Industrial control protocol field division method based on protocol hierarchical analysis

Abstract

The invention relates to the technical field of industrial control system network security, in particular to an industrial control protocol field division method based on protocol hierarchical analysis, and the method comprises the steps: obtaining an industrial control protocol flow set containing a plurality of messages; reversely analyzing the first-layer protocol, determining an effective analysis range, executing field classification, and determining a field division range; dividing the protocol flow into a plurality of sets according to the first-layer function code, and respectively analyzing the second-layer Head and Body parts by each set; dividing the second layer of function code diversity into a plurality of sets, and respectively analyzing the third layer of Head and the remaining part by each set; and storing a three-layer protocol field division result and a field type label. The effective range is the first minimum byte of the message; field classification is realized by using variance, a least square method, FFT and the like according to a fixed value, a length, an increment value, a direction, a function code / session, a special value sequence and an irregular value sequence. According to the method, the field division accuracy is improved, and a protocol analysis basis is provided for industrial control network security.

Description

Technical Field

[0001] This invention belongs to the field of industrial control system network security technology, specifically involving a method for dividing industrial control protocol fields based on protocol layering parsing. Background Technology

[0002] Industrial control systems are the core architecture supporting the operation of critical infrastructures such as national energy, transportation, and chemical industries. Their security and stability are directly related to sustainable economic development, public safety, and even national defense strategic security, occupying an irreplaceable position in the overall national security system. Unlike ordinary IT networks, industrial control systems achieve direct control of physical devices through dedicated protocols, enabling deep integration into real-world industrial production processes. This makes cyberattacks against industrial control systems far more damaging than general cyberattacks. Ordinary cyberattacks are mostly limited to virtual-level losses such as data leaks and terminal device paralysis, while industrial control network attacks can directly affect the physical world. For example, malicious intrusion into traffic dispatch systems can cause road traffic accidents and complete paralysis of urban traffic, while attacks on the control systems of petrochemical enterprises may lead to explosions of production equipment and leaks of toxic chemicals, resulting in casualties and irreversible damage to the ecological environment.

[0003] To mitigate such security threats, the industrial control field currently employs protective measures such as network traffic auditing and real-time identification of malicious operations. The core prerequisite for the effective implementation of these measures lies in the reverse engineering of industrial control network traffic protocols. This technology requires analyzing protocol packets transmitted in the network to deduce the structural rules and semantic information of private or unpublished industrial control protocols, providing underlying technical support for security protection. However, industrial control protocols themselves have significant unique characteristics, such as strong proprietary nature, complex layered and nested logic, and the need to adapt to the low-power and high-real-time operating requirements of industrial equipment. This leads to numerous insurmountable bottlenecks in existing protocol reverse engineering technologies, including the following specific shortcomings: (1) Industrial control protocols often adopt a layered design. Specific control fields of the upper layer protocol directly determine the format and existence of the lower layer protocol. For example, in the Siemens S7Comm protocol, if the third byte of the COTP protocol is 0x80, then the third layer of S7Comm protocol exists; if it is 0x00, then this layer does not exist. However, the current automatic protocol reverse engineering method lacks the ability to adapt to this dynamic hierarchical association and cannot adjust the parsing logic according to the changes in the upper layer fields, resulting in inaccurate protocol structure parsing.

[0004] (2) Some reverse engineering solutions based on the Transformer model are based on the application of the model in the field of language translation. They attempt to reverse engineer unknown protocols after training a model with known protocols. However, in practice, if a model trained with known protocols is to be transferred to an unknown protocol, it is necessary to rebind word vectors and protocol fields or retrain the model. Both of these methods require the known protocol structure as a prerequisite, which fundamentally conflicts with the core goal of "reverse engineering unknown protocols", making the technical path untenable.

[0005] (3) Reverse engineering methods that rely on machine learning or deep learning often use single protocol messages as training data. This makes it difficult to effectively capture the inherent relationships between different fields in the same message, and also makes it difficult to identify the field change patterns across multiple messages in the protocol stream. Especially for field relationships that need to be reflected across a large number of protocol streams, such as 4-byte message sequence markers (with byte change periods of 1, 0x100, 0x10000, and 0x1000000 respectively), existing models cannot simultaneously cover the dual features within the message and between protocol streams, resulting in incomplete feature extraction.

[0006] (4) Traditional automatic protocol reverse engineering techniques divide fixed fields into fixed fields and variable fields by sequence comparison, but the division of variable fields is too coarse-grained. For example, the determination of the boundary of some variable-length data areas in industrial control protocols needs to be combined with function codes or other related fields. Existing methods cannot accurately identify such dynamic boundaries and can only make general divisions, which cannot meet the needs of fine parsing of industrial control protocols.

[0007] (5) When identifying incremental value fields through frequency response, for fields with a change period of 0x1000000 (such as instruction counters of some industrial equipment), a time series consisting of more than 0x1000000 parameters is required to calculate the correct frequency response. However, the computational power of existing frequency response algorithms is limited and cannot cope with such ultra-long sequence analysis, resulting in the failure of incremental value field identification.

[0008] (6) The semantics of some fields in the industrial control protocol depend on the context. For example, in the MODBUS protocol, the address field of the write memory protocol only has the semantics of "address" when it is used with a specific function code. When used with other function codes, it may represent different functions. In the write memory scenario, the address field and the value field are adjacent. If the two change at the same time in the protocol stream, the existing method cannot accurately divide the boundary by combining the context and the field association relationship, resulting in the error of field semantic recognition.

[0009] In view of this, the present invention is hereby proposed. Summary of the Invention

[0010] To address the aforementioned technical problems in the prior art, this invention provides a method for dividing industrial control protocol fields based on protocol layer parsing, which solves problems such as the prior art not considering the impact of protocol layer control fields, coarse division of variable fields, and defects in the identification of special fields.

[0011] To achieve the above objectives, the technical solution of the present invention is as follows: A method for partitioning industrial control protocol fields based on protocol layering parsing, characterized by comprising: S1. Obtain the set of industrial control protocol streams to be analyzed, wherein the set of protocol streams contains multiple industrial control protocol messages; S2. Reverse analyze the first-layer industrial control protocol, determine the effective analysis byte range corresponding to the first-layer industrial control protocol, perform field classification on the bytes within the effective analysis byte range, and determine the field division range of the first-layer industrial control protocol based on the classification results; S3. Reverse analyze the second-layer industrial control protocol. Based on the different values ​​of the function codes in the first-layer industrial control protocol, classify the industrial control protocol stream set into multiple second-layer protocol stream sets. For each second-layer protocol stream set, reverse analyze the Head part and Body part of the second-layer protocol respectively. Each part analysis includes: determining the effective analysis range of the corresponding part, performing field classification, and determining the field division range of the corresponding part based on the classification results. S4. Reversely analyze the third-layer industrial control protocol. Based on the different values ​​of the function codes in the second-layer industrial control protocol, further classify the second-layer protocol stream set obtained in step S3 into multiple third-layer protocol stream sets. For each set of the third-layer protocol streams, the Head part and the remaining part of the third-layer protocol are reverse parsed respectively. The parsing of each part includes: determining the effective analysis range of the corresponding part, performing field classification, and determining the field division range of the corresponding part based on the classification results. S5. Store the field division range results and corresponding field type label information for the first, second, and third layer industrial control protocols.

[0012] Furthermore, the determination of the effective analysis range includes: S21. Record the maximum value MAX_LEN_1 and the minimum value MIN_LEN_1 of the message length, and take the first MIN_LEN_1 bytes of the message as the effective analysis byte range of the first layer protocol; S22. Record the maximum length MAX_LEN_2_1 and minimum length MIN_LEN_2_1 of the remaining bytes, and take the first MIN_LEN_2_1 bytes of the remaining bytes as the effective analysis range of the second layer protocol Head part. S23. Record the maximum length MAX_LEN_2_2 and the minimum length MIN_LEN_2_2 of the remaining bytes, and take the first MIN_LEN_2_2 bytes of the remaining bytes as the effective analysis range of the Body part of the second layer protocol. S24. Record the maximum length MAX_LEN_3_1 and the minimum length MIN_LEN_3_1 of the remaining bytes, and take the first MIN_LEN_3_1 bytes of the remaining bytes as the effective analysis range of the third layer protocol Head part. S25. Record the maximum length MAX_LEN_3_2 and minimum length MIN_LEN_3_2 of the remaining bytes, and take the first MIN_LEN_3_2 bytes of the remaining bytes as the valid analysis range of the remaining part of the third layer protocol.

[0013] Furthermore, the field classification is determined according to the protocol field, and the protocol field determination includes: The system includes judgments on fixed value fields, length fields, incremental value fields, direction fields, function code fields and session fields, and fields with irregular values. Among these, the judgment of special fields is only applicable to the field classification of the third-layer protocol Head part.

[0014] Furthermore, the length field determination specifically includes: set up This represents the maximum message length of the protocol layer to which the current field belongs and its subordinate protocols within the corresponding protocol stream set; like Then, the two adjacent bytes to be analyzed are combined into two temporary combined fields using big-endian and little-endian modes respectively; if In this case, a single byte to be analyzed will be treated as a temporary combined field; For each temporary combined field Construct a two-dimensional feature point set ,in, For the first Temporary composite field of message The value, For the first The length of a message from the current protocol level to the end of the message; If the two-dimensional feature point set There exists If the element is not specified, then the two-dimensional feature point set is discarded. The least squares method is used to fit a straight line to the retained two-dimensional feature point set, and the deviation of all points in the point set from the fitted straight line is calculated. If the deviation is less than a preset threshold, the temporary combined field is a length field; otherwise, the temporary combined field is not a length field.

[0015] Furthermore, the determination of the incremental value field specifically includes: For each field to be analyzed Construct a one-dimensional gradient feature point set ,in, For the first Fields of a message The value; For the set of one-dimensional gradient feature points K-Medoids clustering algorithm is used for classification, and the number of clusters is set. ; After obtaining the three cluster centroids, if one centroid is zero, and the absolute value of the difference between the other two non-zero centroids lies within a neighborhood of 256, then the field to be analyzed is considered... For incremental value fields; otherwise, the field to be analyzed. Non-incremental value field.

[0016] Furthermore, the direction field determination specifically includes: The protocol streams are divided into two categories according to the communication direction: request streams and response streams. The variance of each field is calculated. If the variance of a field is 0 in both the request stream and the response stream, then the field is a direction field, and the direction field label of the field label vector is set to 1; otherwise, the direction field label of the field label vector is set to 2.

[0017] Furthermore, the determination of the function code field and session field specifically includes: Construct a two-dimensional point set of field n ,in, It is the value of field n in the request message of the m-th request-response message group. It is the value of field n in the response message of the m-th request-response message; The least squares method is used to fit a straight line, and the variance of the distance from the point to the fitted line is calculated. If the variance is less than the threshold of 0.5, the field may be a function code or session. Remove duplicate elements from the 2D point set, calculate the number of elements in the point set, and define the field with fewer than a preset threshold as the function code field, setting the function code field label in the field label vector to 1. Define the field with more than or equal to the preset threshold as the session field, setting the session field label in the field label vector to 1. If the variance is greater than or equal to the threshold of 0.5, set both the function code field label and the session field label of the field to 2.

[0018] Furthermore, the determination of the special field specifically includes: Design an industrial control configuration program, which controls the host computer and controller to perform the following periodic operations. The operation parameters are: sampling frequency 1Hz, controlled variable period 30s, and total sampling duration 10 minutes. Based on the protocol stream generated by the industrial control configuration program, a one-dimensional vector is constructed for each field n to be analyzed. The one-dimensional vector The elements are the fields of each message. The value; Construct a filter with a window length of 3 minutes, an amplitude of 1, and a square wave waveform; place the filter window onto the one-dimensional vector. Slide the slider up to calculate the fundamental frequency of the discrete signal using a Fast Fourier Transform (FFT) on each element within the window. ; Through formula Calculate the signal period N ( (where the sampling frequency is used), and the power spectrum of the FFT result is calculated to extract the fundamental frequency. The corresponding power; If the signal period N is equal to the controlled variable period, and the fundamental frequency... If the corresponding power is greater than 50% of the total power, then the signal within this window is a periodic signal; if the one-dimensional vector If at least one segment of the aforementioned periodic signal exists, then the field to be analyzed... It is a special field; otherwise, the field to be analyzed Non-special field.

[0019] Furthermore, the periodic operation includes: Within time interval 1, the controller configuration sets the value stored in a memory address to switch between two values, and the host computer configuration reads the memory address cyclically. Within time interval 2, the controller is configured to set two memory addresses, and the host computer is configured to read these memory addresses in a loop, reading one address at a time. Within time interval 3, the host computer repeatedly writes two values ​​to a memory address in the controller. Within time interval 4, the host computer writes the same value to two memory addresses in the controller's inner loop. Within time interval 5, the controller configuration sets the value stored in an I / O address to switch between two values, and the host computer configuration reads the I / O address cyclically. Within time interval 6, the controller is configured to set two I / O addresses, and the host computer is configured to read these I / O addresses in a loop, reading one address at a time. Within time interval 7, the host computer cyclically writes two values ​​to one I / O address in the controller. Within time interval 8, the host computer writes the same value to two I / O addresses in the controller's internal loop.

[0020] Furthermore, the determination of the fixed value field specifically includes: The protocol flow to be analyzed is grouped into a preset number of A messages. The last message of each group is the same as the first message of the next group. The last group is composed of the actual number of messages. Construct each group of messages For a matrix of dimension 1, calculate the variance of each column; for columns with non-zero variance, set the label of the non-fixed-value field to 2. After traversing all groups, set the fixed value field label corresponding to the byte with a fixed value field label of 0 to 1; merge adjacent fixed value fields with a fixed value field label of 1.

[0021] Compared with existing technologies, the present invention provides a method for dividing industrial control protocol fields based on protocol layering parsing. The method includes: acquiring a set of industrial control protocol streams containing multiple messages; reverse parsing the first-layer protocol, defining the effective analysis range, performing field classification, and determining the field division range; dividing the protocol stream into multiple sets according to the first-layer function codes, and parsing the second-layer Head and Body parts of each set; dividing the set into multiple sets according to the second-layer function codes, and parsing the third-layer Head and the remaining parts of each set; storing the three-layer protocol field division results and field type labels; taking the minimum number of bytes at the beginning of the message as the effective range; and classifying fields according to the order of fixed value, length, incremental value, direction, function code / session, special, and irregular values, using variance, least squares, K-Medoids clustering, FFT, etc. This invention improves the accuracy of field division and provides a protocol parsing foundation for industrial control network security. Attached Figure Description

[0022] Figure 1 A flowchart of the industrial control protocol field division method provided in the embodiments of the present invention; Figure 2 A flowchart for determining protocol fields provided in an embodiment of the present invention; Figure 3 A flowchart for determining the length field provided in an embodiment of the present invention; Figure 4 A flowchart for determining the incremental value field provided in an embodiment of the present invention; Figure 5 A flowchart for determining the direction field provided in an embodiment of the present invention; Figure 6 A flowchart for judging function codes and session fields provided in embodiments of the present invention; Figure 7 A flowchart for determining special fields provided in embodiments of the present invention. Detailed Implementation

[0023] The technical solution of the present invention will be clearly described below with reference to the accompanying drawings. Obviously, the described embodiments are not all embodiments of the present invention. All other embodiments obtained by those skilled in the art without creative effort are within the protection scope of the present invention.

[0024] It should be noted that, unless otherwise specifically stated, the relative arrangement and numerical expressions of the components and steps described in these embodiments should not be construed as limiting the scope of the invention.

[0025] The following description of exemplary embodiments is merely illustrative and is not intended to limit the invention or its application or use in any way. Techniques, methods, and apparatus known to those skilled in the art may not be discussed in detail herein, but where applicable, such techniques, methods, and apparatus should be considered part of this specification.

[0026] Example 1 See Figure 1 , Figure 1 This is a flowchart of a method for dividing industrial control protocol fields based on protocol layering parsing proposed in this invention. Specific steps may include: S1. Read in protocol stream: Obtain the set of industrial control protocol streams to be analyzed, wherein the set of protocol streams contains multiple industrial control protocol messages; The private industrial control protocol messages communicating between the host computer and the controller are captured from the industrial control network to form a set of industrial control protocol streams to be analyzed. This set needs to contain multiple consecutive industrial control protocol messages to meet the requirements of field feature extraction.

[0027] S2. First-layer protocol analysis: Reverse-parse the first-layer industrial control protocol to determine the effective analysis byte range corresponding to the first-layer industrial control protocol. Perform field classification on the bytes within the effective analysis byte range, and determine the field division range of the first-layer industrial control protocol based on the classification results. The methods for determining the effective analysis range include: S21. Valid byte range for the first-layer industrial control protocol: Traverse the packets corresponding to the first-layer protocol in the industrial control protocol stream set and record the maximum packet length. and minimum value Only the first part of each message is analyzed. This portion of bytes is considered as the valid byte range for analysis in the first-layer protocol. S22. Initialize the first-level field label matrix: Construct and initialize the field label vector as follows: A 3D matrix, where each row represents the classification result for a byte. Each row contains 9 components, in order: starting offset, field length, fixed value field label, length field label, incremental value field label, direction field label, function code field label, session field label, and random value field label. The initial value of the starting offset is the corresponding row number, and the initial value of the field length is 1. The status of the fixed value field label to the random value field label is divided into three types: "0", "1" and "2". "0" means unclassified, "1" means belonging to the category, and "2" means not belonging to the category.

[0028] S23. Perform field classification in sequence: Perform field classification on bytes within the valid analysis byte range in the following order; see [link / reference] Figure 2 The field classification is determined according to the protocol field, and the determination of the protocol field includes: The system includes judgments on fixed value fields, length fields, incremental value fields, direction fields, function code fields and session fields, and fields with irregular values. Among these, the judgment of special fields is only applicable to the field classification of the third-layer protocol Head part.

[0029] S231. Fixed value field judgment: The protocol streams to be analyzed are ordered sequentially, grouped into groups of A messages each. The last message in each group is the same as the first message in the next group. The messages in the last group are grouped according to the actual number of messages. The grouping is represented by the message sequence number, as follows: [1,A],[A,2A],[2A,3A],… Fill in the first group of messages The matrix is ​​of dimension LEN, where LEN is the length of the protocol message to be analyzed, and the rows in the matrix represent the messages to be analyzed. The variance of each column in the matrix is ​​calculated; if the variance is not 0, the fixed-value field label in the corresponding field label row vector is set to "2".

[0030] Repeat the above steps for each subsequent group until all groups have been traversed. Set all fixed-value field label 3 values ​​of "0" in the field label row vector to "1".

[0031] If two adjacent field row vectors in the field label vector have a fixed field label value of "1", merge the two field row vectors. Add the field length of the first field row vector to the field length of the second field row vector, and then delete the second field row vector.

[0032] S232, Length field judgment: See Figure 3Let MAX_LEN be the maximum length of the protocol layer to which the field belongs and its subordinate layers in the protocol stream set. If MAX_LEN is greater than 255, then adjacent fields are combined into two temporary combined fields using big-endian and little-endian modes. If MAX_LEN is not greater than 255, then a single-byte field is a temporary combined field.

[0033] Construct a two-dimensional point set of temporary field n , It is the value of the temporary field n of the m-th message. It is the length of the m-th message from the protocol layer to the end of the message. If there are points in the point set whose field value is greater than the message length, the entire point set is discarded.

[0034] For each two-dimensional point set, a straight line is fitted using the least squares method. The variance of all points in the point set to the fitted line is calculated, and if it is greater than a threshold, the point set is discarded.

[0035] Temporary combined fields with variance less than a preset threshold are considered length fields. The corresponding row vectors in the field label vector are combined, and the length field label is set to "1". The length field label for the remaining fields is set to "2".

[0036] S233, Incremental value field judgment: See Figure 4 Construct a one-dimensional gradient point set with field n. , This is the value of field n in the m-th message. The K-Medoids clustering algorithm is applied to the one-dimensional point set.

[0037] If there is a zero point in the vector, then K=3. The clustering result has 3 centroids. If there is a zero centroid and the absolute value of the interpolation of the non-zero centroid is within a neighborhood of 256, then this field belongs to the incremental value field. Set the incremental value field label of the field label vector to "1".

[0038] If there is no zero point in the vector, then K=2. The clustering result has two centroids. If the centroid is not zero, and the absolute value of the interpolation of the two centroids is within a neighborhood of 256, then this field belongs to the incremental value field. Set the incremental value field label of the field label vector to "1".

[0039] S234, Direction field determination: See Figure 5 The protocol streams are divided into two categories based on communication direction: request streams and response streams. The variance of each field is calculated. If the variance of a field is 0 in both the request and response streams, then that field is a direction field. The direction field label of the field label vector is set to "1".

[0040] S235. Function code field and session field judgment: See Figure 6 Construct a two-dimensional point set of field n. , It is the value of field n in the request message of the m-th request-response message group. It is the value of field n in the response message of the m-th request-response message group.

[0041] The least squares method is used to fit a straight line, and the variance of the distance from the point to the fitted line is calculated. If the variance is less than the threshold of 0.5, the field may be a function code or a session.

[0042] Furthermore, duplicate elements in the two-dimensional point set are deleted, and the number of elements in the point set is calculated. If the number of elements is less than a preset threshold, it is a function code field, and the function code field label in the field label vector is set to "1". If the number of elements is greater than the preset threshold, it is a session field, and the session field label in the field label vector is set to "1".

[0043] The preset threshold is determined based on the total number of request-response message pairs in the protocol stream, and is usually set to 10% of the total number of message pairs; if the total number of message pairs is less than 100, the threshold is set to 5 by default.

[0044] S236. Judgment of fields with irregular values: Fields that simultaneously satisfy the following conditions are non-fixed value, non-length, non-incremental value, non-direction, non-function code, and non-session, are set as irregular value fields. The irregular field label of the field label vector is set to "1", and the irregular field label of the other fields is set to "2".

[0045] S24. Determine the field division range of the first layer protocol: Search backward from the last row of the first layer field label matrix until the first row with an irregular value field label of "2" is found (i.e., a non-irregular value field). Specify the field pointed to by this row as the end of the first layer protocol to determine the field division range of the first layer protocol.

[0046] S3. Second-layer protocol analysis: Reverse analysis of the second-layer industrial control protocol. Based on the different values ​​of function codes in the first-layer industrial control protocol, the industrial control protocol stream set is classified into multiple second-layer protocol stream sets. For each second-layer protocol stream set, the Head and Body parts of the second-layer protocol are reverse analyzed. Each part analysis includes: determining the effective analysis range of the corresponding part, performing field classification, and determining the field division range of the corresponding part based on the classification results. Specifically, it includes: S31. Divide the protocol flow set according to the first-level function code: classify the total protocol flow to be analyzed according to the different values ​​of the function codes in the first-level protocol to obtain multiple second-level protocol flow sets, and perform subsequent operations on each second-level protocol flow set. S32. Reverse analysis of the Head section of the Layer 2 protocol, specifically including: S321. Determine the effective analysis range of the Head section: For each set of Layer 2 protocol streams, remove the Layer 1 protocol section of each message in the set, record the maximum length MAX_LEN_2_1 and the minimum length MAX_LEN_2_1 of the remaining bytes, and take the first MAX_LEN_2_1 bytes of the remaining bytes as the effective analysis range of the Layer 2 protocol Head section.

[0047] S322. Initialize the field label matrix of the Head part: Construct and initialize the matrix with dimensions MIN_LEN_2_1x9. The components, initial values ​​and label status definitions of each row are consistent with the field label matrix of the first layer protocol. Each row represents the classification result of one byte and each row has 9 components.

[0048] S323. Perform field classification for the Head section: Using the same logic as the sequential field classification in step S2, perform field classification on the bytes within the effective analysis range of the Head section and update the corresponding field labels.

[0049] S324. Determine the field division range of the Head part: Search backward from the last row of the field label matrix of the Head part until the first row with an irregular value field label of "2" is found. Take the field corresponding to that row as the end of the second layer protocol Head part and determine the field division range of the Head part.

[0050] S33. Reverse analysis of the body portion of the second-layer protocol, specifically including: S331. Divide the request message set and the response message set: Divide each Layer 2 protocol stream set into a request message set and a response message set, and perform subsequent operations on the two sets respectively.

[0051] S332. Determine the effective analysis range of the Body part: For the request message set and the response message set, remove the first layer protocol part and the second layer protocol Head part of each message in the set respectively, record the maximum length MIN_LEN_2_2 and the minimum length MIN_LEN_2_2 of the remaining bytes, and take the first MIN_LEN_2_2 bytes of the remaining bytes as the effective analysis range of the second layer protocol Body part.

[0052] S333. Initialize the field label matrix of the Body part: Construct and initialize the matrix with dimensions MIN_LEN_2_2x7. Each row contains 7 components, namely, starting offset, field length, fixed value field label, length field label, incremental value field label, function code field label, and random value field label. The initial value of the starting offset is the corresponding row number, the initial value of the field length is 1, and the initial state of each label is "0". The label state definition is the same as that of the first layer.

[0053] S334. Perform field classification for the Body section: Following the priority of "fixed value field judgment → length field judgment → incremental value field judgment → function code field judgment → irregular value field judgment", use the same classification logic as in step S2.3 to perform field classification on the bytes within the effective analysis range of the Body section and update the corresponding field labels.

[0054] S335. Determine the field division range of the Body part: Search backward from the last row of the Body part field label matrix until the first row with an irregular value field label of "2" is found. Take the field corresponding to that row as the end of the Body part of the second layer protocol to determine the field division range of the Body part.

[0055] S4. Layer 3 Protocol Analysis: Reverse-analyze the Layer 3 industrial control protocol. Based on the different values ​​of the function codes in the Layer 2 industrial control protocol, further classify the Layer 2 protocol stream set obtained in step S3 into multiple Layer 3 protocol stream sets. For each Layer 3 protocol stream set, reverse-analyze the Head part and the remaining part of the Layer 3 protocol. Each part of the analysis includes: determining the effective analysis range of the corresponding part, performing field classification, and determining the field division range of the corresponding part based on the classification results. Specifically, it includes: S41. Grouping by function code of the second layer protocol: Based on the different values ​​of the function codes in the second layer protocol, the second layer protocol stream set obtained in step S3 is further classified into multiple third layer protocol stream sets.

[0056] S42. Reverse analysis of the Head section of the Layer 3 protocol, specifically including: S421. Determine the effective analysis range of the Head section: For each set of Layer 3 protocol streams, remove the Layer 1 and Layer 2 protocol sections of each message in the set, record the maximum length MIN_LEN_3_1 and the minimum length MIN_LEN_3_1 of the remaining bytes, and take the first MIN_LEN_3_1 bytes of the remaining bytes as the effective analysis range of the Layer 3 protocol Head section.

[0057] S422. Initialize the field label matrix of the Head section: Construct and initialize the matrix with dimensions of... Each row represents the classification result of a byte, and each row consists of 10 components. In addition to the nine components of the first-layer protocol field label matrix, "special field labels" are added. The initial values ​​and label status definitions of each component are consistent with those of the first layer.

[0058] S423. Perform field classification in the Head section: First, use the same logic as the sequential field classification in step S2 to identify fixed value, length, incremental value, direction, function code, and session fields; for fields whose labels are all "2", perform special field judgment; the remaining fields with labels "2" are set as irregular value fields, and the corresponding labels are updated; See Figure 7 The specific steps for determining special fields involve designing configuration software that performs controller memory address / I / O address switching and host computer read / write operations within eight time intervals. This special field determination requires the prior design of the configuration software, which must fulfill the following functions: Within time interval 1, the controller configuration sets the value stored in a memory address to switch between two values, and the host computer configuration reads the memory address cyclically. Within time interval 2, the controller is configured to set two more memory addresses, and the host computer is configured to read these memory addresses in a loop, reading one address at a time. Within time interval 3, the host computer repeatedly writes two values ​​to a memory address in the controller. Within time interval 4, the host computer writes the same value to two memory addresses in the controller's inner loop. Within time interval 5, the controller configuration sets the value stored in an I / O address to switch between two values, and the host computer configuration reads the I / O address cyclically. Within time interval 6, the controller is configured to set two I / O addresses, and the host computer is configured to read these I / O addresses in a loop, reading one address at a time. Within time interval 7, the host computer cyclically writes two values ​​to one I / O address in the controller. Within time interval 8, the host computer writes the same value to two I / O addresses in the controller's internal loop.

[0059] Specifically, the above sampling frequencies Set to 1Hz, controlled variable period Set to 30 seconds, total sampling time 10 minutes.

[0060] Construct a one-dimensional vector with field n , This is the value of field n in the m-th message. Construct a filter with a window length of 3 minutes and a square wave amplitude of 1. The filter window is a one-dimensional vector. Swipe up to apply the Fast Fourier Transform (FFT) algorithm to the points in the window and calculate the fundamental frequency of the discrete signal. .

[0061] Use formula N is the signal period; the power spectrum is obtained by calculating the square of the amplitude at each point in the FFT algorithm result.

[0062] like equal And in If the power of the signal is greater than 50% of the total power, then the signal is a periodic signal.

[0063] If the entire one-dimensional vector If there is a periodic signal above, then the field is a special field. S424. Determine the field division range of the Head part: Search backwards from the last row of the field label matrix of the Head part until the first row with an irregular value field label of "2" is found. Take the field corresponding to that row as the end of the third layer protocol Head part and determine the field division range of the Head part.

[0064] S43. Reverse analysis of the remaining parts of the third-layer protocol, specifically including: S431. Determine the valid analysis range of the remaining portion: For each set of Layer 3 protocol streams, remove the Layer 1 protocol portion, Layer 2 protocol portion, and Layer 3 protocol Head portion of each message in the set, and record the maximum length of the remaining bytes. and minimum length Take the first few bytes of the remaining bytes The remaining bytes constitute the valid analysis range for the third-layer protocol.

[0065] S432. Initialize the remaining field label matrix: Construct and initialize the matrix with dimensions [missing information]. Each row represents the classification result for a byte, and each row consists of 7 components.

[0066] S433. Perform field classification for the remaining part: Using the same logic as the field classification in step S2, which judges fixed values, lengths, incremental values, function codes, and irregular values, classify the bytes within the effective analysis range of the remaining part and update the corresponding tags.

[0067] S434. Determine the field division range of the remaining part: Search backward from the last row of the field label matrix of the remaining part until the first row with the field label of the first irregular value is "2". Take the field corresponding to the row as the end of the remaining part of the third layer protocol and determine the field division range of the remaining part.

[0068] S5. Protocol Analysis Result Storage: Stores the field division range results and corresponding field type label information for the first, second, and third layer industrial control protocols.

[0069] The field division results of the first, second, and third layer industrial control protocols, as well as the type label information (fixed value, length, incremental value, direction, function code, session, special, and irregular value) of the corresponding fields of each layer protocol are stored. At the same time, the function code grouping basis of each protocol flow set is recorded (the first layer function code corresponds to the second layer protocol flow set, and the second layer function code corresponds to the third layer protocol flow set), which corresponds to the requirements for storing analysis results in the "Technical Solution" of the disclosure document.

[0070] In summary, the present invention has the following advantages: 1. Layered analysis of the protocol is performed, as the control fields in the upper-layer protocol determine the format of the lower-layer protocol. Layered protocol analysis increases the accuracy of protocol field segmentation. Similar patents do not consider that function code fields in the protocol can change the protocol structure, thus only simple protocols or protocol header fields can be analyzed; 2. A special field classification algorithm is employed, meticulously constructing the industrial control configuration program. It controls address and read / write value variables, then classifies the protocol stream through function code combinations from the upper-layer protocol, calculates the spectral characteristics of the fields, identifies periodic signals within the fields, and thus identifies special fields. This method provides more accurate boundary identification for special fields. Similar patents do not pre-design the configuration control read / write process or control address and read / write value variables. 3. Incremental value field classification algorithm: This algorithm uses clustering. For incremental value fields with longer change periods, the computational complexity for each point remains the same, but the total computation time increases. Similar patents use frequency response algorithms for incremental fields with longer periods, requiring longer vector lengths for computation. This algorithm is simpler and easier to implement than the frequency response algorithm of similar patents for identifying incremental value fields with long time spans. 4. The length field classification algorithm can identify the length field when the field value is proportional to the length from the protocol layer where the field resides to the end of the message, without requiring the precise byte sequence in the message associated with the length field. Similar patents directly compare the field value with the message length.

[0071] The above specific embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to examples, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A method for field division of an industrial control protocol based on protocol layering analysis, characterized in that, The method comprises the following steps: S1, obtaining a set of industrial control protocol streams to be analyzed, wherein the set of protocol streams comprises a plurality of industrial control protocol packets; S2, reverse analyzing a first layer industrial control protocol, determining an effective analysis byte range corresponding to the first layer industrial control protocol, performing field classification on the bytes in the effective analysis byte range, and determining a field division range of the first layer industrial control protocol based on the classification result; S3, reverse analyzing a second layer industrial control protocol, and classifying the set of industrial control protocol streams into a plurality of second layer protocol stream sets based on different values of a function code in the first layer industrial control protocol; For each second layer protocol stream set, the Head part and the Body part of the second layer protocol are respectively reverse analyzed, and each part analysis comprises the following steps: determining an effective analysis range of the corresponding part, performing field classification, and determining a field division range of the corresponding part based on the classification result; S4, reverse analyzing a third layer industrial control protocol, and further classifying the second layer protocol stream set obtained in step S3 into a plurality of third layer protocol stream sets based on different values of a function code in the second layer industrial control protocol; For each third layer protocol stream set, the Head part and the remaining part of the third layer protocol are respectively reverse analyzed, and each part analysis comprises the following steps: determining an effective analysis range of the corresponding part, performing field classification, and determining a field division range of the corresponding part based on the classification result; S5, storing the field division range result and the type label information of the corresponding field of the first layer, the second layer and the third layer industrial control protocol.

2. The method of claim 1, wherein the protocol-based hierarchical parsing is performed according to a protocol field division table. The determination method of the effective analysis range comprises the following steps: S21, recording a maximum value MAX_LEN_1 and a minimum value MIN_LEN_1 of the packet length, and taking the first MIN_LEN_1 bytes of the packet as the effective analysis byte range of the first layer protocol; S22, recording a maximum length MAX_LEN_2_1 and a minimum length MIN_LEN_2_1 of the remaining bytes, and taking the first MIN_LEN_2_1 bytes of the remaining bytes as the effective analysis range of the Head part of the second layer protocol; S23, recording a maximum length MAX_LEN_2_2 and a minimum length MIN_LEN_2_2 of the remaining bytes, and taking the first MIN_LEN_2_2 bytes of the remaining bytes as the effective analysis range of the Body part of the second layer protocol; S24, recording a maximum length MAX_LEN_3_1 and a minimum length MIN_LEN_3_1 of the remaining bytes, and taking the first MIN_LEN_3_1 bytes of the remaining bytes as the effective analysis range of the Head part of the third layer protocol; S25, recording a maximum length MAX_LEN_3_2 and a minimum length MIN_LEN_3_2 of the remaining bytes, and taking the first MIN_LEN_3_2 bytes of the remaining bytes as the effective analysis range of the remaining part of the third layer protocol.

3. The method of claim 1, wherein the protocol field partitioning is based on a protocol layering. The field classification is performed according to protocol field judgment, and the protocol field judgment comprises the following steps: The fixed value field judgment, the length field judgment, the incremental value field judgment, the direction field judgment, the function code field and session field judgment, and the irregular value field judgment, wherein the special field judgment is only applicable to the field classification of the third layer protocol Head part.

4. The method of claim 3, wherein the protocol field partitioning is based on a protocol layering. The length field judgment specifically includes: Set is the maximum packet length of the protocol layer to which the current field belongs and its lower protocol in the corresponding protocol flow set; If , then two adjacent bytes to be analyzed are combined into two temporary combined fields in big-endian mode and little-endian mode respectively; if , then a single byte to be analyzed is taken as a temporary combined field; for each temporary combination field , a two-dimensional feature point set is constructed , wherein, is the value of the temporary combination field of the first message is the length of the first message from the current protocol level to the end of the message is the length of the first message from the current protocol level to the end of the message​​ if the two-dimensional feature point set contains the element , the two-dimensional feature point set is discarded; The least square method is used to fit a straight line for the reserved two-dimensional feature point set, and the deviation of all points in the point set to the fitted straight line is calculated; if the deviation is less than a preset threshold, the temporary combined field is a length field; otherwise, the temporary combined field is not a length field.

5. The method of claim 3, wherein the protocol field partitioning is based on a protocol layering. The incremental value field judgment specifically includes: For each field to be analyzed , a one-dimensional gradient feature point set is constructed , wherein, is the value of the field of the i-th packet ​​ To the one-dimensional gradient feature point set Classify by using a K-Medoids clustering algorithm, and set the number of clusters ; If there is one class center point being zero and the absolute value of the difference between the other two non-zero class center points is in the neighborhood of 256, the field to be analyzed is an incremental value field; otherwise, the field to be analyzed is a non-incremental value field. is an incremental value field; otherwise, the field to be analyzed is a non-incremental value field.

6. The method of claim 3, wherein the protocol field partitioning is based on a protocol layering. The direction field judgment specifically includes: The protocol flow is divided into two categories according to the communication direction, a request flow and a response flow, and the variance of the field is calculated respectively; if the variance of the field in the request flow and the response flow is 0, the field is a direction field, and the direction field label of the field label vector is set to 1; otherwise, the direction field label of the field label vector is set to 2.

7. The method of claim 3, wherein the protocol field partitioning is based on a protocol layering. The function code field and session field judgment specifically includes: Constructing a two-dimensional point set of field n wherein, is a value of field n of a request message in the mth set of request response messages, is a value of field n of a response message in the mth set of request response messages; The least square method is used to fit a straight line, the variance of the distance of the points to the fitted straight line is calculated, and if the variance is less than a threshold value 0.5, the field may be a function code or a session; The repeated elements in the two-dimensional point set are deleted, the number of elements in the point set is calculated, and the number of elements less than a preset threshold is a function code field, and the function code field label of the field label vector is set to 1; if the variance is greater than or equal to the threshold value 0.5, the function code field label and the session field label of the field are both set to 2.

8. The method of claim 3, wherein the protocol-based hierarchical parsing is performed according to a protocol field division table. The special field judgment specifically includes: An industrial control configuration program is designed, and the industrial control configuration program controls the host computer and the controller to perform the following periodic operations, and the operation parameters are: a sampling frequency of 1 Hz, a controlled quantity cycle of 30 s, and a total sampling time of 10 minutes; Based on the protocol flow generated by the industrial configuration program, a one-dimensional vector is constructed for each field n to be analyzed , the elements of the one-dimensional vector being the values of the field n of each message ; A filter is constructed with a window length of 3 minutes, an amplitude of 1, and a waveform of a square wave. The window of the filter is applied to the one-dimensional vector Upward sliding, a Fast Fourier Transform (FFT) is applied to the elements within each window to calculate the fundamental frequency of the discrete signal ; The signal period N is calculated by the formula The power spectrum of the FFT result is calculated, and the fundamental frequency corresponding power is extracted.​ If the signal period N is equal to the controlled variable period, and the fundamental frequency... If the corresponding power is greater than 50% of the total power, then the signal within this window is a periodic signal; if the one-dimensional vector If at least one segment of the aforementioned periodic signal exists, then the field to be analyzed... It is a special field; otherwise, the field to be analyzed Non-special field.

9. The method of claim 8, wherein, The periodic operation includes: In time interval 1, the controller configuration sets the value stored in a memory address to switch between two values, and the host computer configuration reads the memory address cyclically; In time interval 2, the controller configuration sets two memory addresses, and the host computer configuration reads these memory addresses cyclically, one address at a time; In time interval 3, the host computer writes two values to a memory address in the controller cyclically; In time interval 4, the host computer writes the same value to two memory addresses in the controller cyclically; In time interval 5, the controller configuration sets the value stored in an I / O address to switch between two values, and the host computer configuration reads the I / O address cyclically; In time interval 6, the controller configuration sets two I / O addresses, and the host computer configuration reads these I / O addresses cyclically, one address at a time; In time interval 7, the host computer writes two values to an I / O address in the controller cyclically; In time interval 8, the host computer writes the same value to two I / O addresses in the controller cyclically.

10. The method of claim 3, wherein the protocol-based hierarchical parsing is performed by a protocol field division module. The fixed value field judgment specifically includes: Grouping the protocol flow to be analyzed into groups each containing A preset number of messages, the last message of each group being the same as the first message of the next group, and the last group being formed according to the actual number of messages; constructing for each group of packets a matrix of dimensions, calculating the variance of each column of the matrix; the column with a variance not equal to 0 corresponds to the non-fixed value field of the byte, and the fixed value field label thereof is set to 2; After traversing all the groups, setting the fixed value field label corresponding to the byte with the fixed value field label of 0 to 1; and merging the adjacent fixed value fields with the fixed value field label of 1.

Images