTM and GRU) can process text data with sequential characteristics and can consider the contextual relationships within the text. In protocol specification texts, message formats are often context-dependent. RNNs and their variants can better capture these relationships through memory mechanisms, thereby accurately extracting the protocol message format. However, RNNs may encounter gradient vanishing or exploding problems during training, requiring fine-tuning and optimization. Summary of the Invention

[0008] The technical problem to be solved by this invention is to provide a method for intelligent extraction of network protocols based on a large language model, optimize prompt words in the application of the large language model, and efficiently complete the extraction of network protocol text.

[0009] To solve the above-mentioned technical problems, the present invention adopts the following technical solution: The present invention designs a network protocol intelligent extraction method based on a large language model, and performs the following steps A to E to obtain the target prompt words for the network protocol text extraction corresponding to the large language model;

[0010] Step A. Initialize the number of iterations Based on a preset number of network protocol specification texts, the large language model is initialized to extract various prompt words from the protocol message format and protocol interaction process in each network protocol specification text, forming the first... In the next iteration, each candidate prompt word is analyzed, and then the process proceeds to step B.

[0011] Step B. Construct a scoring function based on accuracy, format compliance, and coverage to obtain the score. In the next iteration, each candidate prompt word corresponds to a score, and the candidate prompt words are sorted from highest to lowest score. A predetermined proportion of candidate prompt words are selected as the first in the filtering order. In the next iteration, each rating filter prompt word is used, and then proceed to step C;

[0012] Step C. Judgment Is it greater than or equal to the preset number of evaluation iterations? If yes, proceed to step D; otherwise, proceed to step E.

[0013] Step D. Obtain from the first The iteration continues to the... In each iteration, the highest score is determined, and it is checked whether the increase in the highest score is less than a preset stable increase threshold. If so, the next iteration... In each iteration, the scoring and filtering prompts constitute the target prompts extracted from the network protocol text corresponding to the large language model; otherwise, proceed to step E.

[0014] Step E. Based on the preset prompt word variation mechanism, for the first... In the next iteration, each scoring filter prompt word is processed using the Large Language Module to obtain the [number]th [item]. Each prompt word variant in the next iteration, combined with the first... In the next iteration, each rating filter prompt word is updated to form the first... +1 iterations for each candidate suggestion word, then targeting The value is incremented by 1 and the process returns to step B.

[0015] As a preferred technical solution of the present invention: in step A, the large language model is initialized to extract the various prompt words of the protocol message format and protocol interaction process in each network protocol specification text in the following manner;

[0016] Method a. Zero-sample hints: Following the order of coarse-grained extraction to fine-grained extraction, directly require the large language model to generate various hint words for extracting protocol message formats from network protocol specification text;

[0017] Method b. Few-sample prompts: The model is constructed with examples from various network protocol specification texts as references, requiring the large language model to extract various prompt words of the protocol message format from the network protocol specification text;

[0018] Method c. Task decomposition and combination: First, parse the specification text of each network protocol, extract all state names, and list all transition events based on each state name to form each sub-task. Then, construct a large language model to extract prompts for each sub-task from each network protocol specification text and combine them to form prompt words.

[0019] Step d. Layered message extraction: If the network protocol specification text has a nested or layered message structure, a large language model is constructed to recursively extract the prompt words of the nested fields in the protocol message format from the network protocol specification text.

[0020] Step e. Apply the preset large language model to extract each prompt word from the corresponding network protocol specification text.

[0021] As a preferred technical solution of the present invention: in step B, respectively targeting the first For each candidate prompt word in the next iteration, obtain the score corresponding to the candidate prompt word according to steps B1 to B2 as follows;

[0022] Step B1. Regarding accuracy, firstly, the large language model extracts each field from the network protocol specification text based on the candidate prompt words, constructs the first set, and obtains the number of fields in the first set. Simultaneously, based on the manually annotated fields of the candidate prompt words corresponding to each network protocol specification text, a second set is constructed, and the number of fields in the second set is obtained. Then determine the number of fields in the intersection of the first and second sets. And calculate the accuracy. Recall rate Finally press Obtain the accuracy score corresponding to the candidate prompt words. ;

[0023] Regarding format compliance, for each field extracted from the network protocol specification text by the large language model based on the candidate prompt words, it is determined whether the format of each field is legal. If it is, the format compliance score corresponding to the candidate prompt word is 1; otherwise, the format compliance score corresponding to the candidate prompt word is 0.

[0024] Regarding coverage, recall rate The coverage score that constitutes the candidate prompt words;

[0025] Step B2. Based on the preset weights corresponding to accuracy, format compliance, and coverage in that order. , , Accuracy scores for each candidate suggestion word The scores are weighted and calculated based on format compliance and coverage to obtain the scores corresponding to the candidate suggestions. .

[0026] As a preferred embodiment of the present invention, the preset prompt word variation mechanism in step E includes at least one of the following:

[0027] Prompt word variant mechanism a. Genetic algorithm crossover: Components in the score-selected prompt words are cross-recombined to generate prompt word variants;

[0028] b. Online learning mechanism: Based on the manually annotated fields of the scoring and filtering prompts corresponding to the standard texts of various network protocols, a large language model is applied to generate the constraints corresponding to the scoring and filtering prompts, and the prompts are combined with the scoring and filtering prompts to form prompt variants.

[0029] c. Multi-protocol adaptation: Based on the protocol message format of different protocols, a preset protocol identifier instruction is added to the scoring and filtering prompt words, including the protocol type and its corresponding operation extraction words, to form a prompt word variant; and a preset syntax-aware instruction is added to the scoring and filtering prompt words to adjust the field parsing rules, to form a prompt word variant.

[0030] cue word variant mechanism d. Multimodal cue fusion: If there are diagrams in the network protocol specification text, then generate diagram description instructions and text-diagram cross-validation instructions to form various cue word variants;

[0031] e. Adversarial optimization: Noise or ambiguous instructions are introduced for the scoring and filtering prompts, thus creating prompt variants.

[0032] Corresponding to the above, the technical problem that this invention also needs to solve is to provide an application of a network protocol intelligent extraction method based on a large language model, so as to optimize the obtained prompt words, further deepen the application of the large language model, and improve the extraction efficiency of network protocol text.

[0033] To solve the above-mentioned technical problems, the present invention adopts the following technical solution: The present invention designs an application of a network protocol intelligent extraction method based on a large language model, which performs the following steps. To the steps This enables the extraction of target network protocol text;

[0034] step The target network protocol text is preprocessed and updated, and then proceeds to the next step. ;

[0035] step The target network protocol text and various target prompts are input into a large language model. The large language model then parses the target network protocol text based on the target prompts to extract the protocol message format and protocol interaction process, and then proceeds to the next step. ;

[0036] step Locate the position and range of the graph description in the target network protocol text, apply a large language model to perform structured parsing and extract the graph description, obtain the graph extraction results, and then proceed to the next step. ;

[0037] step The extracted chart results are added to the protocol message format and protocol interaction process, and integrated into the target output format for output, thus completing the extraction of the target network protocol text.

[0038] As a preferred technical solution of the present invention, the steps The preprocessing and updating of the target network protocol text includes: first, removing irrelevant header information, table of contents, appendices, and redundant characters from the target network protocol text to achieve clean and updated target network protocol text; then, dividing the target network protocol text into segments according to a preset text block size to obtain the corresponding text blocks of the target network protocol text.

[0039] The steps In this process, for each text block corresponding to the target network protocol text, the text block and each target prompt word are input into the large language model. The large language model parses and extracts the text block according to each target prompt word, and obtains the extraction results. Then, the extraction results corresponding to each text block in the target network protocol text are obtained, which constitute the protocol message format and protocol interaction process in the target network protocol text.

[0040] The steps In this process, for each text block corresponding to the target network protocol text, the location and range of the chart description are located, and a large language model is applied to perform structured parsing and extraction of the chart description to obtain the chart extraction results.

[0041] As a preferred technical solution of the present invention: the steps First, the location and range of the chart description are located based on heuristic rules, and the field offset is matched by regular expressions. Then, a large language model is applied to perform structured parsing and extraction of the chart description to obtain the chart extraction result.

[0042] The steps In the process of supplementing the extracted chart results into the protocol message format and protocol interaction process, if the same field is described in both text and chart, the large language model is applied to remove duplicates and fill in the missing information to achieve enhanced understanding of the corresponding content.

[0043] As a preferred technical solution of the present invention: the steps After the extracted chart results are added to the protocol message format and protocol interaction process, error handling, including conflict detection and handling, self-consistency verification, and default value completion, is performed on the protocol message format and protocol interaction process. Finally, the results are integrated into the target output format for output, thus completing the extraction of the target network protocol text.

[0044] Correspondingly, the present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory. When the processor executes the program, it implements steps A to E of the prompt word optimization method, as well as the steps described in the application. To the steps .

[0045] The intelligent extraction method and application of network protocols based on a large language model described in this invention have the following technical advantages compared with existing technologies:

[0046] This invention designs a network protocol intelligent extraction method and application based on a large language model. Taking network protocol specification text as the analysis object, it initializes various candidate prompt words and constructs a large language model to evaluate the accuracy, format compliance, and coverage of network protocol specification text extraction based on the candidate prompt words. Through iterative iteration combined with a preset prompt word variant mechanism, it optimizes the acquisition of various target prompt words. Then, based on each target prompt word, it deepens the analysis and extraction of chart descriptions. The large language model is applied to achieve efficient and accurate acquisition of target network protocol text regarding protocol message format and protocol interaction process. Compared with traditional methods, the design scheme has significant advantages in terms of accuracy, generalization ability, information utilization, and handling of complex protocols, providing a more efficient and reliable approach for protocol specification extraction. Attached Figure Description

[0047] Figure 1 This is a schematic diagram of the architecture of a network protocol intelligent extraction method and application based on a large language model designed in this invention;

[0048] Figure 2 This is an example of a message format presented in ASCII charts in the implementation RFC. Detailed Implementation

[0049] The specific embodiments of the present invention will be further described in detail below with reference to the accompanying drawings.

[0050] Large language models possess strong semantic understanding capabilities and excel in natural language understanding. They can extract structured information from complex texts. Therefore, without relying on other tools, large language models can be used to parse communication protocol specifications and extract the message format and interaction process of the protocol through refined prompting engineering.

[0051] Specifically, this invention designs a method and application for intelligent extraction of network protocols based on a large language model. In practical applications, such as... Figure 1 As shown, the following steps A to E are first executed to implement the prompt word optimization method and obtain the target prompt words extracted from the network protocol text corresponding to the large language model.

[0052] Step A. Initialize the number of iterations Based on a preset number of network protocol specification texts, the large language model is initialized to extract various prompt words from the protocol message format and protocol interaction process in each network protocol specification text, forming the first... In the next iteration, each candidate prompt word is processed, and then step B is performed.

[0053] Regarding the design of initializing each prompt word in step A above, in specific design, a large language model (LLM) is used to directly generate or optimize multiple prompt variants, generating diverse initial candidate prompt words to cover possible extraction requirements, such as:

[0054] Variant 1: List all message fields and their bit lengths;

[0055] Variant 2: Returns field names, offsets, and descriptions in tabular form;

[0056] Variant 3: Generates JSON containing the fields name, bits, and constraints.

[0057] In practical applications, based on a preset number of network protocol specification texts, the large language model is initialized in the following ways to extract the protocol message format and protocol interaction process prompts from each network protocol specification text.

[0058] Method a. Zero-sample hints: Following the order of coarse-grained extraction to fine-grained extraction, directly require the large language model to generate various hint words for extracting protocol message formats from network protocol specification text.

[0059] In the application, coarse-grained extraction is performed first, identifying the macro structure of the message, such as listing all components of the message (e.g., Header, Payload, Trailer); then fine-grained extraction is performed, extracting each part field by field, such as parsing the fields of the Header part, including field name, offset (bits / byte), and whether it is optional.

[0060] Method b. Few-sample hints: The model is constructed with examples in the specifications of various network protocols as references. The large language model is required to extract the various hint words of the protocol message format from the specifications of the network protocols. That is, the large language model is guided by examples to avoid parsing difficulties caused by free text. In practical applications, such as the current protocol being TCP, an example is as follows.

[0061] Please refer to the following TCP field examples:

[0062] name: "ACK Number", bits: 32, description: "ACK Number"

[0063] Please extract the fields for the current protocol in a similar manner.

[0064] Method c. Task decomposition and combination: First, parse the specification text of each network protocol, extract all state names, and list all transition events based on each state name to form each sub-task. Then, construct a large language model to extract prompts for each sub-task from each network protocol specification text and combine them to form prompt words.

[0065] Step d. Layered message extraction: If the network protocol specification text has a nested or layered message structure, a large language model is constructed to recursively extract the prompt words of each nested field in the protocol message format from the network protocol specification text. For example: "Recursively extract all nested fields in the message until the lowest level basic type (such as int, string)."

[0066] Step e. Apply the preset large language model to extract the various prompt words corresponding to the network protocol specification text, such as example: name:"QNAME", bits: variable length, description:"DNS query domain name", please extract them in the same style.

[0067] In practical applications, taking RFC documents as an example, RFC (Request for Comments) is a standardized document describing network protocols. Its content includes natural language text, diagrams, state machine descriptions, etc. The protocol message format in an RFC typically includes the following:

[0068] Data packet header / tail structure: field name, length, and value (such as the sequence number and flags in the TCP header).

[0069] Field semantics: For example, SYN=1 indicates a connection request.

[0070] Encoding rules: such as Big-Endian, variable-length fields.

[0071] Example data packet: Examples in hexadecimal or ASCII form (e.g., 0x00 0x01 0x02).

[0072] The protocol interaction process in an RFC typically includes the following:

[0073] States: such as TCP's SYN_SENT and ESTABLISHED.

[0074] Events: such as receiving a SYN or sending an ACK.

[0075] Transitions: such as SYN_SENT → (received SYN+ACK) → ESTABLISHED.

[0076] Step B. Construct a scoring function based on accuracy, format compliance, and coverage to obtain the score. In the next iteration, each candidate prompt word corresponds to a score, and the candidate prompt words are sorted from highest to lowest score. A predetermined proportion of candidate prompt words are selected as the first in the filtering order. In the next iteration, each rating filter prompt is used, and then step C is performed.

[0077] In actual implementation, step B above is specifically for the first... For each candidate prompt in the next iteration, the specific design involves executing steps B1 to B2 to obtain the score corresponding to the candidate prompt.

[0078] Step B1. Regarding accuracy, firstly, the large language model extracts each field from the network protocol specification text based on the candidate prompt words, constructs the first set, and obtains the number of fields in the first set. Simultaneously, based on the manually annotated fields of the candidate prompt words corresponding to each network protocol specification text, a second set is constructed, and the number of fields in the second set is obtained. Then determine the number of fields in the intersection of the first and second sets. And calculate the accuracy. Recall rate Finally press Obtain the accuracy score corresponding to the candidate prompt words. .

[0079] Regarding format compliance, the large language model extracts each field from the network protocol specification text based on candidate prompts, and determines whether the format of each field is valid. In practical applications, such as the desired target field format being JSON or CSV, the model determines whether both of these field formats are valid. If they are, the format compliance score corresponding to the candidate prompt is 1; otherwise, the format compliance score corresponding to the candidate prompt is 0.

[0080] Regarding coverage, recall rate The coverage score that constitutes the candidate prompt words.

[0081] Step B2. Based on the preset weights corresponding to accuracy, format compliance, and coverage in that order. , , Accuracy scores for each candidate suggestion word The scores are weighted and calculated based on format compliance and coverage to obtain the scores corresponding to the candidate suggestions. In practical applications, such as design weights , , =0.2.

[0082] In step B above, regarding the selection of scoring suggestions, in practical applications, to ensure diversity, we can first deduplicate each candidate suggestion using semantic similarity (such as BERT embedding cosine distance), update the ranking of each candidate suggestion, and ensure that each candidate suggestion covers different strategies. Then, a predetermined proportion of candidate suggestions is set before the selection order, serving as the first... Each rating filter suggestion word in the next iteration.

[0083] The preset proportion of candidate prompts is used as the first step in the filtering order. Each rating filter suggestion word in the next iteration

[0084] Step C. Judgment Is it greater than or equal to the preset number of evaluation iterations? If yes, proceed to step D; otherwise, proceed to step E.

[0085] Step D. Obtain from the first The iteration continues to the... In each iteration, the highest score is determined, and it is checked whether the increase in the highest score is less than a preset stable increase threshold. If so, the next iteration... In each iteration, the scoring and filtering prompts constitute the target prompts extracted from the network protocol text corresponding to the large language model; otherwise, proceed to step E.

[0086] Step E. Based on at least one of the following preset cue word variation mechanisms, for the first... In the next iteration, each scoring filter prompt word is processed using the Large Language Module to obtain the [number]th [item]. Each prompt word variant in the next iteration, combined with the first... In the next iteration, each rating filter prompt word is updated to form the first... +1 iterations for each candidate suggestion word, then targeting The value is incremented by 1 and the process returns to step B.

[0087] Prompt word variant mechanism a. Genetic algorithm crossover: crossover and recombination are performed on the components (such as format description and examples) in the scoring and filtering prompt words to generate prompt word variants.

[0088] The prompt word variation mechanism (b) is an online learning mechanism. Based on the manually annotated fields of the scoring and filtering prompt words corresponding to the standard texts of various network protocols, a large language model is applied to generate constraints corresponding to the scoring and filtering prompt words. These constraints are then combined to form prompt word variations. In actual implementation, examples of the constraints generated here are as follows:

[0089] Add constraints: such as "ignore appendices and references";

[0090] Specify the format: such as "output must be a Python list";

[0091] Consider the context: for example, "If the text description is vague, refer to the chart first."

[0092] c. Multi-protocol adaptation: Based on the protocol message format of different protocols, preset protocol identifier instructions, including protocol type and its corresponding operation extraction words, are added to the scoring and filtering prompt words to form prompt word variants. Preset syntax-aware instructions are also added to the scoring and filtering prompt words to adjust the field parsing rules, forming prompt word variants.

[0093] In practical applications, multi-protocol adaptation can be implemented using protocol identification instructions such as: "If the current RFC describes the HTTP protocol, extract the Header field; if it is the CoAP protocol, extract the Options field"; and preset syntax awareness instructions such as: "Note: binary protocol fields are parsed in big-endian order, and text protocol fields are split by line."

[0094] cue word variant mechanism d. Multimodal cue fusion: If there are diagrams in the network protocol specification text, then generate diagram description instructions and text-diagram cross-validation instructions to form various cue word variants.

[0095] In the actual implementation of multimodal prompt fusion, examples of chart description instructions include: "Describe the content of the chart first, and then extract the state machine based on the description." Examples of text and chart cross-validation instructions include: "If the text and chart conflict, the chart shall prevail and the differences shall be marked."

[0096] The cue word variant mechanism e. Adversarial optimization introduces noise or fuzzy instructions to the scoring filter cue words, forming cue word variants. Examples of noise introduced here are such as "extract the state, even if the text description is incomplete", and examples of fuzzy instructions are such as "try to guess the possible state transitions", which are used to detect whether the large language model is over-associating.

[0097] By executing steps A through E above, the prompt word optimization method is implemented to obtain the target prompt words for extracting network protocol text corresponding to the large language model. This enables the extraction of target network protocol text in practical applications, and in implementation, such as... Figure 1 As shown, the specific design is implemented through the following steps. To the steps This enables the extraction of target network protocol text;

[0098] step The target network protocol text undergoes preprocessing and updating, including first removing irrelevant header information, table of contents, appendices, and redundant characters to clean and update the target network protocol text; then, the target network protocol text is segmented according to a preset text block size to obtain the corresponding text blocks, and then proceeds to the next step. .

[0099] The above steps In practical applications, irrelevant header information in the target network protocol text is removed, including RFC headers containing author names, page numbers, publication years, and tracking information, as they do not contribute to the protocol definition; the table of contents is removed because experiments have shown that it can cause misjudgments in the LLM; other content is also cleaned up, such as removing references, appendices, and redundant line breaks and whitespace characters.

[0100] The above steps The reason for segmenting the target network protocol text is that, according to the limitation of the context length of the large language model, the cleaned target network protocol text is segmented into 500-line segments to adapt to the maximum context length limit of the large language model. In addition, the text blocks contain both plain text and text graphs for subsequent extraction of finite state machines.

[0101] step For each text block corresponding to the target network protocol text, the text block and the target prompt words obtained in steps A to E above are input into the large language model. The large language model parses and extracts the text blocks based on the target prompt words, obtaining the extraction results. This yields the extraction results corresponding to each text block in the target network protocol text, constituting the protocol message format and protocol interaction process in the target network protocol text. Then, the process proceeds to the next step... .

[0102] In practical applications, since message formats are typically found in RFC texts, such as the Packet Format section, Message Structure section, Header Fields section, and section containing diagrams (ASCII or tables), the above steps... In practical applications, the large language model parses and extracts the above-mentioned sections of the text block based on the target prompts. The following is an example of asking the large language model a question.

[0103] "Please extract the detailed definition of the protocol message format from the following RFC text and output it in a structured format according to the following requirements:"

[0104] 1. Field extraction:

[0105] - List all field names in the message header or message body (e.g., "Source Port", "Sequence Number").

[0106] - Specify the data type of each field (e.g., uint8, uint16, string, flags).

[0107] - Specifies the offset and length of the field, in bits or bytes.

[0108] - If the field length is variable, specify the dependency condition (e.g., "the value of the Length field determines the length of Data").

[0109] 2. Formatting Guidelines:

[0110] - The output is in JSON format and contains the following keys.

[0111] -field_name: Field name (string).

[0112] -type: Data type (string).

[0113] -offset: Offset (number + unit, e.g., "4 bits").

[0114] -length: Length (number + unit or "variable").

[0115] -description: A brief description of the field's functionality (optional).

[0116] - Ignore all reserved or padding fields.

[0117] 3. Context processing:

[0118] - If field definitions are scattered across multiple chapters, merge all definitions and remove duplicates.

[0119] - If the text description conflicts with the figure, the figure shall prevail and the following shall be noted: "Conflict resolution: based on figure X".

[0120] Corresponding to the example above, the actual output example from the large language model is shown below.

[0121] {

[0122] "field_name":"Source Port",

[0123] "type":"uint16",

[0124] "offset":"0 bytes",

[0125] "length":"2 bytes",

[0126] "description": "source port number"

[0127] }

[0128] {

[0129] "field_name":"Content-Type",

[0130] "type":"string",

[0131] "offset":"variable",

[0132] "length":"variable",

[0133] "description": "Media type identifier"

[0134] }”

[0135] Furthermore, examples of constraints involved in the application include: "When the SYN flag is 1, it indicates a connection request."

[0136] In practical applications, message formats in RFCs are often represented using ASCII diagrams, such as... Figure 2 As shown.

[0137] Further steps are introduced as follows Design and application.

[0138] step For each text block corresponding to the target network protocol text, the position and range of the chart description are first located based on heuristic rules (such as +, -, +, |, etc.). Field offsets are then matched using regular expressions. A large language model is applied to perform structured parsing and extraction of the chart description, yielding the extracted chart results, which are then used in the next step. .

[0139] In practical applications, such as asking a large language model to parse a message header format chart and return it in JSON format according to field name, starting bit, and length (bits), the output example of the large language model is as follows.

[0140] {

[0141] "header_format":[

[0142] {"name":"Source Port","start_bit":8,"length":16},

[0143] {"name":"Destination Port","start_bit":16,"length":16} ]

[0145] }”

[0146] step The extracted chart results are then added to the protocol message format and protocol interaction process. If the same field is described in both the text and the chart, a large language model is applied to remove duplicates and fill in the missing information, thereby enhancing the understanding of the corresponding content. For example, the text description is: "The sequence number field occupies 32 bits and is used for packet sorting", and the chart description is: |Sequence Number (32 bits)|. The output example after processing by the large language model is as follows.

[0147] {

[0148] "name":"Sequence Number",

[0149] "bits":32,

[0150] "description": "Used for packet sorting"

[0151] }”

[0152] Then, for the protocol message format and protocol interaction process, error handling is performed, including conflict detection and handling, self-consistency verification, and default value completion. Finally, the protocol message format and protocol interaction process are integrated into the target output format for output, thus completing the extraction of the target network protocol text.

[0153] In practical applications, conflict detection and handling can be exemplified as follows: if a chart and text description conflict (e.g., inconsistent length), the conflict is flagged and the most likely correct value is selected based on the context; or if the description of the same field is inconsistent in the text and chart (e.g., length conflict), the Large Language Model (LLM) can flag the problem as shown in the example below.

[0154] Conflict detected:

[0155] -Text description: "The Flags field occupies 8 bits"

[0156] -Chart description: "The Flags field occupies 6 bits"

[0157] Please confirm the correct value.

[0158] Regarding self-consistency verification, this means allowing the large language model to self-verify the extraction results, as shown in the following example.

[0159] "Check if the following state machines are self-consistent:"

[0160] -Does an isolated state exist?

[0161] - Are all transformations explicitly triggered by a specific event?

[0162] Regarding default value completion, for fields that are not explicitly described (such as reserved bits), the Large Language Model (LLM) can infer the default value, such as the example: "Reserved fields should be 0 unless otherwise specified".

[0163] Finally, regarding "applying a large language model to perform structured parsing and extraction of chart descriptions to obtain chart extraction results," examples are as follows.

[0164] (1) Field alignment requirements for output results:

[0165] Explicitly specify the output format (such as JSON) to avoid large differences in the output results caused by free text, making it difficult to integrate the final results. An example is shown below.

[0166] "Return field information strictly according to the following JSON format:"

[0167] {

[0168] "fields":[

[0169] {"name":"Field name","bits":Length","description":"Semantic meaning"} ]

[0171] }”

[0172] (2) Results integration:

[0173] The JSON results extracted from each RFC block are combined in order. For ease of understanding, the large model can output a message in tabular format, as shown in the example below.

[0174] RFC 3550, titled "RTP: Real-Time Application Transport Protocol," defines the Real-Time Transport Protocol (RTP), which is widely used for transmitting audio and video over IP networks. RTP provides end-to-end network transport capabilities suitable for applications that transmit real-time data, such as interactive audio and video conferencing.

[0175] Key components of RTP include:

[0176] 1. RTP header format: Defines the structure of each RTP packet.

[0177] 2. RTCP (RTP Control Protocol): Provides feedback on the quality of data distribution and helps synchronize media streams.

[0178] 3. Packetization: Defines how media is encapsulated into RTP packets.

[0179] 4. Timing and Synchronization: Ensure the correct playback time of the media stream.

[0180] The important formatting elements, including fields, field lengths, and their meanings, are broken down as follows:

[0181] The RTP header format is defined in section 5.1 of RFC 3550. The RTP header has a fixed part, which can be followed by an optional CSRC (Contribution Source) identifier.

[0182] The RTP fixed header fields are shown in Table 1 below.

[0183] Table 1 RTP Fixed Header Fields

[0184]

[0185] The following is an example of the message interaction process of the output protocol.

[0186] Common RTCP packet types are shown in Table 2 below.

[0187] Table 2 Common RTCP packet types

[0188]

[0189] The message interaction process is as follows.

[0190] 1. Session initialization:

[0191] Participants join the RTP session and exchange initial RTCP packets (usually SR or RR).

[0192] 2. Data transmission:

[0193] RTP packets containing media payloads are transmitted periodically.

[0194] Each participant periodically sends an RTCP report (SR or RR) to provide feedback on session quality.

[0195] 3. Source identification:

[0196] Exchange SDES packets to provide a text description of the source.

[0197] 4. Participation ends:

[0198] When a participant leaves the session, it sends a BYE packet to notify other participants.

[0199] 5. Error monitoring:

[0200] The receiver uses SR / RR packets to calculate packet loss rate and jitter, and adjusts the playback buffer accordingly.

[0201] In practical applications, the above design scheme is further adapted to create an electronic device, including a memory, a processor, and a computer program stored in the memory. When the processor executes the program, it implements steps A to E of the prompt word optimization method, as well as the steps described in the application. To the steps .

[0202] The method and application for optimizing prompt words based on a large language model for network protocol extraction described in this invention have the following technical advantages compared with existing technologies:

[0203] This invention designs a network protocol intelligent extraction method and application based on a large language model. Taking network protocol specification text as the analysis object, it initializes various candidate prompt words and constructs a large language model to evaluate the accuracy, format compliance, and coverage of network protocol specification text extraction based on the candidate prompt words. Through iterative iteration combined with a preset prompt word variant mechanism, it optimizes the acquisition of various target prompt words. Then, based on each target prompt word, it deepens the analysis and extraction of chart descriptions. The large language model is applied to achieve efficient and accurate acquisition of target network protocol text regarding protocol message format and protocol interaction process. Compared with traditional methods, the design scheme has significant advantages in terms of accuracy, generalization ability, information utilization, and handling of complex protocols, providing a more efficient and reliable approach for protocol specification extraction.

[0204] Higher accuracy: Traditional methods, such as those based on semantic parsing and network tracking message analysis, are easily affected by factors such as text ambiguity and network environment complexity, leading to problems such as partial extraction and inaccurate probabilities in the extracted protocol FSM. This invention utilizes a large model combined with text and charts for extraction, enabling more accurate extraction of protocol state and transition information.

[0205] Greater generalization ability: Most traditional methods are highly targeted, relying on specific RFC document formats, predefined FSM syntax, or specific program environments, resulting in poor adaptability to different types of protocols. The method proposed in this invention does not rely on predefined state machine syntax. The large language model has been pre-trained on texts from multiple domains, can understand most RFC formats, and can better generalize to various different RFC documents, thus having a wider range of applications.

[0206] Low requirement for manually labeled data: The method proposed in this invention requires less pre-training data for manual labeling. Traditional deep learning-based information extraction methods rely on large amounts of high-quality labeled data, which is difficult and expensive to obtain in the field of network protocols. This invention uses prompting engineering technology to optimize prompts through strategies, rather than relying on large amounts of labeled data to train the model. Therefore, compared with traditional methods, this invention significantly reduces the requirement for manually labeled pre-training data when extracting protocol specifications.

[0207] Reduced human intervention: This invention reduces reliance on human intervention to some extent through a large language model and automated prompting engineering, but it has made significant progress in reducing human intervention compared to traditional methods.

[0208] The embodiments of the present invention have been described in detail above with reference to the accompanying drawings. However, the present invention is not limited to the above embodiments. Within the scope of knowledge possessed by those skilled in the art, various changes can be made without departing from the spirit of the present invention.

Claims

1. A method for intelligent extraction of network protocols based on a large language model, characterized in that, Perform steps A through E to obtain the target prompt words extracted from the network protocol text corresponding to the large language model; Step A. Initialize the number of iterations Based on a preset number of network protocol specification texts, the large language model is initialized to extract various prompt words from the protocol message format and protocol interaction process in each network protocol specification text, forming the first... In the next iteration, each candidate prompt word is analyzed, and then the process proceeds to step B. Step B. Construct a scoring function based on accuracy, format compliance, and coverage to obtain the score. In the next iteration, each candidate prompt word corresponds to a score, and the candidate prompt words are sorted from highest to lowest score. A predetermined proportion of candidate prompt words are selected as the first in the filtering order. In the next iteration, each rating filter prompt word is used, and then proceed to step C; In step B above, respectively for the first For each candidate prompt word in the next iteration, obtain the score corresponding to the candidate prompt word according to steps B1 to B2 as follows; Step B1. Regarding accuracy, the large language model first extracts each field from the network protocol specification text based on the candidate prompt words, constructs the first set, and obtains the number of fields in the first set. Simultaneously, based on the manually annotated fields of the candidate prompt words corresponding to each network protocol specification text, a second set is constructed, and the number of fields in the second set is obtained. Then determine the number of fields in the intersection of the first and second sets. And calculate the accuracy. Recall rate Finally press Obtain the accuracy score corresponding to the candidate prompt words. ; Regarding format compliance, for each field extracted from the network protocol specification text by the large language model based on the candidate prompt words, it is determined whether the format of each field is legal. If it is, the format compliance score corresponding to the candidate prompt word is 1; otherwise, the format compliance score corresponding to the candidate prompt word is 0. Regarding coverage, recall rate The coverage score that constitutes the candidate prompt words; Step B2. Based on the preset weights corresponding to accuracy, format compliance, and coverage in that order. , , Accuracy scores for each candidate suggestion word The scores are weighted and calculated based on format compliance and coverage to obtain the scores corresponding to the candidate suggestions. ; Step C. Judgment Is it greater than or equal to the preset number of evaluation iterations? If yes, proceed to step D; otherwise, proceed to step E. Step D. Obtain from the first The iteration continues to the... In each iteration, the highest score is determined, and it is checked whether the increase in the highest score is less than a preset stable increase threshold. If so, the next iteration... In each iteration, the scoring and filtering prompts constitute the target prompts extracted from the network protocol text corresponding to the large language model; otherwise, proceed to step E. Step E. Based on the preset prompt word variation mechanism, for the first... In the next iteration, each scoring filter prompt word is processed using the Large Language Module to obtain the [number]th [item]. Each prompt word variant in the next iteration, combined with the first... In the next iteration, each rating filter prompt word is updated to form the first... +1 iterations for each candidate suggestion word, then targeting The value is incremented by 1 and the process returns to step B; The preset prompt word variation mechanism in step E above includes at least one of the following: Prompt word variant mechanism a. Genetic algorithm crossover: Components in the score-selected prompt words are cross-recombined to generate prompt word variants; b. Online learning mechanism: Based on the manually annotated fields of the scoring and filtering prompts corresponding to the standard texts of various network protocols, a large language model is applied to generate the constraints corresponding to the scoring and filtering prompts, and the prompts are combined with the scoring and filtering prompts to form prompt variants. c. Multi-protocol adaptation: Based on the protocol message format of different protocols, a preset protocol identifier instruction is added to the scoring and filtering prompt words, including the protocol type and its corresponding operation extraction words, to form a prompt word variant; and a preset syntax-aware instruction is added to the scoring and filtering prompt words to adjust the field parsing rules, to form a prompt word variant. cue word variant mechanism d. Multimodal cue fusion: If there are diagrams in the network protocol specification text, then generate diagram description instructions and text-diagram cross-validation instructions to form various cue word variants; e. Adversarial optimization: Noise or ambiguous instructions are introduced for the scoring and filtering prompts, thus creating prompt variants.

2. The intelligent extraction method for network protocols based on a large language model according to claim 1, characterized in that: In step A, the large language model is initialized in the following ways to extract the various prompt words of the protocol message format and protocol interaction process from each network protocol specification text; Method a. Zero-sample hints: Following the order of coarse-grained extraction to fine-grained extraction, directly require the large language model to generate various hint words for extracting protocol message formats from network protocol specification text; Method b. Few-sample prompts: The model is constructed with examples from various network protocol specification texts as references, requiring the large language model to extract various prompt words of the protocol message format from the network protocol specification text; Method c. Task decomposition and combination: First, parse the specification text of each network protocol, extract all state names, and list all transition events based on each state name to form each sub-task. Then, construct a large language model to extract prompts for each sub-task from each network protocol specification text and combine them to form prompt words. Step d. Layered message extraction: If the network protocol specification text has a nested or layered message structure, a large language model is constructed to recursively extract the prompt words of the nested fields in the protocol message format from the network protocol specification text. Step e. Apply the preset large language model to extract each prompt word from the corresponding network protocol specification text.

3. The application of the intelligent network protocol extraction method based on a large language model as described in claim 1 or 2, characterized in that: Perform the following steps To the steps This enables the extraction of target network protocol text; step The target network protocol text is preprocessed and updated, and then proceeds to the next step. ; step The target network protocol text and various target prompts are input into a large language model. The large language model then parses the target network protocol text based on the target prompts to extract the protocol message format and protocol interaction process, and then proceeds to the next step. ; step Locate the position and range of the graph description in the target network protocol text, apply a large language model to perform structured parsing and extract the graph description, obtain the graph extraction results, and then proceed to the next step. ; step The extracted chart results are added to the protocol message format and protocol interaction process, and integrated into the target output format for output, thus completing the extraction of the target network protocol text.

4. The application of the intelligent network protocol extraction method based on a large language model according to claim 3, characterized in that, The steps The preprocessing and updating of the target network protocol text includes: first, removing irrelevant header information, table of contents, appendices, and redundant characters from the target network protocol text to achieve clean and updated target network protocol text; then, dividing the target network protocol text into segments according to a preset text block size to obtain the corresponding text blocks of the target network protocol text. The steps In this process, for each text block corresponding to the target network protocol text, the text block and each target prompt word are input into the large language model. The large language model parses and extracts the text block according to each target prompt word, and obtains the extraction results. Then, the extraction results corresponding to each text block in the target network protocol text are obtained, which constitute the protocol message format and protocol interaction process in the target network protocol text. The steps In this process, for each text block corresponding to the target network protocol text, the location and range of the chart description are located, and a large language model is applied to perform structured parsing and extraction of the chart description to obtain the chart extraction results.

5. The application of the intelligent network protocol extraction method based on a large language model according to claim 3, characterized in that: The steps First, the location and range of the chart description are located based on heuristic rules, and the field offset is matched by regular expressions. Then, a large language model is applied to perform structured parsing and extraction of the chart description to obtain the chart extraction result. The steps In the process of supplementing the extracted chart results into the protocol message format and protocol interaction process, if the same field is described in both text and chart, the large language model is applied to remove duplicates and fill in the missing information to achieve enhanced understanding of the corresponding content.

6. The application of the intelligent network protocol extraction method based on a large language model according to claim 5, characterized in that: The steps After the extracted chart results are added to the protocol message format and protocol interaction process, error handling, including conflict detection and handling, self-consistency verification, and default value completion, is performed on the protocol message format and protocol interaction process. Finally, the results are integrated into the target output format for output, thus completing the extraction of the target network protocol text.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory, characterized in that, When the processor executes the program, it implements steps A to E in the prompt word optimization method as described in claim 1 or 2, and implements the steps in the application as described in any one of claims 3-6. To the steps .

Images