A method for identifying key fields in an industrial control protocol and related equipment

Abstract

This invention discloses a method and related equipment for identifying key fields in industrial control protocols, belonging to the field of cyberspace security technology. The method includes: if a delimiter exists in the message, identifying key fields in the protocol using the features of the delimiter; if no delimiter exists in the message, performing type-length-value decoding on the protocol; if decoding is successful, identifying key fields in the protocol using type-length-value decoding; if decoding fails, when there is only one length field in the protocol, identifying the length field based on the correlation between the message length difference and the field value difference, and identifying the structure identifier field based on the consistency of the field value in similar messages; when there are multiple length fields in the protocol, identifying the structure identifier field based on the protocol spectrum and convolutional neural network, and identifying the length field based on multidimensional hypothesis testing. This method can effectively identify structure identifier fields and length fields in industrial control protocols.

Description

Technical Field

[0001] This invention relates to a method and related equipment for identifying key fields in industrial control protocols, belonging to the field of cyberspace security technology. Background Technology

[0002] Industrial control protocols (ICPs) are pre-defined rules for data exchange between communicating parties in an IC system. They specifically describe the syntax, semantics, and synchronization information of messages during communication between IC devices, forming a crucial foundation for network and data communication. Therefore, ensuring the security of ICPs has become a significant research topic in the networking field. Currently, a common method for testing the security of ICPs is fuzz testing. However, fuzz testing relies on protocol specifications to improve the effectiveness of generated test cases. For unknown or proprietary ICPs, protocol reverse engineering is necessary to perform reverse analysis. Only after obtaining information such as the protocol's format, semantics, and state machine can fuzz testing be effectively conducted.

[0003] Currently, the analysis objects for industrial control system (ICS) protocol reverse engineering are network traffic and binary firmware. Network traffic-based analysis methods analyze intercepted network data streams, using statistical analysis and data mining to cluster packet samples. Based on the similarity of values ​​in packets with the same format, they analyze and obtain protocol syntax and semantic information, and infer the protocol state machine using the temporal relationships between packets, demonstrating strong versatility. Binary firmware-based analysis methods take the instruction execution trajectory during protocol parsing as the analysis object, using protocol input data as a taint data source. They utilize dynamic taint analysis methods to track the data parsing process, and obtain the protocol specification based on how the protocol parser uses taint data and corresponding context information.

[0004] Currently, there are various protocol reverse analysis methods based on sequence alignment, frequent sets, probabilistic models, and semantic features. However, when analyzing actual industrial control protocols, the importance of key fields such as length fields and structure identifier fields for protocol syntax and semantic reverse analysis is not fully recognized. For example, when a protocol has multiple formats, the structure identifier field clearly marks the format information used by the message, and the length field indicates the length and range of other fields. Ignoring the identification of these fields seriously affects the accuracy and efficiency of protocol format analysis. Summary of the Invention

[0005] The purpose of this invention is to provide a method and related equipment for identifying key fields in industrial control protocols, which can effectively identify structural identifier fields and length fields in industrial control protocols.

[0006] To achieve the above objectives, the present invention provides the following technical solution: In a first aspect, the present invention provides a method for identifying key fields in an industrial control protocol, comprising: Classify the methods of dividing protocol fields: If a delimiter exists in the message, it is determined that the protocol uses a delimiter to divide the fields, and the key fields in the protocol are identified by using the characteristics of the delimiter. If the message does not contain a delimiter, the protocol is decoded using type-length-value. If decoding is successful, it is determined that the protocol uses type-length-value encoding to divide fields, and the key fields in the protocol are identified by type-length-value decoding. If decoding fails, it is determined that the protocol uses a preset message structure for field division, and the key fields in the protocol are identified using the following method: Construct a representation model for the message sequence and key fields in the protocol, and perform mathematical modeling for the structure identifier field and length field; When there is only one length field in the protocol, the length field is identified based on the correlation between the message length difference and the field value difference, and the structure identifier field is identified based on the consistency of the field value in the same type of message; When there are multiple length fields in the protocol, the structure identifier field is identified based on the protocol spectrum and the convolutional neural network, and the length field is identified based on the multidimensional hypothesis test. Verify and confirm the identified structural identifier field and length field to complete the identification of key fields.

[0007] Building upon the first aspect, further, a representation model for the message sequence and key fields in the protocol is constructed, including mathematical modeling of the structure identifier field and the length field, including: Let the message sequence be ,in, , … … They represent The first, second, ... … A message, express The total number of messages sent in the interim; set up The value of the corresponding structure identifier field is If the protocol does not have a structure identifier field, then Empty; The Middle Message length Represented as: ; in, express The base length of the fixed portion in the corresponding protocol structure that is not affected by the variable-length field. express In the corresponding protocol structure, the first The value of the length field The actual length of the mapped field. express The total number of length fields in the corresponding protocol structure. It is a constant, representing the length of other fixed parts in the protocol structure.

[0008] In conjunction with the first aspect, furthermore, when there is only one length field in the protocol, the length field is identified based on the correlation between the message length difference and the field value difference, including: When the protocol structure contains only a length field and the byte offset is fixed, the length difference between any two messages in the protocol is calculated as follows: ; in, , They represent The Middle , Message length, , They represent The Middle , individual message , The value of the corresponding structure identifier field, , They represent , The base length of the fixed portion in the corresponding protocol structure that is not affected by the variable-length field. , They represent , The value of the first length field in the corresponding protocol structure , The actual length of the mapped field; If two messages have the same protocol structure, then the difference in message length is simplified to: ; For all messages in the protocol, traversing the field of length 1 byte or 2 bytes at each byte offset will satisfy... The field is determined to be a length field.

[0009] In conjunction with the first aspect, furthermore, when there is only one length field in the protocol, the structure identifier fields for identifying consistency of field values ​​across similar messages include: like If the calculation result is not 0, then it is determined that the protocol has multiple structures; When a protocol has multiple structures, the structure identifier field, represented by 1 byte or 2 bytes, has the characteristic that the field value is the same in messages with the same protocol structure and the field value is different in messages with different protocol structures. If this feature is not present, the structure identifier field is determined to be represented in bit-level form. Bitwise AND and bitwise OR operations are performed on the byte values ​​of messages with the same protocol structure at the same byte position, and the results of the bitwise AND and bitwise OR operations are then XORed to obtain the bit change pattern of the same protocol structure at the same byte position. ; in, Indicates the first The first byte position Bit change patterns in the protocol structure , … They represent the first The first, second, ..., ... of the protocol structure The first message bytes, Indicates bitwise AND. Indicates bitwise OR. Indicates bitwise XOR; Perform a bitwise OR operation on the bit change patterns of all protocol structures at the same byte position to obtain the combined bit change pattern of all messages at the same byte position: ; in, Indicates that all messages are in the first... The overall bit change pattern at each byte position , … They represent the first The 1st, 2nd, ..., byte positions Bit change patterns in the protocol structure Indicates the total number of protocol structures; Consecutive 0 bits in the comprehensive bit change pattern are identified as the structure identifier field.

[0010] In conjunction with the first aspect, furthermore, when multiple length fields exist in the protocol, the structure identifier fields identified by the protocol spectrum and convolutional neural network include: message sequence Each message in the process is normalized: ; in, , … … They represent The first, second, ... … A message, express The total number of messages in the interim report Indicates the normalized result , , … They represent The first, second, ... Each byte has a value of [number] bytes. Integers within the range express The maximum total number of bytes in each message; from Take out Each normalized message is constructed with a height of Width is Image matrix : ; in, … They represent from The first normalized message extracted from the first normalized message, ... bytes, … They represent from The first one taken from In the normalized message, the first, ..., ... 1 byte; right Normalization is performed: ; in, Indicates the normalized result ; Building a convolutional neural network: The input layer is: ; in, This represents the input to the convolutional neural network; The convolutional layer is: ; in, Indicates the first Spatial location of the feature maps output by each convolutional layer First The value of each channel, This represents the activation function. Indicates the first The first convolutional layer The first convolutional kernel Line 1 Liede The weight of each channel, Indicates the first Spatial location of the feature maps output by each convolutional layer First The value of each channel, Indicates the first The first convolutional layer The bias terms corresponding to each convolution kernel This represents the height of the convolution kernel, i.e., the number of rows. This represents the width of the convolution kernel, i.e., the number of columns. Indicates the first The total number of channels in each convolutional layer; The pooling layer is: ; in, Indicates the first Spatial location of the feature map output by each pooling layer First The value of each channel, Indicates the first The feature maps output by each convolutional layer are displayed in the pooling window. Inner The value of each channel, Indicates the step size of the pooling window; The feature maps are flattened after passing through convolutional and pooling layers and then input into the fully connected layer; The output layer uses the Softmax function to convert the output of the fully connected layer into a probability distribution of the protocol structure category; Generating heatmaps using gradient-weighted class activation mapping: Let the output of the fully connected layer be the first... The original scores for each protocol structure are The spatial location of the feature map output by the last convolutional layer First The value of each channel is The feature map size is , Indicates the height of the feature map. Indicates the width of the feature map. Indicates the number of channels. The gradient is ; Global average pooling is performed on the spatial dimension of each channel to obtain the importance weights of neurons: ; in, Indicates the first The first channel is for identifying the first... The importance weights of neurons in each protocol structure; Class activation graph: ; in, Representing the spatial location of the feature map For the classification result of the first The importance of each protocol structure; Will Size upsampling A heat map was obtained. ; Calculate the average saliency of the spatial location of the feature map under different protocol structures: ; in, The average saliency of the spatial location of the feature map under different protocol structures. Indicates the total number of protocol structures; right Sort according to The ranking determines the candidate position of the structure identifier field. ; Check all messages Byte distribution: ; in, Indicates that all messages are in A collection of bytes, Indicates the first The message is in bytes, Indicates any; like If the number of discrete values ​​is lower than the threshold for the number of discrete values, and the correlation between the discrete values ​​and the protocol structure to which the message belongs is greater than the correlation threshold, then it is determined that... This identifies the location of the structure's identifier field.

[0011] In conjunction with the first aspect, furthermore, when multiple length fields exist in the protocol, the length fields identified based on multidimensional hypothesis testing include: Define the length field as a triple: ; in, Indicates the starting byte position of the length field in the message. Indicates the size in bytes of the length field. Indicates the byte order of the length field; The function for extracting field values ​​is: ; in, express The The original byte value at the specified byte position is [value]. Integers within the range This indicates the byte offset within the length field. This represents the byte order weighting exponent function, corresponding to big-endian. Little-endian correspondence ; The data range declared for the field is: ; The constraints are: ; in, express The total number of bytes; Set the null hypothesis for: Not a length field, alternative assumption for: It is a length field; The first test statistic is a semantic consistency statistic used to measure the consistency between field values ​​and the actual data length within their defined interval. ,in, express The actual number of bytes, Indicates the smoothing factor; The second test statistic is a structural boundary strength statistic used to measure the difference in the distribution of byte values ​​inside and outside the interval defined by the field. ,in, express Boundary strength, , , They represent The value of all internal and external bytes is The proportion of bytes, Indicates the use of measurement and The degree of difference between them, Jensen-Shannon divergence Indicates a mixed distribution. , , They represent the measures used for measurement. , and The Kulbeck-Leibler divergence of the degree of difference between them; The third test statistic is a statistic used to measure whether the distribution of field values ​​exhibits imbalance, indicating the reasonableness of the value distribution. ,in, express exist The entropy value in This represents the maximum entropy when the field values ​​are uniformly distributed. The fourth test statistic is a pointer validity statistic used to measure whether the interval pointed to by the field is always within the message boundary. ,in, Indicates the use of judgment A Boolean indicator function to determine whether the message is completely contained within the message boundary; if the constraint is met, then... ,otherwise ; The overall confidence score is: ; in, , , , They represent , , , The weight, ; like If the score is greater than the overall confidence score threshold, then it is determined that... This is the length field.

[0012] In conjunction with the first aspect, further verification and confirmation of the identified structure identifier field and length field include: Based on the protocol spectrum and convolutional neural network, structural identifier fields are extracted from the message to construct a candidate structural identifier field set; Select the structure identifier field from the candidate structure identifier field set to cluster all messages in the protocol, and obtain several message subsets. Each subset corresponds to a protocol structure, and set the current parsing position as the end position of the structure identifier field. Based on multidimensional hypothesis testing, extract the length field from the message starting from the current parsing position and construct a candidate length field set; If the candidate length field set is empty, then the structure identifier field is reselected from the candidate structure identifier field set to cluster all messages in the protocol. Otherwise, the length field is selected from the candidate length field set, and the data content of each message within the data range declared by the selected length field is extracted as a sub-message. The sub-message is used as the new parsing object, and the current parsing position is updated to the next byte after the end position of the data range. When no new length field can be identified, check the remaining data length after the current parsing position in each message. If the remaining data length is the same in all messages, it is determined that the structure identifier field selected from the candidate structure identifier field set and the length field finally selected from the candidate length field set are both correct key fields. Otherwise, the length field is re-selected from the candidate length field set for verification. If all length fields fail to be verified, the structure identifier field is re-selected from the candidate structure identifier field set for verification.

[0013] In a second aspect, the present invention provides a computer device, comprising: Storage medium: used to store computer programs; Processor: Used to execute the computer program to implement the key field identification method in the industrial control protocol described in the first aspect.

[0014] Thirdly, the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the key field identification method in the industrial control protocol described in the first aspect.

[0015] Fourthly, the present invention provides a computer program product, including a computer program that, when executed by a processor, implements the key field identification method in the industrial control protocol described in the first aspect.

[0016] Compared with the prior art, the beneficial effects of the present invention are: This invention provides a method for identifying key fields in industrial control protocols. Considering both efficiency and robustness, it makes reverse engineering more directional, avoids blind searches, and improves analysis efficiency. It innovatively visualizes message sequences as protocol spectrograms and utilizes the powerful spatial feature extraction capabilities of convolutional neural networks to capture the vertical stripe features of structural identifier fields, demonstrating good recognition results for both fixed-length and bit-level mixed fields. The proposed multi-dimensional hypothesis testing model for length fields integrates semantic, structural, statistical, and boundary-based evidence, effectively filtering noise and coincidental matches, and accurately identifying single or multiple length fields, with significant advantages when handling complex nested length fields. It provides a complete automated process from preprocessing, identification, verification to final format output, reducing reliance on manual prior knowledge. The method is independent of specific protocol specifications and applicable to various public or private binary industrial control protocols, providing accurate key information support for subsequent protocol security testing and vulnerability discovery. Attached Figure Description

[0017] Figure 1 This is a flowchart of the key field identification method in the industrial control protocol provided in the embodiments of the present invention. Detailed Implementation

[0018] The technical solution of the present invention will be further described in detail below with reference to specific embodiments.

[0019] Embodiments of the present invention are described in detail below. Examples of these embodiments are illustrated in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and should not be construed as limiting the present invention. Unless otherwise specified, embodiments of the present invention and the technical features thereof can be combined with each other.

[0020] This invention provides a method for identifying key fields in industrial control protocols, including: Classify the methods of dividing protocol fields: If a delimiter exists in the message, it is determined that the protocol uses a delimiter to divide the fields, and the key fields in the protocol are identified by using the characteristics of the delimiter. If the message does not contain a delimiter, the protocol is decoded using type-length-value. If decoding is successful, it is determined that the protocol uses type-length-value encoding to divide fields, and the key fields in the protocol are identified by type-length-value decoding. If decoding fails, it is determined that the protocol uses a preset message structure for field division, and the key fields in the protocol are identified using the following method: Construct a representation model for the message sequence and key fields in the protocol, and perform mathematical modeling for the structure identifier field and length field; When there is only one length field in the protocol, the length field is identified based on the correlation between the message length difference and the field value difference, and the structure identifier field is identified based on the consistency of the field value in the same type of message; When there are multiple length fields in the protocol, the structure identifier field is identified based on the protocol spectrum and the convolutional neural network, and the length field is identified based on the multidimensional hypothesis test. Verify and confirm the identified structural identifier field and length field to complete the identification of key fields.

[0021] This invention determines whether a protocol uses delimiters for field segmentation by examining the presence of delimiters in the data within the message. The delimiters are then used to further split the protocol fields. If no delimiters are used, the protocol data is decoded using various encoding methods, such as Type-Length-Value (TLV) decoding. The success of decoding determines whether the protocol uses an encoding method to encapsulate the data. If decoding fails, key fields in the protocol are located, and their boundaries are analyzed using these anchor points to complete reverse engineering of the protocol. For protocols that use delimiters for field segmentation, the key is identifying the delimiters in the protocol format, which enables field segmentation and protocol reverse engineering. For protocols like Simple Network Management Protocol (SNMP) that use TLV (Transmission-by-Video) encoding for data transmission, data extraction and parsing can be achieved through TLV decoding. However, considering the various TLV encoding methods currently available, and the possibility of unknown encoding methods, the length field in the TLV encoding is primarily used for identification. If the length field of a message does not match the subsequent content, it can be determined that the protocol does not use TLV encoding. After excluding delimiters and data encoding methods, it can be generally determined that the protocol follows a preset message structure for message encapsulation. For simple industrial control protocols, all messages use the same structure. However, for complex protocols, multiple protocol formats need to be designed to optimize communication efficiency and overhead. In this case, industrial control protocols use fields such as structure identifiers and function codes to describe the structure of subsequent messages. If these key fields can be identified and located, messages with the same structure can be classified into the same category. Then, existing methods can be used to mine the semantic features of each field, allowing for successful reverse analysis of other fields.

[0022] The key field identification method in the industrial control protocol provided by this invention can be used in application scenarios of identifying abnormal behaviors such as data theft and illegal data transmission in complex traffic environments. The operating environment can be an Intel-Windows architecture PC with a Core eight-core CPU with a main frequency of 2.5GHz or higher, an RTX4090 graphics card, ≥16GB of memory, a 500GB hard disk, and running the Windows 11 operating system.

[0023] In one possible embodiment, the delimiter features include: Each message is segmented using a delimiter field to assist the receiver in parsing the control information in the message; The delimiter field uses special characters to separate the data to prevent conflicts with other fields and to avoid affecting the splitting of the actual field. In Internet protocols, spaces and newline characters are usually used as delimiters. The delimiter field is a fixed-length field, with a length of 1 byte or 2 bytes, to prevent a significant decrease in protocol efficiency.

[0024] By utilizing the characteristics of delimiters, delimiter fields in a protocol can be accurately identified, enabling reverse analysis of the protocol.

[0025] In one possible embodiment, let the message sequence be: ,in, , … … They represent The first, second, ... … A message, express The total number of messages in the middle; let's assume... The value of the corresponding structure identifier field is If the protocol does not have a structure identifier field, then Empty; The Middle Message length Represented as: ; in, express The base length of the fixed portion in the corresponding protocol structure that is not affected by the variable-length field. express In the corresponding protocol structure, the first The value of the length field The actual length of the mapped field. express The total number of length fields in the corresponding protocol structure. This is a constant representing the length of other fixed parts of the protocol structure. It is usually a linear function, such as four times the length of the IP header field, but more often the slope of the function is 1.

[0026] In one possible implementation, when there is only one length field, the position of the length field within the same protocol structure is fixed. In this case, the length difference between any two messages in the protocol can be directly calculated as follows: ; in, , They represent The Middle , Message length, , They represent The Middle , individual message , The value of the corresponding structure identifier field, , They represent , The base length of the fixed portion in the corresponding protocol structure that is not affected by the variable-length field. , They represent , The value of the first length field in the corresponding protocol structure , The actual length of the mapped field.

[0027] If two messages have the same protocol structure, then the difference in message length is simplified to: ; If two messages belong to the same protocol structure, then the difference in their message lengths is proportional to the difference in their length field values. Considering the characteristics of industrial control protocols, the message length field generally does not exceed 2 bytes. Therefore, when mining the length field in the protocol structure, we can calculate the difference between data in the same position and within 2 bytes in length, and simultaneously calculate the length difference between the messages.

[0028] For all messages in the protocol, traversing the field of length 1 byte or 2 bytes at each byte offset will satisfy... The field is determined to be a length field.

[0029] In one possible embodiment, Convert to For different types of protocol structures, the result obtained after calculating the difference between protocol sample data is not 0. Therefore, this characteristic can be used to analyze whether multiple structures exist in the protocol at the same time. If there is only a single structure, then the difference between each pair of messages in the sample is equal to the difference between the length field result. Otherwise, multiple structures must exist. Moreover, by using the inconsistency of the difference results of different protocol messages, it is convenient to cluster all messages and classify messages belonging to the same category into the same category.

[0030] like If the calculation result is not 0, then the protocol is determined to have multiple structures.

[0031] If a protocol has multiple structures, the protocol message format will typically include a field to identify the protocol's structure category. Following the efficiency and overhead trade-off principles of protocol design, this field should not exceed 2 bytes in length, and in some cases, it may even use several bits, mixed with other fields to form a single byte. If this structure identifier field is represented by 1 or 2 bytes, it will exhibit the following characteristics: For messages classified into the same protocol structure, the value of the structure identifier field is the same; For messages classified into different protocol structures, the value of the structure identifier field is different.

[0032] If this feature is not present, the structure identifier field is determined to be represented in bit-level form. Bitwise AND and bitwise OR operations are performed on the byte values ​​of messages with the same protocol structure at the same byte position, and the results of the bitwise AND and bitwise OR operations are then XORed to obtain the bit change pattern of the same protocol structure at the same byte position. ; in, Indicates the first The first byte position Bit change patterns in the protocol structure , … They represent the first The first, second, ..., ... of the protocol structure The first message bytes, Indicates bitwise AND. Indicates bitwise OR. This indicates bitwise XOR.

[0033] Perform a bitwise OR operation on the bit change patterns of all protocol structures at the same byte position to obtain the combined bit change pattern of all messages at the same byte position: ; in, Indicates that all messages are in the first... The overall bit change pattern at each byte position , … They represent the first The 1st, 2nd, ..., byte positions Bit change patterns in the protocol structure This indicates the total number of protocol structures.

[0034] The result of the comprehensive bit change pattern calculation is an 8-bit value. If this value contains several consecutive 0s, then these corresponding bits are the structure identifier field. Consecutive 0 bits in the comprehensive bit change pattern are determined as the structure identifier field.

[0035] In one possible embodiment, when multiple length fields exist in the protocol, the specific steps for identifying the structure identifier field based on the protocol spectrum and convolutional neural network include the following: First, analyze the message sequence. Each message in the process is normalized: ; in, , … … They represent The first, second, ... … A message, express The total number of messages in the interim report Indicates the normalized result , , … They represent The first, second, ... Each byte has a value of [number] bytes. Integers within the range express The maximum total number of bytes in each message.

[0036] Then from Take out Each normalized message is constructed with a height of Width is Image matrix : ; in, … They represent from The first normalized message extracted from the first normalized message, ... bytes, … They represent from The first one taken from In the normalized message, the first, ..., ... 1 byte.

[0037] After constructing the image matrix, all byte values ​​are normalized to a range of values. The floating-point numbers between these ranges are used to facilitate subsequent model processing.

[0038] right Normalization is performed: ; in, Indicates the normalized result .

[0039] It can be used as input to a convolutional neural network.

[0040] To achieve the recognition of structural identifier fields, a convolutional neural network is constructed, and the local spatial patterns are captured by the feature of its convolutional kernel sliding on the image. The structure of the entire model includes an input layer, a convolutional layer, a pooling layer, a fully connected layer, and an output layer.

[0041] The input layer is: ; in, This represents the input to the convolutional neural network.

[0042] The convolutional layer is: ; in, Indicates the first Spatial location of the feature maps output by each convolutional layer First The value of each channel, This represents the activation function. Indicates the first The first convolutional layer The first convolutional kernel Line 1 Liede The weight of each channel, Indicates the first Spatial location of the feature maps output by each convolutional layer First The value of each channel, Indicates the first The first convolutional layer The bias terms corresponding to each convolution kernel This represents the height of the convolution kernel, i.e., the number of rows. This represents the width of the convolution kernel, i.e., the number of columns. Indicates the first The total number of channels in each convolutional layer.

[0043] The pooling layer is: ; in, Indicates the first Spatial location of the feature map output by each pooling layer First The value of each channel, Indicates the first The feature maps output by each convolutional layer are displayed in the pooling window. Inner The value of each channel, This indicates the step size of the pooling window.

[0044] Pooling layers are used to reduce the dimensionality of data and enhance the translation invariance of features. The feature map is flattened after passing through convolutional and pooling layers and then input into the fully connected layer.

[0045] The output layer uses the Softmax function to convert the output of the fully connected layer into a probability distribution of protocol structure categories in order to determine the protocol's structure identifier field.

[0046] The identification of structural identifier fields can be regarded as a classification task. A heatmap is generated through the principle of class activation mapping (Grad-CAM), which shows which regions in the input image contribute to the model's judgment.

[0047] Generating a heatmap using gradient-weighted class activation mapping specifically includes the following steps: Let the output of the fully connected layer be the first... The original scores for each protocol structure are The spatial location of the feature map output by the last convolutional layer First The value of each channel is The feature map size is , Indicates the height of the feature map. Indicates the width of the feature map. Indicates the number of channels. The gradient is .

[0048] Global average pooling is performed on the spatial dimension of each channel to obtain the importance weights of neurons: ; in, Indicates the first The first channel is for identifying the first... The importance weights of neurons in each protocol structure.

[0049] Class activation graph: ; in, Representing the spatial location of the feature map For the classification result of the first The importance of each protocol structure.

[0050] Will Size upsampling A heat map was obtained. .

[0051] For each protocol structure category, observe its heatmap. The brightest (largest value) vertical stripe areas in the heatmap—that is, one or more columns of the image that are consistently highlighted—indicate that the byte values ​​at these locations are crucial for identifying this type of message. Calculate the average saliency of the spatial location of the feature map under different protocol structures: ; in, The average saliency of the spatial location of the feature map under different protocol structures. This indicates the total number of protocol structures.

[0052] right Sort according to The ranking determines the candidate position of the structure identifier field. .

[0053] Check all messages Byte distribution: ; in, Indicates that all messages are in A collection of bytes, Indicates the first The message is in bytes, It means any.

[0054] like If the number of discrete values ​​is lower than the threshold for the number of discrete values, and the correlation between the discrete values ​​and the protocol structure to which the message belongs is greater than the correlation threshold, then it is determined that... This identifies the location of the structure's identifier field.

[0055] Then, based on the identified identifier field and its value, the messages are grouped, and the byte value distribution of messages in other locations within each group is checked. If different groups exhibit significantly different internal structures, it indicates that the identified identifier field is correct.

[0056] In one possible embodiment, when multiple length fields exist in the protocol, identifying the length fields based on multidimensional hypothesis testing specifically includes: Define the length field as a triple: ; in, Indicates the starting byte position of the length field in the message. Indicates the size in bytes of the length field. Indicates the byte order of the length field.

[0057] In actual protocol design, The value is typically 1, 2, or 4 bytes, because 4 bytes already exceeds the maximum length of the IP packet MTU, and increasing this length further would only increase protocol overhead. Furthermore, The value is either big-endian or little-endian, depending on the design of the protocol specification itself.

[0058] The function for extracting field values ​​is:

[0059] in, express The The original byte value at the specified byte position is [value]. Integers within the range This indicates the byte offset within the length field. This represents the byte order weighting exponent function, corresponding to big-endian. Little-endian correspondence .

[0060] The data range declared for the field is: ; The constraints are: ; in, express The total number of bytes.

[0061] The sum of the offset of the length field in the message and the value of the length field is usually less than the size of the protocol data unit; otherwise, the field is not a length field.

[0062] For fields that satisfy the data range, we identify them by evaluating how well a candidate field behaves like a true length field. In this case, the length field identification problem can be transformed into a multi-dimensional hypothesis testing problem. Therefore, the following assumptions are designed: Null hypothesis For: Not a length field; Alternative Hypothesis for: It is a length field.

[0063] Then, a set of test statistics was calculated to reject the test. If ultimately rejected Then accept That is to say, it is believed It is a length field.

[0064] The first test statistic is a semantic consistency statistic used to measure the consistency between field values ​​and the actual data length within their defined interval. ,in, express The actual number of bytes, Represents the smoothing factor; when A value close to 1 indicates that the field value is consistent with the actual data length within its defined range.

[0065] The second test statistic is a structural boundary strength statistic used to measure the difference in the distribution of byte values ​​inside and outside the interval defined by the field. ,in, express Boundary strength, , , They represent The value of all internal and external bytes is The proportion of bytes, Indicates the use of measurement and The degree of difference between them, Jensen-Shannon divergence Indicates a mixed distribution. , , They represent the measures used for measurement. , and The degree of difference between them is represented by the Kulbeck-Leibler divergence.

[0066] The third test statistic is a statistic used to measure whether the distribution of field values ​​exhibits imbalance, indicating the reasonableness of the value distribution. ,in, express exist The entropy value in This represents the maximum entropy when the field values ​​are evenly distributed; the lower the entropy value, the more obvious the distribution bias, and the closer it is to a length field.

[0067] The fourth test statistic is a pointer validity statistic used to measure whether the interval pointed to by the field is always within the message boundary. ,in, Indicates the use of judgment A Boolean indicator function to determine whether the message is completely contained within the message boundary; if the constraint is met, then... ,otherwise .

[0068] The overall confidence score is: ; in, , , , They represent , , , The weight, .

[0069] like If the score is greater than the overall confidence score threshold, then it is determined that... This is the length field.

[0070] In one possible embodiment, verifying and confirming the identified structure identifier field and length field specifically includes the following steps: Step 1: Extract the structural identifier field from the message based on the protocol spectrum and convolutional neural network, and construct a candidate structural identifier field set; Step 2: Select the structure identifier field from the candidate structure identifier field set to cluster all messages in the protocol, obtain several message subsets, each subset corresponds to a protocol structure, and set the current parsing position as the end position of the structure identifier field; Step 3: Extract the length field from the message starting from the current parsing position based on multidimensional hypothesis testing, and construct a candidate length field set; Step 4: If the candidate length field set is empty, return to step 2; otherwise, select a length field from the candidate length field set, extract the data content of each message within the data range declared by the selected length field as a sub-message, use the sub-message as the new parsing object, and update the current parsing position to the next byte after the end position of the data range; then repeat steps 3 and 4 until no possible length field can be found. Step 5: When no new length field can be identified, check the remaining data length after the current parsing position in each message. If the remaining data length is the same in all messages, it is determined that the structure identifier field selected from the candidate structure identifier field set and the length field finally selected from the candidate length field set are both correct key fields. Otherwise, return to step 3 and continue to select the next possible length field from the candidate length field set for judgment.

[0071] Taking the reverse engineering of the Siemens S7Comm industrial control protocol as an example, this paper verifies the effectiveness of the key field identification method in the industrial control protocol provided in this embodiment of the invention. Figure 1 As shown, the specific steps include the following: Step 101: Collect network traffic of the S7Comm protocol. If it is determined that no obvious delimiter and standard TLV encoding are used, proceed to the binary structure analysis process, and then go to step 102. Step 102: Extract several messages and construct a protocol spectrum. After training the convolutional neural network (CNN), a heatmap is generated using Grad-CAM. A significant vertical bright stripe is observed at the 5th byte position with a concentrated value range (e.g., 0x31, 0x32, etc.), confirming it as a structure identifier field. Messages are categorized into various types such as requests and responses based on this field value, and then proceed to step 103. In step 103: In the "Job Request" type subset, run the multidimensional hypothesis testing model. The model traverses the candidate fields and finally identifies multiple length fields with high confidence, then proceeds to step 104. For example: a field with offset 10, length 2 bytes, and big-endian order indicates the length of the subsequent parameter part; a field with offset 14, length 2 bytes, and big-endian order indicates the length of the subsequent data part. Step 104: Using the identified structure identifier field (byte 5) and multiple length fields, recursively parse and verify all messages. Verification shows that all messages can be correctly and completely segmented without conflicts or remaining data; verification passed. Step 105: Output the key field identification results of the S7Comm protocol, form a preliminary format template, and clearly indicate the position and semantics of the structure identifier field and multiple length fields.

[0072] The method for identifying key fields in industrial control protocols provided in this invention can effectively solve the problem of reverse analysis of complex protocols and improve the accuracy of protocol reverse analysis results.

[0073] This invention provides a computer device, comprising: Storage medium: used to store computer programs; Processor: Used to execute computer programs to implement the key field identification method in the industrial control protocol provided in the embodiments of the present invention.

[0074] This invention provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the key field identification method in the industrial control protocol provided in this invention.

[0075] This invention provides a computer program product, including a computer program that, when executed by a processor, implements the key field identification method in the industrial control protocol provided in this invention.

[0076] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0077] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, as well as combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart. Figure 1 One or more processes and / or boxes Figure 1 A system that specifies functions in one or more boxes.

[0078] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including an instruction set implemented in a process. Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0079] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0080] The above are merely preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the technical principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A method for identifying key fields in an industrial control protocol, characterized in that, include: Classify the methods of dividing protocol fields: If a delimiter exists in the message, it is determined that the protocol uses a delimiter to divide the fields, and the key fields in the protocol are identified by using the characteristics of the delimiter. If the message does not contain a delimiter, the protocol is decoded using type-length-value. If decoding is successful, it is determined that the protocol uses type-length-value encoding to divide fields, and the key fields in the protocol are identified by type-length-value decoding. If decoding fails, it is determined that the protocol uses a preset message structure for field division, and the key fields in the protocol are identified using the following method: Construct a representation model for the message sequence and key fields in the protocol, and perform mathematical modeling for the structure identifier field and length field; When there is only one length field in the protocol, the length field is identified based on the correlation between the message length difference and the field value difference, and the structure identifier field is identified based on the consistency of the field value in the same type of message; When there are multiple length fields in the protocol, the structure identifier field is identified based on the protocol spectrum and the convolutional neural network, and the length field is identified based on the multidimensional hypothesis test. Verify and confirm the identified structural identifier field and length field to complete the identification of key fields.

2. The method for identifying key fields in industrial control protocols according to claim 1, characterized in that, Constructing a representation model for the message sequence and key fields in the protocol, including mathematical modeling of the structure identifier field and length field, includes: Let the message sequence be ,in, , … … They represent The first, second, ... … A message, express The total number of messages sent in the interim; set up The value of the corresponding structure identifier field is If the protocol does not have a structure identifier field, then Empty; The Middle Message length Represented as: ； in, express The base length of the fixed portion in the corresponding protocol structure that is not affected by the variable-length field. express In the corresponding protocol structure, the first The value of the length field The actual length of the mapped field. express The total number of length fields in the corresponding protocol structure. It is a constant, representing the length of other fixed parts in the protocol structure.

3. The method for identifying key fields in industrial control protocols according to claim 1, characterized in that, When there is only one length field in the protocol, the length field is identified based on the correlation between the message length difference and the field value difference. When the protocol structure contains only a length field and the byte offset is fixed, the length difference between any two messages in the protocol is calculated as follows: ； in, , They represent The Middle , Message length, , They represent The Middle , individual message , The value of the corresponding structure identifier field, , They represent , The base length of the fixed portion in the corresponding protocol structure that is not affected by the variable-length field. , They represent , The value of the first length field in the corresponding protocol structure , The actual length of the mapped field; If two messages have the same protocol structure, then the difference in message length is simplified to: ； For all messages in the protocol, traversing the field of length 1 byte or 2 bytes at each byte offset will satisfy... The field is determined to be a length field.

4. The method for identifying key fields in industrial control protocols according to claim 3, characterized in that, When the protocol contains only a length field, the structure identifier fields used to identify consistency of the field value across similar messages include: like If the calculation result is not 0, then it is determined that the protocol has multiple structures; When a protocol has multiple structures, the structure identifier field, represented by 1 byte or 2 bytes, has the characteristic that the field value is the same in messages with the same protocol structure and the field value is different in messages with different protocol structures. If this feature is not present, the structure identifier field is determined to be represented in bit-level form. Bitwise AND and bitwise OR operations are performed on the byte values ​​of messages with the same protocol structure at the same byte position, and the results of the bitwise AND and bitwise OR operations are then XORed to obtain the bit change pattern of the same protocol structure at the same byte position. ； in, Indicates the first The first byte position Bit change patterns in the protocol structure , … They represent the first The first, second, ..., ... of the protocol structure The first message bytes, Indicates bitwise AND. Indicates bitwise OR. Indicates bitwise XOR; Perform a bitwise OR operation on the bit change patterns of all protocol structures at the same byte position to obtain the combined bit change pattern of all messages at the same byte position: ； in, Indicates that all messages are in the first... The overall bit change pattern at each byte position , … They represent the first The 1st, 2nd, ..., byte positions Bit change patterns in the protocol structure Indicates the total number of protocol structures; Consecutive 0 bits in the comprehensive bit change pattern are identified as the structure identifier field.

5. The method for identifying key fields in industrial control protocols according to claim 1, characterized in that, When multiple length fields exist in the protocol, the structure identifier fields identified by the protocol spectrum and convolutional neural network include: message sequence Each message in the process is normalized: ； in, , … … They represent The first, second, ... … A message, express The total number of messages in the interim report Indicates the normalized result , , … They represent The first, second, ... Each byte has a value of [number] bytes. Integers within the range express The maximum total number of bytes in each message; from Take out Each normalized message is constructed with a height of Width is Image matrix : ； in, … They represent from The first normalized message extracted from the first normalized message, ... bytes, … They represent from The first one taken from In the normalized message, the first, ..., ... 1 byte; right Normalization is performed: ； in, Indicates the normalized result ; Building a convolutional neural network: The input layer is: ； in, This represents the input to the convolutional neural network; The convolutional layer is: ； in, Indicates the first Spatial location of the feature maps output by each convolutional layer First The value of each channel, This represents the activation function. Indicates the first The first convolutional layer The first convolutional kernel Line 1 Liede The weight of each channel, Indicates the first Spatial location of the feature maps output by each convolutional layer First The value of each channel, Indicates the first The first convolutional layer The bias terms corresponding to each convolution kernel This represents the height of the convolution kernel, i.e., the number of rows. This represents the width of the convolution kernel, i.e., the number of columns. Indicates the first The total number of channels in each convolutional layer; The pooling layer is: ； in, Indicates the first Spatial location of the feature map output by each pooling layer First The value of each channel, Indicates the first The feature maps output by each convolutional layer are displayed in the pooling window. Inner The value of each channel, Indicates the step size of the pooling window; The feature maps are flattened after passing through convolutional and pooling layers and then input into the fully connected layer; The output layer uses the Softmax function to convert the output of the fully connected layer into a probability distribution of the protocol structure category; Generating heatmaps using gradient-weighted class activation mapping: Let the output of the fully connected layer be the first... The original scores for each protocol structure are The spatial location of the feature map output by the last convolutional layer First The value of each channel is The feature map size is , Indicates the height of the feature map. Indicates the width of the feature map. Indicates the number of channels. The gradient is ; Global average pooling is performed on the spatial dimension of each channel to obtain the importance weights of neurons: ； in, Indicates the first The first channel is for identifying the first... The importance weights of neurons in each protocol structure; Class activation graph: ； in, Representing the spatial location of the feature map For the classification result of the first The importance of each protocol structure; Will Size upsampling A heat map was obtained. ; Calculate the average saliency of the spatial location of the feature map under different protocol structures: ； in, The average saliency of the spatial location of the feature map under different protocol structures. Indicates the total number of protocol structures; right Sort according to The ranking determines the candidate position of the structure identifier field. ; Check all messages Byte distribution: ； in, Indicates that all messages are in A collection of bytes, Indicates the first The message is in bytes, Indicates any; like If the number of discrete values ​​is lower than the threshold for the number of discrete values, and the correlation between the discrete values ​​and the protocol structure to which the message belongs is greater than the correlation threshold, then it is determined that... This identifies the location of the structure's identifier field.

6. The method for identifying key fields in industrial control protocols according to claim 5, characterized in that, When multiple length fields exist in the protocol, the length fields identified by multidimensional hypothesis testing include: Define the length field as a triple: ； in, Indicates the starting byte position of the length field in the message. Indicates the size in bytes of the length field. Indicates the byte order of the length field; The function for extracting field values ​​is: ； in, express The The original byte value at the specified byte position is [value]. Integers within the range This indicates the byte offset within the length field. This represents the byte order weighting exponent function, corresponding to big-endian. Little-endian correspondence ; The data range declared for the field is: ； The constraints are: ； in, express The total number of bytes; Set the null hypothesis for: Not a length field, alternative assumption for: It is a length field; The first test statistic is a semantic consistency statistic used to measure the consistency between field values ​​and the actual data length within their defined interval. ,in, express The actual number of bytes, Indicates the smoothing factor; The second test statistic is a structural boundary strength statistic used to measure the difference in the distribution of byte values ​​inside and outside the interval defined by the field. ,in, express Boundary strength, , , They represent The value of all internal and external bytes is The proportion of bytes, Indicates the use of measurement and The degree of difference between them, Jensen-Shannon divergence Indicates a mixed distribution. , , They represent the measures used for measurement. , and The Kulbeck-Leibler divergence of the degree of difference between them; The third test statistic is a statistic used to measure whether the distribution of field values ​​exhibits imbalance, indicating the reasonableness of the value distribution. ,in, express exist The entropy value in This represents the maximum entropy when the field values ​​are uniformly distributed. The fourth test statistic is a pointer validity statistic used to measure whether the interval pointed to by the field is always within the message boundary. ,in, Indicates the use of judgment A Boolean indicator function to determine whether the message is completely contained within the message boundary; if the constraint is met, then... ,otherwise ; The overall confidence score is: ； in, , , , They represent , , , The weight, ; like If the score is greater than the overall confidence score threshold, then it is determined that... This is the length field.

7. The method for identifying key fields in industrial control protocols according to claim 1, characterized in that, The verification and confirmation of the identified structure identifier field and length field include: Based on the protocol spectrum and convolutional neural network, structural identifier fields are extracted from the message to construct a candidate structural identifier field set; Select the structure identifier field from the candidate structure identifier field set to cluster all messages in the protocol, and obtain several message subsets. Each subset corresponds to a protocol structure, and set the current parsing position as the end position of the structure identifier field. Based on multidimensional hypothesis testing, extract the length field from the message starting from the current parsing position and construct a candidate length field set; If the candidate length field set is empty, then the structure identifier field is reselected from the candidate structure identifier field set to cluster all messages in the protocol. Otherwise, the length field is selected from the candidate length field set, and the data content of each message within the data range declared by the selected length field is extracted as a sub-message. The sub-message is used as the new parsing object, and the current parsing position is updated to the next byte after the end position of the data range. When no new length field can be identified, check the remaining data length after the current parsing position in each message. If the remaining data length is the same in all messages, it is determined that the structure identifier field selected from the candidate structure identifier field set and the length field finally selected from the candidate length field set are both correct key fields. Otherwise, the length field is re-selected from the candidate length field set for verification. If all length fields fail to be verified, the structure identifier field is re-selected from the candidate structure identifier field set for verification.

8. A computer device, characterized in that, include: Storage medium: used to store computer programs; Processor: Used to execute the computer program to implement the key field identification method in the industrial control protocol according to any one of claims 1 to 7.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the computer program implements the key field identification method in the industrial control protocol as described in any one of claims 1 to 7.

10. A computer program product, comprising a computer program, characterized in that, When executed by a processor, the computer program implements the key field identification method in the industrial control protocol as described in any one of claims 1 to 7.

Images