CN112134737A - Reverse analysis system of industrial Internet of things - Google Patents
Reverse analysis system of industrial Internet of things Download PDFInfo
- Publication number
- CN112134737A CN112134737A CN202010992297.XA CN202010992297A CN112134737A CN 112134737 A CN112134737 A CN 112134737A CN 202010992297 A CN202010992297 A CN 202010992297A CN 112134737 A CN112134737 A CN 112134737A
- Authority
- CN
- China
- Prior art keywords
- things
- industrial internet
- data
- protocol
- model
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 238000004458 analytical method Methods 0.000 title claims abstract description 40
- 238000012549 training Methods 0.000 claims abstract description 30
- 238000000034 method Methods 0.000 claims abstract description 20
- 238000003062 neural network model Methods 0.000 claims abstract description 15
- 238000007781 pre-processing Methods 0.000 claims abstract description 9
- 239000011159 matrix material Substances 0.000 claims description 27
- 230000006870 function Effects 0.000 claims description 24
- 238000004891 communication Methods 0.000 claims description 14
- 238000012360 testing method Methods 0.000 claims description 10
- 238000004140 cleaning Methods 0.000 claims description 5
- 238000013480 data collection Methods 0.000 claims description 5
- 238000001914 filtration Methods 0.000 claims description 5
- 238000012795 verification Methods 0.000 claims description 4
- ORILYTVJVMAKLC-UHFFFAOYSA-N Adamantane Natural products C1C(C2)CC3CC1CC2C3 ORILYTVJVMAKLC-UHFFFAOYSA-N 0.000 claims description 3
- 230000004913 activation Effects 0.000 claims description 3
- 238000002372 labelling Methods 0.000 claims description 3
- 238000005457 optimization Methods 0.000 claims description 3
- 230000005540 biological transmission Effects 0.000 claims description 2
- 238000005538 encapsulation Methods 0.000 claims description 2
- 239000012634 fragment Substances 0.000 claims description 2
- 238000012545 processing Methods 0.000 claims description 2
- 230000006855 networking Effects 0.000 claims 1
- 210000004027 cell Anatomy 0.000 description 6
- 230000000694 effects Effects 0.000 description 3
- 238000000605 extraction Methods 0.000 description 2
- 238000012986 modification Methods 0.000 description 2
- 230000004048 modification Effects 0.000 description 2
- 230000008569 process Effects 0.000 description 2
- 206010033799 Paralysis Diseases 0.000 description 1
- 241000700605 Viruses Species 0.000 description 1
- 238000013459 approach Methods 0.000 description 1
- 238000013528 artificial neural network Methods 0.000 description 1
- 230000009286 beneficial effect Effects 0.000 description 1
- 238000006243 chemical reaction Methods 0.000 description 1
- 238000004883 computer application Methods 0.000 description 1
- 238000010586 diagram Methods 0.000 description 1
- 208000037265 diseases, disorders, signs and symptoms Diseases 0.000 description 1
- 238000005516 engineering process Methods 0.000 description 1
- 238000004880 explosion Methods 0.000 description 1
- 210000002364 input neuron Anatomy 0.000 description 1
- 210000004205 output neuron Anatomy 0.000 description 1
- 239000003208 petroleum Substances 0.000 description 1
- 230000010076 replication Effects 0.000 description 1
- 230000003068 static effect Effects 0.000 description 1
- 239000000126 substance Substances 0.000 description 1
- XLYOFNOQVPJJNP-UHFFFAOYSA-N water Substances O XLYOFNOQVPJJNP-UHFFFAOYSA-N 0.000 description 1
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/14—Network analysis or design
- H04L41/145—Network analysis or design involving simulating, designing, planning or modelling of a network
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/14—Network analysis or design
- H04L41/142—Network analysis or design using statistical or mathematical methods
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/14—Network analysis or design
- H04L41/147—Network analysis or design for predicting network behaviour
-
- G—PHYSICS
- G16—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR SPECIFIC APPLICATION FIELDS
- G16Y—INFORMATION AND COMMUNICATION TECHNOLOGY SPECIALLY ADAPTED FOR THE INTERNET OF THINGS [IoT]
- G16Y40/00—IoT characterised by the purpose of the information processing
- G16Y40/20—Analytics; Diagnosis
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/01—Protocols
- H04L67/12—Protocols specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
Abstract
The invention provides an industrial Internet of things reverse analysis system, which comprises: firstly, preprocessing an initial industrial internet of things protocol message sequence sample set to obtain a complete application layer protocol; secondly, constructing an LSTM neural network model structure according to format characteristics of an industrial Internet of things protocol; then, inputting the training data set as an LSTM network model, and training model parameters; and finally, taking the trained LSTM network structure model as an industrial Internet of things protocol message field prediction model, and predicting unknown industrial Internet of things protocol message fields. Compared with the method for manually analyzing the unknown industrial Internet of things protocol format, the method is higher in efficiency and accuracy.
Description
Technical Field
The invention relates to the field of industrial Internet of things safety, and particularly provides an industrial Internet of things reverse analysis system for a collected industrial Internet of things protocol sample sequence.
Background
The safety problem of the industrial internet of things is getting worse as events such as damages to Iran nuclear facilities by earthquake network viruses, blackish power failure of an UK power grid, explosion of British petroleum pipelines, paralysis of a water supply system in Illinois, USA and the like frequently occur. The industrial internet of things system is interconnected and intercommunicated by communication protocols, the safety of the communication protocols is an important part of the safety of the industrial internet of things system, but due to the consideration of factors such as providing personalized functions and optimizing the communication protocols, various industrial internet of things manufacturers cause a large number of private and unknown communication protocols in the industrial internet of things industry, and great challenges are brought to protocol safety analysis.
In existing solutions, it is the main approach to resolve unknown protocols using protocol inversion techniques. Because the industrial control protocol processing program is mainly integrated in special software and hardware equipment provided by industrial control manufacturers, a protocol analysis execution stream is not easy to obtain, and an unknown industrial control protocol is mainly analyzed by adopting a static method aiming at the protocol stream. Tao et al (Siyu Tao, et al, "Bit-oriented format extraction for automatic binary replication engineering," in IET Communications,2016.) propose a binary protocol analysis method, extract Bit-level features based on Bayesian probability, thereby improving the efficiency of protocol identification; luo et al (Luo Jianzhen, et al, "Position-based automatic reverse engineering of network protocols," in Journal of network and computer applications,2013.) propose an application layer protocol reverse parsing method, which infers a message format based on an association rule established by a message field occurrence frequency and a Position distribution rule; cui et al (Weidong Cui, et al, "discover: automatic protocol conversion from network processes," in Usenix Security Symposium,2007.) propose a protocol format flag domain extraction tool, which recursively clusters a format flag domain by a probabilistic matching algorithm to infer protocol semantics. In the scheme, the time consumption and the accuracy are low by manually analyzing the unknown internet of things protocol format based on the probability algorithm.
Disclosure of Invention
The technical problem to be solved by the invention is to provide an industrial internet of things reverse analysis system, which can solve the problems of time consumption and low accuracy of manual reverse analysis of unknown internet of things protocol formats.
In order to solve the above problem, an embodiment of the present invention provides an industrial internet of things reverse analysis system, where the method includes the following steps:
s1: data collection: capturing communication data in a network as an original data source by accessing an industrial Internet of things, and filtering out the communication data between specific communication entities needing to be analyzed according to sub-packets of IP addresses, port numbers and the like to be used as an initial message sequence sample set for reverse analysis;
s2: data preprocessing: performing data cleaning on an industrial Internet of things protocol data set, dividing the data into a training set and a testing set, and labeling industrial Internet of things protocol data fields of the training set;
s3: constructing an RNN-LSTM neural network model: the input of the RNN-LSTM model is an industrial Internet of things protocol message sequence, and the output of the RNN-LSTM model is a protocol message field;
s4: RNN-LSTM model parameter training: inputting a training data set as an RNN-LSTM network model, and training the model; inputting the data of the test set into a trained RNN-LSTM network model for verification, calculating the prediction accuracy and finely adjusting parameters through the test set to improve the prediction precision;
s5: predicting the field of the industrial Internet of things protocol message: and taking the finally trained RNN-LSTM network structure model as an industrial Internet of things protocol message field prediction model to predict unknown industrial Internet of things protocol message fields.
For example, in the reverse analysis system of the industrial internet of things provided by the embodiment of the present invention, the S2 data preprocessing specifically includes:
s21: processing the situations of packet loss, retransmission, disorder and the like in the industrial internet of things protocol message sequence; filtering messages without load; discarding the message with the checksum error; recombining the IP fragment message; for a TCP session, a complete session starts with a SYN message and ends with an FIN/RST message;
s22: and performing bottom-up decapsulation on the data packet according to a TCP/IP protocol format, and sequentially removing encapsulation of a data link layer, a network layer and a transmission layer to obtain a complete application layer message.
For example, in an industrial internet of things reverse analysis system provided by an embodiment of the present invention, the RNN-LSTM neural network model structure of S3 satisfies the following conditions:
input door it＝σ(Wi*ht-1+Ui*xt+bi) Wherein, UiRepresenting an input-output weight matrix, WiRepresenting hidden layer-input gate weight matrix, biRepresenting the deviation of the input layer from the hidden layer, the activation function uses a sigmoid function of
Wherein h ist-1Representing the output of the hidden layer at the previous moment, xtAn input matrix representing time step t time;
output gate ot＝σ(Wo*ht-1+Uo*xt+bo)，UoRepresenting an input-output gate weight matrix, WoRepresenting hidden layer-input gate weight matrix, boRepresents the output gate offset, ot∈(0，1)；
Forget door ft＝σ(Wf*ht-1+Uf*xt+bf)，UfRepresenting an input-forgetting gate weight matrix, WfRepresenting hidden layer-forgetting gate weight matrix, bfIndicating a forgotten door deviation, ft∈(0，1)；
Output memory information ct＝it*tanh(Wc*ht-1+Uc*xt+bc)+ft*ct-1，UcRepresenting the input-memory cell weight matrix, WcRepresenting a hidden layer-memory cell weight matrix, bcRepresenting the deviation of the input layer to the memory cell;
for example, in the inverse analysis system of the industrial internet of things provided by the embodiment of the present invention, the loss function of the RNN-LSTM neural network model in S3 is represented as:
wherein y isiAnd yjRespectively a real field value and a predicted field value of an industrial Internet of things protocol sequence, wherein n is the total length of a data sequence
For example, in the inverse analysis system of the industrial internet of things provided by the embodiment of the present invention, the RNN-LSTM neural network model loss function in S3 is regularized, and the processed loss function is:
where λ is the regularization coefficient and W represents the value of the model structure weight parameter used.
For example, in the inverse analysis system of the industrial internet of things provided by the embodiment of the present invention, the process of training the RNN-LSTM neural network model in S4 adopts Adam optimization algorithm to update the network weight and the deviation according to the gradient of the loss function.
For example, in the reverse analysis system of the industrial internet of things provided by the embodiment of the present invention, the accuracy of predicting the unknown protocol message field of the industrial internet of things in S5 is determined by
It is shown that, among others,
f (k) represents the predicted industrial IOT protocol field and the actual inconsistent function when yiAnd yj1 at the same time, not 0 at the same time, yiAnd yjThe real field value and the predicted field value of the industrial internet of things protocol sequence are respectively, and N is the total length of the data sequence.
In order to solve the above problems, the present invention further provides an industrial internet of things reverse analysis system, including:
a data collection module: the system is used for collecting industrial Internet of things protocol data as an initial message sequence sample set;
a data preprocessing module: the method comprises the steps of cleaning an initial industrial Internet of things message sequence sample set;
LSTM model building module: the method is used for constructing an LSTM model structure to reversely analyze unknown industrial Internet of things protocol message fields;
a model parameter training module: parameters used for training the reverse analysis model are used for improving the accuracy of prediction;
a protocol message field prediction module: the method is used for predicting the unknown industrial internet of things protocol message field.
The invention has the beneficial effects that: compared with the method for manually analyzing the unknown Internet of things protocol format, the method is higher in efficiency and accuracy.
Drawings
In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings of the embodiments will be briefly described below, and it is apparent that the drawings in the following description only relate to some embodiments of the present invention and are not limiting on the present invention.
Fig. 1 is a flowchart of an industrial internet of things reverse analysis system provided in an embodiment of the present invention;
FIG. 2 is a diagram illustrating the recognition effect of the present invention on unknown industrial IOT protocol fields;
Detailed Description
In order to make the objects, technical solutions and advantages of the embodiments of the present invention clearer and more complete, the technical solutions of the embodiments of the present invention will be described below with reference to the drawings of the embodiments of the present invention, it is obvious that the described embodiments are some but not all embodiments of the present invention, and all other embodiments obtained by a person of ordinary skill in the art without creative efforts based on the described embodiments of the present invention belong to the protection scope of the present invention.
According to the reverse analysis system for the industrial Internet of things, the LSTM neural network model is adopted to predict the unknown protocol format of the industrial Internet of things, and the efficiency and accuracy of analyzing the unknown protocol of the industrial Internet of things are improved.
As shown in fig. 1, an embodiment of the present invention provides an industrial internet of things reverse analysis system, which includes the following steps:
s1: data collection: capturing communication data in a network as an original data source by accessing an industrial Internet of things, and filtering out the communication data between specific communication entities needing to be analyzed according to sub-packets of IP addresses, port numbers and the like to be used as an initial message sequence sample set for reverse analysis;
s2: data preprocessing: performing data cleaning on an industrial Internet of things protocol data set, dividing the data into a training set and a testing set, and labeling industrial Internet of things protocol data fields of the training set; the method comprises the following specific steps:
s3: constructing an RNN-LSTM neural network model: the input of the RNN-LSTM model is an industrial Internet of things protocol message sequence, and the output of the RNN-LSTM model is a protocol message field. The method mainly comprises the following model formulas:
input door it＝σ(Wi*ht-1+Ui*xt+bi) Wherein, UiRepresenting an input-output weight matrix, WiRepresenting hidden layer-input gate weight matrix, biRepresenting the deviation of the input layer from the hidden layer, the activation function uses a sigmoid function of
Wherein h ist-1Representing the output of the hidden layer at the previous moment, xtAn input matrix representing time step t time;
output gate ot＝σ(Wo*ht-1+Uo*xt+bo)，UoRepresenting an input-output gate weight matrix, WoRepresenting hidden layer-input gate weight matrix, boRepresents the output gate offset, ot∈(0，1)；
Forget door ft＝σ(Wf*ht-1+Uf*xt+bf)，UfRepresenting an input-forgetting gate weight matrix, WfRepresenting hidden layer-forgetting gate weight matrix, bfIndicating a forgotten door deviation, ft∈(0，1)；
Output memory information ct＝it*tanh(Wc*ht-1+Uc*xt+bc)+ft*ct-1，UcRepresenting the input-memory cell weight matrix, WcRepresenting a hidden layer-memory cell weight matrix, bcRepresenting the deviation of the input layer to the memory cell;
s4: RNN-LSTM model parameter training: inputting a training data set as an RNN-LSTM network model, and training the model; inputting the data of the test set into a trained RNN-LSTM network model for verification, calculating the prediction accuracy and finely adjusting parameters through the test set to improve the prediction precision;
s5: predicting the field of the industrial Internet of things protocol message: and taking the finally trained RNN-LSTM network structure model as an industrial Internet of things protocol message field prediction model to predict unknown industrial Internet of things protocol message fields.
For example, in the inverse analysis system of the industrial internet of things provided by the embodiment of the present invention, the LSTM neural network model loss function is expressed as:
wherein y isiAnd yjThe real field value and the predicted field value of the industrial internet of things protocol sequence are respectively, n is the total length of the data sequence, and in order to solve the problem of model overfitting, a loss function L (W) needs to be regularized, and the regularized loss function is represented as:
where λ is the regularization coefficient, the initial default value λ is 0.9, and W represents the value of the model structure weight parameter used.
For example, in the industrial internet of things reverse analysis system provided by the embodiment of the present invention, the LSTM model is specifically constructed as follows: the model is divided into an input layer, an output layer and a hidden layer, the number of input neurons is set to be 1, the number of output neurons is set to be 1, the hidden layer is set to be 1 layer, 256 nodes are arranged, and a fully-connected network structure is established by input and output.
For example, in the inverse analysis system of the industrial internet of things provided by the embodiment of the present invention, the LSTM model parameter training specifically includes: updating the network weight and deviation according to the gradient of the loss function by adopting an Adam optimization algorithm, and mainly comprising the following algorithm formula:
mt＝μ1*mt-1+(1-μ1)*L(Wt-1)
nt＝μ2*nt-1+(1-μ2)*L(Wt-1)2
mt *＝mt/(1-μ1 t)
nt *＝nt/(1-μ2 t)
wherein L (W) is a loss function, μ1And mu2For decay index, μ is set by default1＝0.9，μ20.999; η is a training step length, also called a learning rate, and is generally set to be 0.001 by default; e is 10-8Is a constant; m istThe gradient index mean value is obtained through gradient first moment; n istThe square gradient is obtained through the second moment of the gradient; iteratively updating the LSTM neural network weight and deviation by continuously inputting training data to enable the loss function to gradually converge; thereby determining the LSTM network structure ultimately used for condition prediction.
For example, in the reverse analysis system for the industrial internet of things provided in the embodiment of the present invention, the LSTM model predicts the protocol message field of the industrial internet of things specifically as follows: inputting the test set into a trained LSTM model for verification, calculating the predicted accuracy Acc, and generating the accuracy Acc formula as follows:
The recognition effect of the unknown industrial internet of things protocol field is explained by adopting the method. Firstly, four common industrial internet of things protocols are selected, wherein the four common industrial internet of things protocols comprise a Modbus protocol of a Schneider Programmable Logic Controller (PLC), an S7Comm protocol of a Siemens PLC, an IEC104 protocol of a power system and a Message Queue Telemetry Transport (MQTT) protocol; secondly, preprocessing a collected industrial Internet of things protocol sequence sample set to obtain application layer protocol data of the industrial Internet of things protocol sequence sample set; then, training LSTM model parameters; finally, inputting the industrial internet of things protocol sample sequence into the industrial internet of things reverse analysis system provided by the invention, so as to predict unknown industrial internet of things protocol message fields, wherein the protocol reverse analysis effect is shown in the attached figure 2: with the increase of the number of times of LSTM model training, the recognition rate of each protocol tends to be stable, wherein the final recognition rate of the Modbus protocol reaches 73%, the final recognition rate of the S7Comm protocol reaches 67%, the final recognition rate of the IEC104 reaches 65%, and the final recognition rate of the MQTT protocol reaches 66%. The experimental result shows that the LSTM neural network model is adopted to predict the unknown industrial Internet of things protocol format, and the method has higher efficiency and accuracy in analyzing the unknown industrial Internet of things protocol.
The invention provides an industrial Internet of things reverse analysis system, which comprises the following steps of firstly preprocessing an initial industrial Internet of things protocol message sequence sample set to obtain a complete application layer protocol; secondly, constructing an LSTM neural network model structure; then, inputting the training data set as an LSTM network model, and training model parameters; and finally, taking the finally trained LSTM network structure model as an industrial Internet of things protocol message field prediction model to predict unknown industrial Internet of things protocol message fields. In addition, the technology supports other types of industrial control protocols.
It will be apparent to those skilled in the art that modifications and improvements may be made to the embodiments of the invention without departing from the spirit of the invention, and it is intended that all such modifications and improvements be included within the scope of the invention as defined by the appended claims.
Claims (8)
1. An industry thing networking reverse analysis system, includes:
a data collection module: the system is used for collecting industrial Internet of things protocol data as an initial message sequence sample set;
a data preprocessing module: the method comprises the steps of cleaning an initial industrial Internet of things message sequence sample set;
LSTM model building module: the method is used for constructing an LSTM model structure to reversely analyze unknown industrial Internet of things protocol message fields;
a model parameter training module: parameters used for training the reverse analysis model are used for improving the accuracy of prediction;
a protocol message field prediction module: the method is used for predicting the unknown industrial internet of things protocol message field.
2. An industrial Internet of things reverse analysis method comprises the following steps:
s1: data collection: capturing communication data in a network as an original data source by accessing an industrial Internet of things, and filtering out the communication data between specific communication entities needing to be analyzed according to sub-packets of IP addresses, port numbers and the like to be used as an initial message sequence sample set for reverse analysis;
s2: data preprocessing: performing data cleaning on an industrial Internet of things protocol data set, dividing the data into a training set and a testing set, and labeling industrial Internet of things protocol data fields of the training set;
s3: constructing an RNN-LSTM neural network model: the input of the RNN-LSTM model is an industrial Internet of things protocol message sequence, and the output of the RNN-LSTM model is a protocol message field;
s4: RNN-LSTM model parameter training: inputting a training data set as an RNN-LSTM network model, and training the model; inputting the data of the test set into a trained RNN-LSTM network model for verification, calculating the prediction accuracy and finely adjusting parameters through the test set to improve the prediction precision;
s5: predicting the field of the industrial Internet of things protocol message: and taking the finally trained RNN-LSTM network structure model as an industrial Internet of things protocol message field prediction model to predict unknown industrial Internet of things protocol message fields.
3. The industrial internet of things reverse analysis method according to claim 2, wherein the step S2 specifically comprises:
s21: processing the situations of packet loss, retransmission, disorder and the like in the industrial internet of things protocol message sequence; filtering messages without load; discarding the message with the checksum error; recombining the IP fragment message; for a TCP session, a complete session starts with a SYN message and ends with an FIN/RST message;
s22: and performing bottom-up decapsulation on the data packet according to a TCP/IP protocol format, and sequentially removing encapsulation of a data link layer, a network layer and a transmission layer to obtain a complete application layer message.
4. The inverse analysis method of the industrial internet of things as claimed in claim 2, wherein the RNN-LSTM neural network model structure in step S3 satisfies the following requirements:
input door it＝σ(Wi*ht-1+Ui*xt+bi) Wherein, UiRepresenting an input-output weight matrix, WiRepresenting hidden layer-input gate weight matrix, biRepresenting the deviation of the input layer from the hidden layer, the activation function uses a sigmoid function of
Wherein h ist-1Representing the output of the hidden layer at the previous moment, xtAn input matrix representing time step t time;
output gate ot＝σ(Wo*ht-1+Uo*xt+bo)，UoRepresenting an input-output gate weight matrix, WoRepresenting hidden layer-input gate weight matrix, boRepresents the output gate offset, ot∈(0，1)；
Forget door ft＝σ(Wf*ht-1+Uf*xt+bf)，UfRepresenting an input-forgetting gate weight matrix, WfRepresenting hidden layer-forgetting gate weight matrix, bfIndicating a forgotten door deviation, ft∈(0，1)；
Output memory information ct＝it*tanh(Wc*ht-1+Uc*xt+bc)+ft*ct-1，UcRepresenting the input-memory cell weight matrix, WcRepresenting a hidden layer-memory cell weight matrix, bcIndicating the deviation of the input layer to the memory cell.
5. The inverse analysis method of the internet of things of claim 4, wherein the loss function of the RNN-LSTM neural network model in the step S3 is expressed as:
wherein y isiAnd yjThe real field value and the predicted field value of the industrial internet of things protocol sequence are respectively, and n is the total length of the data sequence.
6. The reverse analysis method of the industrial internet of things according to claim 5, wherein the loss function is subjected to regularization, and the processed loss function is as follows:
where λ is the regularization coefficient and W represents the value of the model structure weight parameter used.
7. The inverse analysis method of the internet of things of claim 2, wherein the step S4 of training the RNN-LSTM neural network model adopts Adam optimization algorithm to update the network weight and the deviation according to the gradient of the loss function.
8. The reverse analysis method for industrial internet of things as claimed in claim 2, wherein the accuracy of predicting the unknown protocol field of the industrial internet of things in step S5 is determined by
It is shown that, among others,
f (k) represents the predicted industrial IOT protocol field and the actual inconsistent function when yiAnd yj1 at the same time, not 0 at the same time, yiAnd yjThe real field value and the predicted field value of the industrial internet of things protocol sequence are respectively, and N is the total length of the data sequence.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010992297.XA CN112134737A (en) | 2020-10-19 | 2020-10-19 | Reverse analysis system of industrial Internet of things |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010992297.XA CN112134737A (en) | 2020-10-19 | 2020-10-19 | Reverse analysis system of industrial Internet of things |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN112134737A true CN112134737A (en) | 2020-12-25 |
Family
ID=73841703
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202010992297.XA Pending CN112134737A (en) | 2020-10-19 | 2020-10-19 | Reverse analysis system of industrial Internet of things |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN112134737A (en) |
Cited By (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN114553983A (en) * | 2022-03-03 | 2022-05-27 | 沈阳化工大学 | Deep learning-based high-efficiency industrial control protocol analysis method |
| CN114640611A (en) * | 2022-03-09 | 2022-06-17 | 西安电子科技大学 | Unknown heterogeneous industrial protocol detection and identification method, system, equipment and medium |
| CN114745417A (en) * | 2022-04-12 | 2022-07-12 | 广东技术师范大学 | Industrial control protocol semantic analysis method based on industrial side channel information |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20120210426A1 (en) * | 2009-10-30 | 2012-08-16 | Sun Yat-Sen University | Analysis system for unknown application layer protocols |
| CN108540338A (en) * | 2018-03-08 | 2018-09-14 | 西安电子科技大学 | Application layer communication protocol based on deep-cycle neural network knows method for distinguishing |
| CN109492839A (en) * | 2019-01-17 | 2019-03-19 | 东华大学 | A kind of mineral hot furnace operating condition prediction technique based on RNN-LSTM network |
| CN110532564A (en) * | 2019-08-30 | 2019-12-03 | 中国人民解放军陆军工程大学 | A kind of application layer protocol online recognition method based on CNN and LSTM mixed model |
| CN110855608A (en) * | 2019-09-29 | 2020-02-28 | 上海天旦网络科技发展有限公司 | Protocol reverse engineering system based on reinforcement learning and working method thereof |
-
2020
- 2020-10-19 CN CN202010992297.XA patent/CN112134737A/en active Pending
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20120210426A1 (en) * | 2009-10-30 | 2012-08-16 | Sun Yat-Sen University | Analysis system for unknown application layer protocols |
| CN108540338A (en) * | 2018-03-08 | 2018-09-14 | 西安电子科技大学 | Application layer communication protocol based on deep-cycle neural network knows method for distinguishing |
| CN109492839A (en) * | 2019-01-17 | 2019-03-19 | 东华大学 | A kind of mineral hot furnace operating condition prediction technique based on RNN-LSTM network |
| CN110532564A (en) * | 2019-08-30 | 2019-12-03 | 中国人民解放军陆军工程大学 | A kind of application layer protocol online recognition method based on CNN and LSTM mixed model |
| CN110855608A (en) * | 2019-09-29 | 2020-02-28 | 上海天旦网络科技发展有限公司 | Protocol reverse engineering system based on reinforcement learning and working method thereof |
Cited By (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN114553983A (en) * | 2022-03-03 | 2022-05-27 | 沈阳化工大学 | Deep learning-based high-efficiency industrial control protocol analysis method |
| CN114553983B (en) * | 2022-03-03 | 2023-10-24 | 沈阳化工大学 | Deep learning-based high-efficiency industrial control protocol analysis method |
| CN114640611A (en) * | 2022-03-09 | 2022-06-17 | 西安电子科技大学 | Unknown heterogeneous industrial protocol detection and identification method, system, equipment and medium |
| CN114745417A (en) * | 2022-04-12 | 2022-07-12 | 广东技术师范大学 | Industrial control protocol semantic analysis method based on industrial side channel information |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN112134737A (en) | Reverse analysis system of industrial Internet of things | |
| CN110460458B (en) | Flow anomaly detection method based on multi-order Markov chain | |
| CN111191767B (en) | Vectorization-based malicious traffic attack type judging method | |
| Lai et al. | Industrial anomaly detection and attack classification method based on convolutional neural network | |
| CN113395276B (en) | Network intrusion detection method based on self-encoder energy detection | |
| CN114218403A (en) | Fault root cause positioning method, device, equipment and medium based on knowledge graph | |
| CN111431819A (en) | Network traffic classification method and device based on serialized protocol flow characteristics | |
| CN112433518B (en) | Industrial control system intrusion detection method based on recurrent neural network | |
| CN115277587B (en) | Network traffic identification method, device, equipment and medium | |
| CN112949702B (en) | Network malicious encryption traffic identification method and system | |
| CN110532452B (en) | News website universal crawler design method based on GRU neural network | |
| CN114330544A (en) | Method for establishing business flow abnormity detection model and abnormity detection method | |
| EP4004780A1 (en) | Model structure extraction for analyzing unstructured text data | |
| US20210049414A1 (en) | Deep graph de-noise by differentiable ranking | |
| Sun et al. | A robust data-driven method for multiseasonality and heteroscedasticity in time series preprocessing | |
| CN113886225A (en) | Unknown industrial control protocol-oriented fuzzy test system and method | |
| CN114615088A (en) | Terminal service flow abnormity detection model establishing method and abnormity detection method | |
| CN112187820B (en) | Power distribution terminal DTU intrusion detection method and system based on machine learning | |
| CN113256438A (en) | Role identification method and system for network user | |
| Li et al. | Online course learning outcome evaluation method based on big data analysis | |
| Gao et al. | The prediction role of hidden markov model in intrusion detection | |
| CN116628220A (en) | Electric power work ticket generation method and system based on relation graph convolution neural network | |
| CN115277888B (en) | Method and system for analyzing message type of mobile application encryption protocol | |
| CN115296876A (en) | Network security early warning system of self-adaptation mimicry technique | |
| CN115473734A (en) | Remote code execution attack detection method based on single classification and federal learning |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| WD01 | Invention patent application deemed withdrawn after publication | ||
| WD01 | Invention patent application deemed withdrawn after publication |
Application publication date: 20201225 |