A pattern serialization-driven probabilistic method for industrial control traffic fingerprinting

Abstract

This invention relates to a pattern-serialized probabilistic method for industrial control system (ICS) flow fingerprint recognition. By abstracting flow data collected from ICS devices into patterns, pattern sequences can be extracted. Based on this, a suffix array algorithm is used to process the pattern sequences, thereby generating ICS device fingerprints. Finally, when device identification is required, the flow of unknown devices is abstracted into patterns, and corresponding query sequences are generated. These sequences are then slidably divided into multiple subsequences. Probabilistic matching is performed between these subsequences and the fingerprints of each device, and the result with the highest matching score is used as the identification result. This method can be applied to device fingerprint recognition in various industrial control systems.

Description

Technical Field

[0001] This invention application relates to the field of industrial control system traffic fingerprint recognition technology, specifically to a pattern serialization-driven probabilistic recognition method for industrial control system traffic fingerprints. Background Technology

[0002] Because industrial production requires real-time monitoring, industrial control equipment is typically connected to the public internet, facilitating information exchange but also exposing it to various internet security challenges. Even a minor attack on industrial control equipment can cause significant damage to critical infrastructure, necessitating stronger security mechanisms. Furthermore, the increasing number of industrial infrastructure security incidents worldwide has raised public awareness of the cybersecurity issues and unique security requirements of industrial control systems.

[0003] Current industrial control system fingerprinting methods include time fingerprinting, protocol fingerprinting, traffic fingerprinting, and various hybrid fingerprinting methods. Zuo Haibo et al. proposed a fingerprint normalization method for industrial control equipment. This method first scans the active ports of the industrial control equipment, then performs fingerprint detection on a preset industrial control protocol script to obtain the fingerprint, and finally normalizes the fingerprint based on its reliability. However, the fingerprint information proposed in this method is biased towards hardware information, with less consideration for the industrial control protocol itself, resulting in relatively coarse granularity. Liu Zhijie et al. proposed a method and system for anomaly detection of dark web services based on hybrid fingerprint features. This method first collects single-point fingerprint features, topic-related fingerprint features, and traffic fingerprint information. Then, it determines whether the traffic is abnormal by comparing whether the feature value changes exceed a threshold within a fixed time interval. Although it extracts a large number of features, the threshold is a fixed value, limiting its adaptability to different situations.

[0004] This invention utilizes pattern recognition methods to extract information with finer granularity. For each industrial control protocol, fields with high identifiability and low variation are also included as features, and these features are abstracted into a pattern sequence. Secondly, in the matching process, considering the large amount of traffic, it is divided into traffic segments, and a probabilistic recognition method is used, which has a certain adaptability to different industrial control equipment and situations.

[0005] The patent "A Vulnerability Detection Method for New Energy Edge Industrial Control Systems Based on Raspberry Pi" utilizes a feature fingerprint database to construct vulnerabilities in the database, enabling vulnerability detection in industrial control systems. This invention focuses on using traffic generation pattern sequences to achieve fingerprint-based detection of abnormal traffic. The patent "A Method, Device, and Equipment for Detecting Industrial Control Traffic" primarily uses the corresponding behavior of the target device to infer whether the packets are malicious attacks, emphasizing dynamic response detection of abnormal traffic packets. However, this invention generates relatively fixed fingerprints for the corresponding industrial control devices, identifying the corresponding industrial control traffic through fingerprint matching. The patent "An Industrial Control Traffic Protocol Identification Method Based on Deep Learning" also requires industrial control traffic identification, but the computational cost of machine learning is relatively high, requiring training numerous hyperparameters. This invention mainly utilizes pre-generated fingerprints and performs matching through probabilistic recognition, reducing time overhead.

[0006] Taking into account the focus and advantages and disadvantages of the above methods, the inventors proposed a pattern serialization-driven probabilistic identification method for industrial control traffic fingerprints, which can generate different fingerprints for different industrial control devices and identify traffic fingerprints based on pattern serialization and probability. Summary of the Invention

[0007] The purpose of this invention is to overcome the shortcomings of the prior art and provide a pattern serialization-driven probabilistic identification method for industrial control traffic fingerprints, which mainly solves the problem of industrial control traffic fingerprint identification.

[0008] Technical Problem: To effectively identify different industrial control traffic fingerprints, this invention employs a pattern serialization-driven probabilistic identification method for industrial control traffic fingerprints. By constructing industrial control traffic fingerprints for different hosts and segmenting query traffic, the method identifies industrial control traffic fingerprints based on probability, effectively distinguishing different industrial control traffic types. This is precisely the objective of this invention.

[0009] Technical Solution: To achieve the above-mentioned objectives, the present invention adopts a pattern-sequence-driven probabilistic identification method for industrial control system traffic fingerprints. This method abstracts industrial control traffic into patterns, and then, based on pattern sequence-driven probabilistic identification, identifies the industrial control traffic fingerprint. The following is the overall workflow of the industrial control traffic fingerprint probabilistic identification:

[0010] Step 1: Divide the captured traffic data into several complete traffic streams, and abstract each stream into a pattern s. i This allows us to obtain the pattern sequence for each device;

[0011] Step 1-1: Capture traffic packets on the industrial control equipment and save them as a pcap file.

[0012] Steps 1-2: For each traffic packet, all traffic belonging to that traffic packet needs to be merged to obtain a complete data stream. i For the corresponding industrial control protocol, the construction mode is as follows: Steps (1-3) are as follows:

[0013] Steps 1-3: Extract the stream i The MAC layer, IP layer, TCP layer, and upper-layer industrial control protocols are identified by highly distinctive and relatively unchanging characteristic fields. Different industrial control protocols select different fields, ultimately resulting in a pattern s. i ,

[0014] Steps 1-4: Repeat steps (1-2) and (1-3) until all patterns for a certain device have been extracted, and convert these patterns into a pattern sequence Trav=<s1,s2,...,s n The proposed scheme yields a pattern sequence that is an abstraction of device features, enabling better feature extraction. Furthermore, storage compression optimization saves storage space. The abstract sequence better reflects fingerprint information, ensuring the effectiveness of the matching results and the generalization ability of the model.

[0015] Step 2: Treat the pattern sequence as a fingerprint of the device and compress the repeating patterns;

[0016] Step 2-1: Traverse the pattern sequence of each industrial control device. For repeated patterns, store them only once in the pattern sequence and use a new array `num` of the same size to store the count of each pattern. This compresses the storage units and reduces the number of matches.

[0017] Step 3: Divide the pattern corresponding to the query traffic into multiple sequence slices, and use probability matching to calculate the matching score of the query sequence on each device fingerprint sequence;

[0018] Step 3-1: For the queried traffic packets, extract the pattern sequence as in Step 1.

[0019] Step 3-2: Determine the threshold τ and divide the query sequence q into τ pieces, with the length of each piece as shown in equation (1).

[0020]

[0021] If τ is not divisible by the total length, then the lengths of all pieces except the last one are as shown in equation (1). The length of the last piece will be slightly greater than d, but will not exceed d.

[0022] Step 3-3: Divide each query sequence q into its shards q. i Each mode in the mode sequence of each industrial control device Perform exact matching, where k represents the pattern sequence of the kth industrial control device, i represents the i-th pattern of a certain sequence, and n represents the number of successful matches. s A total of n were matched. t Then, the probability of matching the query sequence q is given by equation (2):

[0023]

[0024] The result calculated by equation (2) represents the probability value of the query sequence q matching the pattern sequence of the kth industrial control device. In this scheme, probability matching has better adaptability than general exact matching, and can give the matching judgment result to the greatest extent; at the same time, the probability can reflect the similarity between fingerprints.

[0025] Step 4: Analyze the matching score of each device fingerprint, find the optimal matching result, and use this matching result as the final device identification result.

[0026] Step 4-1: For the query sequence q, and for the pattern sequence of each industrial control device, repeat steps (3-1) to (3-3). Assuming there are a total of m industrial control devices, the matching probability vector Vec of the query sequence q can be calculated. q (p q1 ,p q2 ,...,p qm ).

[0027] Step 4-2: Apply the input matching probability vector Vec q (p q1 ,p q2 ,...,p qm Sort the array in descending order to get the index array, i.e., index←argsort(Vec q ).

[0028] Step 4-3: Select the category with the highest probability as the final identification result, that is, the traffic of industrial control equipment whose query sequence q is index0.

[0029] Step 4-4: If there is more than one query sequence, perform step (4-1) on each query sequence to obtain t matching probability vectors. Combine the probability (column) vectors into a probability matrix M. (m,t) .

[0030] Steps 4-5: For probability matrix M (m,t) Each row vector V row The average value is calculated to obtain the comprehensive matching probability vector Vec. (m,1) .

[0031] Steps 4-6: Execute steps (4-2) to (4-3) to obtain the judgment result of the query sequence set.

[0032] Beneficial effects: This invention can construct pattern sequences based on the industrial control traffic of devices, segment the query traffic, and effectively identify the query traffic based on pattern sequence driving and probability. It can detect abnormal traffic in industrial control traffic and identify which device the traffic corresponds to. General traffic packet identification relies on keywords, but it is prone to missed detections. After segmenting the traffic and abstracting it into pattern sequences, the identification effect is better, and more potential abnormal traffic can be detected. Attached image description:

[0033] Figure 1 This is the overall flowchart of pattern sequence-driven probabilistic recognition of industrial control traffic fingerprints;

[0034] Figure 2 This is a schematic diagram of pattern sequence compression;

[0035] Figure 3 This is a diagram illustrating query traffic slicing. Detailed implementation method:

[0036] The present invention will be further explained below using the Modbus protocol as an example, in conjunction with the accompanying drawings and specific embodiments.

[0037] Example: Figure 1 The overall workflow of pattern-driven probabilistic recognition of industrial control system traffic fingerprints is described. Furthermore... Figure 3 The specific process for querying traffic slices is described. In this embodiment, industrial control traffic corresponding to the Modbus protocol is used as an example. Other industrial control scenarios can also be implemented with reference to this embodiment, and it can be applied to scenarios corresponding to various industrial control protocols, including DNP3, ENIP, and S7Comm. The specific steps for identifying industrial control traffic fingerprints based on the collected industrial control traffic data corresponding to the Modbus protocol are as follows:

[0038] Step 1: Divide the captured traffic data into several complete traffic streams, and abstract each stream into a pattern s. i This allows us to obtain the pattern sequence for each device;

[0039] Step 1-1: Capture traffic packets on the industrial control equipment and save them as a pcap file.

[0040] Steps 1-2: For each traffic packet, all traffic belonging to that traffic packet needs to be merged to obtain a complete data stream. i For the corresponding industrial control protocol, the construction mode is as follows: Step 1-3: Extract stream iThe MAC layer, IP layer, TCP layer, and transaction, function code, unit, and address information fields are used to obtain a pattern s. i .

[0041] Steps 1-4: Repeat steps (1-2) and (1-3) until all patterns for a certain device have been extracted, and convert these patterns into a pattern sequence Trav=<s1,s2,...,s n >.

[0042] Step 2: Treat the pattern sequence as a fingerprint of the device and compress the repeating patterns;

[0043] Step 2-1: Traverse the pattern sequence of each industrial control device. For repeated patterns, store them only once in the pattern sequence and use a new array num of the same size to store the number of each pattern. This compresses the storage units and reduces the number of matching times.

[0044] Step 3: Divide the pattern corresponding to the query traffic into multiple sequence slices, and use probability matching to calculate the matching score of the query sequence on each device fingerprint sequence;

[0045] Step 3-1: For the queried traffic packets, extract the pattern sequence as in Step 1.

[0046] Step 3-2: Determine the threshold τ and divide the query sequence q into τ pieces, with the length of each piece as shown in equation (1).

[0047]

[0048] If τ is not divisible by the total length, then the lengths of all pieces except the last one are as shown in equation (1). The length of the last piece will be slightly greater than d, but will not exceed d.

[0049] Step 3-3: Divide each query sequence q into its shards q. i Each mode in the mode sequence of each industrial control device Perform exact matching, where k represents the pattern sequence of the kth industrial control device, i represents the i-th pattern of a certain sequence, and n represents the number of successful matches. s A total of n were matched. t Then, the probability of matching the query sequence q is given by equation (2):

[0050]

[0051] The result calculated by equation (2) represents the probability value of the query sequence q matching the pattern sequence of the kth industrial control device.

[0052] Step 4: Analyze the matching score of each device fingerprint, find the optimal matching result, and use this matching result as the final device identification result.

[0053] Step 4-1: For the query sequence q, and for the pattern sequence of each industrial control device, repeat steps (3-1) to (3-3). Assuming there are a total of m industrial control devices, the matching probability vector Vec of the query sequence q can be calculated. q (p q1 ,p q2 ,...,p qm ).

[0054] Step 4-2: Apply the input matching probability vector Vec q (p q1 ,p q2 ,...,p qm Sort the array in descending order to get the index array, i.e., index←argsort(Vec q ).

[0055] Step 4-3: Select the category with the highest probability as the final identification result, that is, the traffic of industrial control equipment whose query sequence q is index0.

[0056] Step 4-4: If there is more than one query sequence, perform step (4-1) on each query sequence to obtain t matching probability vectors. Combine the probability (column) vectors into a probability matrix M. (m,t) .

[0057] Steps 4-5: For probability matrix M (m,t) Each row vector V row The average value is calculated to obtain the comprehensive matching probability vector Vec. (m,1) .

[0058] Steps 4-6: Execute steps (4-2) to (4-3) to obtain the judgment result of the query sequence set. It should be noted that the above embodiments are not intended to limit the scope of protection of this invention. Equivalent transformations or substitutions made based on the above technical solutions all fall within the scope of protection of the claims of this invention.

Claims

1. A pattern serialization-driven probabilistic identification method for industrial control flow fingerprints, characterized in that, The method includes the following steps: (1) Divide the industrial control flow data into several complete flows, and abstract each flow into a pattern. Obtain the pattern sequence for each device; (2) Treat the pattern sequence as the fingerprint of the device and compress the repeating patterns; (3) Query the pattern corresponding to the traffic, use a sliding window to divide it into multiple sequence pieces, and use probability matching to calculate the matching score of the query sequence on each device fingerprint sequence; (4) Determine the matching score of each device fingerprint, find the optimal matching result, and use the matching result as the final device identification result; Specifically, step (3) is as follows: (3-1) For the queried traffic packets, extract the pattern sequence according to step (1). (3-2) Determine the threshold Query sequence Cut into Each piece has a length as shown in equation (1). （1） like If the total length is not divisible by the total length, then the lengths of all pieces except the last one are equal to the lengths in equation (1), with the last piece being slightly longer than the total length. But it will not exceed , (3-3) For each query sequence Fragments Each mode in the mode sequence of each industrial control device Perform exact matching, where Indicates the first A sequence of modes for each industrial control device. Represents the first position of a sequence There are several patterns, and the number of successful matches is recorded as [symbol]. A total of 100 matches were found. Next, query sequence The probability of a match is given by equation (2): （2） The result calculated by equation (2) represents the query sequence. In the The probability value of pattern sequence matching for an industrial control device.

2. The industrial control traffic fingerprint probabilistic recognition method driven by pattern serialization according to claim 1, characterized in that, Step (1) specifically includes: Step 1-1: Capture traffic packets on the industrial control equipment and save them as a pcap file. Steps 1-2: For each traffic packet, all traffic belonging to that traffic packet needs to be merged to obtain a complete data stream. For the corresponding industrial control protocol, construct the mode as follows: Steps 1-3: Steps 1-3: Extraction The MAC layer, IP layer, TCP layer, and upper-layer industrial control protocols are identified by highly distinctive and relatively unchanging characteristic fields. Different industrial control protocols select different fields, ultimately resulting in a pattern. , Steps 1-4: Repeat steps 1-2 and 1-3 until all patterns for a given device have been extracted, and convert these patterns into a pattern sequence. The pattern sequence obtained by this scheme is an abstraction of device features, which can better extract features; at the same time, the storage is compressed and optimized to save storage space.

3. The industrial control traffic fingerprint probabilistic recognition method driven by pattern serialization according to claim 1, characterized in that, Step (2) is specifically as follows: (2-1) Iterate through the pattern sequence of each industrial control device. For repeated patterns, store them only once in the pattern sequence and use a new array of the same size. It stores the number of each pattern, compresses storage units, and reduces the number of matches.

4. The industrial control traffic fingerprint probabilistic recognition method driven by pattern serialization according to claim 1, characterized in that, Step (4) specifically includes: (4-1) For the query sequence Meanwhile, for each industrial control device's mode sequence, repeat steps (3-1) to (3-3), assuming there are a total of For each industrial control device, the query sequence is calculated. Matching probability vector , (4-2) Matching probability vector of the input Sort in descending order to obtain the array of indices for the sorted sequence. , (4-3) Select the class with the highest probability as the final identification result, i.e., the query sequence. yes The flow rate of this type of industrial control equipment. (4-4) If there is more than one query sequence, then perform step (4-1) on each query sequence to obtain the result. The matching probability vectors are combined into a single probability matrix. , (4-5) For the probability matrix Each row vector Calculate the average value to obtain the comprehensive matching probability vector. , (4-6) Execute steps (4-2) to (4-3) to obtain the judgment result of the query sequence set.

Images