A method and apparatus for reverse analysis of unknown industrial control protocols

Abstract

This invention belongs to the field of protocol reverse engineering technology and proposes a method and apparatus for reverse analysis of unknown industrial control protocols. It involves forming a set of message fragments based on network packets; the packets and message fragment sets constitute a dataset; a heterogeneous message graph is constructed based on the dataset; the heterogeneous message graph is input into a neural network model for message graph feature extraction to perform message clustering and train the neural network model; the dataset to be clustered is input into the trained neural network model for clustering; within the same message cluster, the Needleman-Wunsch algorithm is used to infer the syntax format and mark field boundaries. This invention reduces the time complexity of message clustering; it jointly optimizes feature extraction and clustering; and it provides the model with finer-grained and more reasonable analysis units.

Description

Technical Field

[0001] This invention relates to the field of protocol reverse engineering, and more particularly to a method and apparatus for reverse analysis of unknown industrial control protocols. Background Technology

[0002] Industrial Control Systems (ICSs) play a crucial role in national critical infrastructure and the national economy, making their secure operation of paramount importance. ICSs consist of various control components and use specific Industrial Control Protocols (ICPs) for transmission (such as Modbus, S7, and DNP3). Due to the lack of universally accepted international standards and the self-interest of equipment manufacturers, a large number of proprietary ICPs exist within ICSs, with unknown protocol specifications and neglected security mechanisms (such as authentication and encryption). This makes it impossible for security maintenance personnel to analyze these protocols, thus exacerbating ICS security issues.

[0003] Protocol reverse engineering (PRE) has gained widespread attention in order to obtain the specifications of unpublished ICPs. PRE can infer protocol specifications from network packets or parsing programs, thereby gaining knowledge about their syntax and behavior. However, unlike text-based protocols, industrial control protocols are binary protocols, characterized by their messy content, lack of delimiters, and unreadable nature, making reverse engineering methods for text-based protocols difficult to apply effectively to the field of industrial control protocols. Faced with these abstract industrial control protocols with unpublished specifications, constructing an accurate and effective protocol analysis model becomes a very challenging problem.

[0004] The paper "Y. Wang, X. Yun, MZ Shafiq, L. Wang, AX Liu, Z. Zhang, D. Yao, Y. Zhang, and L. Guo. A semantics-aware approach to automated reverse engineering unknown protocols. In 2012 20th IEEE International Conference on Network Protocols (ICNP), pages 1-10. IEEE, 2012" proposes a multi-step protocol reverse engineering model, ProDecoder, based on semantic recognition. This method first uses n-grams to segment network packets into a series of packet fragments, serving as the smallest input unit of the model. Second, it uses the topic analysis model LDA from the NLP field to extract protocol keywords and form a keyword set. Next, based on the obtained keywords, the packet sequences are clustered, grouping packets of the same protocol type into the same cluster. Finally, within each cluster, a sequence alignment algorithm is used to infer the protocol format. However, the coarse-grained message segmentation method based on n-grams ignores the case where some fields of industrial control protocols consist of only a few bits, and generates a large number of meaningless message fragments, thus affecting downstream analysis. In addition, the multi-step pipeline analysis method is prone to error propagation, that is, the deviation of the preceding task will directly affect the accuracy of the subsequent task, thus leading to the deviation of the final analysis results.

[0005] The paper "Y.Ye, Z.Zhang, F.Wang, X.Zhang, D.Xu, NetPlier: Probabilistic network protocol reverse engineering from message traces, in: 28th Annual Network and Distributed System Security Symposium, NDSS2021, Virtually, February 21-25, 2021" proposes a probabilistic reasoning-based unknown protocol analysis method, NetPlier, based on the assumption that key fields determine the type of network packets. This method first employs a multi-sequence alignment algorithm to obtain an aligned set of fields. Then, the problem of identifying message keywords is transformed into finding the field with the highest probability value from the aligned field set. Subsequently, based on the identified keywords, network packets are classified into different types, and the protocol format and state machine are inferred within the same type of packet set. Because it focuses on identifying key fields, it assumes that key fields can determine the type of the current network packet and uses this to perform packet clustering. However, key fields cannot fully reflect the type characteristics of the message, and given the repetitive, abstract, and unreadable nature of ICP message content, obtaining accurate keywords is time-consuming and error-prone.

[0006] In summary, existing protocol reverse engineering methods suffer from problems such as unreasonable message segmentation, limited message type characteristics, and flawed analysis processes. These issues result in low accuracy of the inferred protocol formats and state machines, making them difficult to apply in industrial control protocol analysis and limiting their practicality and reference value. Summary of the Invention

[0007] The purpose of this invention is to propose a highly accurate reverse engineering method and apparatus for unknown industrial control protocols in industrial control system networks. The proposed heuristic message segmentation algorithm can divide the original message sequence into fields of arbitrary length, providing finer-grained analysis units and improving the accuracy of downstream tasks. The proposed message graph feature extraction model, Mess-GCN, has stronger robustness, fully utilizes the interaction information between subtasks, captures richer message structure features, and achieves better clustering results. Taking into full account practical applications, the proposed method is an automated reverse engineering approach, eliminating the need for manual intervention in network messages.

[0008] The technical solution of the present invention is as follows: A method for reverse analysis of an unknown industrial control protocol, comprising the following steps:

[0009] Network packets are segmented into a set of packet fragments based on a heuristic packet segmentation algorithm. The packets and the set of packet fragments constitute a dataset. A heterogeneous packet graph G(V,E) is constructed based on the dataset. The heterogeneous packet graph G(V,E) is input into the Messi-GCN neural network model for packet clustering and training. The dataset to be clustered is input into the trained Messi-GCN neural network model for clustering. Within the same packet cluster, the Needleman-Wunsch algorithm is used to infer the syntax format and mark the field boundaries.

[0010] The specific steps for forming a set of message fragments based on the heuristic message segmentation algorithm are as follows:

[0011] Step 1.1: Extract the application layer data of the network packets to obtain the packet sequence in hexadecimal format. There are K types of packet sequences.

[0012] Step 1.2: Based on heuristic rules, perform field inference on all message sequences to obtain common fields; the common fields include protocol identifier and length field;

[0013] Step 1.3: Perform positional encoding on the remaining part of the message sequence after removing the common fields and use n-gram to obtain multiple message fragments;

[0014] Step 1.4: Perform deduplication on common fields and message fragments to form a message fragment set.

[0015] The heuristic rules are as follows:

[0016] Rule a) Identify the protocol identifier field: If the first N bytes of multiple message sequences are identical, then the first N bytes of character content constitute the protocol identifier field;

[0017] Rule.b) Identify the length field: Divide the message sequence into different groups according to the length. Under the same group of messages, determine whether the values ​​Q of M consecutive bytes at the same position are the same. If the same value Q is present in the same position within the same group of messages, but different values ​​Q are present in the same position between different groups of messages, and Q is the length of the message corresponding to the group, then these M consecutive bytes are identified as the length field.

[0018] The specific operation process of step 1.3 is as follows: concatenate the position number of each byte in the original message sequence with the character content of the corresponding byte, and use a sliding window of size n to slide and select values ​​from left to right in the original message sequence.

[0019] The construction of the heterogeneous message graph G(V,E) specifically involves:

[0020] Step 2.1: Treat each message and each message fragment as a graph node, with the number of nodes |V| = n, which is the sum of the number of messages and the number of message fragments. Establish edges between nodes when a message fragment appears in a message. Use the Term Frequency-Inverse Text Frequency Index (TF-IDF) as the weight value for message-fragment edges and the Point Mutual Information (PMI) as the weight for fragment-fragment edges. The specific process is as follows:

[0021]

[0022]

[0023]

[0024] Where #W(s) is the number of sliding windows containing message fragment s, #W(s,t) is the number of sliding windows containing both message fragment s and message fragment t, and #W refers to the number of sliding windows on the entire set of message fragments.

[0025] The edge weights are calculated as follows:

[0026]

[0027] Where A represents the adjacency matrix of the heterogeneous message graph G, and its value is the calculated edge weight; i, j represent graph nodes; when i and j are nodes of the same message fragment type and their mutual information (PMI) value is positive, the weight of the edge formed between them is the PMI value; when i and j are nodes of different types, the value obtained by TF-IDF calculation is used as the weight value of the edge formed between them; when i and j are the same node, the weight value of the edge is 1; when there is an edge that does not satisfy the above conditions, its weight value is 0.

[0028] Step 2.2: Initialize the feature vector of each node using an m-dimensional one-hot vector. Then, the feature representation of all nodes is a matrix. Generate a heterogeneous message graph.

[0029] The message graph feature extraction neural network model, Mess-GCN, consists of a two-layer graph convolutional neural network (GCN). The embedding size of the nodes in the second layer is the same as the number of message types, K, and is normalized using the softmax function to generate the category features for each message node.

[0030]

[0031] For the first layer of the graph convolutional neural network (GCN), the new h-dimensional node features are obtained:

[0032]

[0033] in, Let W0 be the normalized symmetric adjacency matrix, W0 be the weight matrix, and ρ be the activation function. This is the output layer.

[0034] The training message graph feature extraction neural network model Mess-GCN is specifically as follows:

[0035] Step 3.1: For the heterogeneous message graph G, input it into Mess-GCN and output the K-dimensional feature vectors corresponding to all message nodes. The feature vectors of message fragment nodes are not included in the calculation of the next step;

[0036] Step 3.2: Perform message clustering. As input to the message clustering stage, the loss of the Mess-GCN model is calculated, and its loss function is as follows:

[0037]

[0038] Where g(x) i ,x j w) represents sample x i ,x j Category features l i ,l j The similarity between them is calculated using cosine similarity as the metric; r ij It is an unknown binary variable; when r ij When = 1, it indicates message x i ,x j If they belong to the same type, then r ij =0; L(r) ij ,g(x i ,x j ;w)) is r ij With g(x) i ,x j The loss between ;w) and , where w represents the model parameters of Messi-GCN; r ij The value selection strategy is as follows:

[0039]

[0040] In the formula, λ is the hyperparameter of the Messi-GCN model, used to control sample selection; μ(λ) and η(λ) are the thresholds for selecting similar samples and selecting dissimilar samples, respectively, and satisfy the constraint μ(λ) ≥ η(λ); when g(x i ,x j When w)>μ(λ), the two samples x i ,x j Similar; when g(x) i ,x jWhen w) ≤ η(λ), the two samples are dissimilar; when r ij When it is None, it represents the current sample (x) i ,x j ,r ij (did not participate in the training of the Mess-GCN model;)

[0041] Step 3.3: Update the weight matrix parameters of the Mess-GCN model. The iteration rule for λ is as follows:

[0042]

[0043]

[0044] Where η is the learning rate of λ;

[0045] Step 3.4: Repeat steps 3.1-3.3 until the Messi-GCN model reaches the maximum number of training rounds.

[0046] The clustering process specifically involves outputting a category label corresponding to each message, thereby dividing all messages into different clusters based on the label. The category allocation method is as follows:

[0047]

[0048] Among them, t i The cluster to which the current sample belongs is represented by h, and the category feature l is l. i The subscript of an element.

[0049] The specific steps of the Needleman-Wunsch algorithm are as follows:

[0050] Step 4.1: For any two packets under the current cluster, with lengths β1 and β2 respectively, construct a matrix of size (β1+1)×(β2+1) and initialize the elements to 0;

[0051] Step 4.2: Determine whether each character in the two message sequences is the same, score them according to the scoring rules, and fill the score matrix. The scoring rules are as follows:

[0052]

[0053] Where S ij , w represents the reward score for character matching and the penalty score for spaces, respectively;

[0054] Step 4.3: Traverse the path from the bottom right corner to the top left corner of the score matrix to construct the aligned sequence;

[0055] Step 4.4: Repeat steps 4.1-4.3 until all message sequences in the test message dataset are aligned, using spaces as delimiters, to obtain the boundary division of the protocol fields.

[0056] An unknown industrial control protocol reverse analysis device, comprising:

[0057] The network module is used to capture network traffic data;

[0058] Memory, used to store captured network traffic data and computer programs;

[0059] A processor is configured to execute a computer program stored in the memory, wherein, when the computer program is executed, the processor is configured to:

[0060] Obtain the message sequence data to be analyzed, wherein the message sequence data refers to network traffic data containing only application layer protocols; segment the message sequence data to form a set of message fragments; and construct a heterogeneous message graph based on the message sequence data and message fragments.

[0061] The constructed message graph is input into the Mess-GCN neural network model for graph feature extraction. The adjacency relationships between nodes are extracted, and feature vectors of the nodes are generated. Based on the generated feature vectors, clustering is performed, and the loss function of the Mess-GCN neural network model is trained. Finally, the category to which the data belongs is determined, and clustering is performed. Under the same message cluster, the Needleman-Wunsch algorithm is used to infer the syntax format and mark the field boundaries.

[0062] The beneficial effects of this invention: Addressing the characteristics of industrial control protocols, such as periodicity, chaotic and abstract network packet content, and difficulty in extracting feature patterns, this invention proposes a reverse analysis method for unknown industrial control protocols, applicable to industrial control systems. The key points mainly include the following three aspects:

[0063] (1) Unlike traditional methods that focus on message sequence features, this invention proposes for the first time the idea that there are graph structure features inside ICPs messages, and designs a message graph feature extraction model Mess-GCN based on this. It uses graph neural networks to jointly learn the embedding of fields and low-dimensional features of messages, thereby reducing the time complexity of message clustering.

[0064] (2) Feature extraction and clustering are jointly optimized by utilizing the "feedback" information between subtasks that are neglected in the traditional sequential analysis process. Based on similarity measurement, the clustering problem is transformed into a classification problem by judging whether message sequence pairs belong to the same message type, and then jointly optimized with latent representation learning.

[0065] (3) Considering that some fields of the industrial control protocol consist of only a few bits, a heuristic message segmentation algorithm is proposed to provide the model with a finer-grained and more reasonable analysis unit. Attached Figure Description

[0066] Figure 1 Flowchart of a reverse engineering method for an unknown industrial control protocol;

[0067] Figure 2 A schematic diagram of a neural network model for message graph feature extraction;

[0068] Figure 3 This is a schematic diagram of a reverse engineering device for an unknown industrial control protocol. Detailed Implementation

[0069] The specific embodiments of the present invention will be described in further detail below with reference to the accompanying drawings and examples.

[0070] This embodiment uses four publicly available industrial network traffic datasets from different industrial scenarios to comprehensively evaluate the method proposed in this invention. The protocol types are Modbus / TCP, DNP3.0, S7Comm, and EthernetIP / CIP, respectively. Each type of network traffic dataset contains more than 10 types of industrial control commands, with more than 1,000 messages. The specific data distribution is shown in Table 1.

[0071] Table 1. Industrial Control System Protocol Network Traffic Data

[0072]

[0073] For each type of network traffic dataset, Wireshark was used for deduplication and parsing to determine the true protocol field segmentation facts, which were then used to evaluate the accuracy of the proposed method. Furthermore, 80% of the data was used for training and 20% for testing.

[0074] A reverse engineering method for unknown protocols in industrial control networks, the algorithm steps are as follows:

[0075] Step 1: Network packets are segmented into a set of packet fragments based on a heuristic packet segmentation algorithm. The specific steps are as follows:

[0076] Step 1.1 Extract the application layer data of the network packets to obtain the packet sequence in hexadecimal format.

[0077] Step 1.2 Based on heuristic rules, perform preliminary field inference on all message sequences to obtain common fields.

[0078] Some of the heuristic rules are as follows:

[0079] a) Identifying the protocol identifier field: Given that the content, length, and position of the protocol identifier field are fixed, the protocol identifier field can be identified by judging whether the first 4 bytes of multiple message sequences are the same.

[0080] b) Identifying the length field: First, divide the messages into different groups based on their length. Then, within the same group of messages, determine whether the values ​​of 2 or 4 consecutive bytes at the same position are the same. If the same value exists at the same position within the same group of messages, but different values ​​exist at the same position between different groups of messages, and this value happens to be the length of the message corresponding to that group, then these 2 or 4 consecutive bytes can be identified as the length field.

[0081] Step 1.3 performs positional encoding on the remaining part of the message sequence and uses 4-grams to obtain a series of message subsequence fragments. For example, the original hexadecimal message sequence is:

[0082] 54 32 00 4e

[0083] After encoding the location information, the sequence is obtained as: 054, 132, 200, 34e. When n is 4, that is, using 4-gram, the following fragment will be generated: 5432, 4320, 3200, 2004, 004e.

[0084] Step 1.4 Perform deduplication on the common fields and message sub-fragments to form a message fragment set and obtain the set size v.

[0085] Step 2: The set of messages and message fragments constitutes a dataset. Based on the dataset, a heterogeneous message graph G(V,E) is constructed:

[0086] Step 2.1 Treat each message and each fragment as a node (the number of nodes |V| = n, which is the number of messages plus the number of fragments). Establish edges between nodes based on whether the fragment appears in the message. Use the Term Frequency-Inverse Text Frequency Index (TF-IDF) as the weight value for message-fragment edges and Point Mutual Information (PMI) as the weight for fragment-fragment edges. The specific process is as follows:

[0087]

[0088]

[0089]

[0090] Where #W(s) is the number of sliding windows containing fragment s (the sliding window size is 15), #W(s,t) is the number of sliding windows containing both fragments s and t, and #W refers to the total number of sliding windows across the entire message set. In summary, the edge weights are calculated as follows:

[0091]

[0092] Where A represents the adjacency matrix of graph G.

[0093] After completing the graph construction in step 2.2, initialize the feature vector of each node with a v-dimensional one-hot vector. Then, the features of all nodes can be represented as a matrix.

[0094] Step 3: Input the heterogeneous message graph G(V,E) into the Mess-GCN neural network model for message graph feature extraction, perform message clustering, and train the Mess-GCN neural network model. The structure of the Mess-GCN neural network model is as follows: Figure 3 As shown. The specific steps include:

[0095] Step 3.1 For the input data graph G, input it into a multi-layer neural network GCN to capture the feature information of neighboring nodes. For a single-layer GCN, the calculation method for obtaining the new h-dimensional node features is as follows:

[0096]

[0097] in Let W0 be the weight matrix, and ρ be the activation function, such as the ReLU function ρ(x) = max(0,x). This is the output layer. To capture information from higher-level adjacent nodes, this invention constructs a two-layer GCN neural network, where the node embedding dimension of the first layer is 64, and the node embedding dimension of the second layer is the number of message categories k. Normalization is performed using the softmax function to generate the category features for each message sequence.

[0098]

[0099] Step 3.2 performs message clustering, and... As input to the message clustering stage, its loss function is as follows:

[0100]

[0101] Where g(x) i ,x j w) represents sample x i ,x j Category features (i.e., l) i ,l j For calculating the similarity between r, this invention chooses cosine similarity. ij It is an unknown binary variable. When r ij When = 1, it indicates message x i ,xj If they belong to the same type, then r ij =0. L(r) ij ,g(x i ,x j ;w)) is r ij With g(x) i ,x j The loss between r and w), where w represents the model parameters. ij The value selection strategy is as follows:

[0102]

[0103] In the formula, λ is the hyperparameter of the Messi-GCN model, used to control sample selection. μ(λ) and η(λ) are the thresholds for selecting similar and dissimilar samples, respectively, satisfying the constraint μ(λ) ≥ η(λ), and take values ​​of 0.99 and 0.95, respectively. When r ij When it is None, it represents the current sample (x) i ,x j ,r ij It did not participate in the training of the model.

[0104] Step 3.3 Update the model weight matrix parameters. The iteration rule for λ is as follows:

[0105]

[0106]

[0107] Where η = 0.01 is the learning rate of λ.

[0108] Step 3.4 Repeat steps 3.1-3.3 until the model reaches the maximum number of training rounds of 400.

[0109] Step 3.5 outputs the category label corresponding to each message sequence, thereby dividing the message set into different clusters. The category allocation method is as follows:

[0110]

[0111] Where t i The cluster to which the current sample belongs is represented by h, and the category feature l is l. i The subscript of an element.

[0112] Step 4: Obtain the clustering of test data by loading the model weight matrix parameters. Then, under the same message cluster, use the Needleman-Wunsch algorithm to infer the syntax format and mark the field boundaries. The specific steps of the Needleman-Wunsch algorithm are as follows:

[0113] Step 4.1 Taking two messages under the current cluster as an example, assuming their lengths are n and m respectively, a matrix of size (n+1)×(m+1) is created, and the elements are initialized to 0.

[0114] Step 4.2 Determine whether each character in the two message sequences is the same, score them according to the scoring rules, and fill the score matrix. The scoring rules are as follows:

[0115]

[0116] Where S ij ,w represent the reward score for character matching and the penalty score for spaces, respectively.

[0117] Step 4.3 Traverse the path from the bottom right corner to the top left corner of the score matrix to construct the aligned sequence.

[0118] Step 4.4 Repeat steps 4.1-4.3 until all message sequences in the test message dataset are aligned, using spaces as delimiters, to obtain the boundary division of the protocol fields.

[0119] To verify the effectiveness of the framework proposed in this invention, a series of experiments were conducted to compare the format inference results of the system model with two protocol reverse analysis methods, including the more classic Netzob and the more advanced NetPlier, on datasets of various protocol types.

[0120] Each time we train and analyze a protocol, we use 80% of the data for training and 20% for testing. Specifically, we first construct a heterogeneous message graph (containing message nodes and field nodes) for the entire dataset and generate corresponding training and test set masks. Then, we train the model using the training data, load the model, input the test data, and obtain the type label for each message in the test set. Based on this, we divide the message set into different clusters. Finally, under each cluster, we use a sequence alignment algorithm to obtain the field boundaries of each message sequence. This invention uses accuracy (ACC), adjusted RAND index (ARI), and normalized mutual information (NMI) as evaluation metrics for the message clustering stage, and correctness (Corr.) and perfection (Perf.) as evaluation metrics for protocol field boundary partitioning. Experimental results are shown in Tables 2 and 3.

[0121] Table 2 Message Clustering Results

[0122]

[0123] Table 3. Results of Industrial Control Protocol Format Inference

[0124]

[0125] In message clustering, this invention extracts the graph structure features existing within individual messages and performs joint learning with the clustering stage, achieving better latent layer representations of messages and superior clustering results. Compared to the traditional method of manually extracting message features and performing message clustering in a multi-step pipeline, the clustering model proposed in this invention outperforms the baseline model overall. This is because the protocol specifications of Modbus and DNP3.0 are much simpler than those of S7Comm and EthernetIP / CIP, resulting in less rich internal structural features. The model proposed in this invention primarily focuses on the structural features within individual messages. Therefore, while some clustering metrics on the Modbus and DNP3.0 datasets may be lower, the overall performance is still superior to the baseline method. Particularly on the S7Comm and EthernetIP / CIP datasets, all metrics show at least a 15% improvement. Furthermore, to demonstrate the advantages of this invention in changing the processing flow, we train the feature extraction and clustering processes separately and analyze them in a pipeline manner across various protocols, i.e., the comparison method Pipeline. It can be observed that it is weaker than the present invention in all indicators, but its overall performance is still better than the baseline method.

[0126] To demonstrate the advantages of the clustering method in this invention, we further infer the protocol format based on the obtained clustering results. As shown in Table 3, this invention outperforms the baseline method. Similar to the clustering results, some metrics are lower on the Modbus and DNP3.0 datasets, while all metrics are improved on the S7Comm and EthernetIP / CIP datasets. Due to the inherent limitations of protocol reverse engineering techniques based on network packets, all methods show lower performance on the Perf. metric.

[0127] Based on the above observations, the graph structure features and subtask joint optimization analysis methods considered in this invention, as well as the proposed message graph feature extraction model and progressive message clustering model, all play a positive role in the final protocol reverse analysis results, enabling the protocol format inference accuracy to reach up to 77.12% under various datasets.

[0128] The above preferred embodiments are only for illustrating the technical concept and features of the present invention, and are intended to enable those skilled in the art to understand the content of the present invention and implement it. They should not be used to limit the scope of protection of the present invention. All equivalent changes or modifications made in accordance with the essence of the present invention shall fall within the scope of protection of the present invention.

Claims

1. A method for reverse engineering an unknown industrial control protocol, characterized in that, The steps include the following: Network packets are segmented into a set of packet fragments based on a heuristic packet segmentation algorithm; the packets and the set of packet fragments constitute a dataset, and a heterogeneous packet graph is constructed based on the dataset. Heterogeneous message diagram The data is input into the Mess-GCN neural network model for message graph feature extraction, which is then used to cluster messages and train the Mess-GCN model. The dataset to be clustered is input into the trained Mess-GCN model for clustering. Within the same message cluster, the Needleman-Wunsch algorithm is used to infer the syntax format and mark the field boundaries. The network packets are formed into a set of packet fragments based on a heuristic packet segmentation algorithm, specifically as follows: Step 1.1: Extract the application layer data of the network packets to obtain the packet sequence in hexadecimal format. The packet sequence contains a total of Types; Step 1.2: Based on heuristic rules, perform field inference on all message sequences to obtain common fields; the common fields include protocol identifier and length field; Step 1.3: Perform positional encoding on the remaining part of the message sequence after removing the common fields and use n-gram to obtain multiple message fragments; Step 1.4: Perform deduplication on common fields and message fragments to form a message fragment set; The construction of heterogeneous message graphs Specifically, Step 2.1: Treat each message and each message fragment as a graph node, with the number of nodes... The sum of the number of messages and the number of message fragments is calculated. Between nodes, edges are established when a message fragment appears in a message. The Term Frequency-Inverse Text Frequency Index (TF-IDF) is used as the weight value for message-fragment edges, and Point Mutual Information (PMI) is used as the weight for fragment-fragment edges. The specific process is as follows: in, It contains message fragments The number of sliding windows, It contains message fragments at the same time. and message fragments The number of sliding windows, This refers to the number of sliding windows across the entire set of message segments; The edge weights are calculated as follows: in, Representing heterogeneous message diagrams The adjacency matrix contains the calculated edge weights. Represents a graph node; when When nodes of the same message fragment type have a positive mutual information (PMI) value, the weight of the edge formed between them is the PMI value; when When the nodes are of different types, the value obtained by TF-IDF calculation is used as the weight value of the edge formed between them; when When the edges are the same node, the weight of the edge is 1; when there are edges that do not satisfy the above conditions, the weight of the edge is 0. Step 2.2, using If each node's feature vector is initialized with a one-hot vector, then the feature representation of all nodes is a matrix. Generate heterogeneous message graphs; The message graph feature extraction neural network model Mess-GCN consists of a two-layer graph convolutional neural network (GCN). The size of the node embedding in the second layer of the graph convolutional neural network is related to the number of message types. Similarly, the data is normalized using the softmax function to generate the category features for each message node: For the first layer of the graph convolutional neural network (GCN), we obtain a new... Dimensional node features: in, Represents a normalized symmetric adjacency matrix. It is a weight matrix. This represents the activation function. For output layer; The training message graph feature extraction neural network model Mess-GCN is specifically as follows: Step 3.1, for heterogeneous message graphs Input it into Mess-GCN, and it will output the corresponding message nodes. 3D feature vector The feature vectors of message fragment nodes are not included in the calculation of the next step; Step 3.2: Perform message clustering. As input to the message clustering stage, the loss of the Mess-GCN model is calculated, and its loss function is as follows: in Representative sample Category features The similarity between them is calculated using cosine similarity as the metric. It is an unknown binary variable; when When, it indicates a message They belong to the same type, otherwise they are... ; for and The losses between This represents the model parameters of Messi-GCN; The value selection strategy is as follows: In the formula These are the hyperparameters of the Messi-GCN model, used to control sample selection; and These are the thresholds for selecting similar samples and the threshold for selecting dissimilar samples, respectively, while satisfying the constraints. ;when At that time, two samples Similar; when When, the two samples are dissimilar; when When it is None, it represents the current sample. Not involved in the training of the Mess-GCN model; Step 3.3: Update the weight matrix parameters of the Mess-GCN model. The iteration rules are as follows: in, for The learning rate; Step 3.4: Repeat steps 3.1-3.3 until the Messi-GCN model reaches the maximum number of training rounds.

2. The method for reverse analysis of unknown industrial control protocols according to claim 1, characterized in that, The heuristic rules are as follows: Rule a) Identify the protocol identifier field: the first part of a multiple message sequence The character content of each byte is the same, the first The character content of 1 byte is the protocol identifier field; Rule b) Identify the length field: Divide the message sequence into different groups based on the length, and determine consecutive messages at the same position within the same group. The value of 1 byte Are they the same? Do they have the same value at the same position within the same group of messages? However, different groups of messages have different values ​​at the same location. ,and When the length of the message corresponding to this group is [length], this contiguous [group] will be [length]. Each byte is identified as a length field.

3. The method for reverse analysis of unknown industrial control protocols according to claim 1, characterized in that, The specific operation process of step 1.3 is as follows: concatenate the position number of each byte in the original message sequence with the character content of the corresponding byte, and use a sliding window of size n to slide and select values ​​from left to right in the original message sequence.

4. The method for reverse analysis of unknown industrial control protocols according to claim 1, characterized in that, The clustering process specifically involves outputting a category label corresponding to each message, thereby dividing all messages into different clusters based on the label. The category allocation method is as follows: in, This represents the cluster to which the current sample belongs. Category features The subscript of an element.

5. The method for reverse analysis of unknown industrial control protocols according to claim 4, characterized in that, The specific steps of the Needleman-Wunsch algorithm are as follows: Step 4.1: For any two messages under the current cluster, their lengths are respectively Then create a size of The matrix is ​​initialized to 0 for each element. Step 4.2: Determine whether each character in the two message sequences is the same, score them according to the scoring rules, and fill the score matrix. The scoring rules are as follows: in These represent the reward and penalty scores for matching characters, respectively; Step 4.3: Traverse the path from the bottom right corner to the top left corner of the score matrix to construct the aligned sequence; Step 4.4: Repeat steps 4.1-4.3 until all message sequences in the test message dataset are aligned, using spaces as delimiters, to obtain the boundary division of the protocol fields.

6. An unknown industrial control protocol reverse analysis device, used to execute the unknown industrial control protocol reverse analysis method according to any one of claims 1 to 5, characterized in that, include: The network module is used to capture network traffic data; Memory, used to store captured network traffic data and computer programs; A processor, configured to execute a computer program stored in the memory, when the computer program is... During execution, the processor is used to: Obtain the message sequence data to be analyzed, wherein the message sequence data refers to network traffic data containing only application layer protocols; segment the message sequence data to form a message fragment set, and construct a heterogeneous message graph based on the message sequence data and message fragments; The constructed message graph is input into the Mess-GCN neural network model for graph feature extraction. The adjacency relationships between nodes are extracted, and feature vectors of the nodes are generated. Based on the generated feature vectors, clustering is performed, and the loss function of the Mess-GCN neural network model is trained. Finally, the category to which the data belongs is determined, and clustering is performed. Under the same message cluster, the Needleman-Wunsch algorithm is used to infer the syntax format and mark the field boundaries.

Images