State machine inference method and system for industrial control private protocol

Abstract

The invention relates to the technical field of networks, in particular to a state machine inference method and system for an industrial control private protocol, and the method comprises the steps: collecting a protocol data packet related to industrial control equipment, carrying out the preprocessing of the data packet, extracting the message content and timestamp of the data packet related to a target protocol, and constructing a message sequence; obtaining a message content length and a request response message length according to the message sequence, performing label labeling on a protocol message type according to the request response message length, and storing a message type label and a corresponding message by using a labeling dictionary; sorting the marked message types according to timestamps in the message sequence, and determining a transfer relationship between different states of the protocol based on the message types adjacent in time, so as to construct a protocol state machine according to the transfer relationship between the states; and replaying protocol messages of the same type to the industrial control equipment according to the protocol state machine, and determining and removing abnormal state transition in the protocol state according to the response of the industrial control equipment. According to the invention, the overall performance and efficiency of protocol inference can be improved.

Description

Technical Field

[0001] The present invention relates to the field of network technology, and in particular to a state machine inference method and system for industrial control private protocols. Background Art

[0002] The protocol state machine is the interaction between protocol entities. It is a model that describes the relationship between protocols by converting between protocol states through certain behavioral characteristics. It often presents a graph or tree structure, with nodes representing states and edges between adjacent nodes representing different types of message fragments. Protocol state machine inference refers to inferring the structure and rules of its internal state machine by analyzing the behavior of a system or protocol. This is very important in the fields of computer science and network security, especially in protocol analysis, system verification, vulnerability detection, and performance optimization. Protocol state machine inference methods are divided into active inference and passive inference. Active inference infers the state machine by sending specific inputs or requests to the system and observing the system's response. Common methods include fuzz testing and protocol testing. Passive inference infers the state machine by observing the interaction and behavior of the system in normal operation. Common methods include log analysis and traffic analysis. Since the format of industrial control private protocols is unknown, it is impossible to generate valid test cases for active inference. Therefore, the state machine inference method for industrial control protocols is usually carried out in a passive way. At present, the mainstream method is to find the state-related fields in the protocol message for state labeling through sequence alignment, statistical analysis, frequent item mining and other technologies, and then build a prefix tree to infer the protocol state machine based on the temporal relationship of the transition between each state.

[0003] Each byte, or even each bit, in existing industrial protocols has different functions and meanings. In addition, the functions of some protocols are determined by multiple interrelated fields. These protocol messages usually lack separators, which poses a challenge to current methods (such as sequence alignment, statistical analysis, and frequent item mining) and cannot accurately identify state-related fields used for state marking. In addition, industrial protocols need to generate a large amount of interactive data in a short period of time in order to transmit control information and monitoring data in a timely manner; however, when using the prefix tree structure to build a protocol state machine, a large number of sessions may cause the prefix tree to be too large, requiring a large number of comparison operations in the state machine optimization stage, greatly increasing the time required for state machine inference, affecting the overall performance and efficiency of the system. For this reason, there is an urgent need for a means to accurately mark the protocol state when the industrial control protocol format is unknown, so as to improve the performance and inference efficiency of the protocol state machine. Summary of the invention

[0004] To this end, the present invention provides a state machine inference method and system for industrial control private protocols to solve the problems of the inability to accurately label the protocol state inference efficiency and the unsatisfactory process of the existing protocol state machine inference process.

[0005] According to the design scheme provided by the present invention, on the one hand, a state machine inference method for an industrial control private protocol is provided, comprising:

[0006] Collecting industrial control equipment related protocol data packets and preprocessing the data packets, so as to extract the data packet message content and timestamp related to the target protocol through preprocessing, and constructing a message sequence based on the message content and timestamp;

[0007] Obtain the message content length and the request and response message length according to the message sequence, label the protocol message type according to the request and response message length, and use the label dictionary to store the message type label and the corresponding message, where the key in the label dictionary is the labeled message type label, and the value is all request and response messages corresponding to the message type label;

[0008] Sort the marked message types according to the timestamps in the message sequence, determine the transition relationship between different states of the protocol based on the message types adjacent in time, and construct a protocol state machine according to the transition relationship between the states;

[0009] The same type of protocol message is replayed to the industrial control device according to the protocol state machine, and the abnormal state transition in the protocol state is determined and removed according to the response of the industrial control device.

[0010] As a state machine inference method for industrial control private protocols of the present invention, further, collecting industrial control equipment protocol data packets includes:

[0011] The interaction data packets between the programming software and the industrial control equipment in the target area are captured from the real industrial control environment, and the public protocol data packets are collected from the Internet. The captured interaction data packets and the collected public protocol data packets are used as the industrial control equipment related protocol data packets.

[0012] As a state machine inference method for industrial control private protocols of the present invention, further, preprocessing of data packets includes:

[0013] The packet quadruple is used to filter out the packets irrelevant to the target protocol from the industrial control equipment related protocol packets, the remaining packets in the industrial control equipment related protocol packets are taken as the packets related to the target protocol, and the message content and timestamp in the packets related to the target protocol are extracted.

[0014] As a state machine inference method for industrial control private protocols of the present invention, further, a tag dictionary is used to store message type tags and corresponding messages, including:

[0015] Initialize the status annotation dictionary, generate a message type tag according to the request message length and the response message length, if the message type tag does not exist in the status annotation dictionary, add the message type tag to the status annotation dictionary, and set the key corresponding value in the status annotation dictionary to an empty list, add the request message and the response message to the message type tag corresponding list, and traverse the next pair of request and response messages until the request and response messages are traversed and the status annotation dictionary is obtained.

[0016] As a state machine inference method for industrial control private protocols of the present invention, further, a protocol state machine is constructed according to the transition relationship between states, including:

[0017] The message type is used as the driving condition for state transfer, and the protocol state machine is generated according to the state transfer driving principle and a directed graph structure. The state transfer driving principle includes: the same message type causes the protocol to enter the same state, and different message types cause the protocol to enter different states.

[0018] As a state machine inference method for industrial control private protocols of the present invention, further, a protocol state machine is constructed according to the transition relationship between states, and further includes:

[0019] Initialize the protocol state machine and mapping table, create an initial state and add it to the protocol state machine, and set the initial state as the current state;

[0020] Traverse all message types. If the message type appears for the first time, create a new state and transfer the current state to the new state. Set the new state as the current state and record the mapping relationship between the message type and the new state in the mapping table. If the message type does not appear for the first time, query the corresponding protocol state of the message type from the mapping table, transfer the current state to the corresponding protocol state, and set the corresponding protocol state as the current state.

[0021] Until all message types are traversed, the final complete protocol state machine is obtained.

[0022] As a state machine inference method for industrial control private protocols of the present invention, further, determining and removing abnormal state transitions in the protocol state according to the response of the industrial control device includes:

[0023] According to the protocol state machine, the request messages of the same type corresponding to the conversion conditions are replayed to the industrial control device one by one to determine whether the response of the industrial control device is consistent with the response corresponding to the request message;

[0024] If the response messages are consistent, it is determined that the state transfer process in the protocol state machine is correct, and the request message corresponding to the next transition condition is played back;

[0025] If the response messages are inconsistent, the state transfer process in the protocol state machine is determined to be abnormal, and the request response message is deleted from the current message type, the request response message is marked as a new message type and the protocol state machine is rebuilt;

[0026] Until the request message traversal is completed after being replayed to the industrial control devices one by one.

[0027] On the other hand, the present invention also provides a state machine inference system for industrial control private protocols, comprising: a data processing module, a message marking module, a state machine construction module and an exception handling module, wherein:

[0028] A data processing module is used to collect data packets of industrial control equipment related protocols and pre-process the data packets, so as to extract the message content and timestamp of the data packets related to the target protocol through pre-processing, and construct a message sequence based on the message content and timestamp;

[0029] A message labeling module is used to obtain the message content length and the request response message length according to the message sequence, label the protocol message type according to the request response message length, and store the message type label and the corresponding message using a labeling dictionary, wherein the key in the labeling dictionary is the labeled message type label, and the value is all request response messages corresponding to the message type label;

[0030] A state machine construction module is used to sort the marked message types according to the timestamps in the message sequence, determine the transition relationship between different states of the protocol based on the message types adjacent in time, and construct the protocol state machine according to the transition relationship between the states;

[0031] The exception handling module is used to replay the same type of protocol messages to the industrial control device according to the protocol state machine, and determine and remove the abnormal state transition in the protocol state according to the response of the industrial control device.

[0032] Beneficial effects of the present invention:

[0033] The present invention is directed to a state machine inference method and system for industrial control private protocols. The format structure of industrial control private protocols is special, each byte or even each bit has different functions and meanings, and there is no separator, which causes the current protocol state machine inference method to be unable to accurately mark the protocol state related fields. By utilizing the highly structured protocol characteristics of industrial protocols, protocol messages of different lengths usually represent different types of messages, and the message type can be marked without identifying the protocol state related fields, thereby achieving accurate marking of the protocol state. In addition, in view of the fact that industrial protocols need to generate a large number of interactive messages of control information and monitoring data in a short period of time, the existing protocol state machine inference method causes the prefix tree to be too large, and the performance and efficiency are low when the prefix tree structure is used to construct the protocol state machine. By constructing the protocol state machine using the structure of a directed graph on the basis of completing the message type marking, and using the marked message type as the driving condition for the protocol state conversion, the problems faced by the prefix tree structure can be effectively avoided, and the overall performance and efficiency can be improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 This is a schematic diagram of the state machine inference process for the industrial control private protocol in the embodiment;

[0035] Figure 2 This is a schematic diagram of the state labeling algorithm process in the embodiment;

[0036] Figure 3 The following is a schematic diagram of the algorithm flow for constructing the protocol state machine in the embodiment. DETAILED DESCRIPTION

[0037] In order to make the purpose, technical solutions and advantages of the present invention clearer and more understandable, the present invention is further described in detail below in conjunction with the accompanying drawings and technical solutions.

[0038] Embodiments of the present invention, see Figure 1 As shown, a state machine inference method for industrial control private protocols is provided, including:

[0039] S101, collecting industrial control equipment related protocol data packets and preprocessing the data packets, so as to extract the data packet message content and timestamp related to the target protocol through preprocessing, and constructing a message sequence based on the message content and timestamp.

[0040] Considering the complexity and diversity of the protocol state transfer process, in order to build as many state transfer paths as possible, a large number of data packets are required as input. Specifically, the interaction data packets between the programming software and the industrial control equipment in the target area can be captured from the real industrial control environment, and the public protocol data packets can be collected from Internet platforms such as Github. The captured interaction data packets and the collected public protocol data packets are used as the industrial control equipment related protocol data packets.

[0041] Among them, for the collected industrial control equipment related protocol data packets, the data packet quadruple (IP address, port number, timestamp, message content) can be used to filter out data packets that are not related to the target protocol from the industrial control equipment related protocol data packets, and the remaining data packets in the industrial control equipment related protocol data packets are used as data packets related to the target protocol, and the message content and timestamp in the data packets related to the target protocol are extracted, and a message sequence is constructed based on the obtained message content.

[0042] S102. Obtain the message content length and the request and response message length according to the message sequence, label the protocol message type according to the request and response message length, and use a labeling dictionary to store the message type label and the corresponding message, wherein the key in the labeling dictionary is the labeled message type label, and the value is all request and response messages corresponding to the message type label.

[0043] According to the length of the request and response messages, different message type annotation rules can be designed to annotate the protocol messages. For example, by comparing the length of the request message, if the length of the request message is different, the message type is different; if the length of the request message is the same, then further compare the corresponding response message length, if the length of the response message is different, the message type is different.

[0044] Specifically, the message type labels and corresponding messages are stored using the annotation dictionary, such as Figure 2 As shown, it can be designed to include:

[0045] Initialize the status annotation dictionary, generate a message type tag according to the request message length and the response message length, if the message type tag does not exist in the status annotation dictionary, add the message type tag to the status annotation dictionary, and set the key corresponding value in the status annotation dictionary to an empty list, add the request message and the response message to the message type tag corresponding list, and traverse the next pair of request and response messages until the request and response messages are traversed and the status annotation dictionary is obtained.

[0046] S103, sorting the marked message types according to the timestamps in the message sequence, determining the transition relationship between different states of the protocol based on the message types adjacent in time, and constructing a protocol state machine according to the transition relationship between the states.

[0047] According to the timestamp of the captured message, the marked message types are sorted according to the corresponding timestamps, and there is a state transition relationship between the message types that are adjacent in time. Specifically, the message type is used as the driving condition for the state transition, and the protocol state machine is generated according to the state transition driving principle and a directed graph structure. The state transition driving principle includes: the same message type causes the protocol to enter the same state, and different message types cause the protocol to enter different states.

[0048] Among them, the protocol state machine is constructed according to the transfer relationship between states, such as Figure 3 As shown, it can also be designed to include:

[0049] Initialize the protocol state machine and mapping table, create an initial state and add it to the protocol state machine, and set the initial state as the current state;

[0050] Traverse all message types. If the message type appears for the first time, create a new state and transfer the current state to the new state. Set the new state as the current state and record the mapping relationship between the message type and the new state in the mapping table. If the message type does not appear for the first time, query the corresponding protocol state of the message type from the mapping table, transfer the current state to the corresponding protocol state, and set the corresponding protocol state as the current state.

[0051] Until all message types are traversed, the final complete protocol state machine is obtained.

[0052] Construct state machines for different session processes according to the above algorithm, and then merge the state machines according to the same message types in each state machine to finally generate a complete protocol state machine.

[0053] S104: replay the same type of protocol message to the industrial control device according to the protocol state machine, and determine and remove the abnormal state transition in the protocol state according to the response of the industrial control device.

[0054] Specifically, according to the protocol state machine, the request messages of the same type corresponding to the conversion conditions can be replayed to the industrial control equipment one by one to determine whether the response of the industrial control equipment is consistent with the response corresponding to the request message; if the response messages are consistent, the state transfer process in the protocol state machine is determined to be correct, and the request message corresponding to the next conversion condition is continued to be replayed; if the response messages are inconsistent, the state transfer process in the protocol state machine is determined to be abnormal, and the request response message is deleted from the current message type, the request response message is marked as a new message type and the protocol state machine is rebuilt; until the traversal of the request messages replayed one by one to the industrial control equipment is completed.

[0055] Furthermore, based on the above method, an embodiment of the present invention also provides a state machine inference system for industrial control private protocols, comprising: a data processing module, a message annotation module, a state machine construction module and an exception handling module, wherein:

[0056] A data processing module is used to collect data packets of industrial control equipment related protocols and pre-process the data packets, so as to extract the message content and timestamp of the data packets related to the target protocol through pre-processing, and construct a message sequence based on the message content and timestamp;

[0057] A message labeling module is used to obtain the message content length and the request response message length according to the message sequence, label the protocol message type according to the request response message length, and store the message type label and the corresponding message using a labeling dictionary, wherein the key in the labeling dictionary is the labeled message type label, and the value is all request response messages corresponding to the message type label;

[0058] A state machine construction module is used to sort the marked message types according to the timestamps in the message sequence, determine the transition relationship between different states of the protocol based on the message types adjacent in time, and construct the protocol state machine according to the transition relationship between the states;

[0059] The exception handling module is used to replay the same type of protocol messages to the industrial control device according to the protocol state machine, and determine and remove the abnormal state transition in the protocol state according to the response of the industrial control device.

[0060] State machine inference for industrial control private protocols needs to consider the complexity and diversity of the protocol state transition process. In order to build as many state transition paths as possible, a large number of data packets are required as input. To this end, this solution can capture the communication traffic between the programming software and the target industrial control equipment through tools such as Wireshark in the constructed industrial environment. On the other hand, it can also collect public protocol data packets from Internet platforms such as Github.

[0061] Based on the collected data packets, in the preprocessing step, the four-tuple (IP address, port number, timestamp, message content) is used to filter out data packets that are not related to the target protocol. At the same time, the message content and timestamp in the remaining data packets are extracted to construct a message sequence for protocol state machine inference.

[0062] use Figure 2 The state annotation algorithm shown in the figure annotates the request and response messages in the message sequence with the message type to obtain the state annotation dictionary. The protocol state machine construction algorithm is as follows: Figure 3 As shown, according to the state annotation dictionary and timestamp, the protocol state machine is constructed using a directed graph structure with the message type as the driving condition for state transition to obtain the initial protocol state machine.

[0063] Considering that in the process of protocol state annotation, different types of protocol messages may be incorrectly labeled as the same type due to the same length of request and response messages, the protocol state machine can be corrected by active interaction, which can be summarized as follows:

[0064] According to the constructed protocol state machine, the request messages of the same type corresponding to the conversion conditions are replayed to the industrial devices one by one to observe whether the responses of the industrial devices are consistent with the response messages corresponding to the request messages.

[0065] If they are consistent, it proves that the state transfer process is correct, that is, the message type is correctly marked, and then continue to replay the request message corresponding to the next transition condition; if they are inconsistent, it proves that the state transfer process is wrong, that is, the message type is wrongly marked, and then the request response message is deleted from the current message type and marked with a new message type. Figure 3 The method shown reconstructs the protocol state machine.

[0066] Repeat the above steps until all state transition conditions in the protocol state machine are traversed and completed, at which time the protocol state machine correction is completed.

[0067] Unless otherwise specifically stated, the relative steps, numerical expressions and values ​​of the components and steps set forth in these embodiments do not limit the scope of the present invention.

[0068] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the system disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0069] The units and method steps of each example described in conjunction with the embodiments disclosed herein can be implemented by electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. A person of ordinary skill in the art may use different methods to implement the described functions for each specific application, but such implementation is not considered to be beyond the scope of the present invention.

[0070] Those skilled in the art will appreciate that all or part of the steps in the above method can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium, such as a read-only memory, a disk or an optical disk. Optionally, all or part of the steps in the above embodiment can also be implemented using one or more integrated circuits, and accordingly, each module / unit in the above embodiment can be implemented in the form of hardware or in the form of software function modules. The present invention is not limited to any specific form of combination of hardware and software.

[0071] Finally, it should be noted that the above-described embodiments are only specific implementations of the present invention, which are used to illustrate the technical solutions of the present invention, rather than to limit them. The protection scope of the present invention is not limited thereto. Although the present invention is described in detail with reference to the above-described embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the above-described embodiments within the technical scope disclosed by the present invention, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. A state machine inference method for industrial control private protocols, characterized in that: Include: Collecting industrial control equipment related protocol data packets and preprocessing the data packets, so as to extract the data packet message content and timestamp related to the target protocol through preprocessing, and constructing a message sequence based on the message content and timestamp; Obtain the message content length and the request and response message length according to the message sequence, label the protocol message type according to the request and response message length, and use the label dictionary to store the message type label and the corresponding message, where the key in the label dictionary is the labeled message type label, and the value is all request and response messages corresponding to the message type label; Sort the marked message types according to the timestamps in the message sequence, determine the transition relationship between different states of the protocol based on the message types adjacent in time, and construct a protocol state machine according to the transition relationship between the states; The same type of protocol message is replayed to the industrial control device according to the protocol state machine, and the abnormal state transition in the protocol state is determined and removed according to the response of the industrial control device.

2. The state machine inference method for industrial control private protocol according to claim 1 is characterized in that: Collect industrial control equipment protocol data packets, including: The interaction data packets between the programming software and the industrial control equipment in the target area are captured from the real industrial control environment, and the public protocol data packets are collected from the Internet. The captured interaction data packets and the collected public protocol data packets are used as the industrial control equipment related protocol data packets.

3. The state machine inference method for industrial control private protocol according to claim 1 is characterized in that: Preprocess the data packets, including: The packet quadruple is used to filter out the packets irrelevant to the target protocol from the industrial control equipment related protocol packets, and the remaining packets in the industrial control equipment related protocol packets are taken as the packets related to the target protocol, and the message content and timestamp in the packets related to the target protocol are extracted.

4. The state machine inference method for industrial control private protocol according to claim 1, characterized in that: Use the annotation dictionary to store message type tags and corresponding messages, including: Initialize the status annotation dictionary, generate a message type tag according to the request message length and the response message length, if the message type tag does not exist in the status annotation dictionary, add the message type tag to the status annotation dictionary, and set the key corresponding value in the status annotation dictionary to an empty list, add the request message and the response message to the message type tag corresponding list, and traverse the next pair of request and response messages until the request and response messages are traversed and the status annotation dictionary is obtained.

5. The state machine inference method for industrial control private protocol according to claim 1 is characterized in that: The protocol state machine is constructed based on the transition relationship between states, including: The message type is used as the driving condition for state transfer, and the protocol state machine is generated according to the state transfer driving principle and a directed graph structure. The state transfer driving principle includes: the same message type causes the protocol to enter the same state, and different message types cause the protocol to enter different states.

6. The state machine inference method for industrial control private protocol according to claim 1 or 5, characterized in that: The protocol state machine is constructed based on the transfer relationship between states, and also includes: Initialize the protocol state machine and mapping table, create an initial state and add it to the protocol state machine, and set the initial state as the current state; Traverse all message types. If the message type appears for the first time, create a new state and transfer the current state to the new state. Set the new state as the current state and record the mapping relationship between the message type and the new state in the mapping table. If the message type does not appear for the first time, query the corresponding protocol state of the message type from the mapping table, transfer the current state to the corresponding protocol state, and set the corresponding protocol state as the current state. Until all message types are traversed, the final complete protocol state machine is obtained.

7. The state machine inference method for industrial control private protocol according to claim 1 is characterized in that: Determine and remove abnormal state transitions in the protocol state based on the response of the industrial control equipment, including: According to the protocol state machine, the request messages of the same type corresponding to the conversion conditions are replayed to the industrial control device one by one to determine whether the response of the industrial control device is consistent with the response corresponding to the request message; If the response messages are consistent, it is determined that the state transfer process in the protocol state machine is correct, and the request message corresponding to the next transition condition is played back; If the response messages are inconsistent, the state transfer process in the protocol state machine is determined to be abnormal, and the request response message is deleted from the current message type, the request response message is marked as a new message type and the protocol state machine is rebuilt; Until the request message traversal is completed after being replayed to the industrial control devices one by one.

8. A state machine inference system for industrial control private protocols, characterized in that: It includes: data processing module, message annotation module, state machine construction module and exception handling module, among which, A data processing module is used to collect data packets of industrial control equipment related protocols and pre-process the data packets, so as to extract the message content and timestamp of the data packets related to the target protocol through pre-processing, and construct a message sequence based on the message content and timestamp; A message labeling module is used to obtain the message content length and the request response message length according to the message sequence, label the protocol message type according to the request response message length, and store the message type label and the corresponding message using a labeling dictionary, wherein the key in the labeling dictionary is the labeled message type label, and the value is all request response messages corresponding to the message type label; A state machine construction module is used to sort the marked message types according to the timestamps in the message sequence, determine the transition relationship between different states of the protocol based on the message types adjacent in time, and construct the protocol state machine according to the transition relationship between the states; The exception handling module is used to replay the same type of protocol messages to the industrial control device according to the protocol state machine, and determine and remove the abnormal state transition in the protocol state according to the response of the industrial control device.

9. An electronic device, characterized in that: include: at least one processor, and a memory coupled to the at least one processor; The memory stores a computer program, and the computer program can be executed by the at least one processor to implement the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed, the method according to any one of claims 1 to 7 can be implemented.

Images