217 results about "On-Protocol" patented technology

The invention relates to the technical field of network communication, and discloses a vehicle-mounted edge computing data recording system and method based on protocol adaptive analysis, and the system comprises a multi-protocol network access controller which is used for capturing an original data frame and extracting a physical feature triple; the identification analysis engine is used for executing hash operation on the triple to generate a physical feature code and retrieving a physical logic address mapping table; the direct memory access controller is used for responding to a target memory address pointer hit by retrieval and directly writing a data load into an input buffer area of the functional operation module, and by constructing a direct addressing mechanism based on Hash mapping, thorough decoupling of vehicle-mounted heterogeneous network physical topology and edge computing logic is achieved.

The invention provides a network defense capability verification method and system based on intrusion attack simulation. According to the method, network dynamics and a photoacoustic effect simulation technology are creatively fused, and network abnormal traffic equivalent to real attacks is dynamically excited by constructing a photoacoustic coupling waveform driven by network topology; reversely analyzing the vulnerability characteristics based on the protocol interaction entropy, and generating an attack instruction with a space-time cooperation characteristic; utilizing a phase matching algorithm to precisely couple the attack behavior and the network dynamic disturbance to form a defense response track capable of being quantitatively analyzed; and finally, through an asymmetric correlation model, analyzing a dynamic relationship between trajectory deformation and a node survival state, and realizing objective quantitative evaluation of defense efficiency. According to the technical scheme provided by the embodiment of the invention, high-precision quantitative verification of the virtual-real combined network security defense capability can be realized, and the real-time performance and credibility of defense strategy evaluation are improved.

The invention provides an automatic feedback method based on a protocol fuzz test and related equipment. The method comprises the following steps: acquiring a dynamic configuration file of the protocol fuzz test; performing real-time monitoring on the protocol fuzz test according to the protocol characteristic parameters of the dynamic configuration file, and determining a real-time data stream of the protocol fuzz test; performing multi-level feature analysis on the real-time data stream to judge an abnormal event existing in the protocol fuzz test; generating a feedback instruction corresponding to the abnormal event by performing multi-dimensional correlation analysis based on a knowledge graph on the abnormal event; and sending an exception notification mail to the user terminal according to the feedback instruction. Through an automatic mail notification mechanism, it is ensured that a tester can receive a notification immediately when a test task fails, the workload of manual monitoring is reduced, and the test efficiency is improved.

Techniques relate to generating and / or verifying content based on protocols and / or user input. The techniques can receive protocol data from an entity, including a procedure, guideline, policy, or standard. User input requesting content generation related to specific parameters can also be received. Based on the protocol data, a data request can be generated and sent to a content generation component. Machine-generated content can be received from the content generation component in response. The machine-generated content can be analyzed based on the protocol data. Output content can be generated based on the machine-generated content and provided to a computing device. In examples, this ensures that generated content aligns with entity-specific protocols and / or user-specified parameters, enabling tailored and / or compliant content delivery for various contexts.

The invention relates to the technical field of data processing, and provides a cross-platform equipment management method and system based on a protocol converter, and the method comprises the steps: registering a unique identifier of target equipment in a first cloud platform, and connecting the corresponding target equipment in a second cloud platform; when the first cloud platform needs to obtain the real-time information of the target equipment, sending a unique identifier to the protocol converter for analysis, and finding the corresponding target equipment to obtain the real-time information; when the first cloud platform needs to control the target equipment, a control instruction containing the unique identifier is sent to the protocol converter, and the unique identifier and a control parameter are obtained; and finding a corresponding target device in the second cloud platform based on the unique identifier for control. Through deployment of the protocol converter, real-time information synchronization and instruction control between the first cloud platform and the second cloud platform are realized, protocol conversion and equipment positioning are supported, the management efficiency is improved, and the problems of multi-platform data synchronization and insufficient response are solved.

The invention provides an automatic network protocol testing method and system based on a large language model. According to the method, through three core technologies of structured protocol specification extraction, hybrid test case generation and retrieval feedback enhanced code generation, full-process automation from a protocol specification document to an executable test code is realized. The method comprises the following steps: firstly, carrying out preprocessing and structured analysis on an RFC document, and extracting protocol field information and state machine description; a complete test case covering normal, abnormal and boundary conditions is automatically generated based on protocol elements; and finally, an initial test code is generated in combination with a test equipment API document retrieval result, and multi-round iterative optimization is performed through running log analysis and an experience knowledge base. Compared with the prior art, according to the scheme, an end-to-end automatic test work chain is achieved, new protocol testing can be adapted without manual protocol modeling, meanwhile, a large language model and expert experience are fused through a feedback mechanism, and the test efficiency and the code quality are remarkably improved.

The invention discloses a malicious traffic message interception and retention method based on threat intelligence, and the method comprises the following steps: S1, importing a threat intelligence data set, generating an intelligence label dictionary, and caching the intelligence label dictionary; s2, receiving a network data packet through a traffic mirroring device or an acquisition probe, and aggregating the network data packet into a traffic aggregation object based on a quintuple; s3, modeling and recording a state transition sequence based on a protocol state machine; s4, detecting a state transition sequence by using the information label dictionary, and identifying potential malicious traffic; s5, extracting data messages corresponding to the key nodes to form an extracted message set; s6, grouping according to the information labels and encrypting by using an improved AES symmetric encryption algorithm to generate an encrypted message file; s7, constructing an index data table containing a quintuple, capture time and an information label, and associating the index data table with the encrypted message file; and S8, storing the encrypted message file and the index data table in a separated storage system, and updating the index data table regularly. The method and the device are suitable for a threat-driven encrypted message processing scene.

The invention discloses a self-adaptive threat blocking method and system oriented to industrial control protocol deep analysis, and the method comprises the steps: constructing an industrial control protocol multi-dimensional analysis model, extracting an operation code semantic rule, a parameter structure constraint and session state hopping features based on protocol reverse engineering, generating a protocol syntax tree, and blocking a threat from the protocol syntax tree. Wherein the operation code semantic rule is matched with the service primitive mapping of an abstract communication service interface in the IEC 61850 standard; based on the protocol syntax tree, semantic-level analysis is carried out on real-time communication flow, dynamic indexes are extracted, the dynamic indexes comprise a process value mutation gradient, an instruction sequence logic conflict degree and a session state abnormal jump rate scale, and a three-dimensional threat feature vector is generated. According to the method, hidden attacks are accurately recognized through industrial control protocol semantic analysis and multi-dimensional dynamic blocking, so that the defense action and the production stability can be collaboratively optimized.

The invention relates to the technical field of research and development management, can be applied to business scenes of financial science and technology, medical health and the like, and discloses an anomaly analysis method, device, equipment and medium based on a variation test. Generating a test case through the semantic perception model; selecting a variation strategy by using a state-driven model according to the service state, and generating a variation test case based on the access control strategy; executing the variation test case in a distributed environment, and collecting system resource index data and request execution monitoring data; and inputting the collected data into the abnormal prediction model, and outputting an abnormal behavior prediction result. Through combination of semantic perception generation, state-driven selection and anomaly prediction, coverage of a test case on protocol dependence and a service state is improved, and the accuracy of anomaly detection of the object storage system is remarkably improved.

The invention relates to the technical field of digital information transmission, in particular to a protocol stack fingerprint-based host asset surveying and mapping method, which comprises the following steps of: designing a host discovery algorithm of a combined multi-protocol data packet by referring to an open system interconnection seven-layer network model layering protocol; performing feature analysis and data preprocessing based on a protocol stack fingerprint rule base of a network mapper transmission control protocol, and constructing a protocol stack fingerprint data set of a host asset operating system; the host asset operating system fingerprint identification classification model is constructed based on the random forest algorithm, the coverage rate of survival host discovery is remarkably improved, and the limitation of a traditional rule-based matching method is effectively overcome. According to the method, the accuracy rate in the fingerprint identification task of the coarse-grained operating system reaches 97%, the weighted F1 value in the fingerprint identification task of the fine-grained operating system reaches 0.87, the technical level of host asset surveying and mapping is improved, and a more comprehensive and accurate technical path is provided for network asset security assessment.

The invention provides a power network unknown attack automatic discovery method based on protocol deep analysis. The method comprises the following steps: step 1, establishing comprehensive monitoring index items from three levels of asset state, network flow and protocol instruction; 2, researching an automatic learning construction technology of a normal behavior reference model, establishing the normal reference model based on a plurality of RBM neural networks, researching normal behavior baselines such as a power business operation behavior reference, a same-type equipment reference and a specific communication line reference, and constructing a safety baseline index of the normal behavior model of the power network; an abnormal behavior discovery technology based on a normal reference model is researched on the basis; and step 3, carrying out verification of an abnormal behavior automatic discovery technology, and verifying the abnormal behavior automatic discovery technology by adopting the data based on the simulated network flow and the power network use and collection service. By applying the technical scheme, the unknown attack of the power network can be well and automatically discovered.

The disclosure provides a security analysis method and system based on protocol state, which relates to the technical field of protocol security protection. The method includes the following: a node traversal table is built, the node traversal table is scanned and analyzed according to the protocol trigger sequence rule, a first security evaluation factor of a protocol stack is determined, and a second security evaluation factor of each protocol is determined based on protocol normal application rule, and the trustworthiness degree of the second security factor is determined based on the first security factor, and the second security factor is revised based on the trustworthiness degree, and the security state of the protocol is determined according to the revised second security factor, thus the analysis of the protocol state is realized, and the security of the protocol can be accurately determined.

The invention discloses a network protocol integrated development environment system based on a model context protocol MCP, and relates to the technical field of computer networks. The system comprises an IDE plug-in structure, a protocol analysis engine interface, a context awareness editing module, a user interaction interface and a collaborative view module. According to the method, a development tool is embedded through an IDE plug-in structure, a protocol analysis interface is called to carry out protocol structure identification and semantic modeling, and intelligent suggestions and semantic verification are provided in combination with context information in the protocol editing process. A user can carry out protocol structure editing and visual control through the interactive interface, and different roles can collaboratively carry out protocol design and verification tasks through the collaboration view module. The whole process forms a closed-loop mechanism from protocol modeling and semantic editing to context awareness suggestion, and high-intelligence and high-integration protocol development experience is achieved. The system significantly improves the efficiency and accuracy of protocol development, and is especially suitable for rapid prototype design and standardized development of complex network protocols.

The invention discloses a communication method based on a protocol data unit set and a related device, and the method comprises the steps that access network equipment receives first information, and the first information is used for enabling the access network equipment to determine a retransmission mechanism of one or more PDU SETs; and the access network equipment closes retransmission of a part of or all data packets of the first PDU SET according to the first information, wherein the first PDU SET belongs to one or more PDU SETs. An access network device determines a retransmission mechanism of a data packet of a PDU SET according to an external instruction, and by closing retransmission of a part of the first PDU SET or the data packet, time delay can be reduced, occupation of network resources can be reduced, and data throughput can be improved.

A heterogeneous industrial equipment-oriented adaptive data fusion and decision optimization system relates to the technical field of industrial automation and information, and comprises a cloud, and the cloud is in communication connection with a data acquisition module, a protocol labeling module, a protocol self-consistent module, a detection decision module, a fast response compensation module and a critical trend detection module; the data acquisition module is used for acquiring multi-source type data of each heterogeneous industrial device, and the protocol labeling module is used for constructing an industrial connection topological graph and performing initial communication protocol labeling on the industrial connection topological graph; the protocol self-consistent module is used for carrying out interactive feature analysis on each node in the industrial connection topological graph and carrying out automatic protocol matching on protocol abnormal nodes; the detection decision module detects the multi-source type data of each node in real time, and selects the rapid response compensation module to execute the rapid response compensation operation or the critical trend detection module to execute the critical trend detection operation according to a monitoring result, so that the production efficiency is remarkably improved, and the product quality is ensured.

The invention relates to the technical field of file one-way import, and discloses a multi-protocol file one-way import method, which comprises the following steps: S1, protocol dynamic analysis: based on protocol fingerprint features and a machine learning model, identifying a protocol type of a source end input data stream, and generating a protocol adaptation rule; s2, intelligent fragmentation of the file: dynamically calculating a fragmentation strategy according to a protocol type and a network state, splitting the file into a plurality of fragments and distributing the fragments to different protocol transmission channels; s3, multi-protocol parallel transmission is carried out; s4, performing adaptive fault-tolerant recovery; and S5, recombining and checking the target end. According to the invention, through the protocol fingerprint feature extraction and the hybrid neural network model, and through capturing the message header flag bit, the encryption algorithm identifier and the time sequence interaction behavior in the protocol handshake stage, accurate identification of multiple protocol types and reverse analysis of the private protocol are realized, and the anti-interference capability and the dynamic adaptation efficiency of protocol identification are improved.

The invention discloses a white list application method based on a terminal security management system, which belongs to the technical field of terminal management, and comprises the following steps: acquiring memory instruction characteristics when an application program runs in a terminal, dynamically associating the memory instruction characteristics with a security handshake protocol certificate fingerprint, and generating a white list strategy library with a protocol verification rule; capturing an attack behavior by using an attack protection module, extracting DNS tunnel characteristics of the attack behavior in communication, generating a self-adaptive interception strategy, and synchronizing the self-adaptive interception strategy to a white list strategy library; analyzing a domain name analysis request initiated by the process, and executing white list matching and protocol compliance verification; network connection behaviors of processes in the terminal are monitored, an encrypted communication behavior graph is constructed, and an attack diffusion link formed by cross-process key transmission is identified; and when an attack diffusion link is identified, DNS tunnel encryption binding is triggered based on a protocol verification rule of a white list policy library, and a transmission behavior of an unauthorized encryption protocol is blocked.

The invention discloses a virtual electric energy meter implementation method supporting multiple protocols, and belongs to the technical field of power equipment testing. The method comprises the following steps: (1) a protocol plug-in engine packages protocols such as DL / T645, DL / T698, ModBus and the like into source code level plug-ins capable of being hot-plugged; 2) the virtual table manager dynamically creates / destroys a virtual table instance according to a collection command, and supports automatic table number generation and resource recovery; the intelligent configuration unit (3) is specially used for configuring abnormal response modes including negative acknowledgement, null data and communication timeout to realize dynamic fault simulation; according to the scheme, the problems that real faults are difficult to simulate, protocol switching efficiency is low, virtual table configuration is rigid and the like in a traditional test are solved, the protocol compatibility test coverage rate and automatic test efficiency of the electric power acquisition terminal can be remarkably improved, and the method is particularly suitable for full-scene verification of equipment such as an intelligent electric meter and a concentrator.

The invention relates to an industrial control system anomaly detection method based on protocol field vector similarity, and the method comprises the following specific steps: continuously collecting protocol messages in an industrial control system, and carrying out the protocol analysis of the protocol messages; and training a triplet network prepared in advance by using the training data set to obtain a trained industrial control system anomaly detection model. Protocol messages in the industrial control system are collected in real time, and protocol analysis is carried out on the protocol messages. According to the triplet model training and industrial control anomaly detection method, the collected industrial control protocol data is processed to obtain the stacking vectors, and when the stacking vectors are sorted according to the time sequence, the correlation of the three continuous stacking vectors can just meet the optimization target rule of a triple loss function in a triplet network, so that the triplet model training and industrial control anomaly detection method is designed. The problem that an existing industrial control system anomaly detection method based on unsupervised learning is not high in detection precision is solved, and the industrial control system anomaly detection method based on protocol field vector similarity is provided.

The invention provides an automatic vulnerability analysis method based on a protocol specification state machine, and relates to the technical field of the Internet, and the method comprises the steps: carrying out the mapping of an input symbol sequence according to a mapping relation to generate first mapping data, inputting the first mapping data into a target system for processing, and obtaining a first output symbol sequence, determining a first finite-state machine model, mapping the input symbol sequence according to the protocol specification to generate second mapping data, and determining a second finite-state machine model directory; and generating a first state diagram and a second state diagram, comparing the first state diagram with the second state diagram to determine a target path, and analyzing the target path to determine the vulnerability. The target system and the protocol specification are analyzed to generate the state diagrams, and the state diagrams are compared, so that detection and comparison of the system vulnerabilities are realized, the probability of system security problems caused by the system vulnerabilities is reduced, and the system vulnerability detection efficiency and the system security are improved.

The embodiment of the invention provides an intelligent equipment integrated control method and system based on cloud-side cooperation, and relates to the field of equipment control. The method is applied to intelligent integrated equipment integrating at least one sub-control system of short-range communication, voice control and IOT control, and is associated with a client. The method comprises the following steps: receiving a first control instruction which is sent by an IoT PaaS platform and comprises a voice instruction or a physical instruction sent by a client; the voice instruction comprises an instruction determined by the voice cloud platform based on first voice data, and the first voice data comprises data sent by the intelligent integrated device or the client and obtained according to second voice data input by a user; determining a target device, protocol information thereof and a second control instruction according to the first control instruction; and sending a second control instruction to the target device through the sub-control system or the IoT SaaS platform based on the protocol information, so that the target device executes the second control instruction. The equipment control efficiency can be improved.

The present invention belongs to the technical field of seismic big data, and relates to a big data access method based on protocol adaption and scheduling in the seismological industry. The method comprises the following steps: performing protocol adaption; automatically pulling up client strategy scheduling; performing control by means of a client plug-in; receiving seismic data; pushing the seismic data; and performing failure recovery and smooth upgrade. Compared with the prior art in which whether there is a need to add resources can only be artificially determined without standards and strategies, the present invention involves classifying access tasks of different data types into different priorities on the basis of availability requirements of different seismic data access and availability information of each resource, and configuring a load threshold value to be 0.7 as a scheduling triggering condition on the basis of the total number of instrument terminals that need to be connected and the number of instrument terminals that are actually supported by a single client in a cloud platform, and by means of monitoring and testing and the resource consumption conditions of different protocol data, such that whether there is a need to add resources can be automatically determined.

The invention discloses an attack detection method and system for gateway equipment. According to the heterogeneous cooperative defense system based on protocol context awareness provided by the invention, a'kernel mode instruction recombination-user mode adversarial learning 'double-engine architecture is innovatively constructed, and low-delay extraction of attack features and active evolution of a protection strategy are realized. Specifically, the invention provides a migration type adversarial evaluation model, which breaks through the dependence of a traditional detection scheme on protocol grammar, dynamically constructs a cross-protocol attack sample through a generative adversarial network, captures traffic time sequence anomaly in combination with a bidirectional LSTM, and constructs a dynamic graph containing threat propagation probability and resource occupation trend. Therefore, feature migration and generalization modeling can be carried out on unknown or variant attack behaviors, the recognition capability on zero-day attacks and cross-protocol attacks is enhanced, and finally the detection accuracy is improved.

The invention discloses a measuring point data collecting and processing method, device and system and a storage medium, and the method comprises the steps: obtaining a protocol configuration field and a measuring point configuration field based on a protocol template configuration operation for a target communication protocol; the protocol configuration field is used for indicating a communication parameter of a target communication protocol, and the measuring point configuration field is used for indicating a measuring point data acquisition processing parameter; generating a protocol template of the target communication protocol based on the protocol configuration field and the measuring point configuration field; obtaining a target protocol configuration file obtained based on the protocol template of the target communication protocol; the target protocol configuration file comprises field configuration content corresponding to a protocol configuration field and field configuration content corresponding to a measurement point configuration field; and performing measurement point data acquisition based on the target protocol configuration file, and performing data analysis processing on the acquired target measurement point data. According to the invention, the data generated by the ship measuring point equipment of different communication protocols can be efficiently and flexibly acquired.

The invention discloses a WAF defense capability test method and device based on protocol analysis difference, and relates to the technical field of network security. According to the method, a protocol variation verification test case is constructed to generate a variation test message containing a non-standard protocol feature and a verification load, and the variation test message is sent to a back end through a test link and a reference link; and accurately judging that the WAF is in a state of successful interception, bypassing or repairing to cause bypassing by comparing the response fingerprint with an expected result. According to the invention, comprehensive and automatic assessment of the defense capability of the WAF protocol layer can be realized.

The invention provides a water purifier Internet of Things gateway cooperative control system and method based on protocol dynamic analysis and adaptation, belongs to the field of intelligent control of water purifiers, and solves the problems of low intelligent degree, poor collaboration and the like of an existing water purifier Internet of Things system. Comprising a physical interface layer, a protocol dynamic analysis and adaptation layer, a unified data model layer, an intelligent cooperative control engine layer, a trusted data interaction layer and a management configuration layer. The cooperative control system adopts a containerized architecture; the physical interface layer is connected to the water purifier mainboard, the back-end cloud platform and an external system; the unified data model layer constructs a water purifier digital model covering static, dynamic, prediction and interaction dimensions. According to the invention, a water purifier cluster housekeeper integrating protocol, AI decision, federal learning and block chain security is constructed, high flexibility, expandability and reliability are realized through a containerized micro-service architecture, and efficient, energy-saving and intelligent cooperative control of a large-scale and multi-brand water purifier network is achieved.

This invention relates to the field of communication management technology, specifically to a remote communication management method and system for inspection equipment based on protocol identification. The method includes the following steps: based on a zoned operation scenario, the structure of the communication data frames of the inspection equipment is analyzed sequentially; field parameters are located and parsed; parameter sets and structure templates are compared; related field combinations are filtered and their overlap is determined; structural differences in consecutive data frames are analyzed; structural misalignment changes are identified; and a sequence offset indicator is obtained. This invention, by combining data frame structure analysis and dynamic feature comparison mechanisms during communication interaction, achieves real-time determination of field arrangement and verification relationships. It adaptively adjusts the parsing and control process according to the data content, possessing the ability to continuously perceive changes in communication structure. This avoids parsing obstacles caused by protocol evolution, reduces manual intervention, and improves the communication consistency, command recognition accuracy, and data interaction continuity of inspection equipment in multi-version mixed access environments.

Disclosed is a session management method based on protocol data unit (PDU) session anchor (PSA) relocation, and a device performing the session management method. The session management method may include determining to perform PSA relocation, establishing a new PSA device through the PSA relocation, and releasing an existing PSA device, in which the PSA relocation may allow traffic moving towards the existing PSA device to move to the new PSA device.

The invention discloses an industrial control private protocol vulnerability mining method based on protocol analysis. The method comprises the steps of 1, preprocessing industrial control protocol flow data; and 2, analyzing the target protocol by using the byte change characteristics and the heuristic rule. And 3, generating a test case of the target protocol by using the analysis specification. And 4, reconstructing a protocol state machine by using the state conversion track of the flow, and guiding the protocol to reach a target state for testing. And 5, tracking the state of the detected target and monitoring and positioning the triggered vulnerability through a network. According to the method, the analysis accuracy of the private protocol specification can be effectively improved, the test case acceptance rate, the test target anomaly rate and the state coverage rate in the fuzzy test process are remarkably improved, and meanwhile, more protocol states can be efficiently tested under the condition of the same number of test cases so as to mine more potential vulnerabilities in the protocol.

The invention belongs to the field of computer system compatibility and peripheral interfaces, and relates to a domestic desktop terminal peripheral compatibility method and system based on protocol reverse mapping and a computer readable storage medium. According to the method, after peripheral access, three-layer analysis of physical layer signal reversal, data link layer structure reversal and application layer semantic reversal is carried out in sequence, and an equipment interface type, a frame structure and instruction semantics are dynamically identified. And based on the reverse result, dividing the equipment into a standard protocol or a private protocol through a protocol type decision, respectively routing the protocol to a drive straight-through module or an instruction translation executor for processing, and finally providing compatible services for a domestic service system through a unified virtual equipment interface. According to the method, the adaptation problem of a document-free private protocol is solved, plug and play of a Wintel peripheral by a non-x86 architecture domestic terminal is achieved, the protocol compatibility coverage rate is remarkably increased, meanwhile, the CPU occupancy rate is reduced, and the harsh requirement for millisecond response of specific industries such as electric power is met.