State machine inference method and system for industrial private protocol

Abstract

The present application relates to the technical field of network, in particular to a state machine inference method and system for industrial control private protocol, collecting industrial control device related protocol data packets and preprocessing the data packets to extract data packet message content and time stamp related to the target protocol and build a message sequence; according to the message sequence, the message content length and the request response message length are obtained, the protocol message type is labeled according to the request response message length, and the message type label and the corresponding message are stored by using the labeled dictionary; according to the time stamp in the message sequence, the labeled message type is sorted, the transition relationship between different states of the protocol is determined based on the adjacent message types in time, and the protocol state machine is constructed according to the transition relationship between the states; according to the protocol state machine, the same type protocol message is replayed to the industrial control device, and the abnormal state transition in the protocol state is determined and removed according to the response of the industrial control device. The present application can improve the overall performance and efficiency of protocol inference.

Description

Technical Field

[0001] The present invention relates to the field of network technology, and in particular to a state machine inference method and system for industrial control private protocols. Background Art

[0002] A protocol state machine is the interaction between protocol entities, a model that describes the relationships between protocols by transitioning between protocol states through certain behavioral characteristics. It often exhibits a graph or tree structure, with nodes representing states and edges between adjacent nodes representing different types of message fragments. Protocol state machine inference involves analyzing the behavior of a system or protocol to infer its internal state machine structure and rules. This is crucial in computer science and network security, particularly in areas such as protocol analysis, system verification, vulnerability detection, and performance optimization. Protocol state machine inference methods can be categorized as active and passive. Active inference involves inferring the state machine by sending specific inputs or requests to the system and observing its responses. Common methods include fuzz testing and protocol testing. Passive inference involves observing the interactions and behavior of the system during normal operation. Common methods include log analysis and traffic analysis. Because the formats of proprietary industrial control protocols are unknown, generating effective test cases for active inference is difficult. Therefore, state machine inference methods for industrial control protocols are typically performed passively. At present, the mainstream method is to use sequence alignment, statistical analysis, frequent item mining and other technologies to find state-related fields in protocol messages for state annotation, and then build a prefix tree to infer the protocol state machine based on the temporal relationship between the transitions between states.

[0003] Each byte, or even each bit, in existing industrial protocols has a different function and meaning. Furthermore, the functionality of some protocols is determined by multiple interrelated fields. These protocol messages often lack separators, which poses a challenge to current methods (such as sequence alignment, statistical analysis, and frequent item mining), making it impossible to accurately identify state-related fields used for state marking. Furthermore, industrial protocols need to generate a large amount of interactive data in a short period of time to transmit control information and monitoring data in a timely manner. However, when constructing a protocol state machine using a prefix tree structure, a large number of sessions may cause the prefix tree to be too large, requiring a large number of comparison operations during the state machine optimization phase. This significantly increases the time required for state machine inference, affecting the overall performance and efficiency of the system. Therefore, there is an urgent need for a method that can accurately label protocol states when the industrial control protocol format is unknown, in order to improve the performance and inference efficiency of the protocol state machine. Summary of the Invention

[0004] To this end, the present invention provides a state machine inference method and system for industrial control private protocols to solve the problems of the inability to accurately label the protocol state and the low efficiency of protocol state inference in the existing protocol state machine inference process.

[0005] According to the design scheme provided by the present invention, on the one hand, a state machine inference method for industrial control private protocols is provided, comprising:

[0006] Collecting industrial control equipment related protocol data packets and preprocessing the data packets to extract the data packet message content and timestamp related to the target protocol through preprocessing, and constructing a message sequence based on the message content and timestamp;

[0007] Obtain the message content length and request and response message length according to the message sequence, label the protocol message type according to the request and response message length, and use the labeling dictionary to store the message type label and the corresponding message. The key in the labeling dictionary is the labeled message type label, and the value is all request and response messages corresponding to the message type label.

[0008] Sort the marked message types according to the timestamps in the message sequence, determine the transition relationship between different protocol states based on the temporally adjacent message types, and construct a protocol state machine based on the transition relationship between the states;

[0009] The same type of protocol message is replayed to the industrial control device according to the protocol state machine, and the abnormal state transition in the protocol state is determined and removed according to the response of the industrial control device.

[0010] As a state machine inference method for industrial control private protocols of the present invention, further, collecting industrial control equipment protocol data packets includes:

[0011] The interaction data packets between the programming software and industrial control equipment in the target area are captured from the real industrial control environment, and public protocol data packets are collected from the Internet. The captured interaction data packets and the collected public protocol data packets are used as industrial control equipment-related protocol data packets.

[0012] As a state machine inference method for industrial control private protocols of the present invention, further, pre-processing of data packets includes:

[0013] The packet quadruple is used to filter out the packets unrelated to the target protocol from the industrial control equipment related protocol packets, and the remaining packets in the industrial control equipment related protocol packets are regarded as the packets related to the target protocol, and the message content and timestamp in the packets related to the target protocol are extracted.

[0014] As a state machine inference method for industrial control private protocols of the present invention, further, a tag dictionary is used to store message type tags and corresponding messages, including:

[0015] Initialize the status annotation dictionary, generate a message type tag based on the request message length and the response message length, if the message type tag does not exist in the status annotation dictionary, add the message type tag to the status annotation dictionary, and set the key corresponding value in the status annotation dictionary to an empty list, add the request message and response message to the message type tag corresponding list, and traverse the next pair of request and response messages until the request and response message traversal is completed to obtain the status annotation dictionary.

[0016] As a state machine inference method for industrial control private protocols of the present invention, further, a protocol state machine is constructed according to the transition relationship between states, including:

[0017] The message type is used as the driving condition for state transition. The protocol state machine is generated according to the state transition driving principle and a directed graph structure. The state transition driving principle includes: the same message type causes the protocol to enter the same state, and different message types cause the protocol to enter different states.

[0018] As a state machine inference method for industrial control private protocols of the present invention, further, constructing a protocol state machine according to the transition relationship between states also includes:

[0019] Initialize the protocol state machine and mapping table, create the initial state and add it to the protocol state machine, and set the initial state as the current state;

[0020] Traverse all message types. If the message type appears for the first time, create a new state and transfer the current state to the new state. Set the new state as the current state, and record the mapping relationship between the message type and the new state in the mapping table. If the message type does not appear for the first time, query the corresponding protocol state from the mapping table, transfer the current state to the corresponding protocol state, and set the corresponding protocol state as the current state.

[0021] This continues until all message types are traversed and the final complete protocol state machine is obtained.

[0022] As a state machine inference method for industrial control private protocols of the present invention, further determining and removing abnormal state transitions in the protocol state based on the response of the industrial control device includes:

[0023] According to the protocol state machine, the request messages of the same type corresponding to the conversion conditions are replayed to the industrial control device one by one to determine whether the response of the industrial control device is consistent with the response corresponding to the request message;

[0024] If the response messages are consistent, the state transition process in the protocol state machine is determined to be correct, and the request message corresponding to the next transition condition is replayed;

[0025] If the response messages are inconsistent, the state transition process in the protocol state machine is determined to be abnormal, and the request response message is deleted from the current message type, the request response message is marked as a new message type and the protocol state machine is rebuilt;

[0026] Until the request message traversal is completed after being replayed to the industrial control devices one by one.

[0027] On the other hand, the present invention also provides a state machine inference system for industrial control private protocols, comprising: a data processing module, a message marking module, a state machine construction module and an exception handling module, wherein:

[0028] A data processing module is used to collect data packets of industrial control equipment related protocols and pre-process the data packets to extract the message content and timestamp of the data packets related to the target protocol through pre-processing, and to construct a message sequence based on the message content and timestamp;

[0029] The message tagging module is used to obtain the message content length and the request and response message length according to the message sequence, tag the protocol message type according to the request and response message length, and store the message type tag and the corresponding message using a tag dictionary, where the key in the tag dictionary is the tagged message type tag and the value is all request and response messages corresponding to the message type tag;

[0030] A state machine construction module is used to sort the marked message types according to the timestamps in the message sequence, determine the transition relationship between different protocol states based on the temporally adjacent message types, and construct the protocol state machine based on the transition relationship between the states;

[0031] The exception handling module is used to replay the same type of protocol messages to the industrial control device according to the protocol state machine, and determine and remove the abnormal state transition in the protocol state according to the response of the industrial control device.

[0032] Beneficial effects of the present invention:

[0033] The present invention is directed to a state machine inference method and system for industrial control private protocols. The present invention addresses the problem that the current protocol state machine inference method cannot accurately label protocol state-related fields due to the special format structure of industrial control private protocols, where each byte or even each bit has a different function and meaning, and the absence of separators. By utilizing the highly structured protocol characteristics of industrial protocols, protocol messages of different lengths generally represent different message types, and the message type can be labeled without identifying protocol state-related fields, thereby achieving accurate labeling of the protocol state. Furthermore, in view of the fact that industrial protocols need to generate a large amount of interactive messages of control information and monitoring data in a short period of time, the existing protocol state machine inference method, when using a prefix tree structure to construct a protocol state machine, results in an overly large prefix tree, low performance, and low efficiency. By constructing a protocol state machine using a directed graph structure based on the message type labeling, and using the labeled message type as the driving condition for protocol state switching, the problems faced by the prefix tree structure can be effectively avoided, thereby improving overall performance and efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 This is a schematic diagram of the state machine inference process for the industrial control private protocol in the embodiment;

[0035] Figure 2 This is a schematic diagram of the state marking algorithm process in the embodiment;

[0036] Figure 3 The following is a schematic diagram of the algorithm flow for constructing the protocol state machine in the embodiment. DETAILED DESCRIPTION

[0037] In order to make the objectives, technical solutions and advantages of the present invention clearer and more understandable, the present invention is further described in detail below with reference to the accompanying drawings and technical solutions.

[0038] The embodiment of the present invention, see Figure 1 As shown, a state machine inference method for industrial control private protocols is provided, including:

[0039] S101 , collecting industrial control equipment related protocol data packets and preprocessing the data packets to extract the data packet message content and timestamp related to the target protocol through preprocessing, and constructing a message sequence based on the message content and timestamp.

[0040] Given the complexity and diversity of protocol state transitions, constructing as many state transition paths as possible requires a large number of data packets as input. Specifically, we can capture interaction data packets between programming software and industrial control devices in the target area from a real industrial control environment. We can also collect public protocol data packets from internet platforms such as Github. These captured interaction data packets and collected public protocol data packets are used as the protocol data packets related to the industrial control devices.

[0041] Among them, for the collected industrial control equipment related protocol data packets, the data packet quadruple (IP address, port number, timestamp, message content) can be used to filter out data packets that are not related to the target protocol from the industrial control equipment related protocol data packets, and the remaining data packets in the industrial control equipment related protocol data packets are used as data packets related to the target protocol, and the message content and timestamp in the data packets related to the target protocol are extracted, and a message sequence is constructed based on the obtained message content.

[0042] S102. Obtain the message content length and the request and response message length according to the message sequence, label the protocol message type according to the request and response message length, and use the labeling dictionary to store the message type label and the corresponding message, where the key in the labeling dictionary is the labeled message type label, and the value is all request and response messages corresponding to the message type label.

[0043] Based on the length of the request and response messages, different message type annotation rules can be designed to label protocol messages. For example, by comparing the length of the request message, if the request message lengths are different, the message type is different. If the request message lengths are the same, the corresponding response message lengths are further compared. If the response message lengths are different, the message type is different.

[0044] Specifically, the tag dictionary is used to store message type tags and corresponding messages, such as Figure 2 As shown, it can be designed to include:

[0045] Initialize the status annotation dictionary, generate a message type tag based on the request message length and the response message length, if the message type tag does not exist in the status annotation dictionary, add the message type tag to the status annotation dictionary, and set the key corresponding value in the status annotation dictionary to an empty list, add the request message and response message to the message type tag corresponding list, and traverse the next pair of request and response messages until the request and response message traversal is completed to obtain the status annotation dictionary.

[0046] S103. Sort the marked message types according to the timestamps in the message sequence, determine the transition relationship between different protocol states based on the temporally adjacent message types, and construct a protocol state machine according to the transition relationship between the states.

[0047] Based on the timestamps of captured messages, the marked message types are sorted according to their corresponding timestamps. Temporally adjacent message types have a state transition relationship. Specifically, the message type is used as the driving condition for state transitions. A protocol state machine is generated using a directed graph structure based on the state transition driving principle. The state transition driving principle includes the following: identical message types cause the protocol to enter the same state, while different message types cause the protocol to enter different states.

[0048] wherein the protocol state machine is constructed according to the transition relationship between states, as shown in Figure 3 may also be designed to include:

[0049] initializing the protocol state machine and the mapping table, creating an initial state and adding the initial state to the protocol state machine, and setting the initial state as the current state;

[0050] traversing all message types, if the message type appears for the first time, creating a new state and transferring the current state to the new state, setting the new state as the current state, and recording the mapping relationship between the message type and the new state in the mapping table; if the message type is not the first time, querying the protocol state corresponding to the message type from the mapping table, transferring the current state to the corresponding protocol state, and setting the corresponding protocol state as the current state;

[0051] until all message types are traversed, the final complete protocol state machine is obtained.

[0052] different session processes are constructed according to the above algorithm, and then the state machines are merged according to the same message types in the state machines, and finally a complete protocol state machine is generated.

[0053] S104, replaying the same type of protocol message to the industrial control device according to the protocol state machine, and determining and removing the abnormal state transition in the protocol state according to the response of the industrial control device.

[0054] Specifically, the same type of request message corresponding to the transition condition can be replayed to the industrial control device according to the protocol state machine, and it is judged whether the response of the industrial control device and the response corresponding to the request message are consistent; if the response messages are consistent, it is determined that the state transition process in the protocol state machine is correct, and the next request message corresponding to the transition condition is continued to be replayed; if the response messages are inconsistent, it is determined that the state transition process in the protocol state machine is abnormal, and the request response message is deleted from the current message type, the request response message is marked as a new message type, and the protocol state machine is reconstructed; until the traversal of the request message replayed to the industrial control device ends.

[0055] Further, based on the above method, the embodiment of the present application also provides a state machine inference system for an industrial control private protocol, comprising: a data processing module, a message labeling module, a state machine construction module and an exception processing module, wherein,

[0056] The data processing module is used to collect industrial control device related protocol data packets and pre-process the data packets, so as to extract the data packet message content and timestamp related to the target protocol through the pre-processing, and construct a message sequence based on the message content and timestamp;

[0057] The message tagging module is used to obtain the message content length and the request and response message length according to the message sequence, tag the protocol message type according to the request and response message length, and store the message type tag and the corresponding message using a tag dictionary, where the key in the tag dictionary is the tagged message type tag and the value is all request and response messages corresponding to the message type tag;

[0058] A state machine construction module is used to sort the marked message types according to the timestamps in the message sequence, determine the transition relationship between different protocol states based on the temporally adjacent message types, and construct the protocol state machine based on the transition relationship between the states;

[0059] The exception handling module is used to replay the same type of protocol messages to the industrial control device according to the protocol state machine, and determine and remove the abnormal state transition in the protocol state according to the response of the industrial control device.

[0060] State machine inference for industrial control private protocols needs to consider the complexity and diversity of the protocol state transition process. In order to construct as many state transition paths as possible, a large number of data packets are required as input. To this end, this solution can capture the communication traffic between the programming software and the target industrial control equipment through tools such as Wireshark in the constructed industrial environment. On the other hand, it can also collect public protocol data packets from Internet platforms such as Github.

[0061] Based on the collected data packets, in the preprocessing step, the four-tuple (IP address, port number, timestamp, message content) method is used to filter out data packets that are not related to the target protocol. At the same time, the message content and timestamps in the remaining data packets are extracted to construct a message sequence for protocol state machine inference.

[0062] use Figure 2 The state annotation algorithm shown in the figure annotates the request and response messages in the message sequence with the message type and obtains the state annotation dictionary. The algorithm for constructing the protocol state machine is as follows: Figure 3 As shown, according to the state annotation dictionary and timestamp, the protocol state machine is constructed using a directed graph structure with the message type as the driving condition for state transition to obtain the initial protocol state machine.

[0063] Considering that in the process of protocol state annotation, different types of protocol messages may be mistakenly labeled as the same type due to the same length of request and response messages, an active interaction method can be used to correct the protocol state machine. The specific summary is as follows:

[0064] According to the constructed protocol state machine, the request messages of the same type corresponding to the conversion conditions are replayed to the industrial devices one by one to observe whether the responses of the industrial devices are consistent with the response messages corresponding to the request messages.

[0065] If they are consistent, it proves that the state transfer process is correct, that is, the message type is correctly marked, and then continue to replay the request message corresponding to the next transition condition; if they are inconsistent, it proves that the state transfer process is wrong, that is, the message type is wrong, and then delete the request response message from the current message type and mark it with a new message type. Figure 3 The method shown reconstructs the protocol state machine.

[0066] Repeat the above steps until all state transition conditions in the protocol state machine are traversed and completed, at which point the protocol state machine correction is completed.

[0067] Unless otherwise specifically stated, the relative steps, numerical expressions and values ​​of the components and steps set forth in these embodiments do not limit the scope of the present invention.

[0068] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. Reference can be made to the common and similar parts between the various embodiments. For the systems disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple, and the relevant parts can be referred to the method description.

[0069] The units and method steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the components and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. A person of ordinary skill in the art may use different methods to implement the described functions for each specific application, but such implementation is not considered to be beyond the scope of the present invention.

[0070] Those skilled in the art will appreciate that all or part of the steps in the above method can be performed by a program instructing related hardware. The program can be stored in a computer-readable storage medium, such as a read-only memory, a magnetic disk, or an optical disk. Alternatively, all or part of the steps in the above embodiment can be implemented using one or more integrated circuits. Accordingly, each module / unit in the above embodiment can be implemented in the form of hardware or software functional modules. The present invention is not limited to any specific combination of hardware and software.

[0071] Finally, it should be noted that the above-described embodiments are only specific implementation methods of the present invention, which are used to illustrate the technical solutions of the present invention, rather than to limit them. The scope of protection of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the above-described embodiments, those skilled in the art should understand that any person skilled in the art can modify or easily conceive of changes to the technical solutions described in the above-described embodiments within the technical scope disclosed by the present invention, or replace some of the technical features therein with equivalents. Such modifications, changes, or replacements do not deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be included in the scope of protection of the present invention. Therefore, the scope of protection of the present invention shall be subject to the scope of protection of the claims.

Claims

1. A state machine inference method for industrial control private protocols, characterized in that: Include: Collecting industrial control equipment related protocol data packets and preprocessing the data packets to extract the data packet message content and timestamp related to the target protocol through preprocessing, and constructing a message sequence based on the message content and timestamp; Obtain the message content length and request and response message length according to the message sequence, label the protocol message type according to the request and response message length, and use the labeling dictionary to store the message type label and the corresponding message. The key in the labeling dictionary is the labeled message type label, and the value is all request and response messages corresponding to the message type label. Sort the marked message types according to the timestamps in the message sequence, determine the transition relationship between different protocol states based on the temporally adjacent message types, and construct a protocol state machine based on the transition relationship between the states; The same type of protocol message is replayed to the industrial control device according to the protocol state machine, and the abnormal state transition in the protocol state is determined and removed according to the response of the industrial control device.

2. The state machine inference method for industrial control private protocol according to claim 1 is characterized in that: Collect industrial control equipment protocol data packets, including: The interaction data packets between the programming software and industrial control equipment in the target area are captured from the real industrial control environment, and public protocol data packets are collected from the Internet. The captured interaction data packets and the collected public protocol data packets are used as industrial control equipment related protocol data packets.

3. The state machine inference method for industrial control private protocol according to claim 1, characterized in that: Preprocess the data packet, including: The packet quadruple is used to filter out packets unrelated to the target protocol from the industrial control equipment related protocol packets, and the remaining packets in the industrial control equipment related protocol packets are regarded as packets related to the target protocol, and the message content and timestamp in the packets related to the target protocol are extracted.

4. The state machine inference method for industrial control private protocol according to claim 1, characterized in that: Use the annotation dictionary to store message type tags and corresponding messages, including: Initialize the status annotation dictionary, generate a message type tag based on the request message length and the response message length, if the message type tag does not exist in the status annotation dictionary, add the message type tag to the status annotation dictionary, and set the key corresponding value in the status annotation dictionary to an empty list, add the request message and response message to the message type tag corresponding list, and traverse the next pair of request and response messages until the request and response message traversal is completed to obtain the status annotation dictionary.

5. The state machine inference method for industrial control private protocol according to claim 1, characterized in that: The protocol state machine is constructed based on the transition relationship between states, including: The message type is used as the driving condition for state transition. The protocol state machine is generated according to the state transition driving principle and a directed graph structure. The state transition driving principle includes: the same message type causes the protocol to enter the same state, and different message types cause the protocol to enter different states.

6. The state machine inference method for industrial control private protocol according to claim 1 or 5, characterized in that: The protocol state machine is constructed based on the transition relationship between states, which also includes: Initialize the protocol state machine and mapping table, create the initial state and add it to the protocol state machine, and set the initial state as the current state; Traverse all message types. If the message type appears for the first time, create a new state and transfer the current state to the new state. Set the new state as the current state, and record the mapping relationship between the message type and the new state in the mapping table. If the message type does not appear for the first time, query the corresponding protocol state from the mapping table, transfer the current state to the corresponding protocol state, and set the corresponding protocol state as the current state. This continues until all message types are traversed and the final complete protocol state machine is obtained.

7. The state machine inference method for industrial control private protocol according to claim 1, characterized in that: Identify and remove abnormal state transitions in the protocol state based on the response of the industrial control equipment, including: According to the protocol state machine, the request messages of the same type corresponding to the conversion conditions are replayed to the industrial control device one by one to determine whether the response of the industrial control device is consistent with the response corresponding to the request message; If the response messages are consistent, the state transition process in the protocol state machine is determined to be correct, and the request message corresponding to the next transition condition is replayed; If the response messages are inconsistent, the state transition process in the protocol state machine is determined to be abnormal, and the request response message is deleted from the current message type, the request response message is marked as a new message type and the protocol state machine is rebuilt; Until the request message traversal is completed after being replayed to the industrial control devices one by one.

8. A state machine inference system for industrial control private protocols, characterized by: Contains: data processing module, message annotation module, state machine construction module and exception handling module, among which, A data processing module is used to collect data packets of industrial control equipment related protocols and pre-process the data packets to extract the message content and timestamp of the data packets related to the target protocol through pre-processing, and to construct a message sequence based on the message content and timestamp; The message tagging module is used to obtain the message content length and the request and response message length according to the message sequence, tag the protocol message type according to the request and response message length, and store the message type tag and the corresponding message using a tag dictionary, where the key in the tag dictionary is the tagged message type tag and the value is all request and response messages corresponding to the message type tag; A state machine construction module is used to sort the marked message types according to the timestamps in the message sequence, determine the transition relationship between different protocol states based on the temporally adjacent message types, and construct the protocol state machine based on the transition relationship between the states; The exception handling module is used to replay the same type of protocol messages to the industrial control device according to the protocol state machine, and determine and remove the abnormal state transition in the protocol state according to the response of the industrial control device.

9. An electronic device, characterized in that: include: at least one processor, and a memory coupled to the at least one processor; The memory stores a computer program, and the computer program can be executed by the at least one processor to implement the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, and when the computer program is executed, the method according to any one of claims 1 to 7 can be implemented.

Images