Industrial control protocol format field inference method based on mask modeling and weight analysis

Abstract

The invention discloses an industrial control protocol format field inference method based on mask modeling and weight analysis, and relates to a protocol format field inference method. Comprising the following steps: 1) acquiring a mask model training data set; 2) data preprocessing; carrying out operations such as cutting and filling on the training sequence so as to accord with a sequence form which can be correctly processed by the mask model; and 3) pre-training the model. Training the data set by using the Bert model after modifying the mask strategy to obtain a new pre-training model; and 4) attention weight analysis. And 5) generating a format field label. And according to a result of the attention weight analysis, generating a format field label of the industrial control protocol, and completing a field division task of the industrial control protocol. The method uses an unsupervised deep learning method, does not depend on label data, and can complete format inference of an unknown protocol. The method has good accuracy on different types of protocols, which shows that the method has strong capability in solving protocol field division tasks.

Description

Technical Field

[0001] The present invention relates to the technical field of protocol format field inference methods, and in particular to an industrial control protocol format field inference method based on mask modeling and weight analysis. Background Art

[0002] Industrial Control System (ICS), also known as Industrial Control System, is an automatic control system composed of computer equipment and industrial process control components. Industrial control system is an important part of many critical infrastructures.

[0003] ICS uses proprietary industrial control protocols (referred to as "industrial control protocols") to achieve communication between components and control various industrial control devices in the industrial control network. However, for security and commercial reasons, most manufacturers use private industrial control protocols without public document specifications, resulting in a large number of unknown or even non-standard industrial control protocols in ICS, which brings unknown security risks to the industrial control network. Security protection measures such as industrial control intrusion detection systems and vulnerability analysis also rely on the format of the protocol.

[0004] In order to cope with the challenges brought by unknown industrial control protocols, more and more studies have begun to use protocol reverse engineering to analyze unknown protocols. Protocol reverse engineering is divided into two methods: based on industrial control network traffic analysis and based on execution trajectory analysis. The method based on execution trajectory analysis needs to complete the field division and semantic inference of the industrial control protocol by tracking and analyzing the changes in function stacks, instruction sequences, data, registers and other information during the execution of the target industrial control protocol program. However, this method requires the operation of the industrial control execution program, which has a relatively high impact on the stability and controllability of the ICS, and is also difficult to implement and analyze. The method based on industrial control network traffic analysis only needs to capture the traffic generated during the operation of the industrial control network and then analyze the captured traffic packets to perform protocol reverse engineering. This method does not require the control of the industrial control system, is easy to implement, and has a relatively small impact on the stability of the target system.

[0005] Therefore, designing an automated format inference method based on industrial control traffic analysis for industrial control protocols is needed in the field of industrial control security. Summary of the invention

[0006] The object of the present invention is to provide an industrial control protocol automatic format inference method based on industrial control traffic analysis, which is used to realize the automation of field format inference of the industrial control protocol.

[0007] The technical solution of the present invention is as follows:

[0008] A method for inferring industrial control protocol format fields based on mask modeling and weight analysis, the method comprising the following steps:

[0009] S1. Obtaining a mask model training data set: capturing the communication traffic of the industrial simulation platform and simulation software, and filtering the application layer load of the industrial control communication traffic as a training set by analyzing the data packets;

[0010] S2. Data preprocessing: The training data of the application layer payload is spliced ​​according to the request-response format. During the splicing process, the maximum data length of the request data and the response data shall not exceed 256 bytes, and the length of the spliced ​​data shall not exceed 512 bytes to prevent exceeding the maximum sequence length acceptable to the model; the spliced ​​data needs to be dynamically padded to ensure that the length of the training sequence in each batch is consistent to meet the input format of the mask model;

[0011] S3, model mask language modeling training: using the data processed in step S2 as model input; training through the modified mask mechanism so that the model can fully learn the format information of the sequence, and obtain a pre-trained model based on mask modeling;

[0012] S4, attention weight analysis: the pre-trained model generated in step S3 generates an attention weight value for each mask byte during the mask modeling process, and the weight value is analyzed according to the weight analysis and vote counting rules;

[0013] S5. Generate format field label: Generate protocol format field label according to the analysis result generated in step S4;

[0014] The specific steps of step S1 are:

[0015] S101, analyzing the captured communication data flow, filtering out the flow data of industrial control type, converting the filtered industrial control flow into original data, and saving the application layer load in the original data;

[0016] S102, repeating step S101 until a considerable amount of industrial control data traffic with diverse functions is collected;

[0017] The specific steps of step S2 are:

[0018] S201, classifying the application layer payload captured in step S1 according to request data and response data;

[0019] S202. Add special characters [REQ], [SEP], and [RESP] to the classified request response data to represent the start, end of the request data, and the start of the response packet respectively. To avoid excessive data length during subsequent splicing, cut the request and response data to ensure that the length of each data is less than 256 bytes, and ensure that the length of the spliced data does not exceed the maximum sequence length accepted by the model.

[0020] S203. Standardize the length of the spliced data to unify the data length within each training batch. Assume that the maximum sequence length within each batch is t. For the batch training samples with a byte length less than t, add special character PAD at the end for supplementation.

[0021] The specific steps of step S4 are as follows:

[0022] S401. Extract the position based on the initial value of the prediction mask byte (hereinafter referred to as mask_token). For different sequence lengths, the number of observations during prediction initialization varies. Therefore, the number of extracted observation positions is equal to 20% of the sequence length to meet the dynamic change requirements. In the mask model, the depth and breadth learned by different attention heads in different layers are different. Therefore, it is necessary to conduct a statistical analysis for each layer and each head one by one.

[0023] S402. After extracting the position based on which the initial value of the predicted mask_token is determined, perform a determination analysis. Observe the positions based on which adjacent mask_tokens (such as mask_toke i and mask_token i+1 ) predict the initial value of the mask_token. If the positions based on are exactly the same, it is determined that the adjacent bytes form a protocol field. Increment the together count by 1, otherwise increment the single count by 1. If the observed positions are not exactly the same, perform a second determination.

[0024] S403. According to multiple rounds of experiments, set the optimal parameter threshold to 50% of the total weight value. If the sum of the weight values at the overlapping positions exceeds the threshold, increment the together count by 1, otherwise increment the single count by 1.

[0025] S404. Statistically analyze the results of the attention weight analysis rule according to the voting count rule. The statistical rule is as follows: If the together count > the single count, it is determined that the adjacent bytes form a protocol field, and continue to analyze mask_token i+2 , until a mask_token that does not meet the above conditions is found. All bytes before the mask_token that does not meet this condition are regarded as the same field; if the together count < the single count, then the mask_tokeni Treated as a separate field, the next step will be mask_token i+1 Repeat the above determination operation;

[0026] Mask modeling is composed of multiple layers of encoders (Encoder) stacked together. Each decoder layer consists of an embedding layer, a multi-head attention layer, a normalization layer, a feedforward network, a residual network and a Softmax layer. The embedding layer is responsible for embedding the input data into a high-dimensional vector of 256 dimensions and adding position information. The multi-head attention layer uses the attention mechanism to extract data features, learns the contextual information in the sequence and its vector representation by randomly covering the sequence bytes, and predicts the initial value of the mask byte based on the correlation scores of other bytes. The Softmax layer visualizes the correlation score as an attention value.

[0027] The industrial control protocol format field inference method based on mask modeling and weight analysis, the industrial control protocol data packet in S1 is derived from PLC devices of various manufacturers in the actual working conditions of the thermal power generation simulation platform of the Key Laboratory of Information Security in the Petrochemical Industry, and is captured and collected by Wireshark sniffing software; at the same time, communication data packets are collected from the Github project as subsequent training sets and test sets, and commonly used industrial control system communication protocols include ModbusTCP, S7comm, Ethernet / IP, and DNP3.

[0028] The industrial control protocol format field inference method based on mask modeling and weight analysis, in the S3, the traditional masking method of masking multiple bytes is modified to mask only a certain byte in the response sequence within the concatenated sequence of the request response, and all bytes after the mask byte are replaced by the PAD special character, guiding the model to learn the above information of the request packet to predict the initial value of the mask byte, completing the model training of the mask modeling, and generating a pre-trained model.

[0029] In the industrial control protocol format field inference method based on mask modeling and weight analysis, in S4, the attention weight value generated in the pre-training model process in step S3 is analyzed according to the weight analysis rule. The formula of the weight analysis rule is as follows:

[0030]

[0031]

[0032] where α ij is the attention weight, t a Indicates a certain byte information, Context(t a ) is the position observed when predicting the initial value of a byte, τ is the attention weight threshold at the observation position, ∑j∈Context(j) α ij Used to calculate the sum of the attention values ​​at the overlapping position of a byte. k Indicates a protocol field.

[0033] The industrial control protocol format field inference method based on mask modeling and weight analysis, in the S4, the results of the attention weight analysis rule are counted according to the voting counting rule.

[0034] The industrial control protocol format field inference method based on mask modeling and weight analysis, in the S5, generates a protocol format field label according to the statistical results described in step S4.

[0035] The advantages and effects of the present invention are:

[0036] The present invention does not rely on label data, and solves the field division problem in protocol inversion through unsupervised deep learning. It uses mask modeling to explore whether the context positions based on which different bytes in the protocol field are predicted for initial values ​​in mask modeling are the same, or whether the sum of the attention weight values ​​generated at the same position exceeds a predetermined threshold. If the above conditions are met, it proves that the conditions based on which different bytes in a field are predicted for initial values ​​in mask modeling are the same, while the conditions based on which bytes in different fields are predicted are different. In this way, the inference of the protocol field boundary is completed. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 It is a flow chart of a method for inferring industrial control protocol format fields based on mask modeling and weight analysis of the present invention;

[0038] Figure 2 is a mask modeling structure diagram of the present invention;

[0039] Figure 3 yes Figure 1 Flowchart of the middle weight analysis phase;

[0040] Figure 4 This is the field division result for different types of S7 protocols provided by the industrial control protocol format field inference method based on mask modeling and weight analysis provided by the patent of this invention. DETAILED DESCRIPTION

[0041] The present invention will be further described below in conjunction with the accompanying drawings.

[0042] The process of the present invention is as follows Figure 1 As shown: The specific steps are as follows:

[0043] S1: Acquisition of industrial protocol data packets. The data packets generated by the actual industrial control system come from the simulation platform in the Key Laboratory of Information Security of the Petrochemical Industry of Liaoning Province. The data packets are captured by the Wireshark traffic sniffing software, and the entries of the proprietary protocols of the industrial control system are retained and output in binary form. At the same time, industrial Pcap data packets for testing are collected from Github projects, Wiresharkwiki and other channels, including some commonly used industrial control system communication protocols including S7comm, Modbus TCP, PROFIBUS, IEC104, etc.

[0044] S2. Data preprocessing. The training data of the application layer payload is spliced ​​according to the request-response format. During the splicing process, the maximum data length of the request data and the response data shall not exceed 256 bytes, and the length of the spliced ​​data shall not exceed 512 bytes to prevent exceeding the maximum sequence length acceptable to the model; for the spliced ​​data, dynamic padding is required to ensure that the length of each training sequence is consistent to meet the input format of the mask model.

[0045] S3, mask modeling pre-training. For the data processed by S2, a masking mechanism is adopted to mask only a certain byte in the response packet for each sequence, and all subsequent bytes are replaced with the special character PAD for mask modeling. The overall process of mask modeling is as follows: Figure 2 shown.

[0046] S4. Attention weight analysis. For each mask model, an attention weight value is generated when predicting the initial value of the mask byte. The attention weight value is analyzed and counted according to formula (2) and formula (3). Figure 3 The steps of attention weight analysis are as follows: (1) Observe the adjacent mask_token (such as mask_toke i and mask_token i+1When predicting the initial value of the mask_token, if the basis positions are exactly the same, it is determined that adjacent bytes form a protocol field. The together count is incremented by 1; otherwise, the single count is incremented by 1. (2) If the observed positions are not exactly the same, a second determination is made. If the sum of the weight values at the overlapping positions exceeds the threshold, the together count is incremented by 1; otherwise, the single count is incremented by 1. (3) Based on the above two steps, the determination results are statistically analyzed, and the statistical rules are as follows: If the together count > the single count, it is determined that adjacent bytes form a protocol field, and mask_tokeni+2 is continuously analyzed until a mask_token that does not meet the above conditions is found. All bytes before the one that does not meet this condition are regarded as the same field; if the together count < the single count, mask_tokeni is regarded as a separate field, and the above determination operation will be repeated for mask_tokeni+1 in the next step.

[0047]

[0048] S5. Generate format field labels. Generate protocol format field labels based on the counting results produced in step S4.

[0049] Next, the effect of the industrial control protocol format field inference method based on mask modeling and weight analysis of the present invention on the S7comm protocol format field inference is verified through experiments.

[0050] The method provided by the present invention is used to test the common S7comm protocol. The training data comes from the following parts: (1) Use Snap7 and Step7 to build a simulation environment that conforms to the S7comm protocol and capture communication traffic; (2) Capture communication data from the laboratory oil and gas gathering and transportation simulation platform; (3) Collect publicly available network data. The first two parts use the Wireshark software to capture traffic. The above traffic data is preprocessed to meet the requirements of model training. The specific experimental process is as follows:

[0051] Experimental environment: The test computer is AMD Ryzen 7 6800H with Radeon Graphics 3.20GHz, the RAM is 8GB, and the Windows 11 Professional Edition; the development language is Python 3.9; the development environment is Pytorch; the switch model is H3C-S5120V2-2SP-SI; the simulation slave stations are Snap7 v6.2.2 and Step7 v8.2.0.

[0052] Experimental process: The preprocessed data is divided into training set and test set in a ratio of 4:1. To avoid overfitting during training, an early stopping mechanism is added to save the pre-trained model. In the training evaluation phase, a rolling mask is used. The pre-trained model is loaded to test the test set, and the sequence position and attention weight value based on which the mask in each test set sequence is predicted are saved. The attention weight value is analyzed according to the attention weight analysis rules, the counting results are counted, and the field format label is generated to complete the format inference of the protocol field.

[0053] Experimental description: The model parameters are designed as follows: the embedding dimension is 256, the feedforward layer expansion dimension is 512, the number of encoders is 2, each decoder layer has 2 attention heads, and the activation function is GELU (Gauss

[0054] ian Error Linear Unit), the optimizer is Adam (Adaptive Moment Estimation), and the training period is 50 epochs. There are four specific types of S7 protocols in this experiment, namely Set Co mmunication, SetFunication, Write Var, and ReadVar.

[0055] Experimental result analysis: By conducting experiments on different types of S7 protocol data, the accuracy is statistically analyzed, such as Figure 4 As shown, it can be seen that the overall accuracy of the present invention is improved by 13% and 6% respectively compared with the traditional DIS COVERER and PROSEG industrial control protocol field division methods.

[0056] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for inferring industrial control protocol format fields based on mask modeling and weight analysis, characterized in that: The method comprises the following steps: S1. Obtaining a mask model training data set: capturing the communication traffic of the industrial simulation platform and simulation software, and filtering the application layer load of the industrial control communication traffic as a training set by analyzing the data packets; S2. Data preprocessing: The training data of the application layer payload is spliced ​​according to the request-response format. During the splicing process, the maximum data length of the request data and the response data shall not exceed 256 bytes, and the length of the spliced ​​data shall not exceed 512 bytes to prevent exceeding the maximum sequence length acceptable to the model; the spliced ​​data needs to be dynamically padded to ensure that the length of the training sequence in each batch is consistent to meet the input format of the mask model; S3, model mask language modeling training: using the data processed in step S2 as model input; training through the modified mask mechanism so that the model can fully learn the format information of the sequence, and obtain a pre-trained model based on mask modeling; S4, attention weight analysis: the pre-trained model generated in step S3 generates an attention weight value for each mask byte during the mask modeling process, and the weight value is analyzed according to the weight analysis and vote counting rules; S5. Generate format field label: Generate protocol format field label according to the analysis result generated in step S4; The specific steps of step S1 are: S101, analyzing the captured communication data flow, filtering out the flow data of industrial control type, converting the filtered industrial control flow into original data, and saving the application layer load in the original data; S102, repeating step S101 until a considerable amount of industrial control data traffic with diverse functions is collected; The specific steps of step S2 are: S201, classifying the application layer payload captured in step S1 according to request data and response data; S202. Add special characters [REQ], [SEP], and [RESP] to the classified request and response data to indicate the start and end of the request data and the start of the response packet, respectively. To avoid the spliced ​​data being too long in the subsequent splicing process, cut the request and response data to ensure that the length of each data is less than 256 bytes, and ensure that the spliced ​​data length does not exceed the maximum sequence length accepted by the model. S203, standardize the length of the spliced ​​data to unify the data length in each training batch, assuming that the maximum sequence length in each batch is t, and add a special character PAD to the end of the batch training samples whose byte length is less than t; The specific steps of step S4 are: S401, extracting the position based on which the initial value of the mask byte (hereinafter referred to as mask_token) is predicted. For different sequence lengths, the number of observations varies when predicting the initial value, so the number of extracted observation positions is equal to 20% of the sequence length to meet the needs of dynamic changes. In the mask model, different attention heads of different layers learn different depths and breadths, so it is necessary to perform statistical analysis on each head of each layer one by one; S402, after extracting the position based on which the initial value of mask_token is predicted, perform judgment analysis and observe the adjacent mask_token (such as mask_toke i and mask_token i+1 ) Predict the initial value of mask_token based on the position. If the position is exactly the same, it is determined that the adjacent bytes form a protocol field. The number of together is +1, otherwise the number of single is +1. If the observed position is not exactly the same, a second determination is made; S403. According to multiple rounds of experiments, the optimal parameter threshold is set to 50% of the total weight value. If the sum of the weight values ​​at the overlapping positions exceeds the threshold, the number of together is increased by 1, otherwise, the number of single is increased by 1. S404. Statistically analyze the results of the attention weight analysis rule according to the vote counting rule. The statistical rule is as follows: if the number of "together" is greater than the number of "single", it is determined that adjacent bytes form a protocol field, and the mask_token is continuously analyzed i+2 , until a mask_token that does not meet the above conditions is found. All bytes before the one that does not meet this condition are regarded as the same field; if the number of "together" is less than the number of "single", the mask_token i is regarded as a separate field, and the above determination operation will be repeated for the mask_token i+1 in the next step; Mask modeling is composed of multiple layers of encoders (Encoder) stacked together. Each decoder layer consists of an embedding layer, a multi-head attention layer, a normalization layer, a feedforward network, a residual network and a Softmax layer. The embedding layer is responsible for embedding the input data into a high-dimensional vector of 256 dimensions and adding position information. The multi-head attention layer uses the attention mechanism to extract data features, learns the contextual information in the sequence and its vector representation by randomly covering the sequence bytes, and predicts the initial value of the mask byte based on the correlation scores of other bytes. The Softmax layer visualizes the correlation score as an attention value.

2. According to claim 1, a method for inferring industrial control protocol format fields based on mask modeling and weight analysis is characterized in that: The industrial control protocol data packets in S1 are derived from PLC devices of various manufacturers in the actual working conditions of the thermal power generation simulation platform of the Key Laboratory of Information Security in the Petrochemical Industry, and are captured and collected by Wireshark sniffing software; at the same time, communication data packets are collected from the Github project as subsequent training sets and test sets. Commonly used industrial control system communication protocols include Modbus TCP, S7comm, Ethernet / IP, and DNP3.

3. According to claim 1, a method for inferring industrial control protocol format fields based on mask modeling and weight analysis is characterized in that: In the S3, the traditional masking method of masking multiple bytes is modified to mask only a certain byte in the response sequence within the concatenated sequence of the request response, and all bytes after the mask byte are replaced by the PAD special character, so as to guide the model to learn the above information of the request packet to predict the initial value of the mask byte, complete the model training of the mask modeling, and generate a pre-trained model.

4. According to claim 1, a method for inferring industrial control protocol format fields based on mask modeling and weight analysis is characterized in that: In the above S4, the attention weight value generated in the pre-training model process in step S3 is analyzed according to the weight analysis rule. The formula of the weight analysis rule is as follows: ∑ j∈Context(j) a ij ~t where α ij is the attention weight, t a Indicates a certain byte information, Context(t a ) is the position observed when predicting the initial value of a byte, τ is the attention weight threshold at the observation position, ∑ j∈Context(j) α ij Used to calculate the sum of the attention values ​​at the overlapping position of a byte. k Indicates a protocol field.

5. According to claim 1, a method for inferring industrial control protocol format fields based on mask modeling and weight analysis is characterized in that: In the above-mentioned S4, the results of the attention weight analysis rule are counted according to the voting counting rule.

6. The method for inferring industrial control protocol format fields based on mask modeling and weight analysis according to claim 1 is characterized in that: In the above-mentioned S5, a protocol format field label is generated according to the statistical result described in step S4.

Images