Intelligent analysis method for power terminal protocol

Abstract

The invention relates to the technical field of Internet of Things communication, and particularly provides an intelligent analysis method for a power terminal protocol, which comprises the following steps of: inputting communication flow data into a detection model under the condition that a feature extraction model fails to extract semantic features of the communication flow data to be analyzed to obtain a corresponding active detection message; under the condition of security verification, sending the active detection message to a terminal device of communication flow data, obtaining physical response data, and comparing the physical response data with a preset physical semantic mapping relationship to determine a corresponding semantic feature; and taking the semantic features as analysis results of the communication flow data under the condition that verification of the semantic features is passed through a simulation operation mode, updating historical communication data, and carrying out intensified training on the detection model. The technical problem that effective analysis is often difficult to realize during semantic analysis due to the fact that a frame structure of a non-standard power terminal protocol is different from a frame structure of a standard terminal protocol in the prior art is solved.

Description

Technical Field

[0001] This invention relates to the field of Internet of Things (IoT) communication technology, and in particular to an intelligent parsing method for power terminal protocols. Background Technology

[0002] With the construction of new power systems and the energy internet, a massive number of heterogeneous terminal devices, such as smart meters, photovoltaic inverters, energy storage controllers, and microprocessor-based protection devices, have been connected to the distribution network and user sides. The communication access of these devices faces enormous challenges.

[0003] The existing technology has the following significant problems:

[0004] Communication protocols exhibit extreme fragmentation and privatization. Besides standard protocols such as Modbus, DLT645-1997 / 2007, IEC 60870-5-101 / 103 / 104, and MQTT, a large number of devices use manufacturer-proprietary, non-standard communication protocols. While the Modbus protocol defines the basic communication frame format, it does not define the specific meaning of register addresses (dot tables), leading to significant differences in dot tables between devices from different manufacturers. Furthermore, the Application Service Data Unit (ASDU) structure of the IEC 104 protocol is complex, with various types of identifiers and transmission reasons, and different manufacturers implement it in different standards. For various devices lacking technical documentation, existing parsing methods based on rule matching or feature fingerprint databases (such as Wireshark plugins or Nmap fingerprint databases) often fail, unable to achieve semantic-level parsing.

[0005] For non-standard power terminal protocols in related technologies, the difference in frame structure compared to standard terminal protocols often leads to difficulties in effective semantic parsing, and no effective solution has yet been proposed. Summary of the Invention

[0006] The present invention provides an intelligent parsing method for power terminal protocols, which at least solves the technical problem in the related art that non-standard power terminal protocols often have difficulty in achieving effective semantic parsing due to their different frame structures from standard terminal protocols.

[0007] This invention provides an intelligent parsing method for power terminal protocols, comprising: extracting semantic features from communication traffic data to be parsed based on a pre-trained bit-level feature extraction model; if the feature extraction model fails to extract the semantic features, inputting the communication traffic data into a probe model, and outputting an active probe message corresponding to the communication traffic data through the probe model; wherein the probe model is a reinforcement learning model trained based on historical communication data; if the active probe message passes security verification, sending the active probe message to the terminal device of the communication traffic data to obtain the physical response data of the terminal device; comparing the physical response data with a preset physical semantic mapping relationship to determine the corresponding semantic features; verifying the semantic features through simulation to obtain a verification result; if the verification result indicates that the verification is successful, using the semantic features as the parsing result of the communication traffic data, updating the historical communication data, and performing reinforcement training on the probe model or the feature extraction model.

[0008] As an optional approach, before sending the active probe message to the terminal device receiving the communication traffic data and obtaining the physical response data of the terminal device after the active probe message has passed security verification, the method further includes: sending the active probe message to the behavioral simulation model of the terminal device, wherein the behavioral simulation model is trained based on the historical communication data of the terminal device; simulating the physical response of the terminal device to the active probe message using the behavioral simulation model; determining that the security verification of the active probe message fails if the physical response indicates a fault in the terminal device; and determining that the security verification of the active probe message passes if the physical response indicates that the terminal device is secure.

[0009] As an optional approach, after determining that the security verification of the active probe message fails when the physical response characterizes the terminal device as faulty, the method further includes: intercepting the active probe message and generating a penalty signal; sending the penalty signal to the probe model, which generates a new active probe message based on the penalty signal; and re-verifying the security of the new active probe message until the security verification of the active probe message passes or the iteration stops.

[0010] As an optional approach, before inputting the communication traffic data into the detection model and outputting the active detection message corresponding to the communication traffic data through the detection model, the method further includes: using historical communication data as sample data, selecting state parameters that satisfy Markov properties and are strongly correlated with the detection target based on measurable parameters at different time points in the sample data, and constructing a state space; constructing an action space based on executable detection action parameters and the constraints of the state parameters; determining the state transition probability of transitioning to a new state under different detection actions for different historical states; constructing a reward function based on the information gain, risk penalty, and detection cost of the detection action; setting different solution algorithms according to the complexity of the protocol scenario; and constructing the detection model based on the solution algorithms, the state space, the action space, the state transition probability, and the reward function.

[0011] As an optional approach, the reward function is: ,in, To detect the decrease in state space information entropy caused by an action. This represents the probability of an abnormal response from the terminal device. To reduce detection time costs, These are the corresponding weighting coefficients.

[0012] As an optional approach, the corresponding semantic features are determined by comparing the physical response data with a preset physical semantic mapping relationship, including: extracting multi-dimensional features from the physical response data; wherein the multi-dimensional features include at least one of the following: binary features, numerical features, temporal features, and context features; searching for similar protocol fragments as context in a large dataset based on the multi-dimensional features; inputting the multi-dimensional features and the context into a large language model, and obtaining the corresponding semantic features through reasoning by the large language model via a thought chain.

[0013] As an optional approach, the semantic features are verified through simulation to obtain the verification results, including: combining the semantic features with the corresponding parsing driver code to determine the corresponding communication protocol type; comparing and verifying the semantic features with the historical semantic features of the historical communication data of the communication protocol type; and determining that the semantic features have passed the verification when the consistency between the historical semantic features and the semantic features reaches a preset similarity threshold.

[0014] As an optional approach, before extracting semantic features from the communication traffic data to be parsed based on the pre-trained bit-level feature extraction model, the method further includes: acquiring unlabeled communication data of existing industrial protocols and creating a large dataset; performing byte masking on the unlabeled communication data in the large dataset and forming training samples with the corresponding mask data; performing byte masking on different positions of the unlabeled communication data in the large dataset to generate a training sample set; and training the bit-level feature extraction model based on the training sample set until the cross-entropy loss of the bit-level feature extraction model reaches a preset threshold.

[0015] As an optional approach, the semantic features include semantic feature vectors and frame structure features, and the bit-level feature extraction model is a self-supervised training model based on the Transformer architecture. Extracting semantic features from the communication traffic data to be parsed based on the pre-trained bit-level feature extraction model includes: preprocessing the communication traffic data to be parsed to obtain a corresponding input vector; inputting the input vector into a Transformer encoder with a multi-head self-attention mechanism to obtain the dependency relationship between any two byte units; determining the frame structure features of the communication traffic data based on the dependency relationship; parsing the communication traffic data based on the frame structure features to obtain a semantic feature vector, wherein the semantic features include the frame structure features and the semantic feature vector; if the integrity of the frame structure features does not exceed a preset integrity threshold, and / or the confidence level of the semantic feature vector does not exceed a preset confidence threshold, the semantic feature extraction is confirmed to have failed.

[0016] As an optional approach, the communication traffic data to be parsed is preprocessed to obtain a corresponding input vector, including: processing the communication traffic data to be parsed into a byte sequence of a preset length; mapping byte units in the byte sequence into continuous vectors through the embedding layer of the bit-level feature extraction model; determining the input vector corresponding to the byte unit based on the continuous vector and the position encoding of the byte unit; and / or, if the communication traffic data is encrypted traffic data, extracting the metadata sequence of the encrypted traffic data, wherein the metadata sequence includes at least one of the following: a data packet length sequence, an arrival time interval sequence, and a transmission direction sequence; inputting the metadata sequence into the bit-level feature extraction model to identify the service behavior pattern of the encrypted traffic.

[0017] The intelligent parsing method for power terminal protocols provided in this invention extracts semantic features from the communication traffic data to be parsed based on a pre-trained bit-level feature extraction model. By using the bit-level feature extraction model and artificial intelligence methods to extract semantic features from non-standard communication traffic data, efficiency can be improved.

[0018] If the feature extraction model fails to extract semantic features, the communication traffic data is input into the probing model, which then outputs an active probing message corresponding to the communication traffic data. The probing model is a reinforcement learning model trained based on historical communication data. In the event of extraction failure, active probing messages are generated to probe the semantic features of non-standard communication traffic data, ensuring the effectiveness of parsing non-standard communication traffic data.

[0019] After the active probe message has undergone security verification, it is sent to the terminal device handling the communication traffic data to obtain the physical response data from the terminal device. Security verification of the active probe message prevents the terminal device handling the communication traffic data from malfunctioning due to the active probe message, thus improving the security of active probe parsing.

[0020] The corresponding semantic features are determined by comparing the physical response data with the preset physical semantic mapping relationship. The semantic features are also determined by comparing the physical response data of the terminal device to the active probe message with the physical semantic mapping relationship.

[0021] The semantic features are verified through simulation. If the verification results indicate that the verification is successful, the semantic features are used as the parsing results of the communication traffic data, and the historical communication data is updated. The detection model or feature extraction model is reinforced and trained. The semantic features obtained by the two methods are verified and the verification results are obtained. The detection model or feature extraction model is reinforced and trained.

[0022] This invention addresses the technical challenge of effectively parsing non-standard power terminal protocols due to their different frame structures compared to standard terminal protocols. It achieves the technical effect of quickly and effectively identifying non-standard communication traffic data and performing semantic parsing, ensuring the security and accuracy of the parsing process. Attached Figure Description

[0023] To more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the accompanying drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are merely some embodiments of the present invention, and those skilled in the art can obtain other embodiments based on these drawings without creative effort.

[0024] Figure 1 This is a flowchart of an intelligent parsing method for a power terminal protocol, according to an embodiment of the present invention.

[0025] Figure 2 This is a flowchart of a method for parsing the power terminal protocol according to an embodiment of the present invention.

[0026] Figure 3 This is a schematic diagram of the reinforcement learning neural network structure according to an embodiment of the present invention.

[0027] Figure 4 This is a schematic diagram of the feature encoding and classification network structure of an embodiment of the present invention.

[0028] Figure 5 This is a schematic diagram of the security active detection and digital twin sandbox simulation process of the embodiment of the present invention.

[0029] Figure 6 This is a schematic diagram of the multimodal semantic alignment and driver code generation process according to an embodiment of the present invention.

[0030] Figure 7 This is a schematic diagram of the structure of the electronic device created by this invention. Detailed Implementation

[0031] Embodiments of the present invention will now be described in more detail with reference to the accompanying drawings. While some embodiments of the present invention are shown in the drawings, it should be understood that the present invention can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of the present invention. It should be understood that the drawings and embodiments of the present invention are for illustrative purposes only and are not intended to limit the scope of protection of the present invention.

[0032] Traditional active probing techniques pose serious security risks in the power industry. Port scanning or fuzzing techniques commonly used in the IT field tend to send a large number of high-frequency, distorted probe messages to the target device. However, many older devices in power systems (such as early serial servers and low-performance RTUs) have limited communication processing capabilities and small buffers. Unsecured active probing can easily lead to CPU overload, communication stack crashes, or even device freezes or malfunctions, which is unacceptable for the highly reliable operation of power grids.

[0033] Existing automated configuration generation capabilities are insufficient. Most current access tools can only generate static configuration files (such as JSON or XML) and cannot handle complex private protocol logic (such as non-standard validation algorithms, bitwise operations, and custom floating-point number formats). This forces operations and maintenance personnel to still write a large amount of customized driver code, which is inefficient and prone to errors.

[0034] In summary, the industry urgently needs an automated parsing and driver code generation method that is compatible with multiple protocols, has zero-shot learning capabilities, and can strictly guarantee the security of the detection.

[0035] Therefore, embodiments of the present invention provide an intelligent parsing method for power terminal protocols. Figure 1 This is a flowchart illustrating an intelligent parsing method for a power terminal protocol, according to an embodiment of the present invention. Figure 1 As shown, the intelligent parsing method for power terminal protocols provided by the embodiments of the present invention includes the following steps:

[0036] Step S101: Extract semantic features from the communication traffic data to be parsed based on the pre-trained bit-level feature extraction model.

[0037] In step S102, if the feature extraction model fails to extract semantic features, the communication traffic data is input into the probe model, and the probe model outputs the active probe message corresponding to the communication traffic data; wherein, the probe model is a reinforcement learning model trained based on historical communication data.

[0038] Step S103: After the active probe message has passed security verification, the active probe message is sent to the terminal device of the communication traffic data to obtain the physical response data of the terminal device.

[0039] Step S104: Compare the physical response data with the preset physical semantic mapping relationship to determine the corresponding semantic features.

[0040] Step S105: The semantic features are verified by simulation and the verification result is obtained. If the verification result indicates that the verification is successful, the semantic features are used as the parsing result of the communication traffic data, and the historical communication data is updated to strengthen the training of the detection model or feature extraction model.

[0041] The intelligent parsing method for power terminal protocols provided in the embodiments of this invention improves efficiency by using an artificial intelligence method to extract semantic features of non-standard communication traffic data through a pre-trained bit-level feature extraction model. In the event of extraction failure, an active probe message is generated to probe the semantic features of the non-standard communication traffic data, ensuring the effectiveness of parsing the non-standard communication traffic data. Security verification is performed on the active probe message to prevent terminal devices from malfunctioning due to the active probe message, thus improving the security of active probe parsing. Semantic features are determined by comparing the physical response data of the terminal device to the active probe message with the physical semantic mapping relationship.

[0042] The semantic features are verified through simulation. If the verification results indicate that the semantic features pass, they are used as the parsed results of the communication traffic data. Historical communication data is updated, and the detection model or feature extraction model is reinforced and trained. The semantic features obtained from both methods are then verified, and the verification results are obtained. The detection model or feature extraction model is then reinforced and trained again. This solves the technical problem in related technologies where non-standard power terminal protocols, due to their different frame structures compared to standard terminal protocols, often struggle to achieve effective semantic parsing. It achieves the technical effect of quickly and effectively identifying non-standard communication traffic data and performing semantic parsing, ensuring the security and accuracy of the parsing process.

[0043] The entities performing the above steps can be edge nodes in the edge IoT system. The bit-level feature extraction model, detection model, security verification environment, simulation running environment, etc. can all be deployed on cloud nodes. Only a portion of them can be deployed and used on edge nodes, which can improve ease of use and deployment efficiency.

[0044] The aforementioned communication traffic data refers to the communication data exchanged between power terminals with communication capabilities using a certain communication protocol. It generally exists in the form of a binary byte stream. Different communication protocols have different data frame structures, and the positions of data fields containing semantic information also differ. Therefore, there is a problem of difficulty in effectively parsing non-standard communication traffic data.

[0045] The aforementioned bit-level feature extraction model can be a reinforcement learning machine learning model, pre-trained with existing data to enable the feature extraction model to identify semantic features based on communication traffic data. To improve the accuracy of semantic parsing, the output confidence of the bit-level feature extraction model can be increased. When the model output confidence is lower than this threshold, it is determined that the semantic feature extraction has failed, and the semantic features of the communication traffic data are determined by actively probing the message.

[0046] As mentioned above, the semantic features of non-standard communication traffic data are limited by the frame structure features of the corresponding communication protocol. When the frame structure of non-standard general traffic data is unclear, the bit-level feature extraction model will first extract high-dimensional semantic feature vectors to capture deep data correlations, and at the same time identify key frame structure features (such as frame headers and check fields). Therefore, the above semantic features include frame structure features and semantic feature vectors.

[0047] If the feature extraction model fails to extract semantic features, it indicates that the bit-level feature extraction model cannot effectively parse the communication traffic data. Therefore, this embodiment provides an alternative parsing method: inputting the communication traffic data into a probe model, which then outputs an active probe message corresponding to the communication traffic data. The probe model is a reinforcement learning model trained based on historical communication data.

[0048] The detection model determines the corresponding state vector and action parameters based on communication traffic data, and generates active probe messages by combining them with the general frame structure template of the power protocol. Then, security verification is performed through simulation. Only if the security verification passes will the message be sent to the terminal device to obtain semantic features. This significantly improves security and reliability, completely solving the problems of terminal crashes and malfunctions caused by traditional fuzz testing.

[0049] The aforementioned proactive probe message includes a general frame structure template and action parameters filled in according to the field order of the template. Upon receiving this proactive probe message, the terminal device generates physical response data and reports it to the edge node. Examples include current, voltage, and device operating status.

[0050] The corresponding semantic features are determined by comparing the physical response data with a preset physical semantic mapping relationship. This physical semantic mapping relationship can be based on constraints imposed by electrical physics laws, such as voltage fluctuation range constraints, current load correlation constraints, and frequency constancy constraints. Based on these electrical physics constraints, the corresponding semantic features can be determined by checking whether the physical response data conforms to the corresponding constraints.

[0051] After obtaining the semantic features, they are validated through simulation. If the validation result indicates that the semantic features pass, they are used as the parsed result of the communication traffic data. This is because the entire scheme relies on a reinforcement learning model, which may still contain errors, necessitating pre-output validation to ensure accuracy.

[0052] At the same time, historical communication data can be updated based on the collected communication traffic data and the corresponding parsing and verification results, and the detection model or feature extraction model can be reinforced through training. This allows the model to learn autonomously, gradually accumulate experience, and improve parsing accuracy and efficiency.

[0053] As an optional approach, in step S103, before sending the active probe message to the terminal device that generates the communication traffic data and obtaining the physical response data of the terminal device after the active probe message has passed security verification, the method further includes: sending the active probe message to the behavioral simulation model of the terminal device, wherein the behavioral simulation model is trained based on the historical communication data of the terminal device; simulating the physical response of the terminal device to the active probe message through the behavioral simulation model; determining that the security verification of the active probe message fails if the physical response indicates a fault in the terminal device; and determining that the security verification of the active probe message passes if the physical response indicates that the terminal device is secure.

[0054] The aforementioned behavioral simulation model can be a digital twin sandbox, trained using historical communication data. This digital twin sandbox can employ a hybrid architecture of LSTM and Hidden Markov Models (HMM), or a Transformer model; in this embodiment, a lightweight Transformer model is preferred for edge nodes. It can be pre-trained in the cloud using the interaction characteristics, temporal characteristics, and fault mode characteristics of historical communication data. After training, it is deployed to edge nodes. At the edge nodes, real-time data can be used for dynamic fine-tuning to improve learning capabilities and adapt to differences in terminal communication at the edge nodes.

[0055] The active probe message is sent to the terminal device's behavioral simulation model. This model simulates the terminal device's physical response upon receiving the message. This simulated physical response includes both normal and fault-related responses, such as error feedback and abnormal feedback. A normal response includes parameters like voltage and current. The terminal device sets safety thresholds for these parameters; if the response parameters of a normal response exceed these thresholds, it is considered a fault, posing a safety risk.

[0056] If the simulated physical response indicates a failure, it means that the active probe message will cause the terminal device to malfunction, and in this case, the security verification will fail. Conversely, if the simulated physical response indicates no failure, the security verification will be considered successful, and the active probe message sent to the terminal device will not cause a failure.

[0057] Failure of terminal equipment can affect the communication and operation of the power system, leading to a series of fault responses and the shutdown of related power equipment. By sending proactive probe messages with security verification to the terminal equipment, the reliability of proactive probe messages can be greatly increased, the probability of terminal equipment failure due to proactive probes can be reduced, and the reliability and security of the entire parsing process can be improved.

[0058] As an optional approach, when the physical response characterizes a terminal device failure, after determining that the security verification of the active probe message fails, the method further includes: intercepting the active probe message and generating a penalty signal; sending the penalty signal to the probe model, which then generates a new active probe message based on the penalty signal; and re-verifying the security of the new active probe message until the security verification of the active probe message passes or the iteration stops.

[0059] If the aforementioned proactive probe message fails security checks, it indicates a high probability of causing a terminal device malfunction, requiring regeneration or modification. First, the proactive probe message is intercepted. The severity of the malfunction is quantified based on the fault type and details to determine the cause. Based on the fault severity and cause, a penalty signal can be generated to modify the proactive probe message.

[0060] Upon receiving a penalty signal, the detection model can adjust the selection probability of the policy network parameters based on the penalty signal to generate proactive detection messages. The newly generated proactive detection messages are then re-verified for security, and the number of verifications is recorded. If the verification is successful within a preset number of attempts, the corresponding proactive detection message is output. This ensures high security for the proactive detection messages and significantly reduces the probability of terminal device malfunctions due to proactive detection messages.

[0061] In addition, if the algorithm still fails to verify after a preset number of attempts, the loop will stop and an alarm will be issued to prevent the algorithm from getting stuck in an infinite loop.

[0062] As an optional approach, in step S102, before inputting communication traffic data into the detection model and outputting the active detection message corresponding to the communication traffic data through the detection model, the method further includes: using historical communication data as sample data, selecting state parameters that satisfy Markov properties and are strongly correlated with the detection target based on measurable parameters at different time points in the sample data, and constructing a state space; constructing an action space based on executable detection action parameters and the constraints of the state parameters; determining the state transition probability of transitioning to a new state under different detection actions for different historical states; constructing a reward function based on the information gain, risk penalty, and detection cost of the detection action; setting different solution algorithms according to the complexity of the protocol scenario; and constructing a detection model based on the solution algorithm, state space, action space, state transition probability, and reward function.

[0063] The aforementioned state parameters must satisfy the Markov property, meaning that the future state depends only on the current state. Besides being measurable, the state parameters must also be strongly correlated with the target being probed. Specifically, this can include protocol structure, resource consumption, network state, etc. Furthermore, to avoid state space explosion when constructing the state space, the dimensionality of the state space can be reduced through methods such as information entropy aggregation or encoding compression.

[0064] The aforementioned action parameters can include all feasible probe actions in the current state. When creating the action space, the discretization / continuation of actions can be considered. If the action parameters are continuous (e.g., probe frequency, message length), then adaptation is required through discretization or the introduction of a continuous action space algorithm.

[0065] The statistical methods for calculating the state transition probabilities mentioned above can be either frequency-based or model-fitting. State transition probabilities are calculated based on historical states. As time progresses, the number of actions in historical states increases, and data from too early a time period may become outdated. Therefore, it is advisable to select the most recent data for statistical analysis to ensure accuracy.

[0066] As an alternative, the reward function is: ,in, To detect the decrease in state space information entropy caused by an action. This represents the probability of an abnormal response from the terminal device. To reduce detection time costs, These are the corresponding weighting coefficients.

[0067] Information gain is the reduction in protocol uncertainty caused by the probe action, and it is a positive reward.

[0068] This is a risk penalty. This value is derived from the digital twin sandbox assessment. If, during security verification through simulation, a clearly defined probe action will cause a response delay exceeding a preset threshold or return a known error code, then... It is a large negative value.

[0069] This is the detection cost, which is usually a small constant to encourage detection models to complete the detection in fewer steps.

[0070] The above reward function can obtain the maximum semantic information with the fewest number of probes. The reward function's ΔH(S) (information gain) drives the probe model to prioritize high-value probe actions. For unidentified length domains, it prioritizes traversing reasonable numerical ranges. Combined with frame structure features extracted from bit-level features, it narrows the action space and avoids invalid probes.

[0071] The choice of the above-mentioned solution algorithm needs to match the scene complexity, which can be comprehensively evaluated from the size of the state space, the dimension of the action space, and the degree of uncertainty of the transition probability. For non-standard protocols with high scene complexity, deep reinforcement learning algorithms can be used for solution.

[0072] As an optional approach, step S104 involves comparing the physical response data with a preset physical semantic mapping relationship to determine the corresponding semantic features, including: extracting multi-dimensional features from the physical response data; wherein the multi-dimensional features include at least one of the following: binary features, numerical features, temporal features, and contextual features; searching for similar protocol fragments in a large dataset as context based on the multi-dimensional features; inputting the multi-dimensional features and context into a large language model, and having the large language model infer the corresponding semantic features through a thought chain.

[0073] By combining multi-dimensional features, searching the context, and reasoning through the thought chain of a large language model, more accurate semantic features are obtained. Furthermore, the generalization ability of feature extraction is improved, enabling feature extraction to be applied to communication traffic data from various non-standard communication protocols.

[0074] As an optional approach, step S105 verifies the semantic features through simulation and obtains the verification results, including: combining the semantic features with the corresponding parsing driver code to determine the corresponding communication protocol type; comparing and verifying the semantic features with the historical semantic features of the historical communication data of the communication protocol type; and determining that the semantic feature verification is passed when the consistency between the historical semantic features and the semantic features reaches a preset similarity threshold.

[0075] After verification through simulation, the consistency is verified by comparing with historical semantic features to ensure that the semantic features are not only theoretically reasonable, but also adaptable to actual protocol parsing scenarios and consistent with the logic of historically verified protocols, thus avoiding the disconnect between purely theoretically derived semantic features and actual communication behavior.

[0076] Because non-standard communication protocols are essentially splits and combinations of standard communication protocols in terms of frame structure and semantic field encoding, the parsing driver code can be determined based on the parsing logic of various protocols for semantic features. The semantic features contain the parameters required for the parsing driver code to run. Data transformation is then performed through mapping, and finally, the semantic features are parsed in conjunction with the parsing driver code to identify the corresponding communication protocol type.

[0077] The historical semantic features corresponding to the communication protocol type are invoked to compare and verify the semantic feature parsing accuracy. If the consistency between the historical semantic features and the semantic feature reaches a preset similarity threshold, the semantic feature verification is deemed successful, indicating that the semantic feature parsing is accurate.

[0078] Conversely, if the consistency between historical semantic features and semantic features does not reach the preset similarity threshold, it indicates that although the parsing driver code can run, its semantic understanding is incorrect, and the semantic feature verification fails, indicating that the semantic feature parsing is inaccurate.

[0079] As an optional approach, before step S101, which involves extracting semantic features from the communication traffic data to be parsed based on the pre-trained bit-level feature extraction model, the method further includes: acquiring unlabeled communication data of existing industrial protocols and creating a large dataset; performing byte masking on the unlabeled communication data in the large dataset and forming training samples with the corresponding mask data; performing byte masking on different positions of the unlabeled communication data in the large dataset to generate a training sample set; and training the bit-level feature extraction model based on the training sample set until the cross-entropy loss of the bit-level feature extraction model reaches a preset threshold.

[0080] By leveraging unlabeled communication data from existing industrial protocols and employing byte masking, training data is generated for unlabeled training, improving training efficiency and saving on data processing procedures and resource consumption. This avoids manual annotation and reduces costs.

[0081] By using large datasets, such as tens of thousands of data points, to train a bit-level feature extraction model, the model's generalization ability can be guaranteed, effectively extracting semantic features from communication traffic data of various protocol types. The bit-level feature extraction model can extract features based on the precision levels of digital bits in communication data, ensuring the accuracy of communication traffic data analysis.

[0082] As an optional approach, semantic features include semantic feature vectors and frame structure features. The bit-level feature extraction model is a self-supervised training model based on the Transformer architecture. Semantic features are extracted from the communication traffic data to be parsed based on the pre-trained bit-level feature extraction model, including: preprocessing the communication traffic data to obtain the corresponding input vector; inputting the input vector into a Transformer encoder with a multi-head self-attention mechanism to obtain the dependency relationship between any two byte units; determining the frame structure features of the communication traffic data based on the dependency relationship; parsing the communication traffic data based on the frame structure features to obtain a semantic feature vector, where the semantic features include frame structure features and semantic feature vectors; if the integrity of the frame structure features does not exceed a preset integrity threshold, and / or the confidence of the semantic feature vector does not exceed a preset confidence threshold, the semantic feature extraction is considered to have failed.

[0083] The raw communication traffic data is transformed into a structured input vector that can be processed by a self-supervised training model based on the Transformer architecture, preserving byte semantics and positional information. Through the multi-head self-attention mechanism of the Transformer encoder, the dependency relationship, or association strength, between any two byte units is modeled, providing a basis for subsequent frame structure partitioning.

[0084] Specifically, each header outputs an attention weight matrix, representing the correlation strength of different bytes. By aggregating the multi-head weight matrices column-wise, a global dependency weight matrix is ​​obtained, which presents the dependency relationship between structured fields such as the frame header and other fields.

[0085] The system identifies structured fields of the protocol frame from the global dependency weight matrix, such as frame header, function code, data segment, and checksum. Frame structure features are then output through clustering. Based on these identified frame structure features, semantic encoding is performed on each field to generate a global semantic feature vector, and vector confidence is calculated.

[0086] Then, based on the completeness of the frame structure features and / or the confidence level of the semantic feature vector, it is determined whether semantic feature extraction has failed. In the case of failure, it is necessary to use the probing model to generate corresponding active probing messages, and then use the active probing messages or corresponding semantic features.

[0087] As an optional approach, the communication traffic data to be parsed is preprocessed to obtain the corresponding input vector, including: processing the communication traffic data to be parsed into a byte sequence of a preset length; mapping byte units in the byte sequence into continuous vectors through the embedding layer of a bit-level feature extraction model; and determining the input vector corresponding to the byte unit based on the continuous vector and the position encoding of the byte unit.

[0088] The preset length allows you to set a maximum length for the protocol type. If the length is insufficient, pad with zeros at the end; otherwise, truncate the length. You can also filter bytes that are all zeros or all ones, and filter invalid packets that fail checksum verification to ensure data quality.

[0089] Relative positional encoding is used during encoding, which better captures the relative positional dependencies of byte units compared to absolute positional encoding. The positional encoding vector and the embedding vector are added element-wise to preserve byte positional information, ultimately generating the input vector.

[0090] As an optional approach, it also includes: when the communication traffic data is encrypted traffic data, extracting the metadata sequence of the encrypted traffic data, wherein the metadata sequence includes at least one of the following: data packet length sequence, arrival time interval sequence, and transmission direction sequence; inputting the metadata sequence into a bit-level feature extraction model to identify the business behavior pattern of the encrypted traffic.

[0091] The metadata sequence of the aforementioned encrypted traffic, including packet length, arrival time interval, and transmission direction, is input into a bit-level self-supervised model to identify business behavior patterns. These business behavior patterns can support the detection model in generating proactive probe messages for semantic feature extraction.

[0092] Specifically, the cloud management center has a pre-built encrypted protocol probe template library. Based on the identified business behavior patterns, it filters and matches templates, uses the matched templates as action space constraints for the reinforcement learning agent, and inputs them into the probe model to generate active probe messages that conform to the encrypted protocol communication specifications, thus avoiding invalid probes.

[0093] It should be noted that this embodiment also provides an optional implementation method, which will be described in detail below.

[0094] This implementation is based on a cloud-edge-device collaborative edge IoT architecture: the edge layer consists of intelligent edge gateways (Edge Agents) distributed in substations and power distribution rooms, which have certain computing power and can complete high-frequency, real-time traffic collection and preliminary feature extraction, and are responsible for the execution of the final driver program; the cloud layer relies on high-performance computing clusters to deploy large parameter pre-trained large model (LLM) and digital twin environment, serving as the system "brain" to undertake tasks such as complex semantic reasoning, security pre-simulation, and code generation; in terms of the collaborative mechanism, this implementation breaks through the limitations of traditional single-point parsing and constructs a closed-loop process of "edge perception - cloud thinking - edge execution". After the edge side discovers an unknown device, it automatically requests the cloud to intervene. The cloud generates a parsing APP based on the large model capability and distributes it to the edge in a containerized manner to achieve automated adaptation to massive heterogeneous terminals.

[0095] This implementation aims to solve the following core technical problems existing in current power heterogeneous terminal access technologies:

[0096] 1. Syntactic parsing challenges of unknown protocols: How to perform syntactic analysis on raw binary traffic of unknown, proprietary or non-standard protocols without relying on pre-built rule bases or manual intervention, and automatically identify their frame structure, such as frame header, frame trailer, length field, check field, etc., to achieve zero-sample protocol structuring.

[0097] 2. The dilemma of security and efficiency in active probing: How to ensure that vulnerable or outdated power equipment is not at risk of downtime or malfunction when it is necessary to obtain protocol semantic information through active interaction, and to obtain the maximum information gain with the fewest number of interactions.

[0098] 3. The "last mile" automation gap between semantics and code: How to automatically associate the parsed binary data with the real physical world meaning (such as voltage and current), and further transform this semantic understanding directly into executable and robust device driver code, thereby completely replacing manual coding.

[0099] Figure 2 This is a flowchart of a method for parsing the power terminal protocol according to an embodiment of the present invention, as shown below. Figure 2 As shown, the specific steps are as follows:

[0100] Step (1): Passive perception and bit-level feature extraction: Edge computing nodes collect the raw communication traffic of heterogeneous power terminals through the communication interface, use the preset bit-level feature extraction model to map the raw communication traffic into a high-dimensional semantic feature vector, and extract the frame structure features of the protocol based on the attention mechanism.

[0101] Step (2): Digital twin sandbox construction and pre-simulation: Based on the historical communication traffic collected in step (1), construct a behavior simulation model of the heterogeneous power terminal and instantiate it as a digital twin sandbox in an isolated virtual environment; configure the digital twin sandbox to simulate the response behavior and fault feedback of physical devices.

[0102] Step (3): Security-restricted active detection: When passive perception cannot determine the protocol semantics, a reinforcement learning detection model is instantiated; the detection model generates an active detection message based on the current protocol parsing uncertainty state; the active detection message is first simulated in a digital twin sandbox for security verification. If the simulation result does not trigger the abnormal threshold, the active detection message is sent to the terminal device.

[0103] Step (4): Physical-information multimodal semantic alignment: Obtain the physical response data of the terminal device to the active probe message, extract the numerical statistical features and time-series waveform features of the physical response data, and perform multimodal alignment with the preset physical semantic mapping relationship; use retrieval enhancement generation technology to retrieve the protocol specification from the knowledge base, and determine the physical meaning of the data field, that is, the semantic features, through large language model reasoning.

[0104] Step (5): Driver code generation and closed-loop verification: Generate executable protocol parsing driver code based on the results of large language model inference; backtest and verify the parsing driver code in the digital twin sandbox using historical communication traffic; after verification, deploy it to the edge computing node.

[0105] In step (1) above, the edge computing node collects the raw communication traffic of the heterogeneous power terminals in promiscuous mode.

[0106] The built-in bit-level feature extraction model based on the Transformer architecture is used to encode unlabeled binary byte communication traffic data.

[0107] This bit-level feature extraction model does not rely on manual feature engineering. Instead, it analyzes the dependencies between bytes and calculates the information entropy distribution through a self-attention mechanism, thereby automatically identifying structural features such as the protocol's frame header, length field, function code, and check bits under zero-sample conditions.

[0108] When extracting semantic features, the bit-level feature extraction model described above processes the raw communication traffic collected by the edge computing nodes into a uniform hexadecimal byte sequence, regardless of whether the source is a serial port (RS485 / 232) or Ethernet. ,in .

[0109] Figure 4 This is a schematic diagram of the feature encoding and classification network structure of an embodiment of the present invention, as shown below. Figure 4As shown, to enable the model to process this sequence, each discrete byte value is first embedded through an embedding layer. Mapped to a 2D continuous input vector .

[0110] To preserve the absolute and relative position information of bytes in data packets, sine / cosine positional encoding (PE) is introduced.

[0111] Ultimately, the model is in position Input vector at the location It is composed of byte embedding and positional encoding:

[0112]

[0113] in, bytes at position pos The input vector, The location encoding is calculated as follows:

[0114]

[0115]

[0116] Input vector sequence It is fed into a multi-layer Transformer encoder. Its core is a multi-head self-attention mechanism, used to calculate the dependency between any two bytes in the sequence. Figure 3 This is a schematic diagram of the reinforcement learning neural network structure according to an embodiment of the present invention, as shown below. Figure 3 As shown, the calculation process for a single attention head is as follows:

[0117]

[0118] in These are respectively through the input The query, key, and value matrix obtained by performing a linear transformation. represents the feature dimensions of query Q and key K, i.e., the length of each query vector and each key vector. T is the matrix transpose. This mechanism can capture long-range dependencies, including the mathematical relationship between a CRC check byte and the entire data payload.

[0119] To achieve zero-shot capability, the bit-level feature extraction model was pre-trained on a large-scale unlabeled traffic dataset containing tens of thousands of known industrial protocols (such as Modbus, DLT645, IEC104, etc.) during training.

[0120] Masked Byte Modeling (MBM) involves randomly masking 15% of the bytes in an input sequence and training the model to recover the masked bytes based on context. The loss function used is cross-entropy loss, designed to minimize the difference between predicted and actual bytes. Through this process, the model implicitly learns the common grammatical patterns of industry protocols.

[0121] During the inference phase of the bit-level feature extraction model, for unknown protocol traffic, the attention weight matrix output by the model is used to identify the frame structure.

[0122] The system calculates the information entropy at each byte location. . This represents the probability of a specific byte value occurring at the i-th position.

[0123] Locations with lower entropy values ​​indicate that their byte values ​​remain unchanged or exhibit a single pattern of change across multiple messages, and are thus identified as frame headers, frame trailers, or fixed function codes. Locations with higher entropy values ​​are identified as data payloads, sequence numbers, or timestamps.

[0124] Furthermore, if the attention weight of a byte is highly concentrated on a subsequent continuous byte, then that byte is identified as a length field.

[0125] In step (2) above, digital twin behavior modeling and sandbox construction are performed based on historical traffic. This step aims to build a virtual device environment for security rehearsals. Figure 5 This is a schematic diagram of the security active detection and digital twin sandbox simulation process of an embodiment of the present invention, as shown below. Figure 5 As shown, the following structured features are extracted from the historical traffic collected in step (1): 1) Request-response pairs: Identify and associate request messages with corresponding response messages; 2) Timing features: Statistically analyze the distribution of response delay time (mean, variance, 95th percentile); 3) Error patterns: Analyze the specific error response frames when the device receives abnormal messages (e.g., cyclic redundancy check CRC error).

[0126] Based on the extracted features, the system selects and trains a time-series prediction model. Preferably, a Long Short-Term Memory (LSTM) network or a Gated Recurrent Unit (GRU) can be used.

[0127] The model takes a simulated request message as input and outputs the predicted response message content and response latency.

[0128] The training objective is to minimize the mean squared error or cross-entropy loss between the predicted response and the historical true response.

[0129] The trained behavioral simulation model is deployed in an isolated software container, forming a digital twin sandbox. This sandbox exposes a communication interface through a virtual COM port or a virtual network interface (TUN / TAP device), allowing external programs to interact with it as if they were communicating with a real device.

[0130] In step (3) above, when the bit-level feature extraction model cannot fully parse the protocol semantics, a probing model based on the Proximal Policy Optimization (PPO) algorithm using reinforcement learning is generated. This probing model is responsible for generating proactive probing messages to obtain more information. Crucially, all proactive probing messages must be "pre-rehearsed" in a digital twin sandbox before being sent to the physical device. If the sandbox predicts that the proactive probing message may cause high latency, connection loss, or abnormal errors, it will intercept the proactive probing message and penalize the probing model; only proactive probing messages that have been verified as secure are allowed to be sent to the physical terminal.

[0131] This step aims to safely and efficiently explore the semantic space of unknown protocols. The active probing problem is formalized as an MDP:

[0132] State space (S): The currently known protocol structure, the identified instruction set, the uncovered data fields, and the information entropy of protocol parsing. .

[0133] Action Space (A): Generates an active probe message containing active probe actions. Active probe actions can be parameterized as follows: Iterate through function codes or register addresses. Here, `command_id` is the command identifier (a unique string / enumeration value) used to distinguish the type of action / core intent. `params` is the set of command parameters (a dictionary / key-value pair structure), which contains the specific execution details corresponding to `command_id`.

[0134] Reward function (R): This is the core element ensuring both safety and efficiency. exist The moment is designed to be:

[0135]

[0136] in:

[0137] It is information gain, that is, active detection action. The reduction in uncertainty associated with the agreement is a positive reward. For information gain The weight.

[0138] This is a risk penalty. This value is derived from the digital twin sandbox assessment. If the sandbox predicts an active detection action... This will cause the response delay to exceed the preset threshold. Or return a known error code. It is a large negative value. Risk penalty The weight.

[0139] This is the detection cost, which is usually a small constant to encourage detection models to complete the detection in fewer steps. To detect cost The weight.

[0140] Each active detection action generated by the detection model (trained using the PPO algorithm) All must follow the "rehearsal-execution" process:

[0141] Detection Model Policy Network Output active detection action .

[0142] Active detection action It was sent to the digital twin sandbox.

[0143] The sandbox outputs a predicted response based on its behavioral model. and risk assessment .

[0144] A "Security Shield" module check .like If the safety threshold is exceeded, the proactive detection action is intercepted, and a negative reward is fed back to the detection model.

[0145] Only when When the value is below the threshold, an active detection action is initiated. Only then is it allowed to be sent to the physical device.

[0146] The above step (4) is based on multimodal semantic alignment using physical-information fusion. This step aims to map binary data to specific physical meanings.

[0147] Figure 6 This is a schematic diagram of the multimodal semantic alignment and driver code generation process according to an embodiment of the present invention, as shown below. Figure 6As shown, multi-dimensional features are extracted from the response data: 1) Binary features: the original byte sequence; 2) Numerical features: numerical statistics (mean, variance, extreme values) after decoding the data segments in different formats (int16, float32, etc.); 3) Temporal features: the periodicity of the numerical sequence is analyzed by Fast Fourier Transform (FFT); 4) Contextual features: metadata such as the type of equipment (e.g., "three-phase meter") and rated parameters.

[0148] The system constructs a vector database containing thousands of power protocol standards (IEC61850, DLT645, etc.) and equipment manuals. When processing response data, its structural features are used as queries, and the most similar protocol fragments are retrieved from the database as context through Retrieval Enhanced Generation (RAG) technology.

[0149] The Large Language Model (LLM) receives all the above features and the retrieved context, and performs reasoning through a chain of thoughts. The reasoning process is as follows: "Assumption: Bytes [4:8] represent the voltage of phase A. Verification 1: Parsed as big-endian floating-point, its value is between 215.0 and 225.0, which conforms to the physical constraint of 220V voltage. Verification 2: Its FFT spectrum has a significant peak at 50Hz. Verification 3: RAG search results show that a similar proprietary protocol defines the voltage at this location."

[0150] In step (5) above, executable protocol parsing driver code (Python code) is directly generated based on the inference results of the large language model. The generated parsing driver code is then placed back into the digital twin sandbox for backtesting using historical traffic. After successful verification, the parsing driver code is automatically packaged and hot-loaded into the edge computing gateway's runtime environment.

[0151] This step aims to generate a device driver that can be deployed directly.

[0152] A large language model specifically designed for fine-tuning code generation tasks is employed. To reduce computational overhead, low-rank adaptive (LoRA) techniques are used for fine-tuning. This involves adjusting the original weight matrix of the pre-trained model... Based on this, add a weight increment matrix of low-rank decomposition. Conduct training:

[0153]

[0154] in, The final weight matrix after fine-tuning, the rank of the weight increment matrix. B and A are the original weight matrices, respectively. The two small matrices of the low-rank decomposition fine-tuning dataset consist of a "protocol semantic description - corresponding parsing code" pair.

[0155] LLM receives the semantic map output from step four as a prompt and generates structured Python or C++ code that includes comments and exception handling. The generated code must include at least: a data frame verification function, a payload parsing function (including byte order handling and data type conversion), and a function to convert raw values ​​to standard units.

[0156] The generated driver code is deployed in a digital twin sandbox for final verification. The system takes historical raw traffic as input and runs the driver. The verification module asserts whether the parsed values ​​are within a physically reasonable range and whether they are consistent with historical data patterns. Only code that passes all assertions is ultimately confirmed as a qualified artifact and packaged into a container image for deployment.

[0157] This implementation addresses the pain points of heterogeneous edge devices, limited computing power, and high security requirements in the power Internet of Things (IoT), providing a protocol intelligent parsing method based on a cloud-edge collaborative architecture. It redefines the device access process in the edge IoT system, transferring high-computing-power-consuming feature analysis and model inference to the cloud, while retaining low-latency traffic acquisition and driver execution at the edge.

[0158] By combining the "large model brain" in the cloud with the "perception and execution tentacles" at the edge, and utilizing bit-level self-supervised learning and digital twin technology, a method for intelligent parsing and configuration of power terminal protocols for edge IoT systems is provided. A bit-level feature extraction model is used to extract the deep semantics of binary streams, and multi-head self-attention mechanism and information entropy distribution analysis are used to effectively capture the frame structure features of unknown protocols without a pre-built feature library, achieving zero-sample parsing of private and fragmented protocols.

[0159] By introducing a collaborative mechanism between a digital twin sandbox and a reinforcement learning detection model, security simulations of proactive detection messages are performed in a virtual environment. This avoids the risks of terminal crashes and malfunctions that may result from traditional proactive detection technologies directly sending malformed or high-frequency messages to physical devices.

[0160] By combining physical-information multimodal semantic alignment and retrieval enhancement generation technology, the underlying communication data can be accurately mapped to physical meaning and executable driver code can be automatically generated. This covers the entire process of automation from perception to access, meets the diverse needs of secure access for massive heterogeneous devices in the power Internet of Things, and significantly improves the efficiency of protocol parsing and the reliability of system operation.

[0161] In summary, this implementation achieves zero-sample protocol parsing: through bit-level self-supervised learning, it can identify and parse unknown, proprietary, and even encrypted protocol structures without the need for pre-built feature libraries from specific manufacturers, solving the problem of long-tail device access in the power IoT. It ensures the inherent security of industrial detection: the pioneering "digital twin sandbox pre-simulation" mechanism eliminates the risks of active detection in virtual space, ensuring "minimal disturbance" to older power equipment and addressing the pain point of "reluctance to actively detect" in industrial sites. It improves the depth and accuracy of semantic understanding: through multimodal alignment of physical laws and data features, the system can not only identify device types but also accurately understand the physical meaning of data payloads, achieving semantic-level interoperability. It achieves full-process automation: from traffic capture to the generation and deployment of executable driver code, no manual intervention is required throughout, significantly reducing the operation and maintenance costs and technical barriers of the power IoT.

[0162] Embodiments of the present invention also provide a non-transitory machine-readable medium storing a computer program, wherein the computer program, when executed by a computer's processor, is used to cause the computer to perform a method according to an embodiment of the present invention.

[0163] Embodiments of the present invention also provide a computer program product, including a computer program, wherein the computer program, when executed by a computer's processor, is used to cause the computer to perform the method of an embodiment of the present invention.

[0164] An embodiment of the present invention also provides an electronic device, including: at least one processor; and a memory communicatively connected to the at least one processor. The memory stores a computer program executable by the at least one processor, which, when executed by the at least one processor, causes the electronic device to perform the method of the embodiment of the present invention.

[0165] refer to Figure 7 The present invention will now describe a structural block diagram of an electronic device that can serve as an embodiment of the present invention, serving as an example of a hardware device applicable to various aspects of the present invention. The electronic device is intended to represent various forms of digital electronic computer devices, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the present invention described and / or claimed herein.

[0166] like Figure 7As shown, the electronic device includes a computing unit 701, which can perform various appropriate actions and processes based on a computer program stored in a read-only memory (ROM) 702 or a computer program loaded into a random access memory (RAM) 703 from a storage unit 708. The RAM 703 may also store various programs and data required for the operation of the electronic device. The computing unit 701, ROM 702, and RAM 703 are interconnected via a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0167] Multiple components in the electronic device are connected to I / O interface 705, including: input unit 706, output unit 707, storage unit 708, and communication unit 709. Input unit 706 can be any type of device capable of inputting information into the electronic device. Input unit 706 can receive input digital or character information and generate key signal inputs related to user settings and / or function control of the electronic device. Output unit 707 can be any type of device capable of presenting information and may include, but is not limited to, a display, speaker, video / audio output terminal, vibrator, and / or printer. Storage unit 708 may include, but is not limited to, disks and optical discs. Communication unit 709 allows the electronic device to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks, and may include, but is not limited to, modems, network cards, infrared communication devices, and / or wireless communication transceivers, such as Bluetooth devices, WiFi devices, WiMax devices, cellular communication devices, and / or the like.

[0168] The computing unit 701 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 701 include, but are not limited to, CPUs, graphics processing units (GPUs), various special-purpose artificial intelligence (AI) computing units, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any suitable processor, controller, microcontroller, etc. The computing unit 701 performs the various methods and processes described above. For example, in some embodiments, the method embodiments of the present invention can be implemented as computer programs tangibly contained in a machine-readable medium, such as storage unit 708. In some embodiments, part or all of the computer program can be loaded and / or installed on an electronic device via ROM 702 and / or communication unit 709. In some embodiments, the computing unit 701 can be configured to perform the methods described above by any other suitable means (e.g., by means of firmware).

[0169] Computer programs for implementing the methods of embodiments of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing apparatus, such that when executed by the processor or controller, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0170] In the context of embodiments of this invention, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable signal medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, or infrared systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0171] It should be noted that the term "comprising" and its variations used in the embodiments of this invention are open-ended, meaning "including but not limited to". The term "based on" means "at least partially based on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". The modifications of "one" and "a plurality" mentioned in the embodiments of this invention are illustrative and not restrictive, and those skilled in the art should understand that unless explicitly indicated otherwise in the context, they should be understood as "one or more".

[0172] The user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in the embodiments of this invention are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and corresponding operation entry points are provided for users to choose to authorize or refuse.

[0173] The steps described in the method embodiments provided by the present invention can be performed in different orders and / or in parallel. Furthermore, the method embodiments may include additional steps and / or omit the steps shown. The scope of protection of the present invention is not limited in this respect.

[0174] The term "embodiment" in this specification refers to a specific feature, structure, or characteristic described in connection with an embodiment that may be included in at least one embodiment of the invention. The appearance of this phrase in various places throughout the specification does not necessarily imply the same embodiment, nor does it imply independence or alternativeity from other embodiments. The various embodiments in this specification are described in a related manner, with reference to each other for similar or identical parts. In particular, for apparatus, device, and system embodiments, since they are substantially similar to method embodiments, the description is relatively simple, and relevant details are referred to in the description of the method embodiments.

[0175] The above-described embodiments are merely illustrative of several implementations of the present invention, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of protection. It should be noted that those skilled in the art can make various modifications and improvements without departing from the inventive concept of the present invention, and these modifications and improvements all fall within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the appended claims.

Claims

1. A smart parsing method for power terminal protocols, characterized in that, Includes the following steps: Semantic features are extracted from the communication traffic data to be parsed based on a pre-trained bit-level feature extraction model. If the feature extraction model fails to extract the semantic features, the communication traffic data is input into the probe model, and the probe model outputs the active probe message corresponding to the communication traffic data; wherein, the probe model is a reinforcement learning model trained based on historical communication data; If the active probe message passes security verification, the active probe message is sent to the terminal device that receives the communication traffic data to obtain the physical response data of the terminal device. The corresponding semantic features are determined by comparing the physical response data with the preset physical semantic mapping relationship. The semantic features are verified by simulation to obtain the verification result. If the verification result indicates that the verification is successful, the semantic features are used as the parsing result of the communication traffic data, and the historical communication data is updated to strengthen the training of the detection model or the feature extraction model.

2. The method according to claim 1, characterized in that, Before sending the active probe message to the terminal device that receives the communication traffic data, and obtaining the physical response data of the terminal device, after the active probe message has passed security verification, the method further includes: The behavior simulation model that sends the active probe message to the terminal device is trained based on the historical communication data of the terminal device. The physical response of the terminal device to the active probe message is simulated using the behavioral simulation model. If the physical response indicates a fault in the terminal device, it is determined that the security verification of the active probe message fails. If the physical response characterizes the security of the terminal device, then the security verification of the active probe message is determined to be successful.

3. The method according to claim 2, characterized in that, When the physical response characterizes a fault in the terminal device, and after determining that the security verification of the active probe message fails, the method further includes: The active probe message is intercepted, and a penalty signal is generated; The penalty signal is sent to the detection model, which then generates a new active detection message based on the penalty signal. The new active probe message is re-verified for security until the security verification of the active probe message passes or the iteration stops.

4. The method according to claim 1, characterized in that, Before inputting the communication traffic data into the probe model and outputting the active probe message corresponding to the communication traffic data through the probe model, the method further includes: Using historical communication data as sample data, based on measurable parameters at different time points in the sample data, state parameters that satisfy Markov properties and are strongly correlated with the detection target are selected to construct the state space; and based on the executable detection action parameters, combined with the constraints of the state parameters, the action space is constructed. Based on different historical states and different detection actions, the state transition probability of transitioning to a new state; Based on the information gain, risk penalty, and detection cost of the detection action, a reward function is constructed. Different solution algorithms are set according to the complexity of the protocol scenario; Based on the solution algorithm, the state space, action space, state transition probability, and reward function are used to construct the detection model.

5. The method according to claim 4, characterized in that, The reward function is: in, To detect the decrease in state space information entropy caused by an action. This represents the probability of an abnormal response from the terminal device. To reduce detection time costs, These are the corresponding weighting coefficients.

6. The method according to claim 1, characterized in that, The corresponding semantic features are determined by comparing the physical response data with a preset physical semantic mapping relationship, including: Extract multi-dimensional features from the physical response data; wherein the multi-dimensional features include at least one of the following: binary features, numerical features, temporal features, and contextual features; Based on the aforementioned multi-dimensional features, similar protocol fragments are searched in the big data set as context. The multi-dimensional features and the context are input into a large language model, which then uses a thought chain to deduce the corresponding semantic features.

7. The method according to claim 1, characterized in that, The semantic features are verified through simulation, and the verification results are obtained, including: By combining semantic features with the corresponding parsing driver code, the corresponding communication protocol type can be determined. Based on the historical semantic features of the historical communication data of the aforementioned communication protocol type, a comparison and verification is performed with the semantic features; If the consistency between the historical semantic features and the semantic features reaches a preset similarity threshold, the semantic features are determined to have passed the verification.

8. The method according to claim 1, characterized in that, Before extracting semantic features from the communication traffic data to be parsed based on the pre-trained bit-level feature extraction model, the method further includes: Acquire unlabeled communication data from existing industrial protocols and create a large dataset; The unlabeled communication data in the aforementioned big data set is used to perform byte masking, and the corresponding mask data is used to form training samples; A training sample set is generated by performing byte masking on different positions of unlabeled communication data in the aforementioned big data set. The bit-level feature extraction model is trained based on the training sample set until the cross-entropy loss of the bit-level feature extraction model reaches a preset threshold.

9. The method according to claim 8, characterized in that, The semantic features include semantic feature vectors and frame structure features, and the bit-level feature extraction model is a self-supervised training model based on the Transformer architecture; the semantic features in the communication traffic data to be parsed are extracted based on the pre-trained bit-level feature extraction model, including: The communication traffic data to be parsed is preprocessed to obtain the corresponding input vector; The input vector is fed into a Transformer encoder with a multi-head self-attention mechanism to obtain the dependency relationship between any two byte units; The frame structure characteristics of the communication traffic data are determined based on the dependency relationship; The communication traffic data is parsed based on the frame structure features to obtain a semantic feature vector, wherein the semantic features include the frame structure features and the semantic feature vector; If the integrity of the frame structure features does not exceed a preset integrity threshold, and / or the confidence level of the semantic feature vector does not exceed a preset confidence threshold, the semantic feature extraction is confirmed to have failed.

10. The method according to claim 9, characterized in that, The communication traffic data to be parsed is preprocessed to obtain the corresponding input vector, including: The communication traffic data to be parsed is processed into a byte sequence of a preset length; The byte units in the byte sequence are mapped to continuous vectors through the embedding layer of the bit-level feature extraction model. Based on the continuous vector and the position encoding of the byte unit, the input vector corresponding to the byte unit is determined; And / or, When the communication traffic data is encrypted traffic data, the metadata sequence of the encrypted traffic data is extracted, wherein the metadata sequence includes at least one of the following: a data packet length sequence, an arrival time interval sequence, and a transmission direction sequence; The metadata sequence is input into the bit-level feature extraction model to identify the business behavior patterns of the encrypted traffic.

Images