基于网络流量的工业控制协议逆向工程算法模型研究

工业物联网需要连接各种工业设备和工业过程以实现智能制造。工业设备间的连接可能采用标准或专用通信协议。对于专用协议形成的壁垒，可以采用协议逆向工程，通过分析通讯报文来推断未知协议的格式。但该领域现有工作主要针对互联网协议，也就是文本类协议，而对于以二进制为主的工业控制协议则很难实现。考虑到工业控制协议中存在多个连续子报文嵌在长消息负载中的现象并具有同样的子报文格式，本研究提出了一种新的子报文提取算法SEIP（Sub-messages Extraction for Industrial control Protocol），通过使用模板迭代作为中间步骤，形成完整的消息格式推断框架，并改进了评估准则来评估子报文提取结果。针对工业控制协议内部命令的聚类，本研究提出了一种新的聚类模型TAEIP（Transformer-based Auto-Encoder for Industrial control Protocol command clustering），采用基于Transformer的孪生网络自编码器来实现请求与响应的对应性训练，并使用中间隐藏层来进行聚类。本研究在三种常见的工业控制协议：Modbus/TCP，EthernetIP/CIP，和S7Communication上验证算法模型。实验表明SEIP算法可以极大地提高整个协议的准确性，以及TAEIP聚类模型针对工业控制协议内部命令聚类的准确性。

[1] 何慧霞, 魏桂英, 武森, 等. 智能制造评价理论研究现状及未来展望[J/OL]. 中国工程科学,2022: 1-8. https://kns.cnki.net/kcms/detail/11.4421.G3.20220217.1544.044.html.
[2] 孙毅, 罗穆雄. 美国智能制造的发展及启示[J]. 中国科学院院刊, 2021, 36: 1316-1325.
[3] 周勇, 赵聃, 刘志迎. 我国智能制造发展实践及突破路径研究[J/OL]. 中国工程科学, 2021:1-8. https://kns.cnki.net/kcms/detail/11.4421.g3.20211103.1516.006.html.
[4] 修昭远. 无线工业物联网协议互通研究与实践[D]. 北方工业大学, 2020.
[5] 余晓晖, 刘默, 蒋昕昊, 等. 工业互联网体系架构 2.0[J]. 计算机集成制造系统, 2019, 25:2983-2996.
[6] 余晓晖, 张恒升, 彭炎, 等. 工业互联网网络连接架构和发展趋势[J]. 中国工程科学, 2018,20: 79-84.
[7] 李东. 震网病毒事件浅析及工控安全防护能力提升启示[J]. 网络安全技术与应用, 2019:9-10+24.
[8] FIGUEROA S, AÑORGA J, ARRIZABALAGA S. A survey of iiot protocols: A measure of vulnerability risk analysis based on CVSS[J]. ACM Comput. Surv., 2020, 53(2): 44:1-44:53.
[9] VARGAS H E, CASELLI M, PETER A. Automatic deployment of specification-based intrusion detection in the bacnet protocol[C]//Proceedings of the 2017 Workshop on Cyber-Physical Systems Security and PrivaCy, Dallas, TX, USA, November 3, 2017. 2017: 25-36.
[10] LONGARI S, PENCO M, CARMINATI M, et al. Copycan: An error-handling protocol based intrusion detection system for controller area network[C]//Proceedings of the ACM Workshop on Cyber-Physical Systems Security & Privacy, CPS-SPC@CCS 2019, London, UK, November 11, 2019. 2019: 39-50.
[11] SHENG C, YAO Y, FU Q, et al. A cyber-physical model for SCADA system and its intrusion detection[J]. Computer Networks, 2021, 185: 107677.
[12] ZOLANVARI M, TEIXEIRA M A, GUPTA L, et al. Machine learning-based network vulnerability analysis of industrial internet of things[J]. IEEE Internet of Things Journal, 2019, 6(4): 6822-6834.
[13] NEGI R, KUMAR P, GHOSH S, et al. Vulnerability assessment and mitigation for industrial critical infrastructures with cyber physical test bed[C]//IEEE International Conference on Industrial Cyber Physical Systems, ICPS 2019, Taipei, Taiwan, May 6-9, 2019. 2019: 145-152.
[14] LV W Y, XIONG J W, SHI J Q, et al. A deep convolution generative adversarial networks based fuzzing framework for industry control protocols[J]. Journal of Intelligent Manufacturing, 2021, 32(2): 441-457.
[15] TYCHALAS D, MANIATAKOS M. IFFSET: in-field fuzzing of industrial control systems using system emulation[C]//2020 Design, Automation & Test in Europe Conference & Exhibition, DATE 2020, Grenoble, France, March 9-13, 2020. 2020: 662-665.
[16] ZHAO H, LI Z H, WEI H S, et al. Seqfuzzer: An industrial protocol fuzzing framework from a deep learning perspective[C]//12th IEEE Conference on Software Testing, Validation and Verification, ICST 2019, Xi’an, China, April 22-27, 2019. 2019: 59-67.
[17] HUANG D J, SHI X F, ZHANG W A. False data injection attack detection for industrial control systems based on both time- and frequency-domain analysis of sensor data[J]. IEEE Internet of Things Journal, 2021, 8(1): 585-595.
[18] KHALED A, OUCHANI S, TARI Z, et al. Assessing the severity of smart attacks in industrial cyber-physical systems[J]. ACM Transactions on Cyber-Physical Systems, 2021, 5(1): 10:1-10:28.
[19] ZHOU H P, SHEN S G, LIU J H. Malware propagation model in wireless sensor networks under attack-defense confrontation[J]. Computer Communication, 2020, 162: 51-58.
[20] HADEM P, SAIKIA D K, MOULIK S. An sdn-based intrusion detection system using SVM with selective logging for IP traceback[J]. Computer Networks, 2021, 191: 108015.
[21] CABALLERO J, YIN H, LIANG Z K, et al. Polyglot: automatic extraction of protocol message format using dynamic binary analysis[C]//Proceedings of the 2007 ACM Conference on Computer and Communications Security, CCS 2007, Alexandria, Virginia, USA, October 28-31, 2007. 2007: 317-329.
[22] WONDRACEK G, COMPARETTI P M, KRÜGEL C, et al. Automatic network protocol analysis[C]//Proceedings of the Network and Distributed System Security Symposium, NDSS 2008, San Diego, California, USA, 10th February - 13th February 2008. 2008.
[23] LIN Z Q, JIANG X X, XU D Y, et al. Automatic protocol format reverse engineering through context-aware monitored execution[C]//Proceedings of the Network and Distributed System Security Symposium, NDSS 2008, San Diego, California, USA, 10th February - 13th February 2008. 2008.
[24] CABALLERO J, POOSANKAM P, KREIBICH C, et al. Dispatcher: enabling active botnet infiltration using automatic protocol reverse-engineering[C]//Proceedings of the 2009 ACM Conference on Computer and Communications Security, CCS 2009, Chicago, Illinois, USA, November 9-13, 2009. 2009: 621-634.
[25] KLEBER S, MAILE L, KARGL F. Survey of protocol reverse engineering algorithms: Decomposition of tools for static traffic analysis[J]. IEEE Communication Survey and Tutorials, 2019, 21(1): 526-561.
[26] BEDDOE M A. Network protocol analysis using bioinformatics algorithms[J]. Toorcon, 2004.
[27] NEEDLEMAN S B, WUNSCH C D. A general method applicable to the search for similarities in the amino acid sequence of two proteins[J]. Journal of molecular biology, 1970, 48(3): 443-453.
[28] WATERMAN M S, SMITH T F, KATCHER H L. Algorithms for restriction map comparisons [J/OL]. Nucleic Acids Research, 1984, 12(1): 237-242. https://doi.org/10.1093/nar/12.1Part1.237.
[29] CUI W D, PAXSON V, WEAVER N, et al. Protocol-independent adaptive replay of application dialog[C/OL]//Proceedings of the Network and Distributed System Security Symposium, NDSS 2006, San Diego, California, USA. 2006. https://www.ndss-symposium.org/ndss2006/protocol-independent-adaptive-replay-application-dialog/.
[30] CUI W D, KANNAN J, WANG H J. Discoverer: Automatic protocol reverse engineering from network traces[C/OL]//Proceedings of the 16th USENIX Security Symposium, Boston, MA, USA, August 6-10, 2007. 2007. https://www.usenix.org/conference/16th-usenix-security-sym posium/discoverer-automatic-protocol-reverse-engineering-network.
[31] WHALEN S, BISHOP M, CRUTCHFIELD J P. Hidden markov models for automated protocol learning[C/OL]//Security and Privacy in Communication Networks - 6th Iternational ICST Conference, SecureComm 2010, Singapore, September 7-9, 2010. Proceedings. 2010: 415-428. https://doi.org/10.1007/978-3-642-16161-2_24.
[32] LI H F, SHUAI B, WANG J, et al. Protocol reverse engineering using LDA and association analysis[C/OL]//11th International Conference on Computational Intelligence and Security, CIS 2015, Shenzhen, China, December 19-20, 2015. 2015: 312-316. https://doi.org/10.1109/CIS. 2015.83.
[33] BERMUDEZ I, TONGAONKAR A, ILIOFOTOU M, et al. Automatic protocol field inference for deeper protocol understanding[C/OL]//Proceedings of the 14th IFIP Networking Conference, Networking 2015, Toulouse, France, 20-22 May, 2015. 2015: 1-9. https://doi.org/10.1109/IFIPNetworking.2015.7145307.
[34] KLEBER S, KOPP H, KARGL F. NEMESYS: network message syntax reverse engineering by analysis of the intrinsic structure of individual messages[C/OL]//12th USENIX Workshop on Offensive Technologies, WOOT 2018, Baltimore, MD, USA, August 13-14, 2018. 2018. https://www.usenix.org/conference/woot18/presentation/kleber.
[35] BOSSERT G, GUIHÉRY F, HIET G. Towards automated protocol reverse engineering using semantic information[C]//9th ACM Symposium on Information, Computer and Communications Security, ASIA CCS ’14, Kyoto, Japan - June 03 - 06, 2014. 2014: 51-62.
[36] POHL J, NOACK A. Universal radio hacker: A suite for analyzing and attacking stateful wireless protocols[C/OL]//12th USENIX Workshop on Offensive Technologies, WOOT 2018, Baltimore, MD, USA, August 13-14, 2018. 2018. https://www.usenix.org/conference/woot18/presentation/pohl.
[37] POHL J, NOACK A. Automatic wireless protocol reverse engineering[C/OL]//13th USENIX Workshop on Offensive Technologies, WOOT 2019, Santa Clara, CA, USA, August 12-13, 2019. 2019. https://www.usenix.org/conference/woot19/presentation/pohl.
[38] LáDI G, BUTTYáN L, HOLCZER T. Message format and field semantics inference for binary protocols using recorded network traffic[C]//2018 26th International Conference on Software, Telecommunications and Computer Networks (SoftCOM). 2018: 1-6.
[39] YE Y P, ZHANG Z, WANG F, et al. Netplier: Probabilistic network protocol reverse engineering from message traces[C/OL]//28th Annual Network and Distributed System Security Symposium, NDSS 2021, virtually, February 21-25, 2021. 2021. https://www.ndss-symposium.org/ndss-paper/netplier-probabilistic-network-protocol-reverse-engineering-from-message-traces/.
[40] TAO S Y, YU H Y, LI Q. Bit-oriented format extraction approach for automatic binary protocol reverse engineering[J/OL]. IET Communication, 2016, 10(6): 709-716. https://doi.org/10.1049/iet-com.2015.0797.
[41] 张蔚瑶, 张磊, 毛建瓴, 等. 未知协议的逆向分析与自动化测试[J]. 计算机学报, 2020, 43:653-667.
[42] HE Y H, SHEN J L, XIAO K, et al. A sparse protocol parsing method for iiot protocols based on HMM hybrid model[C/OL]//2020 IEEE International Conference on Communications, ICC 2020, Dublin, Ireland, June 7-11, 2020. 2020: 1-6. https://doi.org/10.1109/ICC40277.2020.9149040.
[43] WANG X W, LV K Z, LI B. IPART: an automatic protocol reverse engineering tool based on global voting expert for industrial protocols[J/OL]. International Journal of Parallel, Emergent and Distributed Systems, 2020, 35(3): 376-395. https://doi.org/10.1080/17445760.2019.1655740.
[44] HEI X H, BAI B B, WANG Y C, et al. Feature extraction optimization for bitstream communication protocol format reverse analysis[C/OL]//18th IEEE International Conference On Trust, Security And Privacy In Computing And Communications / 13th IEEE International Conference On Big Data Science And Engineering, TrustCom/BigDataSE 2019, Rotorua, New Zealand, August 5-8, 2019. 2019: 662-669. https://doi.org/10.1109/TrustCom/BigDataSE.2019.00094.
[45] LUO X, CHEN D, WANG Y J, et al. A type-aware approach to message clustering for protocol reverse engineering[J/OL]. Sensors, 2019, 19(3): 716. https://doi.org/10.3390/s19030716.
[46] 张洪泽, 洪征, 王辰, 等. 基于闭合序列模式挖掘的未知协议格式推断方法[J]. 计算机科学, 2019, 46: 80-89.
[47] KLEBER S, VAN DER HEIJDEN R W, KARGL F. Message type identification of binary network protocols using continuous segment similarity[C/OL]//39th IEEE Conference on Computer Communications, INFOCOM 2020, Toronto, ON, Canada, July 6-9, 2020. 2020: 2243-2252. https://doi.org/10.1109/INFOCOM41043.2020.9155275.
[48] WANG Y P, LI X J, MENG J, et al. Biprominer: Automatic mining of binary protocol features [C/OL]//12th International Conference on Parallel and Distributed Computing, Applications and Technologies, PDCAT 2011, Gwangju, Korea, October 20-22, 2011. 2011: 179-184. https://doi.org/10.1109/PDCAT.2011.25.
[49] WANG Y P, YUN X C, SHAFIQ M Z, et al. A semantics aware approach to automated reverse engineering unknown protocols[C/OL]//20th IEEE International Conference on Network Protocols, ICNP 2012, Austin, TX, USA, October 30 - Nov. 2, 2012. 2012: 1-10. https://doi.org/10.1109/ICNP.2012.6459963.
[50] LUO J Z, YU S Z. Position-based automatic reverse engineering of network protocols[J/OL]. Journal of Network and Computer Applications, 2013, 36(3): 1070-1077. https://doi.org/10.1016/j.jnca.2013.01.013.
[51] CAI J, LUO J Z, LEI F Y. Analyzing network protocols of application layer using hidden semi-markov model[J/OL]. Mathematical Problems in Engineering, 2016: 1024-123X. https://doi.org/10.1155/2016/9161723.
[52] XIAO M M, ZHANG S L, LUO Y P. Automatic network protocol message format analysis [J/OL]. Journal of Intelligent and Fuzzy Systems, 2016, 31(4): 2271-2279. https://doi.org/10.3233/JIFS-169067.
[53] 侯方杰, 王雷, 王嵩, 等. 基于位置的自动化网络流协议逆向分析方法[J/OL]. 计算机工程,2019, 45: 84-87. https://kns.cnki.net/kcms/detail/31.1289.TP.20180626.1732.006.html.
[54] LEITA C, MERMOUD K, DACIER M. Scriptgen: an automated script generation tool for honeyd[C/OL]//21st Annual Computer Security Applications Conference (ACSAC 2005), 5-9 December 2005, Tucson, AZ, USA. 2005: 203-214. https://doi.org/10.1109/CSAC.2005.49.
[55] SHEVERTALOV M, MANCORIDIS S. A reverse engineering tool for extracting protocols of networked applications[C/OL]//14th Working Conference on Reverse Engineering (WCRE 2007), 28-31 October 2007, Vancouver, BC, Canada. 2007: 229-238. https://doi.org/10.1109/WCRE.2007.6.
[56] TRIFILO A, BURSCHKA S, BIERSACK E W. Traffic to protocol reverse engineering[C/OL]//2009 IEEE Symposium on Computational Intelligence for Security and Defense Applications, CISDA 2009, Ottawa, Canada, July 8-10, 2009. 2009: 1-8. https://doi.org/10.1109/CISDA.2009.5356565.
[57] GORBUNOV S, ROSENBLOOM A. Autofuzz: Automated network protocol fuzzing framework[C]//International Journal of Computer Science and Network Security, August, 2010. 2010.
[58] ANTUNES J, NEVES N F, VERÍSSIMO P. Reverse engineering of protocols from network traces[C/OL]//18th Working Conference on Reverse Engineering, WCRE 2011, Limerick, Ireland, October 17-20, 2011. 2011: 169-178. https://doi.org/10.1109/WCRE.2011.28.
[59] KRUEGER T, GASCON H, KRÄMER N, et al. Learning stateful models for network honeypots [C/OL]//Proceedings of the 5th ACM Workshop on Security and Artificial Intelligence, AISec 2012, Raleigh, NC, USA, October 19, 2012. 2012: 37-48. https://doi.org/10.1145/2381896.2381904.
[60] WANG Y P, ZHANG Z B, YAO D F, et al. Inferring protocol state machine from network traces: A probabilistic approach[C/OL]//Applied Cryptography and Network Security - 9th International Conference, ACNS 2011, Nerja, Spain, June 7-10, 2011. Proceedings. 2011: 1-18. https://doi.org/10.1007/978-3-642-21554-4_1.
[61] XIAO M M, LUO Y P. Automatic protocol reverse engineering using grammatical inference [J/OL]. Journal of Intelligent and Fuzzy Systems, 2017, 32(5): 3585-3594. https://doi.org/10.3233/JIFS-169294.
[62] DUCHÊNE J, GUERNIC C L, ALATA E, et al. State of the art of network protocol reverse engineering tools[J]. Journal of Computer Virology and Hacking Techniques, 2018, 14(1): 53-68.
[63] LIN Y D, LAI Y K, BUI Q T, et al. Refsm: Reverse engineering from protocol packet traces to test generation by extended finite state machines[J]. Journal of Network and Computer Applications, 2020, 171: 102819.
[64] BLEI D M, NG A Y, JORDAN M I. Latent dirichlet allocation[J/OL]. Journal of Machine Learning Research, 2003, 3: 993-1022. http://jmlr.org/papers/v3/blei03a.html.
[65] JOYCE J M. Kullback-leibler divergence[M/OL]//International Encyclopedia of Statistical Science. 2011: 720-722. https://doi.org/10.1007/978-3-642-04898-2_327.
[66] P. J. The distribution of the flora in the alpine zone[J]. New Phytologist, 1912, 11(2): 37-50.
[67] YU S Z. Hidden semi-markov models[J/OL]. Artificial Intelligence, 2010, 174(2): 215-243. https://doi.org/10.1016/j.artint.2009.11.011.
[68] SAITTA L, SEBAG M. Grammatical inference[M/OL]//Encyclopedia of Machine Learning and Data Mining. 2017: 569-570. https://doi.org/10.1007/978-1-4899-7687-1_115.
[69] RIECK K, WRESSNEGGER C, BIKADOROV A. Sally: a tool for embedding strings in vector spaces[J]. Journal of Machine Learning Research, 2012, 13: 3247-3251.
[70] BENESTY J, CHEN J, HUANG Y, et al. Pearson correlation coefficient[M]//Noise reduction in speech processing. Springer, 2009: 1-4.
[71] LÜKE H D, SCHOTTEN H D, HADINEJAD-MAHRAM H. Binary and quadriphase sequences with optimal autocorrelation properties: a survey[J]. IEEE Transactions on Information Theory, 2003, 49(12): 3271-3282.
[72] DURBIN R, EDDY S R, KROGH A, et al. Biological sequence analysis: Probabilistic models of proteins and nucleic acids[M]. Cambridge University Press, 1998.
[73] VASWANI A, SHAZEER N, PARMAR N, et al. Attention is all you need[C/OL]//Advances in Neural Information Processing Systems 30: Annual Conference on Neural Information Processing Systems 2017, December 4-9, 2017, Long Beach, CA, USA. 2017: 5998-6008. https://proceedings.neurips.cc/paper/2017/hash/3f5ee243547dee91fbd053c1c4a845aa-Abstract.html.
[74] DEVLIN J, CHANG M W, LEE K, et al. BERT: pre-training of deep bidirectional transformers for language understanding[C/OL]//Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, NAACL-HLT 2019, Minneapolis, MN, USA, June 2-7, 2019, Volume 1 (Long and Short Papers). 2019: 4171-4186. https://doi.org/10.18653/v1/n19-1423.
[75] REIMERS N, GUREVYCH I. Sentence-bert: Sentence embeddings using siamese bertnetworks[C/OL]//Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing, EMNLP-IJCNLP 2019, Hong Kong, China, November 3-7, 2019. 2019: 3980-3990. https://doi.org/10.18653/v1/D19-1410.
[76] BAHDANAU D, CHO K, BENGIO Y. Neural machine translation by jointly learning to align and translate[C/OL]//3rd International Conference on Learning Representations, ICLR 2015, San Diego, CA, USA, May 7-9, 2015, Conference Track Proceedings. 2015. http://arxiv.org/abs/1409.0473.
[77] THAKUR N, REIMERS N, DAXENBERGER J, et al. Augmented SBERT: data augmentation method for improving bi-encoders for pairwise sentence scoring tasks[C/OL]//Proceedings of the 2021 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, NAACL-HLT 2021, Online, June 6-11, 2021. 2021: 296-310. https://doi.org/10.18653/v1/2021.naacl-main.28.
[78] SANH V, DEBUT L, CHAUMOND J, et al. Distilbert, a distilled version of BERT: smaller, faster, cheaper and lighter[J/OL]. CoRR, 2019, abs/1910.01108. http://arxiv.org/abs/1910.01108.
[79] LIU Y H, OTT M, GOYAL N, et al. Roberta: A robustly optimized BERT pretraining approach [J/OL]. CoRR, 2019, abs/1907.11692. http://arxiv.org/abs/1907.11692.
[80] MIKOLOV T, KARAFIÁT M, BURGET L, et al. Recurrent neural network based language model[C/OL]//INTERSPEECH 2010, 11th Annual Conference of the International Speech Communication Association, Makuhari, Chiba, Japan, September 26-30, 2010. 2010: 1045-1048. http://www.isca-speech.org/archive/interspeech_2010/i10_1045.html.
[81] JÓZEFOWICZ R, VINYALS O, SCHUSTER M, et al. Exploring the limits of language modeling[J/OL]. CoRR, 2016, abs/1602.02410. http://arxiv.org/abs/1602.02410.
[82] WANG K X, REIMERS N, GUREVYCH I. TSDAE: using transformer-based sequential denoising auto-encoderfor unsupervised sentence embedding learning[C/OL]//Findings of the Association for Computational Linguistics: EMNLP 2021, Virtual Event / Punta Cana, Dominican Republic, 16-20 November, 2021. 2021: 671-688. https://doi.org/10.18653/v1/2021.finding s-emnlp.59.
[83] GAO T Y, YAO X C, CHEN D Q. Simcse: Simple contrastive learning of sentence embeddings[C/OL]//Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing, EMNLP 2021, Virtual Event / Punta Cana, Dominican Republic, 7-11 November, 2021. 2021: 6894-6910. https://doi.org/10.18653/v1/2021.emnlp-main.552.
[84] CARLSSON F, GYLLENSTEN A C, GOGOULOU E, et al. Semantic re-tuning with contrastive tension[C/OL]//9th International Conference on Learning Representations, ICLR 2021, Virtual Event, Austria, May 3-7, 2021. 2021. https://openreview.net/forum?id=Ov_sMNau-PF.