Enterprise AI Analysis

PMDL Syntax Design and Extensibility

PMDL utilizes XML for its rigorous structuring, hierarchical depth, and extensibility, crucial for modeling complex protocol architectures. It defines basic fields with key-value attributes (name, type, length, offset, export) and structured fields (switch, if, for, while) to handle complex flow control logic.

PMDL also provides robust extensibility for difficult-to-describe fields or structures:

• Custom Attributes: Introduces external program processing logic for specialized field processing (e.g., endianness conversion, bitwise operations) while maintaining basic parsing.
• Custom Fields: Allows introduction of external parsing programs for fields that do not conform to standard PMDL processing logic, such as DNS domain name compression.

This design ensures PMDL can describe proprietary or specialized structures effectively, making it highly adaptable to evolving protocol standards and complex network environments.

PMDL Execution Engine Design

The PMDL execution engine overcomes traditional parsing limitations by employing a memory-resident protocol template that encapsulates PMDL description logic, enabling dynamic updates without recompilation. It consists of three core modules:

• Construction Module: Instantiates protocol templates from PMDL descriptions and manages them in a centralized repository, monitoring PMDL files for real-time updates.
• Parsing Module: Performs dynamic parsing by reading byte streams, applying protocol template information, and generating a temporary result chain.
• Export Module: Serializes parsing results from the temporary chain into a user-defined JSON format, facilitating integration with upper-layer analytical applications.

The engine uses an on-demand loading strategy for templates and a read-write lock mechanism for concurrency control, ensuring high performance, dynamic extensibility, and consistency during updates. This architecture provides unambiguous, on-the-fly protocol adaptation essential for complex network environments.

Experimental Analysis and Verification

Experiments were conducted to verify PMDL's validity, simplicity, and correctness against real-world protocols like Ethernet, IPv4, TCP, HTTP, MySQL, and DNS, using a 10 Gbps campus network dataset. Performance was benchmarked against Wireshark, Kelai, Nail, and BIND.

• Validity Verification: PMDL effectively described complex protocol structures and custom fields (e.g., DNS domain name compression) through external processing logic, demonstrating its comprehensive expressiveness.
• Simplicity Verification: PMDL descriptions required significantly fewer Lines of Code (LOC) compared to Wireshark's C implementations (LOC ratio from 39 to 130), greatly reducing development and maintenance overhead.
• Correctness Verification: The execution engine accurately parsed fields and generated correct output results for various structural fields, matching Wireshark's outputs.
• Performance Analysis: While PMDL showed some throughput overhead compared to pre-compiled tools like Nail (23.08% lower for DNS), it significantly outperformed BIND and achieved throughput comparable to or exceeding Wireshark with multi-threading (2-4 threads). CPU and memory usage were competitive, demonstrating an effective balance between performance and dynamic flexibility.

Overall, PMDL meets the throughput requirements for large-scale security analysis while offering superior extensibility and semantic clarity.