Industrial control protocol normal form grammar automatic generation method and system based on flow analysis

Abstract

The invention discloses an industrial control protocol normal form grammar automatic generation method and system based on flow analysis, and the method comprises the following steps: capturing a data packet sequence in an industrial control system, and extracting a protocol name, a field name, a field type and a field size in each data packet of the data packet sequence; constructing a data model for each data packet: taking a protocol name corresponding to the data packet as a root node, taking a field name as a child node, and taking a field type and a field size as leaf nodes of the field name of a corresponding field; and extracting the common part of all the data models to obtain a general data model, and traversing the general data model to obtain the normal form grammar description of the industrial control protocol. According to the method, the normal form grammar description of the industrial control protocol can be automatically generated, grammar errors and vulnerabilities caused by human errors or negligence are reduced, and accurate protocol specifications are provided.

Description

Technical Field

[0001] The present invention relates to the technical field of protocol test automation, and in particular to a method and system for automatically generating industrial control protocol paradigm grammar based on flow analysis. Background Art

[0002] In modern communication and network systems, protocols play a vital role, defining the rules and formats for data exchange and ensuring interoperability and correctness between different systems and devices. Especially in the field of industrial control systems (ICS) and intelligent manufacturing, industrial control protocols such as Modbus, DNP3, OPC UA, etc., are used to control and monitor industrial equipment, systems and processes, and their testing is becoming increasingly important. With the rapid development of the industrial Internet, industrial control systems are increasingly integrated with the Internet and enterprise-level information technology, which makes the security and interoperability of industrial control protocols particularly important. Malicious attacks and cyber threats can cause serious damage to industrial control systems, so it is crucial to test, evaluate and reinforce industrial control protocols. Developers and users need to ensure the functional integrity, stability and security of the protocol to protect the industrial control system from potential threats and attacks. In this process, an accurate and clear description of the protocol data model is crucial for parsing protocol messages, generating protocol messages, writing protocol documents or performing static analysis.

[0003] In the field of protocol fuzz testing, generation-based technology has always been the mainstream. This technology relies on predefined data models to generate a large number of test inputs that conform to the protocol to test the deep processing logic of the protocol. In contrast, the bit / byte mutations used by mutation-based fuzz testing technology often destroy the structure of the protocol message, resulting in the generated mutant message failing to pass the structural rule check in the protocol parsing phase. The Peach fuzz testing framework is a representative of generation-based technology. It describes the data model and state model by defining Pits files. These XML definition files detail the test state message structure, state jumps, message sending order, and configuration parameters of the fuzz testing system. However, these Pits files need to be manually written and prepared by the tester, which is a time-consuming and error-prone process.

[0004] In order to improve the accuracy of protocol description and development efficiency, a protocol testing method based on paradigm grammar has been introduced. This method uses a formal grammatical description to define the grammatical rules of the protocol, thereby automatically generating test cases to verify and test the implementation of the protocol. For example, a protocol described using the Augmented Backus-Naur Form (ABNF) can generate a variety of legal and illegal inputs to test the robustness and fault tolerance of the protocol implementation. However, traditional industrial control protocol descriptions are usually based on documents or natural languages, which are ambiguous, vague, or incomplete, making it difficult for developers to accurately understand and implement the protocol. In addition, the process of manually implementing protocol parsing and code generation is not only error-prone, but also time-consuming and labor-intensive. Summary of the invention

[0005] The present invention proposes a method and system for automatically generating industrial control protocol paradigm grammar based on flow analysis, which solves the problem that manual protocol parsing and generation is prone to errors and is time-consuming and labor-intensive.

[0006] In order to solve the above technical problems, the present invention provides a method for automatically generating an industrial control protocol paradigm grammar based on traffic analysis, comprising the following steps:

[0007] Step S1: Capture a data packet sequence in the industrial control system, and extract the protocol name, field name, field type and field size of each data packet in the data packet sequence;

[0008] Step S2: construct a data model for each data packet: take the protocol name corresponding to the data packet as the root node, take the field name as the child node, take the field type and field size as the leaf nodes corresponding to the field name;

[0009] Step S3: extract the common parts of all data models to obtain a general data model, traverse the general data model, and obtain a paradigm grammatical description of the industrial control protocol.

[0010] Preferably, the method for traversing the general data model in step S3 comprises the following steps:

[0011] Step S31: Initialize a queue, obtain the root node of the general data model, and add the root node to the queue;

[0012] Step S32: taking the first node from the queue as the current node, determining whether the current node has a child node, if so, executing step S33, otherwise executing step S34;

[0013] Step S33: traverse all child nodes of the current node, add each child node to the queue, describe all child nodes based on the paradigm grammar rules, and output the name of the current node and the description of all child nodes;

[0014] Step S34: if the field size of the current node is determined, the name, size and type of the current node are output; if the field size of the current node is uncertain, the name and type of the current node are output, and the node is marked as a duplicate type;

[0015] Step S35: Repeat steps S32 to S34 until the queue is empty, and obtain the paradigm grammatical description of the industrial control protocol.

[0016] Preferably, the step S33 of describing all child nodes based on the normal form grammar rules comprises the following steps: if an extended Basque Normal Form ABNF description is generated, the names of all child nodes are concatenated using spaces; if an extended Backus-Naur Form EBNF description is generated, the names of all child nodes are concatenated using commas.

[0017] Preferably, marking the node as a repetitive type in step S34 comprises the following steps: if an extended Basque Naur Form ABNF description is generated, "*" is used to indicate repetition; if an extended Backus-Naur Form EBNF description is generated, "{}" is used to indicate repetition.

[0018] Preferably, in step S1, a packet capture tool is used to capture a sequence of protocol data packets in the industrial control system.

[0019] Preferably, in step S1, a data packet parsing tool is used to extract the field name and field type in each data packet of the data packet sequence.

[0020] A system for automatically generating industrial control protocol paradigm grammar based on traffic analysis is implemented based on the above-mentioned method for automatically generating industrial control protocol paradigm grammar based on traffic analysis, and includes: a data packet capture module, a data packet analysis module, a data model generation module and a paradigm grammar generation module;

[0021] The data packet capture module is used to capture and record data packets in different scenarios of the industrial control system, and save the data packet sequence generated by the interaction between the industrial control protocol client and the server according to the sending order of the data packets;

[0022] The data packet analysis module is used to parse the data packet sequence and extract the protocol name, field name, field type and field size of each data packet in the data packet sequence;

[0023] The data model generation module constructs a data model for each data packet by taking the protocol name as the root node, the field name as the child node, and the field type and field size as the leaf nodes corresponding to the field name;

[0024] The paradigm grammar generation module extracts the common parts of all data models to obtain a general data model, traverses the general data model, and obtains a paradigm grammar description of the industrial control protocol.

[0025] The present invention further provides a storage medium, which is applied to an electronic device, and the storage medium carries one or more computer programs. When the one or more computer programs are executed by the electronic device, the electronic device can implement the above-mentioned method for automatically generating industrial control protocol paradigm grammar based on traffic analysis.

[0026] The benefits of the present invention include at least:

[0027] By automatically capturing and extracting field information from data packets, the integrity and accuracy of the data are ensured; by building a data model, complex data packet information is converted into a structured format for easy understanding and processing; by sorting and extracting the common parts of the data model, a common data model is generated, which helps to identify and define the core structure of the protocol, and further automatically generates a paradigm grammar description to ensure the comprehensiveness and applicability of the description. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 A schematic diagram of a method flow of an embodiment of the present invention;

[0029] Figure 2 A schematic diagram of a data packet sequence according to an embodiment of the present invention;

[0030] Figure 3 A schematic diagram of a data model according to an embodiment of the present invention;

[0031] Figure 4 The data model of the ModbusTCP protocol message of the embodiment of the present invention;

[0032] Figure 5 ABNF description of the ModbusTCP protocol of the embodiment of the present invention;

[0033] Figure 6 EBNF description of the Ethernet / IP protocol of the embodiment of the present invention;

[0034] Figure 7 Schematic diagram of the system structure of an embodiment of the present invention. DETAILED DESCRIPTION

[0035] The following is a clear and complete description of the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work belong to the protection scope of the present invention.

[0036] Traffic capture and analysis technology for industrial control protocols is an important tool in the field of network security. It is used to monitor, record and analyze communication traffic in industrial control systems, which helps to gain a deeper understanding of the communication behavior of industrial control protocols, detect security threats, discover potential vulnerabilities and optimize system performance. A common method for capturing industrial control protocol traffic is to use network traffic capture tools. These tools can capture communication data packets on the network where the industrial control system is located, and then use parsing tools to parse out detailed protocol messages, fields and data content. By analyzing the captured traffic, you can gain a deeper understanding of the communication process, data format and interaction rules of the industrial control protocol, which helps to identify abnormal traffic, detect potential attack behaviors and analyze problems in communication.

[0037] Paradigm grammar is a formal grammar description method used to describe the structure and grammatical rules of industrial control protocols. It defines the data types, message formats and communication specifications in the protocol. By describing the industrial control protocol with the paradigm grammar, each part of the protocol can be clearly defined, including the message header, message body, fields and data types. This description method makes the parsing and generation of industrial control protocols more reliable and efficient, and also provides a basis for the security and interoperability of the protocol. It is an important tool for industrial control system development and security analysis.

[0038] Based on the above background, the embodiment of the present invention proposes a method for automatically generating an industrial control protocol paradigm grammar based on traffic analysis, such as Figure 1 As shown, the following steps are included:

[0039] Step S1: Capture and record the data packet sequence in different scenarios of the industrial control system. The acquisition of the data packet sequence can be achieved through a network sniffer or a special traffic capture tool. Use the packet capture tool to capture the data packets sent when the industrial control protocol devices communicate with each other, and use Figure 2 The file is saved as a .pcap file as shown.

[0040] As a format for capturing network data packets, .pcap files can save the data packet sequence generated by the interaction between the client and server of the industrial control protocol in the order in which the data packets are sent. Each data packet is stored in a specific format, including the header information and the payload of the data packet. The data packets are stored in the order in which they are captured in the network. The captured data packet sequence usually contains typical communication sessions and data exchanges. Analyzing it can accurately understand the industrial control protocol. In order to obtain different types of data models of the protocol, it is necessary to capture the traffic of the industrial control system in different scenarios to obtain multiple data packet sequences.

[0041] Step S2: by parsing the captured data packet sequence, converting the format information in the data packet into a processable form, and constructing a data model for each data packet.

[0042] Specifically, by using the data packet parsing tool to analyze the data packet, the various layers of the industrial control protocol data packet can be parsed, including the physical layer, data link layer, network layer, and transport layer. During the parsing process, the protocol name, field name, field type, and field size in the data packet can be extracted, thereby obtaining the basic format information of the protocol data packet. By using the name of the industrial control protocol as the root node, the field name as the child node, and the field type and field size as the leaf nodes of the corresponding field name, the data packet can be converted into Figure 3 The data model of the protocol message shown in FIG. The data model represents the structure and hierarchical relationship of the message. Each node in the data model corresponds to a part of the message, and each node has two attributes: type and size. This process involves mapping the parsed data packet format information to the nodes and subnodes of the data model, thereby establishing a hierarchical relationship between them.

[0043] After structural analysis of all packets in the packet sequence, a data model sequence consisting of multiple data models is obtained. The order of the data model sequence reflects the order in which packets are sent during the protocol interaction process. Due to the different interaction depths between the client and server of the protocol in different scenarios, deep conversations will involve more different types of packets. There may be packets with the same structure and interaction order in different packet sequences. The values ​​of these packets may be different but the structure is the same. By summarizing the data models corresponding to these packets with the same structure, a general data model of this packet can be obtained. The nodes of the general data model have three attributes: name, type, and size.

[0044] Step S3: extract the common parts of all data models respectively to obtain the general data model of the industrial control protocol, and traverse the general data model to obtain the paradigm grammar description of the industrial control protocol, wherein the paradigm grammar description can be in the form of ABNF or EBNF.

[0045] Specifically, traversing the general data model includes the following steps:

[0046] Step S31: Initialize a queue, obtain the root node of the general data model, and add the root node to the queue.

[0047] Step S32: Take the first node from the queue as the current node, and determine whether the current node has child nodes. If so, execute step S33; otherwise, execute step S34.

[0048] Step S33: traverse all child nodes of the current node, add each child node to the queue, and if it is necessary to generate an extended Basque Normal Form ABNF description, use spaces to concatenate the names of all child nodes; if it is necessary to generate an extended Backus-Naur Form EBNF description, use commas to concatenate the names of all child nodes; finally, output the name of the current node and the descriptions of all child nodes.

[0049] Step S34: If the field size of the current node is determined, the name, size and type of the current node are output, where the name of the node and the size and type of the node are connected by "="; if the field size of the current node is uncertain, the name and type of the current node are output, and the node is marked as a repeated type. For ABNF description, "*" is used to indicate repetition; for EBNF description, "{}" is used to indicate repetition.

[0050] Step S35: Repeat steps S32 to S34 until the queue is empty, add definitions of all data types contained in the protocol field from the predefined data type library, and obtain a paradigm grammatical description of the industrial control protocol.

[0051] The example of the present invention selects the ModbusTCP protocol to illustrate the technical effect. First, the traffic packet capture tool Wireshark is used to capture the data packets generated during the interaction between the client and the server in different application scenarios of the ModbusTCP protocol, and multiple ModbusTCP data packet sequences are saved in the form of .pcap files. The saved data packet sequences are then parsed by the protocol data packet parsing tool to obtain the data model of each fragment of the message and the value. The data model stores the basic structure of the ModbusTCP protocol in the form of a syntax tree, in which the leaf nodes of the tree correspond to each field of the ModbusTCP protocol, and the nodes save the name and value of the message fragment. Then, extract the following from the data models of all messages: Figure 4 The general data model of the ModbusTCP protocol shown in FIG. 1 has two attributes, type and size, which correspond to the constituent units of the message fragment and the number of units, respectively.

[0052] After obtaining the message structure and general data model of the ModbusTCP protocol, the ModbusTCP protocol paradigm grammar description is generated through the paradigm grammar generation algorithm, and the definitions of all data types contained in the protocol field are added from the predefined data type library, and finally the following is obtained: Figure 5 The ABNF description of the general data model of the ModbusTCP protocol shown in the figure, wherein BIT is a bit and BYTE is a byte, both of which are the constituent units of the message fragment. Through the paradigm grammar description, the message specification of the ModbusTCP protocol can be clearly understood, wherein the ModbusTCP message is composed of a message header MBAP_Header and a frame structure PDU. MBAP_Header includes a transaction processing identifier Transaction_ID, a protocol identifier Protocol_ID, a length Length and a unit identifier Unit_ID. PDU includes a function code Function_Code and data Data, and PDU reflects the unit and length of each part. Through the method of the embodiment of the present invention, the ModbusTCP protocol paradigm grammar description can be generated with the ModbusTCP protocol flow as input without understanding the ModbusTCP protocol specification, thereby solving the problem of the difficulty of manually writing the industrial control protocol paradigm grammar description, and achieving the effect of automatically generating the ModbusTCP protocol paradigm grammar and accurately describing the protocol specification.

[0053] The method of the embodiment of the present invention can also be used to obtain Figure 6 The EBNF description of the Ethernet / IP protocol is shown.

[0054] The invention provides a method for automatically generating a paradigm grammar of an industrial control protocol based on flow analysis, which can automatically generate a paradigm grammar description of an industrial control protocol, thereby reducing grammatical errors and loopholes caused by human errors or negligence. The automatically generated paradigm grammar description can follow consistent specifications and standards, reduce errors that may occur during manual writing, and provide accurate protocol specifications.

[0055] like Figure 7 As shown, an embodiment of the present invention also provides an automatic generation system of industrial control protocol paradigm grammar based on traffic analysis, which is implemented based on the above-mentioned automatic generation method of industrial control protocol paradigm grammar based on traffic analysis, and includes: a data packet capture module, a data packet analysis module, a data model generation module and a paradigm grammar generation module.

[0056] The data packet capture module is used to capture and record data packets in different scenarios of the industrial control system, and save the data packet sequence generated by the interaction between the industrial control protocol client and server according to the order in which the data packets are sent.

[0057] The data packet analysis module is used to parse the captured data packet sequence and extract the protocol name, field name, field type and field size of each data packet in the data packet sequence.

[0058] The data model generation module builds a data model for each data packet by taking the protocol name as the root node, the field name as the child node, and the field type and field size as the leaf nodes of the corresponding field name.

[0059] The paradigm grammar generation module is used to extract the common parts of all data models to obtain a general data model. By traversing the general data model, a paradigm grammar description of the industrial control protocol can be obtained.

[0060] An embodiment of the present invention also provides an electronic device, comprising at least one processor and a memory connected to the processor, the memory being used to store computer programs or instructions; the processor being used to execute the computer programs or instructions so that the electronic device implements the above-mentioned method for automatically generating industrial control protocol paradigm grammar based on traffic analysis.

[0061] The present invention further provides a storage medium, which is applied to an electronic device, and the storage medium carries one or more computer programs. When the one or more computer programs are executed by the electronic device, the electronic device can implement the above-mentioned method for automatically generating industrial control protocol paradigm grammar based on traffic analysis.

[0062] The technical features of the above embodiments can be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. Only the preferred embodiments of the present invention are expressed. The description is more specific and detailed, but it cannot be understood as limiting the scope of the patent of the present invention. As long as there is no contradiction in the combination of these technical features, they should be considered as the scope recorded in this specification.

[0063] It should be noted that, for those skilled in the art, several modifications and improvements can be made without departing from the concept of the present invention, and these modifications and improvements all belong to the protection scope of the present invention. Therefore, the protection scope of the patent of the present invention shall be subject to the attached claims.

Claims

1. A method for automatically generating industrial control protocol paradigm grammar based on traffic analysis, characterized in that: The following steps are involved: Step S1: Capture a data packet sequence in the industrial control system, and extract the protocol name, field name, field type and field size of each data packet in the data packet sequence; Step S2: construct a data model for each data packet: take the protocol name corresponding to the data packet as the root node, take the field name as the child node, take the field type and field size as the leaf nodes corresponding to the field name; Step S3: extract the common parts of all data models to obtain a general data model, traverse the general data model, and obtain a paradigm grammatical description of the industrial control protocol.

2. According to the method for automatically generating industrial control protocol paradigm grammar based on traffic analysis according to claim 1, it is characterized by: The method for traversing the general data model in step S3 includes the following steps: Step S31: Initialize a queue, obtain the root node of the general data model, and add the root node to the queue; Step S32: taking the first node from the queue as the current node, determining whether the current node has a child node, if so, executing step S33, otherwise executing step S34; Step S33: traverse all child nodes of the current node, add each child node to the queue, describe all child nodes based on the paradigm grammar rules, and output the name of the current node and the description of all child nodes; Step S34: if the field size of the current node is determined, the name, size and type of the current node are output; if the field size of the current node is uncertain, the name and type of the current node are output, and the node is marked as a duplicate type; Step S35: Repeat steps S32 to S34 until the queue is empty, and obtain the paradigm grammatical description of the industrial control protocol.

3. The method for automatically generating industrial control protocol paradigm grammar based on traffic analysis according to claim 2 is characterized in that: Describing all child nodes based on the normal form grammar rules in step S33 includes the following steps: if an extended Basque Normal Form ABNF description is generated, the names of all child nodes are concatenated using spaces; if an extended Backus-Naur Form EBNF description is generated, the names of all child nodes are concatenated using commas.

4. The method for automatically generating industrial control protocol paradigm grammar based on traffic analysis according to claim 2 is characterized in that: Marking the node as a repetition type in step S34 includes the following steps: if an extended Basque Normal Form ABNF description is generated, "*" is used to indicate repetition; if an extended Backus-Naur Form EBNF description is generated, "{}" is used to indicate repetition.

5. The method for automatically generating industrial control protocol paradigm grammar based on traffic analysis according to claim 1 is characterized in that: In step S1, a packet capture tool is used to capture a sequence of protocol data packets in the industrial control system.

6. The method for automatically generating industrial control protocol paradigm grammar based on traffic analysis according to claim 1 is characterized in that: In step S1, a data packet parsing tool is used to extract the field name and field type in each data packet of the data packet sequence.

7. A system for automatically generating industrial control protocol paradigm grammar based on traffic analysis, which is implemented based on a method for automatically generating industrial control protocol paradigm grammar based on traffic analysis as claimed in any one of claims 1 to 6, characterized in that: include: Data packet capture module, data packet analysis module, data model generation module and paradigm grammar generation module; The data packet capture module is used to capture and record data packets in different scenarios of the industrial control system, and save the data packet sequence generated by the interaction between the industrial control protocol client and the server according to the sending order of the data packets; The data packet analysis module is used to parse the data packet sequence and extract the protocol name, field name, field type and field size of each data packet in the data packet sequence; The data model generation module constructs a data model for each data packet by taking the protocol name as the root node, the field name as the child node, and the field type and field size as the leaf nodes corresponding to the field name; The paradigm grammar generation module extracts the common parts of all data models to obtain a general data model, traverses the general data model, and obtains a paradigm grammar description of the industrial control protocol.

8. An electronic device, characterized in that: It includes at least one processor and a memory connected to the processor, wherein the memory is used to store computer programs or instructions; the processor is used to execute the computer program or instructions so that the electronic device implements a method for automatically generating an industrial control protocol paradigm grammar based on traffic analysis as described in any one of claims 1 to 6.

9. A storage medium, applied to an electronic device, characterized in that: The storage medium carries one or more computer programs. When the one or more computer programs are executed by the electronic device, the electronic device can implement a method for automatically generating an industrial control protocol paradigm grammar based on traffic analysis as described in any one of claims 1 to 6.

Images