Communication fault sniffing method and system based on Internet of Things

Abstract

The invention discloses a communication fault sniffing method and system based on the Internet of Things, and relates to the technical field of communication fault sniffing. Stable structure fields in a message can still be recognized in an unknown protocol or private protocol scene through entropy-driven anchor point positioning, and the communication fault sniffing efficiency is improved. Illegal flow misjudgment caused by unregistered protocols or instantaneous distortion is avoided, so that key control instructions such as equipment sudden stop signals cannot be mistakenly discarded, and the industrial communication reliability is improved; an offset checking mechanism based on Poisson distribution is adopted, and protocol drift caused by electromagnetic interference, high-temperature thermal noise and the like is recognized as repairable structural distortion instead of permanent faults; and the original semantic rule is reserved by reconstructing the field index mapping, so that the system can still correctly analyze the message during the interference duration, and the non-planned shutdown of a production line caused by communication false alarm triggering is reduced.

Description

Technical Field

[0001] This invention relates to the field of communication fault detection technology, and in particular to a communication fault detection method and system based on the Internet of Things. Background Technology

[0002] Industrial Internet of Things (IIoT) is widely used in steel smelting, chemical production and other scenarios, with devices relying on protocols such as Modbus / TCP and Profinet for real-time data interaction.

[0003] However, harsh operating conditions such as high temperature and strong electromagnetic interference can cause structural distortions in communication messages, such as field bit offsets and length field expansions. Although traditional sniffing systems can detect data anomalies, they cannot distinguish between valid data mutations and protocol format corruption. For example, in a high-temperature rolling mill control system, temperature values ​​may be misinterpreted as pressure parameters due to bit offsets, triggering equipment malfunctions. Existing sniffers still alarm for data exceeding limits based on fixed templates, failing to address the root cause at the protocol layer.

[0004] Current mainstream solutions employ dynamic protocol identification technology, such as eBPF stream parsing in microservice architectures, which adaptively parses packets by matching protocol fingerprint databases. However, this only works when the protocol completely matches a known fingerprint, and it has no response capability to unregistered private protocols or real-time distortions, such as instantaneous bit flips. Distorted packets are directly classified as illegal traffic and discarded, resulting in the loss of critical control commands, such as emergency shutdown signals. Therefore, there is an urgent need for a communication fault sniffing solution based on the Internet of Things to solve such problems. Summary of the Invention

[0005] In view of the aforementioned existing problems, the present invention is proposed.

[0006] This invention provides a communication fault sniffing method and system based on the Internet of Things to solve the problems of protocol distortion caused by harsh industrial operating conditions and misjudgment and instruction loss caused by traditional static sniffing rules.

[0007] To solve the above-mentioned technical problems, the present invention provides the following technical solution:

[0008] In a first aspect, embodiments of the present invention provide a communication fault detection method based on the Internet of Things, comprising,

[0009] Step S1: Capture communication packets of industrial equipment through the sniffing agent of the edge gateway and generate raw byte stream data;

[0010] Step S2: Identify protocol anchors in the original byte stream. The protocol anchor is the low-entropy value field in the message.

[0011] Step S3: Calculate the sequence of position offsets of the protocol anchor points between consecutive messages;

[0012] Step S4: When the offset sequence conforms to the preset physical interference distribution model, dynamic reconstruction of the parsing template is triggered.

[0013] Step S5: Update the message field index mapping relationship based on the offset distribution pattern to generate a lightweight parsing template;

[0014] Step S6: Synchronize the lightweight parsing template to the associated terminal device.

[0015] In a preferred embodiment of the IoT-based communication fault detection method of the present invention, the low-entropy value field in step S2 is identified in the following manner:

[0016] The message is divided into byte segments using a fixed window, and the entropy value of each byte segment is calculated.

[0017] When the entropy value of a certain byte segment is lower than the dynamic threshold, it is marked as a protocol anchor point;

[0018] The entropy value is calculated using Shannon entropy, and the dynamic threshold is set based on the median of historical message entropy values.

[0019] In a preferred embodiment of the IoT-based communication fault detection method of the present invention, step S2, identifying low-entropy protocol anchor points, includes:

[0020] Calculate the window division and number, and divide the captured raw byte stream by length. The number of windows is defined as follows:

[0021] ,

[0022] in, Indicates the total length of the byte stream. This indicates the number of bytes contained in a single window. This indicates the number of windows obtained from the partitioning;

[0023] Estimate the probability of bytes within the window, and denote it as follows: Each window is its internal byte value The probability of its occurrence is:

[0024] ,

[0025] in, The window number is the value to be used. The byte value sequence number is used to determine the value. , Represents byte value In the window The number of times it appears in This indicates the probability of occurrence.

[0026] Calculate Shannon entropy, window The Shannon entropy is:

[0027] ,

[0028] in, Display window Shannon entropy;

[0029] Take the historical window entropy set We construct a dynamic threshold from the median, and obtain:

[0030] ,

[0031] in, Indicates the first in history Shannon entropy of a window, Indicates the number of historical windows. Indicates a dynamic threshold;

[0032] Introducing deviation coefficient A low-entropy threshold is established, and the bandwidth threshold is adjusted using the following formula:

[0033] ,

[0034] in, The deviation coefficient, range This indicates the threshold for determining low entropy.

[0035] Perform protocol anchor point determination, when When established, the window The starting byte index is marked as the protocol anchor.

[0036] In a preferred embodiment of the IoT-based communication fault detection method of the present invention, the physical interference distribution model in step S4 is a Poisson distribution model, and the determination logic includes:

[0037] Perform a Poisson distribution fit test on the offset sequence;

[0038] If the goodness of fit is higher than the set standard, it is determined to meet the physical interference characteristics.

[0039] As a preferred embodiment of the communication fault detection method based on the Internet of Things described in this invention, in step S4, a Poisson distribution fitting test is performed on the offset sequence, the steps of which include:

[0040] Construct an offset sequence, defining the absolute position difference of the protocol anchor points between two consecutive frames as:

[0041] ,

[0042] in, Indicates the first An offset, Indicates the first The starting byte index of the frame anchor point, This indicates the number of frame pairs whose offsets can be calculated;

[0043] Taking the sample mean as the parameter of the Poisson distribution, it is expressed as:

[0044] ,

[0045] in, The fitted Poisson intensity parameters are in bytes.

[0046] Perform frequency statistics and grouping, and let the set of offset values ​​be . ;remember

[0047] ,

[0048] in, Indicates the value to be The number of times the offset occurs. For indicator functions, Use the index of the offset value. The observation with the largest offset; if it exists Merge adjacent high-order intervals until the desired frequency constraint is met;

[0049] The formula for calculating the expected frequency is:

[0050] ,

[0051] in, Indicates the offset value The expected number of occurrences under the Poisson model for factorial;

[0052] Chi-square goodness-of-fit statistic

[0053] ,

[0054] in, Chi-square statistic is used to measure the degree of deviation between the observed distribution and the theoretical Poisson distribution;

[0055] Perform a degree of freedom and significance test, expressed as:

[0056] ,

[0057] in, The degrees of freedom are subtracted by 1 for probability and constraints, and then subtracted by 1 again for parameter estimation. For degrees of freedom The chi-square cumulative distribution function, The p-value represents the goodness of fit.

[0058] Set the decision threshold ;like If the offset is considered to conform to the Poisson distribution characteristics, dynamic reconstruction of the parsing template is triggered.

[0059] As a preferred embodiment of the communication fault detection method based on the Internet of Things described in this invention, the operation of updating the field index mapping relationship in step S5 includes:

[0060] Extract the modulo value of the current offset as the base offset;

[0061] Shift the original protocol field index by the baseline offset;

[0062] Preserve field data types and semantic constraint rules.

[0063] Secondly, the present invention provides a communication fault detection system based on the Internet of Things, comprising,

[0064] The message capture module, deployed on the edge gateway, is used to intercept the raw byte stream of industrial equipment communications;

[0065] An anchor point tracing engine, connected to the message capture module, includes:

[0066] Entropy calculation unit performs window segmentation and entropy analysis on byte streams;

[0067] Offset statistics unit calculates the sequence of anchor point position differences for consecutive messages;

[0068] The dynamic reconstruction module performs a field index shift operation when the sequence passes the Poisson distribution test.

[0069] The template synchronization interface sends the field index table to the terminal device via the MQTT protocol.

[0070] In a preferred embodiment of the IoT-based communication fault detection system described in this invention, the entropy calculation unit performs:

[0071] Divide the byte stream into segments of equal length;

[0072] Count the frequency of occurrence of byte values ​​in each sub-segment;

[0073] Calculate the Shannon entropy value based on the frequency distribution.

[0074] As a preferred embodiment of the IoT-based communication fault detection system described in this invention, the dynamic reconstruction module includes:

[0075] Offset mode extractor determines the baseline translation amount;

[0076] The field index resetter updates the starting position index of the original protocol field according to the baseline shift amount;

[0077] Semantic rule inheritor, preserving field length, data type, and validation rules.

[0078] As a preferred embodiment of the IoT-based communication fault detection method of the present invention, the lightweight parsing template in step S6 includes:

[0079] The translated field position index table;

[0080] The tolerance threshold for each field allows for offset fluctuations within the threshold range;

[0081] Protocol semantic rule check code.

[0082] The beneficial effects of this invention are as follows: By using entropy-driven anchor point positioning, this invention can still identify stable structural fields in messages even in scenarios with unknown or proprietary protocols. Compared to traditional predefined fingerprint database solutions, it avoids misjudgments of illegal traffic caused by unregistered protocols or transient distortions, ensuring that critical control commands such as equipment emergency stop signals are not incorrectly discarded, thus improving the reliability of industrial communication. It employs a Poisson distribution-based offset verification mechanism to identify protocol drift caused by electromagnetic interference, high-temperature thermal noise, etc., as repairable structural distortions rather than permanent faults. By reconstructing field index mappings and preserving the original semantic rules, the system can still correctly parse messages during periods of persistent interference, reducing unplanned downtime on production lines triggered by communication misreporting.

[0083] Furthermore, this invention employs a lightweight parsing template containing only a field index table and tolerance thresholds, synchronized to the terminal device via the MQTT protocol. The terminal can achieve drift-adaptive parsing without a complete protocol stack, significantly reducing the memory and computing power requirements of embedded devices and supporting the integration of older industrial equipment into the IoT system. The edge-side sniffing agent directly captures communication packets, and protocol anchor tracking and dynamic reconstruction are both completed at the gateway, without requiring modification to existing industrial equipment firmware or communication protocols. A rule inheritor ensures compatibility between the reconstructed protocol and the original system, mitigating compatibility risks during production line upgrades. A rolling dynamic entropy threshold and a configurable goodness-of-fit threshold enable the system to adapt to different factory environments. An offset tolerance mechanism allows packets to fluctuate within the threshold range, avoiding parsing jitter caused by frequent reconstructions. Attached Figure Description

[0084] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0085] Figure 1 This is a flowchart illustrating a communication fault detection method based on the Internet of Things (IoT) in Example 1.

[0086] Figure 2 This is a schematic diagram of the framework of an IoT-based communication fault detection system in Example 1. Detailed Implementation

[0087] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0088] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.

[0089] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The phrase "in one embodiment" appearing in different places in this specification does not necessarily refer to the same embodiment, nor is it a single or selective embodiment that is mutually exclusive with other embodiments.

[0090] Example 1, referring to Figure 1 and Figure 2 This embodiment provides a communication fault detection method based on the Internet of Things, including the following steps:

[0091] Step S1: Capture communication packets of industrial equipment through the sniffing agent of the edge gateway and generate raw byte stream data;

[0092] Step S2: Identify the protocol anchor point in the original byte stream. The protocol anchor point is the low-entropy value field in the message.

[0093] In step S2, the low-entropy value field is identified in the following way:

[0094] The message is divided into byte segments using a fixed window, and the entropy value of each byte segment is calculated.

[0095] When the entropy value of a certain byte segment is lower than the dynamic threshold, it is marked as a protocol anchor point;

[0096] Entropy values ​​are calculated using Shannon entropy, and the dynamic threshold is set based on the median of historical message entropy values.

[0097] In step S2, identifying low-entropy protocol anchor points includes:

[0098] Calculate the window division and number, and divide the captured raw byte stream by length. The number of windows is defined as follows:

[0099] ,

[0100] in, Indicates the total length of the byte stream. This indicates the number of bytes contained in a single window. This indicates the number of windows obtained from the partitioning;

[0101] Estimate the probability of bytes within the window, and denote it as follows: Each window is its internal byte value The probability of its occurrence is:

[0102] ,

[0103] in, The window number is the value to be used. The byte value sequence number is used to determine the value. , Represents byte value In the window The number of times it appears in This indicates the probability of occurrence.

[0104] Calculate Shannon entropy, window The Shannon entropy is:

[0105] ,

[0106] in, Display window Shannon entropy;

[0107] Take the historical window entropy set We construct a dynamic threshold from the median, and obtain:

[0108] ,

[0109] in, Indicates the first in history Shannon entropy of a window, Indicates the number of historical windows. Indicates a dynamic threshold;

[0110] Introducing deviation coefficient A low-entropy threshold is established, and the bandwidth threshold is adjusted using the following formula:

[0111] ,

[0112] in, The deviation coefficient, range This indicates the threshold for determining low entropy.

[0113] Perform protocol anchor point determination, when When established, the window The starting byte index is marked as the protocol anchor point;

[0114] Specifically, the sliding window maintains consistency with the protocol's minimum field scale, enabling statistical features to cover the entire field without crossing interfaces; Shannon entropy is highly sensitive to byte distribution, highlighting fixed pattern regions under unknown protocol conditions; the historical median threshold is updated over time, mitigating drift caused by changes in device load and software upgrades; the deviation coefficient provides a rapid adjustment mechanism to adapt to different anti-interference levels; by comparing real-time entropy with low-entropy thresholds, the process can locate stable segments early in the message structure offset, providing a reliable reference for subsequent offset sequence statistics and template reconstruction, thereby shortening reconstruction latency and improving sniffing success rate;

[0115] Step S3: Calculate the sequence of position offsets of protocol anchor points between consecutive messages;

[0116] Step S4: When the offset sequence conforms to the preset physical interference distribution model, trigger dynamic reconstruction of the parsing template;

[0117] In step S4, the physical interference distribution model is a Poisson distribution model, and the decision logic includes:

[0118] Perform a Poisson distribution fit test on the offset sequence;

[0119] If the goodness of fit is higher than the set standard, it is determined to meet the physical interference characteristics;

[0120] In step S4, a Poisson distribution fit test is performed on the offset sequence. The steps include:

[0121] Construct an offset sequence, defining the absolute position difference of the protocol anchor points between two consecutive frames as:

[0122] ,

[0123] in, Indicates the first An offset, Indicates the first The starting byte index of the frame anchor point, This indicates the number of frame pairs whose offsets can be calculated;

[0124] Taking the sample mean as the parameter of the Poisson distribution, it is expressed as:

[0125] ,

[0126] in, The fitted Poisson intensity parameters are in bytes.

[0127] Perform frequency statistics and grouping, and let the set of offset values ​​be . ;remember

[0128] ,

[0129] in, Indicates the value to be The number of times the offset occurs. For indicator functions, Use the index of the offset value. The observation with the largest offset; if it exists Merge adjacent high-order intervals until the desired frequency constraint is met;

[0130] The formula for calculating the expected frequency is:

[0131] ,

[0132] in, Indicates the offset value The expected number of occurrences under the Poisson model for factorial;

[0133] Chi-square goodness-of-fit statistic

[0134] ,

[0135] in, Chi-square statistic is used to measure the degree of deviation between the observed distribution and the theoretical Poisson distribution;

[0136] Perform a degree of freedom and significance test, expressed as:

[0137] ,

[0138] in, The degrees of freedom are subtracted by 1 for probability and constraints, and then subtracted by 1 again for parameter estimation. For degrees of freedom The chi-square cumulative distribution function, The p-value represents the goodness of fit.

[0139] Set the decision threshold ;like The offset is then assumed to conform to a Poisson distribution, triggering dynamic reconstruction of the analytical template; here, The tolerance for false detection can be set according to the on-site conditions;

[0140] Specifically, when a message is subjected to physical interference such as electromagnetic flashover or noise feedback, the overall field shift caused by retransmission and padding is approximately a one-time random event, manifesting as a counting process where the offset is independent over time and follows the same mean. The Poisson intensity is directly estimated using the sample mean, and then the difference between observed and theoretical frequencies is compared using the chi-square test, which can determine whether the distribution deviates from expectations within a short sequence. Combinations are used to ensure that low-probability intervals meet the chi-square applicability conditions, and degree-of-freedom correction offsets the degree-of-freedom expansion caused by parameter estimation. Thresholds are also used. It provides configurable confidence boundaries, enabling the system to balance sensitivity and false alarm rate according to device level; when the verification passes, it immediately switches to field index shift mode, which can quickly restore message parsing capabilities before the fault spreads.

[0141] Step S5: Update the message field index mapping relationship based on the offset distribution pattern to generate a lightweight parsing template;

[0142] The operation of updating the field index mapping relationship in step S5 includes:

[0143] Extract the modulo value of the current offset as the base offset;

[0144] Shift the original protocol field index by the baseline offset;

[0145] Preserve field data types and semantic constraints;

[0146] Step S6: Synchronize the lightweight parsing template to the associated terminal device;

[0147] The lightweight parsing template in step S6 includes:

[0148] The translated field position index table;

[0149] The tolerance threshold for each field allows for offset fluctuations within the threshold range;

[0150] Protocol semantic rule check code.

[0151] This embodiment also provides a communication fault detection system based on the Internet of Things, including:

[0152] The message capture module, deployed on the edge gateway, is used to intercept the raw byte stream of industrial equipment communications;

[0153] Anchor point tracing engine, connected to the message capture module, includes:

[0154] Entropy calculation unit performs window segmentation and entropy analysis on byte streams;

[0155] Offset statistics unit calculates the sequence of anchor point position differences for consecutive messages;

[0156] The dynamic reconstruction module performs a field index shift operation when the sequence passes the Poisson distribution test.

[0157] The template synchronization interface sends the field index table to the terminal device via the MQTT protocol;

[0158] The entropy calculation unit executes:

[0159] Divide the byte stream into segments of equal length;

[0160] Count the frequency of occurrence of byte values ​​in each sub-segment;

[0161] Calculate the Shannon entropy value based on the frequency distribution;

[0162] The dynamic reconstruction module includes:

[0163] Offset mode extractor determines the baseline translation amount;

[0164] The field index resetter updates the starting position index of the original protocol field according to the baseline shift amount;

[0165] Semantic rule inheritor, preserving field length, data type, and validation rules.

[0166] In summary, this embodiment, through entropy-driven anchor point positioning, can still identify stable structural fields in messages even in scenarios with unknown or proprietary protocols. Compared to traditional predefined fingerprint database solutions, it avoids misjudgment of illegal traffic caused by unregistered protocols or transient distortions, ensuring that critical control commands such as equipment emergency stop signals are not incorrectly discarded, thus improving the reliability of industrial communication. It employs a Poisson distribution-based offset verification mechanism to identify protocol drift caused by electromagnetic interference, high-temperature thermal noise, etc., as repairable structural distortions rather than permanent faults. By reconstructing field index mappings to preserve the original semantic rules, the system can still correctly parse messages during periods of interference, reducing unplanned downtime on production lines triggered by communication false alarms.

[0167] Furthermore, a lightweight parsing template, containing only a field index table and tolerance thresholds, is synchronized to the terminal device via the MQTT protocol. The terminal can achieve drift-adaptive parsing without requiring a complete protocol stack, significantly reducing the memory and computing power requirements of embedded devices and supporting the integration of older industrial equipment into the IoT system. The edge-side sniffing agent directly captures communication packets, and protocol anchor tracking and dynamic reconstruction are both completed at the gateway, without requiring modification to existing industrial equipment firmware or communication protocols. A rule inheritor ensures compatibility between the reconstructed protocol and the original system, mitigating compatibility risks during production line upgrades. A rolling dynamic entropy threshold and a configurable goodness-of-fit threshold enable the system to adapt to different factory environments. An offset tolerance mechanism allows packets to fluctuate within thresholds, avoiding parsing jitter caused by frequent reconstructions.

[0168] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A communication fault detection method based on the Internet of Things, characterized in that, include, Step S1: Capture communication packets of industrial equipment through the sniffing agent of the edge gateway and generate raw byte stream data; Step S2: Identify protocol anchors in the original byte stream. The protocol anchor is the low-entropy value field in the message. Step S3: Calculate the sequence of position offsets of the protocol anchor points between consecutive messages; Step S4: When the offset sequence conforms to the preset physical interference distribution model, dynamic reconstruction of the parsing template is triggered. Step S5: Update the message field index mapping relationship based on the offset distribution pattern to generate a lightweight parsing template; Step S6: Synchronize the lightweight parsing template to the associated terminal device.

2. The communication fault detection method based on the Internet of Things as described in claim 1, characterized in that, The low-entropy value field mentioned in step S2 is identified in the following way: The message is divided into byte segments using a fixed window, and the entropy value of each byte segment is calculated. When the entropy value of a certain byte segment is lower than the dynamic threshold, it is marked as a protocol anchor point; The entropy value is calculated using Shannon entropy, and the dynamic threshold is set based on the median of historical message entropy values.

3. The communication fault detection method based on the Internet of Things as described in claim 2, characterized in that, In step S2, identifying low-entropy protocol anchor points includes: Calculate the window division and number, and divide the captured raw byte stream by length. The number of windows is defined as follows: ， in, Indicates the total length of the byte stream. This indicates the number of bytes contained in a single window. This indicates the number of windows obtained from the partitioning; Estimate the probability of bytes within the window, and denote it as follows: Each window is its internal byte value The probability of its occurrence is: ， in, The window number is the value to be used. The byte value sequence number is used to determine the value. , Represents byte value In the window The number of times it appears in This indicates the probability of occurrence. Calculate Shannon entropy, window The Shannon entropy is: ， in, Display window Shannon entropy; Take the historical window entropy set We construct a dynamic threshold from the median, and obtain: ， in, Indicates the first in history Shannon entropy of a window, Indicates the number of historical windows. Indicates a dynamic threshold; Introducing deviation coefficient A low-entropy threshold is established, and the bandwidth threshold is adjusted using the following formula: ， in, The deviation coefficient, range This indicates the threshold for determining low entropy. Perform protocol anchor point determination, when When established, the window The starting byte index is marked as the protocol anchor.

4. The communication fault detection method based on the Internet of Things as described in claim 1, characterized in that, The physical interference distribution model mentioned in step S4 is a Poisson distribution model, and the determination logic includes: Perform a Poisson distribution fit test on the offset sequence; If the goodness of fit is higher than the set standard, it is determined to meet the physical interference characteristics.

5. The communication fault detection method based on the Internet of Things as described in claim 4, characterized in that, In step S4, a Poisson distribution fit test is performed on the offset sequence. The steps include: Construct an offset sequence, defining the absolute position difference of the protocol anchor points between two consecutive frames as: ， in, Indicates the first An offset, Indicates the first The starting byte index of the frame anchor point, This indicates the number of frame pairs whose offsets can be calculated; Taking the sample mean as the parameter of the Poisson distribution, it is expressed as: ， in, The fitted Poisson intensity parameters are in bytes. Perform frequency statistics and grouping, and let the set of offset values ​​be . ;remember ， in, Indicates the value to be The number of times the offset occurs. For indicator functions, Use the index of the offset value. The observation with the largest offset; if it exists Merge adjacent high-order intervals until the desired frequency constraint is met; The formula for calculating the expected frequency is: ， in, Indicates the offset value The expected number of occurrences under the Poisson model for factorial; Chi-square goodness-of-fit statistic ， in, Chi-square statistic is used to measure the degree of deviation between the observed distribution and the theoretical Poisson distribution; Perform a degree of freedom and significance test, expressed as: ， in, The degrees of freedom are subtracted by 1 for probability and constraints, and then subtracted by 1 again for parameter estimation. For degrees of freedom The chi-square cumulative distribution function, The p-value represents the goodness of fit. Set the decision threshold ;like If the offset is considered to conform to the Poisson distribution characteristics, dynamic reconstruction of the parsing template is triggered.

6. The communication fault detection method based on the Internet of Things as described in claim 1, characterized in that, The operation of updating the field index mapping relationship in step S5 includes: Extract the modulo value of the current offset as the base offset; Shift the original protocol field index by the baseline offset; Preserve field data types and semantic constraint rules.

7. A communication fault detection system based on the Internet of Things (IoT), comprising the communication fault detection method based on the Internet of Things (IoT) according to any one of claims 1 to 6, characterized in that, include: The message capture module, deployed on the edge gateway, is used to intercept the raw byte stream of industrial equipment communications; An anchor point tracing engine, connected to the message capture module, includes: Entropy calculation unit performs window segmentation and entropy analysis on byte streams; Offset statistics unit calculates the sequence of anchor point position differences for consecutive messages; The dynamic reconstruction module performs a field index shift operation when the sequence passes the Poisson distribution test. The template synchronization interface sends the field index table to the terminal device via the MQTT protocol.

8. The communication fault detection system based on the Internet of Things as described in claim 7, characterized in that, The entropy calculation unit performs the following: Divide the byte stream into segments of equal length; Count the frequency of occurrence of byte values ​​in each sub-segment; Calculate the Shannon entropy value based on the frequency distribution.

9. The communication fault detection system based on the Internet of Things as described in claim 7, characterized in that, The dynamic reconstruction module includes: Offset mode extractor determines the baseline translation amount; The field index resetter updates the starting position index of the original protocol field according to the baseline shift amount; Semantic rule inheritor, preserving field length, data type, and validation rules.

10. The communication fault detection method based on the Internet of Things as described in claim 1, characterized in that, The lightweight parsing template mentioned in step S6 includes: The translated field position index table; The tolerance threshold for each field allows for offset fluctuations within the threshold range; Protocol semantic rule check code.

Images