Industrial control protocol message classification method and system based on dialogue analysis

Abstract

The invention discloses an industrial control protocol message classification method based on dialogue analysis. The method comprises the following steps: acquiring a plurality of dialogue messages including request messages and response messages from an industrial control network; comparing a request message and a response message in each dialogue message by using a sequence comparison algorithm to obtain an alignment request message and an alignment response message corresponding to the dialogue message, and for each dialogue message, comparing the alignment request message and the alignment response message corresponding to the dialogue message byte by byte to generate a state sequence corresponding to the dialogue messages, and sorting all the dialogue messages according to the state sequence corresponding to all the dialogue messages to obtain a plurality of sorted dialogue messages; and for the plurality of dialogue messages after sorting, taking out each dialogue message in sequence. The technical problem that the category identifier in the industrial control protocol message is difficult to extract by the existing message classification method based on the frequent sequence and the message classification method based on the clustering algorithm can be solved.

Description

technical field [0001] The invention belongs to the technical field of industrial control network, and more specifically relates to a method and system for classifying industrial control protocol messages based on dialogue analysis. Background technique [0002] Industrial control protocol, that is, the communication specification used between nodes in the industrial control network. Compared with traditional network protocols, most of the existing industrial control protocols are private protocols formulated by industrial control equipment manufacturers themselves, which have the characteristics of high availability, low cost, low delay, easy analysis, and high efficiency. The confidentiality requirements are low, and the security guarantee relies on physical isolation. However, with the development of Internet technology, the trend of informatization, automation, and intelligence has gradually penetrated into the field of production and manufacturing. More and more indust...

AI Technical Summary

Problems solved by technology

[0005] Aiming at the above defects or improvement needs of the prior art, the present invention provides a method and system for classifying industrial control protocol messages based on dialogue analysis. All the packet classification methods are difficult to extract the technical problems of category identification in industrial control protocol packets, and the existing packet classification methods based on clustering algorithms are difficult to extract category features from a single industrial control protocol packet, and due to the need to calculate all The distance or similarity between any two messages in the message, resulting in very time-consuming technical problems

Images