多尺度特征深度学习的未知工控协议分类方法

Unknown Industrial Control Protocols Classification Method Based on Multi-scale Feature Deep Learning

  • 摘要: 工控协议种类多、规范未知、分类难是实现工控系统互联互通、保障信息安全所面临的核心难题。为此,提出了一种多尺度特征深度学习的未知工控协议分类方法。首先,考虑工控协议头部字段关键信息密集的特点,提出了字节与半字节相结合的多尺度工控协议特征提取方法,实现无先验知识情况下的特征提取。进一步,利用头部字段中特征字节不一致的特性,提出特征自动标记方法,动态更新协议特征集合。在此基础上,设计了具备堆叠门控循环单元的1维卷积神经网络,提出了深度学习分类方法,保障协议分类的实时性。在公开数据集上的对比实验表明所题方法的准确率和精度均可达到99.5%以上。

     

    Abstract: The diversity of industrial control protocols, unknown specifications, and difficult classification are key challenges in achieving interconnectivity of industrial control systems and ensuring information security. Therefore, a classification method based on multi-scale feature deep learning for unknown industrial control protocols is proposed. Firstly, considering the dense key information in the header field of industrial control protocols, a multi-scale feature extraction method combining both byte and half-byte is proposed to achieve feature extraction without prior knowledge. Furthermore, leveraging the inconsistency of feature bytes in the header field, an automatic feature marking method is proposed to dynamically update the protocol feature set. On this basis, to ensure real-time classification, a deep learning classification method based on a one-dimensional convolutional neural network with stacked gated recurrent units is proposed. Comparative experiments on public datasets demonstrate that the accuracy and the precision achieved by the proposed method are more than 99.5%.

     

/

返回文章
返回