Protocol identification method and device, electronic equipment and storage medium

Abstract

The invention provides a protocol identification method and device, electronic equipment and a storage medium, and the method comprises the steps: obtaining a target communication message of to-be-connected equipment, and extracting a multi-dimensional format parameter feature from the target communication message; according to the multi-dimensional format parameter features, generating a first feature vector model, and performing dimension reduction processing on the first feature vector model to obtain a second feature vector model; and according to the second feature vector model, identifying the protocol of the to-be-connected equipment. According to the embodiment of the invention, the protocol can be automatically identified, so that the identification efficiency of the protocol is improved; moreover, the method can integrate the multi-dimensional features for recognition, and can improve the accuracy of protocol recognition.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of protocol identification, and particularly relates to a protocol identification method and device, an electronic device and a storage medium. BACKGROUND

[0002] In the related art, device protocol adaptation can be achieved through manual coding. However, this approach has the problems of low protocol identification efficiency and high misidentification rate. SUMMARY

[0003] In view of the above problems, a protocol identification method, device, electronic device and storage medium are provided to overcome the above problems or at least partially solve the above problems, comprising: A protocol identification method, the method comprising: Obtaining a target communication message of a device to be connected, and extracting a multi-dimensional format parameter feature from the target communication message; Generating a first feature vector model according to the multi-dimensional format parameter feature, and performing dimension reduction processing on the first feature vector model to obtain a second feature vector model; According to the second feature vector model, the protocol of the device to be connected is identified.

[0004] In some embodiments, the generating a first feature vector model according to the multi-dimensional format parameter feature comprises: Converting the multi-dimensional format parameter feature into a numerical value to obtain a first feature numerical value; Normalizing the first feature numerical value to obtain a second feature numerical value; Generating the first feature vector model according to the second feature numerical value.

[0005] In some embodiments, the normalizing the first feature numerical value to obtain a second feature numerical value comprises: Obtaining a feature mean and a feature standard deviation of a feature type corresponding to the first feature numerical value; Determining the second feature numerical value according to the first feature numerical value, the feature mean and the feature standard deviation.

[0006] In some embodiments, the performing dimension reduction processing on the first feature vector model to obtain a second feature vector model comprises: According to the first feature vector model, a centralized feature matrix model is constructed; According to the feature matrix model, a covariance matrix model is constructed; According to the covariance matrix model, a projection matrix is determined, and the second feature vector model is determined according to the projection matrix and the feature matrix model.

[0007] In some embodiments, the identifying the protocol of the device to be connected according to the second feature vector model comprises: calculating protocol classification probabilities of the protocol of the device to be connected and each protocol type according to the second feature vector model; determining the target protocol of the device to be connected according to the protocol classification probabilities.

[0008] In some embodiments, the calculating protocol classification probabilities of the protocol of the device to be connected and each protocol type according to the second feature vector model comprises: calculating protocol classification probabilities corresponding to the second feature vector model according to the random forest classification model.

[0009] In some embodiments, the method further comprises: when none of the protocol classification probabilities exceeds the probability threshold, identifying the protocol of the device to be connected by data interaction with the device to be connected.

[0010] In some embodiments, the identifying the protocol of the device to be connected by data interaction with the device to be connected comprises: calculating a reward function by data interaction with the device to be connected; identifying the protocol of the device to be connected according to the reward function.

[0011] In some embodiments, the multi-dimensional format parameter feature comprises at least one of: a medium access control address prefix, a transmission control protocol option, and default port information.

[0012] Embodiments of the present application also provide a protocol identification device, which comprises: an acquisition module configured to acquire a target communication message of a device to be connected, and extract a multi-dimensional format parameter feature from the target communication message; a dimension reduction module configured to generate a first feature vector model according to the multi-dimensional format parameter feature, and perform dimension reduction processing on the first feature vector model to obtain a second feature vector model; an identification module configured to identify the protocol of the device to be connected according to the second feature vector model.

[0013] In some embodiments, the dimension reduction module is configured to perform numerical conversion on the multi-dimensional format parameter feature to obtain a first feature value, perform normalization processing on the first feature value to obtain a second feature value, and generate the first feature vector model according to the second feature value.

[0014] In some embodiments, the dimension reduction module is configured to obtain a feature mean and a feature standard deviation of a feature type corresponding to the first feature value; and determine the second feature value according to the first feature value, the feature mean and the feature standard deviation.

[0015] In some embodiments, the dimension reduction module is configured to construct a centralized feature matrix model according to the first feature vector model; construct a covariance matrix model according to the feature matrix model; determine a projection matrix according to the covariance matrix model, and determine the second feature vector model according to the projection matrix and the feature matrix model.

[0016] In some embodiments, the identification module is configured to calculate a protocol classification probability of each protocol type according to the second feature vector model; and determine the target protocol of the device to be connected according to the protocol classification probability.

[0017] In some embodiments, the identification module is configured to calculate a protocol classification probability corresponding to the second feature vector model according to a random forest classification model.

[0018] In some embodiments, the identification module is further configured to, when none of the protocol classification probabilities exceeds the probability threshold, identify the protocol of the device to be connected by performing data interaction with the device to be connected.

[0019] In some embodiments, the identification module is configured to calculate a reward function by performing data interaction with the device to be connected; and identify the protocol of the device to be connected according to the reward function.

[0020] In some embodiments, the multi-dimensional format parameter feature includes at least one of: a medium access control address prefix, a transmission control protocol option, and default port information.

[0021] Embodiments of the present application also provide an electronic device, including a processor, a memory, and a computer program stored in the memory and capable of running on the processor, and the computer program, when executed by the processor, implements the protocol identification method described above.

[0022] Embodiments of the present application also provide a computer readable storage medium, which stores a computer program, and the computer program, when executed by a processor, implements the protocol identification method described above.

[0023] Embodiments of the present application have the following advantages: In the embodiment of the present application, a target communication message of a device to be connected is acquired, and multi-dimensional format parameter features are extracted from the target communication message; a first feature vector model is generated according to the multi-dimensional format parameter features, and dimension reduction processing is performed on the first feature vector model to obtain a second feature vector model; and a protocol of the device to be connected is identified according to the second feature vector model. Through the embodiment of the present application, the protocol can be automatically identified, thereby improving the protocol identification efficiency; and the protocol can be identified by comprehensively considering multi-dimensional features, thereby improving the protocol identification accuracy. BRIEF DESCRIPTION OF DRAWINGS

[0024] The above and / or additional aspects and advantages of the present application will become apparent and be readily understood from the following description, taken in conjunction with the following drawings, in which: Figure 1 is a step flow chart of a protocol identification method according to an embodiment of the present application; Figure 2 is a step flow chart of another protocol identification method according to an embodiment of the present application; Figure 3 is a step flow chart of still another protocol identification method according to an embodiment of the present application; Figure 4 is a step flow chart of a protocol identification method according to an embodiment of the present application; Figure 5 is a step flow chart of dimension reduction processing according to an embodiment of the present application; Figure 6 is a structural schematic diagram of a protocol identification apparatus according to an embodiment of the present application. DETAILED DESCRIPTION

[0025] In order to make the above and other objectives, features and advantages of the present application more apparent, clear and understandable, the present application will be further described in detail below with reference to the drawings and specific embodiments. Obviously, the described embodiments are some embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the scope of protection of the present application.

[0026] In order to improve the protocol identification efficiency and the protocol identification accuracy, the present application provides a protocol identification method, which can identify the protocol of the device to be connected based on multi-dimensional format parameter features. Compared with the manual identification method, the present application can automatically identify the protocol, thereby improving the protocol identification efficiency; and the protocol can be identified by comprehensively considering multi-dimensional features, thereby improving the protocol identification accuracy.

[0027] Specifically, reference can be made to Figure 1 , Figure 1 shows a step flow chart of a protocol identification method according to an embodiment of the present application, as shown inFigure 1 As shown, the identification method of the protocol can include the following steps: Step 101, obtaining a target communication message of a to-be-connected device, and extracting a multi-dimensional format parameter feature from the target communication message.

[0028] The to-be-connected device can refer to a device whose protocol is not determined. The to-be-connected device can have the capability of communicating with the server, and can perform data interaction with the server according to a protocol set in advance at the factory, so that the server can identify the protocol of the to-be-connected device.

[0029] In the embodiments of the present application, when the to-be-connected device is connected, the server can perform data interaction with the to-be-connected device and obtain a first target communication message. The target communication message can refer to a standardized data frame (or data structure) that needs to be finally generated, sent or parsed according to the protocol rules of the target device / system - it is the "final product of protocol adaptation" and is also the "communication carrier" actually transmitted between devices.

[0030] After obtaining the target communication message, the server can identify and parse it and extract a multi-dimensional format parameter feature therefrom; In some embodiments of the present application, the multi-dimensional format parameter feature includes at least one of the following: a medium access control address prefix, a transmission control protocol option, and default port information.

[0031] The medium access control address prefix is an organizationally unique identifier (OUI), which is the content of the first three bytes (24 bits) of the MAC (Media Access Control) address. It is assigned by IEEE to network device manufacturers and is the core identifier for distinguishing different hardware manufacturers.

[0032] For example, in the MAC address 00-16-EA-AE-3C-40, 00-16-EA is the prefix, representing the manufacturer of the network card. Through this prefix, the network device can quickly identify the manufacturer of the hardware device sending data, which is very useful in device access authentication, network device management and other scenarios. For example, some local area networks can limit the access of devices of specific brands by MAC prefix.

[0033] The transmission control protocol option is an optional extension field in the TCP (Transmission Control Protocol) message header, which is not fixed in length but needs to be an integer multiple of 32 bits, and is used to extend the TCP protocol function and optimize the transmission performance.

[0034] The default port information is a communication port preset by a network service or an application in a factory or standard configuration, used for quickly locating and connecting the corresponding service by a client without manually specifying the port.

[0035] For example, the multi-dimensional format parameter feature can include format parameter features of multiple dimensions; the format parameter feature can refer to a feature extracted from the format parameter and representing the format parameter.

[0036] The format parameter can refer to a parameter extracted from the target communication message and related to the format of the protocol of the target communication message, for example, a media access control address prefix, a transmission control protocol option, default port information, and the like; for example, the format parameter can also include load information, application layer load length, and the like, which are not limited in the embodiments of the present application.

[0037] In step 102, a first feature vector model is generated according to the multi-dimensional format parameter feature, and the first feature vector model is processed by dimension reduction to obtain a second feature vector model.

[0038] After obtaining the multi-dimensional format parameter feature, the multi-dimensional format parameter feature can be composed into the first feature vector model; for example, the first feature vector model can be composed of feature vectors of the multi-dimensional format parameter feature.

[0039] After obtaining the first feature vector model, the first feature vector model can be processed by dimension reduction in order to reduce noise and improve calculation efficiency; for example, the first feature vector model can be processed by dimension reduction by principal component analysis (PCA) to obtain the second feature vector model.

[0040] In step 103, the protocol of the device to be connected is identified according to the second feature vector model.

[0041] After obtaining the second feature vector model, the protocol of the device to be connected can be identified by identifying and analyzing the second feature vector model, so as to identify the target protocol of the device to be connected; for example, the target protocol can include a communication protocol, a software protocol, a hardware protocol, a data protocol, a service protocol, and the like of the device to be connected, which are not limited in the embodiments of the present application.

[0042] In the embodiment of the present application, the target communication message of the device to be connected is obtained, and multi-dimensional format parameter features are extracted from the target communication message; a first feature vector model is generated according to the multi-dimensional format parameter features, and the first feature vector model is processed by dimension reduction to obtain a second feature vector model; and the protocol of the device to be connected is identified according to the second feature vector model. Through the embodiment of the present application, the protocol can be automatically identified, thereby improving the identification efficiency of the protocol; and the present application can comprehensively identify multi-dimensional features, thereby improving the accuracy of protocol identification.

[0043] Referring to Figure 2 , another step flowchart of the protocol identification method of the embodiment of the present application is shown, which can include the following steps: Step 201, obtaining a target communication message of a device to be connected, and extracting multi-dimensional format parameter features from the target communication message.

[0044] In the embodiment of the present application, when the device to be connected is connected, the server can interact with the device to be connected and obtain the first target communication message.

[0045] After obtaining the target communication message, the server can identify and analyze it to extract multi-dimensional format parameter features, such as media access control address prefix, transmission control protocol option, and default port information, which are not limited by the embodiment of the present application.

[0046] Step 202, performing numerical conversion on the multi-dimensional format parameter features to obtain first feature values.

[0047] After obtaining the multi-dimensional format parameter features, numerical conversion can be performed first for subsequent processing; specifically, the multi-dimensional format parameter features can be first converted into numerical values, thereby obtaining first feature values.

[0048] For example, the first 3 bytes (OUI field) of the source MAC address can be extracted and converted into a 24-bit binary feature value.

[0049] In another example, the first 8 bytes of the payload can be extracted, each byte is converted into an integer of 0-255 and normalized.

[0050] In yet another example, the length of the application layer payload (such as the Modbus PDU length) can be calculated, which is not limited by the embodiment of the present application.

[0051] Step 203, performing normalization processing on the first feature values to obtain second feature values.

[0052] After obtaining the first feature value, the first feature value can be normalized to eliminate the dimensional difference of the feature / data, scale the numerical range, make information of different dimensions comparable, and optimize the calculation efficiency and model performance. After the first feature value is normalized, a second feature value can be obtained.

[0053] Step 204, generating a first feature vector model according to the second feature value.

[0054] After obtaining the second feature value, a first feature vector model can be generated according to the second feature value.

[0055] For example, the first feature vector model can be represented as X ∈ R m*n , where m is the number of samples and n is the feature dimension.

[0056] Step 205, constructing a centralized feature matrix model according to the first feature vector model.

[0057] After obtaining the first feature vector model, a centralized feature matrix model can be constructed according to the first feature vector model. The centralized feature matrix model is essentially a data model obtained by performing mean removal operation on the original feature matrix. The core goal is to eliminate the mean deviation of the feature, so that the data distribution is centered at the origin, thereby optimizing the calculation efficiency and result accuracy of the subsequent algorithm.

[0058] Step 206, constructing a covariance matrix model according to the feature matrix model.

[0059] In some embodiments, a covariance matrix model can also be constructed according to the feature matrix model. The covariance matrix model is a core mathematical model for describing the linear correlation between features in high-dimensional data. It is essentially a symmetric matrix, and each element corresponds to the covariance of two features, which fully describes the distribution structure of high-dimensional data.

[0060] Step 207, determining a projection matrix according to the covariance matrix model, and determining a second feature vector model according to the projection matrix and the feature matrix model.

[0061] After determining the covariance matrix model, the covariance matrix model can be decomposed to find the principal component direction. Then, the key feature vectors can be screened and combined to form a projection matrix.

[0062] After obtaining the projection matrix, a second feature vector model after dimensionality reduction can be determined according to the projection matrix and the feature matrix model.

[0063] Step 208, calculating the protocol classification probability of the protocol of the to-be-connected device and each protocol type according to the second feature vector model.

[0064] After the second feature vector model is determined, protocol classification probabilities of the second feature vector model and each protocol type can be calculated respectively; the protocol classification probability can refer to a probability that the protocol of the device to be connected can correspond to the protocol type.

[0065] Step 209, determining a target protocol of the device to be connected according to the protocol classification probability.

[0066] After the protocol classification probabilities of the second feature vector model and each protocol type are determined, the protocol type corresponding to the protocol classification probability with the largest value and exceeding a threshold value can be determined as the target protocol of the device to be connected.

[0067] In the embodiment of the present application, a target communication message of the device to be connected is obtained, and multi-dimensional format parameter features are extracted from the target communication message; numerical conversion is performed on the multi-dimensional format parameter features to obtain first feature values; the first feature values are normalized to obtain second feature values; a first feature vector model is generated according to the second feature values; a centralized feature matrix model is constructed according to the first feature vector model; a covariance matrix model is constructed according to the feature matrix model; a projection matrix is determined according to the covariance matrix model, and a second feature vector model is determined according to the projection matrix and the feature matrix model; protocol classification probabilities of the protocol of the device to be connected and each protocol type are calculated according to the second feature vector model; and a target protocol of the device to be connected is determined according to the protocol classification probability. Through the embodiment of the present application, the protocol recognition accuracy can be improved and the matching delay can be reduced.

[0068] Referring to Figure 3 , another step flowchart of a protocol recognition method according to an embodiment of the present application is shown, which can include the following steps: Step 301, obtaining a target communication message of a device to be connected, and extracting multi-dimensional format parameter features from the target communication message.

[0069] In the embodiment of the present application, when the device to be connected is connected, the server can interact with the device to be connected and obtain the first target communication message.

[0070] After the target communication message is obtained, the server can recognize and analyze it to extract multi-dimensional format parameter features therefrom, such as a media access control address prefix, a transmission control protocol option, and default port information, which are not limited in the embodiment of the present application.

[0071] Step 302, performing numerical conversion on the multi-dimensional format parameter features to obtain first feature values.

[0072] After obtaining the multi-dimensional format parameter feature, numerical conversion can be performed on the multi-dimensional format parameter feature, so as to facilitate subsequent processing. Specifically, numerical conversion can be performed on the multi-dimensional format parameter feature, so as to obtain a first feature value.

[0073] For example, the first three bytes of the source MAC address can be extracted and converted into a 24-bit binary feature value.

[0074] In another example, the first eight bytes of the payload can be extracted, each byte can be converted into an integer from 0 to 255, and normalization can be performed.

[0075] In yet another example, the length of the application layer payload can be calculated, and embodiments of the present application do not limit the length.

[0076] In step 303, the feature mean and the feature standard deviation of the feature type corresponding to the first feature value are obtained.

[0077] After obtaining the first feature value, normalization can be performed on the first feature value, so as to eliminate the dimensional difference of the feature / data, scale the numerical range, make the information of different dimensions comparable, and optimize the calculation efficiency and model performance. After normalization of the first feature value, a second feature value can be obtained.

[0078] For example, when the multi-dimensional format parameter feature is numerically converted, a plurality of first feature values of different feature types can be obtained, such as a first feature value corresponding to a media access control address prefix, a first feature value corresponding to a transmission control protocol option, and a first feature value corresponding to default port information.

[0079] In some embodiments, after obtaining the first feature value, the feature mean of the feature type corresponding to the first feature value and the feature standard deviation of the feature type corresponding to the first feature value can be obtained.

[0080] In step 304, the second feature value is determined according to the first feature value, the feature mean, and the feature standard deviation.

[0081] After obtaining the feature mean and the feature standard deviation of the feature type corresponding to the first feature value, normalization can be performed on the first feature value according to the feature mean and the feature standard deviation, so as to obtain the second feature value.

[0082] For example, the second feature value can be calculated by the following formula: ; wherein x norm is the second feature value, x is the first feature value, μ is the feature mean, and σ is the feature standard deviation.

[0083] Step 305, generating a first feature vector model according to the second feature value.

[0084] After obtaining the second feature value, a first feature vector model can be generated according to the second feature value. For example, the elements in the first feature vector model can be composed of the second feature value.

[0085] Step 306, constructing a centralized feature matrix model according to the first feature vector model.

[0086] After obtaining the first feature vector model, a centralized feature matrix model can be constructed according to the first feature vector model. The centralized feature matrix model is essentially a data model obtained by performing mean removal operation on the original feature matrix. The core goal is to eliminate the mean deviation of the features, so that the data distribution is centered at the origin, thereby optimizing the calculation efficiency and result accuracy of the subsequent algorithm.

[0087] Step 307, constructing a covariance matrix model according to the feature matrix model.

[0088] In some embodiments, a covariance matrix model can also be constructed according to the feature matrix model. The covariance matrix model is a core mathematical model for describing the linear correlation between features in high-dimensional data. Its essence is a symmetric matrix, and each element corresponds to the covariance of two features, which fully describes the distribution structure of high-dimensional data.

[0089] Step 308, determining a projection matrix according to the covariance matrix model, and determining a second feature vector model according to the projection matrix and the feature matrix model.

[0090] After determining the covariance matrix model, the covariance matrix model can be decomposed to find the principal component direction. Then, the key feature vectors can be screened and composed into a projection matrix.

[0091] After obtaining the projection matrix, the second feature vector model after dimensionality reduction can be determined according to the projection matrix and the feature matrix model.

[0092] Step 309, calculating the protocol classification probability corresponding to the second feature vector model according to the random forest classification model.

[0093] After determining the second feature vector model, the protocol classification probability of the second feature vector model and each protocol type can be calculated respectively. The protocol classification probability can refer to the probability of the protocol type to which the protocol of the device to be connected may correspond.

[0094] For example, after obtaining the second feature vector model, the protocol classification probability of the second feature vector model and at least one or more protocol types can be calculated according to the random forest classification model.

[0095] wherein the random forest classifier is a classic supervised classification algorithm based on the idea of ensemble learning, the core of which is to output the final classification result by constructing multiple decision trees and using a voting mechanism. It not only retains the advantages of decision trees such as easy interpretation and no need for feature preprocessing, but also solves the problem of overfitting of a single decision tree through random sampling and random feature selection, and is widely used in technical fields such as industrial detection, network security, and autonomous driving. Based on the random forest classification model, the accuracy and concurrent processing capability of protocol identification can be further improved.

[0096] In some embodiments, the random forest is composed of N decision trees, each tree splits nodes based on the Gini index; the present application can output a protocol classification probability from each tree; for example, the protocol classification probability can be a probability for one or more protocol types.

[0097] Step 310, determining the target protocol of the device to be connected according to the protocol classification probability.

[0098] After determining the protocol classification probability, the maximum value of the protocol classification probability is determined, and it is determined whether the protocol classification probability is greater than a preset probability threshold, for example, 0.9. If the maximum value of the protocol classification probability is greater than the preset probability threshold, it can be further determined that the protocol classification probability is the target protocol classification probability.

[0099] Next, the present application determines the protocol type corresponding to the target protocol classification probability, and determines the protocol type as the target protocol of the device to be connected.

[0100] Step 311, when none of the protocol classification probabilities exceeds the probability threshold, the protocol of the device to be connected is identified by interacting with the device to be connected.

[0101] In some embodiments, if all the determined protocol classification probabilities do not exceed the probability threshold, in order to ensure the accuracy of protocol identification, the present application can identify the protocol of the device to be connected by interacting with the device to be connected.

[0102] In some embodiments of the present application, step 311 can be implemented by the following sub-steps: Sub-step 11, calculating the reward function by interacting with the device to be connected.

[0103] In some embodiments, the target protocol of the device to be connected can be identified and saved according to a Markov decision model (MDP). Specifically, a state space and an action space can be defined first; the state space can be set as a device response feedback, such as a response code and a delay time; and the action space can be defined as a type of a protocol probe packet sent, such as a Modbus query packet and a CoAP handshake packet.

[0104] Next, the server can interact with the device to be connected based on the state space and the action space, and calculate a reward function based on an interaction result.

[0105] Sub-step 12: identifying the protocol of the device to be connected according to the reward function.

[0106] After the reward function is calculated, the protocol of the device to be connected can be identified according to the reward function to determine the target protocol of the device to be connected.

[0107] In some embodiments, after the target protocol is determined, a corresponding relationship between the device to be connected and the target protocol can be saved, and a random forest classification model can be updated by analyzing a packet of the device to be connected and extracting features.

[0108] In some other embodiments, after the corresponding relationship between the device to be connected and the target protocol is saved, the protocol library can also be updated in real time based on the corresponding relationship.

[0109] In the embodiment of the present application, the target communication message of the device to be connected is obtained, and multi-dimensional format parameter features are extracted from the target communication message. Numerical conversion is performed on the multi-dimensional format parameter features to obtain first feature values. The feature mean and feature standard deviation of the feature type corresponding to the first feature values are obtained. The second feature values are determined according to the first feature values, the feature mean and the feature standard deviation. The first feature vector model is generated according to the second feature values. The centralized feature matrix model is constructed according to the first feature vector model. The covariance matrix model is constructed according to the feature matrix model. The projection matrix is determined according to the covariance matrix model, and the second feature vector model is determined according to the projection matrix and the feature matrix model. The protocol classification probability corresponding to the second feature vector model is calculated according to the random forest classification model. The target protocol of the device to be connected is determined according to the protocol classification probability. When the protocol classification probability does not exceed the probability threshold, the protocol of the device to be connected is identified by data interaction with the device to be connected. The present application reduces feature redundancy by introducing principal component analysis for dimensionality reduction processing of the multi-dimensional format parameter features of the message of the device to be connected. The random forest classification model is used for protocol matching to improve accuracy and concurrent processing capability. The PCA mathematics is integrated into the feature extraction stage to automatically retain principal components with a variance contribution rate of ≥95%, reducing the dimension to 1 / 3 of the original. The random forest classification model sets a confidence threshold (≥90%) to achieve high-precision matching. The present application can improve protocol identification accuracy, reduce matching delay, support single gateway processing of multiple protocols concurrently, and improve computational efficiency.

[0110] In addition, the present application uses a Q-learning reinforcement learning model to optimize the interactive learning process, models the protocol detection as a Markov decision model, dynamically adjusts the detection packet sending strategy, and integrates an incremental learning algorithm to realize automatic updating of the protocol library. The present application can define a state space (device response feedback), an action space (detection packet type), and a reward function (such as +10 reward for correct identification), quickly converge through Q value updating, and use a streaming random forest for incremental expansion of the protocol library. Through the embodiment of the present application, the learning period can be shortened, the convergence speed can be improved, and the protocol library can support real-time updating.

[0111] Referring to Figure 4 , a step flowchart of protocol identification according to an embodiment of the present application is shown: S100, a device to be connected is accessed; The device to be connected is a device whose protocol is not confirmed, and the device to be connected has communication capability with a server and can perform data interaction with the server according to a protocol set by the device to be connected before leaving the factory; S200, a server obtains a message of the device to be connected, and performs feature extraction and dimensionality reduction on the message to generate a dimensionality reduction feature vector (i.e., a second feature vector model); When the to-be-connected device accesses, the server obtains the multi-dimensional features in the first communication message, the multi-dimensional format parameter features, and the multi-dimensional format parameter features are format parameters in device communication, such as a MAC (Media Access Control) address prefix, a TCP (Transmission Control Protocol) option, and a default port.

[0112] To reduce noise and improve computational efficiency, principal component analysis (PCA) can be used to reduce the dimensionality of the features, specifically including the following steps: Figure 5 S210, the feature item value is converted, and normalized to generate an original feature vector (i.e., a first feature vector model); Specifically, different protocol samples and corresponding feature items are preset, and the multi-dimensional format parameter features are converted, such as extracting the first 3 bytes (OUI field) of the source MAC address, converting them into 24-bit binary feature values; extracting the first 8 bytes of the load, converting each byte into an integer from 0 to 255 and normalizing; calculating the application layer load length (such as the Modbus PDU length), normalizing, etc. The normalization processing is to use the Z-Score model to process the first feature value to obtain a normalized value of 0-1, and the Z-Score model is: ; In the formula, is the feature mean, is the feature standard deviation; After numerical conversion and normalization processing, the first feature vector model is formed , where m is the number of samples and n is the feature dimension. ; wherein, is the value corresponding to the different format parameter features.

[0113] S220, the first feature vector model is processed by dimensionality reduction; Specifically, a centralized feature matrix model ( is the mean vector) and a covariance matrix model of dimension are established, and the covariance model is: ; The eigenvalue decomposition model is solved , where is the eigenvalue, is the eigenvector; the eigenvalues are arranged in descending order; The cumulative variance contribution rate is calculated, and the calculation formula is: ​ ; The minimum k value is selected so that ; The projection matrix , dimension n x k; S230, dimension reduction transformation, obtaining a second feature vector model; Specifically, the second feature vector model Z is obtained by the dimension reduction transformation model, and the dimension reduction transformation model is: ; S300, according to the random forest classification model, matching the protocol; The random forest is composed of N decision trees, each tree splits the node based on the Gini index, and the protocol classification probability is: ; In the formula, is the prediction result of the i-th tree, is the protocol category; A confidence threshold θ is set to determine whether the protocol classification probability is greater than the confidence threshold θ. If yes, the matching is successful, and step S500 is executed. Otherwise, the matching fails, and step S400 is executed. In the embodiment, θ is 0.9; S400, according to the Markov decision model, identifying the protocol and saving; Specifically, the state space is set as the device response feedback, such as response code and delay time; The action space uses the sent protocol probe packet type, such as Modbus query packet and CoAP handshake packet; The reward function is: ; The Q value update model is:

[0114] In the formula, is the learning rate, is the discount factor; for example, It can be 0.1, It can be 0.9.

[0115] Step S500, saving the identified protocol; According to the identified target protocol, the correspondence between the to-be-connected device and the identified protocol is saved.

[0116] According to the above method, the problems of feature redundancy, low matching efficiency, slow learning convergence and code generation dependent on artificial in the prior art are solved.

[0117] It should be noted that for the method embodiments, the series of acts complement each other to achieve the purpose of this application, therefore, the sequence of the acts should not be construed as a limitation on the implementation of the application. In addition, those skilled in the art should understand that the acts described in the specification are only preferred acts, and not all acts are necessary for the implementation of the application.

[0118] Referring to Figure 6 , a structure schematic diagram of a protocol identification device according to an embodiment of the application is shown, which can include the following modules: The acquisition module 601 is configured to acquire a target communication message of a device to be connected, and extract a multi-dimensional format parameter feature from the target communication message. The dimension reduction module 602 is configured to generate a first feature vector model according to the multi-dimensional format parameter feature, and perform dimension reduction processing on the first feature vector model to obtain a second feature vector model. The identification module 603 is configured to identify the protocol of the device to be connected according to the second feature vector model.

[0119] In an optional embodiment of the application, the dimension reduction module 602 is configured to perform numerical conversion on the multi-dimensional format parameter feature to obtain a first feature value, perform normalization processing on the first feature value to obtain a second feature value, and generate the first feature vector model according to the second feature value.

[0120] In an optional embodiment of the application, the dimension reduction module 602 is configured to acquire a feature mean and a feature standard deviation of a feature type corresponding to the first feature value, and determine the second feature value according to the first feature value, the feature mean and the feature standard deviation.

[0121] In an optional embodiment of the application, the dimension reduction module 602 is configured to construct a centralized feature matrix model according to the first feature vector model, construct a covariance matrix model according to the feature matrix model, determine a projection matrix according to the covariance matrix model, and determine the second feature vector model according to the projection matrix and the feature matrix model.

[0122] In an optional embodiment of the application, the identification module 603 is configured to calculate a protocol classification probability of the protocol of the device to be connected and each protocol type according to the second feature vector model, and determine a target protocol of the device to be connected according to the protocol classification probability.

[0123] In an optional embodiment of the application, the identification module 603 is configured to calculate a protocol classification probability corresponding to the second feature vector model according to a random forest classification model.

[0124] In an optional embodiment of the present application, the identification module 603 is further configured to, when none of the protocol classification probabilities exceeds the probability threshold, identify the protocol of the device to be connected by interacting with the device to be connected.

[0125] In an optional embodiment of the present application, the identification module 603 is configured to calculate a reward function by interacting with the device to be connected, and identify the protocol of the device to be connected according to the reward function.

[0126] In an optional embodiment of the present application, the multi-dimensional format parameter feature includes at least one of the following: a medium access control address prefix, a transmission control protocol option, and default port information.

[0127] In an embodiment of the present application, the target communication message of the device to be connected is obtained, and a multi-dimensional format parameter feature is extracted from the target communication message. A first feature vector model is generated according to the multi-dimensional format parameter feature, and the first feature vector model is processed by dimension reduction to obtain a second feature vector model. The protocol of the device to be connected is identified according to the second feature vector model. Through the embodiment of the present application, the protocol can be automatically identified, thereby improving the identification efficiency of the protocol. In addition, the protocol can be identified by comprehensively considering multi-dimensional features, thereby improving the accuracy of protocol identification.

[0128] An electronic device is also provided in an embodiment of the present application, which includes a processor, a memory, and a computer program stored on the memory and capable of running on the processor. When the computer program is executed by the processor, the protocol identification method described above is implemented.

[0129] A computer readable storage medium is also provided in an embodiment of the present application, which stores a computer program. When the computer program is executed by the processor, the protocol identification method described above is implemented.

[0130] For the device embodiment, it is basically similar to the method embodiment, so the description is relatively simple, and the related parts are described in the part of the method embodiment.

[0131] Each embodiment in the specification is described in a progressive manner, and each embodiment mainly describes the difference from other embodiments. The same and similar parts of each embodiment can be referred to each other.

[0132] Those skilled in the art will appreciate that embodiments of the application can be supplied as a method, a device, or a computer program product. Thus, embodiments of the application can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, embodiments of the application can take the form of a computer program product on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROMs, optical storage devices, etc.) embodying computer readable program code.

[0133] Embodiments of the application are described herein with reference to the drawings, in which are shown flowcharts and / or block diagrams of methods, apparatuses (systems) and computer program products according to embodiments of the application. It will be understood that each block of the flowcharts and / or block diagrams, and combinations of blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processing device or other programmable data processing terminal devices to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing terminal devices, create means for implementing the functions specified in the flowcharts and / or block diagrams block or blocks. Figure 1 one or more functions specified in the flowchart and / or block diagram block or blocks. Figure 1 one or more functions specified in the flowchart and / or block diagram block or blocks.

[0134] These computer program instructions can also be stored in a computer- readable memory that can direct a computer or other programmable data processing terminal device to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instructions which implement the function specified in the flowchart and / or block diagram block or blocks. Figure 1 one or more functions specified in the flowchart and / or block diagram block or blocks. Figure 1 one or more functions specified in the flowchart and / or block diagram block or blocks.

[0135] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device to cause a series of operational steps to be performed on the computer or other programmable terminal device to produce a computer-implemented process such that the instructions which execute on the computer or other programmable terminal device provide steps for implementing the functions specified in the flowchart and / or block diagram block or blocks. Figure 1 one or more functions specified in the flowchart and / or block diagram block or blocks. Figure 1 one or more functions specified in the flowchart and / or block diagram block or blocks.

[0136] Although preferred embodiments of the application have been described, those skilled in the art will appreciate that additional modifications and alterations can be made to the embodiments without departing from the scope of the application. Accordingly, the appended claims are intended to cover all such modifications and alterations as fall within the scope of the application.

[0137] Finally, it is to be understood that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting; it is not intended to exclude myriad other embodiments of the present application that other inventors can develop based on the same general inventive concepts embodied by the described embodiments. That is, although the present application is described in terms of particular embodiments and implementations, it is to be understood that the terminology used is for the purpose of descriptive clarity and that it should be taken in its broadest possible sense. For example, the terms "first" and "second" are used herein only to differentiate one element from another, without necessarily requiring or implying any actual relationship or order between or among the elements. Moreover, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can also include other elements not expressly listed or inherent to such process, method, article, or apparatus. An element proceeded by "comprises... a" does not, without more constraints, exclude the presence of additional identical elements in the process, method, article, or apparatus that comprises the element.

[0138] The above provides a detailed description of the provided protocol identification method, device, electronic equipment and storage medium. The principles and implementation modes of the present application are described by applying specific examples. The above example description is only used to help understand the method and core idea of the present application. Meanwhile, for those skilled in the art, according to the idea of the present application, the specific implementation mode and application range will be changed. In summary, the content of the specification should not be understood as a limitation of the present application.

Claims

1. A method for identifying a protocol, characterized in that, The method includes: Acquire the target communication message of the device to be connected, and extract multi-dimensional format parameter features from the target communication message; Based on the multidimensional format parameter features, a first feature vector model is generated, and the first feature vector model is subjected to dimensionality reduction processing to obtain a second feature vector model. The protocol of the device to be connected is identified based on the second feature vector model.

2. The method according to claim 1, characterized in that, The step of generating a first feature vector model based on the multidimensional format parameter features includes: The multidimensional format parameter features are numerically converted to obtain the first feature value; The first feature value is normalized to obtain the second feature value; The first feature vector model is generated based on the second feature value.

3. The method according to claim 2, characterized in that, The normalization process for the first feature value to obtain the second feature value includes: Obtain the feature mean and feature standard deviation of the feature type corresponding to the first feature value; The second feature value is determined based on the first feature value, the feature mean, and the feature standard deviation.

4. The method according to claim 1, characterized in that, The step of reducing the dimensionality of the first feature vector model to obtain the second feature vector model includes: Based on the first feature vector model, construct a centered feature matrix model; Based on the feature matrix model, construct the covariance matrix model; Based on the covariance matrix model, the projection matrix is ​​determined, and based on the projection matrix and the feature matrix model, the second feature vector model is determined.

5. The method according to claim 1, characterized in that, The step of identifying the protocol of the device to be connected based on the second feature vector model includes: Based on the second feature vector model, calculate the protocol of the device to be connected and the protocol classification probability of each protocol type; The target protocol of the device to be connected is determined based on the protocol classification probability.

6. The method according to claim 5, characterized in that, The step of calculating the protocol classification probability of the device to be connected and each protocol type based on the second feature vector model includes: Based on the random forest classification model, calculate the protocol classification probability corresponding to the second feature vector model.

7. The method according to claim 6, characterized in that, The method further includes: When the probability of each protocol classification does not exceed the probability threshold, the protocol of the device to be connected is identified by data interaction with the device to be connected.

8. The method according to claim 7, characterized in that, The step of identifying the protocol of the device to be connected by exchanging data with the device to be connected includes: The reward function is calculated by interacting with the device to be connected; The protocol of the device to be connected is identified based on the reward function.

9. The method according to any one of claims 1-8, characterized in that, The multidimensional format parameter features include at least one of the following: Media access control address prefix, transmission control protocol options, and default port information.

10. A protocol identification device, characterized in that, The device includes: The acquisition module is used to acquire the target communication message of the device to be connected, and extract multi-dimensional format parameter features from the target communication message; The dimensionality reduction module is used to generate a first feature vector model based on the multidimensional format parameter features, and to perform dimensionality reduction processing on the first feature vector model to obtain a second feature vector model. The identification module is used to identify the protocol of the device to be connected based on the second feature vector model.

11. An electronic device, characterized in that, It includes a processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein the computer program, when executed by the processor, implements the identification method of any one of claims 1 to 9.

12. A computer-readable storage medium, characterized in that, A computer program is stored on the computer-readable storage medium, which, when executed by a processor, implements the identification method of the protocol as described in any one of claims 1 to 9.

Images