Industrial control protocol identification method of fusion network

Abstract

This invention belongs to the field of Industrial Internet of Things (IIoT) and discloses a method for identifying industrial control protocols using a fusion network. This method is used to identify complex multi-protocol messages in an industrial control environment. The method first extracts sessions from the industrial control protocol messages obtained from the industrial control network. Through data preprocessing, the session messages are divided into two different forms: grayscale image data and session formatted message data. These are then used as dual-channel inputs to train an AlexNet model and a TCN model, respectively. The two models are then fused to obtain a trained model network. By capturing data packets in the industrial environment in real time, performing data preprocessing, and loading the trained classification model network for inference, accurate identification results are obtained. This invention can automatically identify input industrial control protocol messages, achieving fast and high-precision classification while preserving more complete information in the messages. It also reduces information loss and improves the speed and accuracy of identification.

Description

Technical fields:

[0001] This invention relates to an industrial control protocol identification method, specifically to an industrial control protocol identification method for a converged network. Background technology:

[0002] With the continuous development of the Industrial Internet of Things (IIoT), there are currently dozens of types of industrial fieldbuses and industrial Ethernet protocols included in the IEC international standards. However, due to the different supporting manufacturers and development organizations, each industrial network protocol has different physical interfaces, transmission mechanisms, and object requirements. To protect their own interests, each manufacturer prioritizes promoting its own technology and is incompatible with other manufacturers' equipment. Therefore, most protocol standards often form their own systems, creating closed hardware and software systems. In a network environment where numerous industrial control protocols coexist, protocol identification is crucial for interoperability.

[0003] Traditional network protocol identification methods mainly include: 1. TCP / UDP port-based protocol identification: This method fails to define port numbers for all applications and services, making it difficult to form and accumulate a complete port mapping relationship. 2. Application service identification based on payload analysis: This method requires examining the application layer payload content of a large number of packets to determine whether the above features are matched. Using this method requires continuous tracking of the development of the protocol to be identified. When the application layer communication process changes or new application protocols emerge, network devices must reload the file recording feature data to address these issues. For protocols with weak feature characteristics, this method has a high false alarm rate. 3. Correlation analysis identification technology: This method has specific applicability and therefore generally needs to be used in conjunction with other technologies such as TCP / UDP port-based identification technology. 4. Traffic identification based on behavioral characteristics: Based on the statistical characteristics of application protocol data flows; this method requires multivariate judgment analysis. This method has high storage overhead and poor real-time performance, slowing down its technological progress. 5. Traffic identification based on machine learning: The performance of this method mainly depends on the characteristics of manually designed feature extractors, limiting its versatility. All of the above traditional methods have obvious limitations. This invention proposes a converged network industrial control protocol identification method. Summary of the Invention:

[0004] The purpose of this invention is to overcome the shortcomings of current technology. This invention proposes an industrial control protocol identification method based on integrated networks, which can automatically identify input protocol messages. While preserving more complete information in the messages, it achieves fast and high-precision classification. Compared with manually selecting message field features to design classifiers, it can reduce the loss of industrial control protocol message information and improve the speed and accuracy of identification.

[0005] The technical solution of this invention to solve the above-mentioned technical problems is as follows:

[0006] 1. A method for identifying industrial control protocols using a fusion network, optionally comprising a model training part S1 and a model inference part S2:

[0007] The model training part S1 includes the following steps:

[0008] (S1-1) Obtain the industrial control protocol data packet and delete redundant information in the data packet;

[0009] (S1-2) Taking a single sensor connection link as a session, the multi-sensor combination data packet in the protocol is divided into several sessions according to the session, and then the sessions are preprocessed.

[0010] (S1-3) The session data is preprocessed to obtain two forms: grayscale image data and formatted message data. These are then used as dual-channel inputs to the Alexnet network and TCN network to extract feature information.

[0011] (S1-4) The AlexNet network and the TCN network are fused to obtain the trained protocol classification model.

[0012] The model inference part S2 includes the following steps:

[0013] (S2-1) Real-time capture of data packets in the industrial control network environment;

[0014] (S2-2) Divide the data packet into several sessions and perform data preprocessing on the sessions;

[0015] (S2-3) The data obtained from data preprocessing is used as dual-channel input to the trained classification model for inference, and the classification result of the model inference is obtained.

[0016] Optionally, in step (S1-1), the process involves acquiring industrial control protocol data packets, capturing protocol data packets from the industrial control network environment, or historically collected and accumulated traffic data packets, and deleting the data packet capture sequence number and time from the data packets.

[0017] Optionally, in step (S1-2), the data packets are divided into several sessions according to bidirectional streams having the same source IP, source port, destination IP, destination port, and transport layer protocol; the data preprocessing includes: formatting to unify the data length, that is, unifying the number of packets in bytes to n. 2 Excessive truncation and insufficient padding are handled using zero bytes. Formatted message data is input as a unit into a single channel. Grayscale image processing is performed, using the value of each byte of message data as its pixel value. The data is converted from hexadecimal to decimal, and value mapping is used to convert n... 2Convert 10 bytes of decimal data into an n×n grayscale image as input data for another channel.

[0018] Optionally, in step (S1-3):

[0019] Classification Model 1 is an AlexNet network. The input of the AlexNet network is the grayscale image of the protocol message obtained after data preprocessing, and the output is the protocol classification result. AlexNet uses ReLU as the activation function and Softmax as the output function. It includes Conv2d convolutional layers, Max_pool pooling layers, Dropout layers, Dense fully connected layers, and LocalResponsNormalization normalization layers.

[0020] Classification model 2 is a TCN network. The input of the TCN network is the session data obtained after data preprocessing, and the output is the protocol classification result. The TCN uses ReLU as the activation function and includes a 1D-FCN structure layer, a 1D-CNN convolutional layer, a CausalConvolutions causal convolutional layer, residual connections, and a Dropout layer.

[0021] Optionally, in steps (S1-4), the loss functions of both the AlexNet network and the TCN network are cross-entropy loss functions; the fusion of the AlexNet network and the TCN network involves multiplying the AlexNet network loss function LOSS1 and the TCN network loss function LOSS2 by weights to obtain the loss function LOSS of the fused model. 1,2 The loss function LOSS of the final classification model includes the AlexNet network loss function LOSS1, the TCN network loss function LOSS2, and the fusion loss function LOSS. 1,2 :

[0022]

[0023]

[0024] LOSS 1，2 =LOSS1*LOSS2 (3)

[0025] Where y label.i This represents the label of training sample i, y 1.i and y 2.i Let represent the predicted values ​​of sample i in Model 1 and Model 2, respectively; finally, the loss function of the entire classification network model is:

[0026] LOSS=α1LOSS1+α2LOSS2+α1α2LOSS 1，2 (4)

[0027] Where α1 and α2 are constants, representing the weights of Model 1 and Model 2, respectively.

[0028] Optionally, in step (S2-1), protocol data packets of the industrial control network environment are captured in real time, and the capture sequence number and time in the data packets are deleted.

[0029] Optionally, in step (S2-2), the data packets are divided into several sessions according to bidirectional streams having the same source IP, source port, destination IP, destination port, and transport layer protocol; the data preprocessing includes: formatting to unify the data length, that is, unifying the number of packets in bytes to n. 2 Excessive truncation and insufficient padding are handled using zero bytes. Formatted message data is input as a unit into a single channel. Grayscale image processing is performed, using the value of each byte of message data as its pixel value. The data is converted from hexadecimal to decimal, and value mapping is used to convert n... 2 Convert 10 bytes of decimal data into an n×n grayscale image as input data for another channel.

[0030] Compared with the prior art, the present invention has the following advantages:

[0031] 1. The industrial control protocol recognition method of the fusion network of the present invention puts two different types of data, grayscale images and protocol messages, into a classification model to extract spatial information and temporal features, and fuses the two different features to achieve a higher accuracy recognition effect.

[0032] 2. The industrial control protocol recognition method of the present invention pre-constructs the industrial control protocol classification model by fusing the loss functions of the AlexNet model and the TCN model. The AlexNet network model combines lightweight and high accuracy. Compared with other complex models, AlexNet reduces the model training time and inference time while ensuring high recognition accuracy. Compared with the RNN network, the TCN network breaks out of the RNN network framework, can process data in parallel, and the size of the receptive field is determined by the number of layers, the size of the convolution kernel, and the dilation coefficient. It can also be flexibly customized according to different tasks and characteristics. It can convert variable-length protocol messages into fixed-length outputs, with stable gradients and less memory usage. By fully combining the advantages of two different types of networks, compared with traditional CNN, RNN, and LSTM, it can extract feature information from industrial control protocols and achieve more accurate recognition results.

[0033] 3. The industrial control protocol identification method of the fusion network of the present invention can identify industrial control protocols with high accuracy while ensuring more complete information in the industrial control protocol messages, and the types of industrial control protocols identified are extremely wide. Attached image description:

[0034] Figure 1 This is a flowchart of the industrial control protocol identification method for the fusion network of the present invention.

[0035] Figure 2 This is a flowchart of the training process for the industrial control protocol identification method model network of the fusion network of the present invention.

[0036] Figure 3 This is a data processing flowchart for the industrial control protocol identification method of the fusion network of the present invention.

[0037] Figure 4 This is a flowchart of the network reasoning process for the industrial control protocol identification method model of the fusion network of the present invention.

[0038] Figure 5 The network diagram of the AlexNet model for the industrial control protocol identification method of the fusion network of the present invention is shown.

[0039] Figure 6 The diagram shows the TCN model network diagram of the industrial control protocol identification method for the fusion network of the present invention. Detailed implementation method:

[0040] The present invention will be further described in detail below with reference to the embodiments and accompanying drawings, but the embodiments of the present invention are not limited thereto.

[0041] See Figure 1 The industrial control protocol identification method of the fusion network of the present invention takes the acquired industrial control protocol messages as a session for a single sensor connection link, divides the multi-sensor combined data packets in the protocol into several sessions according to the session, and then performs data preprocessing on the sessions. The grayscale image and session formatted data obtained after data preprocessing are used as dual channels and input into the AlexNet network and TCN network respectively for training. Then, the two classification models are fused to obtain the trained model. The protocol data packets captured in real time are preprocessed and then loaded into the trained classification model for inference to obtain the inferred protocol classification result.

[0042] For details, see Figure 2 and Figure 3 In the industrial control protocol identification method of the fusion network of the present invention, the model training part S1 is:

[0043] (S1-1) Obtain the industrial control protocol data packet and delete redundant information in the data packet;

[0044] (S1-2) Take a single sensor connection link as a session. Based on the session, divide the multi-sensor combination data packet in the protocol into several sessions. Then, perform data preprocessing on the sessions. In the data preprocessing, n is set to 10.

[0045] (S1-3) The session data is preprocessed to obtain two forms: grayscale image data and formatted message data. These are then used as dual-channel inputs to the Alexnet network and TCN network to extract feature information.

[0046] (S1-4) Fuse the AlexNet network and the TCN network to obtain the trained protocol classification model.

[0047] See Figure 4 The model inference part S2 in the industrial control protocol identification method of the fusion network of the present invention:

[0048] (S2-1) Real-time capture of data packets in the industrial control network environment;

[0049] (S2-2) Divide the data packet into several sessions, perform data preprocessing on the sessions, and set n to 10 in the data preprocessing;

[0050] (S2-3) The data obtained from data preprocessing is used as dual-channel input to the trained classification model for inference, and the classification result of the model inference is obtained.

[0051] See Figure 5 and Figure 6 In this embodiment, classification model 1 is an AlexNet network, which uses Softmax as its output function and includes Conv2d convolutional layers, Max_pooling layers, Dropout layers, Dense fully connected layers, and LocalResponsNormalization layers. Classification model 2 is a TCN network, which also uses Softmax as its output function and includes 1D-FCN structure layers, 1D-CNN convolutional layers, Causal Convolutions layers, residual connections, WeightNormalization layers, and Dropout layers. The fusion of the AlexNet and TCN networks involves multiplying the AlexNet network loss function LOSS1 and the TCN network loss function LOSS2 by weights to obtain the loss function LOSS of the fused model. 1,2 Ultimately, the loss function LOSS of the entire classification network model includes the AlexNet network loss function LOSS1, the TCN network loss function LOSS2, and the fused loss function LOSS. 1,2 :

[0052]

[0053]

[0054] LOSS 1，2=LOSS1*LOSS2(3)

[0055] Where y label.i This represents the label of training sample i, y 1.i and y 2.i Let represent the predicted values ​​of sample i in Model 1 and Model 2, respectively; finally, the loss function of the entire classification network model is:

[0056] LOSS=α1LOSS1+α2LOSS2+α1α2LOSS 1，2 (4)

[0057] Where α1 and α2 are 0.5 and 0.5 respectively, representing the weights of Model 1 and Model 2.

[0058] The above are preferred embodiments of the present invention, but the embodiments of the present invention are not limited to the above content. Any changes, modifications, substitutions, combinations, or simplifications made without departing from the spirit and principle of the present invention shall be considered equivalent substitutions and shall be included within the protection scope of the present invention.

Claims

1. A method for identifying industrial control protocols of a converged network, characterized in that, The model training part S1 and the model inference part S2 are included: The model training part S1 includes the following steps: (S1-1), obtaining industrial control protocol data packets, and deleting redundant information in the data packets; (S1-2), taking a single sensor connection link as a session, cutting the multi-sensor combined data packets in the protocol into several sessions according to the session as a unit, and then performing data preprocessing on the sessions; (S1-3), performing data preprocessing on the session data to obtain gray image data and formatted message data in two forms, which are input into the Alexnet network and the TCN network as double channels to extract feature information; (S1-4), the Alexnet network and the TCN network are fused, that is, the Alexnet network loss function LOSS1 and the TCN network loss function LOSS2 are multiplied by weights to obtain a loss function LOSS of the fusion model 1,2 The loss function LOSS of the final classification model includes the Alexnet network loss function LOSS1, the TCN network loss function LOSS2 and the fused loss function LOSS 1,2 : LOSS 1，2 = LOSS1*LOSS2 (3) where y label.i represents the label of the training sample i, y 1.i and y 2.i represent the predicted value of sample i of model 1 and model 2 respectively, the loss function of the Alexnet network and the TCN network is the cross-entropy loss function; finally, the loss function of the entire classification network model is: LOSS = a1LOSS1 + a2LOSS2 + a1a2LOSS 1，2 (4) Wherein α1, α2 are constants, respectively representing the weight size of model 1 and model 2; Finally, a trained protocol classification model is obtained, and the model inference part S2 includes the following steps: (S2-1), real-time capture of data packets in the industrial control network environment; (S2-2), cutting the data packets into several sessions and performing data preprocessing on the sessions; (S2-3), inputting the data obtained by data preprocessing into the trained classification model as double channels for inference to obtain the classification result of model inference.

2. The method according to claim 1, wherein, In step (S1-1), the protocol data packets in the industrial control network environment or the protocol data packets accumulated by historical collection are captured, and the capture serial number and time in the data packets are deleted.

3. The method of claim 1, wherein the method further comprises: In step (S1-2), the data packets are divided into several sessions according to the bidirectional flow with the same source IP, source port, destination IP, destination port and transport layer protocol; the data preprocessing includes: formatting processing to unify the data length, i.e. unifying the number of report bytes to n 2 , more cutting and less supplementing, the supplemented bytes use zero bytes, the formatted message data is input as a unit to a channel; gray image processing, through the value of each byte of the message data as the pixel value of the byte, the 16 hexadecimal data of the data is converted into 10 decimal, through value mapping, the 10 decimal data of n 2 bytes is converted into an n×n gray image as the input data of another channel.

4. The fusion network industrial protocol identification method according to claim 1, characterized in that, In step (S1-3): The classification model 1 is the Alexnet network, and the input of the Alexnet network is the protocol message gray image obtained by data preprocessing, and the output is the protocol classification result; Alexnet takes ReLU as the activation function, takes Softmax as the output function, includes Conv2d convolution layer, Max_pool pooling layer, Dropout layer, Dense full connection layer, and LocalResponsNormalization normalization layer; The classification model 2 is the TCN network, and the input of the TCN network is the formatted message data obtained by data preprocessing, and the output is the protocol classification result; TCN takes ReLU as the activation function, including 1D-FCN structure layer, 1D-CNN convolution layer, CausalConvolutions causal convolution layer, residual connection, WeightNormalization normalization layer and Dropout layer.

5. The method of claim 1, wherein the method further comprises: In step (S2-1), the protocol data packets in the industrial control network environment are captured in real time, and the capture serial number and time in the data packets are deleted.

6. The method of claim 1, wherein the method further comprises: In step (S2-2), the data packets are divided into several sessions according to the bidirectional flow with the same source IP, source port, destination IP, destination port and transport layer protocol; the data preprocessing includes: formatting processing to unify the data length, i.e. unifying the number of report bytes to n 2 , more cutting and less supplementing, the supplemented bytes use zero bytes, the formatted message data is input as a unit to a channel; gray image processing, through the value of each byte of the message data as the pixel value of the byte, the 16 hexadecimal data of the data is converted into 10 decimal, through value mapping, the 10 decimal data of n 2 bytes is converted into an n×n gray image as the input data of another channel.

7. The method of claim 1, wherein the method further comprises: In step (S2-3), the gray image and the formatted message data are input into the trained model as double channels for inference to obtain the protocol classification result.

Images