Research on non-standard industrial control protocol formats reverse

Dianzi Jishu Yingyong

Xu Fengkai¹  Cheng Bicheng¹  Zhao Yunfei¹  Liu Renhui¹ 

[1] National Engineering Laboratory for Industrial Control System Information Security Technology， National Computer System Engineering Research Institute of China，Beijing 100083，China;

关键词: non-standard industrial control protocol;    protocol reverse;    net-trace;    sequence alignment;    semantic inference;   

DOI  :  10.16157/j.issn.0258-7998.171041

来源: DOAJ

【 摘 要 】

Correct non-standard protocol format recognition is the foundation of protocol security analysis, which is an important part of industrial control system(ICS) information security content. Due to current situation of ICS and protocol features of structure determination, transmission repeat and semantic limited, a method based on net-trace is proposed. The formats of protocol are gotten by single message processing for a preliminary clustering, packet processing for sequence alignment, key fields to infer semantics. Verification results show that the method can reverse recognition non-standard ICS protocol format.

【 授权许可】

Unknown