An unknown industrial control protocol classification method and device

Abstract

The application relates to the field of industrial control networks, and discloses an unknown industrial control protocol classification method and device, which comprises the following steps: capturing unknown industrial control protocol messages; constructing a binary feature sequence corresponding to each unknown industrial control protocol message; calculating the character distance between each binary feature sequence, determining the maximum average character distance according to the character distance; determining the optimal clustering K value according to the maximum average character distance; clustering each binary feature sequence according to the optimal clustering K value to obtain K binary feature sequence groups; and taking the unknown industrial control protocol messages corresponding to each binary feature sequence group as an industrial control protocol category respectively. The character distance of unknown industrial control protocols is calculated and compared, fine-grained similarity discrimination is realized, high-precision unknown industrial control protocol classification is realized, a foundation is laid for unknown industrial control protocol identification, and industrial control system safety monitoring is supported.

Description

Technical Field

[0001] This application relates to the field of industrial control networks, and in particular to a method and apparatus for classifying unknown industrial control protocols. Background Technology

[0002] With the development of digitalization, networking, and intelligence in industrial control systems, a large number of heterogeneous industrial control protocols have emerged. Therefore, the structural information of many industrial control protocols is unknown, making existing internet-oriented protocol classification methods incapable of classifying these unknown protocols. Thus, the classification of unknown industrial control protocols has become a pressing problem to be solved in the field of industrial control.

[0003] To address the challenge of classifying unknown industrial control protocols, academia and industry have conducted in-depth research and introduced reverse engineering principles into the process. Protocol reverse engineering analyzes the message data of unknown protocols to obtain their format specifications, message semantics, and behavioral characteristics. However, reverse engineering can introduce errors when multiple industrial control protocols are transmitted together. Therefore, it is necessary to classify these protocols to enable reverse engineering of the same protocol and improve the accuracy of protocol parsing.

[0004] Existing methods for classifying unknown protocols primarily target Internet protocols, relying mainly on techniques such as support vector machines, machine learning, and clustering. However, compared to Internet protocols, industrial control protocols (ICS) aim to acquire measurement values, status values, and control equipment. Therefore, ICS messages typically include a function code field to specify the content received and the response. ICS protocols are characterized by concise messages and functional blocks divided into byte units, making traditional unknown protocol classification methods ill-suited for their classification.

[0005] However, the classification methods for unknown industrial control protocols are still in their infancy. Existing classification methods for unknown industrial control protocols have solved the problem of classifying unknown industrial control protocols of the same type, but when multiple types of unknown industrial control protocols are transmitted together, their classification results are inaccurate. Summary of the Invention

[0006] In view of this, this application provides a method and apparatus for classifying unknown industrial control protocols. The main purpose is to perform fine-grained similarity discrimination by calculating and comparing the character distance of unknown industrial control protocols, thereby achieving high-precision classification of unknown industrial control protocols and avoiding errors in the classification results when multiple types of unknown industrial control protocols are transmitted in a mixed manner.

[0007] According to one aspect of this application, a method for classifying unknown industrial control protocols is provided, the method comprising:

[0008] (1) Capture unknown industrial control protocol messages;

[0009] (2) Construct the binary feature sequence corresponding to each unknown industrial control protocol message;

[0010] (3) Calculate the character distance between each binary feature sequence, and determine the maximum average character distance based on the character distance;

[0011] (4) Determine the optimal clustering K value based on the maximum average character distance;

[0012] (5) Based on the optimal clustering K value, each binary feature sequence is clustered to obtain K binary feature sequence groups;

[0013] (6) Treat the unknown industrial control protocol messages corresponding to each binary feature sequence group as an industrial control protocol category.

[0014] Optionally, capturing unknown industrial control protocol messages includes the following steps:

[0015] (1-1) Capture the original messages of unknown industrial control protocols: Using preset protocol analysis software, capture M original messages of unknown industrial control protocols based on the MAC address or IP address of the industrial control equipment;

[0016] (1-2) Extracting application layer data: Extract the application layer data of M original messages of the unknown industrial control protocol, and construct the application layer dataset of the unknown industrial control protocol message, denoted as A = {A1,...,A2}. m ,...,A M}, where A m This represents the application layer data of the m-th unknown industrial control protocol message.

[0017] Optionally, constructing the binary feature sequence corresponding to each unknown industrial control protocol message includes the following steps:

[0018] (2-1) Extracting the feature sequence: Extracting A m The first L bytes are used as the feature sequence B m (m = 1, 2, ..., M);

[0019] (2-2) Binary conversion: Convert B to binary. m Convert to binary feature sequence C m The process is as follows:

[0020] C m =encode(B m ), m=1,2,...,M

[0021] Among them, B m Let m be the m-th feature sequence, and encode(·) means converting the feature sequence into a binary feature sequence C. m =[Cm1 C m2 ,...,C mn ,...,C mN ], N represents the number of bits in the binary feature sequence, C mn It represents the nth bit of the mth binary feature sequence.

[0022] Optionally, calculating the character distance between each binary feature sequence and determining the maximum average character distance based on the character distance includes the following steps:

[0023] (3-1) Constructing the sample set: Construct a binary feature sequence sample set, denoted as C = {C1,...,C}. m ,...,C M};

[0024] (3-2) Calculate the character distance between feature sequences: Calculate the character distance between any two binary feature sequences m and p, as follows:

[0025]

[0026] in, This represents the XOR operation, if C mn and C pn If the values ​​are different, the result is 1; if C mn and C pn If the values ​​are the same, the result is 0;

[0027] The character distance is the number of bits whose corresponding binary values ​​differ between two binary feature sequences.

[0028] (3-3) Calculate the maximum average character distance: Calculate the maximum average character distance of M binary feature sequences, the process is as follows:

[0029]

[0030] Optionally, determining the optimal clustering K value based on the maximum average character distance includes the following steps:

[0031] (4-1) Selecting the class center: Randomly select a binary feature sequence C from C. j As the center, and with C j Remove from C to generate a new category D. j C j ∈D j ;

[0032] (4-2) Calculate the character distance between the feature sequence and the category center: Calculate the removal C j All binary feature sequences in C are then transferred to D. j Cj Character distance d mj The process is as follows:

[0033]

[0034] Where, d mj Indicates the removal of C j The m-th binary feature sequence in C and D j C j Character distance;

[0035] (4-3) Perform feature sequence classification: classify all characters whose distance is less than the maximum average character distance (d). mj <d avg The binary feature sequence of ) is classified as D j And remove it from C;

[0036] (4-4) Repeat steps (4-1) to (4-3) in sequence until C is empty, forming multiple categories D. j (j=1,2,...,K), the optimal clustering value K is obtained, denoted as K. * .

[0037] Optionally, the step of clustering each binary feature sequence according to the optimal clustering K value to obtain K groups of binary feature sequences includes the following steps:

[0038] (5-1) Determine the initial cluster centers: Randomly select K from C. * The binary feature sequences are used as the initial cluster centers E. k (k = 1, 2, ..., K) * );

[0039] (5-2) Calculate the character distance between the feature sequence and the cluster center: Calculate MK * A binary feature sequence and K * The character distance between the cluster centers is calculated as follows:

[0040]

[0041] Among them, E kn d represents the nth bit of the binary feature sequence of the kth cluster center. mk This represents the character distance between the m-th binary feature sequence and the binary feature sequence of the k-th cluster center;

[0042] (5-3) Compare the character distances between the feature sequences and the cluster centers: Compare and calculate the distances from binary feature sequences m to K. * The minimum character distance between cluster centers is determined as follows:

[0043]

[0044] (5-4) Determine the category of the feature sequence: Determine the binary feature sequence C based on the calculated minimum character distance. m The category k is determined as follows:

[0045] k←f -1 (d mk ),

[0046] Among them, f -1 (·) represents the binary feature sequence C obtained based on the minimum character distance. m The category k to which it belongs;

[0047] (5-5) Update cluster centers: Find the binary feature sequence corresponding to the minimum character distance within category k, and use it as the new cluster center. The process is as follows:

[0048]

[0049] Among them, ||F k || represents the number of binary feature sequences within category k, and C is the binary feature sequence C corresponding to the minimum character distance within k, calculated from the given information. z It was used as the new cluster center E′ k =C z ;

[0050] (5-6) Repeat steps (5-2) to (5-5) until the binary feature sequence within category k no longer changes, i.e., the clustering ends.

[0051] Optionally, classifying the unknown industrial control protocol messages corresponding to each binary feature sequence group as an industrial control protocol category includes the following steps:

[0052] (6-1) Determine the category of industrial control protocol: based on the calculated binary characteristic sequence C m Belonging to category k, C m The corresponding unknown industrial control protocol A m Classified into category k, i.e., A m ∈F k ;

[0053] (6-2) Repeat step (6-1) until A is empty, thus completing the classification of unknown industrial control protocols.

[0054] According to another aspect of this application, an unknown industrial control protocol classification device is provided, the device comprising:

[0055] The protocol capture module is used to capture unknown industrial control protocol messages;

[0056] The protocol processing module is used to construct the binary feature sequence corresponding to each unknown industrial control protocol message, calculate the character distance between each binary feature sequence, and determine the maximum average character distance.

[0057] The clustering module is used to determine the optimal clustering K value based on the maximum average character distance; and to cluster each binary feature sequence according to the optimal clustering K value to obtain K binary feature sequence groups;

[0058] The classification module is used to classify the unknown industrial control protocol messages corresponding to each binary feature sequence group as an industrial control protocol category.

[0059] Optionally, the protocol capture module is further configured to:

[0060] (1-1) Capture the original messages of unknown industrial control protocols: Using preset protocol analysis software, capture M original messages of unknown industrial control protocols based on the MAC address or IP address of the industrial control equipment;

[0061] (1-2) Extracting application layer data: Extract the application layer data of M original messages of the unknown industrial control protocol, and construct the application layer dataset of the unknown industrial control protocol message, denoted as A = {A1,...,A2}. m ,...,A M}, where A m This represents the application layer data of the m-th unknown industrial control protocol message.

[0062] Optionally, the protocol processing module is further configured to:

[0063] (2-1) Extracting the feature sequence: Extracting A m The first L bytes are used as the feature sequence B m (m = 1, 2, ..., M);

[0064] (2-2) Binary conversion: Convert B to binary. m Convert to binary feature sequence C m The process is as follows:

[0065] C m =encode(B m ), m=1,2,...,M

[0066] Among them, B m Let m be the m-th feature sequence, and encode(·) means converting the feature sequence into a binary feature sequence C. m =[C m1 C m2 ,...,C mn ,...,C mN ], N represents the number of bits in the binary feature sequence, C mnIt represents the nth bit of the mth binary feature sequence.

[0067] Optionally, the protocol processing module is further configured to:

[0068] (3-1) Constructing the sample set: Construct a binary feature sequence sample set, denoted as C = {C1,...,C}. m ,...,C M};

[0069] (3-2) Calculate the character distance between feature sequences: Calculate the character distance between any two binary feature sequences m and p, as follows:

[0070]

[0071] in, This represents the XOR operation, if C mn and C pn If the values ​​are different, the result is 1; if C mn and C pn If the values ​​are the same, the result is 0;

[0072] The character distance is the number of bits whose corresponding binary values ​​differ between two binary feature sequences.

[0073] (3-3) Calculate the maximum average character distance: Calculate the maximum average character distance of M binary feature sequences, the process is as follows:

[0074]

[0075] Optionally, the clustering module is further configured to:

[0076] (4-1) Selecting the class center: Randomly select a binary feature sequence C from C. j As the center, and with C j Remove from C to generate a new category D. j C j ∈D j ;

[0077] (4-2) Calculate the character distance between the feature sequence and the category center: Calculate the removal C j All binary feature sequences in C are then transferred to D. j C j Character distance d mj The process is as follows:

[0078]

[0079] Where, d mj Indicates the removal of C jThe m-th binary feature sequence in C and D j C j Character distance;

[0080] (4-3) Perform feature sequence classification: classify all characters whose distance is less than the maximum average character distance (d). mj <d avg The binary feature sequence of ) is classified as D j And remove it from C;

[0081] (4-4) Repeat steps (4-1) to (4-3) in sequence until C is empty, forming multiple categories D. j (j=1,2,...,K), the optimal clustering value K is obtained, denoted as K. * .

[0082] Optionally, the clustering module is also used for:

[0083] (5-1) Determine the initial cluster centers: Randomly select K from C. * The binary feature sequences are used as the initial cluster centers E. k (k = 1, 2, ..., K) * );

[0084] (5-2) Calculate the character distance between the feature sequence and the cluster center: Calculate MK * A binary feature sequence and K * The character distance between the cluster centers is calculated as follows:

[0085]

[0086] Among them, E kn d represents the nth bit of the binary feature sequence of the kth cluster center. mk This represents the character distance between the m-th binary feature sequence and the binary feature sequence of the k-th cluster center;

[0087] (5-3) Compare the character distances between the feature sequences and the cluster centers: Compare and calculate the distances from binary feature sequences m to K. * The minimum character distance between cluster centers is determined as follows:

[0088]

[0089] (5-4) Determine the category of the feature sequence: Determine the binary feature sequence C based on the calculated minimum character distance. m The category k is determined as follows:

[0090] k←f -1 (d mk ),

[0091] Among them, f -1 (·) represents the binary feature sequence C obtained based on the minimum character distance. m The category k to which it belongs;

[0092] (5-5) Update cluster centers: Find the binary feature sequence corresponding to the minimum character distance within category k, and use it as the new cluster center. The process is as follows:

[0093]

[0094] Among them, ||F k || represents the number of binary feature sequences within category k, and C is the binary feature sequence C corresponding to the minimum character distance within k, calculated from the given information. z It was used as the new cluster center E′ k =C z ;

[0095] (5-6) Repeat steps (5-2) to (5-5) until the binary feature sequence within category k no longer changes, i.e., the clustering ends.

[0096] Optionally, the classification module is further configured to:

[0097] (6-1) Determine the category of industrial control protocol: based on the calculated binary characteristic sequence C m Belonging to category k, C m The corresponding unknown industrial control protocol A m Classified into category k, i.e., A m ∈F k ;

[0098] (6-2) Repeat step (6-1) until A is empty, thus completing the classification of unknown industrial control protocols.

[0099] By employing the above technical solution, this application provides a method and apparatus for classifying unknown industrial control protocols. First, the original messages of unknown industrial control protocols are captured, and a binary feature sequence corresponding to each unknown industrial control protocol message is constructed. Second, the character distance between each binary feature sequence is calculated. Based on the character distance, the maximum average character distance is determined. Based on the maximum average character distance, the optimal clustering K value is determined. Finally, based on the optimal clustering K value, each binary feature sequence is clustered to obtain K binary feature sequence groups. The unknown industrial control protocol message corresponding to each binary feature sequence group is classified as an industrial control protocol category. This application, by calculating and comparing the character distances of unknown industrial control protocols, can perform fine-grained similarity discrimination, thereby achieving high-precision classification of unknown industrial control protocols. This avoids errors in classification results when multiple types of unknown industrial control protocols are transmitted in a mixed manner, laying the foundation for the identification of unknown industrial control protocols and supporting the security monitoring of industrial control systems.

[0100] The above description is only an overview of the technical solution of this application. In order to better understand the technical means of this application and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of this application more obvious and understandable, the following are specific embodiments of this application. Attached Figure Description

[0101] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0102] Figure 1 A flowchart illustrating an unknown industrial control protocol classification method provided in an embodiment of this application is shown.

[0103] Figure 2 A flowchart illustrating the process of capturing unknown industrial control protocol messages provided in an embodiment of this application is shown.

[0104] Figure 3 This paper illustrates a flowchart of the process for constructing the binary feature sequence corresponding to each unknown industrial control protocol message, as provided in an embodiment of this application.

[0105] Figure 4 This document illustrates a flowchart of the process for determining the maximum average character distance provided in an embodiment of this application.

[0106] Figure 5 This document illustrates a flowchart of the process for determining the optimal clustering K value according to an embodiment of this application.

[0107] Figure 6 This illustration shows a flowchart of clustering binary feature sequences according to an embodiment of this application;

[0108] Figure 7 A flowchart illustrating the classification of unknown industrial control protocols provided in an embodiment of this application is shown;

[0109] Figure 8 A schematic diagram of the structure of an unknown industrial control protocol classification device provided in an embodiment of this application is shown. Detailed Implementation

[0110] The present application will be described in detail below with reference to the accompanying drawings and embodiments. It should be noted that, unless otherwise specified, the embodiments and features described in the embodiments of the present application can be combined with each other.

[0111] This embodiment provides a method for classifying unknown industrial control protocols, such as Figure 1 As shown, the method includes:

[0112] Step (1): Capture unknown industrial control protocol messages.

[0113] The unknown industrial control protocol classification method provided in this application embodiment can be applied in industrial control systems to classify unknown industrial control protocols. First, as Figure 2 As shown, using preset protocol analysis software, M raw packets of unknown industrial control protocols are captured based on the MAC address or IP address of the industrial control equipment. After capturing the M raw packets of unknown industrial control protocols, the application layer data of the M raw packets of unknown industrial control protocols is extracted. Based on the M application layer data, an application layer dataset of unknown industrial control protocol packets is constructed, denoted as A = {A1,...,A...}. m ,...,A M}, where A m This represents the application layer data of the m-th unknown industrial control protocol message.

[0114] Step (2) Construct the binary feature sequence corresponding to each unknown industrial control protocol message.

[0115] Next, after constructing the application layer dataset of unknown industrial control protocol messages, such as Figure 3 As shown, A is extracted in order from front to back. m The first L bytes are used as the feature sequence B m (m = 1, 2, ..., M), and B m Perform binary feature sequence conversion to obtain C m The specific conversion process is as follows:

[0116] C m =encode(B m ), m=1,2,...,M (1)

[0117] Among them, B mLet m be the m-th feature sequence, and encode(·) means converting the feature sequence into a binary feature sequence C. m =[C m1 C m2 ,...,C mn ,...,C mN ], N represents the number of bits in the binary feature sequence, C mn It represents the nth bit of the mth binary feature sequence.

[0118] Step (3): Calculate the character distance between each binary feature sequence, and determine the maximum average character distance based on the character distance.

[0119] Next, as Figure 4 As shown, a binary feature sequence sample set is constructed based on each binary feature sequence, denoted as C = {C1,...,C}. m ,...,C M}, and calculate the character distance between any two binary feature sequences m and p in the binary feature sequence sample set. The specific process is as follows:

[0120]

[0121] in, This represents the XOR operation, if C mn and C pn If the values ​​are different, the result is 1; if C mn and C pn If the values ​​are the same, the result is 0.

[0122] The character distance is the number of bits whose corresponding binary values ​​differ between two binary feature sequences.

[0123] The process for calculating the maximum average character distance among M binary feature sequences in a binary feature sequence sample set is as follows:

[0124]

[0125] Step (4): Determine the optimal clustering K value based on the maximum average character distance.

[0126] Next, as Figure 5 As shown, a binary feature sequence C is randomly selected from the binary feature sequence sample set C. j As the center, and with the binary feature sequence C j Remove from the binary feature sequence sample set C to generate a new category D. j C j ∈D j .

[0127] Calculate the binary feature sequence C to be removed j All binary feature sequences in the binary feature sequence sample set C are assigned to category D. j binary feature sequence C j Character distance d mj The specific process is as follows:

[0128]

[0129] Where, d mj Indicates the removal of C j The m-th binary feature sequence in C and D j C j Character distance.

[0130] All characters with a distance less than the maximum average character distance (d) mj <d avg The binary feature sequence of ) is classified into category D. j And remove it from the binary feature sequence sample set C.

[0131] Repeat the above steps until the binary feature sequence sample set C is empty, forming multiple categories D. j (j=1,2,...,K), the optimal clustering value K is obtained, denoted as K. * .

[0132] Step (5): Based on the optimal clustering K value, cluster each binary feature sequence to obtain K binary feature sequence groups.

[0133] Next, as Figure 6 As shown, K is selected from the binary feature sequence sample set C. * The binary feature sequences are used as the initial cluster centers E. k (k = 1, 2, ..., K) * ), and calculate MK * A binary feature sequence and K * The character distance between cluster centers is calculated as follows:

[0134]

[0135] Among them, E kn d represents the nth bit of the binary feature sequence of the kth cluster center. mk This represents the character distance between the m-th binary feature sequence and the binary feature sequence of the k-th cluster center.

[0136] Compare binary feature sequences m to K * The minimum character distance between cluster centers is determined as follows:

[0137]

[0138] The binary feature sequence C is determined based on the calculated minimum character distance. m The category k is determined as follows:

[0139] k←f -1 (d mk ), (7)

[0140] Among them, f -1 (·) represents the binary feature sequence C obtained based on the minimum character distance. m The category k to which it belongs.

[0141] Find the binary feature sequence corresponding to the minimum character distance within category k, and use it as the new cluster center. The specific process is as follows:

[0142]

[0143] Among them, ||F k || represents the number of binary feature sequences within category k, and C is the binary feature sequence C corresponding to the minimum character distance within k, calculated from the given information. z E is used as the new cluster center. k ′=C z .

[0144] Repeat the above steps until the binary feature sequence within category k no longer changes, at which point the clustering ends.

[0145] Step (6) assigns each unknown industrial control protocol message corresponding to a binary feature sequence group as an industrial control protocol category.

[0146] Finally, as Figure 7 As shown, the binary feature sequence C is calculated. m Belonging to category k, C m The corresponding unknown industrial control protocol A m Classified into category k, i.e., A m ∈F k .

[0147] Repeat the above steps until A is empty, thus completing the classification of unknown industrial control protocols.

[0148] By applying the technical solution of this embodiment, a method for determining the optimal clustering K-value is proposed to classify unknown industrial control protocols based on character distance clustering. This method dynamically determines the K-value based on the protocol identifier of the industrial control protocol, solving the problem of difficulty in determining the K-value during the clustering of multiple types of unknown industrial control protocols with mixed transmission. Furthermore, taking advantage of the simplified format of industrial control protocol messages and their widespread use of binary sequences, fine-grained similarity discrimination can be performed by calculating and comparing the character distances of unknown industrial control protocols. This solves the problem that traditional text protocol message clustering algorithms cannot accurately reflect the similarity of unknown industrial control protocol messages, thereby achieving high-precision classification of unknown industrial control protocols and avoiding errors in classification results when multiple types of unknown industrial control protocols are transmitted in a mixed manner.

[0149] Furthermore, as Figure 1 In terms of specific implementation, this application provides an unknown industrial control protocol classification device, such as... Figure 8 As shown, the device includes:

[0150] The protocol capture module is used to capture unknown industrial control protocol messages;

[0151] The protocol processing module is used to construct the binary feature sequence corresponding to each unknown industrial control protocol message, calculate the character distance between each binary feature sequence, and determine the maximum average character distance.

[0152] The clustering module is used to determine the optimal clustering K value based on the maximum average character distance; and to cluster each binary feature sequence according to the optimal clustering K value to obtain K binary feature sequence groups;

[0153] The classification module is used to classify the unknown industrial control protocol messages corresponding to each binary feature sequence group as an industrial control protocol category.

[0154] Optionally, the protocol capture module is further configured to:

[0155] (1-1) Capture the original messages of unknown industrial control protocols: Using preset protocol analysis software, capture M original messages of unknown industrial control protocols based on the MAC address or IP address of the industrial control equipment;

[0156] (1-2) Extracting application layer data: Extract the application layer data of M original messages of the unknown industrial control protocol, and construct the application layer dataset of the unknown industrial control protocol message, denoted as A = {A1,...,A2}. m ,...,A M}, where A m This represents the application layer data of the m-th unknown industrial control protocol message.

[0157] Optionally, the protocol processing module is further configured to:

[0158] (2-1) Extracting the feature sequence: Extracting A m The first L bytes are used as the feature sequence B m (m = 1, 2, ..., M);

[0159] (2-2) Binary conversion: Convert B to binary. m Convert to binary feature sequence C m The process is as follows:

[0160] C m =encode(B m ), m=1,2,...,M

[0161] Among them, B m Let m be the m-th feature sequence, and encode(·) means converting the feature sequence into a binary feature sequence C. m =[C m1 C m2 ,...,C mn ,...,C mN ], N represents the number of bits in the binary feature sequence, C mn It represents the nth bit of the mth binary feature sequence.

[0162] Optionally, the protocol processing module is further configured to:

[0163] (3-1) Constructing the sample set: Construct a binary feature sequence sample set, denoted as C = {C1,...,C}. m ,...,C M};

[0164] (3-2) Calculate the character distance between feature sequences: Calculate the character distance between any two binary feature sequences m and p, as follows:

[0165]

[0166] in, This represents the XOR operation, if C mn and C pn If the values ​​are different, the result is 1; if C mn and C pn If the values ​​are the same, the result is 0;

[0167] The character distance is the number of bits whose corresponding binary values ​​differ between two binary feature sequences.

[0168] (3-3) Calculate the maximum average character distance: Calculate the maximum average character distance of M binary feature sequences, the process is as follows:

[0169]

[0170] Optionally, the clustering module is further configured to:

[0171] (4-1) Selecting the class center: Randomly select a binary feature sequence C from C. j As the center, and with C j Remove from C to generate a new category D. j C j ∈D j ;

[0172] (4-2) Calculate the character distance between the feature sequence and the category center: Calculate the removal C j All binary feature sequences in C are then transferred to D. j C j Character distance d mj The process is as follows:

[0173]

[0174] Where, d mj Indicates the removal of C j The m-th binary feature sequence in C and D j C j Character distance;

[0175] (4-3) Perform feature sequence classification: classify all characters whose distance is less than the maximum average character distance (d). mj <d avg The binary feature sequence of ) is classified as D j And remove it from C;

[0176] (4-4) Repeat steps (4-1) to (4-3) in sequence until C is empty, forming multiple categories D. j (j=1,2,...,K), the optimal clustering value K is obtained, denoted as K. * .

[0177] Optionally, the clustering module is also used for:

[0178] (5-1) Determine the initial cluster centers: Randomly select K from C. * The binary feature sequences are used as the initial cluster centers E. k (k = 1, 2, ..., K) * );

[0179] (5-2) Calculate the character distance between the feature sequence and the cluster center: Calculate MK * A binary feature sequence and K * The character distance between the cluster centers is calculated as follows:

[0180]

[0181] Among them, E kn d represents the nth bit of the binary feature sequence of the kth cluster center. mk This represents the character distance between the m-th binary feature sequence and the binary feature sequence of the k-th cluster center;

[0182] (5-3) Compare the character distances between the feature sequences and the cluster centers: Compare and calculate the distances from binary feature sequences m to K. * The minimum character distance between cluster centers is determined as follows:

[0183]

[0184] (5-4) Determine the category of the feature sequence: Determine the binary feature sequence C based on the calculated minimum character distance. m The category k is determined as follows:

[0185] k←f -1 (d mk ),

[0186] Among them, f -1 (·) represents the binary feature sequence C obtained based on the minimum character distance. m The category k to which it belongs;

[0187] (5-5) Update cluster centers: Find the binary feature sequence corresponding to the minimum character distance within category k, and use it as the new cluster center. The process is as follows:

[0188]

[0189] Among them, ||F k || represents the number of binary feature sequences within category k, and C is the binary feature sequence C corresponding to the minimum character distance within k, calculated from the given information. z It was used as the new cluster center E′ k =C z ;

[0190] (5-6) Repeat steps (5-2) to (5-5) until the binary feature sequence within category k no longer changes, i.e., the clustering ends.

[0191] Optionally, the classification module is further configured to:

[0192] (6-1) Determine the category of industrial control protocol: based on the calculated binary characteristic sequence C m Belonging to category k, C m The corresponding unknown industrial control protocol A m Classified into category k, i.e., A m∈F k ;

[0193] (6-2) Repeat step (6-1) until A is empty, thus completing the classification of unknown industrial control protocols.

[0194] It should be noted that other corresponding descriptions of the functional units involved in the unknown industrial control protocol classification device provided in this application embodiment can be found by referring to... Figure 1 The corresponding descriptions in the methods will not be repeated here.

[0195] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0196] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method for classifying unknown industrial control protocols, characterized in that, Includes the following steps: (1) Capture unknown industrial control protocol messages; (2) Construct the binary feature sequence corresponding to each unknown industrial control protocol message; (3) Calculate the character distance between each binary feature sequence, and determine the maximum average character distance based on the character distance; (4) Determine the optimal clustering K value based on the maximum average character distance; The process of determining the optimal clustering K value based on the maximum average character distance includes the following steps: (4-1) Select category center: From Randomly select binary feature sequence As the center, and from Remove from the middle and generate a new category. , ; in, Represents a set of binary feature sequence samples; (4-2) Calculate the character distance between the feature sequence and the category center: calculate the removal After All binary feature sequences to middle Character distance The process is as follows: in, Indicates removal After The Middle A binary feature sequence and middle Character distance, N The number of bits in the binary characteristic sequence. Indicates the first m The first binary feature sequence n Bit, Represents the XOR operation; (4-3) Perform feature sequence classification: classify all binary feature sequences whose character distance is less than the maximum average character distance into... and from Remove from; (4-4) Repeat steps (4-1) to (4-3) in sequence until... Empty, forming multiple categories The optimal clustering K value is obtained, denoted as K. ; (5) Based on the optimal clustering K value, cluster each binary feature sequence to obtain K binary feature sequence groups; (6) Treat the unknown industrial control protocol messages corresponding to each binary feature sequence group as an industrial control protocol category.

2. The method for classifying unknown industrial control protocols according to claim 1, characterized in that, The capture of unknown industrial control protocol messages includes the following steps: (1-1) Capturing raw messages of unknown industrial control protocols: Using preset protocol analysis software, capture raw messages based on the MAC address or IP address of the industrial control device. The original message of an unknown industrial control protocol; (1-2) Extracting application layer data: Extracting Based on the application layer data of the original unknown industrial control protocol messages, construct an application layer dataset of unknown industrial control protocol messages, denoted as . ,in Indicates the first Application layer data of an unknown industrial control protocol message.

3. The method for classifying unknown industrial control protocols according to claim 1, characterized in that, The construction of the binary feature sequence corresponding to each unknown industrial control protocol message includes the following steps: (2-1) Extracting the feature sequence: Extracting The former 1 byte as feature sequence ; (2-2) Binary conversion: converting binary data into binary data. Convert to binary feature sequence The process is as follows: in, Indicates the first A feature sequence, This indicates that the feature sequence has been converted into a binary feature sequence. , The number of bits in the binary characteristic sequence. Indicates the first The first binary feature sequence Bit.

4. The method for classifying unknown industrial control protocols according to claim 1, characterized in that, The process of calculating the character distance between each binary feature sequence and determining the maximum average character distance based on the character distance includes the following steps: (3-1) Constructing the sample set: Construct a binary feature sequence sample set, denoted as ; (3-2) Calculate the character distance between feature sequences: Calculate the distance between any two binary feature sequences. and The character distance is calculated as follows: in, This represents the XOR operation, if and If the values ​​are different, the result is 1; if and If the values ​​are the same, the result is 0; The character distance is the number of bits whose corresponding binary values ​​differ between two binary feature sequences. (3-3) Calculate the maximum average character distance: Calculate The maximum average character distance of a binary feature sequence is determined as follows: 。 5. The method for classifying unknown industrial control protocols according to claim 1, characterized in that, The step of clustering each binary feature sequence according to the optimal clustering K value to obtain K groups of binary feature sequences includes the following steps: (5-1) Determine the initial cluster centers: From Random selection The binary feature sequences are used as the initial cluster centers. ; (5-2) Calculate the character distance between the feature sequence and the cluster center: Calculate A binary feature sequence and The character distance between the cluster centers is calculated as follows: in, Indicates the first The first binary feature sequence of the cluster center Bit, Indicates the first The binary feature sequence and the first The character distance between the binary feature sequences of the cluster centers; (5-3) Compare the character distance between the feature sequence and the cluster center: Compare and calculate the binary feature sequence. m arrive The minimum character distance between cluster centers is determined as follows: (5-4) Determine the category of feature sequence: Determine the binary feature sequence based on the calculated minimum character distance. Category The process is as follows: in, This represents the binary feature sequence obtained based on the minimum character distance. Category ; (5-5) Update cluster centers: Find the categories The binary feature sequence corresponding to the minimum character distance within the cluster is used as the new cluster center, as follows: in, Indicate category The number of binary feature sequences within is calculated. The binary feature sequence corresponding to the minimum character distance within the range Use it as the new cluster center ; (5-6) Repeat steps (5-2) to (5-5) in sequence until the category is reached. The internal binary feature sequence no longer changes, indicating the end of clustering.

6. The method for classifying unknown industrial control protocols according to claim 1, characterized in that, The step of classifying each unknown industrial control protocol message corresponding to a binary feature sequence group as an industrial control protocol category includes the following steps: (6-1) Determine the type of industrial control protocol: based on the calculated binary characteristic sequence Category ,Will The corresponding unknown industrial control protocol Classified as a category ,Right now ; (6-2) Repeat step (6-1) until... If empty, the classification of unknown industrial control protocols is complete.

7. A device for classifying unknown industrial control protocols, characterized in that, The device includes: The protocol capture module is used to capture unknown industrial control protocol messages; The protocol processing module is used to construct the binary feature sequence corresponding to each unknown industrial control protocol message, calculate the character distance between each binary feature sequence, and determine the maximum average character distance. The clustering module is used to determine the optimal clustering K value based on the maximum average character distance; and to cluster each binary feature sequence according to the optimal clustering K value to obtain K binary feature sequence groups; The process of determining the optimal clustering K value based on the maximum average character distance includes the following steps: (4-1) Select category center: From Randomly select binary feature sequence As the center, and from Remove from the middle and generate a new category. , ; in, Represents a set of binary feature sequence samples; (4-2) Calculate the character distance between the feature sequence and the category center: calculate the removal After All binary feature sequences to middle Character distance The process is as follows: in, Indicates removal After The Middle A binary feature sequence and middle Character distance, N The number of bits in the binary characteristic sequence. Indicates the first m The first binary feature sequence n Bit, Represents the XOR operation; (4-3) Perform feature sequence classification: classify all characters whose distance is less than the maximum average character distance ( The binary feature sequence of ) is classified as and from Remove from; (4-4) Repeat steps (4-1) to (4-3) in sequence until... Empty, forming multiple categories The optimal clustering K value is obtained, denoted as K. ; The classification module is used to classify the unknown industrial control protocol messages corresponding to each binary feature sequence group as an industrial control protocol category.

Images