Protocol identification method for electric power Internet of Things terminal

Abstract

The invention discloses a protocol identification method for an electric power Internet of Things terminal, which comprises the following steps: interacting with the electric power Internet of Things terminal, acquiring protocol data in the interaction process, and carrying out data preprocessing on the protocol data to form an effective load data set; performing feature extraction on the effective load data in the effective load data set to obtain input features; inputting the input features into a power Internet of Things terminal equipment protocol classification model constructed based on a density space clustering method, carrying out learning training, and outputting a classification model after training is finished; and inputting the to-be-classified present network protocol message data subjected to data preprocessing and feature extraction into the trained classification model for classification, and outputting a classification result. The method does not depend on manual labeling any more, the influence of manual intervention and errors is reduced, the method can quickly adapt to access of new equipment and change of protocols in the dynamic environment of the power Internet of Things terminal equipment, and the stability and safety of a power system are guaranteed.

Description

Technical Field

[0001] This invention relates to the technical field of power Internet of Things (IoT) and information communication, and in particular to a protocol identification method for power IoT terminals. Background Technology

[0002] With the rapid development of the power Internet of Things (IoT), the intelligence level of power equipment is constantly improving, and the challenges faced by power grid management and operation and maintenance are becoming increasingly complex. The core of the power IoT system lies in the real-time monitoring and management of power equipment through various intelligent terminal devices to achieve precise control over the operation status of the power grid. Against this backdrop, consumers have increasingly higher requirements for power services and quality, and power companies and power grid management departments need more efficient operation and maintenance management tools and service systems. However, with the increase in intelligent power IoT terminal devices, the lack of uniformity in protocols between devices has become a major pain point in power grid management and operation and maintenance.

[0003] Currently, the protocols used by power IoT terminal devices are numerous, such as the 698 protocol, 645 protocol, and Modbus protocol. Some devices even have unknown protocols. This poses a significant challenge to power grid maintenance personnel during device access and management. The lack of unified protocol standards for power IoT, coupled with the heterogeneity of devices and protocol incompatibility, leads to the complexity of data acquisition and processing. Power grid maintenance personnel need to manually confirm the protocol type of the devices and configure and debug them. This process not only consumes a lot of time and human resources, but misconfiguration can also cause devices to malfunction, affecting the stability and security of the power system. In addition, existing automated management systems still rely on manual labeling and testing for protocol classification, which is not only inefficient but also lacks flexibility and scalability.

[0004] As the scale of power Internet of Things (IoT) terminal devices continues to expand, how to efficiently and accurately classify and manage various device protocols has become an urgent technical challenge. Summary of the Invention

[0005] The purpose of this section is to outline some aspects of the embodiments of the present invention and to briefly introduce some preferred embodiments. Some simplifications or omissions may be made in this section, as well as in the abstract and title of the present application, to avoid obscuring the purpose of this section, the abstract and title of the invention. Such simplifications or omissions shall not be used to limit the scope of the present invention.

[0006] In view of the aforementioned existing problems, the present invention is proposed.

[0007] Therefore, the technical problem solved by this invention is the problem of numerous protocol types, unknown protocols, complex manual configuration, and low efficiency in the existing automatic classification process of power Internet of Things terminal equipment protocols.

[0008] To solve the above-mentioned technical problems, the present invention provides the following technical solution: interacting with a power Internet of Things terminal, obtaining protocol data during the interaction process, and performing data preprocessing to form an effective load dataset;

[0009] Feature extraction is performed on the payload data in the payload dataset to obtain input features;

[0010] The input features are input into the power Internet of Things terminal device protocol classification model constructed based on the density space clustering method, and the model is trained and the classification model after training is output.

[0011] The preprocessed and feature-extracted network protocol message data to be classified is input into the trained classification model for classification, and the classification result is output.

[0012] As a preferred embodiment of the protocol identification method for power Internet of Things terminals described in this invention, the formation of the effective load dataset includes:

[0013] Acquire protocol data from different smart power IoT terminals, including at least 5,000 data entries. Analyze the application layer data in the protocol pcap packet data, use regular expressions to remove invalid characters in the data, and extract the hexadecimal effective load application data.

[0014] The payload application data is converted from hexadecimal to decimal data, and blank fields are filled with fixed decimal values ​​to ensure that different data have consistent lengths.

[0015] The dataset is then scaled to normalize its size, resulting in a payload dataset in numerical form.

[0016] As a preferred embodiment of the protocol identification method for power Internet of Things terminals described in this invention, the scale normalization process includes:

[0017]

[0018] Where μ represents the average value of the data for each protocol type, σ represents the standard deviation of the data, and x * x and y represent the data before and after normalization, respectively.

[0019] As a preferred embodiment of the protocol identification method for power Internet of Things terminals described in this invention, feature extraction is performed on the effective load data in the effective load dataset, including:

[0020] Feature extraction techniques are used to select effective features closely related to message byte length, inter-message distance, and address information data, and these features are used as input features.

[0021] The input features include at least the length of a single data packet, the average length of a data packet, the difference between the length of a single data packet and the average length of a data packet, the difference between the length of a single data packet and the length of the longest data packet, and the difference between the length of a single data packet and the length of the shortest data packet.

[0022] As a preferred embodiment of the protocol identification method for power IoT terminals described in this invention, the input features are input into a power IoT terminal device protocol classification model constructed based on density space clustering method for learning and training, including:

[0023] Based on the input features, construct a sample set D = {x1, x2, x3, ..., x...} n}, set neighborhood parameters ε and MinPts, where ε is the sample distance threshold and MinPts is the minimum number of samples required to form a cluster;

[0024] For each sample point x i Calculate its relationship with all other sample points x j Euclidean distance d(x) i ,x j ):

[0025]

[0026] Where, x ik and x jk They represent samples x respectively i and x j The kth feature value, where m is the total number of features;

[0027] For sample point x i The statistics satisfy d(x) i ,x j The number of sample points ≤ ε, including x i itself;

[0028] If x i The number of points N in the ε neighborhood i If x ≥ MinPts, then x i Mark as core point;

[0029] Add all sample points in its neighborhood that are marked as core points to the core point set CorePoints and classify them into the same cluster C;

[0030] Repeat the above steps until all neighborhood samples of the core points have been processed.

[0031] Output the classification results, i.e., all identified clusters C1, C2, ..., C6. m .

[0032] As a preferred embodiment of the protocol identification method for power Internet of Things terminals described in this invention, the classification result includes at least protocol type tags corresponding to each cluster, including but not limited to Modbus, DNP3, IEC104, and MQTT protocol names, with each cluster representing a protocol type.

[0033] The classification results are represented in the form of a mapping or list to show the correspondence between data samples and protocol types.

[0034] As a preferred embodiment of the protocol identification method for power Internet of Things terminals described in this invention, the specific process of classification is as follows:

[0035] Label sample points, where N is the number of points within an ε-neighborhood. i Sample points ≥MinPts are taken as core points, sample points that are not core points but are located in the ε-neighborhood of a core point are taken as boundary points, and sample points that are neither core points nor boundary points are taken as noise points and the noise points are removed.

[0036] Assign an initial cluster label to each core point and start a new cluster;

[0037] For each core point, add all points within its ε-neighborhood, including both core points and boundary points, to the same cluster;

[0038] If a point in the ε-neighborhood is also a core point, then recursively add the points in its neighborhood to the same cluster;

[0039] Repeat the above process until the current cluster can no longer be expanded;

[0040] For any unprocessed core points, repeat the above steps until all core points have been processed.

[0041] The output is a classified cluster, each cluster representing a protocol type, including at least Modbus, DNP3, IEC104, and MQTT. Each sample point is assigned a category label to its cluster, i.e., the protocol type.

[0042] As a preferred embodiment of the protocol identification method for power Internet of Things (IoT) terminals described in this invention, the model output with the best learning and training effect is selected as the final classification model based on the K-fold cross-validation method. Its mathematical expression formula is as follows:

[0043]

[0044] Among them, y final_prediction For the final output, y prediction (i) represents the output of each model in the 5-fold cross-validation.

[0045] As a preferred embodiment of the computer device described in this invention, it includes:

[0046] One or more processors;

[0047] The memory stores operable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations, including the process described above for the protocol identification method for power Internet of Things terminals.

[0048] As a preferred embodiment of the computer-readable medium for the storage software described in this invention, the software includes instructions executable by one or more computers, the instructions causing the one or more computers to perform operations, the operations including the process of the protocol identification method for power Internet of Things terminals described above.

[0049] The beneficial effects of this invention are:

[0050] 1. It can standardize and normalize the diverse data from power Internet of Things terminals, improve data quality, and reduce the complexity of subsequent data processing and analysis by extracting the effective load dataset. This effectively improves the efficiency and accuracy of data processing in subsequent steps, while eliminating external noise and interference to ensure more accurate data and provide high-quality input data for subsequent protocol classification and classification.

[0051] 2. Feature extraction can extract key information from complex raw data, thereby reducing the dimensionality and complexity of the data and making data processing more efficient. The extracted features can better capture the characteristics of inter-device protocols, providing more targeted input data for subsequent protocol classification. This not only improves the accuracy of protocol classification but also enhances the model's adaptability to different power IoT terminals, ensuring the stability and reliability of the classification results.

[0052] 3. By continuously training, the model's classification accuracy for protocols is improved, eliminating reliance on manual annotation. The high degree of automation reduces the impact of human intervention and errors. The model training process is adaptive, capable of dynamically adjusting according to new protocols or new device data, thus improving the system's flexibility and scalability, enabling the system to continuously optimize and improve during long-term operation.

[0053] 4. It can quickly adapt to the access of new devices and changes in protocols in the dynamic environment of power Internet of Things (IoT) terminal devices, ensuring the stability and security of the power system and meeting the needs of the ever-expanding scale of the power IoT for protocol classification capabilities. Attached Figure Description

[0054] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. Wherein:

[0055] Figure 1 This is a flowchart illustrating the protocol identification method for power Internet of Things terminals as shown in this invention.

[0056] Figure 2 This is a schematic diagram of data preprocessing as shown in the present invention;

[0057] Figure 3 This is a schematic diagram of the 5-fold cross-validation method shown in this invention;

[0058] Figure 4 This is a schematic diagram of the classification accuracy comparison curve shown in this invention;

[0059] Figure 5 This is a schematic diagram of the F1-score comparison curves shown in this invention;

[0060] Figure 6 This is a schematic diagram of the running time efficiency comparison curves shown in this invention. Detailed Implementation

[0061] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments.

[0062] Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without inventive effort should fall within the scope of protection of this invention.

[0063] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.

[0064] According to an embodiment of the present invention, in combination Figure 1 The flowchart shown illustrates a protocol identification method for power Internet of Things (IoT) terminals, which specifically includes the following steps:

[0065] S1. Interact with the power IoT terminal, acquire protocol data during the interaction process, and preprocess the data to form an effective load dataset. Note the following in this step:

[0066] Acquire protocol data from different smart power IoT terminals, including at least 5,000 data entries. Analyze the application layer data in the protocol pcap packet data, use regular expressions to remove invalid characters in the data, and extract the hexadecimal effective load application data.

[0067] The payload application data is converted from hexadecimal to decimal data, and blank fields are filled with fixed decimal values ​​to ensure that different data have consistent lengths.

[0068] The dataset is then scaled to normalize its size, resulting in a payload dataset in numerical form.

[0069] As an example, scale normalization processing:

[0070]

[0071] Where μ represents the average value of the data for each protocol type, σ represents the standard deviation of the data, and x * x and y represent the data before and after normalization, respectively.

[0072] In an optional implementation, maintenance personnel establish communication between the edge device and the smart power IoT terminal device via serial port, bus, or wireless network, and capture data streams based on the edge device's bus packet capture method.

[0073] It should be noted that when analyzing the application layer data in the protocol pcap packet data, invalid data is found. Regular expressions are needed to remove invalid characters from the data, keeping only hexadecimal characters (numbers 0-9 and letters a-fA-F) to form the original application dataset of hexadecimal payload.

[0074] S2. Extract features from the payload data in the payload dataset to obtain input features.

[0075] The following points need to be explained in this step:

[0076] Feature extraction techniques are used to select effective features closely related to message byte length, inter-message distance, and address information data, and these features are used as input features.

[0077] The input features include at least the length of a single data packet, the average length of a data packet, the difference between the length of a single data packet and the average length of a data packet, the difference between the length of a single data packet and the length of the longest data packet, and the difference between the length of a single data packet and the length of the shortest data packet.

[0078] S3. Input the input features into the power IoT terminal device protocol classification model constructed based on the density space clustering method, perform learning and training, and output the classification model after training. It should be noted that the implementation process of the classification model in this step is as follows:

[0079] Construct a sample set D = {x1, x2, x3, ..., x...} based on the input features. n}, set neighborhood parameters ε and MinPts, where ε is the sample distance threshold and MinPts is the minimum number of samples required to form a cluster;

[0080] For each sample point x i Calculate its relationship with all other sample points x j Euclidean distance d(x) i ,x j ):

[0081]

[0082] Where, x ik and x jk They represent samples x respectively i and x j The kth feature value, where m is the total number of features;

[0083] For sample point x i The statistics satisfy d(x) i ,x j The number of sample points ≤ ε, including x i itself;

[0084] If x i The number of points N in the ε neighborhood i If x ≥ MinPts, then x i Mark as core point;

[0085] Add all sample points in its neighborhood that are marked as core points to the core point set CorePoints and classify them into the same cluster C;

[0086] Repeat the above steps until all neighborhood samples of the core points have been processed.

[0087] Output the classification results, i.e., all identified clusters C1, C2, ..., C m .

[0088] As an example, after the learning and training are completed, the K-fold cross-validation method is used to verify the learning and training effect of the model. The model output with the best learning and training effect is selected as the final classification model, and its mathematical expression formula is:

[0089]

[0090] Among them, y final_prediction For the final output, y prediction (i) represents the output of each model in the 5-fold cross-validation.

[0091] As an example, five Modbus protocols representing different manufacturers are selected: 0-Aishwei inverter Modbus protocol, 1-Goodwe inverter Modbus protocol, 2-Growatt inverter Modbus protocol, 3-Huawei inverter Modbus protocol, and 4-Ginlong inverter Modbus protocol. When the classification model performs the above classification operation, it obtains the current network protocol data of the five manufacturers' Modbus protocols. After data preprocessing and feature extraction, the data is input into the classification model for classification, and the output label for the device is {0,1,2,3,4}.

[0092] S4. Input the preprocessed and feature-extracted live network protocol message data to be classified into the trained classification model for classification, and output the classification result. It should be noted that the specific classification process is as follows:

[0093] The number of points N in the ε-neighborhood will satisfy i Sample points ≥MinPts are used as core points;

[0094] Sample points that are not themselves core points but are located in the ε-neighborhood of a certain core point are taken as boundary points;

[0095] Sample points that are neither core points nor boundary points are treated as noise points and removed.

[0096] Assign an initial cluster label to each core point and start a new cluster;

[0097] For each core point, add all points within its ε-neighborhood, including both core points and boundary points, to the same cluster;

[0098] If a point in the ε-neighborhood is also a core point, then recursively add the points in its neighborhood to the same cluster;

[0099] Repeat the above process until the current cluster can no longer be expanded;

[0100] For any unprocessed core points, repeat the above steps until all core points have been processed.

[0101] The output is a classified cluster, each cluster representing a protocol type, including at least Modbus, DNP3, IEC104, and MQTT. Each sample point is assigned a category label to its cluster, i.e., the protocol type.

[0102] As an example, the classification results should include at least the protocol type labels corresponding to each cluster, including but not limited to the protocol names Modbus, DNP3, IEC104, and MQTT, with each cluster representing a protocol type.

[0103] As an example, the classification results are represented in the form of a map or list to show the correspondence between data samples and protocol types;

[0104] As shown in Table 1 below:

[0105] Table 1. Classification of Protocol Types

[0106] Sample number Protocol type Sample1 Modbus Sample2 DNP3 Sample3 IEC104 Sample4 MQTT …… ……

[0107] As an example, the mapping code is shown below:

[0108] % Defines protocol type mapping

[0109] protocol_map=containers.Map('KeyType','int32','ValueType','char');

[0110] protocol_map(1) = 'Modbus';

[0111] protocol_map(2) = 'DNP3';

[0112] protocol_map(3) = 'IEC104';

[0113] protocol_map(4) = 'MQTT';

[0114] As an example, the code for converting clustering results into a protocol type is shown below:

[0115]

[0116]

[0117] It should be noted that traditional classification algorithms based on support vector machines (SVM) are usually based on port number identification or deep packet inspection (DPI) based on feature signatures. Traditional methods have the drawbacks of difficulty in identifying encrypted traffic, complexity in maintaining feature databases, and weak ability to identify unknown protocols.

[0118] To comprehensively evaluate the performance of the protocol identification method for power Internet of Things terminals proposed in this invention in practical applications, especially its advantages in key indicators such as classification accuracy, recall (F1-score) and runtime efficiency, this invention is compared with traditional methods to verify its beneficial effects in processing complex network data and improving identification accuracy and efficiency.

[0119]

Experimental Subjects

[0120] Protocol types: Four common protocols in the power Internet of Things were selected: Modbus, DNP3, IEC104, and MQTT;

[0121] Data Acquisition: Communication data of various protocols were collected from the power Internet of Things environment. 2,500 data points were collected for each protocol, totaling 10,000 protocol messages.

[0122] Packet length: Modbus packet length is mainly between 100-150 bytes, DNP3 is between 200-250 bytes, IEC104 is between 300-350 bytes, and MQTT is between 400-450 bytes;

[0123] Communication frequency: Modbus and DNP3 protocols have the highest communication frequency, followed by IEC104, and MQTT has the lowest.

[0124] Data format: Different protocols have different data packet formats, containing different header information and payload data;

[0125] [Experimental Environment]

[0126] Server configuration: Two servers with identical performance were used for the experiment, configured with Intel Xeon E5-2690v4 2.6GHz (12 cores), 64GB of memory, and 1TB of SSD storage;

[0127] Operating system: Ubuntu 20.04LTS;

[0128] Development environment: Python 3.8, MATLAB R2021b;

[0129] Main libraries and tools: NumPy, Pandas, scikit-learn, matplotlib, Wireshark, tcpdump;

[0130]

Experimental Parameters

[0131] The method of this invention: DBSCAN algorithm based on density clustering;

[0132] Parameter settings: Neighborhood radius ε = 0.3, minimum number of samples MinPts = 10;

[0133] Traditional methods: classification algorithms based on Support Vector Machines (SVM);

[0134] Parameter settings: Kernel function is radial basis function (RBF), parameter C = 1, γ = 0.1;

[0135] [Experimental Preparation]

[0136] Preprocessing steps in traditional methods:

[0137] Use basic regular expressions to remove obvious invalid characters and erroneous data;

[0138] Extract basic statistical features, including packet length, source IP address, destination IP address, source port, and destination port;

[0139] Label encoding is applied to non-numerical features (such as IP address and port number);

[0140] Standardize the numerical features so that their mean is 0 and their standard deviation is 1.

[0141] Preprocessing steps of the method of this invention:

[0142] Deeply analyze data packets, using advanced regular expressions and data parsing tools to remove noisy data and extract the payload;

[0143] Extract in-depth features closely related to the protocol type, such as: message byte length, message interval time, address information data, and statistical features of payload data (such as mean and variance);

[0144] The feature data is normalized and mapped to the [0,1] interval;

[0145] [Experimental Procedure]

[0146] Traditional methods (SVM classification algorithm):

[0147] The dataset was divided into a training set and a test set in an 8:2 ratio.

[0148] Train the SVM model on the training set;

[0149] Perform classification on the test set and record the classification results;

[0150] Calculate classification accuracy, recall (F1-score), and runtime;

[0151] Performance evaluation: Calculate clustering accuracy, recall (F1-score), and runtime;

[0152] The method of this invention (DBSCAN density clustering algorithm):

[0153] DBSCAN is an unsupervised algorithm that directly clusters all data.

[0154] Identify the core points based on the ε and MinPts parameters;

[0155] The core points and their density-reachable sample points are grouped into the same cluster;

[0156] Based on the clustering results, correspond to the known protocol types;

[0157] Performance evaluation: Calculate clustering accuracy, recall (F1-score), and runtime.

[0158]

Experimental Results

[0159] Reference Figure 4 As can be clearly seen from the classification accuracy comparison curve, the classification accuracy of the method of the present invention (solid line) is higher than that of the traditional method (dashed line) under different data volumes. As the data volume increases, the classification accuracy gradually improves and tends to stabilize. The classification accuracy of the method of the present invention increases from 93% to 95%, while that of the traditional method increases from 90% to 92%. This shows that the method of the present invention has better stability and accuracy when processing large-scale data.

[0160] Reference Figure 5 As can be clearly seen from the F1-score comparison curve, the F1-score of the method of the present invention is always higher than that of the traditional method, and the growth rate is faster. When the amount of data reaches 10,000, the F1-score of the method of the present invention reaches 97.44%, while that of the traditional method is only 92%. This shows that the method of the present invention is significantly better than the traditional method in terms of comprehensive performance that balances accuracy and recall.

[0161] Reference Figure 6 As can be clearly seen from the comparison curve of running time efficiency, the running time of the method of the present invention (solid line) is always lower than that of the traditional method (dashed line). As the amount of data increases, the running time of the traditional method increases faster, while the running time of the method of the present invention increases more gradually. When the amount of data reaches 10,000 records, the running time of the method of the present invention is 14 seconds, while the traditional method requires 18 seconds. This shows that the method of the present invention has higher efficiency when processing large amounts of data.

[0162] The aforementioned input feature extraction methods can be implemented using existing technologies and methods, and will not be elaborated upon in this example.

[0163] Other aspects disclosed in the embodiments of the present invention also provide a computer device, including: one or more processors and memory.

[0164] The memory is used to store operable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations, including the flow of the protocol identification method for power IoT terminals described in the foregoing embodiments, particularly... Figure 1 The flowchart of the method is shown.

[0165] Other aspects disclosed in the embodiments of the present invention also propose a computer-readable medium for storing software including instructions executable by one or more computers, which, upon execution, cause the one or more computers to perform operations including the flow of the protocol identification method for power Internet of Things terminals described in the foregoing embodiments, particularly... Figure 1 The flowchart of the method is shown.

[0166] It should be recognized that embodiments of the present invention may be implemented or carried out by computer hardware, a combination of hardware and software, or by computer instructions stored in a non-transitory computer-readable storage medium.

[0167] The method can be implemented using standard programming techniques, including a non-transitory computer-readable storage medium configured with a computer program in the computer program, wherein the storage medium is configured such that the computer operates in a specific and predefined manner.

[0168] Each program can be implemented in a high-level procedural or object-oriented programming language to communicate with the computer system; however, if necessary, the program can be implemented in assembly or machine language.

[0169] In any case, the language can be either compiled or interpreted.

[0170] Furthermore, for this purpose, the program can run on a programmed application-specific integrated circuit.

[0171] The processes described herein (or variations and / or combinations thereof) can be executed under the control of one or more computer systems configured with executable instructions, and can be implemented by hardware or a combination thereof as code (e.g., executable instructions, one or more computer programs, or one or more applications) that commonly executes on one or more processors. The computer program includes a plurality of instructions executable by one or more processors.

[0172] Furthermore, the method can be implemented in any suitable computing platform, including but not limited to personal computers, minicomputers, mainframes, workstations, networked or distributed computing environments, standalone or integrated computer platforms, or in communication with charged particle tools or other imaging devices.

[0173] Various aspects of the present invention can be implemented in machine-readable code stored on a non-transitory storage medium or device, whether portable or integrated into a computing platform, such as a hard disk, optical read and / or write storage medium, RAM, ROM, etc., such that it can be read by a programmable computer, and when the storage medium or device is read by the computer, it can be used to configure and operate the computer to perform the processes described herein.

[0174] Furthermore, machine-readable code, or parts thereof, can be transmitted via wired or wireless networks.

[0175] When such media includes instructions or programs that combine with a microprocessor or other data processor to implement the steps described above, the invention described herein includes these and other different types of non-transitory computer-readable storage media.

[0176] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A protocol identification method for power Internet of Things (IoT) terminals, characterized in that, include: It interacts with the power Internet of Things terminal, obtains the protocol data during the interaction process, and preprocesses the data to form an effective load dataset; Feature extraction is performed on the payload data in the payload dataset to obtain input features; The input features are input into the power Internet of Things terminal device protocol classification model constructed based on the density space clustering method, and the model is trained and the classification model after training is output. The preprocessed and feature-extracted network protocol message data to be classified is input into the trained classification model for classification, and the classification result is output.

2. The protocol identification method for power Internet of Things terminals according to claim 1, characterized in that, The formation of the payload dataset includes: Acquire protocol data from different smart power IoT terminals, including at least 5,000 data entries. Analyze the application layer data in the protocol pcap packet data, use regular expressions to remove invalid characters from the data, and extract the hexadecimal effective load application data. The payload application data is converted from hexadecimal to decimal data, and blank fields are filled with fixed decimal values ​​to ensure that different data have consistent lengths. The dataset is then scaled to normalize its size, resulting in a payload dataset in numerical form.

3. The protocol identification method for power Internet of Things terminals according to claim 2, characterized in that, The scale normalization process: Where μ represents the average value of the data for each protocol type, σ represents the standard deviation of the data, and x * x and y represent the data before and after normalization, respectively.

4. The protocol identification method for power Internet of Things terminals according to claim 1 or 2, characterized in that, Feature extraction is performed on the payload data in the payload dataset, including: Feature extraction techniques are used to select effective features closely related to message byte length, inter-message distance, and address information data, and these features are used as input features. The input features include at least the length of a single data packet, the average length of a data packet, the difference between the length of a single data packet and the average length of a data packet, the difference between the length of a single data packet and the length of the longest data packet, and the difference between the length of a single data packet and the length of the shortest data packet.

5. The protocol identification method for power Internet of Things terminals according to claim 4, characterized in that, The input features are input into a power IoT terminal device protocol classification model constructed based on density space clustering method for learning and training, including: Based on the input features, construct a sample set D = {x1, x2, x3, ..., x...} n }, set neighborhood parameters ε and MinPts, where ε is the sample distance threshold and MinPts is the minimum number of samples required to form a cluster; For each sample point x i Calculate its relationship with all other sample points x. j Euclidean distance d(x) i ,x j ): Where, x ik and x jk They represent samples x respectively i and x j The k-th feature value, where m is the total number of features; For sample point x i The statistics satisfy d(x) i ,x j The number of sample points ≤ ε, including x i itself; If x i The number of points N in the ε neighborhood i If x ≥ MinPts, then x i Mark as core point; Add all sample points in its neighborhood that are marked as core points to the core point set CorePoints and classify them into the same cluster C; Repeat the above steps until all neighborhood samples of the core points have been processed. Output the classification results, i.e., all identified clusters C1, C2, ..., C m .

6. The protocol identification method for power Internet of Things terminals according to claim 5, characterized in that, The classification results include at least the protocol type labels corresponding to each cluster, including but not limited to the protocol names Modbus, DNP3, IEC104, and MQTT, with each cluster representing a protocol type; The classification results are represented in the form of a mapping or list to show the correspondence between data samples and protocol types.

7. The protocol identification method for power Internet of Things terminals according to claim 6, characterized in that, The specific process of the classification is as follows: Label sample points, where N is the number of points within an ε-neighborhood. i Sample points ≥MinPts are taken as core points, sample points that are not core points but are located in the ε-neighborhood of a core point are taken as boundary points, and sample points that are neither core points nor boundary points are taken as noise points and the noise points are removed. Assign an initial cluster label to each core point and start a new cluster; For each core point, add all points within its ε-neighborhood, including both core points and boundary points, to the same cluster; If a point in the ε-neighborhood is also a core point, then recursively add the points in its neighborhood to the same cluster; Repeat the above process until the current cluster can no longer be expanded; For any unprocessed core points, repeat the above steps until all core points have been processed. The output is a classified cluster, each cluster representing a protocol type, including at least Modbus, DNP3, IEC104, and MQTT. Each sample point is assigned a category label to its cluster, i.e., the protocol type.

8. The protocol identification method for power Internet of Things terminals according to claim 5, characterized in that, The K-fold cross-validation method selects the output of the model with the best learning and training performance as the final classification model. Its mathematical expression is as follows: Among them, y final_prediction For the final output, y prediction (i) represents the output of each model in the 5-fold cross-validation.

9. A computer device, characterized in that, include: One or more processors; The memory stores operable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations, including the flow of the protocol identification method for a power Internet of Things terminal as described in any one of claims 1 to 8.

10. A computer-readable medium for storing software, characterized in that: The software includes instructions executable by one or more computers, which, upon execution, cause the one or more computers to perform operations including the flow of a protocol identification method for a power Internet of Things terminal as described in any one of claims 1 to 8.

Images