68 results about "Protocol Status" patented technology

Failure of an active CU-UP can be managed and mitigated. In connection with an active CU-UP serving a device using a service, CU-CP can employ a node manager component (NMC) that, in connection with failure of active CU-UP, can synchronize operational state parameters, including user plane protocol state parameters, associated with active CU-UP with standby CU-UP, and transition from active CU-UP to standby CU-UP to become an active CU-UP that can serve the device, to maintain service continuity for the device. NMC can inform RAN SMO to reconfigure transport network to switch downlink data and uplink data to standby CU-UP. Standby CU-UP can buffer downlink data and uplink data in buffer memory until the synchronization is completed, after which the formerly standby, now active, CU-UP can communicate buffered downlink data to DU for communication to the device, and buffered uplink data to UPF for communication to a desired destination.

The invention relates to a multi-Agent-based hierarchical progressive RFC state machine model extraction method, belongs to the technical field of network protocol extraction, and solves the problems that RFC document information is difficult to refine when a state machine model is extracted at present, the large model used for extraction is easily influenced by illusion due to the limitation of the large model, and the accuracy and recall rate are difficult to guarantee. Comprising the steps of obtaining an RFC document of a to-be-extracted state machine model and performing structured processing to obtain each RFC document block taking a title as a demarcation point; based on a preset protocol state machine term, recalling a core document block, a supplementary document block and a long tail document block from each RFC document block; extracting an initial state machine model from the core document block, performing review, and optimizing the initial state machine model based on a review result to obtain a reviewed state machine model; and on the basis of the supplementary document block and the long tail document block, performing supplementary optimization on the reviewed state machine model to obtain an RFC state machine model.

The invention relates to the technical field of network security detection, and discloses a network transmission protocol intrusion detection method and system. The method comprises the following steps: acquiring a network transmission protocol data stream, extracting head features and load features of a data packet, and integrating to form an original feature set; the original feature set is classified according to protocol types, different protocol clusters are divided, and corresponding identifiers are marked; constructing a dynamic feature filter based on the protocol cluster identifier, and screening a feature subset associated with the current protocol cluster from the original feature set; inputting the feature subset into a protocol state analysis model, and outputting a protocol state vector and abnormal behavior probability distribution by the model; and generating an intrusion detection result according to the two, and triggering a corresponding defense response instruction. According to the method, different protocol characteristics are adapted through protocol cluster classification and dynamic characteristic screening, accurate identification of protocol intrusion behaviors is realized, and the method can be applied to various scenes depending on a network transmission protocol.

The invention provides a self-adaptive feature fusion intrusion detection method and system for an electric power industrial control network, and the method comprises the steps: enabling the generation of a sample to strictly follow the sequential logic of an industrial control protocol through introducing a protocol state perception dynamic sampling mechanism; multi-modal causal feature extraction is adopted, protocol semantics, equipment fingerprints and causal association features are fused, and the feature discrimination ability is effectively improved; designing a federated residual error enhancement fusion model, and realizing safety cooperative training and heterogeneous data adaptation between distributed nodes; and in combination with deep reinforcement learning and transfer learning, constructing a detection parameter dynamic tuning mechanism. According to the method, various attacks such as DoS attacks, protocol forgery and unauthorized access can be accurately identified, the real-time performance of services is guaranteed, meanwhile, the detection precision is remarkably improved, the false alarm rate is reduced, and the method has high environmental adaptability and can be widely applied to electric power industrial control scenes such as transformer substations and dispatching centers.

The invention belongs to the technical field of artificial intelligence, and particularly relates to a computer network intrusion detection method and system based on artificial intelligence, and the method comprises the steps: constructing a finite state automaton to carry out the state jump compliance verification of a connection flow, intercepting the illegal flow, only sending the compliance flow into a feature engineering module, and extracting the multi-dimensional behavior features; inputting a deep neural network classification model to determine whether the behavior is an intrusion behavior; according to the technical scheme provided by the invention, the data input to the artificial intelligence model can be ensured to have complete compliance on the protocol level, so that the model is prevented from learning false feature association caused by protocol violation, and the antagonistic attack based on protocol state jump can be effectively resisted on the premise of not depending on adversarial training.

The invention discloses an industrial control private protocol vulnerability mining method based on protocol analysis. The method comprises the steps of 1, preprocessing industrial control protocol flow data; and 2, analyzing the target protocol by using the byte change characteristics and the heuristic rule. And 3, generating a test case of the target protocol by using the analysis specification. And 4, reconstructing a protocol state machine by using the state conversion track of the flow, and guiding the protocol to reach a target state for testing. And 5, tracking the state of the detected target and monitoring and positioning the triggered vulnerability through a network. According to the method, the analysis accuracy of the private protocol specification can be effectively improved, the test case acceptance rate, the test target anomaly rate and the state coverage rate in the fuzzy test process are remarkably improved, and meanwhile, more protocol states can be efficiently tested under the condition of the same number of test cases so as to mine more potential vulnerabilities in the protocol.

This invention discloses a highly interactive SIP honeypot system based on phased interactive control, comprising: a message receiving module for receiving external SIP requests; a SIP interactive control module supporting multiple interaction modes and generating corresponding responses according to the current configuration mode; a session state machine module for maintaining the SIP session protocol state; a phase switching control module for maintaining phase state variables and dynamically selecting the interaction mode according to preset trigger conditions; and a recording and statistics module for recording request behavior characteristics, interaction logs, and switching logs. This invention achieves runtime schedulable management of interactive capabilities, enabling low-resource-consumption recording of scanning behavior and deep trapping of advanced attacks and collection of complete attack chain data, providing reliable data support for the detection of encrypted malicious traffic.

This invention belongs to the field of electronic digital data processing technology, specifically relating to a low-altitude communication data anomaly detection system and method based on edge intelligence. The system parses protocol fields from the raw bitstream of the low-altitude communication link layer, extracts type identifiers and payload lengths to construct a protocol state machine transition matrix, and utilizes a Long Short-Term Memory (LSTM) network to extract state transition probability sequence features. Geographically adjacent edge nodes are set as micro-federated learning groups. Each node, after training using local features, only uploads network gating weight parameters to its neighboring nodes for weighted aggregation to update its local model. An alarm is triggered when the real-time state transition probability sequence deviates from the normal transition matrix and exceeds a preset topology threshold. This invention can identify protocol state machine logic errors and transition anomalies, reducing the amount of communication data required for collaborative model updates between edge nodes.

The application discloses a VR signal direct connection system and method based on multi-protocol adaptive matching, wherein the VR signal direct connection system comprises a signal receiving unit used for receiving signals of different frequency bands; a protocol decoding unit used for performing protocol decoding on the transmitted signals; an LSTM protocol prediction model used for generating a protocol priority queue and transmitting the generated protocol priority queue to a dynamic protocol loading unit; the dynamic protocol loading unit is used for judging whether to switch protocols according to signal quality conditions and the generated protocol priority queue, and if yes, transmitting the protocol state after switching to an FPGA dynamic partition; the FPGA dynamic partition is used for receiving the protocol state transmitted by the dynamic protocol loading unit and the protocol data transmitted by the protocol decoding unit; a signal processing module is used for receiving the protocol state and the protocol data transmitted by the FPGA dynamic partition, processing the received data information, and generating the content displayed on a VR device.

The invention relates to the technical field of industrial internet-of-things automatic control, and discloses an actuator internet-of-things multi-protocol adaptation system and method.The method comprises the steps that a protocol module constructs a state machine model for each protocol adapter, cross-protocol state collaboration and abnormal event release are achieved through tense logic rule verification, and a resource module receives abnormal events and sends the abnormal events to a server; the method comprises the following steps: dynamically updating a global resource constraint graph, analyzing an optimal resource reallocation scheme and an atomic task sequence, deconstructing the task sequence into a pi-calculation concurrent process network by applying a reconstruction module, recombining the process network and mapping the recombined process network into a cross-protocol instruction set to drive an executor, and finally, executing the Pi-calculation concurrent process network. Full-link adaptation from protocol layer state consistency guarantee and resource layer dynamic optimization scheduling to application layer process flexible reconstruction is realized, and the reliability and response efficiency of a multi-protocol actuator system in a complex industrial environment are improved.

This invention discloses an IoT fuzzing method based on LLM-guided and FSM dynamic inference, belonging to the field of IoT network security and software testing technology. Addressing the problems of low coverage and inaccurate state machine inference in current IoT protocol fuzzing, this invention first constructs an initial FSM by combining IoT protocol specifications and captured traffic data. Then, it generates a large number of test cases through mutation of seed test cases for fuzzing testing. Features are extracted from device responses, and state identification is performed by calculating similarity. When a new state appears, the FSM and state fingerprint database are updated. When coverage becomes a bottleneck, LLM-guided path inference is used to generate extended sub-FSMs and test cases, which are then executed. The FSM is then corrected based on the test results. This invention enables high-precision automated construction of IoT protocol state FSMs, improving test coverage and enhancing the efficiency and accuracy of vulnerability discovery.

The invention discloses a network flow generating and repairing method based on protocol constraint. The method comprises the following steps: analyzing an original traffic capture file, extracting basic features through stream-level recombination and session segmentation, and mapping a continuous time sequence and a discrete protocol field to a uniform feature space; and on the basis, constructing a diffusion type network flow generation model to capture a statistical attribute and time sequence dependency relationship of the network flow. In the generating or repairing process, a protocol state machine is constructed, protocol constraint is introduced in the reverse denoising stage, the sampling process is constrained through a legality guiding mechanism, and protocol logic violation in the generating process is avoided. And finally, through feature inverse mapping and virtual protocol stack state maintenance, reconstructing to obtain network flow data which meets a communication protocol specification and can be correctly analyzed by a real protocol stack. According to the method, the generation and repair of the network traffic can be realized under a unified framework, and the correctness of a result in protocol semantics is ensured.

The invention provides a network protocol program parallel fuzzy test method and device and electronic equipment, and relates to the technical field of computers. The network protocol program parallel fuzzy test method comprises the following steps: acquiring a state model of a to-be-tested protocol program with a directed graph structure; according to a plurality of state nodes of the state model and a data model associated with the output operation of each state node, generating a plurality of protocol state paths carrying path variation calculation amount weights; according to the number of test examples of the protocol program to be tested and the path variation calculation amount weight of each protocol state path, determining the test task amount weight of each test example; and according to the test task load weight of each test instance and the similarity between the protocol state paths, allocating the protocol state paths to the corresponding test instances. According to the invention, fuzz testing can be efficiently and accurately carried out on the network protocol program.

The invention discloses a protocol isolation device, an access control method, equipment and a medium, and relates to the technical field of industrial network boundary security, the device comprises an extranet host system, an isolation switching unit and an intranet host system which are all physical modules; wherein each of the extranet host system and the intranet host system comprises a message analysis module, a protocol state module, an access strategy module and an intelligent scheduling module; and strategies such as time-sharing double ferrying, protocol state tracking, a dynamic strategy and intelligent scheduling are designed, and through coordination work of the strategies, a protocol isolation and control scheme which can meet the high-speed data interaction requirement of the industrial Internet of Things and is stable and safe in performance is provided.

The invention discloses a network defense detection method, device and equipment, a storage medium and a product thereof, and relates to the technical field of network security, the method is applied to a coprocessor module arranged in a terminal, the coprocessor module is used for network security testing, and the method comprises the following steps: monitoring a network service enabling event of the terminal, loading a corresponding attack script according to the started service to carry out a network security test; in the testing process, comparing a first transfer path of the protocol state expected by the attack script with a second transfer path of the protocol state actually executed by the main processor, and judging whether the first transfer path is consistent with the second transfer path or not; and if the first transfer path is not consistent with the second transfer path, determining that an exception exists in the test, and controlling a communication module of the terminal to repair the corresponding security hole. That is, the whole process from vulnerability identification to communication layer repair can be completed without depending on external network interaction, so that the autonomous defense capability of the Internet of Things terminal in a complex network environment is enhanced.

The invention provides a risk protection method and device for data acquisition and electronic equipment, and the method comprises the steps: obtaining a plurality of original messages of a data acquisition node, carrying out the security enhancement processing of each original message, obtaining a reinforced message flow, carrying out the multi-dimensional risk detection of the reinforced message flow, obtaining a risk score, and carrying out the risk protection of the data acquisition node. The multi-dimensional risk detection comprises the step of carrying out risk detection on at least two of a protocol state layer, a time sequence behavior layer and a semantic content layer; according to the invention, the security of the original message is enhanced, so that the risk of sensitive data leakage is reduced; multi-dimensional risk detection is performed through a protocol state layer, a time sequence behavior layer, a semantic content layer and the like, so that combined attacks can be identified in a cross-dimension manner, and the security of data acquisition is improved.

The invention discloses a standardized access and detection system for auxiliary control equipment of a transformer substation, and relates to the field of transformer substations. Comprising a multi-protocol adaptation layer which constructs a protocol state machine and supports dynamic analysis and conversion of DL / T860 and MQTT protocols; performing model difference quantification, designing a double-similarity algorithm, and outputting a model compatibility scoring report; containerized simulation clusters, deployment of equipment simulators based on Docker and support of thousand-level equipment concurrent testing are carried out, and in model difference quantification, a verification process comprises the steps of analyzing equipment ICD files and extracting a model field list; and loading the MICS document of the corresponding equipment from the standard model library. According to the method, the protocol state machine is constructed, then compatibility scoring is performed based on double-similarity calculation, so that the compatibility verification efficiency can be improved, in addition, an analysis quintuple is set in the protocol adaptation layer, the analysis speed is increased, finally resource allocation and data generation simulation are performed through the simulator, and access whole-process automatic testing is realized.

The application relates to the technical field of network security detection, and discloses a network transmission protocol intrusion detection method and system. The method comprises the following steps: collecting network transmission protocol data streams, extracting packet header features and payload features, and integrating to form an original feature set; classifying the original feature set according to protocol types, dividing different protocol clusters and marking corresponding identifiers; constructing a dynamic feature filter based on the protocol cluster identifiers, screening a feature subset associated with the current protocol cluster from the original feature set; inputting the feature subset into a protocol state analysis model, outputting a protocol state vector and an abnormal behavior probability distribution from the model; generating an intrusion detection result according to the two, and triggering a corresponding defense response instruction. Through protocol cluster classification and dynamic feature screening, the method adapts to different protocol characteristics, realizes accurate identification of protocol intrusion behaviors, and can be applied to various scenes relying on network transmission protocols.

Embodiments obtain state elements based on application requests from a client. The state elements may be enqueued in a state queue associated with an application session for an application requests and the application requests may be forwarded to the application. Application responses from the application may be employed to perform further actions, including: obtaining message elements based on the application responses such that the message elements may be enqueued in a message queue associated in the application session; collecting a portion of the state elements in the state queue that may be associated the message elements; updating the portion of the state elements to advance a protocol state based on the message elements such that the application responses may be communicated to the client.

The application relates to the technical field of semiconductor testing, and particularly discloses an error injection and fault-tolerant test system in FT testing of a storage chip. The system comprises a test control host, a programmable error injection module, a protocol state monitoring module, a multi-dimensional response analysis module and a test scene generation engine. Through cooperative work, the system can automatically generate and inject error sequences, non-invasively monitor the internal state of a protocol, and perform timing, logic and statistical analysis, so that automatic, high-intensity stress testing and comprehensive evaluation of the fault-tolerant capability of a chip are realized. The system forms a closed-loop system of the programmable error injection module and the test scene generation engine, and realizes automatic stress testing of a high intensity and high concurrency of a fault-tolerant protocol of a storage chip.

The invention relates to the field of data processing, and discloses an instant messaging private protocol vulnerability mining method and system. The method comprises the following steps: collecting multi-mode communication data and carrying out fusion reverse analysis to obtain a fusion reverse output result comprising a protocol syntax tree, a protocol state machine model and protocol state information; constructing a triple response test to obtain response data; and obtaining the vulnerability of the instant messaging private protocol by analyzing the response data and fusing the reverse output result. According to the method, an instant messaging private encryption protocol can be accurately and reversely deduced by using a fusion reverse analysis mechanism of multi-mode communication data, a protocol state machine model of the instant messaging protocol is constructed, and a reverse output result and response data are compared and fused through a tentative protocol packet response mechanism, so that the instant messaging private encryption protocol can be accurately and reversely deduced. The vulnerability of the instant messaging protocol can be accurately mined, and a new thought is provided for instant messaging private protocol analysis.

The invention relates to the technical field of intelligent lighting control of building automation, and particularly discloses an intelligent lighting control system based on multi-protocol dynamic switching and a control method thereof. The system comprises a lighting controller, a multi-protocol communication module, a protocol arbitration module, a unified state memory, a local logic execution engine and a man-machine interaction interface. According to the method, communication quality of each protocol channel is monitored in real time, a health degree score is calculated, a protocol switching process is dynamically triggered, cross-protocol state synchronization is realized by adopting unified state storage, local control is automatically degraded when a network is abnormal, and state backtracking is completed after the network is recovered. According to the invention, gateway-free intelligent cooperation of multiple protocols of a management layer and a field layer is realized, the real-time consistency of a control state is guaranteed, the reliability and fault-tolerant capability of the system are improved, the operation and maintenance process is simplified, and the system can be widely applied to illumination control scenes of high-end intelligent buildings and has remarkable economic and social benefits.

Embodiments obtain state elements based on application requests from a client. The state elements may be enqueued in a state queue associated with an application session for an application requests and the application requests may be forwarded to the application. Application responses from the application may be employed to perform further actions, including: obtaining message elements based on the application responses such that the message elements may be enqueued in a message queue associated in the application session; collecting a portion of the state elements in the state queue that may be associated the message elements; updating the portion of the state elements to advance a protocol state based on the message elements such that the application responses may be communicated to the client.

The invention discloses a self-adaptive cross-protocol privacy enhancement method for power data communication, and relates to the technical field of network communication privacy protection. The method comprises the following steps: establishing an electric power communication protocol message unified description model, and carrying out formalized modeling on a protocol message format, a conversion rule and a state transition mechanism; collecting a target protocol flow sample, selecting a representative sample through state difference measurement, and constructing a target protocol state machine; selecting a target state with the highest matching degree with the source protocol based on a minimum cost matching principle; state-driven message format privacy enhancement is executed, and message conversion is realized; and constructing a cost-income evaluation model, and evaluating the privacy enhancement effect from five dimensions of time delay cost, bandwidth cost, message state consistency, format state matching degree and characteristic state similarity. According to the method, cross-protocol privacy protection of power data communication can be realized under controllable cost, traffic recognition attack based on deep learning is effectively resisted, and technical support is provided for power system security and privacy protection.

The invention relates to a stateful protocol grey box fuzzy test method based on heuristic variation scheduling, which comprises the following steps: S1, initializing a test environment, and establishing a high-speed communication channel based on a shared memory, S2, dividing an initial seed set into a plurality of source seed systems according to sources; s3, selecting a target test state based on an inferred protocol state machine, and selecting a message sequence capable of reaching the state from a corpus, S4, selecting an enabled mutation operator to perform havoc mutation on candidate subsequences according to a current generation offspring mutation strategy of a current source seed system; s5, the test case is sent to the server through the shared memory channel, and the execution state is monitored; s6, generating a new generation of filial generation strategy after the first generation of filial generation strategy of the current source seed system is evaluated; and S7, repeating the steps S3 to S6 until a test termination condition is met. According to the method, global exploration and local development can be effectively balanced, the diversity and pertinence of test cases are improved, and the coverage capability of protocol states and code paths and the discovery probability of deep vulnerabilities are remarkably enhanced.

The invention provides a multi-protocol adaptive identification and matching method for a universal equipment motion controller, and relates to the technical field of automatic control. The method comprises the following steps: performing online clustering processing on a hybrid network data stream received by a communication interface of a motion controller, and dividing the hybrid network data stream into a plurality of independent protocol data subsets; establishing an initial protocol state transfer graph based on the command-response sequential relationship and the state code transfer relationship of the data packets in each protocol data subset; a graph neural network model fusing sub-graph structure perception constraint is adopted to carry out topology completion on the graph, and a hypothetical protocol behavior model is generated; a digital twinborn exploration environment is constructed, a reinforcement learning agent taking a session establishment success rate as a reward function is established, a stable communication strategy is obtained through an interactive game, and a security verification sub-strategy is applied to real source equipment to perform protocol matching verification, so that real-time accurate identification and matching of equipment communication in a multi-protocol environment are realized, and the communication efficiency is improved. And the communication stability and the adaptive capability of the motion controller are obviously improved.

The application discloses a kind of automation case construction methods and systems for private protocol test, it is related to communication protocol test technical field. Including: step one, through traffic sniffing and deep packet analysis, identify the field structure of private protocol, state transition rule and dependent relationship;Step two, based on reinforcement learning algorithm, combine protocol state machine and historical test results, dynamically generate test case set covering normal scene, boundary scene and abnormal scene;Step three, inject the test traffic generated in the simulation environment, monitor the response data of target system in real time, calculate the evaluation value and adjust the generation strategy of test case according to the value.The application realizes efficient and robust verification of private protocol through adaptive execution and multidimensional abnormal analysis in simulation environment, and significantly improves test efficiency and protocol security.

The invention relates to the technical field of communication, in particular to a network session recovery method and system in a microkernel operating system, electronic equipment and a medium. The method comprises the following steps: storing communication association information between an application program and a network service process in a persistent storage area which can be accessed by the network service process; maintaining, by the application, protocol state information of the network session in its user mode space; accessing a shared memory maintained by the application program by a network service process running in a user mode so as to carry out data forwarding; after the network service process is restarted, communication connection with the application program is reestablished based on the communication association information, and the service is recovered: if the protocol state information is stored in the shared memory, the service is recovered by synchronizing the protocol state information; if the protocol state information is stored in the private address space, the network service process restores the data forwarding function, and the application program guarantees session continuity based on the protocol state information maintained by the application program.

Disclosed are a packet data convergence protocol status reporting method, a packet data convergence protocol status receiving method, a terminal and devices. The method at the terminal side includes: in case of receiving the MBS, triggering to report a packet data convergence protocol (PDCP) status according to a preset condition; transmitting a PDCP status report on a predetermined uplink channel.

The application discloses a kind of based on deep learning's multi-protocol Internet of Things equipment Matter state and command mapping method, method is according to command event associated protocol source, source protocol state, executable command, Matter cluster state, command permission relationship and device physical response, form protocol state transition waveform and physical response waveform;Response time delay correction is obtained by frequency domain analysis cross-modal frequency domain phase-coherent feature, and its amplitude and phase are corrected after KOSS frequency domain differential product formation, before inverse fourier transform, to correct the input derivative to participate in state recursion, form cross-protocol state representation;In turn, according to the consistency of device physical response and command permission relationship screening mapping combination, obtain Matter state and command mapping relationship, for reducing and device actual response do not match or in current Matter cluster state prohibited execution mapping.