Protocol state mechanism construction method based on large language model

Abstract

The application provides a protocol state mechanism construction method based on a large language model. The large language model extracts message information contained in a single function stage in a protocol from a protocol specification document, and behavior information of related devices and messages when the messages are interacted between devices, to construct stage behavior specifications corresponding to the function stage. The large language model constructs a function state machine based on the stage behavior specifications, with device states as nodes, message information and message behavior information as trigger conditions, and device behavior information as node migration conditions. The large language model fuses corresponding function state machines based on the relationship between each function stage extracted from the protocol specification document to construct a protocol state machine. The application can significantly reduce the workload when constructing and updating the state machine, while reducing the state omission and transfer rule error, and improving the construction efficiency, accuracy and expansion flexibility of the state machine.

Description

Technical Field

[0001] This invention relates to the field of protocol state machine construction technology, and specifically to a method for constructing a protocol state machine based on a large language model. Background Technology

[0002] As a crucial link in the energy transmission and distribution of smart grids, the safe and stable operation of power distribution systems directly impacts social production, daily life, and energy supply security. The core communication protocol of power distribution systems, IEC 60870-5-104 (hereinafter referred to as the IEC104 protocol), serves as the standard protocol for remote communication in power grids, undertaking critical tasks such as dispatch command transmission and equipment status monitoring. However, with the increasing scale of interconnected terminal devices and the continuous expansion of the network attack surface, the IEC104 protocol is vulnerable to targeted attacks such as denial-of-service attacks, message forgery, and data tampering, posing a serious threat to power grid security. Intrusion detection technology, capable of real-time monitoring of network and system behavior and timely identification of security threats, is an important means of ensuring power grid security. Current intrusion detection methods rely on manually set rules and feature libraries (CN114553580A, CN113221107A) to some extent. While these methods can quickly respond to known attacks, they struggle to identify unknown attacks, mutated attacks, and protocol logic anomalies. Some intrusion detection methods employ machine learning-based training techniques (CN115865486A, CN113901448A, CN120498808A), which can identify unknown attacks and abnormal behaviors to some extent. However, when training resources are limited, training samples are insufficient, or protocol states are complex, their detection performance remains unsatisfactory, making it difficult to adequately address abnormal states and unknown attacks in complex power grid communication scenarios.

[0003] To overcome this limitation, state machine-based anomaly detection methods have gradually gained attention. This method models the normal states and state transition logic of a system or protocol, using state validity to determine whether behavior is abnormal, effectively identifying unknown anomalies. In IEC 104 protocol applications, the state machine method shows significant advantages. However, the diversity of protocol states and the complexity of logic make it significantly difficult to construct state machines using traditional methods, mainly in the following aspects: 1. Manually compiling protocol states and state transition rules is time-consuming and laborious; 2. Human error may lead to state omissions or incorrect transition rules, affecting detection accuracy; 3. It is difficult to cope with changes in protocol updates, business expansion, and unknown abnormal behaviors. Summary of the Invention

[0004] In view of this, the problem to be solved by the present invention is to provide a protocol state machine construction method based on a large language model, which can significantly reduce the workload of building and updating the state machine, while reducing the occurrence of state omissions and transition rule errors, and improving the construction efficiency, accuracy and scalability of the state machine.

[0005] To solve the above-mentioned technical problems, the technical solution adopted by the present invention is as follows: A protocol state machine construction method based on a large language model includes a construction phase behavior specification. The large language model extracts message information contained in a single functional phase within the protocol from the protocol specification document, as well as the behavior information of related devices and messages when messages interact between devices, to form the phase behavior specification corresponding to the functional phase. Generate a functional state machine. The large language model constructs a functional state machine based on the stage behavior specification, with device state as the node, message information and message behavior information as the trigger conditions of the node, and device behavior information as the node transition conditions. Generate the protocol state machine. The large language model is based on the relationship between the functional stages extracted from the protocol specification document and integrates the corresponding functional state machines to form the protocol state machine.

[0006] Furthermore, the functional phases include a connection establishment phase, a general call phase, a time synchronization phase, an RTU telemetry / telecommunications change phase, and a remote control preset and execution phase.

[0007] Furthermore, the behavioral specifications for the construction phase include a specification document based on the functional phase segmentation protocol.

[0008] Furthermore, the message information includes message format type identifier information, message triggering reason identifier information, and addressing identifier information.

[0009] Furthermore, the behavioral specifications for the construction phase include verifying the consistency of message information for the same message within different functional phases.

[0010] Furthermore, the behavioral information includes message behavioral information and device behavioral information. The message behavioral information includes message type information, message format information, and message transmission direction information. The device behavioral information includes the device state definition of the message sending and receiving device, the rules for state transitions, and the rules for handling abnormal interactive messages received.

[0011] Furthermore, the construction of phase behavior specifications includes: extracting behavioral information of the same functional phase multiple times from the large language model, and defining the behavioral information that is the most frequently repeated as the phase behavior specification.

[0012] The beneficial effects of this invention are: The protocol's individual functional phases are transformed into protocol state machines based on message-triggered device state transitions and state transition logic between device states. This facilitates the large language model's ability to extract type identification and behavioral information from the corresponding specification documents of each functional phase, thereby constructing the functional state machine for that phase. Furthermore, leveraging the large language model's text information extraction capabilities, the dependency or mutual exclusion relationships between functional phases are obtained from the protocol specification documents, and the functional state machines corresponding to different phases are merged to form the protocol state machine. When the protocol is updated or expanded, the protocol state machine can be quickly updated to enable continuous monitoring and rapid response in complex power grid communication environments, improving the application flexibility of intrusion detection.

[0013] Setting up a large language model to extract initial stage behavior specifications multiple times and verifying the consistency of type identification information for the same message corresponding to different functional stages can improve the accuracy of type identification information and behavior information extraction by the large language model. Attached Figure Description

[0014] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings: Figure 1 This is an overall flowchart of a protocol state machine construction method based on a large language model according to the present invention; Figure 2 This is a flowchart illustrating the behavioral specifications of the construction phase in a protocol state machine construction method based on a large language model according to the present invention. Figure 3 This is a flowchart illustrating the process of generating a protocol state machine in a protocol state machine construction method based on a large language model according to the present invention. Detailed Implementation

[0015] The technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0016] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains. The terminology used herein in the specification of this invention is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. The term "and / or" as used herein includes any and all combinations of one or more of the associated listed terms.

[0017] This invention provides a method for constructing a protocol state machine based on a large language model, such as... Figures 1 to 3 As shown, this includes the behavior specifications for the construction phase. The large language model extracts message information contained in a single functional phase within the protocol from the protocol specification document, as well as the behavior information of related devices and messages when messages interact between devices, to form the phase behavior specifications corresponding to the functional phase.

[0018] The IEC 104 protocol includes functional phases such as the connection establishment phase, general call phase, time synchronization phase, RTU telemetry / telecommunications change phase, and remote control preset and execution phase. The connection establishment phase includes two phases: the TCP three-way handshake and the application layer STARTDT interaction. The general call phase includes the complete data request process initiated by the master station to the slave station to obtain all current statuses and measurements of the slave station. The time synchronization phase includes the process of the master station sending a standard time command to the slave station, which synchronizes its local clock accordingly and returns an acknowledgment. The RTU telemetry / telecommunications change phase includes the proactive reporting process when abnormal data changes occur. In the remote control preset and execution phase, remote control preset involves the master station sending a command to the slave station to select a controlled object, and the slave station confirming the selection. Remote control execution involves the master station sending an execution command, and the slave station executing the operation and confirming the result.

[0019] Using the aforementioned functional stages as the segmentation criteria, the originally continuous and lengthy protocol specification document is divided into multiple independent text fields that contain only text descriptions related to the corresponding functional stages. This ensures that the content of each text field is semantically complete and logically clear, making it easy for the large language model to accurately extract relevant information about the functional stage from the text fields. Only a small text field needs to be identified to accurately extract information related to the functional stage, effectively isolating the interference of information from other functional stages on the extraction results.

[0020] The message information includes message format type identifiers, message triggering reason identifiers, and addressing identifiers. Specifically, message type identifiers include identifiers for telemetry, remote signaling, remote control, and point setting; message triggering reason identifiers include identifiers for periodic transmission, sudden reporting, and activation confirmation; and addressing identifiers include identifiers for querying public addresses and querying information body addresses.

[0021] Specifically, each type of identification information includes the identifier's name, numerical range, and semantic description of its application scenario in different functional stages. One embodiment of this application is as follows: the type identifier is named "Remote Control Selection Command," with a numerical range of "0x2E," and a semantic description of "applied to the remote control preset and execution stage, direction from master station to substation." The message triggering reason identifier is named "Activation," with a numerical range of "6," and a semantic description of "activation command applied to stages such as general call, remote control, and time synchronization."

[0022] To improve the accuracy and format consistency of the large language model's extraction of identifier information, structured template prompts are set based on the identifier's name, numerical range, and semantic description, with original text placeholders embedded within these prompts. By embedding these placeholders, the embedding position of the extracted fields is explicitly specified, ensuring that identifier information is output in a uniform format. Furthermore, setting the large model's temperature parameter to zero and adding few-sample examples can reduce randomness and illusions during data extraction from the large language model, ensuring the reliability and format consistency of the output information.

[0023] The master and slave stations typically need to exchange multiple messages and perform multiple state transitions to complete a functional phase. However, the message definitions for implementing the same function are identical across different functional phases. For example, the activation confirmation message contains the same identification information. After extracting the message information contained in different functional phases using a large language model, verifying the consistency of message information for the same message across different functional phases can improve the accuracy of message information extraction.

[0024] Behavioral information includes message transmission direction information, device state definitions of the sending device, state transition rules, and handling rules for receiving abnormal interactive messages. Examples of message transmission direction information include two directions: from the master station to the slave station, and from the slave station back to the master station. Device state is defined as the state of the device before, during, and after sending / receiving messages, such as idle state, select-wait state, and execution state. State transition rules are the conditions and actions for switching device states, such as trigger conditions, response actions, and target states. Handling rules for receiving abnormal interactive messages include methods for generating error codes and sending them back when timeout or illegal messages are received.

[0025] To improve the accuracy of behavioral information, a large language model is set up to extract behavioral information from the same functional stage multiple times. The corresponding behavioral information in multiple sets of behavioral information is compared to see if they are the same. The behavioral information with the most occurrences of the same behavior is defined as the stage behavioral norm.

[0026] Generate a functional state machine. The large language model constructs a functional state machine based on the stage behavior specification, with device state as the node, message information and message behavior information as the node trigger conditions, and device behavior information as the node transition conditions.

[0027] Specifically, the behavioral specifications corresponding to each functional stage are stored in the knowledge base. The large language model accesses the behavioral specifications in the knowledge base to determine all the states contained in each device within the functional stage, and generates the corresponding state nodes. Then, the triggering conditions of the state nodes and the transition conditions between state nodes are coupled to form the functional state machine of that functional stage, and output it in a structured manner.

[0028] For example, when a message with a specified type, structure, and transmission direction is received, the corresponding state node is triggered, and the device switches to the next state node based on the device behavior information corresponding to that state node, thus completing the state transition.

[0029] Generate the protocol state machine. The large language model is based on the relationship between the functional stages extracted from the protocol specification document and integrates the corresponding functional state machines to form the protocol state machine.

[0030] Specifically, the dependency and mutual exclusion information between functional stages can be automatically extracted from the protocol specification document using a large language model. Based on this information, the large language model constructs a hierarchical protocol state machine structure. Using the functional state machines generated by the large language model as input, the model is guided to automatically integrate into a unified protocol state machine. By providing the large model with semantic descriptions of dependencies and mutual exclusion conditions between functional stages (e.g., remote control must be initiated after connection establishment), the model's hierarchical state machine structure is designed. The model automatically defines state nesting relationships, ensuring that the generated global state machine can completely and accurately reflect the entire session state of the IEC 104 protocol from connection establishment to data interaction.

[0031] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any way. Any simple modifications, equivalent changes, and alterations made to the above embodiments based on the technical essence of the present invention shall still fall within the scope of the technical solution of the present invention.

Claims

1. A method for constructing a protocol state machine based on a large language model, characterized in that, include, To construct the phase behavior specifications, the large language model extracts message information contained in a single functional phase within the protocol from the protocol specification document, as well as the behavior information of related devices and messages when messages interact between devices, to form the phase behavior specifications corresponding to the functional phase. Generate a functional state machine. The large language model constructs a functional state machine based on the stage behavior specification, with device state as the node, message information and message behavior information as the trigger conditions of the node, and device behavior information as the node transition conditions. Generate the protocol state machine. The large language model is based on the relationship between the functional stages extracted from the protocol specification document and integrates the corresponding functional state machines to form the protocol state machine.

2. The method for constructing a protocol state machine based on a large language model according to claim 1, characterized in that, The functional phases include the connection establishment phase, the general call phase, the time synchronization phase, the RTU telemetry / telecommunications mutation phase, and the remote control preset and execution phase.

3. The method for constructing a protocol state machine based on a large language model according to claim 1, characterized in that, The behavioral guidelines for the construction phase include a specification document based on the functional phase segmentation protocol.

4. The method for constructing a protocol state machine based on a large language model according to claim 1, characterized in that, The message information includes message format type identifier information, message trigger reason identifier information, and addressing identifier information.

5. The method for constructing a protocol state machine based on a large language model according to claim 4, characterized in that, The behavioral guidelines for the construction phase include verifying the consistency of message information for the same message across different functional phases.

6. The method for constructing a protocol state machine based on a large language model according to claim 1, characterized in that, The behavioral information includes message behavioral information and device behavioral information. The message behavioral information includes message type information, message format information, and message transmission direction information. The device behavioral information includes the device state definition of the message sending and receiving device, the rules for state transitions, and the rules for handling abnormal interactive messages received.

7. The method for constructing a protocol state machine based on a large language model according to claim 1, characterized in that, The behavioral specifications for the construction phase include: extracting behavioral information of the same functional phase multiple times from the large language model, and defining the behavioral information that is most frequently extracted as the phase behavioral specifications.

Images