An automatic identification and classification method of unknown industrial control protocol

Abstract

The application relates to the field of industrial control networks, and discloses an automatic identification and classification method for unknown industrial control protocols, which comprises the following steps: extracting unknown industrial control protocol application layer data; constructing a head sequence binary tuple set; comparing corresponding bytes between binary tuple sequences, and calculating byte comparison scores; comparing corresponding half bytes and non-corresponding half bytes between binary tuple sequences, and calculating half byte comparison scores; screening characteristic sequences according to the byte comparison scores and the half byte comparison scores; automatically marking unknown industrial control protocol head sequences according to the characteristic sequences; and classifying the unknown industrial control protocols with labels by using a one-dimensional convolutional neural network enhanced by a gated recurrent unit. Through multi-granularity feature extraction and automatic marking, the unknown industrial control protocol classification can be efficiently and accurately realized, a foundation is laid for unknown industrial control protocol identification, intrusion detection is supported, and industrial control information security is ensured.

Description

Technical Field

[0001] This invention relates to the field of industrial control networks, and in particular to an automatic identification and classification method for unknown industrial control protocols. Background Technology

[0002] Industrial control networks, acting as the central nervous system of industrial control systems, are responsible for connecting numerous sensors, controllers, and actuators to enable self-sensing, self-optimization, and self-operation of the industrial control system. However, the sheer number of industrial devices and the diverse manufacturers have led to the development of numerous public and private industrial control protocols. Lacking unified standards and specifications, these protocols are mutually uninterpretable, creating numerous isolated systems and resulting in a chaotic landscape of conflicting protocols. Particularly in the open industrial internet environment, the unknown specifications of private protocols make them difficult to classify and identify, significantly impacting the security of industrial control systems. Therefore, classifying unknown industrial control protocols is fundamental to achieving interoperability and is a prerequisite for ensuring the security of industrial control systems.

[0003] To address this situation, a common approach is to utilize protocol reverse engineering, combining techniques such as natural language processing, unsupervised learning, and deep learning to infer the syntax, semantics, and timing of protocols, thereby enabling the classification and identification of unknown protocols. Protocol reverse engineering is primarily based on program instructions or message sequences. While program instruction-based reverse engineering methods offer strong analytical capabilities and accurate results, industrial control programs typically operate in different environments, making it difficult to obtain the application source code of the protocols. In contrast, message sequence-based reverse engineering methods are relatively easier to obtain, directly acquiring the message sequences of most industrial control protocols and processing similar protocols.

[0004] Reverse engineering methods for industrial control protocols based on message sequences mainly include steps such as classification, format inference, semantic analysis, and state machine reconstruction. Among these, classification is the most critical step in the reverse analysis process, and its accuracy directly affects the recognition of format, semantics, and state. However, diverse protocol types, complex protocol formats, and varied attack methods all increase the difficulty of classification. Moreover, existing methods rely too heavily on prior knowledge, resulting in overly complex classification structures and excessive resource consumption. Therefore, there is an urgent need for an efficient and accurate classification method for unknown industrial control protocols. Summary of the Invention

[0005] This invention provides an automatic identification and classification method for unknown industrial control protocols. It fully utilizes the unique, stable, and periodic characteristic fields of industrial control protocols to classify them based solely on their inherent characteristics, without relying on prior knowledge. This method enables high-speed and accurate protocol classification, meeting the requirements of industrial control.

[0006] This invention provides an automatic identification and classification method for unknown industrial control protocols, comprising the following steps:

[0007] (1) Extract application layer data of unknown industrial control protocols;

[0008] (2) Construct a set of head sequence binary pairs;

[0009] (3) Compare the corresponding bytes between the binary sequences and calculate the byte alignment score;

[0010] (4) Compare the corresponding and non-corresponding nibbles between the binary sequences and calculate the nibble alignment score;

[0011] (5) Select feature sequences based on byte alignment scores and half-byte alignment scores;

[0012] (6) Automatically mark unknown industrial control protocol header sequences based on feature sequences;

[0013] (7) A one-dimensional convolutional neural network enhanced by gated recurrent units is used to classify unknown industrial control protocols with labels.

[0014] The extraction of unknown industrial control protocol application layer data includes the following steps:

[0015] (1-1) Capture raw data: Capture n binary raw data of unknown industrial control protocols from the industrial control equipment;

[0016] (1-2) Converting the binary data of the captured n unknown industrial control protocol into hexadecimal data;

[0017] (1-3) Extract application layer data: Extract n hexadecimal unknown industrial control protocol application layer data.

[0018] The automatic identification and classification method for unknown industrial control protocols according to claim 1, characterized in that the construction of the header sequence binary set includes the following steps:

[0019] (2-1) Extracting the header sequence: Calculate the length of the application layer data one by one, take the shortest length as the base length, start from the data start position, and extract the length of the application layer data to be consistent with the base length to obtain the header sequence of each unknown industrial control protocol application layer data. All header sequences constitute the header sequence set.

[0020] (2-2) Constructing a set of binary tuples: Select any two head sequences from the head sequence set and combine them to form a set of binary tuples. Let A = {(A1, A2)1, ..., (A... m A n ) N}; where N represents the number of binary sequences, A m Let A represent the m-th head sequence. n This represents the nth head sequence.

[0021] The process of comparing corresponding bytes between binary sequences and calculating byte alignment scores includes the following steps:

[0022] (3-1) Calculate the byte length of the header sequence: The byte length of the header sequence is calculated as follows: l represents the length of the header sequence;

[0023] (3-2) Calculate the byte alignment score: Starting from the data start bit, compare the A bytes in each tuple sequence sequentially. a and A b Byte A at the corresponding position ai and A bi a, b = 1, ..., n, a ≠ b, where i represents the i-th element of the sequence;

[0024] The score for the i-th position is calculated as follows:

[0025]

[0026] The scores f(i) after each comparison are summed to obtain the total score after comparing a sequence of two tuples. Then for f c The average value is used to obtain the byte alignment score. N represents the number of binary tuple sequences.

[0027] The process of comparing corresponding and non-corresponding nibbles between binary sequences and calculating the nibble alignment score includes the following steps:

[0028] (4-1) Calculate the half-byte length of the header sequence: The half-byte length of the header sequence is calculated as l2 = 2 × l1 = l;

[0029] (4-2) Calculate the matching window size: Set a dynamic comparison range, where the matching window is calculated as follows:

[0030] (4-3) Count the number of matched half-bytes: Starting from the data start position, traverse sequence A. a Each nibble A in aj In A b Find the half-byte A within the matching window range bj Where j represents the j-th position in the sequence, j = 1,...,l2;

[0031] If A aj =A bj Then A aj and Abj The number of matching half-bytes within the matching window is denoted as e;

[0032] (4-4) Counting the number of transposed nibbles: Extract the matched nibbles from their header sequence to obtain a new sequence set with a length of l3. Select any two sequences from the new sequence set and combine them to form a new set of binary sequences B = {(B1, B2)1, ..., (B m B n ) N};

[0033] If B in the new binary sequence a and B b The half-byte B at the corresponding position ak ≠B bk If a, b = 1, ..., n, a ≠ b, and k = 1, ..., l3, then the two half-bytes B at the same position are considered to be... ak and B bk A transposition operation has occurred. The number of half-byte characters involved in the transposition is half the number of bytes involved in the transposition operation, denoted as t.

[0034] (4-5) Calculate the half-byte alignment score: half-byte alignment score h d The calculation is as follows:

[0035] h d =h c +0.1×ε×(1-h c ),d=1,...,N

[0036] Where ε represents the number of consecutive identical nibbles in the two header sequences. This represents the half-byte alignment score when consecutive identical half-bytes in the two header sequences are not considered, and N represents the number of tuple sequences.

[0037] The step of filtering feature sequences based on byte alignment scores and half-byte alignment scores includes the following steps:

[0038] (5-1) Construct the byte alignment score matrix: all f d Construct the byte alignment score matrix F1;

[0039] (5-2) Construct the half-byte alignment score matrix: all h d Construct the half-byte alignment score matrix F2;

[0040] (5-3) Constructing the comprehensive comparison score matrix: Calculate the average of corresponding elements in the two score matrices F1 and F2 to obtain the average score matrix F3. The process is as follows:

[0041]

[0042] The value of each element is in the range of [0,1].

[0043] (5-4) Filtering binary sequences: Set a score threshold β, filter F3, retain binary sequences that exceed the threshold to obtain high-scoring binary sequences; otherwise, remove them.

[0044] (5-5) Screening Feature Sequences: If A is retained in the binary sequence... a and A b Byte A at the corresponding position ai =A bi If A, then the bytes will be preserved; if A ai ≠A bi Then use the symbol "--" as a placeholder; traverse all binary tuple sequences and filter to obtain the sequence set C = (C1,...,C...). n );

[0045] Return to step (5-1) and repeat the loop multiple times. Stop filtering when each sequence in C contains only one byte, thus obtaining the feature sequence set D = (D1,...,D...). n ), D n This represents the nth feature sequence.

[0046] The step of automatically marking unknown industrial control protocol header sequences based on feature sequences includes the following steps:

[0047] (6-1) Copying the feature sequence set: Copy each element in the feature sequence set D sequentially to a new feature set E = (E1,...,E2). n );

[0048] (6-2) Automatically labeled sequence: Extract a feature sequence E from E. p Compare it with the feature sequence D in D q Each sequence is compared individually, and the header sequence is labeled based on the comparison results. The process is as follows:

[0049]

[0050] Where s represents the label of the head sequence with the same characteristics, and the value range is non-negative integer; u represents the placeholder label.

[0051] (6-3) Constructing the label matrix: When E p After the alignment analysis with all feature sequences in D is completed, E will be... p Filter it out from E;

[0052] Return to step (6-1) until all feature sequences in E have been filtered out, indicating that the head sequence labeling is complete, and the label matrix is ​​obtained:

[0053]

[0054] (6-4) Dynamically adjust the label matrix: Dynamically adjust the elements in the label matrix, filter out u, and merge the remaining s into one column to obtain a label matrix containing multiple labels:

[0055]

[0056] The method of classifying labeled unknown industrial control protocols using a one-dimensional convolutional neural network enhanced by gated recurrent units includes the following steps:

[0057] (7-1) Numericalizing the header sequence: Using tag encoding, the discrete header sequence is numerically converted into a continuous sequence;

[0058] (7-2) Normalize the header sequence: Normalize the numerical header sequence using Min-Max, that is, map the byte values ​​in the header sequence to the range [0,1].

[0059] (7-3) Learning the internal features of the head sequence: In the convolutional layers of X one-dimensional convolutional neural networks, the internal features of the head sequence are learned by performing convolution operations between the convolutional kernels and the input sequence. The process is as follows:

[0060]

[0061] Where, x conv x represents the output feature of the convolutional layer. conv-1 This represents the input features of the convolutional layers. The input features of the first convolutional layer are the normalized head sequence. and λ represents the weight factor and bias factor of the convolution kernel in the convolutional layer, respectively; λ represents the position in the convolution kernel; * represents the convolution operation; θ represents the total number of convolution kernels; and G(·) represents the activation function.

[0062] (7-4) Perform nonlinear transformation: Use the ReLU activation function to perform a nonlinear transformation on the output features of the convolutional layer, transforming the output value y conv Within a fixed range, the process is as follows:

[0063] y conv =ReLU(x)=max(x) conv ,0)

[0064] (7-5) Reduce the dimensionality of the head sequence: In the pooling layers of the Y one-dimensional convolutional neural networks, max pooling is used to highlight important features in the head sequence. The process is as follows:

[0065] x pool =max(y conv )

[0066] Among them, y conv x represents the output value after transformation by the ReLU activation function. pool This represents the output after max pooling;

[0067] (7-6) Learning features between head sequences: Z gated recurrent units are stacked together in sequence and added after the convolutional and pooling layers of a one-dimensional convolutional neural network to learn features between head sequences.

[0068] (7-7) Output predicted values: Use the normalized exponential function to calculate the probability of each category label, i.e., the predicted value;

[0069] (7-8) Calculate the loss value: Use the multi-class cross-entropy loss function to calculate the difference between the predicted value and the true value of the head sequence, i.e., the loss value. The process is as follows:

[0070]

[0071] Where n represents the number of head sequences in the input one-dimensional convolutional neural network, v represents the dimension of the output prediction vector, z represents the class labels of the head sequences obtained in (6-4) in the form of 0 or 1, i.e. the true values, and r represents the predicted value, which takes the value range of [0,1].

[0072] (7-9) Reverse parameter update: The parameters of the convolutional layer in (7-3) are updated in reverse by using the loss function until the loss value is less than the set value, at which point the parameter update stops;

[0073] (7-10) Classify unknown industrial control protocols: Based on the classification results of the header sequence, classify the original data of the corresponding unknown industrial control protocols.

[0074] An automatic identification and classification device for unknown industrial control protocols includes a memory and a processor; the memory is used to store a computer program; the processor is used to implement the automatic identification and classification method for unknown industrial control protocols when the computer program is executed.

[0075] A computer-readable storage medium storing a computer program, which, when executed by a processor, implements an automatic identification and classification method for unknown industrial control protocols.

[0076] By employing the above technical solution, this invention provides an automatic identification and classification method for unknown industrial control protocols. First, it extracts application layer data of the unknown industrial control protocol; then, it constructs a set of header sequence tuples; next, it compares corresponding bytes between tuple sequences and calculates byte alignment scores; it then compares corresponding and non-corresponding half-bytes between tuple sequences and calculates half-byte alignment scores; finally, it filters feature sequences based on byte alignment scores and half-byte alignment scores; based on these feature sequences, it automatically labels the header sequences of the unknown industrial control protocols; and finally, it uses a one-dimensional convolutional neural network enhanced with gated recurrent units to classify the labeled unknown industrial control protocols. This invention, through multi-granularity feature extraction and automatic labeling, can achieve high-efficiency and high-precision classification of unknown industrial control protocols. This lays the foundation for the identification of unknown industrial control protocols, supports intrusion detection, and ensures the security of industrial control information.

[0077] The present invention has the following beneficial effects and advantages:

[0078] 1. Taking into full account the characteristics of specific positions and fixed values ​​of industrial control protocol header fields, a multi-granularity industrial control protocol feature extraction method combining bytes and half-bytes is proposed. This breaks the dependence and subjectivity of existing methods on known industrial control protocol features or expert experience, and meets the classification needs of large-scale unknown industrial control protocol data.

[0079] 2. To address the issue of missing feature labels in existing classifications of unknown industrial control protocols, an automatic feature labeling method is proposed based on the inconsistency of feature bytes in the header fields of industrial control protocols. By analyzing the changes in features in the feature set, header sequences with the same feature bytes are automatically labeled, and the labels are dynamically adjusted, thus solving the problems of slow speed, long time, and low accuracy of manual labeling.

[0080] 3. Furthermore, considering the limited computing resources of industrial control system equipment, and the problems of existing deep learning methods being complex in structure, having many parameters, and requiring large resources, a one-dimensional convolutional neural network protocol classification method based on gated recurrent units is proposed. This reduces the number of parameters and computational load, and improves the efficiency and real-time performance of classification in terms of overall structure.

[0081] 4. The classification of unknown industrial control protocols implemented in this invention can lay the foundation for the identification of unknown industrial control protocols, support intrusion detection, and ensure the security of industrial control information. Attached Figure Description

[0082] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this invention, illustrate exemplary embodiments of the invention and are used to explain the invention, but do not constitute an undue limitation of the invention. In the drawings:

[0083] Figure 1 A flowchart illustrating an automatic identification and classification method for unknown industrial control protocols;

[0084] Figure 2 A schematic diagram of the data extraction process for unknown industrial control protocols at the application layer.

[0085] Figure 3 A schematic diagram illustrating the process of constructing a set of head sequence binary pairs;

[0086] Figure 4 A schematic diagram illustrating the process of calculating byte alignment scores;

[0087] Figure 5 A schematic diagram illustrating the process of calculating the half-byte alignment score;

[0088] Figure 6 Schematic diagram of the feature sequence selection process;

[0089] Figure 7 A schematic diagram of the header sequence of automatically marking unknown industrial control protocols;

[0090] Figure 8 Schematic diagram of the classification process for unknown industrial control protocols. Detailed Implementation

[0091] This embodiment provides an automatic identification and classification method for unknown industrial control protocols, such as Figure 1 As shown, the method includes:

[0092] Step (1): Extract application layer data of unknown industrial control protocols.

[0093] The automatic identification and classification method for unknown industrial control protocols provided in this embodiment of the invention can be applied in industrial control systems for classifying unknown industrial control protocols. Firstly, as... Figure 2 As shown, n binary unknown industrial control protocol raw data are captured from the industrial control equipment, and the captured n binary unknown industrial control protocol raw data are converted into hexadecimal data to extract n hexadecimal unknown industrial control protocol application layer data.

[0094] Step (2) Construct a set of head sequence tuples.

[0095] like Figure 3 As shown, the length of each application layer data is calculated sequentially. Using the shortest length as the baseline, starting from the data start position, the length of the application layer data is truncated to match the baseline length, resulting in the header sequence of each unknown industrial control protocol application layer data. All header sequences constitute a header sequence set. Then, any two header sequences are selected sequentially from the header sequence set and combined to form a binary tuple sequence. Let A = {(A1, A2)1, ..., (A...} m A n ) N}; where N represents the number of binary sequences, Am Let A represent the m-th head sequence. n This represents the nth head sequence.

[0096] Step (3) compare the corresponding bytes between the binary sequences and calculate the byte alignment score.

[0097] like Figure 4 As shown, the byte length of the header sequence is calculated as follows: l represents the length of the header sequence; then, starting from the beginning of the data, the A values ​​in each pair sequence are compared sequentially. a and A b Byte A at the corresponding position ai and A bi (a,b=1,...,n,a≠b), where i represents the i-th position in the sequence.

[0098] The process of calculating the score for the i-th position is as follows:

[0099]

[0100] Next, the scores f(i) after each comparison are accumulated to obtain the total score after comparing a sequence of two tuples. Then for f c The average value is used to obtain the byte alignment score. N represents the number of binary tuple sequences.

[0101] Step (4) compare corresponding and non-corresponding half-bytes between the binary sequences and calculate the half-byte alignment score.

[0102] like Figure 5 As shown, the half-byte length of the header sequence is calculated as l2 = 2 × l1 = l, and a dynamic comparison range is set, where the matching window is calculated as... Then, starting from the beginning of the data, traverse sequence A. a Each nibble A in aj In A b Find the half-byte A within the matching window range bj Where j represents the j-th position in the sequence, j = 1,...,l2; if A aj =A bj Then A aj and A bj This is denoted as matching a half-byte, and the number of matching half-bytes within the matching window is counted, denoted as e;

[0103] Next, the matched half-byte is extracted from its header sequence, resulting in a new sequence set with a sequence length of l3. Any two sequences are then selected sequentially from this new sequence set and combined to form a new set of binary sequences B = {(B1, B2)1, ..., (B... m B n ) N If B in the new binary sequence a and B b The half-byte B at the corresponding position ak ≠B bk (a, b = 1, ..., n, a ≠ b, k = 1, ..., l3), then the two half-bytes B at the same position are considered to be... ak and B bk A transposition operation occurred, and the number of transposed half-bytes is half the number of bytes involved in the transposition operation, denoted as t; the final half-byte alignment score is h. d The calculation is as follows:

[0104] h d =h c +0.1×ε×(1-h c ),d=1,...,N (2)

[0105] Where ε represents the number of consecutive identical nibbles in the two header sequences. This represents the half-byte alignment score when consecutive identical half-bytes in the two header sequences are not considered, and N represents the number of tuple sequences.

[0106] Step (5): Select feature sequences based on byte alignment scores and half-byte alignment scores.

[0107] like Figure 6 As shown, all f d Construct a byte alignment score matrix F1, and then combine all h... d Construct a half-byte alignment score matrix F2; then, calculate the average of corresponding elements in the two score matrices F1 and F2 to obtain the average score matrix F3. The process is as follows:

[0108]

[0109] The value of each element is in the range of [0,1].

[0110] Then, based on the comprehensive comparison score matrix, a score threshold β is set, and F3 is filtered out. Pair sequences exceeding the threshold are retained, resulting in high-scoring pairs; otherwise, they are removed. If A is among the retained pairs... a and A b Byte A at the corresponding position ai =Abi If A, then the bytes will be preserved; if A ai ≠A bi Then use the symbol "--" as a placeholder; traverse all binary tuple sequences and filter to obtain the sequence set C = (C1,...,C...). n );

[0111] Return to step (5) and repeat the loop multiple times. Stop filtering when each sequence in C contains only one byte, thus obtaining the feature sequence set D = (D1,...,D...). n ), D n This represents the nth feature sequence.

[0112] Step (6): Automatically mark the unknown industrial control protocol header sequence based on the feature sequence.

[0113] like Figure 7 As shown, each element in the feature sequence set D is copied sequentially to form a new feature set E = (E1,...,E2). n Then, a feature sequence E is extracted from E. p Compare it with the feature sequence D in D q Each sequence is compared individually, and the header sequence is labeled based on the comparison results. The process is as follows:

[0114]

[0115] Where s represents the label of the head sequence with the same characteristics, and the value range is non-negative integer; u represents the placeholder label.

[0116] When E p After comparing E with all feature sequences in D, E p Filter out from E; return to step (6) until all feature sequences in E have been filtered out, indicating that the head sequence labeling is complete, and the label matrix is ​​obtained:

[0117]

[0118] Then, the elements in the label matrix are dynamically adjusted, u is filtered out, and the remaining s are merged into one column to obtain a label matrix containing multiple labels:

[0119]

[0120] Step (7) classifies the unknown industrial control protocols with labels based on a one-dimensional convolutional neural network enhanced by a gated recurrent unit.

[0121] like Figure 8As shown, the discrete header sequence is numerically converted into a continuous sequence using label encoding; the numerically converted header sequence is then normalized using Min-Max, mapping the byte values ​​in the header sequence to the [0,1] interval; the internal features of the header sequence are learned by performing convolution operations between convolution kernels and the input sequence in the convolutional layers of X one-dimensional convolutional neural networks, as follows:

[0122]

[0123] Where, x conv x represents the output feature of the convolutional layer. conv-1 This represents the input features of the convolutional layers. The input features of the first convolutional layer are the normalized head sequence. and λ represents the weight factor and bias factor of the convolution kernel in the convolutional layer, respectively; λ represents the position in the convolution kernel; * represents the convolution operation; θ represents the total number of convolution kernels; and G(·) represents the activation function.

[0124] Next, the ReLU activation function is used to perform a non-linear transformation on the output features of the convolutional layer, transforming the output value y... conv Within a fixed range, the process is as follows:

[0125] y conv =ReLU(x)=max(x) conv ,0) (8)

[0126] Secondly, in the pooling layers of the Y one-dimensional convolutional neural networks, max pooling is used to highlight important features in the head sequence, as follows:

[0127] x pool =max(y conv (9)

[0128] Among them, y conv x represents the output value after transformation by the ReLU activation function. pool This represents the output after max pooling;

[0129] Then, Z gated recurrent units are stacked sequentially and added after the convolutional and pooling layers of a one-dimensional convolutional neural network to learn features between the head sequences. A normalized exponential function is used to calculate the probability of each category label, i.e., the predicted value. Finally, a multi-class cross-entropy loss function is used to calculate the difference between the predicted and true values ​​of the head sequences, i.e., the loss value. The process is as follows:

[0130]

[0131] Where n represents the number of head sequences in the input one-dimensional convolutional neural network, v represents the dimension of the output prediction vector, z represents the class labels of the head sequences obtained in (6-4) in the form of 0 or 1, i.e. the true values, and r represents the predicted value, which takes the value range of [0,1].

[0132] Finally, the parameters of the convolutional layer are updated in reverse using the loss function. and The parameter update stops when the loss value is less than the set value; then, based on the classification results of the header sequence, the corresponding unknown industrial control protocol raw data is classified into serial communication protocol, fieldbus protocol, and industrial Ethernet protocol.

[0133] By applying the technical solution of this embodiment, considering the dense key information in the header fields of industrial control protocols, a multi-granularity industrial control protocol feature extraction method combining bytes and half-bytes is adopted to achieve accurate feature extraction without prior knowledge, avoiding the strong subjectivity in feature extraction. Furthermore, by utilizing the inconsistent feature bytes in the header fields, feature sequences are automatically labeled, and the protocol feature set is dynamically updated, thereby solving the problem of labeling unknown protocol data. Based on this, to ensure real-time classification, a protocol classification method based on a one-dimensional convolutional neural network enhanced by gated recurrent units is proposed. This invention, through multi-granularity feature extraction and automatic labeling, can achieve high-efficiency and high-precision classification of unknown industrial control protocols, laying the foundation for the identification of unknown industrial control protocols, supporting intrusion detection, and ensuring the security of industrial control information.

Claims

1. An automatic identification and classification method for unknown industrial control protocols, characterized in that, Includes the following steps: (1) Extract application layer data of unknown industrial control protocols; (2) Construct a set of head sequence binary pairs; (3) Compare the corresponding bytes between the binary sequences and calculate the byte alignment score; (4) Compare corresponding and non-corresponding nibbles between the binary sequences and calculate the nibble alignment score; (5) Select feature sequences based on byte alignment scores and half-byte alignment scores; (6) Automatically mark unknown industrial control protocol header sequences based on feature sequences; (7) Classify unknown industrial control protocols with labels using a one-dimensional convolutional neural network enhanced by gated recurrent units; The construction of the head sequence binary set includes the following steps: (2-1) Extracting the header sequence: Calculate the length of the application layer data one by one, take the shortest length as the base length, start from the data start position, and extract the length of the application layer data to be consistent with the base length to obtain the header sequence of each unknown industrial control protocol application layer data. All header sequences constitute the header sequence set. (2-2) Constructing a set of binary tuples: Select any two head sequences from the head sequence set and combine them to form a set of binary tuples. Let the set of all binary tuple sequences be denoted as . ;in, Indicates the number of pairs in the sequence. Indicates the first Head sequence Indicates the first One head sequence; The process of comparing corresponding bytes between binary sequences and calculating byte alignment scores includes the following steps: (3-1) Calculate the byte length of the header sequence: The byte length of the header sequence is calculated as follows: , Indicates the length of the header sequence; (3-2) Calculate the byte alignment score: Starting from the data start bit, align each tuple sequence sequentially. and byte at the corresponding position and , ,in Represents the first of the sequence Bit; Calculate the first The scoring process for each position is as follows: ； The score after each comparison The scores are accumulated to obtain the total score after comparing a sequence of two tuples. And then The average value is used to obtain the byte alignment score. , Indicates the number of pairs in the sequence; The process of comparing corresponding and non-corresponding nibbles between binary sequences and calculating the nibble alignment score includes the following steps: (4-1) Calculate the half-byte length of the header sequence: The half-byte length of the header sequence is calculated as follows: ; (4-2) Calculate the matching window size: Set a dynamic comparison range, where the matching window is calculated as follows: ; (4-3) Count the number of matching half-bytes: Starting from the data start position, traverse the sequence. Each nibble ,exist Find the half-byte within the matching window range ;in, Represents the first of the sequence Bit, ; like ,but and This is denoted as a matching half-byte, and the number of matching half-bytes within the matching window is counted, denoted as... ; (4-4) Counting the number of transposed nibbles: Extract the matched nibbles from their respective header sequences to obtain a new sequence set. The length of the sequences in the new sequence set is... Select any two sequences from the new sequence set and combine them to form a new set of binary sequences. ; If the new binary sequence contains and half byte at the corresponding position , , Then the two half-bytes at the same position are identified. and A transposition operation occurred, and the number of half-bytes involved in the transposition was half the number of bytes involved in the transposition operation, denoted as... ; (4-5) Calculate the half-byte alignment score: half-byte alignment score The calculation is as follows: ； in, This indicates the number of consecutive identical nibbles in two header sequences. This represents the half-byte alignment score when consecutive identical half-bytes in two header sequences are not considered. Indicates the number of pairs in the sequence; The step of filtering feature sequences based on byte alignment scores and half-byte alignment scores includes the following steps: (5-1) Construct the byte alignment score matrix: all Constructing a byte alignment score matrix ; (5-2) Construct the half-byte alignment score matrix: all Constructing a half-byte alignment score matrix ; (5-3) Constructing a comprehensive comparison score matrix: For the two score matrices and The average score matrix is ​​obtained by averaging the corresponding elements within the matrix. The process is as follows: ； The value of each element is in the range of [0,1]. (5-4) Filtering binary sequences: setting a score threshold ,filter The sequence of pairs exceeding the threshold is retained to obtain the high-scoring pair sequence; otherwise, it is removed. (5-5) Filtering Feature Sequences: If the retained binary sequences include and byte at the corresponding position If, then the bytes will be preserved; if Then use the symbol "—" as a placeholder; traverse all the binary sequences and filter to obtain the sequence set. ; Return to step (5-1) and repeat the loop multiple times until... The filtering process stops when each sequence contains only one byte, thus obtaining the set of feature sequences. , Indicates the first A feature sequence; The step of automatically marking unknown industrial control protocol header sequences based on feature sequences includes the following steps: (6-1) Copy the feature sequence set: Copy the feature sequence set Each element in the set is copied sequentially to form a new feature set. ; (6-2) Automatically labeled sequences: from Extract a feature sequence from , and Feature sequences in Each sequence is compared individually, and the header sequence is labeled based on the comparison results. The process is as follows: ； in, Labels representing header sequences with the same characteristics are listed, and their values ​​are non-negative integers. Indicates a placeholder label; (6-3) Constructing the label matrix: When and After all feature sequence alignment analysis is completed, from Filtered out; Return to step (6-1) until... When all feature sequences in the header are filtered out, the header sequence labeling is complete, and the label matrix is ​​obtained. ； (6-4) Dynamically adjust the tag matrix: Dynamically adjust the elements in the tag matrix to filter out... and the remainder Merge them into one column to obtain a label matrix containing multiple labels: 。 2. The automatic identification and classification method for unknown industrial control protocols according to claim 1, characterized in that, The extraction of unknown industrial control protocol application layer data includes the following steps: (1-1) Capturing raw data: capturing data from industrial control equipment The raw data of an unknown binary industrial control protocol; (1-2) Convert number system: Convert the captured number system to a different base. The raw data of an unknown binary industrial control protocol is converted into hexadecimal data; (1-3) Extracting application layer data: Extracting Application layer data of an unknown hexadecimal industrial control protocol.

3. The automatic identification and classification method for unknown industrial control protocols according to claim 1, characterized in that, The method of classifying labeled unknown industrial control protocols using a one-dimensional convolutional neural network enhanced by gated recurrent units includes the following steps: (7-1) Numericalizing the header sequence: Using tag encoding, the discrete header sequence is numerically converted into a continuous sequence; (7-2) Normalize the header sequence: Normalize the numerical header sequence using Min-Max, that is, map the byte values ​​in the header sequence to the range [0,1]; (7-3) Learning the internal features of the head sequence: In In the convolutional layers of a one-dimensional convolutional neural network, convolutional kernels are used to perform convolution operations with the input sequence to learn the internal features of the head sequence. The process is as follows: ； in, This represents the output features of the convolutional layer. This represents the input features of the convolutional layers. The input features of the first convolutional layer are the normalized head sequence. and These represent the weight factor and bias factor of the convolution kernel in the convolutional layer, respectively. Indicates the position within the convolution kernel. This represents the convolution operation. This represents the total number of convolution kernels. Indicates the activation function; (7-4) Perform nonlinear transformation: Use the ReLU activation function to perform a nonlinear transformation on the output features of the convolutional layer, and transform the output values... Within a fixed range, the process is as follows: ； (7-5) Reduce the dimensionality of the head sequence: In In the pooling layers of a one-dimensional convolutional neural network, max pooling is used to highlight important features in the head sequence. The process is as follows: ； in, This represents the output value after transformation by the ReLU activation function. This represents the output after max pooling; (7-6) Learning features between head sequences: Gated recurrent units are stacked sequentially and added after the convolutional and pooling layers of a one-dimensional convolutional neural network to learn features between head sequences. (7-7) Output predicted values: Use the normalized exponential function to calculate the probability of each category label, i.e., the predicted value; (7-8) Calculate the loss value: Use the multi-class cross-entropy loss function to calculate the difference between the predicted value and the true value of the head sequence, i.e., the loss value; (7-9) Backward parameter update: Update the parameters of the convolutional layer in (7-3) in reverse using the loss value until the loss value is less than the set value, then stop updating the parameters; (7-10) Classify unknown industrial control protocols: Based on the classification results of the header sequence, classify the original data of the corresponding unknown industrial control protocols.

4. An automatic identification and classification device for unknown industrial control protocols, characterized in that, It includes a memory and a processor; the memory is used to store a computer program; the processor is used to implement, when executing the computer program, an automatic identification and classification method for an unknown industrial control protocol as described in any one of claims 1-3.

5. A computer-readable storage medium, characterized in that, The storage medium stores a computer program, which, when executed by a processor, implements an automatic identification and classification method for an unknown industrial control protocol as described in any one of claims 1-3.

Images