A Practical Format and Semantic Reverse Analysis Approach for Industrial Control Protocols

Abstract

Industrial control protocol is the basis of communication and interaction of industrial control system, and its security is related to the whole industrial infrastructure. Because many industrial control systems use proprietary protocols, it is necessary to adopt protocol reverse analysis technology to parse them and then detect whether there are secure vulnerabilities in the protocols by means of fuzzy testing. However, most of the existing technologies are designed for common network protocols, and there is no improvement for industrial control protocol. Therefore, we propose a multistage ensemble reverse analysis method, namely, MSERA, which fully considers the design concept of industrial control protocols. MSERA divides the traditional reverse analysis process into three stages and identifies the fields with different semantic characteristics in different stages and combines with field rectification to effectively improve the results of reverse analysis of industrial control protocols. Through the experimental comparison of some public and proprietary industrial control protocols, it is found that MSERA not only outperforms Netzob in the accuracy of field split but also far exceeds Netzob in semantic recognition accuracy. The experimental results show that MSERA is very practical and suitable for reverse analysis of industrial control protocols.

IMCSA: Providing Better Sequence Alignment Space for Industrial Control Protocol Reverse Engineering

“…However, these works are not universal, and they are only applicable to certain specifc protocols. In 2021, Wang et al [20] introduced semantic information into the protocol reverse work, which greatly improved the accuracy of analysis results. However, the approach introduces a signifcant time overhead in the semantic premining phase.…”

“…However, there are still some problems with the reverse analysis of industrial control protocols based on sequence alignment, especially in terms of time overhead. However, most existing related works [13][14][15][16][17][18][19][20] focus on how to introduce additional information to improve the accuracy of the format extraction results, while ignoring the potentially signifcant overhead. Terefore, we conducted a study to improve the efciency of the algorithm.…”