摘要
工控协议是网络协议的一个分支,在工控系统的信息安全研究中,协议安全是其中相当重要的一部分。目前工控协议缺乏统一规范,产生了大量的私有未知协议,这些私有协议的逆向分析在报文分类方面研究有限。通过对基于网络流量的协议逆向方法研究,提出了一种私有工控协议报文分类方法,通过N-gram算法进行报文切分,然后通过关键词提取算法提取关键词,最后依据提取的关键词进行报文聚类。实验结果表明所提出的方法能对未知的工控协议进行较好的按照功能分类。
Industrial control protocol is a branch of network protocol.In the research of information security of industrial control system,protocol security is a very important part.At present,industrial control protocols are lack of unified specifications,resulting in a large number of private unknown protocols.In the face of the reverse analysis of these private protocols,the research on packet classification is limited.This paper proposes a packet classification method of private industrial control protocols by studying the protocol reverse method based on network traffic,which uses N-gram algorithm for packet segmentation,then the keywords are extracted by keyword extraction algorithm,and finally the message clustering is carried out according to the extracted keywords.Experimental results show that the proposed method can classify unknown industrial control protocols according to their functions.
作者
周帅
王绍杰
Zhou Shuai;Wang Shaojie(National Computer System Engineering Research Institute of China,Beijing 100083,China)
出处
《信息技术与网络安全》
2021年第9期19-24,共6页
Information Technology and Network Security
基金
北京市科技计划课题(Z191100004619011)。
关键词
工控协议
协议逆向
网络流量
N-GRAM
industrial control protocol
protocol reverse
network traffic
N-gram
