Communication protocol analysis method and system, computer equipment and computer program product

Abstract

The invention is suitable for the technical field of communication, and provides a communication protocol analysis method and system, computer equipment and a computer program product, and the method comprises the steps: capturing an original message through a network interface, and carrying out the data preprocessing of the original message, and obtaining a numeralization sequence; inputting the numeralization sequence into a pre-training model to obtain a protocol label, wherein the protocol label has a corresponding confidence coefficient; performing grammatical structure analysis on the original message based on the protocol label and the confidence corresponding to the protocol label to obtain structure information of the original message; and performing semantic information analysis on the original message based on the structure information to obtain semantic information of the original message. According to the method and the device, any original message can be efficiently, accurately and automatically identified, and the semantic information of the original message can be accurately analyzed.

Description

TECHNICAL FIELD

[0001] The present application belongs to the technical field of communication, and particularly relates to a communication protocol analysis method and system, a computer device and a computer program product. BACKGROUND

[0002] Industrial control systems are widely used in key fields such as intelligent manufacturing, energy, and transportation. The network environment is filled with a variety of industrial communication protocols, such as Modbus, PROFIBUS (Process Field Bus), PROFINET (Process Field Network), OPC UA (OLE for Process Control Unified Architecture), EtherNet / IP (Ethernet Industrial Protocol), CANopen (Controller Area Network open), and the like. In addition, there are a large number of private or industry-specific protocols.

[0003] Existing communication protocol analysis techniques highly depend on expert experience. When new devices are connected or protocols are changed, engineers need to manually analyze protocol documents (if any) or use packet capture tools for reverse engineering to analyze message structures and write specific parsing scripts or drivers. This process is time-consuming and labor-intensive, and requires high professional skills. Moreover, once the protocol version is updated or the device is replaced, the original parsing logic may fail, and manual intervention is required to adjust the system, which is difficult to adapt automatically. For private protocols that are not publicly disclosed, there is a lack of effective automated parsing means, which seriously hinders the modification of old systems and the mining of data value.

[0004] Therefore, there is an urgent need for a communication protocol analysis method to solve the problems existing in the prior art. SUMMARY

[0005] Therefore, the embodiments of the present application provide a communication protocol analysis method and system, a computer device and a computer program product to realize efficient and accurate automatic identification of any original message and accurate semantic information analysis of the original message.

[0006] The first aspect of the embodiments of the present application provides a communication protocol analysis method, comprising: grabbing an original message through a network interface and performing data preprocessing on the original message to obtain a numerical sequence; inputting the numerical sequence into a pre-trained model to obtain a protocol label, the protocol label having a corresponding confidence; perform syntax structure analysis on the original message based on the protocol label and the confidence corresponding to the protocol label to obtain structure information of the original message; perform semantic information analysis on the original message based on the structure information to obtain semantic information of the original message.

[0007] In an implementation form of the first aspect, the obtaining a numerical sequence by capturing an original message through a network interface and performing data preprocessing on the original message comprises: capturing a physical signal of the original message through the network interface, and interpreting the physical signal as a binary data stream, the physical signal being a level signal; converting the binary data stream into a protocol data unit according to a data link layer protocol; extracting application layer data payload in the protocol data unit by stripping header information of a network layer and a transport layer to obtain an application layer message; generating a numerical sequence based on the application layer message.

[0008] In an implementation form of the first aspect, the generating a numerical sequence based on the application layer message comprises: arranging each byte of the application layer message in a one-dimensional sequence according to a time sequence and a spatial order of each byte in the application layer message; performing numerical mapping on each byte in the one-dimensional sequence to obtain a numerical sequence, the numerical sequence including an integer corresponding to the byte; generating message association information of the numerical sequence based on a session identifier, a communication end point and a time sequence context of the application layer message.

[0009] In an implementation form of the first aspect, the inputting the numerical sequence into a pre-trained model to obtain a protocol label, the protocol label having a corresponding confidence, comprises: inputting the numerical sequence into a pre-trained model to obtain a feature vector of the numerical sequence, the feature vector being a mathematical representation of an overall pattern of the numerical sequence; loading a prototype feature vector of a known protocol and calculating a target distance between the feature vector and the prototype feature vector; determining that a known protocol corresponding to the prototype feature vector with the minimum target distance is a protocol label of the numerical sequence, and generating a confidence of the protocol label according to the target distance.

[0010] In an implementation form of the first aspect, the performing syntax structure analysis on the original message based on the protocol label and the confidence corresponding to the protocol label to obtain structure information of the original message comprises: determining that the communication protocol corresponding to the protocol label is the communication protocol of the original message when the confidence of the protocol label is greater than a first preset confidence; performing syntax structure analysis on the original message based on the communication protocol to obtain structure information; performing syntax structure analysis on the original message based on at least one of the value range mutation information, the byte statistical law, the function code and the length field in the numerical sequence to obtain structure information when the confidence of the protocol label is less than a second preset confidence.

[0011] In an implementation form of the first aspect, when the confidence of the protocol label is greater than the first preset confidence, the performing semantic information analysis on the original message based on the structure information to obtain semantic information of the original message comprises: loading a semantic knowledge base according to the communication protocol; mapping the function code, the address field and the data field in the structure information into semantic information of the original message according to the semantic knowledge base; In an implementation form of the first aspect, when the confidence of the protocol label is less than the second preset confidence, the performing semantic information analysis on the original message based on the structure information to obtain semantic information of the original message comprises: generating at least one semantic speculation information of the original message based on the structure information, prior knowledge of a known protocol, context of the original message and statistical clustering analysis, each of the semantic speculation information having a confidence; determining the semantic information of the original message based on the confidence of the semantic speculation information.

[0012] In an implementation form of the first aspect, the method further comprises: mapping the structure information and the semantic information to a target data model; extracting semantic actions in the structure information in combination with the semantic information; performing protocol mapping and assembling on the target data model according to the target protocol and the semantic actions to obtain a target message under the target protocol when the target protocol is a known protocol; performing protocol mapping and assembling on the target data model according to configuration driving information and the semantic actions to obtain a target message under the target protocol when the target protocol is an unknown protocol.

[0013] A second aspect of the embodiments of the application provides a communication protocol analysis system, comprising: a data processing module configured to capture an original message through a network interface and perform data preprocessing on the original message to obtain a numerical sequence; a protocol label module, configured to input the numerical sequence into a pre-trained model to obtain a protocol label, the protocol label having a corresponding confidence; a structure analysis module, configured to perform syntax structure analysis on the original message based on the protocol label and the corresponding confidence of the protocol label to obtain structure information of the original message; a semantic analysis module, configured to perform semantic information analysis on the original message based on the structure information to obtain semantic information of the original message.

[0014] A third aspect of the embodiments of the present application provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the steps of the method according to the first aspect when executing the computer program.

[0015] A fourth aspect of the embodiments of the present application provides a computer program product, including a computer program, and the computer program is executable to cause the method according to the first aspect to be executed.

[0016] The first aspect of the embodiments of the present application has the following beneficial effects: the original message is captured through the network interface, and the data preprocessing is performed on the original message to obtain a numerical sequence, the numerical sequence is input into a pre-trained model to obtain a protocol label, the protocol label has a corresponding confidence, the syntax structure analysis is performed on the original message based on the protocol label and the corresponding confidence of the protocol label to obtain the structure information of the original message, the semantic information analysis is performed on the original message based on the structure information to obtain the semantic information of the original message, and the efficient and accurate automatic identification of the original message is realized, and the accurate semantic information analysis of the original message is completed.

[0017] It can be understood that the beneficial effects of the second aspect to the fourth aspect can be referred to the related description in the first aspect, and will not be repeated here. BRIEF DESCRIPTION OF DRAWINGS

[0018] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiments or the prior art description. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0019] Figure 1 is a schematic diagram of the implementation process of the communication protocol analysis method provided by the embodiments of the present application; Figure 2 is a schematic diagram of the implementation process of the communication protocol analysis method provided by the embodiments of the present application; Figure 3is a schematic diagram of an implementation process of a communication protocol analysis method provided by an embodiment of the present application; Figure 4 is a schematic diagram of an implementation process of a communication protocol analysis method provided by an embodiment of the present application; Figure 5 is a schematic diagram of an implementation process of a communication protocol analysis method provided by an embodiment of the present application; Figure 6 is a schematic diagram of a communication protocol analysis system provided by an embodiment of the present application; Figure 7 is a schematic diagram of a computer device provided by an embodiment of the present application; Figure 8 is a schematic diagram of a computer program product provided by an embodiment of the present application. DETAILED DESCRIPTION

[0020] In the following description, specific details are set forth, such as particular system configurations, techniques, etc., in order to provide a thorough understanding of the embodiments of the present application. However, persons skilled in the art will understand that the present application can be practiced without these specific details. In other instances, well-known systems, structures, circuits, and techniques have not been shown in detail in order not to obscure the understanding of this description.

[0021] It should be understood that the term "comprises" as used in the specification and the appended claims indicates the presence of the described features, integers, steps, operations, elements, and / or components, but does not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0022] It should also be understood that the term "and / or" as used herein refers to any one of the associated listed items, combinations of one or more of the associated listed items, and all possible combinations thereof.

[0023] As used in the description of the application and the appended claims, the term "if" can be interpreted as meaning "when" or "upon" or "in response to determining" or "in response to detecting", depending on the context. Similarly, the phrase "if it is determined" or "if [a described condition or event] is detected" can be interpreted as meaning "upon determining" or "in response to determining" or "upon detecting [a described condition or event]" or "in response to detecting [a described condition or event]", depending on the context.

[0024] In addition, in the description of the present application and the appended claims, the terms "first", "second", "third", etc. are only used for differentiation in description, and cannot be understood as indicating or implying relative importance.

[0025] Reference within the specification of this application to "one embodiment" or "some embodiments" means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment of the application. The appearances of the phrase "in one embodiment" or "in some embodiments" in various places within specified

[0026] The embodiment of the present application provides a communication protocol analysis method, which is used for efficiently and accurately identifying an original message communication protocol and analyzing semantic information of the original message. The method provided by the present application comprises the following steps: an original message is captured through a network interface, and data preprocessing is performed on the original message to obtain a numerical sequence; the numerical sequence is input into a pre-trained model to obtain a protocol label, the protocol label has a corresponding confidence; syntax structure analysis is performed on the original message based on the protocol label and the confidence corresponding to the protocol label to obtain structure information of the original message; semantic information analysis is performed on the original message based on the structure information to obtain semantic information of the original message, so that efficient and accurate automatic identification of any original message is realized, and accurate semantic information analysis of the original message is completed.

[0027] The communication protocol analysis method provided by the embodiment of the present application can be applied to a computer device such as a mobile phone, a tablet computer, a wearable device, a vehicle-mounted device, an augmented reality (AR) / virtual reality (VR) device, a notebook computer, an ultra-mobile personal computer (UMPC), a netbook, a personal digital assistant (PDA), a desktop computer, a cloud server, and the like. The embodiment of the present application does not make any limitation on the specific type of the computer device.

[0028] As Figure 1 The embodiment of the present application provides a communication protocol analysis method, which comprises the following steps: In step S1, an original message is captured through a network interface, and data preprocessing is performed on the original message to obtain a numerical sequence.

[0029] In application, the original message in the industrial communication field is captured through the network interface, and the communication protocol of the original message is an industrial communication protocol.

[0030] In application, the core goal of data preprocessing is to transform the binary bit stream of physical layer into structured semantic information of application layer, such as application layer message, in a lossless manner. This process follows the layered model of communication system, but the processing logic is reversed. Numerical sequence generation is a key step to transform application layer message into model input, and its logical core is to abandon any semantic analysis based on prior knowledge, and to use the most basic and universal numerical representation.

[0031] Step S2, input the numerical sequence into the pre-trained model to obtain a protocol label, and the protocol label has a corresponding confidence.

[0032] In application, the numerical sequence obtained after preprocessing is input into a pre-trained AI large model to obtain at least one protocol label, and each protocol label has a corresponding confidence, which represents the similarity between the protocol label and the actual communication protocol of the original message.

[0033] In application, the protocol label includes protocol type and version information. The identification result of the protocol label is the "master switch" or "routing table" of the entire parsing process, which determines the allocation of subsequent resources and parsing strategy. For example, guiding syntax parsing: high confidence protocol label (greater than 90%): the system will load the corresponding protocol parsing template. For example, after identifying as Modbus TCP, the model will focus on the positions of MBAP header, transaction ID, unit identifier and other specific fields for accurate parsing, greatly improving the accuracy and efficiency of parsing.

[0034] Low confidence identification (less than 50%), enter "exploration mode". The model cannot rely on strong prior knowledge and needs to use its general sequence understanding ability to analyze the message structure from scratch. This will consume more computing resources and have relatively low accuracy, but it is the necessary ability of the system to deal with unknown protocols. Determine semantic mapping: protocol type is directly associated with semantic knowledge base. For example, if PROFIBUS is identified, the system will call the function code dictionary and device address mapping table of PROFIBUS from the knowledge base to convert the parsed raw numerical values into business semantics such as "start motor" and "temperature too high". The identification result of the protocol label determines the data model format of the standardized output and the rule set of protocol conversion. Different target systems (such as SCADA and MES) may require different formats of data, and the protocol type is the key to selecting the correct format.

[0035] In application, low matching degree (e.g. less than 50%) is not a failed result, but a high-value diagnostic signal. Its engineering significance is reflected in: triggering a hierarchical processing flow, high confidence (> 85%): automatic processing, the result directly enters the business system; medium confidence (50%-85%): the result will be marked as "to be verified" and enter the manual review queue, and at the same time, the original output of the model is recorded. This greatly reduces the scope of manual investigation from "massive unknown data" to "a small amount of suspicious data".

[0036] Low confidence (<50%): trigger "new protocol discovery" alarm. The system will automatically archive these messages and their context (session pair) for experts to analyze, thereby continuously expanding the training data of the model. Provide an analysis starting point. Even if there is only 50% confidence, the "most likely protocol" output by the model provides valuable clues. Engineers can start comparative analysis from this protocol family (for example, it may match "some TCP-based binary protocol") instead of starting from scratch. Reflect "honesty": a method that can report low confidence is more reliable than a system that "overconfidently" gives wrong results. It establishes the foundation of trust for human-machine collaboration.

[0037] Step S3, performing syntax structure analysis on the original message based on the protocol label and the confidence corresponding to the protocol label to obtain structure information of the original message.

[0038] In application, the syntax structure of the original message is analyzed byte by byte or field by field. If the confidence is greater than the field-by-field threshold (e.g. 90%), it enters the "field-by-field analysis" fast lane. Load the protocol template and directly extract the key information. If the confidence is greater than the byte-by-byte threshold, it enters the "byte-by-byte analysis" deep exploration lane. The model starts its sequence labeling ability and analyzes the message structure from scratch.

[0039] In application, even in the "field-by-field analysis" mode, if a certain value parsed is obviously unreasonable (for example, the value of the length field exceeds the total length of the message), it will automatically downgrade to the "byte-by-byte analysis" mode to re-examine the area to ensure robustness. The length of the field is not fixed and is defined by the protocol or inferred by pattern analysis. The confidence of the protocol label is a "decision signal" for selecting the parsing strategy, not the only basis for the length of the field. "Byte by byte" is a general ability to deal with unknown and discovered structures; "field by field" is an optimized means to utilize known and efficient extraction.

[0040] The above method provided by the application is creative in that when there is no protocol template available (i.e. the "field-by-field" path is blocked), the system can still complete the parsing task through intelligent analysis of "byte by byte", thereby realizing adaptive communication protocol parsing.

[0041] Step S4, based on the structure information, the original message is parsed to obtain the semantic information of the original message.

[0042] As shown in the figure, in one embodiment, the step S1, through the network interface to grab the original message and the original message data preprocessing to obtain the numerical sequence, including: Figure 2 Step S11, through the network interface to grab the original message physical signal, and the physical signal is interpreted as a binary data stream, the physical signal is a level signal.

[0043] In the application, the network interface card (NIC, Network Interface Card) or serial device completes the analog-to-digital conversion, and the level signal (such as the differential signal of Ethernet, the voltage difference of RS-485) is interpreted as the original binary bit stream. The above process focuses on bit synchronization and frame delimiting (such as the preamble and frame start delimiter of Ethernet).

[0044] Step S12, according to the data link layer protocol, the binary data stream is converted into a protocol data unit.

[0045] In the application, according to the data link layer protocol (such as Ethernet frame, serial frame format), the frame header and frame tail are parsed, and the frame check sequence is verified. After stripping the frame encapsulation, the network layer / transport layer PDU (Protocol Data Unit) is obtained, such as IP (Internet Protocol) packet, Modbus RTU (Remote Terminal Unit) ADU (Application Data Unit). The above process ensures the integrity and correctness of the frame.

[0046] Step S13, by stripping the header information of the network layer and the transport layer, the application layer data payload in the protocol data unit is extracted to obtain the application layer message.

[0047] ​In application, the header information of the network layer (IP header) and transport layer (TCP / UDP header) is further stripped away to extract the application layer payload. TCP stands for Transmission Control Protocol; UDP stands for User Datagram Protocol. For example, for Modbus TCP, it is the PDU after removing the MBAP (Modbus Application Protocol) header; for serial protocols, it is the data field after removing the address and check fields. After the above process, a pure application layer message representing industrial operation instructions or data is obtained.

[0048] Step S14: Generate a numerical sequence based on the application layer message.

[0049] In traditional applications, this requires prior knowledge of the protocol specifications for parsing. This application, however, directly feeds the unparsed application layer message into a large AI model, allowing the model to "guess" its internal structure. This application achieves a general numerical representation at the underlying level by converting the application layer message into a numerical sequence.

[0050] like Figure 3 As shown, in one embodiment, step S14, generating a numerical sequence based on the application layer message, includes: Step S141: Arrange each byte of the application layer message into a one-dimensional sequence according to the temporal and spatial order of each byte in the application layer message.

[0051] In this application, bytes are chosen as the atomic unit. Bytes are the most basic and universal addressing unit in computer systems, and the de facto foundation of all protocols. Choosing bytes as the basic processing unit, rather than bits or multi-byte fields, ensures the universal applicability of the method provided in this application. Then, each byte is arranged sequentially according to the temporal and spatial order of the message's appearance on the network, forming a one-dimensional sequence. This sequence accurately records all the original information of the message, including potential protocol headers, data, padding, etc., without any information loss. For example, a message "A5 5A 0701 02 03 04 B3 C4" is directly converted into the sequence [165, 90, 7, 1, 2, 3, 4, 179, 196].

[0052] Step S142: Perform numerical mapping on each byte in the one-dimensional sequence to obtain a numerical sequence, wherein the numerical sequence includes the integer corresponding to the byte.

[0053] In the application, each byte (8-bit unsigned integer) is mapped to the integer space of 0-255. This mapping is deterministic and one-to-one. The pre-trained model can learn the association between specific numerical patterns (such as 165, 90 often appearing consecutively, which may represent a frame header) and protocol syntax in this integer sequence.

[0054] In the application, the model needs fixed-dimensional input, but the length of the message is variable. Therefore, for short messages, intelligent padding is used. Intelligent padding is not simply padding with 0, but using a special value (such as 0xFF or 0x00) that rarely appears in normal messages as a padding symbol, and accompanying an effective length identifier in the input to tell the model which is real data and which is padding.

[0055] For long messages, truncation is performed with key area preservation. Analysis shows that the key information of the protocol (such as function code, address) is usually located in the front part of the message. Therefore, the tail data is preferentially truncated. At the same time, the model can be trained to handle "segmented input" to process long messages in multiple segments.

[0056] In step S143, message association information of the numerical sequence is generated based on the session identifier, communication endpoint and timing context of the application layer message.

[0057] The purpose of message association is to restore the context of communication, and the information of a single request or response message is incomplete. The core principle of association is to use identifiers in the protocol and network five-tuple to match within a time window. The three elements of association include session identifier, communication endpoint and timing context.

[0058] The session identifier is mainly to extract the field that can uniquely identify a "transaction" in each message. For example, Modbus TCP: use the transaction identifier in the MBAP header. The same request and response have the same transaction ID. The general TCP protocol uses TCP sequence number and acknowledgement number. The acknowledgement number of the response message is equal to the sequence number of the request message plus the length of the request data. Custom protocols may contain message IDs or sequence numbers that increment.

[0059] In the application, the communication endpoint information of the network layer is used to divide different data streams. The communication endpoint includes the network five-tuple: {source IP, source port, destination IP, destination port, transport layer protocol}. All messages of a session should have the same five-tuple (the source / destination of the request and response are opposite). The above process ensures that the communication between different devices will not be incorrectly associated.

[0060] In application, the time context includes that the request and the response have immediate temporal relationship. For example, a reasonable timeout window (e.g. 1-5 seconds) is set. After a request packet is captured, the system will look for a matching response from the same five tuple (but with source / destination swapped) within the timeout window. If no match is found, it is determined that either the request or the response is lost.

[0061] In application, the specific procedure of association includes packet classification, according to the five tuple, the captured packets are shunted to different "virtual channels". Request detection, in a channel, according to the protocol features (such as known port number, specific function code mode) or heuristic rules (such as the packet that first initiates the connection is usually a request), the request packet is identified. Identifier extraction, the session identifier (such as transaction ID) is extracted from the request packet. Response matching, in the subsequent incoming packets, find the packet that meets the following conditions: belongs to the same channel (five tuple is swapped), contains the session identifier that matches the request packet, arrives after the request and does not exceed the timeout. Session construction, the matching request and response packets are paired to form a session pair, and are marked with a uniform session ID. The session pair can be used as a larger input unit for the model to learn the "question and answer" logical relationship.

[0062] As shown in Figure 4 In one embodiment, the step S2 inputs the numerical sequence into a pre-trained model to obtain a protocol label, and the protocol label has a corresponding confidence, including: Step S21 inputs the numerical sequence into a pre-trained model to obtain a feature vector of the numerical sequence, and the feature vector is a mathematical representation of the overall pattern of the numerical sequence.

[0063] In the application, the "overall pattern" is a comprehensive concept, which does not refer to a specific field, but the collection of multi-dimensional, multi-level statistical and structural characteristics presented by the message as a complete sequence. The model analyzes the following patterns in parallel: Macro statistical characteristics: message length distribution: the length of some protocol messages is fixed or varies within a small range (such as some PROFIBUS messages), while others are highly variable (such as OPC UA). Byte value distribution: analyze the entropy value of each byte position in the message. The bytes in the protocol header often have low entropy values (more fixed), while the data area bytes have high entropy values (more random). Structural characteristics: magic number, identify whether there is a specific, fixed byte sequence at the beginning of the message (such as 00 00 for Modbus TCP, although not a strict magic number, but the pattern is fixed); field alignment, analyze whether the message presents a certain alignment rule (such as 2-byte, 4-byte alignment), which implies the data types (16-bit integer, 32-bit float) that the protocol may use. Session interaction characteristics, request-response pattern: analyze whether there is a stable correspondence between the length, structure of the request message and the length, structure of the response message. For example, a short request is always followed by a long response, which may be a "read data" operation. The model integrates these characteristics from different dimensions into a high-dimensional, comprehensive feature vector, which is used to match known protocols.

[0064] Step S22, load the prototype feature vector of the known protocol and calculate the target distance between the feature vector and the prototype feature vector.

[0065] The preprocessed numerical sequence [x1, x2, x3,..., xn] is input into the model, and the model converts this sequence into a fixed-length, high-dimensional, dense feature vector through its complex neural network layer (Transformer encoder). This vector is the mathematical representation of the "overall pattern" of the message.

[0066] In the model training phase, the model has learned one or more prototype feature vectors for each protocol it has learned (such as Modbus TCP, OPC UA), which can be understood as anchor points of this type of protocol in the feature space. In the inference phase, the "distance" between the feature vector and each known protocol prototype vector is calculated, such as cosine similarity or Euclidean distance.

[0067] Step S23, determine the known protocol corresponding to the prototype feature vector with the smallest target distance as the protocol label of the numerical sequence, and generate the confidence of the protocol label according to the target distance.

[0068] These "distances" are converted by a Softmax function to a probability distribution. The match degree (e.g. 90%) is the probability value. It means that the current message belongs to the target protocol with a probability of 90% among all candidate protocols.

[0069] For example, assume that there are 3 protocols (A, B, C), and the original similarity scores of the current message with them are S_A=8, S_B=2, S_C=0. After Softmax: P_A≈0.9975, P_B≈0.0025, P_C≈0.0001. Finally, protocol A is confirmed, and the match degree is 99.75%.

[0070] In application, the known protocol corresponding to the prototype feature vector with the minimum target distance is determined as the protocol label of the numerical sequence, and the above match degree is taken as the confidence of the protocol label.

[0071] In an embodiment, the step S3 includes: Step S31, in the case that the confidence of the protocol label is greater than a first preset confidence, the communication protocol corresponding to the protocol label is determined as the communication protocol of the original message.

[0072] In application, the first preset confidence is 90% or other higher value, and the confidence of the protocol label greater than the first preset confidence means that the feature vector of the current message is very close to the prototype vector of a certain protocol in the feature space, almost coincides, and they belong to the same type of communication protocol.

[0073] Step S32, the original message is parsed based on the communication protocol to obtain the structure information.

[0074] In application, in the case that the confidence of the protocol label is greater than the first preset confidence, the template of the protocol label is called from the knowledge base. The template clearly specifies the name, starting position, length and data type of each field. The model can know that "from the 0th byte, take 2 bytes as transaction ID; then 2 bytes as protocol identification...". In this case, the parsing is directly performed field by field, which is the most efficient and the most accurate.

[0075] In application, the structure information includes function code, address field and data field.

[0076] Step S33, in the case that the confidence of the protocol label is less than a second preset confidence, the original message is parsed based on at least one of the value domain mutation information, byte statistical rule, function code and length field in the numerical sequence to obtain the structure information.

[0077] In the application, if the confidence of the protocol label is less than the second preset confidence, such a certain template cannot be obtained. At this time, the general field boundary recognition ability learned in pre-training and fine-tuning must be used, that is, "byte-by-byte analysis".

[0078] In the application, the mutation of the value domain: the value of the two adjacent bytes appears a huge difference, which may mean that the head field with a fixed value is switched to the data field with a large change. Statistical rule: the entropy of the byte value at a certain position is very low (the value is fixed or changes little, such as the function code), and the entropy after the position suddenly becomes high (the value is random, such as the data payload). The mutation point of the entropy may be the field boundary. Function code mode: the model has learned that certain specific values (such as 01, 03, and 10) appearing at a specific offset position (usually near the beginning) of the message have a high probability of being "function codes". After identifying the function codes, the possible position and size of the subsequent fields (such as address and length) can be inferred according to the common mode. Length field: the model can identify the field used to declare the "data part length" in some protocols. Once the value L of the length field is parsed, it can directly locate the L bytes after the length field as the boundary of the data domain.

[0079] In one embodiment, when the confidence of the protocol label is greater than the first preset confidence, the step S4 of performing semantic information parsing on the original message based on the structure information to obtain semantic information of the original message comprises: Step S41, loading a semantic knowledge base according to the communication protocol.

[0080] In the application, according to the protocol type and version, a corresponding "dictionary" is loaded from the structured semantic knowledge base. Function code dictionary: this is a direct mapping table. For example, 03-> function: read and hold register, 06-> function: write a single register, and 10-> function: write multiple registers. Address mapping table of the database mapping the logical address in the protocol to the address of the physical entity. For example, hold register address 0x0000-> device: boiler 1, variable: temperature setting value, unit: °C; coil address 0x0001-> device: motor 2, variable: start-stop state. Data type specification: define how to interpret the original byte sequence as meaningful numerical values. For example, 2 bytes, big-endian, unsigned integer; 4 bytes, IEEE (Institute of Electrical and Electronics Engineers) 754 floating point number.

[0081] Step S42, mapping the function code, address domain and data domain in the structure information into the semantic information of the original message according to the semantic knowledge base.

[0082] In application, the parsed function code is queried in the function code dictionary to obtain readable operation description. The parsed address domain is queried in the address mapping table to obtain actual device or variable represented by the address. The parsed data domain is decoded according to data type specification to obtain final numerical value.

[0083] For example, in Modbus TCP protocol, the output structure information includes function code: 0x10, start address: 0x0000, register number: 0x0002, data: 0x4248 0x0000 (4 bytes). The semantic analysis process is: query function code dictionary: 0x10 -> “write multiple holding registers”; query address mapping table: 0x0000 -> “boiler 1 temperature set value”; decode according to data type: data 0x42480000 is interpreted as IEEE 754 floating point number -> 50.0, and finally output: “instruction: set the temperature set value of boiler 1 to 50.0°C”.

[0084] In the case where the confidence of the protocol label is less than the second preset confidence, the step S4 includes: Step S43, based on the structure information, combining prior knowledge of known protocols, context of the original message and statistical clustering analysis, at least one semantic speculation information of the original message is generated, and each semantic speculation information has a confidence.

[0085] In application, in the case where the confidence of the protocol label is less than the second preset confidence, and when there is no ready-made semantic knowledge base available, semantic analysis is realized through a multi-factor, interpretable reasoning process, and the implementation process is not a black box with “input and output results”. Specifically, pre-trained prior knowledge is used, and the model has learned common patterns of hundreds of public protocols in the training stage. It knows that “a byte near the beginning of the message is likely to be a function code”, “the next 2 bytes are likely to be an address”, “the data domain is usually located in the rear part of the message”, and such prior knowledge enables the model to make reasonable guesses even when facing unknown protocols. Context session analysis (the most critical means): the model does not analyze a message in isolation. It always understands the request and response messages as a pair. For example, a short request message is observed, followed by a longer response message containing a large amount of data.

[0086] Inference: "This is likely a read data instruction. Some field in the request message specifies what to read, and the data field in the response message is the value read back." Observation: A request message containing a piece of data is observed, followed by a short response message indicating success only. Later, another request for the read status returns a different piece of data. Inference: "This is likely a write data instruction. The data in the request message is the value to be set." Statistical and clustering analysis, long-term monitoring of network traffic, clustering of messages. For example, if a certain type of message is found to always appear periodically and the data field changes very little, it can be inferred to be a "heartbeat packet" or "status periodic reporting". If a certain type of message is found to always appear immediately after a certain event (such as pressing a button), it can be inferred to be a "control instruction".

[0087] In application, generate hypothesis and confidence score, based on the above analysis, the model generates one or more semantic hypotheses. For example, "with 75% confidence, byte [1] is the function code, whose value 0xA0 represents'read'; byte [2-3] is the start address 0x0100; byte [4-5] is the data length." This confidence is dynamically adjusted as more identical session patterns are observed. Unknown protocol example: input session pair: Request: [0xAA, 0xBB, 0x01, 0x00, 0x02]; Response: [0xAA, 0xBB, 0x41, 0x48, 0x00, 0x00] (assuming 0x41480000 is the byte representation of floating point number 50.0), the model inference process of this example is as follows: pattern matching: short request, long response and containing floating point data -> high probability of "read operation"; field association: 0x0100 (256) and 0x02 (2) in the request may represent "address 256" and "request 2 registers" respectively; semantic generation: the model may output "suspected read operation: read 2 registers from address 256, get floating point value 50.0 (unit unknown)", with a confidence score, for example, 70%.

[0088] Step S44, determining the semantic information of the original message based on the confidence of the semantic inference information.

[0089] In application, the semantic inference information with the highest confidence is determined as the semantic information of the original message.

[0090] As Figure 5 shown, in one embodiment, the method further comprises: Step S51, mapping the structure information and the semantic information to a target data model.

[0091] In application, the parsed structure information and semantic information are mapped to a unified, standardized data model (e.g., based on JSON (JavaScript Object Notation), XML (Extensible Markup Language) or OPC UA information model). The structure information includes a list of field boundaries of the message, the original byte value of each field, the inferred role of each field (e.g., function code, start address, data length, data payload, CRC (Cyclic Redundancy Check)). For example, [{start byte: 0, length: 1, role: "function code", original value: "0x10"}, {start byte: 2, length: 2, role: "start address", original value: "0x0000"},...]. The semantic information includes the operation type (e.g., read, write, heartbeat), the target object (e.g., device ID, variable address, register number), the data value (decoded numerical value, e.g., 50.0), the physical meaning (e.g., "boiler temperature setpoint"), the unit (e.g., "°C"). For example, {operation: "write", target: "boiler 1 temperature setpoint", value: 50.0, unit: "°C"}.

[0092] In application, the structure information and semantic information are represented as a standard data structure in combination with context information, which includes session ID (associated request-response pair), timestamp, communication direction (request / response), for example, {session ID: "sess_12345", timestamp: "2023-10-27T10:00:00.000Z", direction: "request"}.

[0093] In application, the structure information and semantic information are represented as a JSON object as follows, for example, in combination with the above context information: { "metadata":{ "protocol":"Modbus_TCP", "version":"1.0", "confidence":0.98, "session_id":"sess_12345", "timestamp":"2023-10-27T10:00:00.000Z", "direction":"request" }, "syntax":{ "function_code": {"raw_value": "0x10", "role": "function_code"}, "starting_address": {"raw_value": "0x0000", "role": "address"}, "quantity": {"raw_value": "0x0002", "role": "data_length"}, "data": {"raw_value": "0x42480000", "role": "payload"} }, "semantics": { "operation": "WRITE_MULTIPLE_REGISTERS", "target_device": "Boiler_1", "target_variable": "Temperature_Setpoint", "value": 50.0, "unit": "°C" }}.

[0094] Step S52, extract the semantic action in the structure information in combination with the semantic information.

[0095] In the application, no matter the source protocol is Modbus, PROFIBUS or a private protocol, the core business intent can be described by a set of common meta- language to read the common semantic action extracted from the semantics part of the above-mentioned "structured information". For example, operation: READ / WRITE / COMMAND / SUBSCRIBE; target: {device_id}.{variable_name} (such as "Boiler_1.Temperature_Setpoint"); value: 50.0 (with type and unit information).

[0096] Step S53, in the case that the target protocol is a known protocol, protocol mapping and assembly are performed on the target data model according to the target protocol and the semantic action to obtain a target message under the target protocol.

[0097] In the application, in the case that the target protocol is a known protocol, a complete knowledge base of the known target protocol (such as OPC UA) is known, and a target message under the target protocol is obtained by performing protocol mapping and assembling on the target data model according to the target protocol and the semantic action. The mapping process includes operation mapping: mapping the general operation WRITE to the WriteRequest service call of OPC UA; address mapping: mapping the general target Boiler_1.Temperature_Setpoint to the NodeId of OPC UA, for example, ns=1;s=Boiler1 / TempSetpoint; data encoding: encoding the value 50.0 according to the standard data type (such as Float) of OPC UA.

[0098] Step S54, in the case that the target protocol is an unknown protocol, a target message under the target protocol is obtained by performing protocol mapping and assembling on the target data model according to the configuration driving information and the semantic action.

[0099] In the application, in the case that the target protocol is an unknown protocol, a template of the target private protocol is defined by an engineer in advance, that is, the configuration driving information, and the format of the function code, the address domain and the data domain is specified. The conversion engine becomes a filler of the template.

[0100] In the application, if the structure of the target protocol is learned online (by listening to the traffic thereof), a message can also be “imitated” according to the learned structure according to the general semantics. For example, it is known that the “write operation” function code of the target protocol is 0xA5, and the data domain is a 4-byte floating-point number, so such a message can be assembled. In this case, the output is accompanied by a lower confidence degree, and needs to be strictly tested.

[0101] In the application, the target message is sent to the target device or network.

[0102] In one embodiment, the detailed training process of the pre-training model is as follows: Phase 1: Data Preparation. Raw data collection, multi-source data aggregation: public protocol specification library (Modbus, PROFIBUS, OPC UA, etc.); analog data generator (covering all function codes and data type combinations); real industrial network traffic (de-identified); protocol variant data (enhancing model robustness). Data cleaning and preprocessing, including: noise filtering (removing non-industrial protocol traffic); invalid message removal (length anomalies, checksum errors); session flow reorganization (based on five-tuple and transaction ID); byte serialization (uniformly converted to integer sequences). Fine-grained data labeling includes a multi-level labeling system, protocol type and version labels; byte-level field boundary labeling (BIO scheme); semantic role labeling (function code, address, data, etc.); session context labeling (request-response pairing). Data set division, including pre-training set: 100 million+ unlabeled messages (for self-supervised learning); fine-tuning set: 10 million+ labeled samples (for supervised training); test set: reserved data (for final evaluation).

[0103] Phase 2: Pre-training. Model architecture initialization, basic configuration, Transformer encoder architecture, byte-level vocabulary (256 tokens), multi-scale attention mechanism, relative position encoding. Pre-training task design, masked byte prediction: in python, input: [0xA5, 0x5A, [MASK], 0x01, 0x02, [MASK], 0x04], target: predict masked bytes [0x07, 0x03], purpose: learn protocol local structure and dependencies. Next byte prediction: in python, input: [0xA5, 0x5A, 0x07, 0x01, 0x02], target: predict next byte 0x03, purpose: learn protocol state machine. Protocol contrastive learning: in python, positive samples: (request message, corresponding response message), negative samples: (Modbus message, PROFIBUS message), purpose: learn protocol differentiation ability. Syntax tree prediction: construct abstract syntax trees for known protocols, predict the tree structure corresponding to the message, purpose: learn protocol hierarchical organization. Optimization and convergence, training parameters: batch size: 1024-2048, learning rate: warm-up + linear decay, optimizer: AdamW + gradient clipping. Convergence criteria: validation set perplexity stability, each task accuracy saturation early stopping mechanism triggered.

[0104] Phase Three: Supervised Fine-Tuning, including multi-task learning architecture: shared backbone network, pre-trained Transformer encoder, dedicated output heads, protocol classification head (fully connected layer + Softmax), field detection head (CRF (Conditional Random Fields) layer + BIO (Beginning, Inside, Outside, sequence labeling scheme) tagging), semantic parsing head (multi-layer perceptron). Progressive training strategy: basic protocols, focus on Modbus, PROFIBUS, and other structured protocols, focus on field boundary detection. Complex protocols, introduce OPCUA, EtherNet / IP, and other complex protocols, enhance semantic understanding ability. Private protocols, small sample learning technology, meta-learning framework application. Learning arrangement, from simple to complex: fixed length → variable length protocol; known to unknown: standard protocol → protocol variant; independent to interactive: single message → complete session.

[0105] Phase Four: Reinforcement Learning Optimization. Analyze the environment and build a state space: current message sequence + parsing history; action space: field boundary prediction + semantic label assignment; reward function: Python language: def reward_function(parsing_result, ground_truth): accuracy = calculate_overlap(parsing_result, ground_truth); consistency = check_structure_consistency(parsing_result); confidence = model_confidence_score(parsing_result); return 0.6 * accuracy + 0.3 * consistency + 0.1 * confidence.

[0106] PPO (Proximal Policy Optimization) algorithm training, policy network: fine-tuned model; value network: additional training critic network; update mechanism: proximal policy optimization, ensure training stability.

[0107] Phase Five: Continuous Learning. Online learning mechanism, real-time data stream: continuous monitoring of industrial network traffic; Active learning: low-confidence samples are labeled first; incremental training: periodically update the model with new data. Catastrophic forgetting prevention, elastic weight consolidation: important parameter regularization; experience replay: core sample buffer; knowledge distillation: collaborative training of new and old models. Version management system, model snapshot: save each important version; performance monitoring: real-time tracking of model performance; rollback mechanism: quickly recover when performance declines.

[0108] Phase six: model deployment. Model compression, knowledge distillation, teacher model: complete large model; student model: lightweight network; distillation loss: KL (Kullback-Leibler divergence) divergence + task loss. Quantization optimization, precision conversion: FP32→INT8; calibration dataset: representative industrial traffic; quantization-aware training: simulate quantization effects. Inference optimization, engine integration: TensorRT, ONNXRuntime (Open Neural Network Exchange Runtime). Cache mechanism: cache common protocol templates; batch processing: multiple packets are parsed in parallel. Performance verification, accuracy indicators: protocol recognition accuracy > 98%; field parsing F1 score > 95%; end-to-end success rate > 97%; efficiency indicators: single-packet parsing delay < 10ms; throughput > 1000pps (Packets Per Second); memory usage < 2GB.

[0109] It should be understood that the size of the serial number of each step in the above embodiment does not mean the order of execution, and the execution order of each process should be determined according to its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0110] The embodiments of the present application also provide a communication protocol parsing system for executing the steps in the above communication protocol parsing method embodiments. The communication protocol parsing system can be a virtual appliance (Virtual Appliance) in a computer device, run by the processor of the computer device, or can be the computer device itself.

[0111] As shown in Figure 6 The embodiments of the present application provide a communication protocol parsing system 600, which includes: A data processing module 601 is configured to capture original packets through a network interface and perform data preprocessing on the original packets to obtain a numerical sequence; A protocol label module 602 is configured to input the numerical sequence into a pre-trained model to obtain a protocol label, the protocol label having a corresponding confidence; The structure analysis module 603 is configured to perform syntax structure analysis on the original message based on the protocol label and the confidence of the protocol label corresponding to the protocol label to obtain structure information of the original message. The semantic analysis module 604 is configured to perform semantic information analysis on the original message based on the structure information to obtain semantic information of the original message.

[0112] In an embodiment, the data processing module 601 is configured to: grab a physical signal of the original message through a network interface, and interpret the physical signal as a binary data stream, the physical signal being a level signal; convert the binary data stream into a protocol data unit according to a data link layer protocol; extract application layer data payload in the protocol data unit by stripping header information of a network layer and a transport layer to obtain an application layer message; generate a numerical sequence based on the application layer message.

[0113] In an embodiment, the data processing module 601 is configured to: arrange each byte of the application layer message in a one-dimensional sequence according to a time sequence and a spatial order of each byte in the application layer message; perform numerical mapping on each byte in the one-dimensional sequence to obtain a numerical sequence, the numerical sequence including an integer corresponding to the byte; generate message association information of the numerical sequence based on a session identifier, a communication end point and a time sequence context of the application layer message.

[0114] In an embodiment, the protocol label module 602 is configured to: input the numerical sequence into a pre-trained model to obtain a feature vector of the numerical sequence, the feature vector being a mathematical representation of an overall pattern of the numerical sequence; load a prototype feature vector of a known protocol and calculate a target distance between the feature vector and the prototype feature vector; determine that the known protocol corresponding to the prototype feature vector with the minimum target distance is a protocol label of the numerical sequence, and generate a confidence of the protocol label according to the target distance.

[0115] In an embodiment, the structure analysis module 603 is configured to: determine that a communication protocol corresponding to the protocol label is a communication protocol of the original message when the confidence of the protocol label is greater than a first preset confidence; perform syntax structure analysis on the original message based on the communication protocol to obtain structure information. In a case where the confidence of the protocol label is less than a second preset confidence, the semantic analysis module 604 is configured to:

[0116] In one embodiment, in a case where the confidence of the protocol label is greater than a first preset confidence, the semantic analysis module 604 is configured to: load a semantic knowledge base according to the communication protocol; map the function code, address field and data field in the structure information to semantic information of the original message according to the semantic knowledge base.

[0117] In a case where the confidence of the protocol label is less than a second preset confidence, the semantic analysis module 604 is configured to: generate at least one semantic conjecture information of the original message based on the structure information, prior knowledge of a known protocol, context of the original message and statistical clustering analysis, each of the semantic conjecture information having a confidence; determine the semantic information of the original message based on the confidence of the semantic conjecture information.

[0118] In one embodiment, the method further includes a protocol conversion module configured to: map the structure information and the semantic information to a target data model; extract semantic actions in the structure information in combination with the semantic information; in a case where the target protocol is a known protocol, perform protocol mapping and assembly on the target data model according to the target protocol and the semantic actions to obtain a target message under the target protocol; in a case where the target protocol is an unknown protocol, perform protocol mapping and assembly on the target data model according to configuration driving information and the semantic actions to obtain a target message under the target protocol.

[0119] In applications, the modules in the communication protocol analysis system can be software program modules, can be realized by different logic circuits integrated in a processor, or can be realized by multiple distributed processors.

[0120] Figure 7 A structural schematic diagram of a computer device according to an embodiment of the present application is shown in FIG. 7. As shown in FIG. 7, the computer device 7 of this embodiment includes at least one processor 70 (for example, a central processing unit (CPU), a microprocessor, a microcomputer, a microcontroller, or the like) and a memory 71. Figure 7 The memory 71 is connected to the processor 70 and stores various programs and data required for the operation of the computer device 7. The memory 71 can be a random access memory (RAM), a read-only memory (ROM), a flash memory, or the like. Figure 7(Only one is shown in the diagram) a processor, a memory 71, and a computer program 72 stored in the memory 71 and executable on the at least one processor 70, wherein the processor 70 executes the computer program 72 to implement the steps in any of the above-described communication protocol parsing method embodiments.

[0121] The computer device may include, but is not limited to, a processor 70 and a memory 71. Those skilled in the art will understand that... Figure 7 The computer device 7 is merely an example and does not constitute a limitation on the computer device 7. It may include more or fewer components than shown, or combine certain components, or different components, such as input / output devices, network access devices, etc.

[0122] The processor 70 can be a Central Processing Unit (CPU), but it can also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor.

[0123] In some embodiments, the memory 71 may be an internal storage unit of the computer device 7, such as a hard disk or memory of the computer device 7. In other embodiments, the memory 71 may be an external storage device of the computer device 7, such as a plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, etc., equipped on the computer device 7. Furthermore, the memory 71 may include both internal and external storage units of the computer device 7. The memory 71 is used to store the operating system, applications, bootloader, data, and other programs, such as the program code of the computer program. The memory 71 can also be used to temporarily store data that has been output or will be output.

[0124] It should be noted that the information interaction and execution process between the above-mentioned devices / units are based on the same concept as the method embodiments of this application. For details on their specific functions and technical effects, please refer to the method embodiments section, and they will not be repeated here.

[0125] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is merely an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiments can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit. Furthermore, the specific names of the functional units and modules are only for easy differentiation and are not intended to limit the scope of protection of this application. The specific working process of the units and modules in the above system can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0126] This application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps described in the various method embodiments above.

[0127] like Figure 8 As shown, this application provides a computer program product 800, including a computer program 72. When the computer program 72 is run, the steps in the above-described communication protocol parsing method embodiments are executed.

[0128] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments of this application can be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include at least: any entity or device capable of carrying computer program code to a device / computer equipment, a recording medium, a computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media. Examples include USB flash drives, portable hard drives, magnetic disks, or optical disks. In some jurisdictions, according to legislation and patent practice, computer-readable media cannot be electrical carrier signals or telecommunication signals.

[0129] In the above-described embodiments, the description of each embodiment focuses on different aspects, and parts not described in detail or recorded in a certain embodiment can be referred to the relevant description of other embodiments.

[0130] Those skilled in the art can understand that the units and algorithm steps of each example described in combination with the embodiments disclosed herein can be realized by electronic hardware or a combination of computer software and electronic hardware. Whether the functions are realized in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0131] In the embodiments provided in the present application, it should be understood that the disclosed computer device and method can be implemented in other ways. For example, the computer device embodiments described above are only schematic. The division of the modules or units is only a logical function division, and there can be another division in actual implementation. For example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the displayed or discussed mutual coupling or direct coupling or communication connection can be indirect coupling or communication connection through some interface, device or unit, and can be electrical, mechanical or in other forms.

[0132] The units described as separate components can or can not be physically separated, and the components displayed as units can or can not be physical units, that is, they can be located in one place, or can be distributed on a plurality of network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the embodiments.

[0133] The above-described embodiments are only used to illustrate the technical solutions of the present application, but not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that the technical solutions recorded in the foregoing embodiments can be modified, or some technical features can be replaced by equivalent; and these modifications or replacements do not make the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application, and should be included in the protection scope of the present application.

Claims

1. A communication protocol parsing method, characterized in that, include: The original packets are captured through the network interface and the data preprocessed to obtain a numerical sequence. The numerical sequence is input into a pre-trained model to obtain a protocol label, which has a corresponding confidence level. Based on the protocol tag and the confidence level corresponding to the protocol tag, the original message is parsed to obtain the structural information of the original message; The semantic information of the original message is obtained by parsing the original message based on the structural information.

2. The communication protocol parsing method as described in claim 1, characterized in that, The step of capturing raw packets through a network interface and performing data preprocessing on the raw packets to obtain a numerical sequence includes: The original packet physical signal is captured through the network interface and interpreted into a binary data stream. The physical signal is a level signal. The binary data stream is converted into protocol data units according to the data link layer protocol. By stripping the header information of the network layer and transport layer, the application layer data payload in the protocol data unit is extracted to obtain the application layer message; A numerical sequence is generated based on the application layer message.

3. The communication protocol parsing method as described in claim 2, characterized in that, The generation of a numerical sequence based on the application layer message includes: According to the temporal and spatial order of each byte in the application layer message, each byte of the application layer message is arranged sequentially to form a one-dimensional sequence; A numerical sequence is obtained by numerically mapping each byte in the one-dimensional sequence, and the numerical sequence includes the integer corresponding to the byte; The message association information of the numerical sequence is generated based on the session identifier, communication endpoint, and timing context of the application layer message.

4. The communication protocol parsing method as described in claim 1, characterized in that, The step of inputting the numerical sequence into a pre-trained model to obtain a protocol label, wherein the protocol label has a corresponding confidence level, including: The numerical sequence is input into a pre-trained model to obtain the feature vector of the numerical sequence, and the feature vector is a mathematical representation of the overall pattern of the numerical sequence; Load the prototype feature vector of a known protocol and calculate the target distance between the feature vector and the prototype feature vector; The known protocol corresponding to the prototype feature vector with the smallest target distance is determined as the protocol label of the numerical sequence, and the confidence level of the protocol label is generated based on the target distance.

5. The communication protocol parsing method as described in claim 1, characterized in that, The step of parsing the original message based on the protocol tag and the confidence level corresponding to the protocol tag to obtain the structural information of the original message includes: If the confidence level of the protocol tag is greater than the first preset confidence level, the communication protocol corresponding to the protocol tag is determined to be the communication protocol of the original message; The original message is parsed using the communication protocol to obtain structural information. If the confidence level of the protocol tag is less than the second preset confidence level, the original message is parsed to obtain structural information based on at least one of the value domain mutation information, byte statistical patterns, function code and length field in the numerical sequence.

6. The communication protocol parsing method as described in claim 5, characterized in that, When the confidence level of the protocol tag is greater than a first preset confidence level, the step of parsing the semantic information of the original message based on the structural information to obtain the semantic information of the original message includes: Load the semantic knowledge base according to the communication protocol; Based on the semantic knowledge base, the function code, address field, and data field in the structural information are mapped to the semantic information of the original message; When the confidence level of the protocol tag is less than the second preset confidence level, the step of parsing the semantic information of the original message based on the structural information to obtain the semantic information of the original message includes: Based on the structural information, combined with prior knowledge of known protocols, the context of the original message, and statistical cluster analysis, at least one semantic inference information of the original message is generated, and each semantic inference information has a confidence level. The semantic information of the original message is determined based on the confidence level of the semantic inference information.

7. The communication protocol parsing method according to any one of claims 1 to 6, characterized in that, The method further includes: Map the structural information and the semantic information to the target data model; Semantic actions are extracted from the structural information by combining the semantic information; When the target protocol is a known protocol, the target data model is mapped and assembled according to the target protocol and the semantic action to obtain the target message under the target protocol; When the target protocol is unknown, the target data model is mapped and assembled according to the configuration driver information and the semantic action to obtain the target message under the target protocol.

8. A communication protocol parsing system, characterized in that, include: The data processing module is used to capture raw packets through a network interface and perform data preprocessing on the raw packets to obtain a numerical sequence. The protocol label module is used to input the numerical sequence into the pre-trained model to obtain a protocol label, and the protocol label has a corresponding confidence level. The structure parsing module is used to perform syntax structure parsing on the original message based on the protocol tag and the confidence level corresponding to the protocol tag to obtain the structure information of the original message; The semantic parsing module is used to perform semantic information parsing on the original message based on the structural information to obtain the semantic information of the original message.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the method as described in any one of claims 1 to 7.

10. A computer program product, characterized in that, Includes a computer program, which, when run, causes the method described in any one of claims 1 to 7 to be performed.

Images