CN103746867B - A kind of network protocol analysis method based on basic function - Google Patents

Abstract

The invention discloses a network protocol analysis method based on basis functions, including: establishing a basis function library and a base function pattern combination library of known structural protocols; when receiving data sent by a target network, using the data and the existing basis The combination of function patterns characterizes the structure of the target protocol corresponding to the target network; judge according to the structure of the target protocol: if the data is protocol data with a known structure, analyze the target protocol using a layered method; if the data bit For the protocol data with unknown structure, use the existing basis function or new basis function to generate the basis function mode combination mode corresponding to the target protocol. The invention can solve the problems of rapid protocol identification and accurate analysis and processing.

Description

A Network Protocol Analysis Method Based on Basis Function

technical field

The invention relates to the field of computer technology, in particular to a network protocol analysis method based on basis functions.

Background technique

Network protocol analysis is the core issue that many scholars pay attention to in the field of network management and network security research. Network protocol analysis captures data packets in the network, analyzes the header and data fields of the data packets to give detailed information and statistical results of the protocol, and then classifies and analyzes the data, thereby further helping to discover potential security risks in the network, and can be used in the network Provides failure analysis information when a failure occurs. Network protocol analysis can enable network managers to quickly and accurately locate the cause of the fault, find out the network node, network protocol and network link that caused the fault, and restore the normal operation of the network at the fastest speed. In addition, network protocol analysis can also provide a reliable basis for planning and adjusting the network by analyzing network communication and network connection conditions, rationally allocating network performance and resources.

However, due to the diversification and privatization of existing network protocols, protocol analysts are faced with the problems of more and more types of protocols and more and more complex protocol state spaces.

Most of the existing protocol analysis methods use the method of character string matching, because this method uses a large number of matching methods, so the speed is relatively slow. However, other protocol analysis methods based on statistics have the disadvantage of low accuracy. In addition, none of these methods can analyze the private protocols of various network companies.

Contents of the invention

In view of the above-mentioned analysis, the present invention aims to provide a network protocol analysis method based on basis functions to solve the problems caused by various types of protocols, complex protocol state space, and non-disclosure of private protocols in the field of network analysis. Problems with slow and inaccurate recognition.

The purpose of the present invention is mainly achieved through the following technical solutions:

The invention provides a network protocol analysis method based on basis functions, comprising:

Establish a base function library and a base function pattern combination library of known structural protocols;

When the data sent by the target network is received as input data, the structure of the target protocol corresponding to the target network is characterized by using the combination of the data and the existing basis function mode;

Judging according to the structure of the target protocol: if the target protocol is a protocol with a known structure, use a layered method to analyze the target protocol; if the target protocol is a protocol with an unknown structure, use existing basis functions or new The basis function generates a basis function mode combination mode corresponding to the target protocol.

Further, the Walsh function is used to establish a base function library and a base function mode combination library of known structural protocols. Specifically include:

The Walsh function is defined as follows:

If wal(k,t)(k=0,1,…) is used to represent the Walsh function on the interval t∈[0,1), then it is defined as the following formula:

wal(2k,t)=wal(k,2t)+(-1) ^k wal(k,2t-1),k=1,2,…

wal(2k+1,t)=wal(k,2t)+(-1) ^k+1 wal(k,2t-1),k=0,1,…

$\mathrm{<span\; class="notranslate">\; wal</span>}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; 0</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; t</span>}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; =</span>\left\{\begin{array}{cc}\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; ,</span>& \mathrm{<span\; class="notranslate">\; 0</span>}<span\; class="notranslate">\; \&le;</span>\mathrm{<span\; class="notranslate">\; t</span>}<span\; class="notranslate">\; <</span>\mathrm{<span\; class="notranslate">\; 1</span>}\\ \mathrm{<span\; class="notranslate">\; 0</span>}<span\; class="notranslate">\; ,</span>& \mathrm{<span\; class="notranslate">\; t</span>}<span\; class="notranslate">\; <</span>\mathrm{<span\; class="notranslate">\; 0</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; t</span>}<span\; class="notranslate">\; \&Greater\; Equal;</span>\mathrm{<span\; class="notranslate">\; 1</span>}\end{array}\right.$

Define the following transformation to convert the Walsh function of ±1 to a 0,1 bitstream:

$\mathrm{<span\; class="notranslate">\; f</span>}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; w</span>}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; =</span>\left\{\begin{array}{cc}\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; ,</span>& \mathrm{<span\; class="notranslate">\; w</span>}<span\; class="notranslate">\; =</span><span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; 1</span>}\\ \mathrm{<span\; class="notranslate">\; 0</span>}<span\; class="notranslate">\; ,</span>& \mathrm{<span\; class="notranslate">\; w</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}\end{array}\right.$

Then transform f(x) to obtain a set of orthogonal basis functions base(k,t)(k=0,1,…):

base(2k,t)=f(wal(2k,t)),k=1,2,…

base(2k+1,t)=f(wal(2k+1,t)),k=0,1,…

base(0,t)=f(wal(0,t))

The set of orthogonal base functions base is the base function library, and all known protocols are expressed by using different combination modes of the set of orthogonal base functions, so as to obtain a base function mode combination library of known structural protocols.

Further, the step of characterizing the structure of the target protocol by using the existing basis function mode combination specifically includes:

Using the existing combination of basis function modes and the received data of the target network, the time-sliding method is used to describe the time-structure distribution diagram of the target protocol;

Based on the description of the time-structure distribution diagram of the target protocol, the basis function mode combination-matching rate distribution diagram is obtained, and the structure of the target protocol is characterized by the basis function mode combination-matching rate sub-relationship.

Further, the above time-structure distribution diagram is obtained according to the following method:

Assuming that C is a set of basis function combination patterns, for each existing basis function combination pattern c ₁ ,c ₂ ,…,c _cn ∈C, the XOR operation is performed with the received data in a time sliding manner to obtain The structure value in each combination mode, that is, for a certain combination mode and input data I={b ₁ ,b ₂ ,...,b _n }, calculate Here, if n>cf, let i repeat from 1 to cf, that is, i=1～cf, 1～cf..., so as to obtain the time-structure distribution diagram of the input data.

Further, the above basis function pattern combination-matching rate distribution diagram is obtained according to the following method:

For different basis function combination modes c _i , add all the data in the time-structure distribution diagram of the input data to obtain the structure matching value ( _{ci ,m i )} of each basis function combination mode, i∈{1,2 ,...,c _n };

Based on the structural matching values of all known basis function combination modes, the basis function combination mode-matching rate distribution diagram is drawn, where the abscissa is the known basis function combination mode, and the ordinate is the structure matching value.

Further, the step of judging according to the structure of the target agreement specifically includes:

Comparing the maximum matching rate value m in the basis function mode combination-matching rate distribution diagram with the first predetermined threshold t1:

If m is greater than or equal to t1, the target protocol is considered to be a protocol with a known structure, and the target protocol is analyzed using a layered method;

If m is less than t1, the target protocol is considered to be a private protocol, and the basis function mode combination corresponding to the target protocol is generated by using existing basis functions or new basis functions.

Further, the step of analyzing the target protocol using a layered method specifically includes:

(0) Use the data sent by the target network as input data d;

(1) For the input data d, use its basis function combination mode to extract the outermost protocol feature fields f ₁ , f ₂ ,...,f _fn of the input data d, and divide the received input protocol information into protocol header fields H and upper layer protocol data supD;

(2) Parse all the feature fields contained in the header field H;

(3) Determine whether the length of supD of the upper-layer protocol data is 0, and stop if it is;

(4) Perform protocol structure characterization on the upper layer protocol data supD obtained after segmentation;

(5) Take the upper-layer protocol data that has been characterized by the structure as input data, and turn to (1);

until all the data is processed.

Further, the step of using existing basis functions or new basis functions to generate the basis function mode combination method corresponding to the target protocol specifically includes:

Let F be the set of basis functions, and C be the set of combination patterns of basis functions

1) First use the existing basis functions f ₁ , f ₂ ,…, f _cf ∈ F, and adopt a new combination mode different from the combination mode library That is, a new _ki value is randomly selected so that the new c does not belong to C, and the structure distribution diagram of the target protocol is drawn;

2) Use the structural matching values of all new basis function combination modes c to draw the basis function mode combination-matching rate distribution diagram;

3) Compare the maximum matching rate value m with the second predetermined threshold t2:

If m is greater than or equal to t2, then add the new base function mode combination mode c _n corresponding to this protocol into the base function combination mode library C, and stop;

If m is less than t2, add 1 to the dimension of the basis function, add the new basis function f _cf+1 to the basis function library F, and go to step 1).

The beneficial effects of the present invention are as follows:

The invention provides a network protocol analysis method based on basic functions, which can solve the problems of rapid protocol identification and accurate analysis and processing.

Additional features and advantages of the invention will be set forth in the description which follows, and in part will be apparent from the description, or may be learned by practice of the invention. The objectives and other advantages of the invention may be realized and attained by the structure particularly pointed out in the written description and claims hereof as well as the appended drawings.

Description of drawings

Fig. 1 is a schematic flow chart of the method described in the embodiment of the present invention;

Fig. 2 is a time-structure distribution diagram of input data in the method described in the embodiment of the present invention;

Fig. 3 is a distribution diagram of basis function combination mode-matching rate in the method described in the embodiment of the present invention;

4 is a schematic diagram of layer-by-layer analysis of the protocol in the method described in the embodiment of the present invention;

Fig. 5 is a schematic diagram of the analysis results of protocol data in the method described in the embodiment of the present invention.

detailed description

The method of the present invention mainly includes: establishing a base function library and a base function mode combination mode library of a known structure protocol; when receiving the data sent by the target network, using the data and the existing base function mode combination mode to represent the target The structure of the target protocol corresponding to the network; judge according to the structure of the target protocol: if the target protocol is a protocol with a known structure, use a layered method to analyze the target protocol; if the target protocol is a protocol with an unknown structure, A basis function mode combination mode corresponding to the target protocol is generated by using existing basis functions or new basis functions.

Preferred embodiments of the present invention will be specifically described below in conjunction with the accompanying drawings, wherein the accompanying drawings constitute a part of the application and are used together with the embodiments of the present invention to explain the principles of the present invention.

As shown in Figure 1, Figure 1 is a schematic flow chart of the method described in the embodiment of the present invention, which may specifically include the following steps:

Step 101: Utilize the Walsh function to establish a base function library and a base function pattern combination library of known structural protocols:;

Due to the various characteristic fields of the existing protocols, it is necessary to use a small amount of information to describe the characteristic fields of a large number of protocols, so as to provide a basis for protocol analysis.

Since the Walsh function system has the characteristics of function value ±1, orthogonality, etc., in the embodiment of the present invention, the Walsh function is used as the base function to characterize the protocol structure. Of course, other similar Functions do too.

The Walsh function is defined as follows:

If wal(k,t)(k=0,1,…) is used to represent the Walsh function on the interval t∈[0,1), then it is defined as the following formula:

wal(2k,t)=wal(k,2t)+(-1) ^k wal(k,2t-1),k=1,2,…

wal(2k+1,t)=wal(k,2t)+(-1) ^k+1 wal(k,2t-1),k=0,1,…

$\mathrm{<span\; class="notranslate">\; wal</span>}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; 0</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; t</span>}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; =</span>\left\{\begin{array}{cc}\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; ,</span>& \mathrm{<span\; class="notranslate">\; 0</span>}<span\; class="notranslate">\; \&le;</span>\mathrm{<span\; class="notranslate">\; t</span>}<span\; class="notranslate">\; <</span>\mathrm{<span\; class="notranslate">\; 1</span>}\\ \mathrm{<span\; class="notranslate">\; 0</span>}<span\; class="notranslate">\; ,</span>& \mathrm{<span\; class="notranslate">\; t</span>}<span\; class="notranslate">\; <</span>\mathrm{<span\; class="notranslate">\; 0</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; t</span>}<span\; class="notranslate">\; \&Greater\; Equal;</span>\mathrm{<span\; class="notranslate">\; 1</span>}\end{array}\right.$

With the Walsh function, the embodiment of the present invention defines the following transformation to convert the ±1 of the Walsh function into a 0,1 bit stream:

$\mathrm{<span\; class="notranslate">\; f</span>}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; w</span>}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; =</span>\left\{\begin{array}{cc}\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; ,</span>& \mathrm{<span\; class="notranslate">\; w</span>}<span\; class="notranslate">\; =</span><span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; 1</span>}\\ \mathrm{<span\; class="notranslate">\; 0</span>}<span\; class="notranslate">\; ,</span>& \mathrm{<span\; class="notranslate">\; w</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}\end{array}\right.$

Then a set of orthogonal basis functions base(k,t)(k=0,1,…) can be obtained by transforming f(x):

base(2k,t)=f(wal(2k,t)),k=1,2,…

base(2k+1,t)=f(wal(2k+1,t)),k=0,1,…

base(0,t)=f(wal(0,t))

Since the protocol data of a protocol with a known structure can be expressed as a 0,1 code string, all known protocols can be expressed with different combination modes of the orthogonal basis function base, that is, for a protocol data of a known structure d={x ₁ x ₂ ... x _n }, x _i ∈ {0,1}, it is always possible to find real numbers c _i such that Where M is the number of orthogonal basis function bases, so that a base function library and a base function mode combination library of known structural protocols can be established.

Step 102: receiving data sent by the target network as input data;

Step 103: characterize the structure of the target protocol corresponding to the target network by using the combination of the data and the existing basis function mode;

Specifically, on the basis of the basis function and the transformation f(x), using the existing combination of basis function patterns and the received data of the target network, the time-sliding method is used to describe the time-structure distribution of the target protocol , and then draw the basis function mode combination-matching rate distribution diagram according to the time-structure distribution diagram, so as to judge whether the data of the target network is protocol data with a known structure, that is, it can be judged whether the protocol adopted by the target network is Known structure protocol.

Assuming that C is a set of basis function combination patterns,

(1) For each existing basis function combination mode c ₁ ,c ₂ ,...,c _cn ∈C, perform XOR operation with the input data received in step 102 in a time sliding manner to obtain each The structure value in the combination mode, that is, for a certain combination mode and input data I={b ₁ ,b ₂ ,...,b _n }, calculate

(Here, if n>cf, let i repeat from 1 to cf, that is, i=1～cf, 1～cf...), so as to obtain the time-structure distribution diagram of the input data, as shown in Figure 2;

(2) For different basis function combination patterns c _i , add all the data in the time-structure distribution diagram of the input data to obtain the structure matching value ( _{ci , m i )} of each basis function combination pattern, i∈{ 1,2,...,c _n };

(3) Use the structural matching values of all known basis function combination modes to draw the basis function combination mode-matching rate distribution diagram, as shown in Figure 3, where the abscissa is the known basis function combination mode, and the ordinate is the structural matching value.

Step 104: Find the maximum matching rate value in the pattern-matching rate distribution diagram, and compare the maximum matching rate value m with the first predetermined threshold t1:

If m is greater than or equal to t1, the data is considered to be data of a known structured protocol, that is, the target protocol corresponding to the target network is a known structured protocol, and the process goes to step 105, and the process ends; if m is less than t1, the data is considered to be The data of the private protocol, that is, the target protocol corresponding to the target network is a private protocol, go to step 106, and carry out self-learning;

Wherein, the first predetermined threshold t1 can be manually specified, which affects the accuracy of the protocol analysis, and generally can be taken as 0.8.

Step 105: Layered protocol analysis based on basis function combination mode;

Specifically, because the existing communication protocol has the characteristics of layered encapsulation, the idea of basis function combination mode is adopted in the embodiment of the present invention to analyze the received protocol data layer by layer, and the analysis method can adopt existing methods in this field. Mature technical solutions, the specific steps are as follows:

105-0: Use the data sent by the target network as input data d;

105-1: For the input data d, use its basis function combination mode to extract the outermost protocol feature fields f ₁ , f ₂ ,...,f _fn of the input data d, and divide the received input protocol information into protocol header fields H and upper layer protocol data supD;

105-2: Parse all the characteristic fields contained in the header field H;

105-3: Judging whether the length of supD of the upper layer protocol data is 0, if yes, stop;

105-4: Use the method in the previous section to characterize the protocol structure of the upper layer protocol data supD obtained after segmentation;

105-5: Take the upper-layer protocol data that has been characterized by the structure as input data, go to (1);

That is, it is equivalent to (1)-(4) processing a layer of protocol, starting from the outermost protocol, and processing a layer of protocol every cycle until all the data is processed.

As shown in Figure 4, 4 provides a schematic diagram of layer-by-layer analysis of the protocol. It can be seen from Figure 4 that when analyzing the target protocol layer by layer, only the basis function is used to extract part of the information of the overall protocol for each analysis, which can reduce the amount of processed data and speed up the speed of protocol analysis.

The layered structural analysis of the target protocol by the above method can simplify the complexity of the protocol analysis, and achieve the purpose of level-by-level precision, increasing the accuracy of the protocol analysis.

Step 106: Self-learnable basis function and its combination mode extension method

Specifically, due to the uncertainty of the private protocol structure, it is necessary to design a basis function with self-learning capability and its combination mode extension method. The self-learning analysis method adopted in the embodiment of the present invention can be divided into the following steps:

Let F be the set of basis functions, and C be the set of combination patterns of basis functions

106-1: First use the existing basis functions f ₁ , f ₂ ,…,f _cf ∈F, and adopt a new combination pattern different from the combination pattern library That is, a new _ki value is randomly selected so that the new c does not belong to C, and the structure distribution diagram of the target protocol is drawn;

106-2: Use the structural matching values of all new basis function combination modes c to draw basis function mode combination-matching rate distribution diagrams;

106-3: Compare the maximum matching rate value m with the second predetermined threshold t2:

If m is greater than or equal to t2, it means that the target protocol can be characterized by the new combination mode c _n of the existing basis functions, and the new combination mode c _n of the basis function mode corresponding to this protocol is added to the base function combination mode library C ,stop;

If m is less than t2, it means that the target protocol cannot be characterized by the existing basis function, then add 1 to the dimension of the basis function, add the new basis function f _cf+1 to the basis function library F, and turn to (1);

Wherein, the second predetermined threshold t2 can be manually specified, which affects the accuracy of the protocol representation, and is generally set to be 0.8.

The above-mentioned self-learning basis function and its combination mode extension method can form a new basis function and its mode combination mode, which is used to establish the representation mode of the private protocol. If you encounter the same protocol later, you can quickly characterize and analyze this protocol through the basis function combination pattern library.

The effectiveness of the basis function-based protocol analysis method proposed in the embodiment of the present invention is described below. Figure 5 shows the results of protocol data analysis using the matching method, statistical method and proposed method, where the abscissa is the number of input protocol data, and the ordinate is the analysis time. It can be seen from the figure that the basis function-based network protocol analysis method proposed by the embodiment of the present invention is superior to the matching method and the statistical method in terms of performance.

To sum up, the embodiment of the present invention provides a network protocol analysis method based on basis functions. Firstly, based on the protocol characterization idea of basis functions, the network protocol data to be analyzed is analyzed, and it is judged whether it is data of a known structure protocol or Data of private agreement. Then, the characteristics of the known structured protocol and the private protocol are processed separately. For the known structured protocol, since a large number of design ideas of protocol layer nesting are used in today's network, a layered protocol analysis method is used in the embodiment of the present invention. ; For the private protocol, the embodiment of the present invention uses the idea of self-learning to construct a new basis function and characterize the protocol data, and then convert it into a protocol with a known structure for analysis. The embodiments of the present invention can solve the problems of rapid identification and accurate analysis and processing of protocols.

The above is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any person skilled in the art within the technical scope disclosed in the present invention can easily think of changes or Replacement should be covered within the protection scope of the present invention. Therefore, the protection scope of the present invention should be determined by the protection scope of the claims.

Claims (8)

1. A network protocol analysis method based on basis functions, characterized in that, comprising: Using the Walsh function to establish a base function library and a base function pattern combination library of known structural protocols; When the data sent by the target network is received as input data, the structure of the target protocol corresponding to the target network is characterized by using the combination of the data and the existing basis function mode; Judging according to the structure of the target protocol: if the target protocol is a protocol with a known structure, use a layered method to analyze the target protocol; if the target protocol is a protocol with an unknown structure, use existing basis functions or new The basis function generates a basis function mode combination mode corresponding to the target protocol. 2. The method according to claim 1, characterized in that, specifically comprising: The Walsh function is defined as follows: If wal(k,t)(k=0,1,…) is used to represent the Walsh function on the interval t∈[0,1), then it is defined as the following formula: wal(2k,t)=wal(k,2t)+(-1) ^k wal(k,2t-1),k=1,2,… wal(2k+1,t)=wal(k,2t)+(-1) ^k+1 wal(k,2t-1),k=0,1,… $\mathrm{<span\; class="notranslate">\; w</span>}\mathrm{<span\; class="notranslate">\; a</span>}\mathrm{<span\; class="notranslate">\; l</span>}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; 0</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; t</span>}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; =</span>\left\{\begin{array}{cc}\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; ,</span>& \mathrm{<span\; class="notranslate">\; 0</span>}<span\; class="notranslate">\; \&le;</span>\mathrm{<span\; class="notranslate">\; t</span>}<span\; class="notranslate">\; <</span>\mathrm{<span\; class="notranslate">\; 1</span>}\\ \mathrm{<span\; class="notranslate">\; 0</span>}<span\; class="notranslate">\; ,</span>& \mathrm{<span\; class="notranslate">\; t</span>}<span\; class="notranslate">\; <</span>\mathrm{<span\; class="notranslate">\; 0</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; t</span>}<span\; class="notranslate">\; \&Greater\; Equal;</span>\mathrm{<span\; class="notranslate">\; 1</span>}\end{array}\right.$ Define the following transformation to convert the Walsh function of ±1 to a 0,1 bitstream: $\mathrm{<span\; class="notranslate">\; f</span>}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; w</span>}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; =</span>\left\{\begin{array}{cc}\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; ,</span>& \mathrm{<span\; class="notranslate">\; w</span>}<span\; class="notranslate">\; =</span><span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; 1</span>}\\ \mathrm{<span\; class="notranslate">\; 0</span>}<span\; class="notranslate">\; ,</span>& \mathrm{<span\; class="notranslate">\; w</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}\end{array}\right.$ Then transform f(x) to get a set of orthogonal basis functions base(k,t)(k=0,1,…): base(2k,t)=f(wal(2k,t)),k=1,2,… base(2k+1,t)=f(wal(2k+1,t)),k=0,1,... base(0,t)=f(wal(0,t)) The set of orthogonal base functions base is the base function library, and all known protocols are expressed by using different combination modes of the set of orthogonal base functions, so as to obtain a base function mode combination library of known structural protocols. 3. The method according to claim 1, wherein the step of utilizing the existing basis function pattern combination to characterize the structure of the target protocol specifically comprises: Using the existing combination of basis function modes and the received data of the target network, the time-sliding method is used to describe the time-structure distribution diagram of the target protocol; Based on the description of the time-structure distribution diagram of the target protocol, the basis function mode combination-matching rate distribution diagram is obtained, and the structure of the target protocol is characterized by the basis function mode combination-matching rate sub-relationship. 4. method according to claim 3, is characterized in that, obtains above-mentioned time-structure distribution figure according to following method: Assuming that C is a set of basis function combination patterns, for each existing basis function combination pattern c ₁ ,c ₂ ,…,c _cn ∈C, the XOR operation is performed with the received data in a time sliding manner to obtain The structure value in each combination mode, that is, for a certain combination mode and input data I={b ₁ ,b ₂ ,...,b _n }, calculate Here, if n>cf, let i repeat from 1 to cf, that is, i=1~cf, 1~cf..., so as to obtain the time-structure distribution diagram of the input data. 5. method according to claim 4, is characterized in that, obtains above-mentioned basis function pattern combination-matching rate distribution figure according to following method: For different basis function combination modes c _i , add all the data in the time-structure distribution diagram of the input data to obtain the structure matching value ( _{ci ,m i )} of each basis function combination mode, i∈{1,2 ,...,c _n }; Based on the structural matching values of all known basis function combination modes, the basis function combination mode-matching rate distribution diagram is drawn, where the abscissa is the known basis function combination mode, and the ordinate is the structure matching value. 6. The method according to claim 3, wherein the step of judging according to the structure of the target agreement specifically comprises: Comparing the maximum matching rate value m in the basis function mode combination-matching rate distribution diagram with the first predetermined threshold t1: If m is greater than or equal to t1, the target protocol is considered to be a protocol with a known structure, and the target protocol is analyzed using a layered method; If m is less than t1, the target protocol is considered to be a private protocol, and the basis function mode combination corresponding to the target protocol is generated by using existing basis functions or new basis functions. 7. The method according to any one of claims 1 to 6, wherein the step of analyzing the target protocol using a layered method specifically comprises: (0) The data sent by the target network is used as input data d; (1) For the input data d, use its basis function combination mode to extract the outermost protocol feature fields f ₁ , f ₂ ,...,f _fn of the input data d, and divide the received input protocol information into protocol header fields H and upper layer protocol data supD; (2) Parsing all the feature fields contained in the header field H; (3) judge whether the supD length of the upper layer protocol data is 0, if so, stop; (4) performing protocol structure characterization on the upper layer protocol data supD obtained after segmentation; (5) Using the upper-layer protocol data characterized by the structure as input data, turn to (1); until all the data is processed. 8. according to the method described in any one in claim 1 to 6, it is characterized in that, utilize existing basis function or new basis function to generate the step of the basis function mode combination mode corresponding to this target agreement to specifically comprise: Let F be the set of basis functions, and C be the set of combination patterns of basis functions 1) First use the existing basis functions f ₁ , f ₂ ,…, f _cf ∈ F, and adopt a new combination mode different from the combination mode library That is, a new _ki value is randomly selected so that the new c does not belong to C, and the structure distribution diagram of the target protocol is drawn; 2) Use the structural matching values of all new basis function combination modes c to draw the basis function mode combination-matching rate distribution diagram; 3) Compare the maximum matching rate value m with the second predetermined threshold t2: If m is greater than or equal to t2, then add the new base function mode combination mode c _n corresponding to this protocol into the base function combination mode library C, and stop; If m is less than t2, add 1 to the dimension of the basis function, add the obtained new basis function f _cf+1 to the basis function library F, and go to step 1).