摘要
在对工业互联网设备私有工控协议进行安全分析时,溯源其采用的工控网络协议标准十分困难。文章提出一种基于状态机子图同构匹配的私有工控协议溯源方法,可快速匹配私有工控协议所采用的工控网络协议标准。该方法首先对私有工控协议流量数据进行逆向解析,通过聚类算法提取消息格式和关键字段,根据关键字段构造增广前缀树(Augmented Prefix Tree Acceptor,APTA),推断出协议状态机图;然后采用子图同构匹配算法将该状态机图与工控协议标准状态机图进行子图匹配,解决流量数据有限导致生成状态机图不完整的问题。实验结果表明,该方法溯源准确率在95%以上,可快速定位私有协议采用的工控网络协议标准,从而为进一步的安全分析提供帮助。
In the security analysis of private industrial control protocol of industrial equipment,it becomes very difficult to trace the industrial control network protocol standard.This paper proposes a traceability method of private industrial control protocol based on subgraph isomorphic matching of state machine,which can quickly match the industrial control network protocol standard adopted by private industrial control protocol.In this method,the traffic data of private industrial control protocol is reverse-parsed,the message format and key fields are extracted by clustering algorithm,and the protocol state machine graph is deduced by constructing an augmented prefix tree acceptor based on the key fields.In order to solve the problem of incomplete state machine graph generated by limited traffic data,the state machine graph is matched with the standard state machine graph of industrial control protocol by using the subgraph isomorphism matching algorithm.Experiments show that the traceability accuracy of the proposed method is more than 95%,which can quickly locate the industrial control network protocol standard adopted by private protocol,thus providing help for further security analysis.
作者
宋宇波
陈烨
蔡义涵
张波
SONG Yubo;CHEN Ye;CAI Yihan;ZHANG Bo(School of Cyber Science and Engineering,Southeast University,Nanjing 211189,China;Jiangsu Key Laboratory ofComputer Networking Technology,Nanjing 211189,China;Network Communication and Security Purple MountainLaboratory,Nanjing 211189,China;Global Energy Interconnection Research Institute Co.,Ltd.,Nanjing 210003,China)
出处
《信息网络安全》
CSCD
北大核心
2022年第9期1-10,共10页
Netinfo Security
基金
国家自然科学基金[61601113]。
关键词
工控协议
协议逆向工程
状态机比对
子图同构
industrial control protocol
protocol reverse engineering
state machine comparison
subgraph isomorphism
