CN116192705A - Object-oriented protocol consistency problem positioning test method and system - Google Patents

Abstract

The invention discloses a method and system for locating and testing object-oriented protocol consistency problems. The method includes: collecting interactive communication messages generated by a power consumption information collection system as original sample data to form an original sample database; Read the original sample data from the original sample database, perform data standardization processing on the original sample data, and form standard data; based on a large number of historical standard data records, form a standard sample with standard data including all the characteristic factors of the message as the training sample library, and perform model training on the training samples according to the machine learning algorithm to determine the prediction model; input the samples to be detected into the prediction model for abnormal detection, and output the detection results.

Description

Object-oriented protocol consistency problem location testing method and system

technical field

The present invention relates to the technical field of data mining, and more specifically, to an object-oriented protocol consistency problem location testing method and system.

Background technique

With the release and wide application of "DL\T-698.45 Object-Oriented Power Consumption Information Data Exchange Protocol", due to its high development flexibility and easy scalability, it has greatly reduced the power consumption information collection system and equipment. system development and maintenance costs. However, the disadvantages of high flexibility are also obvious. In the situation where the "Protocol" is widely used, many manufacturers have their own unique understanding of the description of the attributes or methods of some specific objects, which leads to There are deviations in the consistency of the communication messages used by the equipment of different manufacturers, which makes the equipment of different manufacturers incompatible, reduces the communication efficiency of the adopting system, and increases the development cost of the manufacturer. Therefore, there is an urgent need for a protocol conformance evaluation rule that conforms to the mainstream.

The current method for protocol consistency detection of power consumption information collection equipment is to specify specific test content, and strictly compare the data type and value of the returned data to determine whether the device conforms to the protocol consistency specification. The limitations of this test form are very large. First, its test cases are fixed, inconvenient to expand, and easy to pass the test through special optimization by equipment manufacturers. Second, the coverage of its detection is insufficient, and the specified test content cannot cover various scenarios in actual use, which cannot meet the requirements of massive data. Third, the detection rules may not conform to the mainstream way of understanding, limited to the limitations of the business understanding of the R&D personnel of the detection software, which will lead to inaccurate detection rules.

Contents of the invention

According to the present invention, a method and system are provided to solve the problem that the current method used for the protocol consistency detection of electricity information collection equipment is to specify specific test content, and strictly compare the data type and value of the returned data for judgment Whether the device complies with the protocol conformance specification. The limitations of this form of testing are very technical.

According to the first aspect of the present invention, an object-oriented protocol consistency problem location testing method is provided, including:

Collect the interactive communication messages generated by the electricity consumption information collection system as the original sample data to form the original sample library;

reading original sample data from the original sample library, and performing data standardization processing on the original sample data to form standard data;

Based on massive historical standard data records, form a standard sample library with standard data containing all the characteristic factors of the message as training samples, and perform model training on the training samples according to the machine learning algorithm to determine the prediction model;

The samples to be detected are input into the prediction model for anomaly detection, and the detection results are output.

Optionally, performing data standardization processing on the original sample data to form standard data, including:

Perform data standardization processing on the original sample data, and divide the frame structure of the message into the attribute of a certain object or the parameter unit of the method according to a predetermined rule;

According to the data type of the parameter unit, the characteristic factor of the parameter unit is generated, and all the characteristic factors are serialized to form standard data.

Optionally, the frame structure of the message is divided into attribute or method parameter units of a certain object according to predetermined rules, including:

According to the predetermined rules, the message is divided into a start character, a length field, a control field, an address field, a frame header check, a link user data, a frame check, a terminator, and a parameter unit that determines an attribute of an object or a method.

Optionally, generate the feature factor of the parameter unit according to the data type of the parameter unit, and serialize all the feature factors to form standard data, including:

Determining whether the parameter unit meets the predetermined specification, if the parameter unit meets the predetermined specification, generating a characteristic factor of the parameter unit, if the parameter unit does not meet the predetermined specification, judging that the message is abnormal sample data and discarding it;

After the original data is extracted and the characteristic factors are completed, a standard data stream is formed in a decision tree-like manner according to the order of the parsed structure of the message.

Optionally, the samples to be detected are input into the prediction model for anomaly detection, and the detection results are output, including:

Inputting the samples to be detected into the prediction model for anomaly detection, and determining the probability distribution that the samples to be detected belong to each category;

When the probability distribution of no arbitrary classification category is greater than the specified threshold, it is determined that the sample data to be detected is abnormal and does not conform to the protocol consistency rule;

If the probability distribution of a certain category is greater than the specified threshold, it can be determined that the sample data to be detected conforms to a subcategory in the protocol consistency rule.

According to another aspect of the present invention, an object-oriented protocol consistency problem location testing system is also provided, including:

Form an original sample library module, which is used to collect the interactive communication messages generated by the electricity consumption information collection system as original sample data to form an original sample library;

Forming a standard data module for reading original sample data from the original sample library, performing data standardization processing on the original sample data, and forming standard data;

Determine the prediction model module, which is used to form a standard sample library based on a large amount of historical standard data records, using standard data containing all the characteristic factors of the message as training samples, and perform model training on the training samples according to the machine learning algorithm to determine the prediction Model;

The detection result output module is used to input the samples to be detected into the prediction model for anomaly detection, and output the detection results.

Optionally, form a standard data module, including:

Divide into parameter unit sub-modules, which are used to perform data standardization processing on the original sample data, and divide the frame structure of the message into parameter units of attributes or methods of a certain object according to predetermined rules;

A standard data sub-module is formed, which is used to generate characteristic factors of the parameter unit according to the data type of the parameter unit, and all characteristic factors are serialized to form standard data.

Optionally split into parameter unit submodules, including:

Determine the parameter unit, which is used to divide the message into start character, length field, control field, address field, frame header check, link user data, frame check, end character according to predetermined rules, and determine the attributes of an object Or the parameter unit of a method.

Optionally, form standard data submodules, including:

judging the parameter unit, used to determine whether the parameter unit conforms to the predetermined specification, if the parameter unit conforms to the predetermined specification, generate the characteristic factor of the parameter unit, if the parameter unit does not conform to the predetermined specification, determine that the message is abnormal sample data and discard;

A standard data flow unit is formed, which is used to form a standard data flow in a decision tree-like manner according to the order of the parsed structure of the message after the original data has been extracted to complete the eigenfactors.

Optionally, the output detection result module includes:

Determine the probability distribution sub-module, which is used to input the samples to be detected into the prediction model for anomaly detection, and determine the probability distribution that the samples to be detected belong to each category;

A sub-module for judging non-compliance is used for judging that the sample data to be detected is abnormal and does not conform to the protocol consistency rule when the probability distribution of any classification category is greater than the specified threshold;

The conformity determination sub-module is used to determine that the sample data to be tested conforms to a sub-category in the protocol consistency rule if the probability distribution of a certain category is greater than a specified threshold.

Therefore, through the existing sample database for base period learning, an optimized prediction model can be obtained through training. This model can predict any sample with a similar structure in the sample database to determine whether it conforms to the rules. If you need to expand it, you only need to increase the sample library under the corresponding classification and retrain without changing the software itself, which is highly scalable. The detected data comes from the interactive messages of the daily operation of the equipment, which greatly includes the application conditions of the equipment in various scenarios, improves the coverage of the test, and meets the requirements of massive message data in the daily use process. The message sample library of this detection method comes from the actual interaction scene in the user-collection system, including many terminal manufacturers, and the richness and randomness of the samples are sufficient to guarantee. The analysis and prediction model obtained through the training of the sample library is typical enough to represent the mainstream understanding methods of many manufacturers.

Description of drawings

A more complete understanding of the exemplary embodiments of the present invention can be had by referring to the following drawings:

FIG. 1 is a schematic flow diagram of an object-oriented protocol consistency problem location testing method described in this embodiment;

FIG. 2 is a schematic diagram of the data standardization model described in this embodiment;

FIG. 3 is a schematic diagram of data serialization described in this embodiment;

FIG. 4 is a schematic diagram of an object-oriented protocol conformance problem location testing system described in this embodiment.

Detailed ways

Exemplary embodiments of the present invention will now be described with reference to the drawings; however, the present invention may be embodied in many different forms and are not limited to the embodiments described herein, which are provided for the purpose of exhaustively and completely disclosing the present invention. invention and fully convey the scope of the invention to those skilled in the art. The terms used in the exemplary embodiments shown in the drawings do not limit the present invention. In the figures, the same units/elements are given the same reference numerals.

Unless otherwise specified, the terms (including scientific and technical terms) used herein have the commonly understood meanings to those skilled in the art. In addition, it can be understood that terms defined by commonly used dictionaries should be understood to have consistent meanings in the context of their related fields, and should not be understood as idealized or overly formal meanings.

According to a first aspect of the present invention, an object-oriented protocol conformance problem location testing method 100 is provided, as shown in FIG. 1 , the method 100 includes:

S101: Collect the interactive communication messages generated by the electricity consumption information collection system as original sample data to form an original sample library;

S102: read original sample data from the original sample library, and perform data standardization processing on the original sample data to form standard data;

S103: Based on a large amount of historical standard data records, form a standard sample library with the standard data containing all the characteristic factors of the message as the training samples, and carry out model training on the training samples according to the machine learning algorithm to determine the prediction model;

S104: Input the samples to be detected into the prediction model for abnormality detection, and output the detection results.

Specifically, including:

S1: Data preparation. By collecting the interactive communication messages generated by the power consumption information collection system every day, a message material library is formed.

S2: Data normalization. Analyze and process the original message material library, divide the frame structure of the message into attribute or method parameter units of a certain object according to the agreed rules in the "Protocol", and then generate the parameter unit according to the data type of each parameter unit eigenfactors to avoid feature loss due to differences in specific data content, and finally serialize all eigenfactors to form standard data.

S3: Train the analysis model. Based on a large amount of historical data records, a training sample library is formed with standard data containing all the characteristic factors of the message as samples, and the machine learning algorithm of the computer is used for model training.

S4: Abnormal data detection. When there is a message that needs to be detected, after the data standardization operation in step S2, the test sample library with standard data as samples is obtained. After inputting the anomaly detection analysis model, the detection conclusion and corresponding probability distribution are given.

Further, the frame structure analysis model of S2 in the step, as shown in Table 1,

Table 1

According to the provisions of the "Protocol", it can be divided into start character, length field, control field, address field, frame header check, link user data, frame check, end character. Among them, link user data can be further divided into different application service types according to the "Agreement".

Further, the training model of S3 in the above steps is defined as a random forest algorithm in integrated learning, which is a supervised learning algorithm based on if-then-else rules, which is highly explanatory and conforms to human intuitive thinking .

The basis of random forests is the decision tree algorithm, which is an algorithm for solving classification problems. It adopts a tree structure and uses layer-by-layer reasoning to achieve the final classification. A decision tree consists of the following elements:

Root node: contains the full set of samples

Internal node: Corresponding feature attribute test

Leaf node: represents the result of the decision

When predicting, judge with a certain attribute value at the internal node of the tree, and decide which branch node to enter according to the judgment result, until the leaf node is reached, and the classification result is obtained. A random forest is composed of many decision trees, and there is no correlation between different decision trees. The final prediction result of the random forest is the mode of the prediction results of many decision trees.

Detailed ways:

The present invention will be described in further detail in conjunction with the accompanying drawings and specific embodiments. Example:

S1: As shown in Figure 2, the software reads the original sample data DA1 from the original sample database. After the data standardization function module, the original sample DA1 is parsed into several parameter units PA1...PAn according to the frame structure. The marking rules of the parameter units follow ASN .1 abstract syntax, see GB/T16262.1-2006 for details. Following the abstract syntax rules of ASN.1, extract the characteristic factor Tm of the current parameter unit PAm. Tm is the specific data type of the current parameter unit. For detailed definitions, see the data type definition section in the "Protocol".

S2: After the feature factor is extracted from the original data, data serialization is required. The principle of serialization is defined according to the theoretical decision tree of the random forest algorithm, as shown in Figure 3, according to the order of the parsed structure of the message, a standard data flow is formed in a decision tree-like manner, as shown in Table 2:

Table 2

parameter unit 1 Parameter unit 2 Parameter unit... … Parameter unit N Eigenfactor 1 Characteristic factor 2 Characteristic factor… … Characteristic factor N

If it is detected that any parameter unit does not comply with the provisions of the "Agreement", the message is judged to be abnormal sample data and discarded.

S3: The process of training the model can be performed using the sklearn.ensemble.RandomForestRegressor() library in python. The main performance parameters of the RandomForestRegressor function:

max_features: The maximum number of features that a random forest allows a single decision tree to use.

n_estimators: Number of decision trees in the random forest.

min_sample_leaf: The minimum number of samples for leaf nodes.

This function returns a predictive model trained using training samples.

S4: Use the prediction model to detect the abnormality of the sample data to be tested. The prediction model provides an external interface function predict_proba(testdata), which returns a one-dimensional vector, which is the probability distribution of the testdata belonging to each category. When there is no classification category When the probability distribution of is greater than the specified threshold, it is determined that the test sample data is abnormal and does not conform to the protocol consistency rules. If the probability distribution of a certain category is greater than the specified threshold, it can be determined that the test sample data conforms to a subcategory in the protocol consistency rules.

Therefore, through the existing sample database for base period learning, an optimized prediction model can be obtained through training. This model can predict any sample with a similar structure in the sample database to determine whether it conforms to the rules. If you need to expand it, you only need to increase the sample library under the corresponding classification and retrain without changing the software itself, which is highly scalable. The detected data comes from the interactive messages of the daily operation of the equipment, which greatly includes the application conditions of the equipment in various scenarios, improves the coverage of the test, and meets the requirements of massive message data in the daily use process. The message sample library of this detection method comes from the actual interaction scene in the user-collection system, including many terminal manufacturers, and the richness and randomness of the samples are sufficient to guarantee. The analysis and prediction model obtained through the training of the sample library is typical enough to represent the mainstream understanding methods of many manufacturers.

Optionally, performing data standardization processing on the original sample data to form standard data, including:

Perform data standardization processing on the original sample data, and divide the frame structure of the message into the attribute of a certain object or the parameter unit of the method according to a predetermined rule;

According to the data type of the parameter unit, the characteristic factor of the parameter unit is generated, and all the characteristic factors are serialized to form standard data.

Optionally, the frame structure of the message is divided into attribute or method parameter units of a certain object according to predetermined rules, including:

According to the predetermined rules, the message is divided into a start character, a length field, a control field, an address field, a frame header check, a link user data, a frame check, a terminator, and a parameter unit that determines an attribute of an object or a method.

Optionally, generate the feature factor of the parameter unit according to the data type of the parameter unit, and serialize all the feature factors to form standard data, including:

Determining whether the parameter unit meets the predetermined specification, if the parameter unit meets the predetermined specification, generating a characteristic factor of the parameter unit, if the parameter unit does not meet the predetermined specification, judging that the message is abnormal sample data and discarding it;

After the original data is extracted and the characteristic factors are completed, a standard data stream is formed in a decision tree-like manner according to the order of the parsed structure of the message.

Optionally, the samples to be detected are input into the prediction model for anomaly detection, and the detection results are output, including:

Inputting the samples to be detected into the prediction model for anomaly detection, and determining the probability distribution that the samples to be detected belong to each category;

When the probability distribution of no arbitrary classification category is greater than the specified threshold, it is determined that the sample data to be detected is abnormal and does not conform to the protocol consistency rule;

If the probability distribution of a certain category is greater than the specified threshold, it can be determined that the sample data to be detected conforms to a subcategory in the protocol consistency rule.

Therefore, through the existing sample database for base period learning, an optimized prediction model can be obtained through training. This model can predict any sample with a similar structure in the sample database to determine whether it conforms to the rules. If you need to expand it, you only need to increase the sample library under the corresponding classification and retrain without changing the software itself, which is highly scalable. The detected data comes from the interactive messages of the daily operation of the equipment, which greatly includes the application conditions of the equipment in various scenarios, improves the coverage of the test, and meets the requirements of massive message data in the daily use process. The message sample library of this detection method comes from the actual interaction scene in the user-collection system, including many terminal manufacturers, and the richness and randomness of the samples are sufficient to guarantee. The analysis and prediction model obtained through the training of the sample library is typical enough to represent the mainstream understanding methods of many manufacturers.

According to another aspect of the present invention, an object-oriented protocol conformance problem location testing system 400 is also provided. Referring to FIG. 4, the system 400 includes:

Form an original sample library module 410, which is used to collect the interactive communication messages generated by the electricity consumption information collection system as original sample data to form an original sample library;

Forming a standard data module 420, which is used to read original sample data from the original sample library, perform data standardization processing on the original sample data, and form standard data;

Determine the prediction model module 430, which is used to form a standard sample library based on a large amount of historical standard data records with standard data containing all feature factors of the message as training samples, and perform model training on the training samples according to machine learning algorithms, and determine predictive model;

The detection result output module 440 is configured to input the samples to be detected into the prediction model for anomaly detection, and output the detection result.

Optionally, form a standard data module, including:

Divide into parameter unit sub-modules, which are used to perform data standardization processing on the original sample data, and divide the frame structure of the message into parameter units of attributes or methods of a certain object according to predetermined rules;

A standard data sub-module is formed, which is used to generate characteristic factors of the parameter unit according to the data type of the parameter unit, and all characteristic factors are serialized to form standard data.

Optionally split into parameter unit submodules, including:

Determine the parameter unit, which is used to divide the message into start character, length field, control field, address field, frame header check, link user data, frame check, end character according to predetermined rules, and determine the attributes of an object Or the parameter unit of a method.

Optionally, form standard data submodules, including:

judging the parameter unit, used to determine whether the parameter unit conforms to the predetermined specification, if the parameter unit conforms to the predetermined specification, generate the characteristic factor of the parameter unit, if the parameter unit does not conform to the predetermined specification, determine that the message is abnormal sample data and discard;

A standard data flow unit is formed, which is used to form a standard data flow in a decision tree-like manner according to the order of the parsed structure of the message after the original data has been extracted to complete the eigenfactors.

Optionally, the output detection result module includes:

Determine the probability distribution sub-module, which is used to input the samples to be detected into the prediction model for anomaly detection, and determine the probability distribution that the samples to be detected belong to each category;

A sub-module for judging non-compliance is used for judging that the sample data to be detected is abnormal and does not conform to the protocol consistency rule when the probability distribution of any classification category is greater than the specified threshold;

The conformity determination sub-module is used to determine that the sample data to be tested conforms to a sub-category in the protocol consistency rule if the probability distribution of a certain category is greater than a specified threshold.

An object-oriented protocol conformance problem location testing system 400 in an embodiment of the present invention corresponds to an object-oriented protocol consistency problem location testing method 100 in another embodiment of the present invention, and will not be repeated here.

Those skilled in the art should understand that the embodiments of the present application may be provided as methods, systems, or computer program products. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein. The solutions in the embodiments of the present application can be realized by using various computer languages, for example, the object-oriented programming language Java and the literal translation scripting language JavaScript.

The present application is described with reference to flowcharts and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the present application. It should be understood that each procedure and/or block in the flowchart and/or block diagram, and a combination of procedures and/or blocks in the flowchart and/or block diagram can be realized by computer program instructions. These computer program instructions may be provided to a general purpose computer, special purpose computer, embedded processor, or processor of other programmable data processing equipment to produce a machine such that the instructions executed by the processor of the computer or other programmable data processing equipment produce a An apparatus for realizing the functions specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to operate in a specific manner, such that the instructions stored in the computer-readable memory produce an article of manufacture comprising instruction means, the instructions The device realizes the function specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions can also be loaded onto a computer or other programmable data processing device, causing a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process, thereby The instructions provide steps for implementing the functions specified in the flow chart or blocks of the flowchart and/or the block or blocks of the block diagrams.

While preferred embodiments of the present application have been described, additional changes and modifications to these embodiments can be made by those skilled in the art once the basic inventive concept is appreciated. Therefore, the appended claims are intended to be construed to cover the preferred embodiment and all changes and modifications which fall within the scope of the application.

Obviously, those skilled in the art can make various changes and modifications to the application without departing from the spirit and scope of the application. In this way, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalent technologies, the present application is also intended to include these modifications and variations.

Claims (10)

1. The object-oriented protocol consistency problem positioning test method is characterized by comprising the following steps:

collecting an interactive communication message generated by an electricity consumption information acquisition system as original sample data to form an original sample library;

reading original sample data from the original sample library, and performing data standardization processing on the original sample data to form standard data;

forming a standard sample library taking standard data containing all characteristic factors of a message as training samples based on massive historical standard data records, carrying out model training on the training samples according to a machine learning algorithm, and determining a prediction model;

and inputting the sample to be detected into the prediction model for abnormality detection, and outputting a detection result.

2. The method of claim 1, wherein performing data normalization processing on the raw sample data to form standard data comprises:

carrying out data standardization processing on the original sample data, and dividing the frame structure of the message into attribute of a certain object or parameter units of a method according to a preset rule;

and generating characteristic factors of the parameter unit according to the data type of the parameter unit, and serializing all the characteristic factors to form standard data.

3. The method according to claim 2, wherein the partitioning of the frame structure of the message into the attributes of an object or the parameter elements of the method according to a predetermined rule comprises:

the message is divided into a start symbol, a length field, a control field, an address field, a frame header check, link user data, a frame check and an end symbol according to a preset rule, and the attribute of an object or a parameter unit of a method is determined.

4. The method of claim 2, wherein generating the feature factors of the parameter unit according to the data type of the parameter unit, and serializing all feature factors to form the standard data comprises:

judging whether the parameter unit accords with a preset specification, if the parameter unit accords with the preset specification, generating a characteristic factor of the parameter unit, and if the parameter unit does not accord with the preset specification, judging that the message is abnormal sample data and discarding the message;

after the feature factors are extracted from the original data, a standard data stream is formed in a decision tree mode according to the analysis structure sequence of the message.

5. The method according to claim 1, wherein inputting the sample to be detected into the predictive model for abnormality detection and outputting the detection result comprises:

inputting a sample to be detected into the prediction model for abnormality detection, and determining probability distribution of the sample to be detected belonging to each category;

when the probability distribution of any classification category is not greater than a specified threshold, judging that the sample data to be detected is abnormal and does not accord with the protocol consistency rule;

if the probability distribution of a certain class is larger than a specified threshold, the sample data to be detected can be judged to accord with one sub-class in the protocol consistency rule.

6. An object-oriented protocol consistency problem location test system, comprising:

the original sample library forming module is used for collecting the interactive communication message generated by the electricity consumption information acquisition system as original sample data to form an original sample library;

the standard data forming module is used for reading original sample data from the original sample library, and carrying out data standardization processing on the original sample data to form standard data;

the prediction model determining module is used for forming a standard sample library taking standard data containing all characteristic factors of the message as training samples based on massive historical standard data records, performing model training on the training samples according to a machine learning algorithm, and determining a prediction model;

and the output detection result module is used for inputting the sample to be detected into the prediction model for abnormality detection and outputting a detection result.

7. The system of claim 6, wherein forming the standard data module comprises:

the sub-module is divided into parameter units, which is used for carrying out data standardization processing on the original sample data and dividing the frame structure of the message into parameter units of an attribute or a method of a certain object according to a preset rule;

and forming a standard data sub-module, which is used for generating characteristic factors of the parameter unit according to the data type of the parameter unit, and serializing all the characteristic factors to form standard data.

8. The system of claim 7, wherein the partitioning into parameter unit sub-modules comprises:

and the parameter determining unit is used for dividing the message into a start symbol, a length domain, a control domain, an address domain, a frame header check, link user data, a frame check and an end symbol according to a preset rule, and determining the attribute of an object or the parameter unit of a method.

9. The system of claim 7, wherein forming the standard data sub-module comprises:

the judging parameter unit is used for judging whether the parameter unit accords with a preset specification, generating a characteristic factor of the parameter unit if the parameter unit accords with the preset specification, and judging that the message is abnormal sample data and discarding the message if the parameter unit does not accord with the preset specification;

and forming a standard data stream unit, wherein the standard data stream unit is used for forming a standard data stream in a decision tree mode according to the analysis structure sequence of the message after the feature factors are extracted from the original data.

10. The system of claim 6, wherein the output test result module comprises:

the probability distribution determining sub-module is used for inputting a sample to be detected into the prediction model for abnormal detection and determining probability distribution of the sample to be detected belonging to each category;

the judging non-conforming sub-module is used for judging that the sample data to be detected is abnormal and does not conform to the protocol conforming rule when the probability distribution of any classification category is larger than a specified threshold value;

and the consistency judging sub-module is used for judging that the sample data to be detected accords with one sub-category in the protocol consistency rule if the probability distribution of one category is larger than a specified threshold value.

Images