An industrial network encrypted traffic application identification method

Abstract

The application discloses an industrial network encrypted traffic application identification method, which is applied to the field of industrial network information security and directly determines the application of industrial network traffic conforming to a point-to-point mode by adopting clustering and time-dependent graph methods to classify, determine and analyze the industrial network encrypted traffic based on the features extracted from the industrial network encrypted traffic and by using a feature library matching method to determine the application of the industrial network traffic of a non-point-to-point mode. The method can identify the similar communication modes between the industrial network encrypted traffic, help to automatically find the communication clusters in the industrial network, better understand the protocol diversity and the change of the communication mode, and divide the encrypted industrial network traffic into applications, thereby facilitating the network administrator to optimize the allocation of network resources and ensure the performance of key applications.

Description

Technical Field

[0001] This invention relates to the field of industrial network information security, and in particular to a method, apparatus, device, and medium for identifying encrypted traffic applications in industrial networks. Background Technology

[0002] The encrypted traffic captured by traffic acquisition devices in industrial networks is complex, potentially employing multiple protocols, including custom ones. This protocol diversity can render traditional protocol analysis tools ineffective in accurately identifying and parsing the purpose and content of communications. Furthermore, industrial networks may involve point-to-point communication between different devices and users, with communication patterns frequently changing based on network usage and needs. Traditional traffic pattern analysis methods cannot adapt to these changes in a timely manner. Industrial software often employs encrypted applications at the office network level, requiring further identification and analysis of these applications.

[0003] Therefore, given the diverse protocols and varied communication modes of industrial networks, an effective application identification method is needed to identify the applications of encrypted traffic in industrial networks. Summary of the Invention

[0004] In view of this, the purpose of the present invention is to provide a method, apparatus, device and medium for identifying applications of encrypted traffic in industrial networks, which solves the problem of difficulty in identifying applications caused by the diversity of protocols and the variability of communication modes in encrypted traffic of industrial networks in the prior art.

[0005] To address the aforementioned technical problems, this invention provides a method for identifying encrypted traffic applications in industrial networks, comprising: Collect encrypted traffic from an industrial network over a period of time to obtain a network flow dataset; Feature extraction is performed on all the encrypted traffic of the industrial network in the network flow dataset to obtain the traffic features of each encrypted traffic of the industrial network; Based on the traffic characteristics, a clustering algorithm is used to cluster all the encrypted traffic of the industrial network to obtain various clusters. A time dependency graph is created for each of the clusters to obtain time dependency graph parameters, and a metric value for each of the clusters is calculated based on the time dependency graph parameters. Based on the metric value, determine whether each cluster conforms to the point-to-point pattern; Industrial network encrypted traffic in clusters that conform to the described peer-to-peer pattern is identified as peer-to-peer pattern applications. The metric values ​​of clusters that do not conform to the peer-to-peer pattern are matched with the application feature library to determine the application corresponding to the encrypted traffic of the industrial network in the clusters that do not conform to the peer-to-peer pattern.

[0006] Optionally, before performing feature extraction on all the encrypted traffic of the industrial network in the network flow dataset, the method further includes: Port analysis is performed on all the encrypted traffic of the industrial network. Based on the port information obtained from the analysis, the encrypted traffic of the industrial network for non-encrypted traditional applications is filtered to obtain the filtered encrypted traffic of the industrial network. Accordingly, the feature extraction of all the encrypted industrial network traffic in the network flow dataset includes: Feature extraction is performed on the filtered encrypted traffic from the industrial network.

[0007] Optionally, the step of extracting features from all the encrypted traffic of the industrial network in the network flow dataset to obtain the traffic features of each encrypted traffic of the industrial network includes: Five-tuple analysis is performed on the encrypted traffic of the industrial network to obtain the network node relationship characteristics. The five-tuple consists of the source IP, destination IP, source port, destination port, and transport layer protocol. Extract statistical features of the encrypted traffic of the industrial network; the statistical features include general traffic features, features related to packet size, features of packet size and byte rate, features of packet arrival time interval, features related to packet header, features related to packet payload, and traffic state features.

[0008] Optionally, based on the traffic characteristics, the step of clustering all the encrypted traffic of the industrial network using a clustering algorithm to obtain various clusters includes: Based on the traffic characteristics, the encrypted traffic of industrial networks that reaches a preset similarity threshold is clustered into a cluster using a density clustering algorithm to obtain each cluster; wherein, the similarity is calculated using the Euclidean algorithm.

[0009] Optionally, before creating a time dependency graph for each of the clusters, obtaining time dependency graph parameters, and calculating the metric value of each of the clusters based on the time dependency graph parameters, the method further includes: Steps for calculating the IP ratio: Calculate the number of identical IPs in any two clusters and the total number of IPs in the two clusters, and calculate the ratio of the number of identical IPs to the total number of IPs; Merging step: If the ratio is greater than a preset threshold, the two clusters are merged; The steps of calculating the IP ratio and merging are repeated until no further merging is possible, at which point the cluster merging ends, resulting in each merged large cluster. Accordingly, the step of creating a time dependency graph for each cluster, obtaining time dependency graph parameters, and calculating the metric value for each cluster based on the time dependency graph parameters includes: A time dependency graph is created for each of the large clusters to obtain time dependency graph parameters, and the metric value of each of the large clusters is calculated based on the time dependency graph parameters.

[0010] Optionally, the step of creating a time dependency graph for each of the clusters, obtaining time dependency graph parameters, and calculating the metric value for each of the clusters based on the time dependency graph parameters includes: A time dependency graph is created for each of the clusters to obtain the time dependency graph parameters corresponding to each cluster, and the metric value is calculated based on the time dependency graph parameters. The time dependency graph parameters include the behavioral features generated by constructing the time dependency graph, the percentage of nodes with in-degree and out-degree to the total number of nodes, the network diameter, and the average degree of nodes.

[0011] Optionally, the step of matching the metric values ​​of clusters that do not conform to the peer-to-peer pattern with the application feature library to determine the application corresponding to the encrypted traffic of the industrial network in the clusters that do not conform to the peer-to-peer pattern includes: The metric values ​​of the clusters that do not conform to the peer-to-peer pattern are matched with the static feature library and the dynamic feature library to determine the applications corresponding to the encrypted traffic of industrial networks in the clusters that do not conform to the peer-to-peer pattern. The static feature library includes common encrypted traffic patterns, behavioral characteristics, known normal operation data and potential threat indicators of industrial networks that are collected and compiled. The dynamic feature library includes a feature library that is dynamically updated according to real-time network monitoring and the latest security events.

[0012] The present invention also provides an industrial network encrypted traffic application identification device, comprising: The acquisition module is used to collect encrypted industrial network traffic over a period of time to obtain a network flow dataset. The feature extraction module is used to extract features from all the encrypted traffic of the industrial network in the network flow dataset to obtain the traffic features of each encrypted traffic of the industrial network. The clustering module is used to cluster all the encrypted traffic of the industrial network based on the traffic characteristics using a clustering algorithm to obtain various clusters; The metric calculation module is used to create a time dependency graph for each of the clusters, obtain time dependency graph parameters, and calculate the metric value of each of the clusters based on the time dependency graph parameters. The point-to-point pattern determination module is used to determine whether each cluster conforms to the point-to-point pattern based on the metric value. The peer-to-peer mode determination module is used to determine the encrypted traffic of industrial networks in clusters that conform to the peer-to-peer mode as peer-to-peer mode applications. The matching and determination module is used to match the metric values ​​of clusters that do not conform to the peer-to-peer pattern with the application feature library to determine the application corresponding to the encrypted traffic of the industrial network in the clusters that do not conform to the peer-to-peer pattern.

[0013] The present invention also provides an industrial network encrypted traffic application identification device, comprising: Memory, used to store computer programs; A processor is used to implement the steps of the above-described industrial network encrypted traffic application identification method when executing the computer program.

[0014] The present invention also provides a medium storing computer-executable instructions, which, when loaded and executed by a processor, implement the steps of the above-described industrial network encrypted traffic application identification method.

[0015] As can be seen, this invention collects and extracts features from encrypted traffic in industrial networks. Based on the extracted features, it uses clustering and time dependence graph (TDG) methods to classify and analyze the encrypted traffic, thereby identifying similar communication patterns among encrypted traffic flows. This helps to automatically discover communication clusters in industrial networks, leading to a better understanding of protocol diversity and communication pattern variations. It directly identifies the applications to which industrial network traffic conforming to point-to-point patterns belongs, and uses feature library matching methods to determine the applications to which industrial network traffic conforming to non-point-to-point patterns belongs. This method can classify encrypted industrial network traffic by application, facilitating network administrators to optimize network resource allocation, ensuring the performance of critical applications, enabling regulatory agencies to monitor enterprise demand for industrial network traffic, identifying and analyzing the actual operating status of industrial networks, providing a foundation for advanced data analysis applications such as industrial user behavior analysis and network usage pattern analysis, and serving as an early indicator for network anomalies, aiding in the timely detection and response to network intrusions or system failures.

[0016] In addition, the present invention also provides an industrial network encrypted traffic application identification device, equipment and medium, which also have the above-mentioned beneficial effects. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0018] Figure 1 A flowchart illustrating an industrial network encrypted traffic application identification method provided in this embodiment of the invention; Figure 2 A schematic diagram of the structure of an industrial network encrypted traffic application identification device provided in an embodiment of the present invention; Figure 3 This is a schematic diagram of the structure of an industrial network encrypted traffic application identification device provided in an embodiment of the present invention. Detailed Implementation

[0019] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0020] Please refer to Figure 1 , Figure 1 A flowchart illustrating an industrial network encrypted traffic application identification method provided in an embodiment of the present invention. The method may include: S101: Collect encrypted traffic from industrial networks over a period of time to obtain a network flow dataset.

[0021] This embodiment performs high-speed collection of real-time traffic on the link, and can collect encrypted traffic of industrial networks for a period of time at a time. For example, it can collect encrypted traffic of industrial networks in the last minute; or it can collect encrypted traffic of industrial networks in the last hour.

[0022] Furthermore, to better identify the application to which encrypted traffic belongs in an industrial network, the following steps may be included after step S101 and before step S102: Perform port analysis on all encrypted traffic in the industrial network, and filter the encrypted traffic of unencrypted traditional applications in the industrial network based on the port information obtained from the analysis to obtain the filtered encrypted traffic in the industrial network. Accordingly, feature extraction is performed on all encrypted traffic from industrial networks in the network flow dataset, including: Feature extraction is performed on the filtered encrypted traffic from the industrial network.

[0023] Specifically, considering that port-based methods are effective at identifying certain unencrypted traditional applications, port-based identification methods are applied to filter out identifiable applications such as the Web (World Wide Web), DNS (Domain Name System), and SMTP (Simple Mail Transfer Protocol). This not only reduces interference from other background traffic but also lowers the time and space complexity of subsequent steps. Specifically, after collecting encrypted traffic from the industrial network, conventional packet analysis, i.e., port analysis, is performed first. This includes examining the protocol header to understand the protocol version, source and destination ports, flags, etc. By observing the port information, encrypted traffic from unencrypted traditional industrial network applications is filtered out.

[0024] S102: Extract features from all encrypted traffic of industrial networks in the network flow dataset to obtain the traffic features of encrypted traffic of each industrial network.

[0025] The purpose of this step is to extract features from encrypted traffic on industrial networks. This embodiment does not limit the extracted features, as long as they are categorical features that can be identified by the application. For example, they can be statistical features; or they can be other features.

[0026] Furthermore, to improve the accuracy of traffic clustering, feature extraction is performed on all encrypted traffic from industrial networks in the network flow dataset to obtain the traffic features of each encrypted traffic from industrial networks. This may include the following steps: Step 21: Perform quintuple analysis on the encrypted traffic of the industrial network to obtain the network node relationship characteristics. The quintuple consists of the source IP, destination IP, source port, destination port, and transport layer protocol. Step 22: Extract statistical features of encrypted traffic in industrial networks; statistical features include general traffic features, features related to packet size, features of packet size and byte rate, features of packet arrival time intervals, features related to packet headers, features related to packet payloads, and traffic state features.

[0027] Step 21 aims to extract the node relationship characteristics of encrypted traffic in the industrial network. It uses a five-tuple (source IP (Internet Protocol), destination IP, source port, destination port, transport layer protocol) to define network flows, using bidirectional flows within a certain time period as the basic unit. The direction of the TCP (Transmission Control Protocol) flow is defined by taking the sender of the first data packet as the source and the receiver as the destination. The direction of the UDP (User Datagram Protocol) flow is defined by taking the sender of the first data packet in the same five-tuple flow as the source and the receiver as the destination. Step 22 aims to extract statistical characteristics of the encrypted traffic in the industrial network, which may include: (1) General characteristics of traffic (5): duration of the entire flow, i.e. the interval between the first and last packets, total number of forward / backward messages, and total number of bytes sent; (2) Relevant characteristics of packet size (14): minimum, maximum, average, standard deviation and variance of packet size; minimum, maximum, average and standard deviation of forward / backward packet size; byte ratio of backward message to forward message. (3) Characteristics of data packets and byte rate (4): byte rate, calculated as the total number of bytes divided by the duration; packet rate, i.e., the total number of packets divided by the duration; forwarding packet rate; and lagging packet rate. (4) Characteristics of data packet arrival time intervals (14): minimum, maximum, average and standard deviation of data packet arrival intervals, minimum, maximum, average and standard deviation of backward / forward data packet arrival intervals, and the sum of all backward / forward arrival intervals. (5) Related features of the packet header (14): the number of TCP packets containing PSH / URG flags in the forward / backward messages, the total number of packets containing FIN / SYN / RST / ACK / CWR flags in the TCP packets, and the number of ECE packets; among them, URG, PSH, FIN, SYN, RST, ACK, CWR and ECE are all flags in the TCP header; (6) Relevant characteristics of packet payload (11): average payload size of all flow packets, average payload size of forward / backward messages, average number of packets and average number of bytes in burst traffic in almost consecutive forward / backward packets, number of bytes in the initial burst traffic of forward / backward packets, number of backward packets with payload, and minimum payload size of backward packets. (7) Status characteristics of flow (8): minimum, maximum, average and standard deviation of active and idle time.

[0028] S103: Based on traffic characteristics, clustering algorithms are used to cluster all encrypted traffic of industrial networks to obtain various clusters.

[0029] After feature extraction in step 102, clustering algorithms are used to cluster the industrial network traffic. This embodiment does not limit the clustering algorithm. For example, it can be the K-Means (K-Nearest Neighbors) algorithm; or it can be a density-based clustering algorithm, such as DBSCAN (Density-Based Spatial Clustering of Applications with Noise).

[0030] Furthermore, to improve the accuracy of clustering, based on traffic characteristics, a clustering algorithm is used to cluster all encrypted traffic from the industrial network to obtain various clusters. This may include the following steps: Based on traffic characteristics, density clustering algorithm is used to cluster encrypted traffic of industrial networks that reaches a preset similarity threshold into a cluster, resulting in various clusters; wherein, the similarity is calculated using the Euclidean algorithm.

[0031] This embodiment employs a density-based clustering algorithm, such as the DBSCAN clustering algorithm, to cluster network flows with similar statistical characteristics. The distance calculation algorithm can be the Euclidean algorithm, which calculates the similarity in the feature space.

[0032] Furthermore, to improve the accuracy of clustering, based on traffic characteristics, a clustering algorithm is used to cluster all encrypted traffic from the industrial network, resulting in various clusters, including: Step 1: Define a scanning radius for the first target traffic in the network flow dataset. Centered on the first target traffic, the industrial network traffic within the scanning radius is taken as the first traffic set. Calculate the number of encrypted industrial network traffic in the first traffic set to obtain the number of first traffic items. The first target traffic is each encrypted industrial network traffic that has not undergone clustering. Step 2: If the number of first traffic flows is greater than the minimum number of flows threshold, a new cluster is created, and the encrypted industrial network traffic in the first traffic flow set is added to the new cluster; Step 3: Centered on the second target traffic, the industrial network traffic within the scanning radius is taken as the second traffic set, and the number of encrypted industrial network traffic in the second traffic set is calculated to obtain the number of second traffic; the second target traffic is the encrypted traffic of each industrial network in the new cluster; Step 4: If the number of second flows is greater than or equal to the minimum flow threshold, then the industrial network data flows in the second flow set that do not belong to any cluster are added to the new cluster.

[0033] Step 5: Once all industrial encrypted traffic has been added to the corresponding cluster, the clustering process is complete, and the clusters are obtained.

[0034] Specifically, let F represent the network flow dataset, and fi∈F represent the encrypted traffic of each industrial network within it. The detailed steps of the clustering algorithm are as follows: (1) For each unprocessed data stream fi∈F in the network stream dataset F, define its scanning radius (eps) and detect the encrypted industrial network traffic within the range of eps. If the number of such traffic streams is greater than the minimum flow threshold (minPTS), create a new cluster Y and add these encrypted industrial network traffic streams to cluster Y.

[0035] (2) For each industrial network encrypted traffic yj in cluster Y, detect the industrial network encrypted traffic within the range of its eps. If the number of such traffic is greater than or equal to minPTS, then aggregate the industrial network encrypted traffic that is not included in any cluster into cluster Y.

[0036] (3) Repeat step (2) until no new industrial network encrypted traffic is aggregated into cluster Y.

[0037] (4) Based on the identification results, repeat steps (1) to (3) until all industrial network encrypted traffic has been clustered.

[0038] Furthermore, to ensure the accuracy of clustering and to guarantee that industrial networks with the same communication patterns are clustered together, the following steps may be included after step S103 and before step S104: Steps to calculate the IP ratio: Calculate the number of identical IPs in any two clusters and the total number of IPs in the two clusters, and calculate the ratio of the number of identical IPs to the total number of IPs; Merging steps: If the ratio is greater than a preset threshold, the two clusters will be merged. The IP ratio calculation and merging steps are executed repeatedly until no further merging is possible, at which point the cluster merging ends, resulting in each merged large cluster. Accordingly, a time dependency graph is created for each cluster, and time dependency graph parameters are obtained. Based on the time dependency graph parameters, the metric value of each cluster is calculated, including: A time dependency graph is created for each large cluster, and the parameters of the time dependency graph are obtained. The metric value of each large cluster is calculated based on the parameters of the time dependency graph.

[0039] Specifically, based on the above clustering, a further improvement is made by merging the clusters obtained from the above clustering process. The merging is based on the IP similarity between the clusters. The specific operation is as follows: the ratio of the number of identical IPs in any two clusters to the total number of IPs in the two clusters represents the IP similarity between the two clusters. If the similarity reaches a preset threshold, the two clusters are merged. If the IP similarity is difficult to meet the preset threshold, they cannot be merged. IP similarity calculation is performed on all clusters. When clusters can no longer be merged, the merging process ends.

[0040] S104: Create a time dependency graph for each cluster, obtain the time dependency graph parameters, and calculate the metric value of each cluster based on the time dependency graph parameters.

[0041] After clustering is completed in step S103, a time dependency graph is created for each cluster, and its metrics (i.e., time dependency graph parameters) are used for classification to determine the application to which the encrypted traffic of the industrial network belongs in each cluster. The nature of the dependency can be data flow, control flow, or other forms of interaction, and these relationships can change over time. In security analysis, understanding the dependencies between components and how they change over time is crucial; time dependency graphs can be used to assess the system's vulnerabilities in the face of various threats.

[0042] Furthermore, to improve the accuracy of identification, a time dependency graph is created for each cluster to obtain time dependency graph parameters. The metric for each cluster is then calculated based on these parameters, which may include the following steps: A time dependency graph is created for each cluster, and the time dependency graph parameters corresponding to each cluster are obtained. The metric is calculated based on the time dependency graph parameters. The time dependency graph parameters include the behavioral characteristics generated by constructing the time dependency graph, the percentage of nodes with in-degree and out-degree to the total number of nodes, the network diameter, and the average degree of nodes.

[0043] In this embodiment, when creating corresponding time dependency graphs for each cluster, the specific parameters of the time dependency graph are the behavioral characteristics generated by constructing the time dependency graph, the percentage of nodes with in-degree and out-degree relative to the total number of nodes, the network diameter, and the average degree of the nodes. The in-degree and out-degree represent the flow direction of encrypted traffic in the industrial network. The metric values ​​for each cluster are calculated based on the aforementioned time dependency graph parameters.

[0044] S105: Determine whether each cluster conforms to the point-to-point pattern based on the metric value.

[0045] P2P (Peer-to-Peer) technology allows users to exchange data directly with each other, rather than through a central server. This model makes P2P applications such as file sharing and video streaming an important part of industrial network traffic, thus allowing for its identification. P2P traffic characteristics include high-speed transmission, large data volume, long online time, symmetrical uplink and downlink traffic, wide distribution of service points, and fixed traffic features, such as fixed port numbers or keywords. In this embodiment, the metric values ​​of different clusters calculated in step S104 are used. If the metric value meets a set threshold, step S106 is executed, determining that the cluster conforms to the P2P model. The industrial network traffic within this cluster is then labeled and classified, identifying similar communication patterns and determining it as traffic from peer-to-peer applications, i.e., data traffic transmitted point-to-point over the network. Otherwise, step S107 is executed.

[0046] S106: Identify encrypted traffic from industrial networks in clusters that conform to the peer-to-peer pattern as peer-to-peer applications.

[0047] If the data conforms to the peer-to-peer pattern, it indicates that the encrypted traffic of the industrial network in this cluster is determined to be a peer-to-peer application.

[0048] S107: Match the metrics of clusters that do not conform to the peer-to-peer pattern with the application feature library to determine the application corresponding to the encrypted traffic of industrial networks in the clusters that do not conform to the peer-to-peer pattern.

[0049] If the traffic does not conform to the peer-to-peer pattern, it indicates that it is not traffic from a peer-to-peer application and further determination of the application type is required. Specifically, it is matched against the application feature library. Since the clustering metric has been calculated in step S104, the application to which it belongs is determined based on the result of matching the metric with the application feature library.

[0050] Furthermore, to further determine the application, the metrics of clusters that do not conform to the peer-to-peer pattern are matched with the application feature library to identify the applications corresponding to the encrypted industrial network traffic in the clusters that do not conform to the peer-to-peer pattern. This can include the following steps: The similarity of the metrics of clusters that do not conform to the peer-to-peer pattern is matched with the static and dynamic feature libraries to determine the applications corresponding to the encrypted traffic of industrial networks in the clusters that do not conform to the peer-to-peer pattern. The static feature library includes common encrypted traffic patterns, behavioral characteristics, known normal operation data and potential threat indicators of industrial networks that have been collected and compiled. The dynamic feature library includes a feature library that is dynamically updated according to real-time network monitoring and the latest security events.

[0051] Specifically, a static feature library and a dynamic feature library are established. The static feature library collects and compiles common network traffic patterns and behavioral characteristics, including known normal operational data and potential threat indicators. The dynamic feature library is dynamically updated based on real-time network monitoring and recent security incidents. These features reflect the latest network behavior and potential security risks. Metrics obtained from clustering and Time Correlation Graph (TDG) relationship mining are matched and compared with the recorded data in the feature libraries. Matching rules can be formulated, which may include data similarity calculations, such as using Euclidean distance, cosine similarity, etc., to determine the degree of matching between real-time data and application patterns in the feature library. The application with the highest matching degree is identified as the application to which all industrial network encrypted traffic belongs in that cluster.

[0052] The industrial network encrypted traffic application identification method provided in this invention collects and extracts features from industrial network encrypted traffic. Based on the extracted features, clustering and time dependence graph (TDG) methods are used to classify and analyze the industrial network encrypted traffic, thereby identifying similar communication patterns among industrial network encrypted traffic. This helps to automatically discover communication clusters in industrial networks, thus better understanding the diversity of protocols and changes in communication patterns. The method directly determines the application to which industrial network traffic conforming to point-to-point patterns belongs, and uses a feature library matching method to determine the application to which industrial network traffic conforming to non-point-to-point patterns belongs. This method can classify encrypted industrial network traffic by application, facilitating network administrators to optimize network resource allocation, ensure the performance of critical applications, and enable regulatory agencies to monitor enterprise demand for industrial network traffic. It identifies and analyzes the actual operating status of industrial networks, providing a foundation for advanced data analysis applications such as industrial user behavior analysis and network usage pattern analysis. Furthermore, it can serve as an early indicator for network anomalies, aiding in the timely detection and response to network intrusions or system failures.

[0053] The following describes the industrial network encrypted traffic application identification device provided in the embodiments of the present invention. The industrial network encrypted traffic application identification device described below and the industrial network encrypted traffic application identification method described above can be referred to in correspondence with each other.

[0054] Please refer to the details. Figure 2 , Figure 2 A schematic diagram of the structure of an industrial network encrypted traffic application identification device provided in an embodiment of the present invention may include: The acquisition module 100 is used to collect encrypted industrial network traffic over a period of time to obtain a network flow dataset. The feature extraction module 200 is used to extract features from all the encrypted traffic of the industrial network in the network flow dataset to obtain the traffic features of each encrypted traffic of the industrial network. Clustering module 300 is used to cluster all the encrypted traffic of the industrial network based on the traffic characteristics using a clustering algorithm to obtain various clusters; The metric calculation module 400 is used to create a time dependency graph for each of the clusters, obtain time dependency graph parameters, and calculate the metric value of each of the clusters based on the time dependency graph parameters. The peer-to-peer pattern determination module 500 is used to determine whether each cluster conforms to the peer-to-peer pattern based on the metric value. The peer-to-peer pattern determination module 600 is used to determine the encrypted traffic of industrial networks in clusters that conform to the peer-to-peer pattern as peer-to-peer pattern applications. The matching determination module 700 is used to match the metric values ​​of clusters that do not conform to the peer-to-peer pattern with the application feature library to determine the application corresponding to the encrypted traffic of the industrial network in the clusters that do not conform to the peer-to-peer pattern.

[0055] Based on the above embodiments, the industrial network encrypted traffic application identification device may further include: The filtering module is used to perform port analysis on all the encrypted traffic of the industrial network, and filter the encrypted traffic of the industrial network for non-encrypted traditional applications based on the port information obtained from the analysis, so as to obtain the filtered encrypted traffic of the industrial network. Accordingly, the feature extraction module 200 may include: The feature extraction unit is used to extract features from the filtered encrypted industrial network traffic.

[0056] Based on the above embodiments, the feature extraction module 200 may include: The network node relationship feature extraction unit is used to perform five-tuple analysis on the encrypted traffic of the industrial network to obtain network node relationship features. The five-tuple consists of the information source IP, destination IP, source port, destination port, and transport layer protocol. The statistical feature extraction unit is used to extract statistical features of the encrypted traffic of the industrial network; the statistical features include general traffic features, features related to data packet size, features of data packets and byte rate, features of data packet arrival time intervals, features related to data packet headers, features related to data packet payloads, and traffic status features.

[0057] Based on the above embodiments, the clustering module 300 may include: A clustering unit is used to cluster encrypted industrial network traffic with a similarity threshold that reaches a preset similarity threshold into a cluster based on the traffic characteristics and using a density clustering algorithm to obtain each cluster; wherein the similarity is calculated using the Euclidean algorithm.

[0058] Based on the above embodiments, the industrial network encrypted traffic application identification device may further include: The IP ratio calculation module is used to perform the IP ratio calculation step: calculate the number of identical IPs in any two clusters and the total number of IPs in the two clusters, and calculate the ratio of the number of identical IPs to the total number of IPs; The merging module is used to perform the merging step: if the ratio is greater than a preset threshold, the two clusters are merged. The termination module is used to repeatedly execute the IP ratio calculation step and the merging step until no further merging is possible, at which point the cluster merging ends, and each merged large cluster is obtained; Accordingly, the measurement value calculation module 400 may include: The metric calculation unit is used to create a time dependency graph for each of the large clusters, obtain time dependency graph parameters, and calculate the metric value of each of the large clusters based on the time dependency graph parameters.

[0059] Based on the above embodiments, the measurement value calculation module 400 may include: The metric calculation unit is used to create the time dependency graph for each of the clusters, obtain the time dependency graph parameters corresponding to each cluster, and calculate the metric value based on the time dependency graph parameters; the time dependency graph parameters include the behavioral features generated by constructing the time dependency graph, the percentage of nodes with in-degree and out-degree to the total number of nodes, the network diameter, and the average degree of nodes.

[0060] Based on the above embodiments, the matching determination module 700 may include: A matching unit is used to perform similarity matching between the metric values ​​of the clusters that do not conform to the peer-to-peer pattern and the static feature library and the dynamic feature library to determine the application corresponding to the encrypted traffic of the industrial network in the clusters that do not conform to the peer-to-peer pattern; the static feature library includes common encrypted traffic patterns, behavioral characteristics, known normal operation data and potential threat indicators collected and compiled; the dynamic feature library includes a feature library that is dynamically updated according to real-time network monitoring and the latest security events.

[0061] It should be noted that the order of the modules and units in the aforementioned industrial network encrypted traffic application identification device can be changed without affecting the logic.

[0062] The industrial network encrypted traffic application identification device provided in this invention collects and extracts features from industrial network encrypted traffic. Based on the extracted features, it uses clustering and time-dependence graph (TDG) methods to classify and analyze the industrial network encrypted traffic, thereby identifying similar communication patterns among industrial network encrypted traffic. This helps to automatically discover communication clusters in industrial networks, thus better understanding the diversity of protocols and changes in communication patterns. It directly determines the application to which industrial network traffic conforming to point-to-point patterns belongs, and uses a feature library matching method to determine the application to which industrial network traffic conforming to non-point-to-point patterns belongs. This method can classify encrypted industrial network traffic by application, facilitating network administrators to optimize network resource allocation, ensure the performance of critical applications, and enable regulatory agencies to monitor enterprise demand for industrial network traffic. It identifies and analyzes the actual operating status of industrial networks, providing a foundation for advanced data analysis applications such as industrial user behavior analysis and network usage pattern analysis. Furthermore, it can serve as an early indicator for network anomalies, aiding in the timely detection and response to network intrusions or system failures.

[0063] The following describes the industrial network encrypted traffic application identification device provided in the embodiments of the present invention. The industrial network encrypted traffic application identification device described below and the industrial network encrypted traffic application identification method described above can be referred to in correspondence.

[0064] Please refer to Figure 3 , Figure 3 A schematic diagram of the structure of an industrial network encrypted traffic application identification device provided in an embodiment of the present invention may include: Memory 10 is used to store computer programs; The processor 20 is used to execute computer programs to implement the above-described industrial network encrypted traffic application identification method.

[0065] The memory 10, processor 20, and communication interface 31 all communicate with each other through the communication bus 32.

[0066] In this embodiment of the invention, the memory 10 is used to store one or more programs. The programs may include program code, which includes computer operation instructions. In this embodiment of the invention, the memory 10 may store programs for implementing the following functions: Collect encrypted traffic from an industrial network over a period of time to obtain a network flow dataset; Feature extraction is performed on all encrypted traffic from industrial networks in the network flow dataset to obtain the traffic characteristics of encrypted traffic from each industrial network. Based on traffic characteristics, clustering algorithms are used to cluster all encrypted traffic from industrial networks to obtain various clusters. A time dependency graph is created for each cluster to obtain time dependency graph parameters, and the metric value of each cluster is calculated based on the time dependency graph parameters. Determine whether each cluster conforms to the point-to-point pattern based on the metric value; Industrial network encrypted traffic in clusters that conform to the peer-to-peer pattern is identified as peer-to-peer application. The metrics of clusters that do not conform to the peer-to-peer pattern are matched with the application feature library to determine the applications corresponding to the encrypted traffic of industrial networks in the clusters that do not conform to the peer-to-peer pattern.

[0067] In one possible implementation, the memory 10 may include a program storage area and a data storage area, wherein the program storage area may store the operating system and applications required for at least one function; and the data storage area may store data created during use.

[0068] Furthermore, memory 10 may include read-only memory and random access memory, providing instructions and data to the processor. A portion of the memory may also include NVRAM. The memory stores operating systems and operating instructions, executable modules, or data structures, or subsets thereof, or extended sets thereof, wherein the operating instructions may include various operating instructions for implementing various operations. The operating system may include various system programs for implementing various basic tasks and handling hardware-based tasks.

[0069] Processor 20 can be a central processing unit (CPU), an application-specific integrated circuit, a digital signal processor, a field-programmable gate array, or other programmable logic device. Processor 20 can be a microprocessor or any conventional processor. Processor 20 can call programs stored in memory 10.

[0070] Communication interface 31 can be an interface for the communication module, used to connect with other devices or systems.

[0071] Of course, it should be noted that, Figure 3 The structure shown does not constitute a limitation on the industrial network encrypted traffic application identification device in the embodiments of the present invention. In practical applications, the industrial network encrypted traffic application identification device may include devices that are more advanced than those described above. Figure 3 More or fewer components as shown, or combinations of certain components.

[0072] The following describes the readable storage medium provided in the embodiments of the present invention. The medium described below can be referred to in correspondence with the industrial network encrypted traffic application identification method described above.

[0073] The present invention also provides a medium on which a computer program is stored, which, when executed by a processor, implements the steps of the above-described industrial network encrypted traffic application identification method.

[0074] The medium can include various media that can store program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0075] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0076] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0077] Finally, it should be noted that in this document, relationships such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.

[0078] The above provides a detailed description of the industrial network encrypted traffic application identification method, apparatus, device, and medium provided by the present invention. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A method for identifying encrypted traffic applications in industrial networks, characterized in that, include: Collect encrypted traffic from an industrial network over a period of time to obtain a network flow dataset; Feature extraction is performed on all the encrypted traffic of the industrial network in the network flow dataset to obtain the traffic features of each encrypted traffic of the industrial network; Based on the traffic characteristics, a clustering algorithm is used to cluster all the encrypted traffic of the industrial network to obtain various clusters. A time dependency graph is created for each of the clusters to obtain time dependency graph parameters, and a metric value for each of the clusters is calculated based on the time dependency graph parameters. Based on the metric value, determine whether each cluster conforms to the point-to-point pattern; Industrial network encrypted traffic in clusters that conform to the described peer-to-peer pattern is identified as peer-to-peer pattern applications. The metric values ​​of clusters that do not conform to the peer-to-peer pattern are matched with the application feature library to determine the application corresponding to the encrypted traffic of the industrial network in the clusters that do not conform to the peer-to-peer pattern. The step of extracting features from all the encrypted traffic of the industrial network in the network flow dataset to obtain the traffic features of each encrypted traffic of the industrial network includes: Five-tuple analysis is performed on the encrypted traffic of the industrial network to obtain the network node relationship characteristics. The five-tuple consists of the source IP, destination IP, source port, destination port, and transport layer protocol. Before creating a time dependency graph for each of the clusters, obtaining time dependency graph parameters, and calculating the metric value for each of the clusters based on the time dependency graph parameters, the method further includes: Steps for calculating the IP ratio: Calculate the number of identical IPs in any two clusters and the total number of IPs in the two clusters, and calculate the ratio of the number of identical IPs to the total number of IPs; Merging step: If the ratio is greater than a preset threshold, the two clusters are merged; The steps of calculating the IP ratio and merging are repeated until no further merging is possible, at which point the cluster merging ends, resulting in each merged large cluster. Accordingly, the step of creating a time dependency graph for each cluster, obtaining time dependency graph parameters, and calculating the metric value for each cluster based on the time dependency graph parameters includes: A time dependency graph is created for each of the large clusters, and the time dependency graph parameters corresponding to each cluster are obtained. The metric value of each large cluster is calculated based on the time dependency graph parameters. The time dependency graph parameters include the behavioral features generated by constructing the time dependency graph, the percentage of nodes with in-degree and out-degree to the total number of nodes, the network diameter, and the average degree of nodes.

2. The industrial network encrypted traffic application identification method according to claim 1, characterized in that, Before performing feature extraction on all the encrypted traffic from the industrial network in the network flow dataset, the method further includes: Port analysis is performed on all the encrypted traffic of the industrial network. Based on the port information obtained from the analysis, the encrypted traffic of the industrial network for non-encrypted traditional applications is filtered to obtain the filtered encrypted traffic of the industrial network. Accordingly, the feature extraction of all the encrypted industrial network traffic in the network flow dataset includes: Feature extraction is performed on the filtered encrypted traffic from the industrial network.

3. The industrial network encrypted traffic application identification method according to claim 1, characterized in that, The step of extracting features from all the encrypted traffic of the industrial network in the network flow dataset to obtain the traffic features of each encrypted traffic of the industrial network includes: Extract statistical features of the encrypted traffic of the industrial network; the statistical features include general traffic features, features related to packet size, features of packet size and byte rate, features of packet arrival time interval, features related to packet header, features related to packet payload, and traffic state features.

4. The industrial network encrypted traffic application identification method according to claim 1, characterized in that, Based on the traffic characteristics, a clustering algorithm is used to cluster all the encrypted traffic of the industrial network to obtain various clusters, including: Based on the traffic characteristics, the encrypted traffic of industrial networks that reaches a preset similarity threshold is clustered into a cluster using a density clustering algorithm to obtain each cluster; wherein, the similarity is calculated using the Euclidean algorithm.

5. The industrial network encrypted traffic application identification method according to claim 1, characterized in that, The step of matching the metric values ​​of clusters that do not conform to the peer-to-peer pattern with the application feature library to determine the application corresponding to the encrypted traffic of the industrial network in the clusters that do not conform to the peer-to-peer pattern includes: The metric values ​​of the clusters that do not conform to the peer-to-peer pattern are matched with the static feature library and the dynamic feature library to determine the applications corresponding to the encrypted traffic of industrial networks in the clusters that do not conform to the peer-to-peer pattern. The static feature library includes common encrypted traffic patterns, behavioral characteristics, known normal operation data and potential threat indicators of industrial networks that are collected and compiled. The dynamic feature library includes a feature library that is dynamically updated according to real-time network monitoring and the latest security events.

6. An industrial network encrypted traffic application identification device, characterized in that, include: The acquisition module is used to collect encrypted traffic from industrial networks over a period of time to obtain a network flow dataset. The feature extraction module is used to extract features from all the encrypted traffic of the industrial network in the network flow dataset to obtain the traffic features of each encrypted traffic of the industrial network. The clustering module is used to cluster all the encrypted traffic of the industrial network based on the traffic characteristics using a clustering algorithm to obtain various clusters; The metric calculation module is used to create a time dependency graph for each of the clusters, obtain time dependency graph parameters, and calculate the metric value of each of the clusters based on the time dependency graph parameters. The point-to-point pattern determination module is used to determine whether each cluster conforms to the point-to-point pattern based on the metric value. The peer-to-peer mode determination module is used to determine the encrypted traffic of industrial networks in clusters that conform to the peer-to-peer mode as peer-to-peer mode applications. The matching and determination module is used to match the metric values ​​of clusters that do not conform to the peer-to-peer pattern with the application feature library to determine the application corresponding to the encrypted traffic of the industrial network in the clusters that do not conform to the peer-to-peer pattern. The feature extraction module includes: The network node relationship feature extraction unit is used to perform five-tuple analysis on the encrypted traffic of the industrial network to obtain network node relationship features. The five-tuple consists of the information source IP, destination IP, source port, destination port, and transport layer protocol. Also includes: The IP ratio calculation module is used to perform the IP ratio calculation step: calculate the number of identical IPs in any two clusters and the total number of IPs in the two clusters, and calculate the ratio of the number of identical IPs to the total number of IPs; The merging module is used to perform the merging step: if the ratio is greater than a preset threshold, the two clusters are merged; The termination module is used to repeatedly execute the IP ratio calculation step and the merging step until no further merging is possible, at which point the cluster merging ends, and each merged large cluster is obtained; Accordingly, the metric calculation module is specifically used to create time dependency graphs for each of the large clusters, obtain time dependency graph parameters corresponding to each cluster, and calculate the metric value of each of the large clusters based on the time dependency graph parameters; the time dependency graph parameters include the behavioral features generated by constructing the time dependency graph, the percentage of nodes with in-degree and out-degree to the total number of nodes, the network diameter, and the average degree of nodes.

7. An industrial network encrypted traffic application identification device, characterized in that, include: Memory, used to store computer programs; A processor, configured to implement the steps of the industrial network encrypted traffic application identification method as described in any one of claims 1 to 5 when executing the computer program.

8. A medium, characterized in that, The medium stores computer-executable instructions, which, when loaded and executed by a processor, implement the steps of the industrial network encrypted traffic application identification method as described in any one of claims 1 to 5.

Images