CN1735091A - Protocol message analytic method and protocol message analytic system - Google Patents
Protocol message analytic method and protocol message analytic system Download PDFInfo
- Publication number
- CN1735091A CN1735091A CN 200410058081 CN200410058081A CN1735091A CN 1735091 A CN1735091 A CN 1735091A CN 200410058081 CN200410058081 CN 200410058081 CN 200410058081 A CN200410058081 A CN 200410058081A CN 1735091 A CN1735091 A CN 1735091A
- Authority
- CN
- China
- Prior art keywords
- message
- rule
- layer
- protocol
- bit stream
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
- 238000004458 analytical method Methods 0.000 title claims abstract description 37
- 238000000034 method Methods 0.000 claims abstract description 31
- 230000009471 action Effects 0.000 claims abstract description 27
- 230000008569 process Effects 0.000 claims abstract description 22
- 238000012545 processing Methods 0.000 claims description 37
- 239000000203 mixture Substances 0.000 claims description 15
- 238000002224 dissection Methods 0.000 claims description 9
- 239000012224 working solution Substances 0.000 claims description 9
- 238000011112 process operation Methods 0.000 claims description 4
- 230000001351 cycling effect Effects 0.000 claims description 3
- 238000012163 sequencing technique Methods 0.000 claims description 2
- 230000004048 modification Effects 0.000 abstract description 3
- 238000012986 modification Methods 0.000 abstract description 3
- 230000007423 decrease Effects 0.000 abstract 1
- 230000000875 corresponding effect Effects 0.000 description 23
- 238000012360 testing method Methods 0.000 description 9
- 230000006854 communication Effects 0.000 description 6
- 238000004891 communication Methods 0.000 description 5
- 230000008859 change Effects 0.000 description 4
- 230000008878 coupling Effects 0.000 description 4
- 238000010168 coupling process Methods 0.000 description 4
- 238000005859 coupling reaction Methods 0.000 description 4
- 238000001514 detection method Methods 0.000 description 3
- 239000012467 final product Substances 0.000 description 3
- 230000000694 effects Effects 0.000 description 2
- 238000010295 mobile communication Methods 0.000 description 2
- 230000003068 static effect Effects 0.000 description 2
- 101000911390 Homo sapiens Coagulation factor VIII Proteins 0.000 description 1
- 230000009286 beneficial effect Effects 0.000 description 1
- 230000001413 cellular effect Effects 0.000 description 1
- 230000002596 correlated effect Effects 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 230000004069 differentiation Effects 0.000 description 1
- 238000005516 engineering process Methods 0.000 description 1
- 238000005111 flow chemistry technique Methods 0.000 description 1
- 102000057593 human F8 Human genes 0.000 description 1
- 230000008676 import Effects 0.000 description 1
- 230000014759 maintenance of location Effects 0.000 description 1
- 238000013507 mapping Methods 0.000 description 1
- 238000005259 measurement Methods 0.000 description 1
- 229940047431 recombinate Drugs 0.000 description 1
- 230000006641 stabilisation Effects 0.000 description 1
- 238000011105 stabilization Methods 0.000 description 1
- 238000003860 storage Methods 0.000 description 1
- 239000002699 waste material Substances 0.000 description 1
Images
Landscapes
- Communication Control (AREA)
Abstract
This invention provides a analysis method and system for protocol information composed of some IEs. Wherein, the method comprises following steps: 1) dividing and selecting a set rule signs for control action from all logic control actions used in protocol analysis process, the control action comprises: positioning IE position, connecting and uniting IE, calculating, deciding and outputting the IE; 2) generating a general explainer to recognize the said rule signs; 3) setting rule database unit according to a exact protocol; 4) when receiving the bit stream, the said explainer reads rule statement from rule database, executes every control action set by rule sign, and completes the analysis. When the protocol changes, it needs just to modify the rule database unit instead of the said explainer; thereby, the invention decreases modification time and analysis difficulty.
Description
Technical field
The present invention relates to the analytic method of protocol message in the communications field and the resolution system of protocol message.
Background technology
In communication system, transmit leg will send content and send according to certain wireless communication protocol composition protocol message, and the recipient resolves the protocol message that receives according to identical wireless communication protocol, thereby obtain to send content.Wherein, protocol message comprises the standard agreement message of protocol specification definition and the custom protocol message of equipment vendor's exploitation.
Communications equipment manufacturer is when development equipment, need follow the tracks of and test the protocol message of equipment, by the communication process of observing these protocol messages and the detailed content that comprises thereof, the problem that can discovering device exists, and then weigh the height of stabilization of equipment performance.Also have, for common carrier, also need by the protocol message of following the tracks of and analysis is transmitted in network, thereby find out the problem that network exists, and then reach the effect that network performance is continued to optimize.
Wherein, protocol message is based on certain protocol, and message parse is to resolve the agreement that message adopted, and therefrom obtains the content of message.The message of employing same protocol can be finished the parsing of those message by a protocol message resolution system.
At present, prior protocols message parse system mainly contains two kinds of implementations.First kind of protocol message resolution system is a protocol resolving program fully, and the protocol analysis processing procedure all writes in the code of this protocol resolving program, promptly all realizes protocol analysis by program.At the agreement of specific format, the structure that the specific structure of definition is come mapping message in the middle of program.For the agreement of different editions, issue the protocol resolving program of corresponding version.
In the time need resolving, set in advance protocol resolving program, if when receiving protocol message to the message that adopts certain agreement, analysis program carries on an agreement, therefrom obtain corresponding message structure, and then obtain the content of this message, thereby realize parsing this protocol message.
When adopting above-mentioned protocol message resolution system and analytic method to carry out message parse, owing to when agreement is upgraded, must need to revise protocol resolving program, and need provide the corresponding protocols analysis program for different agreements, therefore the autgmentability of this protocol resolving program is poor, thereby makes the program development personnel need the written program size of code big and program maintainability is poor; And for the user of protocol message resolution system, operability is poor.Especially, along with the agreement upgrading is healed soon, therefore the code of modification protocol resolving program the more realizes that the difficulty that protocol message is resolved heals greatly.
Adopting second kind of protocol message resolution system is the mode that adopts protocol message structrual description module and protocol resolving program to combine.This protocol message resolution system adopts one group of protocol architecture description document to come the static structure of describing protocol message to form.
Usually, some kinds of type of messages are set in the agreement, and each message is made up of IE (information unit).And that IE is divided into is a variety of, we with length fix, the IE of fixed-site is referred to as fixedly IE, and will (refer to whether its IE occurs in message as condition IE (referring to that its IE value depends on the IE value of other IE in the same message), optional IE, need depend on the IE value of other IE in the same message) wait in other and the same message IE in addition to have the IE of dependence, be referred to as dynamic I E.
Above-mentioned protocol architecture description document is that every type message structure describing this agreement is formed, and described message structure comprises type and the composition of the composition of IE, every kind of IE, when this IE is dynamic I E, also need describe its dependence.
In fact, since the description that above-mentioned protocol message structrual description module is just static the structure of message form, so when resolving message, decision process to wherein dynamic I E must partly be finished by protocol resolving program, this has just caused protocol resolving program to be and certain consensus standard, or the coded system (TLV of the employing of certain consensus standard, CSN.1, ASN.1 etc.) be correlated with, under specific situation or even and a certain version of consensus standard be closely related, this has just caused when consensus standard is upgraded, and except upgrading protocol message structrual description module, need upgrade to protocol resolving program.
Can when receiving concrete protocol message, protocol resolving program be searched in protocol message structrual description module, determines earlier the type of this message, judge each the IE value that determine message by this type of message then, if obtain the content of this message; Otherwise protocol resolving program obtains each IE value according to the code that sets in advance in the program, thereby realizes the parsing to this protocol message.
Above-mentioned protocol message resolution system and method thereof mainly exist the parsing of protocol message and agreement that message is adopted to have correlation, make:
(1) changes when agreement, when changing such as the coded system of agreement, if coded system is when the CSN.1 mode of GSM (digital cellular mobile communication systems) changes to the ASN.1 mode of 3G (3-G (Generation Three mobile communication system)), the message structure describing module of dividing out according to original CSN.1 coded system can not be applicable to the protocol analysis under the ASN.1 coded system, and, original protocol resolving program also needs to remodify, when this just causes agreement to change, need the whole protocol message resolution system of upgrading.And, owing to need the program development personnel to remodify the code of protocol resolving program, so, not only increase program development personnel's workload, and need the parsing effect of the protocol resolving program after the test upgrading again, and then increased update time.That is to say, when agreement was upgraded, owing to need to upgrade whole protocol message resolution system, the difficulty of especially upgrading protocol resolving program was big, waste time and energy thereby make to upgrade the protocol message resolution system, and then cause the renewal speed of protocol message resolution system not go up the renewal speed of agreement.
(2) the protocol message resolution system is widely used in various field tests, at present, the protocol message resolution system that the tester adopts the developer to develop, carry out protocol test, when protocol variation or upgrading, also need former protocol message resolution system is returned to the developer, obtain amended protocol message resolution system and carry out the test of New Deal, because the modification time of protocol message resolution system is longer, therefore influenced whole test period.
Summary of the invention
The object of the present invention is to provide a kind of protocol message analytic method and protocol message resolution system, to solve in the prior art, because there is correlation in the agreement that message parse and message are adopted, make the protocol analysis more complicated, the technical problem that protocol analysis upgrading difficulty is big, the cycle is grown.
The invention discloses a kind of protocol message analytic method, described protocol message is made up of some information unit IE, may further comprise the steps:
1) from all logic control action that protocol message resolving is used, mark off the regular symbol of a cover expression control action, described control action comprises: locate the IE position from the bit stream of message, IE is connected merging, IE is carried out computing and judgement and output;
2) generate the general interpreter that to discern this socket gauge then symbol;
3) according to a concrete agreement rule base unit is set, described rule base unit is made up of rule statements, and described rule statements is made up of regular symbol, and described rule base unit is used for describing the message parse process of this each type of agreement;
4) when receiving the bit stream of described protocol message, described general interpreter reads rule statements from described rule base, and carry out the set control action of each regular symbol in each rule statements, to determine the type of described protocol message, and obtain each IE value in the described protocol message, thereby finish parsing to this message.
Wherein, the regular symbol that is provided with in the step 1) also comprises redirect rule symbol; Step 3) also comprises: described rule base unit is divided into several layers, and the redirect relation between layer and the layer is set, wherein each layer comprises the several rules statement, finishes a dissection process step to indicate described general interpreter.
In addition, also comprise step 3) and 4): a: described general interpreter obtains the configuration information of described rule base in advance, and described configuration information comprises the layer composition order of described rule base unit and the redirect relation between the layer.
General interpreter described in the step 4) is to concern the equivalent layer that finds in the described rule base unit according to the redirect between described layer composition order that obtains in advance and the layer, and reads the rule statements in the described layer.
Step 4) specifically comprises:
41) general interpreter carries out pretreatment operation to described bit stream, described pretreatment operation comprise to described bit stream carry out validity check, bit stream is cut apart and bit stream reconfigures processing, to obtain the bit stream of a full message;
42) determine the type of message of described bit stream;
43) according to the described rule base of described type of message index unit, search the structrual description of described type of message correspondence, thereby obtain the particular content of described message.
Step 42) specifically may further comprise the steps:
According to the indication of regular symbol, general interpreter intercepts the corresponding information bit of described bit stream;
Mate by described information bit and the message Rule of judgment that is arranged in the rule base unit, determine the type of this message.
Step 43) further comprising the steps of:
431) describe according to the message structure that finds, obtain the type of each IE of described message;
432) whether the type of judging described IE is fixedly during IE, if, then intercepting the corresponding information bit of described bit stream according to its length, the data that described information bit is represented are as the IE value of this IE correspondence; Otherwise the type of described IE is dynamic I E, and general interpreter obtains the IE value that described IE relies on according to the predefined analyzing step in rule base unit, obtains corresponding IE value in view of the above.
The above-mentioned regular symbol that IE is connected merging comprises:
The concatenate rule symbol is in order to the connection union operation of the IE that identifies two diverse locations;
The length scale then symbol has the IE of length mark in order to sign, is convenient to obtain complete IE information bit;
Regular symbol to IE carries out computing and judgement comprises:
The operation rule symbol, it comprises the arithmetic/logic rule;
The regular symbol of circulation sign: in order to the cycling of sign to rule statements;
Condition dependency rule symbol: in order to branch's decision operation of mark rule statement execution.
Also have, the regular symbol that in the step 1) IE is carried out computing and judgement comprises in order to the alternative rule symbol of the alternative operation of defined parameters and the rule searching symbol of defined parameter list being inquired about in order to sign;
Also comprise in the step 3): message element inquiry layer is set in the rule base unit, and message element inquiry layer is in order to preserve the variable that general interpreter obtains in resolving;
Step 4) also comprises: when general interpreter runs into variable, read message element inquiry layer, judge in the described message element inquiry layer whether have described variable, if then obtain described variate-value, otherwise preserve described variate-value.
Wherein: the regular symbol that is provided with in the step 1) comprises fault processing rule symbol, the processing operation when making a mistake in the resolving in order to be defined in;
Also comprise in the step 3): the fault processing layer is set in the rule base unit, and described fault processing layer is used to preserve general interpreter and runs into and carry out corresponding process operations when different wrong;
Step 4) also comprises: when general interpreter runs into mistake, obtain corresponding processing operation according to the fault processing layer.
The invention also discloses a kind of protocol message resolution system, comprising:
The rule base unit: it is made up of rule statements, described rule statements is made up of regular symbol, wherein, described regular symbol is abstract comes out from the bit stream of the message structure of described agreement and the logic control resolving action, and the dissection process process of described agreement is described in described rule base unit;
General interpreter, receive the bit stream of the protocol message that needs parsing, read the rule statements in the described rule base unit, discern the regular symbol in the described rule statements, and the information that obtains type of message and wherein comprise according to the indication of described regular symbol, thereby finish parsing to this message.
Described rule base unit also comprises:
Layer is described in the rule base configuration: be used for the composition layer of whole rule base unit is described, so that general interpreter obtains the sequencing of layer described in the described rule base unit, be convenient to protocol message and resolve;
The bit stream pretreatment layer: be used to indicate working solution to release device the bit stream that receives is carried out pretreatment operation, thus the bit stream of acquisition full message;
Message classification layer: be used to indicate working solution to release the corresponding information position that device reads described bit stream, mate fast, determine the type of message by the message Rule of judgment in described information bit and the described message classification layer;
Message structure is described layer: be used to indicate working solution to release device and search corresponding structrual description according to described type of message, obtain the particular content of message.
Compared with prior art, the present invention has the following advantages:
Protocol message resolution system of the present invention is provided with a rule base unit and a general interpreter, this rule base is made up of regular symbol, comprise the regular symbol of representing control action in the rule symbol, it is to divide from all logic control actions that protocol message resolving is used.Use rule base of the present invention unit that protocol data is described, can in rule statements, add and resolve the action indication, make that the everything in the protocol analysis process all is recorded in the middle of the rule base.Therefore rule base has comprised full details such as the form of various message in the agreement and protocol processes action, thereby when handling new agreement, only needs to import new rule base and get final product.And regular symbol is to divide from the binary code that all logic controls that protocol message resolving is used are moved, and no matter how agreement changes, and the regular symbol of binary code repressentation can not change usually.In resolving, general interpreter is the rule statements that the rule-oriented symbol combination forms, thus, when agreement changes, need not to revise general interpreter, only revise corresponding rule base unit and get final product, thereby reduce the time that the protocol message resolution system is revised, reduce the difficulty of protocol analysis, and the rule base unit can be arranged to textual form, and then reduce and revise protocol message and resolve difficulty.
In field tests, the protocol message resolution system that the tester adopts the developer to develop is resolved, and when protocol variation or upgrading, need not return the developer and remodify program code, the tester gets final product by revising the rule base unit, has shortened protocol message resolution system upgrade cycle.
Description of drawings
Fig. 1 is the structural representation sketch of protocol message resolution system of the present invention;
Fig. 2 is the structural representation of rule base unit;
Fig. 3 is the structural representation of general interpreter;
Fig. 4 the present invention is based on the Analytic principle flow chart that above-mentioned protocol message resolution system carries out protocol message;
Fig. 5 is the flow chart of initialization rule base unit in the resolving of protocol message of the present invention;
Fig. 6 is the flow chart of in the protocol message analytic method of the present invention the bit stream that receives being resolved;
Fig. 7 is the resolving embodiment of a concrete TSM agreement.
Embodiment
Below in conjunction with accompanying drawing, specify the present invention.
See also Fig. 1, it is for the structural representation sketch of protocol message resolution system of the present invention.This protocol message resolution system comprises rule base unit 1 and general interpreter 2.Wherein:
Rule base unit 1: it is made up of rule statements, described rule statements is made up of regular symbol, wherein, regular symbol is used for describing message structure and relevant logic control action, described action refer in the middle of the message parse process the judgement, redirect, connection etc. that must use; Rule statements is used for describing the concrete action of a certain resolving; And the dissection process process of described agreement is described in described rule base unit.
General interpreter 2, receive the bit stream of the protocol message that needs parsing, and described bit stream mated in rule base unit 1, go to extract wherein type of message and the information that comprises of this message thereof according to the indication in the rule base unit 1 simultaneously, to finish parsing to message.
No matter which kind of coded system is agreement adopt, in fact all be based on the parsing of bit stream (Bit stream), and agreement when upgrading, dividing the regular symbol that comes out from bit stream seldom can change, therefore make general interpreter 2 need not when agreement changes, to change, thereby avoid revising the trouble of the program code in the general interpreter 2, and then reduce the difficulty of protocol analysis and shortened the whole parsing time.
Wherein, the regular symbol of presentation logic control action of the present invention can be divided into following a few class:
(1) the locating rule symbol of IE position, location comprises absolute fix rule symbol and relative positioning rule symbol, and absolute fix rule symbol is in order to be identified at the IE of fixed-site in the message; And relative positioning rule symbol is in order to be identified at the relative positioning of the variable IE of message inner position;
(2) IE is connected the regular symbol of merging, comprising:
The concatenate rule symbol is in order to the connection union operation of the IE that identifies two diverse locations;
The length scale then symbol has the IE of length mark in order to sign, is convenient to obtain complete IE information bit;
(3) IE is carried out the regular symbol of computing and judgement, comprising:
The operation rule symbol, it comprises the arithmetic/logic rule, wherein arithmetical operation rule symbol in order to sign add, subtract, arithmetical operations such as multiplication and division, power; Logical operation rule symbol in order to sign with or etc. logical operation;
The regular symbol of circulation sign: in order to the cycling of sign to rule statements;
Condition dependency rule symbol: in order to branch's decision operation of mark rule statement execution;
Alternative rule symbol:, can be used to the input parameter value of the variate-value that obtains earlier as the rule statements of follow-up resolving in order to have defined the alternative operation of parameter;
Rule searching symbol: defined parameter list is inquired about in order to sign, such as value for measurement parameter, the different corresponding actual values of layer value are different, and in different message, all can use this parameter, therefore can utilize its layer value and actual value to make a parameter list, the layer that obtains it when us is during value, just can directly obtain the actual value of its correspondence by inquiring about described parameter list;
(4) the regular symbol of output function comprises:
Export regular symbol: in order to identifying different output functions, such as with the form output of bit stream or with 16 system outputs etc.;
(5) carry out the regular symbol of redirect, comprising:
Block mark rule symbol in order to identify the IE that does not have length mark, is convenient to obtain complete IE information bit;
Layer sign and redirect rule symbol: in order to have identified the skip operation between layered processing of operation and the layer;
(6) fault processing rule symbol: the processing operation when making a mistake in the resolving in order to be defined in.
Except the regular outer symbol of above-mentioned expression control action, the present invention has also defined and has explained regular symbol, explains by right rule statements, has strengthened the readability of rule base.
Regular symbol according to above-mentioned definition is provided with the rule base unit.Usually the treatment step according to the message parse process is divided into several layers with the rule base unit, and each layer comprises the several rules statement, finishes a dissection process step in order to indicate general interpreter.
See also Fig. 2, it is the layer composition structural representation of rule base unit 1.It is divided into following which floor: rule base configuration is described layer 11, bit stream pretreatment layer 12, message classification layer 13, message structure and is described layer 14, message element inquiry layer 15 and fault processing layer 16.Wherein:
In general interpreter 2 operations, read the configuration information that layer 11 is described in the rule base configuration earlier, described configuration information comprises the redirect relation between layer composition order and the layer; Go to read rule statements in the equivalent layer according to configuration information then, identification regular symbol is wherein finished corresponding parsing.In addition, general interpreter is according to the layer composition order of relevant rule base unit, and these rule base files are carried out initial work (comprise peel off comment statement, rule statements is carried out work such as syntax check).
Bit stream pretreatment layer 12: be used to indicate working solution to release 2 pairs of bit streams that receive of device and carry out pretreatment operation, thus the bit stream of acquisition full message; Wherein, preliminary treatment comprise to the validity of this bit stream check, to the dividing processing of this bit stream and reconfigure processing, make it to become an effective full message bit stream.
Message classification layer 13: be used to indicate working solution to release the corresponding information position that device 2 reads described bit stream,, determine the type of message by the quick coupling of described information bit and message Rule of judgment.In this layer, the bit stream corresponding protocols message that general interpreter 2 just can be determined the full message that receives is concrete which class message, finishes the judgement to type of message.
Message structure is described layer 14: be used to indicate working solution to release device 2 and search corresponding structrual description according to described type of message, obtain the particular content of message.Describe in the layer 14 at this message structure, the internal structure of pre-defined all message and detailed content, after the differentiation of finishing type of message, general interpreter 2 can be according to the type of message index messages structrual description layer 14 that obtains, search the structrual description part of this type of message, thereby finish parsing this message particular content.
Message element inquiry layer 15, the variate-value to indicate general interpreter 2 storages to obtain is beneficial in the follow-up resolving and can calls described variate-value again.
See also Fig. 3, it is a kind of structural representation of general interpreter 2.General interpreter is an interpreter, and this interpreter comprises: rule statements is obtained subelement 21, regular symbol obtains subelement 22, judgment sub-unit 23, priority subelement 24, regular symbol execution subelement 25.Wherein:
Rule statements is obtained subelement 21, is used for reading the rule statements of rule base unit 1;
The rule symbol obtains subelement 22: each the regular symbol that is used for obtaining from every the regular statement that reads described statement;
Judgment sub-unit 23: be used for detecting the rule statements that the reads judgement of whether having ready conditions, if unconditional judgement, then directly each the regular symbol in this rule statements is sent to priority subelement 24, if have ready conditions judgement, judge then whether described condition satisfies, if then each the regular symbol in the described rule statements is sent to the priority subelement, otherwise judge next bar rule statement;
The rule symbol is carried out subelement 25: be used for carrying out successively according to described priority the indication of described regular symbol, finish the parsing of this regular statement.
Reciprocal process between general interpreter 2 and the rule base unit 1 is the identifying to concrete regular symbol.For general interpreter 2, what it was not concerned about present parsing is any agreement, it just reads the rule statements in the middle of the rule base unit 1, identification regular symbol wherein, and bit being flow to line operate according to the indication of regular symbol, its result's output equally also is to finish by the indication of regular symbol.Therefore the general interpreter 2 in this system is the only general interpreters of rule-oriented symbol, it and concrete protocol-independent.
Based on above-mentioned disclosed protocol message resolution system, the present invention proposes a kind of protocol analysis method.See also Fig. 4, it is for the principle flow chart of protocol message analytic method of the present invention.Described protocol message is made up of some information unit IE, may further comprise the steps:
S110: from all logic control actions that protocol message resolving is used, mark off the regular symbol of a cover expression control action, described control action comprises: locate the IE position from the bit stream of message, IE is connected merging, IE is carried out computing and judgement;
S120: generate the general interpreter that to discern this socket gauge then symbol;
S130: according to a concrete agreement rule base unit is set, described rule base unit is made up of rule statements, and described rule statements is made up of regular symbol, and described rule base unit is used for describing the message parse process of this each type of agreement;
S140: when receiving the bit stream of described protocol message, described general interpreter reads rule statements from described rule base, and carry out the set control action of each regular symbol in each rule statements, to determine the type of described protocol message, and obtain each IE value in the described protocol message, thereby finish parsing to this message.
In step S110-step S130, be mainly used in the protocol analysis system that sets up.In order to improve the efficient of protocol analysis, in step 130, framework is handled in the layering that the rule base unit can also be set, and be about to the rule base unit and be divided into several layers, and the redirect that is provided with between layer and the layer concerns.Comprise the several rules statement in each layer, finish a dissection process step to indicate general interpreter, and utilize layer to finish being connected of dissection process step, when especially some have special format message in processing, improved protocol analysis efficient with the redirect relation between the layer.
Between step S130 and step S140, also can comprise: general interpreter obtains the configuration information of described rule base in advance, and described configuration information comprises the layer composition order of described rule base unit and the redirect relation between the layer.
In step S140, general interpreter is to concern the equivalent layer that finds in the described rule base unit according to the redirect between described layer composition order that obtains in advance and the layer, and reads the rule statements in the described layer.
By above-mentioned steps, can reduce execution in step, improve and carry out efficient.Below illustrate especially exemplified by example.
When in existing instrument (as K1205), resolving message,, be that good according to the rules flow processing order is carried out resolving (as: L1-＞L2-＞L3-＞L4) successively if according to traditional analytic method.And this instrument be applied on the Uu mouth (Air Interface between NodeB and UE air interface) carry out drive test the time, owing to there is special testing mobile phone, may be only when message parse need be through two steps (as: L1-＞L4), framework and redirect rule are handled in the layering that utilization sets in advance, in L1, set in advance when satisfying condition relation to the L4 redirect, when general interpreter runs to L1, can go to handle to the L4 layer automatically according to the indication of this redirect, improve the speed of resolving.
See also Fig. 5, it is the flow chart of initialization rule base unit in the resolving of protocol message of the present invention.Comprise:
Step 210: general interpreter 2 reads the content in the rule base configuration description layer 11, therefrom obtains the configuration information in this rule base unit 1, and described configuration information comprises the layer composition order of rule base unit 1 and the redirect between the layer concerns;
Step 220: the notes content that general interpreter 2 separates in rule base unit 1, format the rule statements in the described rule base unit 1;
Step 230: carry out the detection of rule statements grammer validity, when detection is not passed through, print error message, otherwise carry out step S140.
Process step S110-S130 is provided with the initial work of the rule base unit of protocol message protocol system and step 210-step 230, begins to receive bit stream and carries out the dissection process operation.Wherein:
The specific implementation of step S120: consult Fig. 6, it is the specific implementation flow chart that the protocol message that receives is resolved of the present invention.
S310: general interpreter 2 is according to the indication of regular symbol, described bit stream is carried out pretreatment operation, obtain the bit stream of full message, wherein, pretreatment operation comprises the validity check to the bit stream that receives, to the dividing processing of this bit stream and reconfigure processing, make it to become one effectively and the bit stream of full message;
S320: determine the type of message of described bit stream, comprising:
At first, according to the indication of regular symbol, the corresponding information bit of the general interpreter 2 described bit streams of intercepting;
Then, the quick coupling of the message Rule of judgment by described information bit and message classification layer 13, determine concrete type of message, the Rule of judgment of each type of message is kept in the message classification layer in advance in the agreement, the different information bits that obtain and all Rule of judgment of each type of message mate one by one, find condition all to mate the message stripe shape, be the type of message of this bit stream;
S330: describe layer 14 according to the message structure in the described rule base of the described type of message index unit 1, search the structrual description of described type of message, thereby obtain the particular content of described message.The message structure of all type of message correspondences sets in advance at message structure and describes in the layer 14 in the agreement, can obtain corresponding message content according to the type of message that obtains.
Below lift an example, specify from receiving a bit and flow to a concrete resolving that this bit stream is parsed its message content.And, bit stream is identified with 16 systems for better explanation.Receive following bit stream:
0A74809330384BC23D2323399458371028430A33834B34343F88
At first, carry out preliminary treatment, intercept or recombinate, obtain a complete message data bit stream according to the indication of bit stream pretreatment layer 12, as follows such as the bit stream of complete message data:
74809330384BC23D2323399458371028430A33834B34343F
Then, this bit stream is carried out the message classification;
According to the indication of message classification layer 13, the corresponding information bit of general interpreter 2 interceptings by the quick coupling of these information bits and message decision condition, is judged concrete type of message then.
Such as, obtain " 74 " this Byte, then with message decision condition coupling, that find to meet " 74 " is message " Handover Command ", promptly this message is a switching command message.
Then, carrying out message resolves in detail;
The particular type (" Handover Command ") of acquisition message afterwards, types value (0x74) according to it removes to search the message structure description layer 14 of this message correspondence again, indicate according to the rule of this part then, can realize detailed parsing, as obtain information such as switch reasons, switching purpose sub-district this switching command message.
Below be that a rule base unit 1 carries out layering and the object lesson that the redirect between the layer concerns is set, concrete steps comprise:
At first, regular unit is carried out layering, describe layer and the bit stream pretreatment layer except setting the rule base configuration, also be divided into four layers of acquisition of finishing message classification and message structure, see also Fig. 7, it is four-layer structure and graph of a relation thereof.
Ground floor Level1 is used to obtain the up-downgoing information of message, and judges whether the message into MPH, if then jump to the 4th layer of Level4; Otherwise, enter second layer Level2;
Second layer Level2 is used to obtain logic channel and PD (Protocol Discrimator) information, and judges whether to be non-standard L3 message, handles file if then enter into the 3rd layer of non-standard L3 of Level3; Otherwise, enter among the 3rd layer of Level3 standard L3 and handle in the file;
The 3rd layer of Level3 is divided into that non-standard L3 handles file and standard L3 handles file, and wherein, non-standard L3 handles file and is used for according to channel identification number and the concrete type of message of value of message types identification identification; Standard L3 handles file and is used for according to channel identification number, up-downgoing information and the concrete type of message of value of message types identification, and determines the detection file of one deck down according to PD information;
The 4th layer of Level4 is used for resolving message, acquired information territory according to type of message.
When protocol element 2 receives the TSM protocol message, will resolve according to following steps:
The first step: the processing of " L3-Level1 " sublayer.Data flow through " data preliminary treatment " process is at first retrieved in " L3-Level1 " sublayer, distinguish concrete " Mph_ message ", with two special " Ph_ message ", that is: PhDataReq and PhDataInd have obtained " the up-downgoing information " of these two Ph_ message simultaneously.If " Mph_ message " is then directly delivered in the corresponding message database in " L3-Level4 " sublayer and is resolved; If special " Ph_ message " is sent to " Level2 " sub-layer processes.
Second step: the processing of " L3-Level2 " sublayer.Partial data stream (actual is exactly two special P h_ message) through " L3-Level1 " sub-layer processes, retrieval via " L3-Level2 " sublayer, can distinguish " the L3 message " of carrying whether " standard L3RR message ", for " standard L3RR message ", need to judge obtain its " PD information ".
The 3rd step: the processing of " L3-Level3 " sublayer.Through the data flow of " L3-Level2 " sub-layer processes, whether be " standard L3RR message " according to it, deliver to respectively in " L3-Level3 " sublayer and retrieve in the corresponding database file, can determine its " message name ".
The 4th step: the processing of " L3-Level4 " sublayer.Through the data flow of " L3-Level3 " sub-layer processes, according to its " message name " and " PD information " thereof, deliver to respectively in " L3-Level4 " sublayer and retrieve in the corresponding database file, can parse the particular content of this message.What note is, the processing of this layer might need to table look-up, and the information of the table that all are used all is kept in the middle of the independent file (preset parameter table).
In the protocol analysis process, may make a mistake.The present invention is provided with fault processing fault mistake processing layer in the rule base unit, described fault processing layer is used to preserve general interpreter and runs into the different corresponding process operations of carrying out when wrong;
When general interpreter carries out the protocol message parsing,, can obtain respective operations according to the fault processing layer if run into mistake.
In order more to improve analytic efficiency, the present invention also is provided with message element inquiry layer in the rule base unit, and message element inquiry layer is in order to preserve the variable that general interpreter obtains in resolving;
When general interpreter carries out protocol message when resolving,, can read the rule statements of message element inquiry layer if when running into variable, judge in the described message element inquiry layer and whether have above-mentioned variable, if then obtain described variate-value, otherwise preserve described variate-value.The present invention is the record variable value in advance, when follow-up resolving is used above-mentioned variable, can conveniently call, and has avoided searching again the trouble of variable, has improved analytic efficiency.
More than disclosed only be several specific embodiment of the present invention, those skilled in the art can think variation, all should fall within the scope of protection of the present invention.
Claims (12)
1, a kind of protocol message analytic method, described protocol message is made up of some information unit IE, it is characterized in that: may further comprise the steps:
1) from all logic control action that protocol message resolving is used, mark off the regular symbol of a cover expression control action, described control action comprises: locate the IE position from the bit stream of message, IE is connected merging, IE is carried out computing and judgement and output;
2) generate the general interpreter that to discern this socket gauge then symbol;
3) according to a concrete agreement rule base unit is set, described rule base unit is made up of rule statements, and described rule statements is made up of regular symbol, and described rule base unit is used for describing the message parse process of this each type of agreement;
4) when receiving the bit stream of described protocol message, described general interpreter reads rule statements from described rule base, and carry out the set control action of each regular symbol in each rule statements, to determine the type of described protocol message, and obtain each IE value in the described protocol message, thereby finish parsing to this message.
2, protocol message analytic method as claimed in claim 1 is characterized in that,
The regular symbol that is provided with in the step 1) also comprises redirect rule symbol;
Step 3) also comprises: described rule base unit is divided into several layers, and the redirect relation between layer and the layer is set, wherein each layer comprises the several rules statement, finishes a dissection process step to indicate described general interpreter.
3, protocol message analytic method as claimed in claim 2 is characterized in that, step 3) and 4) between also comprise:
A: described general interpreter obtains the configuration information of described rule base in advance, and described configuration information comprises the layer composition order of described rule base unit and the redirect relation between the layer.
4, protocol message analytic method as claimed in claim 3, it is characterized in that, general interpreter described in the step 4) is to concern the equivalent layer that finds in the described rule base unit according to the redirect between described layer composition order that obtains in advance and the layer, and reads the rule statements in the described layer.
5, as claim 1 or 4 described protocol message analytic methods, it is characterized in that step 4) specifically comprises:
41) general interpreter carries out pretreatment operation to described bit stream, described pretreatment operation comprise to described bit stream carry out validity check, bit stream is cut apart and bit stream reconfigures processing, to obtain the bit stream of a full message;
42) determine the type of message of described bit stream;
43) according to the described rule base of described type of message index unit, search the structrual description of described type of message correspondence, thereby obtain the particular content of described message.
6, protocol message analytic method as claimed in claim 5 is characterized in that step 42) specifically may further comprise the steps:
According to the indication of regular symbol, general interpreter intercepts the corresponding information bit of described bit stream;
Mate by described information bit and the message Rule of judgment that is arranged in the rule base unit, determine the type of this message.
7, protocol message analytic method as claimed in claim 5 is characterized in that step 43) further comprising the steps of:
431) describe according to the message structure that finds, obtain the type of each IE of described message;
432) whether the type of judging described IE is fixedly during IE, if, then intercepting the corresponding information bit of described bit stream according to its length, the data that described information bit is represented are as the IE value of this IE correspondence; Otherwise the type of described IE is dynamic I E, and general interpreter obtains the IE value that described IE relies on according to the predefined analyzing step in rule base unit, obtains corresponding IE value in view of the above.
8, protocol message analytic method as claimed in claim 1 or 2 is characterized in that,
The regular symbol that IE is connected merging comprises:
The concatenate rule symbol is in order to the connection union operation of the IE that identifies two diverse locations;
The length scale then symbol has the IE of length mark in order to sign, is convenient to obtain complete IE information bit;
Regular symbol to IE carries out computing and judgement comprises:
The operation rule symbol, it comprises the arithmetic/logic rule;
The regular symbol of circulation sign: in order to the cycling of sign to rule statements;
Condition dependency rule symbol: in order to branch's decision operation of mark rule statement execution.
9, protocol message analytic method as claimed in claim 8 is characterized in that,
The regular symbol that in the step 1) IE is carried out computing and judgement comprises in order to the alternative rule symbol of the alternative operation of defined parameters and the rule searching symbol defined parameter list inquired about in order to sign;
Also comprise in the step 3): message element inquiry layer is set in the rule base unit, and message element inquiry layer is in order to preserve the variable that general interpreter obtains in resolving;
Step 4) also comprises: when general interpreter runs into variable, read message element inquiry layer, judge in the described message element inquiry layer whether have described variable, if then obtain described variate-value, otherwise preserve described variate-value.
10, protocol message analytic method as claimed in claim 2 is characterized in that,
The regular symbol that is provided with in the step 1) comprises fault processing rule symbol, the processing operation when making a mistake in the resolving in order to be defined in;
Also comprise in the step 3): the fault processing layer is set in the rule base unit, and described fault processing layer is used to preserve general interpreter and runs into and carry out corresponding process operations when different wrong;
Step 4) also comprises: when general interpreter runs into mistake, obtain corresponding processing operation according to the fault processing layer.
11, a kind of protocol message resolution system is characterized in that, comprising:
The rule base unit: it is made up of rule statements, described rule statements is made up of regular symbol, wherein, described regular symbol is abstract comes out from the bit stream of the message structure of described agreement and the logic control resolving action, and the dissection process process of described agreement is described in described rule base unit;
General interpreter, receive the bit stream of the protocol message that needs parsing, read the rule statements in the described rule base unit, discern the regular symbol in the described rule statements, and the information that obtains type of message and wherein comprise according to the indication of described regular symbol, thereby finish parsing to this message.
12, the resolution system of protocol message as claimed in claim 11 is characterized in that, described rule base unit also comprises:
Layer is described in the rule base configuration: be used for the composition layer of whole rule base unit is described, so that general interpreter obtains the sequencing of layer described in the described rule base unit, be convenient to protocol message and resolve;
The bit stream pretreatment layer: be used to indicate working solution to release device the bit stream that receives is carried out pretreatment operation, thus the bit stream of acquisition full message;
Message classification layer: be used to indicate working solution to release the corresponding information position that device reads described bit stream, mate fast, determine the type of message by the message Rule of judgment in described information bit and the described message classification layer;
Message structure is described layer: be used to indicate working solution to release device and search corresponding structrual description according to described type of message, obtain the particular content of message.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN200410058081A CN100591070C (en) | 2004-08-12 | 2004-08-12 | Protocol message analytic method and protocol message analytic system |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN200410058081A CN100591070C (en) | 2004-08-12 | 2004-08-12 | Protocol message analytic method and protocol message analytic system |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN1735091A true CN1735091A (en) | 2006-02-15 |
| CN100591070C CN100591070C (en) | 2010-02-17 |
Family
ID=36077286
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN200410058081A Active CN100591070C (en) | 2004-08-12 | 2004-08-12 | Protocol message analytic method and protocol message analytic system |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN100591070C (en) |
Cited By (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2007140703A1 (en) * | 2006-06-07 | 2007-12-13 | Huawei Technologies Co., Ltd. | Method and apparatus of rsvp node interactive |
| CN101651683A (en) * | 2009-08-28 | 2010-02-17 | 重庆重邮东电通信技术有限公司 | Method for generating analysis source code of signaling message |
| CN108494752A (en) * | 2018-03-09 | 2018-09-04 | 万帮充电设备有限公司 | A kind of analysis method and device of agreement |
| CN112448971A (en) * | 2019-08-29 | 2021-03-05 | 中科云谷科技有限公司 | Data analysis platform, data analysis method and storage medium |
Family Cites Families (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US6708310B1 (en) * | 1999-08-10 | 2004-03-16 | Sun Microsystems, Inc. | Method and system for implementing user-defined codeset conversions in a computer system |
| CN1152515C (en) * | 2001-06-21 | 2004-06-02 | 华为技术有限公司 | Network management system based on strategy |
-
2004
- 2004-08-12 CN CN200410058081A patent/CN100591070C/en active Active
Cited By (9)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2007140703A1 (en) * | 2006-06-07 | 2007-12-13 | Huawei Technologies Co., Ltd. | Method and apparatus of rsvp node interactive |
| CN101087221B (en) * | 2006-06-07 | 2010-12-08 | 华为技术有限公司 | Resource reservation protocol node and its interaction method |
| US7852770B2 (en) | 2006-06-07 | 2010-12-14 | Huawei Technologies Co., Ltd. | Method and apparatus for interaction among resource reservation protocol nodes |
| CN101651683A (en) * | 2009-08-28 | 2010-02-17 | 重庆重邮东电通信技术有限公司 | Method for generating analysis source code of signaling message |
| CN101651683B (en) * | 2009-08-28 | 2014-07-23 | 重庆重邮东电通信技术有限公司 | Method for generating analysis source code of signaling message |
| CN108494752A (en) * | 2018-03-09 | 2018-09-04 | 万帮充电设备有限公司 | A kind of analysis method and device of agreement |
| CN108494752B (en) * | 2018-03-09 | 2021-03-16 | 万帮星星充电科技有限公司 | Protocol analysis method and device |
| CN112448971A (en) * | 2019-08-29 | 2021-03-05 | 中科云谷科技有限公司 | Data analysis platform, data analysis method and storage medium |
| CN112448971B (en) * | 2019-08-29 | 2024-01-23 | 中科云谷科技有限公司 | Data analysis platform, data analysis method and storage medium |
Also Published As
| Publication number | Publication date |
|---|---|
| CN100591070C (en) | 2010-02-17 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN1310488C (en) | System and method for bi-directional communication of mobile phone | |
| CN1752934A (en) | Compiler, compilation method, and compilation program | |
| CN1896992A (en) | Method and device for analyzing XML file based on applied customization | |
| CN1767453A (en) | Automatic test method and system | |
| CN1655118A (en) | Processor and compiler | |
| CN1956394A (en) | Method and device for service configuration of network equipment | |
| CN1859359A (en) | Realizing method and its device for communication protocol described by abstract grammar rule | |
| CN1934565A (en) | Machine translation system, machine translation method, and program | |
| CN1526104A (en) | Parsing structured data | |
| CN1828591A (en) | Command-line data-type discovery and conversion | |
| CN1859196A (en) | Telecommunication field network data acquisition processing system based on rule and realizing method | |
| CN101051965A (en) | Device and method for forming topological map and detecting topological structure | |
| CN1790957A (en) | Apparatus testing method | |
| CN1719786A (en) | Automatic testing system and method for command of command line interface of data communication apparatus | |
| CN1260993C (en) | Collection of internal infor mation of mobile communication terminal by external module | |
| CN1950819A (en) | A system and method for retrieving information and a system and method for storing information | |
| CN101047555A (en) | Detection method for quality of equipment | |
| CN1744092A (en) | Method and system for automatic schedule logic simulation and code coverage rate analysis | |
| CN1525323A (en) | Processor and compiler for creating program for the processor | |
| CN1735091A (en) | Protocol message analytic method and protocol message analytic system | |
| CN1900910A (en) | Identifying method of multiple target branch statement through jump list in binary translation | |
| CN1862267A (en) | Method for checking circuit schematic diagram | |
| CN1960367A (en) | Method for associating general multiple protocols | |
| CN101056210A (en) | An event processing system and method of network central management platform | |
| CN1314030A (en) | Radio receiving device and diffusion code identification method |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C14 | Grant of patent or utility model | ||
| GR01 | Patent grant | ||
| ASS | Succession or assignment of patent right |
Owner name: INST OF TELECOMMUNICATION SCIENCE AND TECHNOLGOY Free format text: FORMER OWNER: DATANG MOBILE COMMUNICATION EQUIPMENT CO., LTD. Effective date: 20110523 |
|
| C41 | Transfer of patent application or patent right or utility model | ||
| TR01 | Transfer of patent right |
Effective date of registration: 20110523 Address after: 100083 No. 40, Haidian District, Beijing, Xueyuan Road Patentee after: CHINA ACADEMY OF TELECOMMUNICATIONS TECHNOLOGY Address before: 100083 No. 40, Haidian District, Beijing, Xueyuan Road Patentee before: DATANG MOBILE COMMUNICATIONS EQUIPMENT Co.,Ltd. |
|
| CP01 | Change in the name or title of a patent holder |
Address after: 100083 No. 40, Haidian District, Beijing, Xueyuan Road Patentee after: CHINA ACADEMY OF TELECOMMUNICATIONS TECHNOLOGY Address before: 100083 No. 40, Haidian District, Beijing, Xueyuan Road Patentee before: CHINA ACADEMY OF TELECOMMUNICATIONS TECHNOLOGY |
|
| CP01 | Change in the name or title of a patent holder | ||
| TR01 | Transfer of patent right |
Effective date of registration: 20210617 Address after: 100085 1st floor, building 1, yard 5, Shangdi East Road, Haidian District, Beijing Patentee after: DATANG MOBILE COMMUNICATIONS EQUIPMENT Co.,Ltd. Address before: 100083 No. 40, Haidian District, Beijing, Xueyuan Road Patentee before: CHINA ACADEMY OF TELECOMMUNICATIONS TECHNOLOGY |
|
| TR01 | Transfer of patent right |