CN111723181A - A Reverse Analysis Method of Industrial Control Protocol Based on Active Learning - Google Patents

Abstract

The invention discloses a reverse analysis method of industrial control protocol based on active learning. Then use the result to conduct interactive active learning with the industrial computer, and continuously acquire new messages, so as to more accurately and completely infer the lexical and syntax of the protocol, and use Needleman‑ Wunsch sequence alignment algorithm, the algorithm infers the format and state machine of the protocol through similarity scoring and optimal backtracking steps, which effectively ensures the accuracy of the analysis results. It matches the protocol format of the industrial control protocol, judges whether the packet matches these protocol formats, and performs repeated matching according to the requirements, which significantly improves the accuracy and coverage of the reverse industrial control protocol.

Description

A Reverse Analysis Method of Industrial Control Protocol Based on Active Learning

technical field

The invention relates to the technical field of protocol format analysis, in particular to a method for reverse analysis of industrial control protocols based on active learning.

Background technique

Industrial control system, referred to as industrial control system, is an automatic control system composed of computer equipment and industrial process control components. It is widely used in electric power, water treatment, oil and gas, chemical industry, transportation, manufacturing and other industries. Networking and informatization, more and more industrial control devices are connected to the network, which brings great security risks while being convenient to use. and other technologies to detect the industrial control protocol, so as to dig out whether there is a security loophole in the industrial control protocol.

The reverse analysis of the unknown industrial control protocol mainly adopts the analysis method based on network traffic. This method is more general. It only needs to import the communication sample of the industrial control protocol into the analysis system in the form of pcap, and then the format of the industrial control protocol can be obtained by reverse analysis. However, there is a big problem with this traditional processing method. In many cases, the samples of industrial control protocols cannot cover all the message formats and state machines of the protocol, which will lead to inaccurate and incomplete analysis results. , there is an urgent need for a reverse analysis method of industrial control protocol based on active learning to solve the problems existing in the prior art.

SUMMARY OF THE INVENTION

The present invention provides a reverse analysis method of industrial control protocol based on active learning, which can effectively solve the problem that the traditional processing method proposed in the above background technology often fails to cover all the message formats and state machines of the protocol, resulting in inconsistent analysis results. Inaccurate and incomplete questions.

In order to achieve the above object, the present invention provides the following technical solutions: a method for reverse analysis of industrial control protocols based on active learning, comprising the following steps:

S1. Import: import the message data in the pcap file, and load all the message data into the original set of the message data set;

S2. Preliminary analysis: perform reverse analysis on the packets in the packet data set OriginalSet by the algorithm, and obtain the preliminary industrial control protocol format and state machine;

S3. Mutation: According to the preliminary analysis results, the function code field in the protocol format is mutated to generate a new message;

S4. Matching: Through interactive active learning, the response message is matched with the protocol format in the preliminary analysis result, and the message that does not match the existing protocol format is filtered out and added to the message data set NewSet;

S5. Merge: reversely analyze the messages after the active learning, and merge the analyzed results with the preliminary analysis results to obtain a complete analysis result.

Preferably, in step S1, the operating environment is a PC with an Intel-Windows architecture, an industrial computer running an industrial control protocol server-side program, and a sample data set in a pcap format, which is obtained by capturing packets using a wireshark tool.

Preferably, in step S2, the algorithm performs reverse analysis on the packets in the original set of packet data set, wherein, the Needleman-Wunsch sequence alignment algorithm is used in the reverse analysis of the protocol, and the similarity score and optimal Backtracking infers the format and state machine of the protocol.

Preferably, in step S4, the new message is used for interactive active learning with the industrial computer, and new messages are continuously obtained, and the specific steps include:

a. Send the newly generated message to the industrial computer, and receive the response message from the industrial computer;

b. Match the response message with the protocol format in the preliminary analysis result, and judge whether the message matches these protocol formats. If it matches, go to step d, otherwise go to step c;

c. Add the response message of the industrial computer to the NewSet collection;

d. Determine whether the active learning process is over, if the active learning is completed, otherwise return to step a.

Preferably, in step S5, after active learning, the Needleman-Wunsch sequence alignment algorithm is used to reversely analyze the messages in the message data set NewSet to obtain a new industrial control protocol format and state machine, and analyze the The latter results were combined with the results of the preliminary analysis.

Compared with the prior art, the beneficial effects of the present invention are as follows: the present invention has a scientific and reasonable structure, is safe and convenient to use, and can master some message formats and state machines of the industrial control protocol by preliminarily analyzing the pcap message samples of the industrial control protocol, and then utilize The result is interactive and active learning with the industrial computer, and new messages are continuously obtained, so as to more accurately and completely infer the lexical and grammar of the protocol, and the Needleman-Wunsch sequence alignment algorithm is used in the reverse analysis of the protocol. , the algorithm infers the format and state machine of the protocol through similarity scoring and optimal backtracking steps, which effectively ensures the accuracy of the analysis results. At the same time, combined with the active learning process, the response message is matched with the protocol format in the preliminary analysis results. , judging whether the message matches these protocol formats, and performing repeated matching according to requirements, which significantly improves the accuracy and coverage of the reverse engineering of industrial control protocols.

Description of drawings

The accompanying drawings are used to provide a further understanding of the present invention, and constitute a part of the specification, and are used to explain the present invention together with the embodiments of the present invention, and do not constitute a limitation to the present invention.

In the attached image:

Fig. 1 is the schematic block diagram of the industrial control protocol reverse analysis method of active learning of the present invention;

FIG. 2 is a schematic block diagram of active learning for matching according to the present invention.

Detailed ways

The preferred embodiments of the present invention will be described below with reference to the accompanying drawings. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present invention, but not to limit the present invention.

Embodiment: As shown in Figure 1, a method for reverse analysis of industrial control protocol based on active learning includes the following steps:

S1. Import: import the message data in the pcap file, and load all the message data into the original set of the message data set;

S2. Preliminary analysis: perform reverse analysis on the packets in the packet data set OriginalSet by the algorithm, and obtain the preliminary industrial control protocol format and state machine;

S3. Mutation: According to the preliminary analysis results, the function code field in the protocol format is mutated to generate a new message;

S4. Matching: Through interactive active learning, the response message is matched with the protocol format in the preliminary analysis result, and the message that does not match the existing protocol format is filtered out and added to the message data set NewSet;

S5. Merge: reversely analyze the messages after the active learning, and merge the analyzed results with the preliminary analysis results to obtain a complete analysis result.

Further, in step S1, the operating environment is a PC with an Intel-Windows architecture, an industrial computer running an industrial control protocol server-side program, and a sample data set with a format of pcap type, and the wireshark tool is used to obtain by capturing packets, Among them, in this embodiment, the PC hardware is a PC with a Core eight-core CPU with a main frequency of 2.5GHz and above, a memory ≥ 4GB, a hard disk of 500GB, running Windows 10 operating system, and the main frequency of the industrial computer hardware is 2.5GHz and above. A PC with the above Core eight-core CPU, memory ≥2GB, hard disk 100GB, running Windows 10 operating system.

Further, in step S2, the algorithm performs a reverse analysis on the packets in the packet data set OriginalSet, wherein, the Needleman-Wunsch sequence alignment algorithm is used in the reverse analysis of the protocol, and the similarity score and optimal Backtracking infers the format and state machine of the protocol.

As shown in Figure 2, in step S4, the new message is used for interactive active learning with the industrial computer, and new messages are continuously obtained. The specific steps include:

a. Send the newly generated message to the industrial computer, and receive the response message from the industrial computer;

b. Match the response message with the protocol format in the preliminary analysis result, and judge whether the message matches these protocol formats. If it matches, go to step d, otherwise go to step c;

c. Add the response message of the industrial computer to the NewSet collection;

d. Determine whether the active learning process is over, if the active learning is completed, otherwise return to step a.

Using the method of active learning, the test machine actively communicates with the industrial computer, and uses the variation of the message content to obtain a new message format and state machine, so as to optimize and improve the analysis results of the industrial control protocol.

Further, in step S5, after the active learning, by using the Needleman-Wunsch sequence alignment algorithm again to reversely analyze the messages in the message data set NewSet, a new industrial control protocol format and state machine are obtained, and the analysis is performed. The final results are merged with the preliminary analysis results to obtain the complete analysis results, save all the analysis results, and end the analysis.

Finally, it should be noted that the above descriptions are only preferred examples of the present invention, and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still Modifications are made to the technical solutions described in the foregoing embodiments, or equivalent replacements are made to some of the technical features therein. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included within the protection scope of the present invention.

Claims (5)

1. an industrial control protocol reverse analysis method based on active learning, is characterized in that, comprises the steps: S1. Import: import the message data in the pcap file, and load all the message data into the original set of the message data set; S2. Preliminary analysis: perform reverse analysis on the packets in the packet data set OriginalSet by the algorithm, and obtain the preliminary industrial control protocol format and state machine; S3. Mutation: According to the preliminary analysis results, the function code field in the protocol format is mutated to generate a new message; S4. Matching: Through interactive active learning, the response message is matched with the protocol format in the preliminary analysis result, and the message that does not match the existing protocol format is filtered out and added to the message data set NewSet; S5. Merge: reversely analyze the messages after the active learning, and merge the analyzed results with the preliminary analysis results to obtain a complete analysis result. 2. a kind of industrial control protocol reverse analysis method based on active learning according to claim 1, is characterized in that: in step S1, the operating environment is the PC of Intel-Windows architecture and the industrial control that has run the industrial control protocol server-side program The sample data set of the machine and format is pcap type, and is obtained by capturing packets using the wireshark tool. 3. a kind of industrial control protocol reverse analysis method based on active learning according to claim 1 is characterized in that: in step S2, the algorithm is reversely analyzed to the message in the message data set OriginalSet, wherein, to the protocol The Needleman-Wunsch sequence alignment algorithm was used for reverse analysis, and the format and state machine of the protocol were inferred through similarity scoring and optimal backtracking. 4. a kind of industrial control protocol reverse analysis method based on active learning according to claim 1, is characterized in that: in step S4, utilize new message and industrial computer to carry out interactive active learning, continuously obtain new message , the specific steps include: a. Send the newly generated message to the industrial computer, and receive the response message from the industrial computer; b. Match the response message with the protocol format in the preliminary analysis result, and judge whether the message matches these protocol formats. If it matches, go to step d, otherwise go to step c; c. Add the response message of the industrial computer to the NewSet collection; d. Determine whether the active learning process is over, if the active learning is completed, otherwise return to step a. 5. a kind of industrial control protocol reverse analysis method based on active learning according to claim 1, is characterized in that: in step S5, after active learning, by adopting Needleman-Wunsch sequence comparison algorithm again to the message data set The messages in the NewSet are reversely analyzed to obtain a new industrial control protocol format and state machine, and the analyzed results are combined with the preliminary analysis results.

Images