Marine industrial control protocol semantic level protocol analysis method

Abstract

The invention relates to a semantic-level protocol analysis method for an industrial control protocol for a ship, and the method comprises the following steps: 1, collecting data, carrying out the priori knowledge learning of the field information of all protocols of an industrial control network, and accumulating protocol analysis experience through a basic feature library and real-time knowledge learning; 2, carrying out formatting preprocessing on the acquired data; step 3, basic feature extraction is carried out based on the structured data preprocessed in the step 2; 4, performing depth feature extraction based on the basic features extracted in the step 3; and step 5, based on the depth features extracted in the step 4, constructing and optimizing a key field state machine by constructing an adjacency list, and performing semantic-level protocol analysis of the ship industrial control system by adopting a key state field state machine inference algorithm. According to the invention, semantic level analysis of public protocols and private protocols in different industrial control networks can be realized.

Description

Technical Field

[0001] The invention belongs to the fields of generic technology, national defense software technology and information security software technology, and relates to a semantic level protocol parsing method for an industrial control system, in particular to a semantic level protocol parsing method for a ship industrial control protocol. Background Art

[0002] Industrial control systems integrate computers, communications, networks, automatic control equipment and technologies. They use sensors to collect data, exchange data through network communication protocols, perform calculations on the host computer, and adjust the underlying mechanical and digital systems. In the field of industrial control, network protocols are gradually evolving in the direction of "diversification", "complexity", "privatization", and "algorithm combination", which increases the difficulty of network security defense of industrial control systems. Through in-depth analysis of the command level and semantic level of industrial control protocols, it is possible to effectively detect industrial control network security risks, perceive network trends, assist network management decisions, and improve network security protection capabilities.

[0003] At present, traditional protocol parsing technology cannot meet the technical standard requirements of industrial control network security monitoring. Traditional protocol parsing methods, such as port-based protocol identification and payload-based protocol identification, are no longer applicable to increasingly complex industrial control network scenarios. There is a lack of in-depth analysis methods for private protocols. At the beginning of the design of the industrial control system network, due to the consideration of the specificity, security and practicality of the industrial control system, the privatization of industrial control protocol specifications was relatively common, which increased the difficulty of industrial control network protocol parsing.

[0004] Therefore, the versatility of traditional protocol parsing methods cannot meet the needs. With the development of intelligent and networked industrial Internet, distributed control systems, programmable logic controller systems, and remote terminal unit systems are emerging in an endless stream. The business characteristics of different industrial control networks are very different, and traditional protocol parsing methods cannot meet the needs of protocol parsing accuracy and quantity in specific business scenarios.

[0005] After searching, no public documents of the prior art identical or similar to the present invention were found. Summary of the invention

[0006] The purpose of the present invention is to overcome the shortcomings of the prior art and propose a semantic-level protocol parsing method for a ship-based industrial control protocol. The method can collect network traffic in real time, analyze the flow and content of network data packets, monitor network security situation, assist network management decisions, improve the security capabilities of industrial control networks, and effectively prevent network security accidents based on semantic-level protocol parsing technology.

[0007] The present invention solves the practical problem by adopting the following technical solutions:

[0008] A method for semantic level protocol parsing of a marine industrial control protocol comprises the following steps:

[0009] Step 1: Collect data and learn prior knowledge about the field information of all protocols in the industrial control network, and accumulate protocol parsing experience through basic feature libraries and real-time knowledge learning;

[0010] Step 2: Format and pre-process the collected data;

[0011] Step 3: Extract basic features based on the structured data preprocessed in step 2;

[0012] Step 4: Based on the basic features extracted in step 3, perform deep feature extraction;

[0013] Step 5: Based on the deep features extracted in step 4, the key field state machine is constructed and optimized by building an adjacency table, and the key state field state machine inference algorithm is used to perform semantic-level protocol analysis of the marine industrial control system.

[0014] Moreover, the specific method of step 1 is:

[0015] (1) Collect data, including industrial control network communication data packets, commands, IP packets, and control messages;

[0016] (2) In the prior knowledge learning layer, based on the collected data, the model is trained by pre-importing or annotating the meaning of some protocol fields to master the semantic information of different protocol fields.

[0017] Moreover, the specific method of step 2 is:

[0018] After detecting, parsing, and formatting the data, the protocol data preprocessing layer unifies the data dimensions and fills in the default values, and converts the data into JSON data format.

[0019] Moreover, the basic features extracted in step 3 include: protocol communication port features, load features and associated behavior features.

[0020] Moreover, the specific method of step 4 is: in the deep feature extraction stage, deep analysis of the industrial control protocol is achieved through field division, structure recognition and semantic annotation.

[0021] Moreover, the specific steps of step 4 include:

[0022] (1) An improved multiple sequence comparison algorithm is used to perform synchronous sequence analysis field by field: First, n protocols to be analyzed are input, and then the length l of the longest protocol is obtained. m , other protocols use 0 to fill to 1 m , and finally output the processed simplified protocol; when a field of all protocols is completely consistent, the field is marked as a static field Static, otherwise it is marked as a dynamic field Dynamic.

[0023] (2) After sequence analysis, key field semantic inference technology is used to perform field segmentation;

[0024] The field division principle is: integrate static fields and extract dynamic fields; the field integration algorithm traverses all static fields and merges adjacent static fields to further simplify the protocol;

[0025] (3) Perform structure recognition and semantic annotation based on feature analysis to complete deep feature extraction.

[0026] Moreover, the specific steps of step 5 include:

[0027] (1) Constructing a key status field state machine

[0028] When the function code field is used as the key field for state machine construction, it is necessary to obtain the function field value and the order of the function code fields in the protocol; when the function code field order is 02, 11, 21, 42, 41, 42, 22, the key state field state machine construction algorithm is used to construct the state adjacency table.

[0029] (2) Optimize the key status field state machine constructed in step (1)

[0030] In order to simplify the state machine, the abnormal state migration is analyzed through the state transition probability, and the abnormal state is ignored; for parallel states of the same level, the state merging method is adopted to merge multiple parallel states into one state to achieve state machine optimization.

[0031] (3) In step (2), the protocol state machine is optimized, and a large number of marine industrial control system protocols are used to continuously improve and optimize the state machine until the state of the state machine remains unchanged, thereby realizing semantic-level protocol parsing of the marine industrial control system.

[0032] Advantages and beneficial effects of the present invention:

[0033] 1. The present invention proposes a semantic-level protocol parsing method for ship-based industrial control protocols, which is based on a semantic-level protocol solution method and meets the requirements of different industrial control network protocol parsing accuracy, quantity, and versatility. The semantic-level protocol parsing method includes a 5-layer protocol parsing architecture, namely, prior knowledge learning, data preprocessing, basic feature extraction, deep feature extraction, and state machine inference. It comprehensively considers the versatility of public protocols and the specificity of private protocols, uses improved multi-sequence comparison technology and key field semantic inference technology to extract protocol formats, uses key state field state machine inference algorithm to infer and optimize protocol states, establishes a semantic-level protocol parsing model, and constructs an efficient, reliable, and accurate industrial control network security monitoring system based on semantic-level protocol parsing. It designs a visualized industrial control network situation, monitors network data traffic, and ensures the safety and stability of industrial control scenarios.

[0034] 2. The present invention is aimed at the field of special industrial control, and utilizes the advantages of improved multi-sequence comparison technology and key field semantic inference technology in deep protocol parsing. Through protocol format extraction and protocol state machine inference, it realizes semantic-level parsing of public and private protocols in different industrial control networks. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 It is a diagram of the semantic level protocol parsing model architecture of the present invention;

[0036] Figure 2 is a flow chart based on load feature identification of the present invention;

[0037] Figure 3 is a flow chart of the improved multiple sequence analysis algorithm of the present invention;

[0038] Figure 4 It is a flow chart of the algorithm for constructing the key state field state machine of the present invention. DETAILED DESCRIPTION

[0039] The embodiments of the present invention are further described in detail below with reference to the accompanying drawings:

[0040] A semantic level protocol parsing method for marine industrial control protocols, such as Figure 1 As shown, the following steps are included:

[0041] Step 1: Collect data and learn prior knowledge about the field information of all protocols in the industrial control network, and accumulate protocol parsing experience through basic feature libraries and real-time knowledge learning;

[0042] The specific method of step 1 is:

[0043] (1) Collect data, including industrial control network communication data packets, commands, IP packets, control messages, etc.;

[0044] (2) In the prior knowledge learning layer, based on the collected data, the model is trained by pre-importing or annotating the meaning of some protocol fields to master the semantic information of different protocol fields.

[0045] In this embodiment, prior knowledge refers to the information such as the functions, identifiers, and lengths of different protocol fields that have been mastered before protocol parsing. In the prior knowledge learning layer, model training is performed by pre-importing or annotating the meanings of some protocol fields. Among them, the collected data includes industrial control network communication data packets, commands, IP packets, control messages, etc. With the increase in the amount of training data and the increase in the number of training times, the model masters the field information of all protocols of the target industrial control network. After mastering the semantic information of the protocol field, deep parsing can be achieved by analyzing the protocol structure.

[0046] Step 2: Format and pre-process the collected data;

[0047] The specific method of step 2 is:

[0048] After detecting, parsing, and formatting the data, the protocol data preprocessing layer unifies the data dimensions and fills in the default values, and converts the data into JSON data format.

[0049] In this embodiment, the data dimension can be unified by filling the data with zero, filling the mean value, etc. In the preprocessing stage, the text value data is stored in different attribute lists, and different message sessions are roughly classified by basic information such as source IP, destination IP, port number, etc., to achieve session delimitation and message delimitation.

[0050] Step 3: Extract basic features based on the structured data preprocessed in step 2;

[0051] The basic features extracted in step 3 include: protocol communication port features, load features and associated behavior features.

[0052] In this embodiment, the basic feature extraction layer extracts features from the preprocessed structured data. The basic features of the protocol include protocol communication ports, load features, associated behavioral features, etc. Basic feature extraction requires less relevant information, and the basic feature extraction algorithm has low time complexity and space complexity, and is simple to implement. Through basic feature extraction and analysis, most common protocols and some private protocols can be identified, providing prior knowledge support for deep feature extraction.

[0053] In terms of port characteristics, the Internet Assigned Numbers Authority contains detailed registered port numbers for each protocol to distinguish protocols.

[0054] In terms of load characteristics, based on the message field characteristics learned from prior knowledge, we look for the "fingerprint" characteristics of the application protocol during the communication process, that is, the proprietary characteristics that are different from any other application protocol. The algorithm performs load characteristic analysis by checking the application layer load part above the TCP header or UDP header of each data packet in the data stream from top to bottom. Figure 2 shown.

[0055] In the process of load feature identification, the protocol features are first extracted, and a feature library is built through feature extraction and knowledge accumulation; then the protocol is matched and identified using the previously used feature library; finally, the feature library is updated to increase knowledge accumulation and continuously learn protocol features.

[0056] In terms of associated behavioral characteristics, statistical principles are used to analyze the status of different protocols in session connections.

[0057] Step 4: Based on the basic features extracted in step 3, perform deep feature extraction:

[0058] The specific method of step 4 is: in the deep feature extraction stage, deep analysis of the industrial control protocol is achieved through field division, structure recognition and semantic annotation.

[0059] In this embodiment, in the deep feature extraction stage, the deep analysis of the industrial control protocol is achieved through field division, structure recognition and semantic annotation. The improved multi-sequence analysis algorithm and the semantic recognition algorithm based on feature analysis are respectively used for field division, structure recognition and semantic annotation.

[0060] The specific steps of field division, structure recognition and semantic annotation in step 4 include:

[0061] (1) An improved multiple sequence comparison algorithm is used to perform synchronous sequence analysis field by field: First, n protocols to be analyzed are input, and then the length l of the longest protocol is obtained. m , other protocols use 0 to fill to 1 m , and finally output the processed simplified protocol; when a field of all protocols is completely consistent, the field is marked as a static field Static, otherwise it is marked as a dynamic field Dynamic.

[0062] Improved multiple sequence analysis algorithms such as Figure 3 shown.

[0063] In the improved multiple sequence analysis algorithm, the protocol to be parsed, the number of protocols, and the maximum protocol length need to be input. All fields of all protocols are traversed. When a field is fixed, the field is marked as a Static field, otherwise it is marked as a Dynamic field.

[0064] (4) After sequence analysis, key field semantic inference technology is used to perform field segmentation;

[0065] The field division principle is: integrate static fields and extract dynamic fields; the field integration algorithm traverses all static fields and merges adjacent static fields to further simplify the protocol;

[0066] (5) Perform structure recognition and semantic annotation based on feature analysis to complete deep feature extraction;

[0067] The specific method of step (3) of step 4 is:

[0068] By cluster analysis, the field with the highest average score is selected as the function code field. In this embodiment, different fields of the industrial control protocol have different characteristics, such as the length field is related to the length of the protocol message, and the length field values ​​of different length messages are different. The difference in function codes reflects the similarity of the function structure, and the similarity of the function code field structure is related to the length of the protocol message sequence. Therefore, by cluster analysis, the field with the highest average score can be selected as the function code field.

[0069] Definition rule 1: When the number of messages contained in a cluster is 1, the score of the cluster is 0; when the number of messages contained in a cluster is more than 1, the score of the cluster is 0.1; when the number of messages contained in a cluster is more than 1 and the lengths of all cluster members are the same, the score of the cluster is 1.

[0070] Step 5: Based on the deep features extracted in step 4, the key field state machine is constructed and optimized by building an adjacency table, and the key state field state machine inference algorithm is used to perform semantic-level protocol analysis of the marine industrial control system;

[0071] The specific steps of step 5 include:

[0072] (1) Constructing a key status field state machine

[0073] When the function code field is used as the key field for state machine construction, it is necessary to obtain the function field value and the order of the function code fields in the protocol; when the function code field order is 02, 11, 21, 42, 41, 42, 22, the key state field state machine construction algorithm is used to construct the state adjacency table.

[0074] The key state field state machine construction algorithm is as follows Figure 4 shown.

[0075] In the key field state machine construction algorithm, the protocol to be parsed is first input, an adjacency table is constructed, and the adjacency table is updated by judging the characteristics of the field values ​​until all fields are completed.

[0076] (2) Optimize the key status field state machine constructed in step (1)

[0077] To simplify the state machine, the state transition probability can be used to analyze abnormal state migration and ignore abnormal states. For parallel states of the same level, the state merging method is used to merge multiple parallel states into one state to achieve state machine optimization.

[0078] (3) In step (2), the protocol state machine is optimized, and a large number of marine industrial control system protocols are used to continuously improve and optimize the state machine until the state of the state machine remains unchanged, thereby realizing semantic-level protocol parsing of the marine industrial control system.

[0079] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0080] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0081] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0082] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

Claims

1. A method for semantic level protocol parsing of a marine industrial control protocol, characterized by: The following steps are involved: Step 1: Collect data and learn prior knowledge about the field information of all protocols in the industrial control network, and accumulate protocol parsing experience through basic feature libraries and real-time knowledge learning; Step 2: Format and pre-process the collected data; Step 3: Extract basic features based on the structured data preprocessed in step 2; Step 4: Based on the basic features extracted in step 3, perform deep feature extraction; Step 5: Based on the deep features extracted in step 4, the key field state machine is constructed and optimized by building an adjacency table, and the key state field state machine inference algorithm is used to perform semantic-level protocol analysis of the marine industrial control system.

2. A method for semantic level protocol parsing of a marine industrial control protocol according to claim 1, characterized in that: The specific method of step 1 is: (1) Collect data, including industrial control network communication data packets, commands, IP packets, and control messages; (2) In the prior knowledge learning layer, based on the collected data, the model is trained by pre-importing or annotating the meaning of some protocol fields to master the semantic information of different protocol fields.

3. A method for semantic level protocol parsing of a marine industrial control protocol according to claim 1, characterized in that: The specific method of step 2 is: After detecting, parsing, and formatting the data, the protocol data preprocessing layer unifies the data dimensions and fills in the default values, and converts the data into JSON data format.

4. A method for semantic level protocol parsing of a marine industrial control protocol according to claim 1, characterized in that: The basic features extracted in step 3 include: protocol communication port features, load features and associated behavior features.

5. A method for semantic level protocol parsing of a marine industrial control protocol according to claim 1, characterized in that: The specific method of step 4 is: in the deep feature extraction stage, deep analysis of the industrial control protocol is achieved through field division, structure recognition and semantic annotation.

6. A method for semantic level protocol parsing of a marine industrial control protocol according to claim 5, characterized in that: The specific steps of step 4 include: (1) An improved multiple sequence comparison algorithm is used to perform synchronous sequence analysis field by field: First, n protocols to be analyzed are input, and then the length l of the longest protocol is obtained. m , other protocols use 0 to fill to 1 m , and finally output the simplified protocol after processing; when a field of all protocols is completely consistent, the field is marked as a static field Static, otherwise it is marked as a dynamic field Dynamic; (2) After sequence analysis, key field semantic inference technology is used to perform field segmentation; The field division principle is: integrate static fields and extract dynamic fields; the field integration algorithm traverses all static fields and merges adjacent static fields to further simplify the protocol. (3) Perform structure recognition and semantic annotation based on feature analysis to complete deep feature extraction.

7. A method for semantic level protocol parsing of a marine industrial control protocol according to claim 1, characterized in that: The specific steps of step 5 include: (1) Constructing a key status field state machine When the function code field is used as the key field for state machine construction, it is necessary to obtain the function field value and the order of the function code fields in the protocol; when the order of the function code fields is 02, 11, 21, 42, 41, 42, 22, the key state field state machine construction algorithm is used to construct the state adjacency table; (2) Optimize the key status field state machine constructed in step (1) To simplify the state machine, the abnormal state migration is analyzed through the state transition probability, and the abnormal state is ignored; for the parallel states of the same level, the state merging method is adopted to merge multiple parallel states into one state to achieve state machine optimization; (3) In step (2), the protocol state machine is optimized, and a large number of marine industrial control system protocols are used to continuously improve and optimize the state machine until the state of the state machine remains unchanged, thereby realizing semantic-level protocol parsing of the marine industrial control system.

Images