Network protocol collaborative combination analysis method based on tree layered structure

Abstract

The invention relates to the technical field of protocol analysis, in particular to a network protocol collaborative combination analysis method based on a tree hierarchical structure, which comprises the following steps of: acquiring different network protocol analysis requirements, training a basic network protocol analysis model and a coarse granularity model, and acquiring a hierarchical structure by analyzing the coarse granularity and the fine granularity of application requirements. The method comprises the following steps: identifying and combining network protocol analysis models of the same hierarchy, constructing a tree-shaped layered structure, extracting a model identification result and an operation relationship in the tree-shaped layered structure, designing a two-dimensional mapping table, guiding input traffic through the two-dimensional mapping table, analyzing the input traffic layer by layer according to the tree-shaped structure, and positioning the next step through an operation result of each step until requirements are met. And an efficient collaborative analysis process is obtained. According to the method, the problems of high model training difficulty, high resource consumption and accumulation of errors along with layer propagation existing in a single network protocol analysis algorithm for multi-granularity and multi-layer hybrid application requirements are solved.

Description

Technical Field

[0001] This invention belongs to the field of protocol parsing technology, specifically relating to a method for collaborative combination parsing of network protocols based on a tree-structured hierarchical structure. Background Technology

[0002] With the rapid development of internet technology, the diversity and complexity of network applications have increased significantly, placing higher demands on network protocol parsing technology. Traditional single-mode network protocol parsing algorithms are gradually revealing problems such as high model training difficulty and low recognition efficiency when facing the needs of multi-granularity and multi-level mixed applications. Specifically, a single algorithm cannot simultaneously meet the parsing requirements of different granularities and levels, resulting in high computational resource consumption, slow recognition speed, and difficulty in guaranteeing accuracy when processing large-scale, highly complex network traffic. Especially against the backdrop of continuously expanding data scale and relatively scarce computing resources, traditional methods reduce overall processing speed and waste resources due to the need to process a large number of negative samples. Furthermore, model errors in hierarchical structures are prone to propagate and accumulate with each layer, further affecting the accuracy of recognition.

[0003] To address the challenges of training complex models and low recognition efficiency in multi-granularity, multi-level hybrid applications using single network protocol parsing algorithms, this invention proposes a tree-structured, hierarchical network protocol collaborative parsing method. This invention trains network protocol parsing models that meet the needs of various applications and establishes a hierarchical structure of multiple network protocol parsing models based on the coarseness of the application requirements. On this basis, a tree-structured hierarchical network protocol parsing model is generated through the collaborative combination of multiple hierarchical structures, enabling the collaborative combination of models under hybrid application requirements. Furthermore, the filtering of useless samples by the upper-level models improves the overall recognition efficiency. Summary of the Invention

[0004] To address the aforementioned issues, this invention provides a network protocol collaborative combination parsing method based on a tree-structured hierarchical architecture. This method solves the problems of high model training difficulty, low recognition efficiency, high resource consumption, and error accumulation as it propagates across layers when single network protocol parsing algorithms face the demands of multi-granularity and multi-level hybrid applications. To achieve the above objectives, this invention adopts the following technical solution: The proposed network protocol collaborative combination parsing method based on a tree-structured hierarchical structure includes the following steps: acquiring different network protocol parsing requirements; training a basic network protocol parsing model and a coarse-grained model to ensure that each model meets specific recognition requirements; obtaining a high-precision basic model library through verification and optimization; organizing the basic models hierarchically by analyzing the coarse and fine granularity of application requirements, with upper-layer models responsible for coarse classification and lower-layer models responsible for fine classification; filtering useless data through hierarchy to obtain a hierarchical structure model; quantifying the recognition deviation of the models in the hierarchical structure through error analysis; adjusting parameters and increasing data to reduce error propagation; and so on. Optimization ensures high recall of the upper-layer model, resulting in an error-optimized hierarchical structure. This hierarchical structure is then acquired by identifying and merging network protocol parsing models at the same level to construct a tree-like hierarchical structure. Nodes represent models, and edges represent data flows, resulting in a tree-like hierarchical parsing architecture. The model identification results and operational relationships within the tree-like hierarchical architecture are extracted, and a two-dimensional mapping table is designed. Using horizontal and vertical coordinate encoding, the next operation is quickly located, resulting in the mapping table and encoding rules. The input traffic is guided by the two-dimensional mapping table and parsed layer by layer according to the tree structure. The next step is located based on the result of each operation until the requirements are met, resulting in an efficient collaborative parsing process.

[0005] Furthermore, the process of acquiring different network protocol parsing requirements, training basic network protocol parsing models and coarse-grained models to ensure that each model meets specific recognition requirements, and obtaining a high-precision basic model library through verification and optimization includes the following steps: Based on different network protocol parsing requirements, training basic network protocol parsing models using deep learning and spanning tree algorithms; for coarse-grained recognition tasks, constructing models for classifying large categories of network protocol traffic; validating models using large-scale datasets, extracting recognition accuracy and recall metrics, and evaluating model performance; adjusting parameters and performing data augmentation optimization on models that do not meet the standards; and integrating high-precision models that meet specific recognition requirements and have stable performance through iterative training to obtain a basic model library covering multiple granularity requirements.

[0006] Furthermore, by analyzing the coarse-grained nature of application requirements, the basic model is organized hierarchically, with the upper-level model responsible for coarse classification and the lower-level model responsible for fine classification. This hierarchical filtering of useless data yields a hierarchical structure model, including the following steps: Based on the coarse-grained nature of application requirements, the coarse-grained features are analyzed in depth. The basic model is then classified and organized according to the granularity level of the recognition task to construct a hierarchical framework. This hierarchical framework includes an upper-level model and a lower-level model. The upper-level model uses broad features for rapid coarse classification, effectively filtering irrelevant data traffic and reducing the processing burden on the lower layers. The lower-level model uses fine features for deep fine classification based on the upper-level output results. Through layer-by-layer data filtering and task decomposition, the upper-level and lower-level models are logically linked to obtain a hierarchical structure model system with efficient filtering capabilities and accurate recognition performance.

[0007] Furthermore, the step of quantifying the recognition bias of the models in the hierarchical structure through error analysis, adjusting parameters, and adding data to reduce error propagation, and optimizing to ensure high recall of the upper-level models, resulting in an error-optimized hierarchical structure, includes the following steps: using a confusion matrix to perform error analysis on the recognition results of each model in the hierarchical structure, quantifying the number and proportion of misclassified positive and negative samples; extracting the error propagation path, locating key nodes of error accumulation, adjusting model parameters such as learning rate and iteration count for the root causes of errors, and supplementing the training set with targeted data; optimizing the upper-level models to improve their ability to capture target traffic, ensuring high recall to reduce error propagation to the lower layers, and retaining the structure with significantly reduced errors and stable hierarchical collaborative performance through multiple rounds of iterative optimization, thus obtaining a hierarchical structure with enhanced error control capabilities.

[0008] Furthermore, the acquisition of the hierarchical structure involves identifying and merging network protocol parsing models at the same level to construct a tree-like hierarchical structure. Nodes represent models, and edges represent data flows, resulting in a tree-like hierarchical parsing architecture. This includes the following steps: acquiring the hierarchical structure; using model similarity analysis to identify network protocol parsing models with overlapping functions at different levels; merging and optimizing equivalent models at the same level through parameter comparison and performance evaluation; constructing a tree structure using graph theory, abstracting each model as a node, and abstracting the data input / output relationships between models as directed edges; and ensuring unidirectional data flow through topological sorting to obtain a clearly hierarchical tree-like hierarchical parsing architecture.

[0009] Furthermore, the extraction of model recognition results and operational relationships from the hierarchical tree structure, the design of a two-dimensional mapping table, and the rapid location of the next operation through horizontal and vertical coordinate encoding, resulting in the mapping table and encoding rules, include the following steps: extracting the recognition results and subsequent operational requirements of the model output from the hierarchical tree structure, and establishing a mapping relationship in the form of a two-dimensional table; arranging the model results from bottom to top according to the tree hierarchy through vertical encoding, and sorting the operational instructions according to the application requirements-model number priority through horizontal encoding; mapping the model output label to the vertical coordinate and the operation type to the horizontal coordinate, forming a two-dimensional mapping table containing coordinate positioning and operation guidance; and achieving rapid matching of model results and operation paths through preset encoding rules, resulting in a standardized mapping table and efficient encoding scheme that supports multi-level collaborative recognition.

[0010] Furthermore, the process of guiding input traffic through a two-dimensional mapping table, parsing it layer by layer according to a tree structure, and determining the next step based on the result of each operation until the requirements are met, resulting in an efficient collaborative parsing process, includes the following steps: Introducing input traffic into the starting point of the hierarchical tree architecture, using a two-dimensional mapping table as parsing navigation, extracting the current model's recognition result, locating the current level on the vertical axis of the mapping table, and obtaining the next operation instruction on the horizontal axis; selecting the corresponding child node model for secondary parsing according to the guidance, using the new result as input to repeat the positioning process, passing it layer by layer, with the upper-level model filtering invalid traffic through high recall, and the lower-level model focusing on target feature extraction; when the operation result triggers a preset termination condition and reaches a leaf node, parsing stops and the result is output, resulting in an efficient collaborative parsing process with self-optimization capabilities.

[0011] Furthermore, the performance improvement formula for the network protocol parsing model is as follows: in, It is a model The identified includes the first A collection of traffic for each target category. It is all network protocol traffic. Representative by model The set of identified remaining network protocol traffic; when A value greater than 0 indicates that the model is effective against the model. It has a performance-enhancing effect, when and The smaller the value, the greater the performance improvement, indicating that the model... The greater the improvement in overall performance.

[0012] Furthermore, the formulas for precision and recall are as follows: Where Precision is the accuracy rate and Recall is the recall rate. This represents the number of positive samples that were predicted to be true. The number of negative samples that were predicted as false. The number of positive samples that were predicted as false. The number of samples that were predicted as false for negative samples.

[0013] In the technical solution provided by this invention, different network protocol parsing requirements are obtained, and basic network protocol parsing models and coarse-grained models are trained to ensure that each model meets specific recognition requirements. Through verification and optimization, a high-precision basic model library is obtained. By analyzing the coarse and fine granularity of application requirements, the basic models are organized hierarchically, with upper-layer models responsible for coarse classification and lower-layer models responsible for fine classification. Useless data is filtered through hierarchy to obtain a hierarchical structure model. Error analysis is used to quantify the recognition deviation of the models in the hierarchical structure, and parameters are adjusted and data is added to reduce error propagation. Optimization ensures high recall of upper-layer models, resulting in an error-optimized hierarchical structure. The hierarchical structure is obtained by identifying and merging network protocol parsing models of the same level to construct a tree-like hierarchical structure. Nodes represent models, and edges represent data flows, resulting in a tree-like hierarchical parsing architecture. The model recognition results and operation relationships in the tree-like hierarchical architecture are extracted, and a two-dimensional mapping table is designed. Through horizontal and vertical coordinate encoding, the next operation is quickly located, resulting in the mapping table and encoding rules. The input traffic is guided by the two-dimensional mapping table and parsed layer by layer according to the tree structure. The next step is located based on the result of each operation until the requirements are met, resulting in an efficient collaborative parsing process. This invention solves the problems of high model training difficulty, low recognition efficiency, high resource consumption, and error accumulation as it propagates across layers when a single network protocol parsing algorithm faces the requirements of multi-granularity and multi-level mixed applications. Attached Figure Description

[0014] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the invention.

[0015] Figure 1 This is a schematic diagram of the first embodiment of a network protocol collaborative combination and parsing method based on a tree-structured hierarchical structure according to the present invention.

[0016] Figure 2 This is a schematic diagram of the tree model structure of a network protocol collaborative combination parsing method based on a tree-hierarchical structure in an embodiment of the present invention.

[0017] Figure 3 This is a linear structure diagram of a network protocol collaborative combination parsing method based on a tree-structured hierarchical structure in an embodiment of the present invention.

[0018] Figure 4 This is a schematic diagram of the hierarchical structure of a network protocol collaborative combination parsing method based on a tree-like hierarchical structure in an embodiment of the present invention.

[0019] Figure 5 This is a schematic diagram illustrating the error propagation and accumulation of a network protocol collaborative combination parsing method based on a tree-structured hierarchical structure in an embodiment of the present invention.

[0020] Figure 6 This is a schematic representation of a two-dimensional mapping of a tree-hierarchical structure for a network protocol collaborative composition parsing method based on a tree-hierarchical structure, as described in an embodiment of the present invention.

[0021] Figure 7 This is a schematic diagram of the tree-hierarchical structure two-dimensional mapping table encoding of a network protocol collaborative combination parsing method based on a tree-hierarchical structure in an embodiment of the present invention.

[0022] Figure 8 This is a schematic diagram of the hierarchical error analysis process of a network protocol collaborative combination parsing method based on a tree-structured hierarchical structure in an embodiment of the present invention. Detailed Implementation

[0023] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0024] Those skilled in the art will understand that, unless specifically stated otherwise, the singular forms “a,” “an,” “the,” and “the” used herein may also include the plural forms. It should be further understood that the term “comprising” as used in this specification means the presence of the stated features, integers, steps, operations, elements, and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0025] A network protocol cooperative composition parsing method based on a tree-structured hierarchical structure, such as Figure 1As shown, the process includes the following steps: First, acquire different network protocol parsing requirements; train basic network protocol parsing models and coarse-grained models to ensure each model meets specific recognition requirements; obtain a high-precision basic model library through verification and optimization. Second, analyze the coarse and fine granularity of application requirements, organize the basic models hierarchically, with upper-layer models responsible for coarse classification and lower-layer models responsible for fine classification; filter useless data through hierarchy to obtain a hierarchical structure model. Third, quantify the recognition deviation of models in the hierarchical structure through error analysis, adjust parameters, and increase data to reduce error propagation; ensure high recall of upper-layer models through optimization to obtain an error-optimized hierarchical structure. Fourth, acquire the hierarchical structure, identify and merge network protocol parsing models of the same level, construct a tree-like hierarchical structure, represent models with nodes and data flows with edges to obtain a tree-like hierarchical parsing architecture. Fifth, extract the model recognition results and operation relationships in the tree-like hierarchical architecture, design a two-dimensional mapping table, and quickly locate the next operation through horizontal and vertical coordinate encoding to obtain the mapping table and encoding rules. Sixth, guide the input traffic through the two-dimensional mapping table, parse it layer by layer according to the tree structure, locate the next step through the result of each operation until the requirements are met, and obtain an efficient collaborative parsing process.

[0026] Specific hierarchical structure: For most network protocol parsing, there are generally more than two output results. For example... Figure 2 As shown, the spanning tree algorithm for solving multi-class classification typically transforms the multi-class model into multiple binary classification models, each belonging to the one-vs-rest category. When input data arrives, it needs to be processed through each one-vs-rest model separately. Finally, the most probable output class is calculated, and the multi-class probability (PredictProbability) is calculated using SoftMax. For multi-class deep learning models, the output layer is usually a fully connected (Dense) layer with an equal number of output classes, using SoftMax as its activation function to achieve the multi-class classification task.

[0027] Therefore, when identifying network protocol traffic, for any piece of traffic data to be identified, if a network protocol parsing model is constructed using a spanning tree algorithm or deep learning algorithm, the final judgment requires computation from all nodes, regardless of whether the network protocol traffic is the final target category. While this ensures the accuracy of the final result, a large number of negative samples participate in useless computations. Especially when the data scale is large and computing resources are scarce, this structure both reduces processing speed and wastes a significant amount of resources. In this case, to accelerate identification, a linear structure composed of combined network protocol parsing models can be used, such as... Figure 3As shown, one model is first used to identify a portion of the target category data, and then another model is used to identify the remaining data. In this way, the number of traffic items that subsequent models need to identify is smaller, and different categories of traffic data can be identified through different processes, thus improving the overall identification efficiency.

[0028] like Figure 3 As shown, It is a model The identified includes the first The set of traffic for each target category, S, is the total network protocol traffic. Representative by model The set of remaining network protocol traffic identified.

[0029] Establishing a hierarchical structure can improve the overall efficiency of network protocol parsing when simultaneously handling multiple application requirements with different granularities and hierarchical relationships. In network traffic identification, there may be combinations of application requirements across different hierarchical structures. Therefore, this technology constructs a tree-like hierarchical structure based on the collaborative combination of hierarchical structures.

[0030] Represent each node of the hierarchical tree structure as follows: Then, when the input traffic passes through After identification, network applications were categorized into two different types based on their service functions. Traffic from both services was obtained, and then... The classification yields specific network applications. The hierarchical tree structure is composed of multiple levels, with network protocol parsing models of different granularities arranged sequentially according to the hierarchical relationship, collectively completing the collaborative identification of network protocol traffic under mixed application requirements.

[0031] To construct a hierarchical tree structure for network protocol parsing models, this invention uses an existing hierarchical structure library. By identifying network protocol parsing models at the same level within the hierarchical structure, multiple hierarchical structures are combined into a single hierarchical tree structure. Only one identical model is retained. For models at the same level, the models are ranked by comparing their recognition performance.

[0032] The tree-structured hierarchical structure proposed in this invention has significant advantages in handling network protocol parsing under mixed application requirements. First, it can output results at multiple granularities, supporting more diverse network resource monitoring. Second, the tree-structured hierarchical model significantly improves the performance of the upper-layer model compared to the lower-layer model. Greater than 0, therefore it can optimize protocol parsing performance; furthermore, due to the model in the tree-structured hierarchical structure The data to be identified is a proper subset of the entire dataset S, and therefore it is able to resist the adverse effects of data drift.

[0033] In this embodiment, based on different network protocol parsing requirements, deep learning and spanning tree algorithms are used to train basic network protocol parsing models. For coarse-grained recognition tasks, models are constructed to classify traffic of major network protocols. Models are validated using large-scale datasets, and recognition accuracy and recall metrics are extracted to evaluate model performance. Models that do not meet the standards are optimized by parameter adjustment and data augmentation. Through iterative training, high-precision models that meet specific recognition requirements and have stable performance are integrated to obtain a basic model library covering multiple granularity requirements.

[0034] In this embodiment, a hierarchical framework is constructed by classifying and organizing the data according to the granularity of the recognition task. The hierarchical framework includes an upper-layer model and a lower-layer model. The upper-layer model uses broad features for fast coarse classification, effectively filtering irrelevant data traffic and reducing the processing burden on the lower layer. The lower-layer model uses fine features for deep fine classification based on the output results of the upper layer. Through layer-by-layer data filtering and task decomposition, the upper-layer model and the lower-layer model are connected in a logical relationship to obtain a hierarchical structure model system with efficient filtering capabilities and accurate recognition performance.

[0035] like Figure 4 As shown, when the application requirement is to simultaneously identify a specific network application and all abnormal traffic, based on the above hierarchical structure, coarse-grained network protocol parsing can be performed first to identify all video-related network protocol traffic. This traffic is then input into a fine-grained network protocol parsing model to identify the traffic of the specific network application and the traffic of other network applications. At this point, non-abnormal traffic has been eliminated and does not need to participate in the identification process of the lower-level fine-grained identification model. Therefore, the identification efficiency is improved to a certain extent.

[0036] In this embodiment, a confusion matrix is ​​used to perform error analysis on the identification results of each model in the hierarchical structure, quantifying the number and proportion of misclassified positive and negative samples. By extracting the error propagation path, key nodes of error accumulation are located. For the root cause of the error, model parameters such as learning rate and number of iterations are adjusted, and targeted data is added to enhance the training set. The upper-layer model is optimized to improve its ability to capture target traffic and ensure high recall to reduce the propagation of errors to the lower layers. Through multiple rounds of iterative optimization, the structure with significantly reduced error and stable hierarchical collaborative performance is retained, resulting in a hierarchical structure with enhanced error control capabilities.

[0037] In real-world scenarios, any network protocol parsing model may contain errors. For hierarchical structures, these errors often propagate and accumulate across layers, such as... Figure 5 As shown, assuming the target protocol traffic is represented by △ and the remaining interfering protocol traffic is represented by ○, the leftmost leaf node can be represented as the output of the hierarchical structure. Since some protocol traffic was classified during the first classification... Incorrect classifications result in some non-target protocol traffic being incorrectly classified to the left and some target protocol traffic being incorrectly classified to the right, causing these misclassifications to persist and propagate deeper into the model.

[0038] The confusion matrix generated during the identification process of network protocol traffic can be divided into: the number of positive samples predicted as true. The number of negative samples predicted as false The number of positive samples predicted as false The number of negative samples predicted as false Here, to ensure the recognition effect of the network protocol parsing model, protocol traffic that meets the recognition requirements is marked as a positive sample, and protocol traffic that does not meet the recognition requirements is marked as a negative sample.

[0039] In this embodiment, a hierarchical structure is obtained, and model similarity analysis is used to identify network protocol parsing models with overlapping functions in different levels. Through parameter comparison and performance evaluation, equivalent models at the same level are merged and optimized. A tree structure is constructed using graph theory, and each model is abstracted as a node, while the data input and output relationships between models are abstracted as directed edges. Topological sorting is used to ensure unidirectional data flow, resulting in a clear hierarchical tree-structured parsing architecture.

[0040] In this embodiment, the recognition results of the model output in the tree-structured hierarchical architecture and the subsequent operation requirements are extracted, and a mapping relationship is established in the form of a two-dimensional table. The model results are arranged from bottom to top according to the tree hierarchy through vertical encoding, and the operation instructions are sorted by application requirements-model number priority through horizontal encoding. The model output labels are mapped to the vertical axis and the operation type is mapped to the horizontal axis to form a two-dimensional mapping table containing coordinate positioning and operation guidance. The model results and operation paths are quickly matched through preset encoding rules to obtain a standardized mapping table and an efficient encoding scheme that supports multi-level collaborative recognition.

[0041] Because hybrid application requirements involve multiple different granularities and levels, a convenient tree-structured hierarchical storage method is needed. To address this issue, this invention provides a tree-structured hierarchical storage method. For each tree-structured two-dimensional mapping table, the vertical axis represents the identification result of each network protocol parsing model, and the horizontal axis represents the next operation to be taken, including the identification model number to be selected in the next layer, or the application requirements to be met. By establishing a tree-structured two-dimensional mapping table, the collaborative combination of network protocol parsing models between different levels can be achieved to support multiple hybrid application requirements with different granularities and levels.

[0042] To achieve convenient representation and fast access to a tree-structured hierarchical two-dimensional mapping table, this invention proposes an encoding rule for such tables, as follows: Step 1: The horizontal axis corresponds to the next operation to be performed, ordered according to "application requirements" and "subsequent identification models" to ensure timely response to application requirements; Step 2: The vertical axis corresponds to the identification result of each network protocol parsing model, encoded according to the hierarchical traversal of the tree structure. The original network protocol traffic, as an unidentified result, is placed in the first row, followed by other results arranged sequentially according to the tree structure, with deeper identification models appearing higher on the vertical axis; Step 3: Each model is sorted on the vertical axis according to the order of its output labels. Based on the above rules, a typical tree-structured hierarchical two-dimensional mapping table is encoded as follows: Figure 7 As shown.

[0043] Depend on Figure 7 It can be seen that when a new network protocol traffic data S arrives, a horizontal (left-to-right) search is first performed in the first row (from bottom to top) of the hierarchical tree-structured two-dimensional mapping table to find its location in the model. A value of 1 indicates that the next step should be to use... The model performs network protocol parsing. When using... After traffic identification, if the identification result is 0, then according to the vertical axis, when... When doing so, a horizontal search should be performed starting from the second row; if using a model If the result obtained after network protocol parsing is 1, then according to the vertical axis, when... At that time, a horizontal search should be performed starting from row 3. When searching from row 3, it was found in the model. A value of 1 indicates that the next step should use... The model performs network protocol parsing. If the recognition result is 1, then according to the vertical axis, the search should start from the 8th row. The next step is to send the recognition result to the application requirements. Execute sequentially until a row of results is completely empty, or the results meet the corresponding requirements.

[0044] Therefore, with the support of the tree structure, the network protocol parsing model collaborative combination method proposed in this invention can ensure that the input network protocol traffic is always in the first row of the two-dimensional mapping table of the tree hierarchical structure, and can quickly locate the next operation based on the operation result of each step, thereby improving the overall efficiency of network protocol parsing under the requirements of hybrid applications.

[0045] This invention addresses the problems of low accuracy and efficiency in network protocol identification under multi-granularity and hierarchical application requirements. It proposes a network protocol parsing technology for hybrid application needs. First, by arranging multiple network protocol parsing models hierarchically, a multi-level structure is established to effectively resist the impact of data drift, reduce the computational load of lower-level models, and improve the overall identification efficiency of the network model. Furthermore, based on the protocol combinations between different hierarchical structures, a tree-like hierarchical structure is constructed, forming a two-dimensional mapping table, thereby satisfying the collaborative identification of network protocol traffic under different application requirements.

[0046] In this embodiment, the input traffic is introduced to the starting point of the tree-structured hierarchical architecture. A two-dimensional mapping table is used as the parsing navigation. By extracting the current model recognition result, the level is located on the vertical axis of the mapping table, and the next operation instruction is obtained on the horizontal axis. According to the guidance, the corresponding child node model is selected for secondary parsing. The new result is used as input to repeat the positioning process and pass it layer by layer. The upper-level model filters invalid traffic through high recall, and the lower-level model focuses on target feature extraction. When the operation result triggers the preset termination condition and reaches the leaf node, the parsing stops and the result is output, resulting in a highly efficient collaborative parsing process with self-optimization capabilities.

[0047] In this embodiment, the performance improvement formula for the network protocol parsing model is: in, It is a model The identified includes the first A collection of traffic for each target category. It is all network protocol traffic. Representative by model The set of identified remaining network protocol traffic; when A value greater than 0 indicates that the model is effective against the model. It has a performance-enhancing effect, when and The smaller the value, the greater the performance improvement, indicating that the model... The greater the improvement in overall performance.

[0048] This invention considers that when dealing with multiple application requirements of different granularities and with hierarchical structures at the same time, a hierarchical structure of the network protocol parsing model can be established based on the coarseness or fineness of the application requirements.

[0049] In this embodiment, the formulas for precision and recall are: Where Precision is the accuracy rate and Recall is the recall rate. This represents the number of positive samples that were predicted to be true. The number of negative samples that were predicted as false. The number of positive samples that were predicted as false. The number of samples that were predicted as false for negative samples.

[0050] like Figure 8 As shown in subgraph A, the input Directly input into the model The identification was performed, and the result was... In subgraph B, a model has been added. The set of its prediction results For use in subsequent models Further identification yielded the following results: ; As a model The excluded protocol data is assumed to also use... The identification was performed, and the result was... Assuming it is not empty, then:

[0051]

[0052]

[0053]

[0054] That is, through the upper-level model After identification, the set of positive samples in the model that are identified as true is A subset of the set of positive samples identified as true, i.e. Similarly, it can be deduced that... Then the overall precision and recall of subgraph B are:

[0055]

[0056] Therefore, when the upper-level model in the hierarchical structure has a high recall rate, it will improve the overall performance of the model. When a large number of negative samples are identified, the computational load of subsequent models can be greatly reduced.

[0057] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely preferred examples and are not intended to limit the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the present invention as claimed. The scope of protection of the present invention is defined by the appended claims and their equivalents.

Claims

1. A method for resolving network protocol cooperative composition based on a tree-structured hierarchical structure, characterized in that, The network protocol cooperative composition and parsing method based on a tree-structured hierarchical structure includes the following steps: Different network protocol parsing requirements are obtained, basic network protocol parsing models and coarse-grained models are trained to ensure that each model meets specific recognition requirements, and a high-precision basic model library is obtained through verification and optimization. By analyzing the coarse and fine granularity of application requirements, the basic model is organized hierarchically, with the upper-level model responsible for coarse classification and the lower-level model responsible for fine classification. By filtering out useless data through hierarchy, a hierarchical structure model is obtained. Error analysis is used to quantify the identification bias of the model in the hierarchical structure. Parameters are adjusted and data is added to reduce error propagation. Optimization ensures high recall of the upper-level model, resulting in an error-optimized hierarchical structure. Obtain the hierarchical structure by identifying and merging network protocol parsing models at the same level, construct a tree-like hierarchical structure, and use nodes to represent models and edges to represent data flows to obtain the tree-like hierarchical parsing architecture. Extract the model recognition results and operation relationships in the tree-structured hierarchical architecture, design a two-dimensional mapping table, and quickly locate the next operation through horizontal and vertical coordinate encoding to obtain the mapping table and encoding rules; The input traffic is guided by a two-dimensional mapping table and parsed layer by layer according to a tree structure. The next step is located based on the result of each operation until the requirements are met, resulting in an efficient collaborative parsing process.

2. The network protocol cooperative composition and parsing method based on a tree-structured hierarchical structure according to claim 1, characterized in that, The process of acquiring different network protocol parsing requirements, training basic network protocol parsing models and coarse-grained models to ensure that each model meets specific recognition requirements, and obtaining a high-precision basic model library through verification and optimization includes the following steps: Based on the different network protocol parsing requirements, a basic network protocol parsing model is trained using deep learning and spanning tree algorithms. For coarse-grained identification tasks, a model is constructed to classify traffic of major network protocols. Model validation was performed using large-scale datasets, and accuracy and recall metrics were extracted to evaluate model performance. For models that do not meet the standards, parameter adjustments and data augmentation optimization are performed. Through iterative training, high-precision models that meet specific recognition requirements and have stable performance are integrated to obtain a basic model library covering multiple granularity requirements.

3. The network protocol cooperative composition and parsing method based on a tree-structured hierarchical structure according to claim 1, characterized in that, The process involves analyzing the coarse-grained nature of application requirements, organizing the basic model hierarchically, with upper-level models responsible for coarse classification and lower-level models responsible for fine classification. By filtering out useless data through this hierarchical structure, a hierarchical model is obtained, including the following steps: Based on the coarse-grained nature of the application requirements, we deeply analyze the coarse-grained features in the application requirements, classify and organize the basic model according to the granularity level of the recognition task, and build a hierarchical framework. The hierarchical framework includes an upper-layer model and a lower-layer model. The upper-layer model uses broad features for fast coarse classification, effectively filtering irrelevant data traffic and reducing the processing burden on the lower layer. The lower-level model performs in-depth classification using refined features based on the output results of the upper-level model. Through layer-by-layer data filtering and task decomposition, the upper-level and lower-level models are connected in a logical relationship to obtain a hierarchical structure model system with efficient filtering capabilities and accurate recognition performance.

4. The network protocol cooperative composition and parsing method based on a tree-structured hierarchical structure according to claim 1, characterized in that, The process of quantifying the identification bias of the model in the hierarchical structure through error analysis, adjusting parameters and increasing data to reduce error propagation, and optimizing to ensure high recall of the upper-level model, resulting in an error-optimized hierarchical structure, includes the following steps: Error analysis was performed on the identification results of each model in the hierarchical structure using a confusion matrix to quantify the number and proportion of misclassifications of positive and negative samples. By extracting the error propagation path, locating key nodes of error accumulation, and targeting the root causes of errors, adjusting model parameters such as learning rate and number of iterations, and supplementing the training set with targeted data; The upper-layer model is optimized to improve its ability to capture target traffic and ensure high recall to reduce the propagation of errors to the lower layers. Through multiple rounds of iterative optimization, the structure with significantly reduced errors and stable hierarchical collaboration performance is retained, resulting in a hierarchical structure with enhanced error control capabilities.

5. The network protocol cooperative composition and parsing method based on a tree-structured hierarchical structure according to claim 1, characterized in that, The process of obtaining the hierarchical structure involves identifying and merging network protocol parsing models at the same level to construct a tree-like hierarchical structure. The model is represented by nodes, and data flows are represented by edges, resulting in a tree-like hierarchical parsing architecture. This includes the following steps: The hierarchical structure is obtained, and model similarity analysis technology is used to identify network protocol parsing models with overlapping functions in different levels; By comparing parameters and evaluating performance, equivalent models at the same level are merged and optimized. A tree structure is constructed using graph theory, where each model is abstracted as a node and the data input-output relationship between models is abstracted as directed edges. Topological sorting ensures unidirectional data flow, resulting in a clear, hierarchical tree-like parsing architecture.

6. The network protocol cooperative composition and parsing method based on a tree-structured hierarchical structure according to claim 1, characterized in that, The process of extracting the model recognition results and operational relationships from the hierarchical tree structure, designing a two-dimensional mapping table, and quickly locating the next operation through horizontal and vertical coordinate encoding, resulting in the mapping table and encoding rules, includes the following steps: Extract the recognition results from the model output in the hierarchical tree structure and the requirements for subsequent operations, and establish a mapping relationship in the form of a two-dimensional table; The model results are arranged from bottom to top in a tree structure by vertical coding, and the operation instructions are sorted by application requirements and model number priority by horizontal coding. The model output labels are mapped to the vertical axis, and the operation type is mapped to the horizontal axis, forming a two-dimensional mapping table that includes coordinate positioning and operation guidance; By using preset coding rules, the model results and operation paths can be quickly matched, resulting in a standardized mapping table and an efficient coding scheme that supports multi-level collaborative recognition.

7. The network protocol cooperative composition and parsing method based on a tree-structured hierarchical structure according to claim 1, characterized in that, The process of guiding the input traffic through a two-dimensional mapping table, parsing it layer by layer according to a tree structure, and determining the next step based on the result of each operation until the requirements are met, results in an efficient collaborative parsing process, including the following steps: The input traffic is introduced to the starting point of the tree-structured hierarchical architecture. A two-dimensional mapping table is used as the parsing navigation. By extracting the current model recognition result, the level is located on the vertical axis of the mapping table, and the next operation instruction is obtained on the horizontal axis. According to the instructions, select the corresponding child node model for secondary parsing, use the new results as input to repeat the localization process, and pass it layer by layer. The upper-level model filters invalid traffic through high recall, and the lower-level model focuses on target feature extraction. When the operation result triggers the preset termination condition and reaches the leaf node, the parsing stops and the result is output, resulting in a highly efficient collaborative parsing process with self-optimization capabilities.

8. The network protocol cooperative composition and parsing method based on a tree-structured hierarchical structure according to claim 2, characterized in that, The performance improvement formula for the network protocol parsing model is: ； in, It is a model The identified includes the first A collection of traffic for each target category. It is all network protocol traffic. Representative by model The set of identified remaining network protocol traffic; when A value greater than 0 indicates that the model is effective against the model. It has a performance-enhancing effect, when and The smaller the value, the greater the performance improvement, indicating that the model... The greater the improvement in overall performance.

9. The network protocol cooperative composition and parsing method based on a tree-structured hierarchical structure according to claim 2, characterized in that, The formulas for precision and recall are as follows: ； ； Where Precision is the accuracy rate and Recall is the recall rate. This represents the number of positive samples that were predicted to be true. The number of negative samples that were predicted as false. The number of positive samples that were predicted as false. The number of samples that were predicted as false for negative samples.

Images