Industrial mixed protocol classification method based on data track

Abstract

The invention discloses an industrial hybrid protocol classification method based on a data track. The method comprises the following steps: 1, preprocessing original network traffic; step 2, constructing a data track matrix with a fixed length, realizing unified representation of variable-length sessions, and providing unified input for the model; 3, taking the data track as input, and adopting a two-stage cascade judgment mechanism: in the first stage, classifying known protocols and outputting category probability and confidence, and in the second stage, further executing unknown protocol detection and atypical known protocol identification on low-confidence or abnormal session samples to obtain a judgment result; and step 4, realizing automatic identification and result summarization of the industrial mixed flow. According to the method, dynamic evolution of a complete communication session is mapped into a multivariate time sequence to reserve a staged interaction mode and rhythm, and meanwhile, content-independent statistical evolution characteristics are reserved, so that the representability is enhanced.

Description

Technical Field

[0001] This invention belongs to the field of network protocol identification technology, specifically relating to an industrial hybrid protocol classification method based on data trajectories. Background Technology

[0002] Network protocol identification is a long-standing and active research area in network traffic analysis. Existing research can be broadly divided into two categories: traditional protocol classification methods based on prior knowledge and data-driven machine learning protocol classification methods.

[0003] I. Traditional Protocol Classification Methods Based on Prior Knowledge: Early protocol identification methods relied primarily on predefined rules and prior knowledge of the protocols. Port number-based classification matched the source / destination port numbers in the TCP / UDP header with a list of well-known ports maintained by IANA (Internet Assigned Numbers Authority), but this approach is prone to failure in cases of dynamic ports, port reuse, and spoofing.

[0004] To overcome the limitations of ports, Deep Packet Inspection (DPI) was proposed, which identifies protocols by analyzing characteristic strings or binary patterns in the packet payload. While DPI boasts high accuracy in plaintext protocol scenarios, it faces significant challenges in industrial networks: firstly, the widespread use of encryption mechanisms in industrial protocols makes payload content difficult to parse, significantly reducing DPI's effectiveness in encrypted traffic scenarios; secondly, many industrial communications employ vendor-defined proprietary protocols, whose protocol formats and semantic information are often not publicly available, making it difficult to construct signature databases, thus limiting the applicability of DPI methods in real-world industrial environments.

[0005] II. Protocol classification methods based on machine learning: To address the limitations of traditional methods in complex network environments, researchers have gradually introduced machine learning techniques to conduct protocol classification research. Based on different feature modeling methods, existing research can be mainly divided into the following three categories.

[0006] 1) Protocol classification method based on flow statistical features: This type of method aggregates continuous data packets into network flows and extracts multi-dimensional statistical features such as flow duration, number of data packets, number of bytes transmitted, packet length distribution, and arrival time interval. These features are then trained and classified using traditional machine learning models such as support vector machines, decision trees, random forests, or Naive Bayes. However, this method compresses the communication process, which has strong temporal characteristics, into a fixed-dimensional static vector, making it difficult to characterize the phased behaviors and dynamic evolutionary features of protocol interactions. This results in performance limitations in multi-stage control protocol scenarios.

[0007] To enhance temporal modeling capabilities, some studies have introduced models such as temporal convolutional networks to model flow sequences, improving the ability to capture temporal behavior patterns. Furthermore, other works have constructed flow-level graph structures to characterize inter-flow relationships, enhancing the ability to express complex interaction scenarios. While these methods alleviate the shortcomings of static feature modeling to some extent, their ability to express deep interaction details of industrial protocols remains limited.

[0008] 2) Deep learning methods based on payload content: Payload-based deep learning methods automatically learn features directly from packet payloads or complete data packets, typically representing them as one-dimensional byte sequences or two-dimensional matrices, and then inputting them into deep neural networks for modeling. For example, methods that treat payloads as images and input them into convolutional neural networks for classification demonstrate strong feature representation capabilities in plaintext or weakly encrypted scenarios. Furthermore, some studies combine convolutional neural networks with recurrent neural networks to capture local and global dependencies in payload sequences. In recent years, graph neural networks have also been introduced into payload modeling, enhancing feature representation capabilities by modeling the structural relationships between nodes. Although payload-based deep learning methods excel in extracting local semantic information, their limitation lies in their difficulty in capturing overall interaction patterns across data packets and at the session level, especially when payload information is invisible under strict encryption, resulting in a significant performance decline.

[0009] 3) Methods based on pre-training and temporal modeling: To enhance temporal representation capabilities, recent research has increasingly incorporated pre-trained models and self-supervised learning strategies. Some works, based on the Transformer architecture, utilize self-attention mechanisms to model intra-flow packet sequences, effectively improving the representation of complex encrypted traffic temporal patterns. Other studies combine pre-training strategies with self-supervised learning, attempting to learn more general representations from unlabeled or sparsely labeled data; for example, self-supervised contrastive learning frameworks can enhance the discriminative ability between encrypted flows and unknown patterns. Furthermore, some research explores using generative pre-trained models for traffic behavior understanding to improve the model's ability to model and generalize to unknown protocols. In resource-constrained industrial IoT environments, some studies further explore lightweight temporal modeling strategies, such as combining variational autoencoders and attention mechanisms for multi-scale behavior extraction. These studies generally emphasize modeling the overall dynamic behavior of a session, providing new technical approaches for the classification and understanding of complex protocol systems. However, these methods are still limited by predetermined feature spaces or model assumptions in terms of the uniformity and expressiveness of protocol representations.

[0010] In summary, existing protocol classification methods either heavily rely on prior knowledge such as port mapping, parsing rules, or signature libraries, making them ill-suited for vendor-specific protocols, protocol variants, and unknown protocol scenarios; or they are limited by feature representation methods, making it difficult to fully model the complex request-response timing interactions in industrial protocols at the session level. These shortcomings are particularly pronounced in industrial network environments characterized by strong protocol heterogeneity, a high proportion of encrypted traffic, and continuously evolving communication behaviors. This results in identification results that are easily affected by factors such as port changes, encapsulation, and encryption, making it difficult to support the high accuracy, robustness, and scalability requirements of industrial network asset mapping and security monitoring. Summary of the Invention

[0011] To overcome the shortcomings of the existing technology, the present invention aims to provide an industrial hybrid protocol classification method based on data trajectory, which does not rely on port or payload plaintext. By mapping the dynamic evolution of the complete communication session to a multivariate time series, it preserves the staged interaction patterns and rhythms, while retaining content-independent statistical evolution characteristics, thereby enhancing representability.

[0012] To achieve the above objectives, the technical solution adopted by the present invention is as follows: An industrial hybrid protocol classification method based on data trajectories includes the following steps; Step 1: Data preprocessing and session reconstruction; preprocess the raw network traffic and perform session aggregation and inactivity timeout segmentation based on the session key to obtain clearly defined and logically independent session samples and their metadata, providing a consistent input object for subsequent modeling; Step 2: Data Trajectory Construction; Extract multidimensional features such as packet length, time interval, direction, and payload statistics at the session granularity, and stack, align, and truncate / padded them in chronological order to construct a fixed-length data trajectory matrix, thereby achieving a unified representation of variable-length sessions and providing a unified input for the model; Step 3: Two-stage cascaded protocol classification; using data trajectories as input, a two-stage cascaded decision mechanism is adopted: the first stage classifies known protocols and outputs the category probability and confidence level; the second stage further performs unknown protocol detection and atypical known protocol identification on low-confidence or abnormal samples to obtain the judgment result. Step 4: Output classification results: Fill the judgment results of Step 3 back into the corresponding session samples of Step 1 and output the protocol category, confidence level and unknown / atypical markers to realize the automated identification and result summary of industrial mixed traffic.

[0013] Step 1 specifically involves: The original network traffic is divided into independent session units through a hierarchical session reconstruction mechanism; the original network traffic and the original and unordered data packet stream refer to the same thing, namely the original packet capture data (PCAP) input in this step. The layered session reconstruction mechanism can adapt to mixed traffic containing different network layer protocols. The raw network traffic is passively collected at the industrial field switch's mirror port (SPAN), captured using packet capture tools (such as Wireshark or tcpdump), and saved as a PCAP file. For the captured packets... Define a session key generation function. To identify the session it belongs to: in, This indicates a single captured data packet; and These represent the source and destination IP addresses at the network layer, respectively. and These represent the source and destination ports at the transport layer, respectively. Indicates the transport layer protocol type (TCP / UDP); and These represent the source and destination MAC addresses at the link layer, respectively. This indicates that the fields at both ends of the communication are sorted in an undirected manner to ensure that the same bidirectional session has a unique session key.

[0014] The layered session reconstruction mechanism uses the IP 5-tuple (source / destination IP address, source / destination port, and transport layer protocol) as the session identifier; When data packets do not contain network layer or transport layer information (such as some pure link layer protocols), the mechanism adaptively falls back to session partitioning based on link layer MAC address pairs; data packets with the same session key are aggregated into a preliminary session stream.

[0015] Introduce an inactivity timeout threshold To further distinguish logically independent multiple interaction processes between the same communication entity, this threshold is used to characterize the temporal continuity of the communication process. For a time-ordered session stream, if two consecutive data packets... and The time interval between them satisfies If a single session ends at this point, a new session is started at that location. Through this process, the original network traffic is precisely divided into a set of independent sessions. The relationship between this timeout segmentation and the aforementioned session aggregation step is as follows: First, based on the session key, all data packets of the same communication entity pair are aggregated into a candidate session stream; on this basis, for multiple interaction processes formed by the same entity pair in different control cycles or multiple rounds of request-response, further based on... Idle interval breakpoints are identified within the candidate session stream, and the stream is divided into multiple logically independent session samples.

[0016] Step 2 specifically involves: Each of the sessions Abstracted into a multi-dimensional time series, called a data trajectory, the data trajectory is represented as a... 3D numerical matrix ,in For a fixed sequence length, D is the feature dimension extracted for each data packet; used to characterize the dynamic behavior of the protocol at the session level. A fixed sequence length is used to strike a balance between ensuring model input consistency and information integrity, by truncating the sequence before the session begins. The method of using individual data packets preserves the main protocol behavior characteristics; When the number of packets in a session At that time, only the first one is retained. Data packets; when When zeroing occurs, zero padding is performed at the end of the sequence. The feature vectors of the virtual data packets introduced by the padding are uniformly set to zero to avoid interfering with the actual temporal feature distribution.

[0017] Furthermore, for the first in the sequence Data packets Its eigenvectors It consists of two types of features: behavioral features and content features, and aims to simultaneously characterize the communication behavioral characteristics and protocol-independent load statistical features. The behavioral characteristics are used to describe the dynamic properties of data packets during the communication process and do not depend on the payload content. The content features are used to characterize the statistical distribution characteristics of the data packet payload, avoiding dependence on the semantics of specific protocol fields.

[0018] The behavioral characteristics include: Data packet length : Indicates the total length of the data packet (in bytes), reflecting the data transmission scale of the protocol at different interaction stages; Time interval : Indicates a data packet Compared with the previous data packet The time difference between them is used to characterize the timing and response patterns of the protocol; Transmission direction : is a binary feature used to indicate the transmission direction of a data packet (from the initiator to the responder, or vice versa), and its direction determination is based on the source and destination addresses of the first data packet in the session.

[0019] The content features include: Load entropy : Used to measure the randomness of payload byte distribution, it is defined as: in Represents byte value The probability of occurrence in the load; Byte frequency distribution : is a 256-dimensional vector, where each dimension represents the normalized frequency of the corresponding byte value in the payload, and the sum of its dimensions is 1, used to provide a statistical fingerprint of the payload; In summary, the first The feature vector of each data packet is Before the session The feature vectors of the data packets, stacked in chronological order, can form the data trajectory matrix corresponding to the session. Before being fed into the model, all feature dimensions are standardized (e.g., Z-score standardization) to eliminate dimensional differences, accelerate model convergence, and improve overall classification performance.

[0020] Step 3 specifically involves: A two-stage cascaded protocol classification decision framework is used to achieve high-precision classification of known industrial protocols and reliable detection of unknown protocols. This framework combines a discriminative classification model with a reconstruction-based anomaly detection model, which can effectively support the discovery of unknown protocols in open environments while ensuring the performance of known protocol identification.

[0021] The first phase aims to achieve high-precision identification of known industrial protocols. The data trajectory, essentially a session-level multidimensional time series, is generated using a pre-trained sequence deep learning model. As a protocol classifier; considering the temporal dependencies that are common in industrial protocol interactions, recurrent neural network models that can effectively model long-term dependency characteristics, such as Long Short-Term Memory (LSTM) networks or gated recurrent units, are preferred; wherein, the data trajectory refers to extracting the length, interval, direction and load statistics of the intra-session data packets obtained in step 1 in chronological order, and stacking them to form a fixed-length multidimensional time series matrix representation. The goal of the second stage is to further distinguish between atypical known protocols and truly unknown protocols from the low-confidence samples of the first stage; this involves introducing an anomaly detection model based on sequence reconstruction, employing an LSTM autoencoder. As an unknown protocol detector, the LSTM autoencoder consists of two parts: an encoder and a decoder, both of which are based on the LSTM structure. The encoder maps the input data trajectory to a low-dimensional latent space representation, while the decoder attempts to reconstruct the original input sequence from this representation.

[0022] The specific steps of the first stage are as follows: input a data trajectory matrix. ; Processing procedure: The classification model reads the feature vector corresponding to each data packet in the data trajectory step by step, and learns the temporal behavior pattern at the session level through the gating structure of the recurrent unit; the hidden state of the last layer of the network is mapped to the class probability distribution through the fully connected layer and the activation function. Output: one A probability distribution vector of dimension ; Where k represents the number of known protocol categories, Represents the input trajectory Belongs to the The probability of a known protocol; Decision-making strategy: Calculate the maximum confidence score of the classification results. ; if When the classifier's prediction for the sample is considered to have high reliability, the session is directly classified into the corresponding known protocol category, and the classification process ends; when When the confidence threshold is reached, it indicates that the classifier's judgment of the sample is uncertain. The sample may belong to some atypical known protocol behavior, or it may correspond to an unknown protocol that did not appear during the training phase. At this time, the sample will be sent to the second phase for further analysis. The optimization is determined by tuning on the validation set to achieve a balance between the accuracy of known protocol classification and the ability to detect unknown protocols.

[0023] The second phase specifically involves: Training strategy: Model Training is performed using only normal data trajectories with known protocols, and the goal is to minimize the input trajectory. With reconstructed trajectory The reconstruction error between them; through this training process, the model can learn the normal distribution characteristics of known protocols in session-level behavior; Processing procedure: For low-confidence samples input from the first stage Inputting it into the trained autoencoder model yields the corresponding reconstructed output: ; Reconstruction error calculation: Mean Squared Error (MSE) is used as the measure of reconstruction error. Decision rule: Reconstruction error With preset threshold Comparison: like This indicates that the session-level behavior pattern of this sample is significantly different from the normal distribution of known protocols, and the model cannot effectively reconstruct the data trajectory, thus classifying it as an unknown protocol. like This indicates that although the classifier has low confidence in its predictions, its overall behavior pattern still conforms to the distribution characteristics of known protocols, thus classifying it as an atypical known protocol. The highest probability category given by the first-stage classifier is used as its protocol type. In engineering deployment, an "atypical known protocol" can be considered an alarm / low-confidence state of a known protocol: its overall behavior still falls near the distribution of known protocols, but the classifier's confidence is insufficient, potentially corresponding to rare operations, equipment differences, configuration changes, or noise in data acquisition. The system adds a warning flag to the output of such sessions and triggers subsequent handling according to a strategy (e.g., entering a manual review queue, reducing the level of automated handling, or performing rate limiting and auditing without affecting the control loop) to reduce the risk of misclassifying potential anomalies as normal known protocols. Among them, the reconstruction error threshold Similarly, validation set experiments were conducted to determine the optimal protocol for balancing the detection rate and false positive rate.

[0024] Step 4 specifically involves: associating the predicted protocol category and its classification confidence score output in step 3 with the metadata of each session sample obtained in step 1, and outputting the protocol type label and classification confidence score for each session; when a session is determined to be an unknown protocol, outputting an unknown protocol label and corresponding reconstruction error score; when a session is determined to be an atypical known protocol, adding an alarm / low confidence label to the output and providing a reference known protocol category; and simultaneously summarizing the session results within a preset time window to generate analysis results such as the distribution of mixed traffic protocols, the number and proportion of unknown protocols.

[0025] The beneficial effects of this invention are: 1. This invention has a strong ability to express dynamic interaction patterns of sessions and provides stable protocol classification results. By constructing a session representation that can preserve the temporal evolution of sessions and combining it with sequence modeling for learning, this invention can effectively characterize the phased, directional, and request-response interaction features of industrial protocols, thereby maintaining good recognition stability under conditions such as port changes, session truncation, and mixed traffic in complex industrial environments.

[0026] 2. This invention exhibits good robustness to heterogeneous, encrypted, and private / unknown protocol environments, and possesses the ability to discover unknown protocols in open environments. This invention does not rely on payload parsing; instead, it introduces a second-stage discrimination mechanism when the confidence level of known protocol classification is insufficient. This enables explicit detection and separation of unknown protocol sessions, and can output "atypical known" as an intermediate result, facilitating further source tracing analysis and handling by operations and maintenance personnel.

[0027] 3. This invention reduces coupling to specific input organization schemes, improving engineering adaptability and interpretability. In the session reconstruction phase, this invention employs a layered session partitioning strategy to enhance adaptability to different industrial network links and protocol stacks. In the session representation construction phase, it reduces sensitivity to session length fluctuations and missing data by fixing input dimensions (such as truncation and padding). Furthermore, through a "session reconstruction—representation construction—two-stage decision" process design, it provides traceable intermediate evidence for the final output, thereby improving engineering feasibility and alarm interpretability. Attached Figure Description

[0028] Figure 1 This is the overall flowchart of the industrial hybrid protocol classification method based on data trajectory proposed in this invention.

[0029] Figure 2 This is a schematic diagram of the data trajectory construction process in this invention.

[0030] Figure 3 This is a diagram illustrating the structure and decision logic of the two-stage cascaded protocol classification framework in this invention.

[0031] Figure 4It is a confusion matrix used to evaluate the performance of the known protocol classifier in this invention on the test set.

[0032] Figure 5 This is a statistical bar chart showing the results of analyzing a real mixed network traffic packet containing known and unknown protocols according to the present invention. Detailed Implementation

[0033] The present invention will now be described in further detail with reference to the accompanying drawings.

[0034] This invention discloses an industrial hybrid protocol classification method based on data trajectories, the overall process of which is as follows: Figure 1 As shown, the specific steps are as follows: Step 1: Data Preprocessing and Session Reconstruction Protocol behavior patterns manifest at the session level; therefore, the first step is to divide the raw and unordered data packet stream into independent session units. To this end, a robust hierarchical session reconstruction mechanism is designed, capable of adapting to mixed traffic containing different network layer protocols. For captured data packets... A session key generation function is defined. To identify the session it belongs to: This mechanism prioritizes using the IP 5-tuple (source / destination IP address, source / destination port, and transport layer protocol) as the session identifier, which is applicable to most industrial Ethernet protocols. When packets do not contain network layer or transport layer information (e.g., some pure link layer protocols), the mechanism adaptively falls back to session segmentation based on link layer MAC address pairs. Packets with the same session key are aggregated into an initial session stream.

[0035] To further distinguish logically independent multiple interaction processes between the same communication entity, an inactivity timeout threshold is introduced. This threshold is used to characterize the temporal continuity of the communication process, and its value can be set empirically based on typical control cycles and communication frequencies in industrial networks. For time-ordered session streams, if two consecutive data packets... and The time interval between them satisfies If a session ends at a certain point, a new session is started at that point. Through this process, the original network traffic is precisely divided into a set of independent sessions. .

[0036] Step 2: Data Trajectory Construction: The data trajectory construction process refers to Figure 2 As shown. To characterize the dynamic behavior of the protocol at the session level, each session Abstracted into a multi-dimensional time series, this is called a data trajectory. The data trajectory is represented as a... 3D numerical matrix ,in With a fixed sequence length, D represents the feature dimension extracted for each data packet. The fixed sequence length strikes a balance between ensuring model input consistency and information integrity. Experimental statistics show that the key interactive behaviors of most industrial protocols are concentrated in the initial stage of the session; therefore, intercepting the pre-session phase is recommended. The method of storing data packets preserves the main protocol behavior characteristics. When the number of data packets in a session... At that time, only the first one is retained. Data packets; when When zeroing occurs, zero padding is performed at the end of the sequence. The feature vectors of the virtual data packets introduced by the padding are uniformly set to zero to avoid interfering with the actual temporal feature distribution.

[0037] In this embodiment, the sequence length Feature Dimension For the first in the sequence Data packets Its eigenvectors It consists of two types of features, aiming to simultaneously characterize the communication behavior characteristics and protocol-independent load statistics.

[0038] (1) Behavioral characteristics: Behavioral characteristics are used to describe the dynamic properties of data packets during communication, and are independent of the payload content. They mainly include: Data packet length : Indicates the total length of the data packet (in bytes), reflecting the data transmission scale of the protocol at different interaction stages; Time interval : Indicates a data packet Compared with the previous data packet The time difference between them is used to characterize the timing and response patterns of the protocol; Transmission direction : is a binary feature used to indicate the transmission direction of a data packet (from the initiator to the responder, or vice versa), and its direction determination is based on the source and destination addresses of the first data packet in the session.

[0039] (2) Content characteristics: Content features are used to characterize the statistical distribution characteristics of the packet payload, avoiding dependence on the semantics of specific protocol fields. Therefore, they have good robustness to encrypted or unknown protocol traffic, and mainly include: Load entropy : Used to measure the randomness of payload byte distribution, it is defined as: in Represents byte value The probability of occurrence in the load; Byte frequency distribution : is a 256-dimensional vector, where each dimension represents the normalized frequency of the corresponding byte value in the payload, and the sum of its dimensions is 1, used to provide a statistical fingerprint of the payload.

[0040] In summary, the first The feature vector of each data packet is Its feature dimension is Before the session The feature vectors of the data packets, stacked in chronological order, can form the data trajectory matrix corresponding to the session. Before being fed into the model, all feature dimensions are standardized (e.g., Z-score standardization) to eliminate dimensional differences, accelerate model convergence, and improve overall classification performance.

[0041] The above features do not rely on any prior semantics of protocol fields or message structure, making the constructed data trajectory highly adaptable to unknown protocols and encrypted traffic.

[0042] Step 3: Classification of Two-Phase Cascading Protocols: To achieve high-precision classification of known industrial protocols and reliable detection of unknown protocols, this invention designs a two-stage cascaded protocol classification decision framework, the overall process of which is as follows: Figure 3 As shown, this framework combines a discriminative classification model with a reconstruction-based anomaly detection model, effectively supporting the discovery of unknown protocols in open environments while ensuring performance in recognizing known protocols. The core idea of ​​this two-stage design is to decouple the category discrimination problem from the distribution consistency judgment problem, thereby avoiding performance degradation of a single model in open set scenarios.

[0043] (1) Known protocol classifications: The goal of the first phase is to achieve high-precision identification of known industrial protocols. The data trajectory constructed in the previous section is essentially a session-level multidimensional time series, and a pre-trained sequence deep learning model is employed. As a protocol classifier, considering the temporal dependencies that are common in industrial protocol interactions, recurrent neural network models that can effectively model long-term dependency characteristics, such as Long Short-Term Memory (LSTM) networks or gated recurrent units, are preferred.

[0044] Input: A data trajectory matrix .

[0045] Processing procedure: The classification model sequentially reads the feature vector corresponding to each data packet in the data trajectory step by step, and learns the session-level temporal behavior pattern through the gating structure of the recurrent unit. The hidden state of the last layer of the network is mapped to the class probability distribution through a fully connected layer and an activation function.

[0046] Output: one A probability distribution vector of dimension ; Where k represents the number of known protocol categories, Represents the input trajectory Belongs to the The probability of a known protocol.

[0047] Decision-making strategy: Calculate the maximum confidence score of the classification results. .

[0048] if When the classifier's prediction for the sample is considered to have high reliability, the session is directly classified into the corresponding known protocol category, and the classification process ends; when When the confidence threshold is reached, it indicates that the classifier's judgment of the sample is uncertain. The sample may belong to some atypical known protocol behavior, or it may correspond to an unknown protocol that was not encountered during the training phase. At this point, the sample will be sent to the second phase for further analysis. The confidence threshold is one such threshold. The optimization is determined by tuning on the validation set to achieve a balance between the accuracy of known protocol classification and the ability to detect unknown protocols.

[0049] (2) Unknown protocol detection: The goal of the second stage is to further distinguish between atypical known protocols and truly unknown protocols from the low-confidence samples of the first stage. To this end, this invention introduces an anomaly detection model based on sequence reconstruction, employing an LSTM autoencoder. As an unknown protocol detector, the LSTM autoencoder consists of two parts: an encoder and a decoder, both based on the LSTM structure. The encoder maps the input data trajectory to a low-dimensional latent space representation, while the decoder attempts to reconstruct the original input sequence from this representation.

[0050] Training strategy: Model Training is performed using only normal data trajectories with known protocols, and the goal is to minimize the input trajectory. With reconstructed trajectory The reconstruction error between them. Through this training process, the model can learn the normal distribution characteristics of known protocols in session-level behavior.

[0051] Processing procedure: For low-confidence samples input from the first stage Inputting it into the trained autoencoder model yields the corresponding reconstructed output: .

[0052] Reconstruction error calculation: Mean Squared Error (MSE) is used as the measure of reconstruction error. Decision rule: Reconstruction error With preset threshold Comparison: like This indicates that the session-level behavior pattern of this sample differs significantly from the normal distribution of known protocols, and the model cannot effectively reconstruct this data trajectory, thus classifying it as an unknown protocol. This indicates that although the classifier has low confidence in its predictions, the overall behavior pattern still conforms to the distribution characteristics of known protocols, thus classifying it as an atypical known protocol. The highest probability category given by the first-stage classifier is used as its protocol type. In engineering deployment, an "atypical known protocol" can be considered an alarm / low-confidence state of a known protocol: its overall behavior still falls near the distribution of known protocols, but the classifier's confidence is insufficient, potentially corresponding to rare operations, equipment differences, configuration changes, or acquisition noise. The system can attach a warning flag to the output of such sessions and trigger subsequent actions according to a strategy (e.g., entering a manual review queue, reducing the level of automated processing, or rate limiting and auditing without affecting the control loop) to reduce the risk of misclassifying potential anomalies as normal known protocols.

[0053] Among them, the reconstruction error threshold Similarly, validation set experiments were conducted to determine the optimal protocol for balancing the detection rate and false positive rate.

[0054] Through the above two-stage cascaded decision-making mechanism, this invention constructs an open set protocol classification framework for industrial network environments. This framework can effectively identify unknown protocols that did not appear during the training phase while maintaining high classification accuracy of known protocols.

[0055] Experimental results: To closely resemble real-world industrial network scenarios, this invention constructed the following two datasets: Training dataset This dataset consists of four pre-labeled industrial protocol traffic PCAP files, with the protocol category set as follows: .

[0056] Test dataset This dataset is constructed from a mixture of two samples: one part is... The first part consists of session samples of four known industrial control protocols; the second part consists of session samples of unknown protocol traffic collected in an industrial simulation environment, which includes at least one unknown network layer protocol and one unknown link layer protocol that did not appear in the training set.

[0057] Model parameters: Sequence length of the data trajectory The feature dimension of each data packet is fixed at 10. .

[0058] Known protocol classifier The model employs a two-layer LSTM network structure, with each layer containing 64 hidden units, and Dropout (p=0.5) is added after each layer to prevent overfitting. The model is trained using the Adam optimizer (learning rate 0.001) and the cross-entropy loss function, and an early stopping mechanism based on validation set loss is introduced.

[0059] Unknown Protocol Detector The model employs an LSTM autoencoder architecture, with both the encoder and decoder being single-layer LSTMs. The latent space dimension is set to 32. The model is trained using the Adam optimizer and mean squared error loss function for a total of 150 training epochs.

[0060] Threshold setting: Classification confidence threshold The threshold is set to 0.99 to ensure that only highly reliable classification results are accepted in the first stage; the reconstruction error threshold is also set accordingly. The reconstruction error distribution of the autoencoder on the training samples was determined by statistical analysis, and its 99th percentile was used in the experiment. .

[0061] Figure 4 The classifier is given Confusion matrix results for known protocols on independent test subsets. Experimental results show that all test samples are correctly mapped to the diagonal positions of the confusion matrix, achieving accurate identification of Modbus TCP, DNP3, EtherNet / IP, and the S7 protocol with a smaller sample size. This result demonstrates that the proposed method is effective in... It has stable and reliable classification capabilities within the protocol set.

[0062] Mixed traffic test set Inputting the complete two-stage cascaded classification framework, the resulting protocol recognition statistics are as follows: Figure 5 As shown.

[0063] Known protocol identification results: The framework identified 2490 Modbus TCP sessions, 45 DNP3 sessions, 5 S7 sessions, and 4 EtherNet / IP sessions with high confidence.

[0064] Unknown protocol detection results: The framework successfully detected 112 sessions with unknown protocols, accounting for approximately 4% of the total number of sessions. Among them, 110 were identified as unknown link layer protocols and 2 as unknown network layer protocols, reflecting the reality that private link layer protocols account for a higher proportion in real industrial networks.

[0065] Atypical Protocol Identification Results: The framework also identified 14 atypical known protocol sessions, including 8 atypical Modbus TCP sessions, 5 atypical DNP3 sessions, and 1 atypical S7 session. These samples still conform to the distribution of known protocols in terms of behavioral patterns, but showed low confidence during the classification phase.

[0066] The experimental results show that the two-stage cascading framework proposed in this paper can effectively distinguish between known protocols, atypical protocols, and unknown protocols in open set industrial network environments, verifying the feasibility of the method in open set industrial network environments.

Claims

1. An industrial hybrid protocol classification method based on data trajectories, characterized in that, Includes the following steps; Step 1: Preprocess the raw network traffic and perform session aggregation and inactivity timeout segmentation based on the session key to obtain clearly defined and logically independent session samples and their metadata, providing a consistent input object for subsequent modeling; Step 2: Extract multidimensional features such as packet length, time interval, direction, and payload statistics at the session granularity, and stack, align, and truncate / padded them in chronological order to construct a fixed-length data trajectory matrix, thereby achieving a unified representation of variable-length sessions and providing a unified input for the model; Step 3: Using the data trajectory as input, a two-stage cascaded decision mechanism is adopted: the first stage classifies known protocols and outputs the category probability and confidence level; the second stage further performs unknown protocol detection and atypical known protocol identification on low-confidence or abnormal session samples to obtain the judgment result. Step 4: Fill the judgment result of Step 3 back into the corresponding session sample of Step 1 and output the protocol category, confidence level and unknown / atypical mark to realize the automatic identification and result summary of industrial mixed traffic.

2. The industrial hybrid protocol classification method based on data trajectory according to claim 1, characterized in that, Step 1 specifically involves: The original network traffic is divided into independent session units through a hierarchical session reconstruction mechanism; Raw network traffic was passively collected at the mirror port of the industrial field switch. Packet capture tools were used to capture data packets and save them as PCAP files. For the captured data packets... Define a session key generation function. To identify the session it belongs to: in, This indicates a single captured data packet; and These represent the source and destination IP addresses at the network layer, respectively. and These represent the source and destination ports at the transport layer, respectively. Indicates the transport layer protocol type (TCP / UDP); and These represent the source and destination MAC addresses at the link layer, respectively. This indicates that the fields at both ends of the communication are sorted without direction. The hierarchical session reconstruction mechanism uses the IP 5-tuple as the session identifier; When a data packet does not contain network layer or transport layer information, the mechanism adaptively falls back to session partitioning based on link layer MAC address pairs; data packets with the same session key are aggregated into a preliminary session stream.

3. The industrial hybrid protocol classification method based on data trajectory according to claim 2, characterized in that, Introduce an inactivity timeout threshold To further distinguish logically independent multiple interaction processes between the same communication entity, this threshold is used to characterize the temporal continuity of the communication process. For a time-ordered session stream, if two consecutive data packets... and The time interval between them satisfies If a single session ends at this point, a new session is started at that location. Through this process, the original network traffic is precisely divided into a set of independent sessions. ; Timeout segmentation aggregates all data packets of the same communication entity pair into candidate session streams based on the session key; further, for multiple interaction processes formed by the same entity pair in different control cycles or multiple rounds of request-response, it is further segmented based on... Idle interval breakpoints are identified within the candidate session stream, and the stream is divided into multiple logically independent session samples.

4. The industrial hybrid protocol classification method based on data trajectory according to claim 3, characterized in that, Step 2 specifically involves: Each of the sessions Abstracted into a multi-dimensional time series, called a data trajectory, the data trajectory is represented as a... 3D numerical matrix ,in For a fixed sequence length, D is the feature dimension extracted for each data packet; Used to characterize the dynamic behavior of protocols at the session level; A fixed sequence length is used to strike a balance between ensuring model input consistency and information integrity, by truncating the sequence before the session begins. The method of using individual data packets preserves the main protocol behavior characteristics; When the number of packets in a session At that time, only the first one is retained. Data packets; when When zeroing occurs, zero padding is performed at the end of the sequence. The feature vectors of the virtual data packets introduced by the padding are uniformly set to zero to avoid interfering with the real time-series feature distribution. For the first in the sequence Data packets , Its eigenvectors It consists of two categories of features: behavioral features and content features; The behavioral characteristics are used to describe the dynamic properties of data packets during the communication process and do not depend on the payload content. The content features are used to characterize the statistical distribution characteristics of the data packet payload, avoiding dependence on the semantics of specific protocol fields.

5. The industrial hybrid protocol classification method based on data trajectory according to claim 4, characterized in that, The behavioral characteristics include: Data packet length : Indicates the total length of the data packet, reflecting the data transmission scale of the protocol at different interaction stages; Time interval : Indicates a data packet Compared with the previous data packet The time difference between them is used to characterize the timing and response patterns of the protocol; Transmission direction : is a binary feature used to indicate the transmission direction of a data packet. Its direction determination is based on the source and destination addresses of the first data packet in the session.

6. The industrial hybrid protocol classification method based on data trajectory according to claim 4, characterized in that, The content features include: Load entropy : Used to measure the randomness of payload byte distribution, it is defined as: in Represents byte value The probability of occurrence in the load; Byte frequency distribution Each dimension represents the normalized frequency of the corresponding byte value in the payload, and the sum of each dimension is 1, which is used to provide a statistical fingerprint of the payload. No. The feature vector of each data packet is Before the session The feature vectors of the data packets, stacked in chronological order, can form the data trajectory matrix corresponding to the session. All feature dimensions are standardized before being fed into the model.

7. The industrial hybrid protocol classification method based on data trajectory according to claim 4, characterized in that, Step 3 specifically involves: A two-stage cascaded protocol classification decision framework is used to achieve high-precision classification of known industrial protocols and reliable detection of unknown protocols. This framework combines a discriminative classification model with a reconstruction-based anomaly detection model. The first phase aims to achieve high-precision identification of known industrial protocols. Regarding the data trajectory, which is essentially a session-level multidimensional time series, a pre-trained sequence deep learning model will be used. As a protocol classifier, a recurrent neural network model that can effectively model long-term dependency characteristics is selected; wherein, the data trajectory refers to extracting the length, interval, direction and load statistics of the intra-session data packets obtained in step 1 in chronological order, and stacking them to form a fixed-length multidimensional time series matrix representation; The goal of the second stage is to further distinguish between atypical known protocols and truly unknown protocols from the low-confidence samples of the first stage; this involves introducing an anomaly detection model based on sequence reconstruction, employing an LSTM autoencoder. As an unknown protocol detector, the LSTM autoencoder consists of two parts: an encoder and a decoder, both of which are based on the LSTM structure. The encoder maps the input data trajectory to a low-dimensional latent space representation, while the decoder attempts to reconstruct the original input sequence from this representation.

8. The industrial hybrid protocol classification method based on data trajectory according to claim 7, characterized in that, The specific steps of the first stage are as follows: input a data trajectory matrix. ; The classification model reads the feature vector corresponding to each data packet in the data trajectory step by step, and learns the temporal behavior pattern at the session level through the gating structure of the recurrent unit; the hidden state of the last layer of the network is mapped to the class probability distribution through the fully connected layer and the activation function. Output a A probability distribution vector of dimension ; Where k represents the number of known protocol categories, Represents the input trajectory Belongs to the The probability of a known protocol; Calculate the maximum confidence score of the classification results. ; if When the classifier's prediction for the sample is considered to have high reliability, the session is directly classified into the corresponding known protocol category, and the classification process ends; when When the confidence threshold is reached, it indicates that the classifier's judgment of the sample is uncertain. The sample may belong to some atypical known protocol behavior, or it may correspond to an unknown protocol that did not appear during the training phase. At this time, the sample will be sent to the second phase for further analysis. The optimization is determined by tuning on the validation set to achieve a balance between the accuracy of known protocol classification and the ability to detect unknown protocols.

9. The industrial hybrid protocol classification method based on data trajectory according to claim 7, characterized in that, The second phase specifically includes: Model Training is performed using only normal data trajectories with known protocols, and the goal is to minimize the input trajectory. With reconstructed trajectory Reconstruction error between; Through this training process, the model can learn the normal distribution characteristics of known protocols in session-level behavior; For low-confidence samples input from the first stage Inputting it into the trained autoencoder model yields the corresponding reconstructed output: ; Mean squared error is used as the measure of reconstruction error: Reconstruction error With preset threshold Comparison: like This indicates that the session-level behavior pattern of this sample differs significantly from the normal distribution of known protocols, and the model is unable to effectively reconstruct the data trajectory, thus classifying it as an unknown protocol. like This indicates that although the classifier has low confidence in its prediction, its overall behavior pattern still conforms to the distribution characteristics of known protocols. Therefore, it is classified as an atypical known protocol, and the highest probability category given by the first-stage classifier is used as its protocol type. Among them, the reconstruction error threshold Similarly, validation set experiments were conducted to determine the optimal protocol for balancing the detection rate and false positive rate.

10. The industrial hybrid protocol classification method based on data trajectory according to claim 7, characterized in that, Step 4 specifically involves associating the predicted protocol category and its classification confidence score output in step 3 with the metadata of each session sample obtained in step 1, and outputting the protocol type label and classification confidence score for each session; when a session is determined to be an unknown protocol, outputting an unknown protocol label and the corresponding reconstruction error score. When a session is determined to be an atypical known protocol, an alarm / low-confidence flag is added to the output and a reference known protocol category is given; at the same time, the session results within the preset time window are statistically summarized to generate analysis results on the distribution of mixed traffic protocols, the number and proportion of unknown protocols.

Images