信息网络安全

信息网络安全 ›› 2022, Vol. 22 ›› Issue (9): 1-10.doi: 10.3969/j.issn.1671-1122.2022.09.001

• 等级保护 • 上一篇    下一篇

基于状态机子图同构匹配的私有工控协议溯源

宋宇波1,2,3(), 陈烨1,2,3, 蔡义涵1,2,3, 张波4   

  1. 1.东南大学网络空间安全学院，南京 211189
    2.江苏省计算机网络技术重点实验室，南京 211189
    3.网络通信与安全紫金山实验室，南京 211189
    4.国网智能电网研究院有限公司，南京 210003
  • 收稿日期:2022-06-13 出版日期:2022-09-10 发布日期:2022-11-14
  • 通讯作者: 宋宇波 E-mail:songyubo@seu.edu.cn
  • 作者简介:宋宇波（1977—），男，江苏，副教授，博士，主要研究方向为无线网络和移动通信安全、移动终端安全、隐私数据安全、区块链安全|陈烨（2000—），男，江西，硕士研究生，主要研究方向为移动通信安全、隐私数据安全、区块链安全|蔡义涵（2000—），男，江苏，硕士研究生，主要研究方向为区块链安全|张波（1985—），男，江苏，高级工程师，博士，主要研究方向为电力网络安全、电网数字化、信息物理融合安全
  • 基金资助:
    国家自然科学基金(61601113)

Traceability of Private Industrial Control Protocol Based on Subgraph Isomorphic Matching of Protocol State Machine

SONG Yubo1,2,3(), CHEN Ye1,2,3, CAI Yihan1,2,3, ZHANG Bo4   

  1. 1. School of Cyber Science and Engineering, Southeast University, Nanjing 211189, China
    2. Jiangsu Key Laboratory of Computer Networking Technology, Nanjing 211189, China
    3. Network Communication and Security Purple Mountain Laboratory, Nanjing 211189, China
    4. Global Energy Interconnection Research Institute Co.,Ltd., Nanjing 210003, China
  • Received:2022-06-13 Online:2022-09-10 Published:2022-11-14
  • Contact: SONG Yubo E-mail:songyubo@seu.edu.cn

RichHTML

5

PDF (PC)

44

摘要：

在对工业互联网设备私有工控协议进行安全分析时，溯源其采用的工控网络协议标准十分困难。文章提出一种基于状态机子图同构匹配的私有工控协议溯源方法，可快速匹配私有工控协议所采用的工控网络协议标准。该方法首先对私有工控协议流量数据进行逆向解析，通过聚类算法提取消息格式和关键字段，根据关键字段构造增广前缀树（Augmented Prefix Tree Acceptor，APTA），推断出协议状态机图;然后采用子图同构匹配算法将该状态机图与工控协议标准状态机图进行子图匹配，解决流量数据有限导致生成状态机图不完整的问题。实验结果表明，该方法溯源准确率在95%以上，可快速定位私有协议采用的工控网络协议标准，从而为进一步的安全分析提供帮助。

关键词: 工控协议, 协议逆向工程, 状态机比对, 子图同构

Abstract:

In the security analysis of private industrial control protocol of industrial equipment, it becomes very difficult to trace the industrial control network protocol standard. This paper proposes a traceability method of private industrial control protocol based on subgraph isomorphic matching of state machine, which can quickly match the industrial control network protocol standard adopted by private industrial control protocol. In this method, the traffic data of private industrial control protocol is reverse-parsed, the message format and key fields are extracted by clustering algorithm, and the protocol state machine graph is deduced by constructing an augmented prefix tree acceptor based on the key fields. In order to solve the problem of incomplete state machine graph generated by limited traffic data, the state machine graph is matched with the standard state machine graph of industrial control protocol by using the subgraph isomorphism matching algorithm. Experiments show that the traceability accuracy of the proposed method is more than 95%, which can quickly locate the industrial control network protocol standard adopted by private protocol, thus providing help for further security analysis.

Key words: industrial control protocol, protocol reverse engineering, state machine comparison, subgraph isomorphism

中图分类号: