An FTTR gateway data protocol analysis method, device, equipment and medium

Abstract

The application provides an FTTR gateway data protocol analysis method and device, equipment and medium, belonging to the field of FTTR gateway data protocol. Through self-defined iptables based on kernel hook mounting listening point, TEE rule bypass non-invasive copy mirror message is configured; a polling thread pool is created to process protocol data in the mirror message in layers; the standardized protocol data is analyzed in layers to obtain protocol analysis results, and based on the protocol analysis results and the baseline, abnormal detection and positioning are performed to obtain abnormal detection results; based on the abnormal detection results, a visual abnormal alarm is formed, corresponding alarms are executed according to the abnormal level, and data backup and expired data cleaning are performed, which comprehensively improves the FTTR network operation efficiency and stability. Therefore, through the above scheme, the FTTR master-slave gateway MQTT communication and multi-protocol messages can be accurately captured; fine protocol analysis is realized, and the accuracy of data analysis is improved.

Description

Technical Field

[0001] This application belongs to the field of FTTR gateway data protocol analysis technology, and specifically relates to an FTTR gateway data protocol analysis method, apparatus, device and medium. Background Technology

[0002] With the widespread adoption of gigabit broadband and the implementation of Wi-Fi 6th / 7th generation technology, FTTR, as an innovative solution extending PON technology indoors, is rapidly being promoted in scenarios such as large apartments, villas, high-end apartments, and corporate offices, thanks to its core advantage of "one fiber into the house, 10 gigabit coverage throughout." Its core architecture consists of a master gateway (Master ONT), slave gateways (optical APs, Slave ONTs), and terminal devices. The master and slave gateways communicate using the MQTT protocol to synchronize device status, distribute configurations, and manage roaming. The master gateway is responsible for terminating operator signals such as XGS-PON and providing unified management of slave gateways and various terminals, enabling scheduling and control of the entire home network.

[0003] During FTTR gateway operation, extensive data interaction is required with operator OLT equipment, downstream slave gateways, and terminal devices, involving multiple data protocols, including the OMCI protocol at the PON layer, the MQTT protocol for master-slave gateway communication, the DHCPv4 / v6, ARP, and ND protocols at the network layer, the IP / TCP / UDP protocols at the transport layer, the HTTP / DNS protocols at the application layer, the Wi-Fi Mesh protocol at the access layer, and the TR069 protocol at the management layer. These protocols carry critical information such as device registration, configuration distribution, link status feedback, and service data transmission, and are the core support for ensuring the normal operation of the FTTR network.

[0004] Currently, FTTR gateway data protocol analysis suffers from several technical challenges: First, existing analysis methods primarily target single protocols or single interaction scenarios, failing to cover the MQTT communication protocol between master and slave gateways, thus hindering unified capture and parsing of the entire FTTR gateway protocol and process. Second, the lack of iptables-based packet mirroring and kernel hook capture mechanisms makes it difficult to accurately acquire master-slave gateway interaction packets, leading to data loss or parsing errors. Third, protocol anomaly detection relies on manual investigation, lacking refined parsing and anomaly judgment for critical protocols such as DHCP, IP / TCP / UDP, and DNS. Fourth, the lack of a unified protocol analysis system prevents the visualization of collected protocol data, parsing results, and anomaly information, making it difficult for operations and maintenance personnel to intuitively grasp the network protocol operation status. Summary of the Invention

[0005] In view of the above problems, this application proposes an FTTR gateway data protocol analysis method, apparatus, device, and medium. It addresses the issues of incomplete coverage of the master-slave gateway MQTT communication protocol, which prevents unified capture and parsing of the entire FTTR gateway protocol and process; and the lack of iptables-based packet mirroring and kernel hook capture mechanisms, making it difficult to accurately obtain master-slave gateway interaction packets and prone to data loss or parsing errors.

[0006] One embodiment of this application provides a method for analyzing FTTR gateway data protocols, including:

[0007] Acquire protocol data and packet mirroring of communication between the FTTR master gateway and at least one slave gateway via MQTT protocol; mount listening points based on netfilter kernel hooks using a custom iptables mirroring module, configure TEE rules to bypass and non-intrusively copy mirrored packets; create a polling thread pool to process the protocol data in the mirrored packets in a layered manner and preprocess the protocol data to generate standardized protocol data; perform layered parsing of the standardized protocol data to obtain protocol parsing results, and perform anomaly detection and location based on the protocol parsing results and baseline to obtain anomaly detection results; generate visualized anomaly alarms based on the anomaly detection results, execute corresponding alarms according to the anomaly level, and perform data backup and expired data cleanup.

[0008] Furthermore, obtaining the protocol data and message mirroring of the FTTR master gateway and at least one slave gateway communicating via the MQTT protocol includes:

[0009] The original traffic of the FTTR master gateway and at least one slave gateway communicating via the MQTT protocol is copied without modification to form protocol data by blocking the service traffic.

[0010] The message image is obtained based on the protocol data.

[0011] Furthermore, the step of creating a polling thread pool to process the protocol data in the image packets in a layered manner includes:

[0012] Create a polling thread pool to handle protocol events.

[0013] The polling thread pool includes: PON layer, MQTT layer, network layer, transport layer, application layer, access layer, and management layer;

[0014] Protocol data is processed in layers based on the PON layer, MQTT layer, network layer, transport layer, application layer, access layer, and management layer.

[0015] Furthermore, the preprocessing of the protocol data to generate standardized protocol data includes:

[0016] The message protocol data is deduplicated, noise-reduced, fragmented and reassembled, and format-standardized to generate standardized protocol data.

[0017] Furthermore, the step of performing layered parsing on the standardized protocol data to obtain the protocol parsing result includes:

[0018] The protocol parsing module incorporates a built-in FTTR gateway protocol parsing rule base, which is used to perform layered parsing of standardized protocol data.

[0019] Layered parsing is performed on MQTT, DHCP, IP / TCP / UDP, DNS, HTTP, OMCI, TR069, and Mesh protocols in standardized protocol data;

[0020] Obtain the resolution results for MQTT, DHCP, IP / TCP / UDP, DNS, HTTP, OMCI, TR069, and Mesh protocols.

[0021] Furthermore, the method also includes: PON layer protocol parsing: parsing the OMCI protocol to extract device registration, configuration distribution, optical power, link status, and fault alarm information;

[0022] MQTT layer protocol parsing: Parses MQTT communication messages between master and slave gateways, extracting device identifiers, topic subscriptions, message publishing, configuration synchronization, status reporting, and heartbeat keep-alive information;

[0023] Network layer protocol parsing: Parses DHCPv4 / v6 and ARP, extracts IP allocation, MAC mapping, IP lease time, IPv6 configuration information, and identifies IP conflicts and MAC migration;

[0024] Transport layer protocol parsing: Parses IP, TCP, and UDP protocols, extracting: protocol information list, IP addresses of communicating parties, total number of TCP connections, number of successful TCP connections, TCP three-way handshake time, uplink retransmission rate, and downlink retransmission rate;

[0025] Application layer protocol resolution: DNS protocol resolution extracts the DNS information list, accessed domain name, domain name corresponding IP list, DNS server IP, DNS request time (UTC milliseconds), and DNS response time (UTC milliseconds); HTTP protocol resolution extracts the request method, URL, status code, request / response time, and session identifier.

[0026] Access layer protocol parsing: Parses the Wi-Fi Mesh protocol, extracting information such as roaming handover, signal strength, connection type, access authentication, and transmission rate;

[0027] Management Protocol Analysis: Parse the TR069 protocol to extract remote management commands, parameter configurations, and status reporting information;

[0028] Business layer protocol parsing: Extracting service rate, latency, and packet loss rate to assess service quality.

[0029] Furthermore, the anomaly detection result obtained by performing anomaly detection and localization based on the protocol parsing result and baseline includes:

[0030] Anomaly detection rules are established based on historical baselines, which are generated by averaging historical protocol parsing results.

[0031] A three-level anomaly determination rule is established based on the historical baseline, and the anomaly determination rule includes severe anomalies, general anomalies, and minor anomalies.

[0032] The source / destination address, link, and anomaly field of the protocol parsing result are used to locate the anomaly location and root cause, and anomaly detection results are generated.

[0033] Based on the same inventive concept, a second aspect of the embodiments of this application also provides an FTTR gateway data protocol analysis device, comprising:

[0034] The data acquisition unit is used to acquire protocol data and message images of communication between the FTTR master gateway and at least one slave gateway via the MQTT protocol;

[0035] The packet mirroring unit is used to mount listening points based on netfilter kernel hooks through a custom iptables mirroring module, and configure TEE rules to bypass and non-intrusively copy mirrored packets.

[0036] The data preprocessing unit is used to create a polling thread pool to process the protocol data in the image message in a layered manner and to preprocess the protocol data to generate standardized protocol data.

[0037] The protocol parsing unit is used to perform hierarchical parsing on the standardized protocol data to obtain the protocol parsing result, and to perform anomaly detection and location based on the protocol parsing result and the baseline to obtain the anomaly detection result.

[0038] An anomaly alarm unit is used to generate a visual anomaly alarm based on the anomaly detection results, execute the corresponding alarm according to the anomaly level, and perform data backup and expired data cleanup.

[0039] Based on the same inventive concept, a third aspect of the present application also provides an electronic device, including: a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus;

[0040] Memory, which stores computer programs;

[0041] When the processor executes a program stored in memory, it implements a method for analyzing FTTR gateway data protocols.

[0042] Based on the same inventive concept, the fourth aspect of the present application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements an FTTR gateway data protocol analysis method.

[0043] The beneficial effects of this application are:

[0044] Based on the above technical solution, the following steps are taken: Protocol data and packet mirroring of FTTR master gateway and at least one slave gateway communicating via MQTT protocol are obtained; a custom iptables mirroring module is used to mount listening points based on netfilter kernel hooks, and TEE rules are configured to bypass and non-intrusively copy mirrored packets; a polling thread pool is created to process the protocol data in the mirrored packets in a layered manner and preprocess the protocol data to generate standardized protocol data; the standardized protocol data is parsed in layers to obtain protocol parsing results; anomaly detection and location are performed based on the protocol parsing results and baseline to obtain anomaly detection results; a visualized anomaly alarm is generated based on the anomaly detection results, and corresponding alarms are executed according to the anomaly level, along with data backup and expired data cleanup. Therefore, by using custom iptables packet mirroring and kernel hooks, the MQTT communication and multi-protocol packets of FTTR master and slave gateways can be accurately captured; fine-grained parsing of protocols such as IP / TCP / UDP, DNS, and DHCP is achieved, improving the accuracy of data parsing; real-time anomaly detection, hierarchical alarms, and visualization are supported, comprehensively improving the efficiency and stability of FTTR network operation and maintenance.

[0045] Other features and advantages of this application will be set forth in the following description and will be apparent in part from the description or may be learned by practicing the application. The objectives and other advantages of this application may be realized and obtained by means of the structures pointed out in the description and the accompanying drawings. Attached Figure Description

[0046] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0047] Figure 1 A flowchart of an FTTR gateway data protocol analysis method is shown;

[0048] Figure 2 A schematic diagram of the gateway data protocol analysis process in an embodiment of this application is shown;

[0049] Figure 3 A schematic diagram of an FTTR gateway data protocol analysis device is shown.

[0050] Figure 4 A schematic diagram of an electronic device used for gateway data protocol analysis is shown. Detailed Implementation

[0051] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0052] It should be noted that the terms "first," "second," etc., used in this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate for the embodiments of this application described herein. In this application, the terms "upper," "lower," "left," "right," "front," "rear," "top," "bottom," "inner," "outer," "middle," "vertical," "horizontal," "lateral," "longitudinal," etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings.

[0053] This application provides an embodiment of an FTTR gateway data protocol analysis method. (See also...) Figure 1 ,include:

[0054] S100: Obtain protocol data and message images of communication between the FTTR master gateway and at least one slave gateway via the MQTT protocol;

[0055] S200: By using a custom iptables mirroring module to mount a listening point based on a netfilter kernel hook, TEE rules are configured to bypass and non-intrusive copy mirrored packets.

[0056] S300: Create a polling thread pool to process the protocol data in the image message in a layered manner and preprocess the protocol data to generate standardized protocol data;

[0057] S400: Perform layered parsing on the standardized protocol data to obtain protocol parsing results, and perform anomaly detection and localization based on the protocol parsing results and baseline to obtain anomaly detection results;

[0058] S500: Based on the anomaly detection results, a visual anomaly alarm is generated, and the corresponding alarm is executed according to the anomaly level, and data backup and expired data cleanup are performed.

[0059] The FTTR gateway data protocol analysis method described in the embodiments of this specification is typically applied in servers, which can be cloud servers or local servers. Servers can be electronic devices such as laptops, desktop computers, tablets, and all-in-one computers.

[0060] Specifically, in step S100, obtaining the protocol data and message mirror of the FTTR master gateway and at least one slave gateway communicating via the MQTT protocol includes:

[0061] The original traffic of the FTTR master gateway and at least one slave gateway communicating via the MQTT protocol is copied without modification to form protocol data by blocking the service traffic.

[0062] The message image is obtained based on the protocol data.

[0063] Specifically, see Figure 1 and Figure 2 By using a custom iptables mirroring module, a listening point is mounted based on a netfilter kernel hook, and TEE mirroring rules are configured by port. The master and slave gateway MQTT interaction messages and uplink and downlink service protocol messages are copied and mirrored, and sent to the protocol analysis unit in a bypass manner. The non-intrusive collection architecture is adopted, and the original service traffic is not affected.

[0064] Specifically, in step S300, the creation of a polling thread pool for hierarchical processing of the protocol data in the image message includes:

[0065] Create a polling thread pool to handle protocol events.

[0066] The polling thread pool includes: PON layer, MQTT layer, network layer, transport layer, application layer, access layer, and management layer;

[0067] Protocol data is processed in layers based on the PON layer, MQTT layer, network layer, transport layer, application layer, access layer, and management layer.

[0068] Specifically, see Figure 2 A polling thread pool is created to process protocol interaction events of the PON layer, MQTT layer, network layer, transport layer, application layer, access layer and management layer in parallel, so as to achieve comprehensive, real-time and lossless collection of multi-type protocol data.

[0069] The collected protocol messages include: OMCI protocol, MQTT protocol, DHCPv4 / v6, ARP, IP, TCP, UDP, HTTP, DNS, Wi-Fi Mesh, TR069, and service data protocol messages.

[0070] Specifically, in step S300, the preprocessing of the protocol data to generate standardized protocol data includes:

[0071] The message protocol data is deduplicated, noise-reduced, fragmented and reassembled, and format-standardized to generate standardized protocol data.

[0072] The collected protocol interaction messages are deduplicated, noise-reduced, fragmented and reassembled, and format standardized. The source address, destination address, protocol type, interaction timestamp, message length, and payload information of the messages are extracted to generate standardized protocol data, which is then stored and sent to the protocol parsing unit.

[0073] Specifically, in step S400, the hierarchical parsing of the standardized protocol data to obtain the protocol parsing result includes:

[0074] The protocol parsing module incorporates a built-in FTTR gateway protocol parsing rule base, which is used to perform layered parsing of standardized protocol data.

[0075] Layered parsing is performed on MQTT, DHCP, IP / TCP / UDP, DNS, HTTP, OMCI, TR069, and Mesh protocols in standardized protocol data;

[0076] Obtain the resolution results for MQTT, DHCP, IP / TCP / UDP, DNS, HTTP, OMCI, TR069, and Mesh protocols.

[0077] Specifically, the protocol parsing unit has a built-in FTTR gateway protocol parsing rule base, which performs layered parsing of standardized data based on the rule base, and adds fine-grained parsing of the MQTT layer, transport layer and application layer.

[0078] Specifically, the method also includes: PON layer protocol parsing: parsing the OMCI protocol to extract device registration, configuration distribution, optical power, link status, and fault alarm information;

[0079] MQTT layer protocol parsing: Parses MQTT communication messages between master and slave gateways, extracting device identifiers, topic subscriptions, message publishing, configuration synchronization, status reporting, and heartbeat keep-alive information;

[0080] Network layer protocol parsing: Parses DHCPv4 / v6 and ARP, extracts IP allocation, MAC mapping, IP lease time, IPv6 configuration information, and identifies IP conflicts and MAC migration;

[0081] Transport layer protocol parsing: Parses IP, TCP, and UDP protocols, extracting: protocol information list, IP addresses of communicating parties, total number of TCP connections, number of successful TCP connections, TCP three-way handshake time, uplink retransmission rate, and downlink retransmission rate;

[0082] Application layer protocol resolution: DNS protocol resolution extracts the DNS information list, accessed domain name, domain name corresponding IP list, DNS server IP, DNS request time (UTC milliseconds), and DNS response time (UTC milliseconds); HTTP protocol resolution extracts the request method, URL, status code, request / response time, and session identifier.

[0083] Access layer protocol parsing: Parses the Wi-Fi Mesh protocol, extracting information such as roaming handover, signal strength, connection type, access authentication, and transmission rate;

[0084] Management Protocol Analysis: Parse the TR069 protocol to extract remote management commands, parameter configurations, and status reporting information;

[0085] Business layer protocol parsing: Extracting service rate, latency, and packet loss rate to assess service quality.

[0086] In step S400, the anomaly detection result is obtained by performing anomaly detection and localization based on the protocol parsing result and the baseline. This includes:

[0087] Anomaly detection rules are established based on historical baselines, which are generated by averaging historical protocol parsing results.

[0088] A three-level anomaly determination rule is established based on the historical baseline, and the anomaly determination rule includes severe anomalies, general anomalies, and minor anomalies.

[0089] The source / destination address, link, and anomaly field of the protocol parsing result are used to locate the anomaly location and root cause, and anomaly detection results are generated.

[0090] Specifically, based on the parsing results, anomaly judgment rules, and historical baselines, the system monitors and processes anomalies in real time: anomaly judgment identifies packet loss, format errors, interaction timeouts, IP conflicts, SN conflicts, abnormal optical power, TCP handshake timeouts, excessively high retransmission rates, DNS resolution timeouts, MQTT heartbeat interruptions, and other anomalies; it classifies them into three levels: severe, general, and minor; it locates the anomaly location and root cause by combining source / destination addresses, link information, and anomaly fields, and generates a report; and it compares the anomalies with historical data to analyze anomaly patterns and frequencies, and predict trends.

[0091] Specifically, in step S500, the visualization module displays protocol distribution, interaction rate, link status, anomaly statistics, and location distribution in charts / lists; it supports queries by protocol type, time, device, and anomaly type; it displays TCP connection statistics, DNS resolution sequence, and MQTT communication status; and it supports exporting to Excel / PDF. The alarm module triggers alarms according to the anomaly level: severe anomalies → audible and visual alarms + SMS; general anomalies → pop-up window + in-site message; minor anomalies → only logging. Maintenance personnel mark the status after handling, forming a closed loop. Original packets, standardized data, parsing results, and anomaly records are backed up regularly; expired data is automatically cleaned up, releasing storage space.

[0092] Based on the same inventive concept, a second aspect of the embodiments of this application also provides an FTTR gateway data protocol analysis device, see [link to relevant documentation]. Figure 3 ,include:

[0093] Data acquisition unit 201 is used to acquire protocol data and message images of communication between the FTTR master gateway and at least one slave gateway via the MQTT protocol;

[0094] Packet mirroring unit 202 is used to mount listening points based on netfilter kernel hooks through a custom iptables mirroring module, and configure TEE rules to bypass and non-intrusively copy mirrored packets.

[0095] Data preprocessing unit 203 is used to create a polling thread pool to process the protocol data in the image message in a hierarchical manner and preprocess the protocol data to generate standardized protocol data;

[0096] The protocol parsing unit 204 is used to perform hierarchical parsing on the standardized protocol data to obtain the protocol parsing result, and to perform anomaly detection and location based on the protocol parsing result and the baseline to obtain the anomaly detection result.

[0097] The anomaly alarm unit 205 is used to generate a visual anomaly alarm based on the anomaly detection result, execute the corresponding alarm according to the anomaly level, and perform data backup and expired data cleanup.

[0098] Based on the same inventive concept, a third aspect of this disclosure also provides an electronic device 161, see [link to relevant documentation]. Figure 4 It includes a processor 164, a communication interface 165, a memory 162, and a communication bus, wherein the processor 164, the communication interface 165, and the memory 162 communicate with each other through the communication bus;

[0099] Memory 162 stores computer program 163;

[0100] When processor 164 executes the program stored in memory 162, it implements the aforementioned FTTR gateway data protocol analysis method.

[0101] The aforementioned communication bus can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. This communication bus can be divided into address bus, data bus, control bus, etc.

[0102] The communication interface 165 is used for communication between the aforementioned electronic device 161 and other devices.

[0103] The memory 162 may include random access memory (RAM) or non-volatile memory, such as at least one disk storage device. Optionally, the memory 162 may also be at least one storage device located remotely from the aforementioned processor 164.

[0104] The processor 164 mentioned above can be a general-purpose processor 164, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0105] Based on the same inventive concept, the fourth aspect of this disclosure also provides a computer-readable storage medium storing a computer program 163, which, when executed by a processor 164, implements the aforementioned FTTR gateway data protocol analysis method.

[0106] The computer-readable storage medium may be included in the device / apparatus described in the above embodiments; or it may exist independently and not assembled into the device / apparatus. The computer-readable storage medium carries one or more programs that, when executed, implement an FTTR gateway data protocol analysis method according to the embodiments of this disclosure.

[0107] The above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A method for analyzing FTTR gateway data protocols, characterized in that, include: Obtain the protocol data and message mirroring between the FTTR master gateway and at least one slave gateway via the MQTT protocol; By using a custom iptables mirroring module to mount a listening point based on a netfilter kernel hook, TEE rules are configured to bypass and non-intrusive copy mirroring packets. A polling thread pool is created to process the protocol data in the image packets in a layered manner and preprocess the protocol data to generate standardized protocol data. The standardized protocol data is parsed in layers to obtain the protocol parsing result. Anomaly detection and localization are performed based on the protocol parsing result and the baseline to obtain the anomaly detection result. Based on the anomaly detection results, a visual anomaly alarm is generated, and the corresponding alarm is executed according to the anomaly level, along with data backup and expired data cleanup.

2. The method according to claim 1, characterized in that, The acquisition of protocol data and message mirroring between the FTTR master gateway and at least one slave gateway via the MQTT protocol includes: The original traffic of the FTTR master gateway and at least one slave gateway communicating via the MQTT protocol is copied without modification to form protocol data by blocking the service traffic. The message image is obtained based on the protocol data.

3. The method according to claim 2, characterized in that, The process of creating a polling thread pool for hierarchical processing of protocol data in the image packets includes: Create a polling thread pool to handle protocol events. The polling thread pool includes: PON layer, MQTT layer, network layer, transport layer, application layer, access layer, and management layer; Protocol data is processed in layers based on the PON layer, MQTT layer, network layer, transport layer, application layer, access layer, and management layer.

4. The method according to claim 1 or 3, characterized in that, The preprocessing of the protocol data to generate standardized protocol data includes: The message protocol data is deduplicated, noise-reduced, fragmented and reassembled, and format-standardized to generate standardized protocol data.

5. The method according to claim 1, characterized in that, The step of performing layered parsing on the standardized protocol data to obtain the protocol parsing result includes: The protocol parsing module incorporates a built-in FTTR gateway protocol parsing rule base, which is used to perform layered parsing of standardized protocol data. Layered parsing is performed on MQTT, DHCP, IP / TCP / UDP, DNS, HTTP, OMCI, TR069, and Mesh protocols in standardized protocol data; Obtain the resolution results for MQTT, DHCP, IP / TCP / UDP, DNS, HTTP, OMCI, TR069, and Mesh protocols.

6. The method according to claim 5, characterized in that, The method further includes: PON layer protocol parsing: Parse the OMCI protocol to extract device registration, configuration distribution, optical power, link status, and fault alarm information; MQTT layer protocol parsing: Parses MQTT communication messages between master and slave gateways, extracting device identifiers, topic subscriptions, message publishing, configuration synchronization, status reporting, and heartbeat keep-alive information; Network layer protocol parsing: Parses DHCPv4 / v6 and ARP, extracts IP allocation, MAC mapping, IP lease time, IPv6 configuration information, and identifies IP conflicts and MAC migration; Transport layer protocol parsing: Parses IP, TCP, and UDP protocols, extracting: protocol information list, IP addresses of communicating parties, total number of TCP connections, number of successful TCP connections, TCP three-way handshake time, uplink retransmission rate, and downlink retransmission rate; Application layer protocol resolution: DNS protocol resolution extracts the DNS information list, accessed domain name, domain name corresponding IP list, DNS server IP, DNS request time (UTC milliseconds), and DNS response time (UTC milliseconds); HTTP protocol resolution extracts the request method, URL, status code, request / response time, and session identifier. Access layer protocol parsing: Parses the Wi-Fi Mesh protocol, extracting information such as roaming handover, signal strength, connection type, access authentication, and transmission rate; Management Protocol Analysis: Parse the TR069 protocol to extract remote management commands, parameter configurations, and status reporting information; Business layer protocol parsing: Extracting service rate, latency, and packet loss rate to assess service quality.

7. The method according to claim 1, characterized in that, The anomaly detection result obtained by performing anomaly detection and localization based on protocol parsing results and baseline includes: Anomaly detection rules are established based on historical baselines, which are generated by averaging historical protocol parsing results. A three-level anomaly determination rule is established based on the historical baseline, and the anomaly determination rule includes severe anomalies, general anomalies, and minor anomalies. The source / destination address, link, and anomaly field of the protocol parsing result are used to locate the anomaly location and root cause, and anomaly detection results are generated.

8. An FTTR gateway data protocol analysis device, characterized in that, include: The data acquisition unit is used to acquire protocol data and message images of communication between the FTTR master gateway and at least one slave gateway via the MQTT protocol; The packet mirroring unit is used to mount listening points based on netfilter kernel hooks through a custom iptables mirroring module, and configure TEE rules to bypass and non-intrusively copy mirrored packets. The data preprocessing unit is used to create a polling thread pool to process the protocol data in the image message in a layered manner and to preprocess the protocol data to generate standardized protocol data. The protocol parsing unit is used to perform hierarchical parsing on the standardized protocol data to obtain the protocol parsing result, and to perform anomaly detection and location based on the protocol parsing result and the baseline to obtain the anomaly detection result. An anomaly alarm unit is used to generate a visual anomaly alarm based on the anomaly detection results, execute the corresponding alarm according to the anomaly level, and perform data backup and expired data cleanup.

9. An electronic device, characterized in that, include: The processor, communication interface, memory, and communication bus are connected, with the processor, communication interface, and memory communicating with each other via the communication bus. Memory, which stores computer programs; When the processor executes a program stored in memory, it implements the FTTR gateway data protocol analysis method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The device contains a computer program that, when executed by a processor, implements the FTTR gateway data protocol analysis method according to any one of claims 1 to 7.

Images