A Method for Identifying Industrial Control Equipment Manufacturers Based on Industrial Control Protocol Communication Model

Abstract

This invention proposes a method for identifying industrial control equipment (ICS) manufacturers based on an industrial control protocol (ICS) communication model. The method involves constructing ICS fingerprint vectors applicable to various ICS protocols based on the ICS communication model; performing security scans on ICS devices on the Internet according to the ICS communication model to form an ICS fingerprint vector database; acquiring ICS manufacturer information and labeling the corresponding ICS fingerprint vectors; preprocessing the attribute values ​​in the ICS fingerprint vectors; clustering the ICS fingerprint vectors using a density peak-based random clustering algorithm to form an ICS fingerprint vector classification model; monitoring traffic in the target ICS network to extract ICS fingerprint vectors; and identifying ICS manufacturers in the target ICS network using a composite classification algorithm based on fingerprint vector packets. This method effectively solves the problem of difficulty in identifying manufacturer information for various ICS devices in industrial control networks and significantly improves the accuracy of ICS manufacturer identification.

Description

Technical Field

[0001] This invention relates to the field of industrial control system network security, specifically a method for identifying industrial control equipment manufacturers based on an industrial control protocol communication model. Background Technology

[0002] As industrial control systems become increasingly open, their traditional closed environment isolated from external networks is gradually being broken down, and network boundaries are becoming increasingly blurred. Various industrial control devices deployed within these systems can now be accessed not only by the enterprise management network but also directly via the internet. However, due to the lack of sufficient information security features within these devices and their design's limited consideration of protection against malicious external access, direct exposure to the internet poses a serious threat to their information security. Furthermore, with the increasing public disclosure of vulnerabilities and the continuous emergence of zero-day vulnerabilities, the security situation for industrial control devices is becoming even more severe.

[0003] To achieve comprehensive protection for industrial control equipment (ICS), identifying relevant equipment information and accurately profiling it is a fundamental and crucial task. Since existing vulnerability information is typically released for ICS devices from specific manufacturers, manufacturer information is particularly important for ICS security compared to other, simpler profiling information (such as device roles, connected objects, and traffic statistics). On one hand, attackers can launch targeted cyberattacks against ICS devices from different manufacturers, resulting in a higher success rate and greater difficulty in defense. On the other hand, when vulnerability information for a specific manufacturer's ICS devices is published, defenders can use this information to implement targeted and timely patch upgrades or security policy upgrades, increasing the difficulty of attacks and dynamically enhancing network defense capabilities.

[0004] However, information on industrial control equipment (ICS) manufacturers is often difficult to obtain directly, especially for industrial control systems that have been deployed for a long time. Due to data gaps or changes in network topology, it is difficult to obtain relevant ICS manufacturer information through queries. Although active probing technologies (such as NMap, Zmap, and PLCScan) have shown good performance and effectiveness in exposing ICS, the availability and real-time requirements of ICS in already operational industrial control systems mean that unsafe active probing behavior may affect the normal operation of ICS and even cause production interruptions. Therefore, such technologies cannot yet be applied to asset detection within industrial control systems.

[0005] Passive detection technologies (such as P0f, GRASSMARLIN, and Netdiscover) identify the identity, manufacturer, and type of industrial control equipment (ICS) by analyzing network traffic in the target ICS network. However, the main drawback of this type of method is its heavy reliance on the effectiveness and comprehensiveness of the ICS fingerprint database and the accuracy of the fingerprint matching algorithm. Currently, the challenge of establishing a relatively effective and comprehensive ICS fingerprint database remains unresolved, and the accuracy of related fingerprint matching algorithms is difficult to guarantee. Furthermore, existing methods are often only applicable to specific types of ICS or protocols, lacking versatility. Therefore, establishing a representative ICS fingerprint vector applicable to multiple ICS protocols, thereby creating an effective and comprehensive ICS fingerprint vector database, and proposing a highly accurate multi-classification algorithm suitable for ICS fingerprint matching, would effectively improve the security and accuracy of ICS manufacturer identification. Summary of the Invention

[0006] To address the shortcomings of existing technologies, this invention proposes a method for identifying industrial control equipment manufacturers based on an industrial control protocol communication model. The aim is to solve problems such as insufficient fingerprint vector discrimination capability, poor universality, and low accuracy of fingerprint recognition algorithms for industrial control equipment. Compared with existing industrial control equipment manufacturer identification methods, this invention effectively improves applicability and accuracy.

[0007] The technical solution adopted by the present invention to achieve the above objectives is as follows:

[0008] A method for identifying industrial control equipment manufacturers based on an industrial control protocol communication model includes the following steps:

[0009] 1) Construct fingerprint vectors for industrial control equipment applicable to multiple industrial control protocols based on the industrial control protocol communication model;

[0010] 2) Perform security scans on industrial control equipment on the Internet based on the industrial control protocol communication model, and extract fingerprint vectors based on the scan traffic to form an industrial control equipment fingerprint vector library;

[0011] 3) Obtain the manufacturer information of the industrial control equipment and label the corresponding industrial control equipment fingerprint vectors in the fingerprint vector library;

[0012] 4) Preprocess the attribute values ​​in the fingerprint vector of industrial control equipment;

[0013] 5) Cluster the preprocessed industrial control equipment fingerprint vectors using a density peak-based random clustering algorithm to obtain an industrial control equipment fingerprint vector classification model;

[0014] 6) Monitor the traffic in the target industrial control network and extract the fingerprint vectors of the industrial control devices;

[0015] 7) Identify the industrial control equipment manufacturers in the target industrial control network using the industrial control equipment fingerprint vector classification model. The industrial control protocol communication model ICS_CM in step 1) is represented as:

[0016] ICS_CM = (C E C D C T )

[0017] Among them, C E The message sequence representing the connection establishment phase is represented as follows:

[0018]

[0019] in, The SYN message represents the connection establishment phase. The SYN_ACK message represents the connection establishment phase. The ACK message represents the connection establishment phase. The superscripts src and dst indicate that the sender of the message is the host that requests to establish a TCP connection (Client) and the host that agrees to establish a TCP connection (Server), respectively. The subscript indicates the message type.

[0020] C D A message sequence representing a data transmission phase, consisting of one or more data transmissions, is represented as:

[0021]

[0022] in, This represents the i-th data transmission, where i = 1, ..., n, and n represents the total number of data transmissions. Represented as:

[0023]

[0024] in, This represents a request message for the i-th data transmission. This represents the TCP ACK response message for the i-th data transmission. The industrial control protocol data response message for the i-th data transmission;

[0025] C T The message sequence representing the connection termination phase consists of one or more message subsequences, and is represented as follows:

[0026]

[0027] in, This indicates the sequence of messages initiated by the client to terminate the TCP connection. This indicates the sequence of messages returned by the server. and Represented as:

[0028]

[0029] The industrial control equipment fingerprint vector DF in step 1) is represented as follows:

[0030] DF={ITTL,IPDF,IWS,MSS,WSC,SAP,ILRT,TON,TSCON,TCF,RTD,FTS}

[0031] Wherein, ITTL and IPDF respectively represent The initial value of the TTL field and the value of the DF flag in the IP header of the message; IWS, MSS, WSC, and SAP respectively represent The values ​​of the Window Size, MaximumSegmentSize, Window Scale, and SACKPermitted fields in the TCP header of the message; ILRT indicates... Message and The time interval of the message; TON indicates TSCON indicates whether the message includes the TCP timestamps option. The value of the TSecr field in the TCP timestamps option of the message is the same as... Whether the TSval field value of the TCP timestamps option in the message is consistent; TCF indicates the update frequency of the TSval field value of the TCP timestamps option on the server side; RTD indicates... Message and Message time interval and Message and The difference in time intervals between messages; FTS represents the sequence of message types sent by the server during the connection termination phase.

[0032] Step 2) specifically refers to:

[0033] Based on the industrial control protocol communication model, security scans of industrial control devices on the Internet are performed using standard industrial control protocol format data packets, and fingerprint vectors are extracted based on the scan traffic to form an industrial control device fingerprint vector library.

[0034] The specific steps for obtaining the manufacturer information of the industrial control equipment in step 3) are as follows:

[0035] 3.1) For industrial control equipment that supports returning manufacturer information through industrial control protocol function codes, during the security scan of the industrial control equipment, use the corresponding industrial control protocol's device information retrieval function code to query the manufacturer information of the industrial control equipment.

[0036] 3.2) For industrial control equipment that does not support returning manufacturer information via industrial control protocol function codes, continue to try to access its common ports that support HTTP / HTTPS protocols, and extract the banner information from the response header and response body returned by the HTTP / HTTPS protocol, thereby obtaining the manufacturer information of the industrial control equipment.

[0037] Step 4) specifically involves:

[0038] All attribute values ​​in the fingerprint vector of industrial control equipment are normalized and discretized, and the data distribution of time-related attributes ILRT and RTD is fitted.

[0039] The data distribution fitting specifically involves: if the number of fingerprint vectors for industrial control equipment from a known manufacturer is greater than 10, then a normal distribution is used to fit the data distribution of the manufacturer's time-related attributes, and the corresponding mean μ and standard deviation σ are obtained; if a certain attribute value has a corresponding normal distribution, then the distance d from the normal distribution of other attribute values ​​to that attribute value is... n (x i ,x j )for:

[0040]

[0041] Where, x j μ represents the attribute value that exhibits a normal distribution. j and σ j Let x represent the mean and standard deviation of the corresponding normal distribution. i The attribute value representing the distance to the normal distribution to be calculated is represented as:

[0042]

[0043] Here, dist represents the distance between attribute values.

[0044] Step 5) specifically involves:

[0045] 5.1) Create m feature subsets of the fingerprint vector of industrial control equipment, each feature subset containing k different features randomly selected from the fingerprint vector of industrial control equipment;

[0046] 5.2) Use the industrial control equipment fingerprint vector library to create a density peak-based clustering model DPCM for each feature subset, and create a total of m independent DPCM models;

[0047] 5.3) For each cluster in the DPCM model, if it contains industrial control equipment fingerprint vectors with vendor labels, then a voting method is used to mark its vendor label as the vendor label with the most votes; otherwise, its vendor label is marked as unknown.

[0048] Step 5.2) specifically refers to:

[0049] 5.2.1) Based on the set cutoff distance d c Calculate DF for each fingerprint vector i Local density ρ i and its d c Neighborhood, local density ρ i The calculation formula is:

[0050]

[0051] Where, d ij Represents the fingerprint vector DF of industrial control equipment i and DF j The distance between;

[0052] d c The neighborhood is represented as:

[0053]

[0054] Among them, DF j d ij Less than d c The fingerprint vector corresponding to the time;

[0055] 5.2.2) Sort all fingerprint vectors in descending order of local density to obtain the fingerprint vector number sequence Γ, represented as:

[0056] Γ= <s1,s2,…,s n >

[0057] Among them, s i This represents the index corresponding to the fingerprint vector with the i-th largest local density, such as DF. j If the local density is the largest at point i, then s i =j;

[0058] 5.2.3) Calculate DF for each fingerprint vector i and its nearest and locally denser fingerprint vector DF j Distance δ i The closest distance δ i The calculation formula is:

[0059]

[0060] 5.2.4) Use the fingerprint vector numbered s1 Create the first cluster; thereafter, perform cluster affiliation and cluster merging checks on each fingerprint vector in the order of the number sequence Γ.

[0061] The cluster affiliation test is as follows: if the fingerprint vector closest distance If it is less than the cutoff distance, then... Assign it to the cluster that contains the nearest and densest fingerprint vector; otherwise, create a new cluster for it.

[0062] The cluster merging test is: when the fingerprint vector After the cluster is determined, its d is checked. c Check if all fingerprint vectors with higher density in the neighborhood belong to the same cluster as the fingerprint vector. If they do not belong to the same cluster, then change the fingerprint vector. d c All clusters to which fingerprint vectors with higher density belong within the neighborhood are merged to form a new cluster.

[0063] Step 7) specifically involves:

[0064] 7.1) The set of different fingerprint vectors generated by the same industrial control equipment is called the fingerprint vector package BoDF, denoted as:

[0065] BoDF i ={DF1,DF2,…,DF p}

[0066] Where p represents the number of fingerprint vectors generated by industrial control device i;

[0067] 7.2) DF of the j-th fingerprint vector of industrial control device i j The data is input into the m independent DPCM models generated in step 5) for classification, and the DPCM models are used to classify the fingerprint vector DF. j The classification process is as follows: calculate the fingerprint vector DF j The minimum distance to all clusters in the DPCM model; if the minimum distance is less than the cutoff distance d c Then DF j Classify it as the manufacturer to which the corresponding cluster belongs; otherwise, determine that it belongs to an unknown manufacturer outside the fingerprint vector database.

[0068] 7.3) Using a voting method to evaluate the fingerprint vectors DF generated from m DPCM models j The classification results are aggregated and represented as follows:

[0069]

[0070] Among them, G(DF)j ) represents DF j The final classification result, i.e., the manufacturer label, The label representing the manufacturer with the most votes, g l This represents the l-th DPCM model. G represents l About DF j In the manufacturer label c k The output on; if g l The classification result is c k ,but The value is 1 if all manufacturer labels receive 0 votes, otherwise the value is 0. If all manufacturer labels receive 0 votes, then DF will be... j Classified as an unknown manufacturer;

[0071] 7.4) Fingerprint vector packet BoDF for industrial control device i i The corresponding classification result C = {C1, C2, ..., C} p The weighted voting method is used for integration to obtain the manufacturer label corresponding to industrial control equipment i, where the weighted voting method is expressed as:

[0072]

[0073] Among them, Γ(BoDF) i ) represents BoDF i The final classification result, G k (DF j ) represents G(DF) j ) in the manufacturer label c k The output on; if G(DF) j The classification result is c. k Then G k (DF j The value of ω is 1 if it is not 1, otherwise its value is 0; j BoDF i The j-th fingerprint vector DF j The classification weights are expressed as:

[0074]

[0075] Among them, T j Represents the fingerprint vector DF j The number of data packets included.

[0076] The present invention has the following beneficial effects and advantages:

[0077] 1. A network communication model capable of describing the communication process of various industrial control protocols was proposed, and an industrial control equipment fingerprint vector capable of being used in active and passive detection scenarios was constructed, effectively solving the problem that the industrial control equipment fingerprint vector library is difficult to establish and has poor universality.

[0078] 2. A random clustering algorithm based on density peaks and a composite classification algorithm based on fingerprint vector packets are proposed. These algorithms effectively solve the problems of varying importance of different attributes in the fingerprint vectors of industrial control equipment during the identification of industrial control equipment manufacturers, as well as the aggregation of multiple different fingerprint vectors generated by the same industrial control equipment under different network communication conditions, thereby improving the accuracy of industrial control equipment manufacturer identification. Attached Figure Description

[0079] Figure 1 This is a flowchart illustrating the method of the present invention;

[0080] Figure 2 These are communication data packets generated during security scanning of industrial control equipment in this embodiment of the invention;

[0081] Figure 3 This refers to a set of data packets generated by industrial control devices within the target industrial control network in this embodiment of the invention.

[0082] Figure 4 This refers to a set of data packets generated by industrial control devices within the target industrial control network in this embodiment of the invention. Detailed Implementation

[0083] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments, but this is not intended to limit the technical solutions of the present invention.

[0084] like Figure 1 As shown, a method for identifying industrial control equipment manufacturers based on an industrial control protocol communication model includes the following steps:

[0085] 1) Construct fingerprint vectors for industrial control equipment applicable to multiple industrial control protocols based on the industrial control protocol communication model;

[0086] 2) Perform security scans on industrial control equipment on the Internet based on the industrial control protocol communication model, and extract fingerprint vectors based on the scan traffic to form an industrial control equipment fingerprint vector library;

[0087] 3) Obtain the manufacturer information of industrial control equipment and label the corresponding industrial control equipment fingerprint vectors;

[0088] 4) Preprocess the attribute values ​​in the fingerprint vector of industrial control equipment to make them suitable for clustering algorithms;

[0089] 5) Cluster the fingerprint vectors of industrial control equipment using a density peak-based random clustering algorithm to form a fingerprint vector classification model for industrial control equipment;

[0090] 6) Monitor the traffic in the target industrial control network and extract the fingerprint vectors of the industrial control devices;

[0091] 7) Identify industrial control equipment manufacturers in the target industrial control network using a composite classification algorithm based on fingerprint vector packets.

[0092] The industrial control protocol communication model (ICS_CM) in step 1) is specifically a network communication model that can be used to describe the main communication processes of various industrial control protocols (such as Modbus / TCP, Ethernet / IP, etc.) based on the TCP protocol and using a Client / Server communication mode, and is represented as follows:

[0093] ICS_CM = (C E C D C T )

[0094] Among them, ICS_CM describes the entire communication process based on a single TCP connection, which mainly consists of the connection establishment phase, the data transmission phase, and the connection termination phase. E The message sequence representing the connection establishment phase is represented as follows:

[0095]

[0096] in, The SYN message represents the connection establishment phase. The SYN_ACK message represents the connection establishment phase. This indicates an ACK message during the connection establishment phase. The superscripts src and dst indicate that the sender of the message is the host requesting the TCP connection (Client) and the host agreeing to establish the TCP connection (Server), respectively. The subscript indicates the message type. D A message sequence representing a data transmission phase, consisting of one or more data transmissions, is represented as:

[0097]

[0098] in, This represents the i-th data transmission, and n represents the total number of data transmissions. Represented as:

[0099]

[0100] in, This represents a request message for the i-th data transmission. This represents the TCP ACK response message for the i-th data transmission. The industrial control protocol data response message for the i-th data transmission. In addition, Message and The message is optional; the server can reply with all of the above messages, reply with only some messages, or reply with nothing. T The message sequence representing the connection termination phase consists of one or more message subsequences, and is represented as follows:

[0101]

[0102] in, This indicates the sequence of messages initiated by the client to terminate the TCP connection. This indicates the sequence of messages returned by the server. and Represented as:

[0103]

[0104]

[0105] Among them, C T , and The types and number of messages included are determined by the specific implementation of the industrial control equipment's protocol stack.

[0106] Based on the above Industrial Control Protocol Communication Model (ICS_CM), the industrial control device fingerprint vector (DF) in step 1) is represented as follows:

[0107] DF={ITTL,IPDF,IWS,MSS,WSC,SAP,ILRT,TON,TSCON,TCF,RTD,FTS}

[0108] Wherein, ITTL and IPDF respectively represent The initial value of the TTL field and the value of the DF flag in the IP header of the message; IWS, MSS, WSC, and SAP respectively represent The values ​​of the Window Size, MaximumSegmentSize, Window Scale, and SACKPermitted fields in the TCP header of the message; ILRT indicates... Message and The time interval of the message; TON indicates TSCON indicates whether the message includes the TCP timestamps option. The value of the TSecr field in the TCP timestamps option of the message is the same as... Whether the TSval field value of the TCP timestamps option in the message is consistent; TCF indicates the update frequency of the TSval field value of the TCP timestamps option on the server side; RTD indicates... Message and Message time interval and Message and The difference in the time interval between messages; FTS represents the sequence of message types sent by the server during the connection termination phase, where ACK message type is 1, [FIN,ACK] message type is 2, [RST,ACK] message type is 3, [RST] message type is 4, [ACK] message type with TCP data portion length greater than 0 is 5, and other message types are 0.

[0109] Step 2) specifically refers to:

[0110] Based on the industrial control protocol communication model, security scans of industrial control devices on the Internet are performed using standard industrial control protocol format data packets, and fingerprint vectors are extracted based on the scan traffic to form an industrial control device fingerprint vector library.

[0111] The specific steps for obtaining the manufacturer information of the industrial control equipment in step 3) are as follows:

[0112] 3.1) For industrial control equipment that supports returning manufacturer information through industrial control protocol function codes, during the security scan of the industrial control equipment in step 2), the corresponding industrial control protocol's device information acquisition function code is used to query the manufacturer information of the industrial control equipment;

[0113] 3.2) For industrial control equipment that does not support the above functions, continue to try to access its common ports that support HTTP / HTTPS protocols (such as 80, 8080, etc.), and extract the Banner information (usually including the server name Server, webpage title, etc.) from the response header and response body returned by the HTTP / HTTPS protocol, and then obtain the manufacturer information of the industrial control equipment.

[0114] The preprocessing of attribute values ​​in the fingerprint vector of industrial control equipment in step 4) mainly includes data normalization, data discretization, and data distribution fitting.

[0115] Data distribution fitting refers to fitting the time-related attributes ILRT and RTD to the data distribution of a manufacturer's industrial control equipment if the number of fingerprint vectors is greater than 10, using a normal distribution to obtain the corresponding mean μ and standard deviation σ. If a certain attribute value has a corresponding normal distribution, the distance from the normal distribution of other attribute values ​​to that attribute value is calculated using the following formula:

[0116]

[0117] Where, x j μ represents the attribute value that exhibits a normal distribution. j and σ j Let x represent the mean and standard deviation of the corresponding normal distribution. i This represents the attribute value from which the distance to the normal distribution is to be calculated. The distance between two attribute values ​​is expressed as:

[0118]

[0119] Here, `dist` represents the distance between attribute values, used in subsequent clustering algorithms to calculate the distance between industrial control device fingerprint vectors. The distances for other attributes of the industrial control device fingerprint vectors are calculated assuming no normal distribution exists. The distance between industrial control device fingerprint vectors is calculated using Euclidean distance.

[0120] The specific steps of the density peak-based random clustering algorithm in step 5) are as follows:

[0121] 5.1) Create m feature subsets of the fingerprint vector of industrial control equipment, each feature subset containing k different features randomly selected from the fingerprint vector of industrial control equipment;

[0122] 5.2) Use the industrial control equipment fingerprint vector library to create a density peak clustering model (DPCM) for each feature subset, and create a total of m independent DPCM models;

[0123] 5.3) For each cluster in the DPCM model, if it contains industrial control equipment fingerprint vectors with vendor labels, then a voting method is used to mark its vendor label as the vendor label with the most votes; otherwise, its vendor label is marked as unknown.

[0124] The specific steps for creating the density peak-based clustering model (DPCM) in step 5.2) are as follows:

[0125] 5.2.1) Based on the cutoff distance d c Calculate DF for each fingerprint vector i Local density ρ i and its d c Neighborhood. Local density ρ i The calculation formula is:

[0126]

[0127] Where, d ij Represents the fingerprint vector DF of industrial control equipment i and DF j The distance between them. d c The neighborhood is represented as:

[0128]

[0129] Among them, DF j d ij Less than d c The fingerprint vector corresponding to the time.

[0130] 5.2.2) Sort all fingerprint vectors in descending order of local density to obtain the fingerprint vector number sequence Γ, represented as:

[0131] Γ= <s1,s2,…,s n >

[0132] Among them, s i This represents the index corresponding to the fingerprint vector with the i-th largest local density, such as DF. j If the local density is the largest at point i, then s i =j.

[0133] 5.2.3) Calculate DF for each fingerprint vector i and its nearest and locally denser fingerprint vector DF j Distance δ i The closest distance δ i The calculation formula is:

[0134]

[0135] 5.2.4) Use the fingerprint vector numbered s1 Create the first cluster; thereafter, perform cluster affiliation and cluster merging tests on each fingerprint vector in the order of the numbering sequence Γ; the cluster affiliation test refers to: if the fingerprint vector... closest distance If it is less than the cutoff distance, then... Assign it to the cluster containing the nearest and densest fingerprint vector; otherwise, create a new cluster for it. Cluster merging test: when the fingerprint vector... After the cluster is determined, its d is checked. c If all fingerprint vectors with higher density in the neighborhood belong to the same cluster as the fingerprint vector, and if they do not belong to the same cluster, then all the aforementioned clusters are merged to form a new cluster.

[0136] Step 6) specifically refers to:

[0137] By mirroring the switch ports, network traffic in the target industrial control network is exported. The corresponding industrial control protocol traffic is filtered out according to the port number of the industrial control protocol, and then the fingerprint vector of the corresponding industrial control device is extracted.

[0138] The specific steps of the composite classification algorithm based on fingerprint vector packets in step 7) are as follows:

[0139] 7.1) The set of different fingerprint vectors generated by the same industrial control equipment is called a fingerprint vector packet (BoDF), represented as:

[0140] BoDF i ={DF1,DF2,…,DF p}

[0141] Where p represents the number of fingerprint vectors generated by industrial control device i.

[0142] 7.2) DF of the j-th fingerprint vector of industrial control device i j The data is input into the m independent DPCM models generated in step 5) for classification, and the DPCM models are used to classify the fingerprint vector DF. j The classification process is as follows: calculate the fingerprint vector DF j The minimum distance to all clusters in the DPCM model; if the minimum distance is less than the cutoff distance d c Then DF j If the product is classified as belonging to the corresponding cluster of vendors, it is determined to belong to an unknown vendor outside the fingerprint vector database.

[0143] 7.3) Using a voting method to evaluate the fingerprint vectors DF generated from m DPCM models j The classification results are aggregated and represented as follows:

[0144]

[0145] Among them, G(DF) j ) represents DF j The final classification result (i.e., manufacturer label), The label representing the manufacturer with the most votes, g l This represents the l-th DPCM model. G represents l About DF j In the manufacturer label c k The output on; if g l The classification result is c k ,but The value is 1 if all manufacturer labels receive 0 votes, otherwise the value is 0. If all manufacturer labels receive 0 votes, then DF will be... j Classified as an unknown manufacturer.

[0146] 7.4) Fingerprint vector packet BoDF for industrial control device i i The corresponding classification result C = {C1, C2, ..., C} p The weighted voting method is used for integration to obtain the manufacturer label corresponding to industrial control equipment i, where the weighted voting method is expressed as:

[0147]

[0148] Among them, Γ(BoDF) i ) represents BoDF i The final classification result, G k (DF j ) represents G(DF) j ) in the manufacturer label c k The output on; if G(DF) j The classification result is c. k Then G k (DF j The value of ω is 1 if it is not 1, otherwise its value is 0; j BoDF i The j-th fingerprint vector DF j The classification weights are expressed as:

[0149]

[0150] Among them, T j Represents the fingerprint vector DF j The number of data packets included.

[0151] Example

[0152] The overall process of the industrial control equipment manufacturer identification method based on the industrial control protocol communication model provided by this invention includes the following steps:

[0153] Step 1: Construct industrial control device fingerprint vectors applicable to multiple industrial control protocols based on the industrial control protocol communication model.

[0154] Step 2: Perform a security scan on industrial control equipment (ICS) devices on the Internet based on the ICS protocol communication model, and extract fingerprint vectors based on the scan traffic to form an ICS device fingerprint vector database. Taking a scanning server with IP address 192.168.158.111 performing a security scan on an ICS device with IP address 95.173.*.40 exposed on the Internet as an example, the results are as follows: Figure 2 The communication message sequence shown can be used to obtain the following industrial control equipment fingerprint vector:

[0155] DF={255,false,6000,1400,-1,false,0,false,false,-1,0.01911,12}

[0156] Step 3: Obtain the manufacturer information of the industrial control equipment and label the corresponding industrial control equipment fingerprint vector. For industrial control equipment that supports returning manufacturer information through industrial control protocol function codes, such as... Figure 2For industrial control equipment with IP address 95.173.*.40, its manufacturer can be directly identified as ABB. For industrial control equipment that does not support the above functions, taking the industrial control equipment with IP address 104.169.*.178 as an example, its port 80 is open and supports the HTTP protocol. From the title of the webpage in its HTTP response body, its manufacturer can be extracted as Rockwell Automation.

[0157] Step 4: Preprocess the attribute values ​​in the fingerprint vector of industrial control equipment to make them suitable for clustering algorithms. Taking the RTD attributes of industrial control equipment from Schneider Electric equipment manufacturer supporting the Modbus protocol obtained in one round of scanning as an example, a total of 524 attribute values ​​were obtained. The calculated mean is -0.0272 and the standard deviation is 0.27091. When the RTD attribute value of a certain industrial control equipment is 0.035, its normal distribution distance is 0.0765; when the RTD attribute value is 0.739, its normal distribution distance is 0.9427.

[0158] Step 5: Cluster the fingerprint vectors of industrial control equipment using a density peak-based random clustering algorithm to form a classification model for the fingerprint vectors of industrial control equipment. First, create 10 feature subsets of the fingerprint vectors of industrial control equipment, each feature subset containing 6 different features randomly selected from the fingerprint vectors of industrial control equipment; second, truncation distance d c Set to 0.01, create 10 independent DPCM models based on the above feature subset; finally, use a voting method to create manufacturer labels for each cluster in the DPCM model.

[0159] Step 6: Export network traffic from the target industrial control network using switch port mirroring. Filter the traffic according to the port number of the industrial control protocol to extract the fingerprint vector of the corresponding industrial control device. For example, for an industrial control device with IP address 192.168.0.2, its two TCP connections are as follows: Figure 3 and Figure 4 As shown, two different fingerprint vectors, DF1 and DF2, are obtained, respectively:

[0160] DF1={64,true,8192,-1,-1,false,0,false,false,-1,-0.0027,1234}

[0161] DF2={64,true,8192,-1,-1,false,0,false,false,-1,0.00587,1234}

[0162] Step 7: Identify the industrial control equipment manufacturers in the target industrial control network using a composite classification algorithm based on fingerprint vector packets. Taking the industrial control equipment with IP address 192.168.0.2 as an example, its fingerprint vector packet (BoDF) is represented as follows:

[0163] BoDF = {DF1, DF2}

[0164] The fingerprint vectors were classified using the 10 independent DPCM models generated in step 5). The classification results for fingerprint vectors DF1 and DF2 were both Schneider Electric. Furthermore, fingerprint vectors DF1 and DF2 each contain 12 data packets, and their respective weights are both 0.5. Therefore, by integrating the classification results using a weighted voting method, the manufacturer tag for the industrial control equipment with IP address 192.168.0.2 was determined to be Schneider Electric.

Claims

1. A method for identifying industrial control equipment manufacturers based on an industrial control protocol communication model, characterized in that, Includes the following steps: 1) Construct fingerprint vectors for industrial control equipment applicable to multiple industrial control protocols based on the industrial control protocol communication model; 2) Perform security scans on industrial control equipment on the Internet based on the industrial control protocol communication model, and extract fingerprint vectors based on the scan traffic to form an industrial control equipment fingerprint vector library; 3) Obtain the manufacturer information of the industrial control equipment and label the corresponding industrial control equipment fingerprint vectors in the fingerprint vector library; 4) Preprocess the attribute values ​​in the fingerprint vector of industrial control equipment; 5) Cluster the preprocessed industrial control equipment fingerprint vectors using a density peak-based random clustering algorithm to obtain an industrial control equipment fingerprint vector classification model; 6) Monitor the traffic in the target industrial control network and extract the fingerprint vectors of the industrial control devices; 7) Identify industrial control equipment manufacturers in the target industrial control network using an industrial control equipment fingerprint vector classification model; The specific steps for obtaining the manufacturer information of the industrial control equipment in step 3) are as follows: 3.1) For industrial control equipment that supports returning manufacturer information through industrial control protocol function codes, during the security scan of the industrial control equipment, use the corresponding industrial control protocol's device information retrieval function code to query the manufacturer information of the industrial control equipment. 3.2) For industrial control equipment that does not support returning manufacturer information via industrial control protocol function codes, continue to try to access its common ports that support HTTP / HTTPS protocols, and extract the banner information from the response header and response body returned by the HTTP / HTTPS protocol, thereby obtaining the manufacturer information of the industrial control equipment.

2. The method for identifying industrial control equipment manufacturers based on an industrial control protocol communication model according to claim 1, characterized in that, The industrial control protocol communication model ICS_CM in step 1) is represented as follows: ICS_CM=(C E ,C D ,C T ) Among them, C E The message sequence representing the connection establishment phase is represented as follows: in, The SYN message represents the connection establishment phase. The SYN_ACK message represents the connection establishment phase. The ACK message represents the connection establishment phase. The superscripts src and dst indicate that the sender of the message is the host that requests to establish a TCP connection (Client) and the host that agrees to establish a TCP connection (Server), respectively. The subscript indicates the message type. C D A message sequence representing a data transmission phase, consisting of one or more data transmissions, is represented as: in, This represents the i-th data transmission, where i = 1, ..., n, and n represents the total number of data transmissions. Represented as: in, This represents a request message for the i-th data transmission. This represents the TCP ACK response message for the i-th data transmission. The industrial control protocol data response message for the i-th data transmission; C T The message sequence representing the connection termination phase consists of one or more message subsequences, and is represented as follows: in, This indicates the sequence of messages initiated by the client to terminate the TCP connection. This indicates the sequence of messages returned by the server. and Represented as:

3. The method for identifying industrial control equipment manufacturers based on an industrial control protocol communication model according to claim 1, characterized in that, The industrial control equipment fingerprint vector DF in step 1) is represented as follows: DF={ITTL,IPDF,IWS,MSS,WSC,SAP,ILRT,TON,TSCON,TCF,RTD,FTS} Wherein, ITTL and IPDF respectively represent The initial value of the TTL field and the value of the DF flag in the IP header of the message; IWS, MSS, WSC, and SAP respectively represent The values ​​of the Window Size, MaximumSegmentSize, Window Scale, and SACKPermitted fields in the TCP header of the message; ILRT indicates... Message and The time interval of the message; TON indicates TSCON indicates whether the message includes the TCP timestamps option. The value of the TSecr field in the TCP timestamps option of the message is the same as... Whether the TSval field value of the TCP timestamps option in the message is consistent; TCF indicates the update frequency of the TSval field value of the TCP timestamps option on the server side; RTD indicates... Message and Message time interval and Message and The difference in time intervals between messages; FTS represents the sequence of message types sent by the server during the connection termination phase.

4. The method for identifying industrial control equipment manufacturers based on an industrial control protocol communication model according to claim 1, characterized in that, Step 2) specifically refers to: Based on the industrial control protocol communication model, security scans of industrial control devices on the Internet are performed using standard industrial control protocol format data packets, and fingerprint vectors are extracted based on the scan traffic to form an industrial control device fingerprint vector library.

5. The method for identifying industrial control equipment manufacturers based on an industrial control protocol communication model according to claim 1, characterized in that, Step 4) specifically involves: All attribute values ​​in the fingerprint vector of industrial control equipment are normalized and discretized, and the data distribution of time-related attributes ILRT and RTD is fitted. The data distribution fitting specifically involves: if the number of fingerprint vectors for industrial control equipment from a known manufacturer is greater than 10, then a normal distribution is used to fit the data distribution of the manufacturer's time-related attributes, and the corresponding mean μ and standard deviation σ are obtained; if a certain attribute value has a corresponding normal distribution, then the distance d from the normal distribution of other attribute values ​​to that attribute value is... n (x i ,x j )for: Where, x j μ represents the attribute value that exhibits a normal distribution. j and σ j Let x represent the mean and standard deviation of the corresponding normal distribution. i The attribute value representing the distance to the normal distribution to be calculated is represented as: Here, dist represents the distance between attribute values.

6. The method for identifying industrial control equipment manufacturers based on an industrial control protocol communication model according to claim 1, characterized in that, Step 5) specifically involves: 5.1) Create m feature subsets of the fingerprint vector of industrial control equipment, each feature subset containing k different features randomly selected from the fingerprint vector of industrial control equipment; 5.2) Use the industrial control equipment fingerprint vector library to create a density peak-based clustering model DPCM for each feature subset, and create a total of m independent DPCM models; 5.3) For each cluster in the DPCM model, if it contains industrial control equipment fingerprint vectors with vendor labels, then a voting method is used to mark its vendor label as the vendor label with the most votes; otherwise, its vendor label is marked as unknown.

7. The method for identifying industrial control equipment manufacturers based on an industrial control protocol communication model according to claim 6, characterized in that, Step 5.2) specifically refers to: 5.2.1) Based on the set cutoff distance d c Calculate DF for each fingerprint vector i Local density ρ i and its d c Neighborhood, local density ρ i The calculation formula is: Where, d ij Represents the fingerprint vector DF of industrial control equipment i and DF j The distance between; d c The neighborhood is represented as: Among them, DF j d ij Less than d c The fingerprint vector corresponding to the time; 5.2.2) Sort all fingerprint vectors in descending order of local density to obtain the fingerprint vector number sequence Γ, represented as: C= <s1,s2,…,s n > Among them, s i This represents the index corresponding to the fingerprint vector with the i-th largest local density, such as DF. j If the local density is the largest at point i, then s i =j; 5.2.3) Calculate DF for each fingerprint vector i and its nearest and locally denser fingerprint vector DF j Distance δ i The closest distance δ i The calculation formula is: 5.2.4) Use the fingerprint vector numbered s1 Create the first cluster; thereafter, perform cluster affiliation and cluster merging checks on each fingerprint vector in the order of the number sequence Γ.

8. The method for identifying industrial control equipment manufacturers based on an industrial control protocol communication model according to claim 7, characterized in that, The cluster affiliation test is as follows: if the fingerprint vector closest distance If it is less than the cutoff distance, then... Assign it to the cluster that contains the nearest and densest fingerprint vector; otherwise, create a new cluster for it. The cluster merging test is: when the fingerprint vector After the cluster is determined, its d is checked. c Check if all fingerprint vectors with higher density in the neighborhood belong to the same cluster as the fingerprint vector. If they do not belong to the same cluster, then change the fingerprint vector. d c All clusters to which fingerprint vectors with higher density belong within the neighborhood are merged to form a new cluster.

9. The method for identifying industrial control equipment manufacturers based on an industrial control protocol communication model according to claim 1, characterized in that, Step 7) specifically involves: 7.1) The set of different fingerprint vectors generated by the same industrial control equipment is called the fingerprint vector package BoDF, denoted as: BoDF i ={DF1,DF2,…,DF p } in, p represents the number of fingerprint vectors generated by industrial control device i; 7.2) DF of the j-th fingerprint vector of industrial control device i j The data is input into the m independent DPCM models generated in step 5) for classification, and the DPCM models are used to classify the fingerprint vector DF. j The classification process is as follows: calculate the fingerprint vector DF j The minimum distance to all clusters in the DPCM model; if the minimum distance is less than the cutoff distance d c Then DF j Classify it as the manufacturer to which the corresponding cluster belongs; otherwise, determine that it belongs to an unknown manufacturer outside the fingerprint vector database. 7.3) Using a voting method to evaluate the fingerprint vectors DF generated from m DPCM models j The classification results are aggregated and represented as follows: Among them, G(DF) j ) represents DF j The final classification result, i.e., the manufacturer label, The label representing the manufacturer with the most votes, g l This represents the l-th DPCM model. G represents l About DF j In the manufacturer label c k The output on; if g l The classification result is c k ,but The value is 1 if all manufacturer labels receive 0 votes, otherwise the value is 0. If all manufacturer labels receive 0 votes, then DF will be... j Classified as an unknown manufacturer; 7.4) Fingerprint vector packet BoDF for industrial control device i i The corresponding classification result C = {C1, C2, ..., C} p The weighted voting method is used for integration to obtain the manufacturer label corresponding to industrial control equipment i, where the weighted voting method is expressed as: Among them, Γ(BoDF) i ) represents BoDF i The final classification result, G k (DF j ) represents G(DF) j ) in the manufacturer label c k The output on; if G(DF) j The classification result is c. k Then G k (DF j The value of ω is 1 if it is not 1, otherwise its value is 0; j BoDF i The j-th fingerprint vector DF j The classification weights are expressed as: Among them, T j Represents the fingerprint vector DF j The number of data packets included.

Images