This invention discloses a method and related equipment for identifying key fields in industrial control protocols, belonging to the field of cyberspace security technology. The method includes: if a
delimiter exists in the message, identifying key fields in the protocol using the features of the
delimiter; if no
delimiter exists in the message, performing type-length-value decoding on the protocol; if decoding is successful, identifying key fields in the protocol using type-length-value decoding; if decoding fails, when there is only one length field in the protocol, identifying the length
field based on the correlation between the
message length difference and the field value difference, and identifying the structure identifier
field based on the consistency of the field value in similar messages; when there are multiple length fields in the protocol, identifying the structure identifier
field based on the protocol spectrum and
convolutional neural network, and identifying the length field based on multidimensional
hypothesis testing. This method can effectively identify structure identifier fields and length fields in industrial control protocols.