An automatic identification method of industrial control equipment based on tcp/ip fingerprint

Abstract

The invention provides an industrial control equipment automatic identification method based on a TCP / IP fingerprint, and the method is characterized in that the method mainly comprises the steps: 1,collecting the features of a communication port; step 2, extracting TCP / IP head features; 3, generating a device fingerprint; step 4, carrying out equipment type prediction; and step 5, carrying out equipment subtype prediction.

Description

technical field [0001] The invention relates to an automatic identification method, in particular to an automatic identification method for industrial control equipment based on TCP / IP fingerprints. Background technique [0002] The concept of "private network, physical isolation" of industrial control network is gradually broken. In order to achieve collaboration and information sharing between systems, more and more industrial control systems begin to use common Ethernet protocol standards for communication, and are even directly exposed to the Internet. The inherent vulnerabilities and attack surfaces of industrial control systems are increasing day by day. As industrial control systems become more open and interconnected, they will also face traditional network security threats such as viruses and malicious intrusions. [0003] The premise of ensuring the security of the industrial control system is to know the detailed information of various devices that make up the sy...

AI Technical Summary

Problems solved by technology

[0005] Existing device identification solutions either lack support for industrial control devices or lack general scalability

Images