VT Log Analyzer Tool (v2.1) – .vtl Parsing & Anomaly Detection

The VT Log Analyzer Tool (v2.1) operates on binary or ASCII-encoded .vtl log files—captured traces of real-world or simulated ISOBUS VT communications between a Virtual Terminal (e.g., in a tractor cab) and implement ECUs. Internally, it reconstructs the VT object pool, parses Object Pool Descriptors (OPDs), monitors dynamic object updates (e.g., button presses, variable changes, screen transitions), and validates message sequencing against ISO 11783-6 state machines (e.g., proper use of VT_UPDATE_OBJECTS, VT_SET_ATTRIBUTE, and VT_GET_ATTRIBUTE_RESPONSE). Anomaly detection combines deterministic rule engines (e.g., 'a VT_DELETE_OBJECT must reference an existing object ID') with time-series heuristics (e.g., outlier detection in inter-message latency or object update frequency) and finite-state validation (e.g., illegal transitions from 'Screen Displayed' to 'Object Deleted' without intermediate 'Screen Cleared'). The tool further supports customizable detection profiles—such as 'Certification Mode' (strict ISO conformance) or 'Debug Mode' (verbose event correlation)—and exports annotated logs in JSON, CSV, and interactive HTML formats. Its architecture is modular: parser layer handles byte-level decoding of CAN frames and VT-specific PDUs; semantic layer interprets object lifecycle and attribute semantics; and analytics layer applies temporal, logical, and statistical models to flag inconsistencies like stale object references, duplicate object IDs, or unsolicited VT messages violating master-slave role constraints.