基于主动交互式学习的工控协议逆向分析

doi:10.19665/j.issn1001-2400.2023.04.003

西安电子科技大学学报 ›› 2023, Vol. 50 ›› Issue (4): 22-33.doi: 10.19665/j.issn1001-2400.2023.04.003

基于主动交互式学习的工控协议逆向分析

付安民¹(),毛安¹(),黄涛¹(),胡超²(),刘莹²(),张晓明³(),王占丰⁴()

1.南京理工大学计算机科学与工程学院,江苏南京 210094
2.中国人民解放军陆军工程大学指挥控制工程学院,江苏南京 210007
3.国家计算机网络与信息安全管理中心,北京 100029
4.南京莱克贝尔信息技术有限公司,江苏南京 210014

收稿日期:2023-01-15 出版日期:2023-08-20 发布日期:2023-10-17
作者简介:付安民(1981—),男,教授,E-mail:fuam@njust.edu.cn;|毛安(1998—),男,南京理工大学硕士研究生,E-mail:120106022665@njust.edu.cn;|黄涛(1988—),男,南京理工大学博士研究生,E-mail:nuisthuangtao@163.com;|胡超(1984—),男,副教授,E-mail:huchao@aeu.edu.cn;|刘莹(1987—),女,讲师,E-mail:liuying_seven@163.com;|张晓明(1980—),男,高级工程师,E-mail:zhangxiaoming@cert.org.cn;|王占丰(1982—),男,博士后,E-mail:hehengw@hotmail.com
基金资助:
国家重点研发计划(2022YFB3104002);国家自然科学基金(62072239);江苏省重点研发计划(BE2022081);未来网络科研基金(FNSRFP-2021-ZD-05)

Industrial control protocol reverse analysis based on active interactive learning

FU Anmin¹(),MAO An¹(),HUANG Tao¹(),HU Chao²(),LIU Ying²(),ZHANG Xiaoming³(),WANG Zhanfeng⁴()

1. School of Computer Science and Engineering,Nanjing University of Science and Technology,Nanjing 210094,China
2. College of Command Control Engineering,Army Engineering University of PLA,Nanjing 210007,China
3. National Computer Network and Information Security Management Center,Beijing 100029,China
4. Nanjing Lexbell Information Technology Company Limited,Nanjing 210014,China

Received:2023-01-15 Online:2023-08-20 Published:2023-10-17

摘要/Abstract

摘要：

作为工业控制系统信息交互的重要基础,工控协议在设计和实现上的规范与完备直接关系到整个工业控制系统的安全运行。针对未知工业控制协议逆向,基于流量样本的协议逆向方法因其无需分析系统固件等优点而受到越来越多的关注。但是该类方法也存在过于依赖样本多样性等缺点,特别是样本多样性不足容易导致字段划分错误、状态识别错误、分析只得到协议规范子集等问题。为此提出一种基于主动交互式学习的工控协议逆向分析方法,在流量样本逆向结果的基础上,依据初始逆向结果构建数据包集合,与真实设备进行交互学习,探测未知协议字段与状态机。与工控模拟软件的交互学习仿真实验结果显示,该方法能有效地验证字段语义、扩充字段取值、扩充异常样本类型,并解决因样本多样性不足而导致的伪长静态字段问题,同时还能有效探测新的状态和状态变迁,极大提高了未知协议逆向的准确性。

关键词: 工控协议, 协议逆向, 交互式学习, 协议状态机

Abstract:

As an important basis for information exchange in industrial control systems,the standardization and completeness of the design and implementation of industrial control protocols involve the security of the entire industrial control system.For the reverse of unknown industrial control protocols,although the protocol reverse method based on traffic samples has attracted more and more attention because it does not need to analyze the system firmware and other advantages,this type of method also has the disadvantage of relying too much on sample diversity.Especially,insufficient sample diversity can easily lead to problems such as field division errors,state identification errors,and only a subset of protocol specifications can be obtained from analysis.For this reason,this paper proposes an industrial control protocol reverse analysis method based on active interactive learning.On the basis of the reverse results of traffic samples,a data packet set is constructed according to the initial reverse results,and interactive learning is carried out with real devices to detect unknown protocol fields and state machines.Simulation experimental results of interactive learning with industrial control simulation software show that this method can effectively verify field semantics,expand field values,expand abnormal sample types,and solve the problem of pseudo-long static fields caused by insufficient sample diversity and that it can detect new states and state transitions,greatly improving the accuracy of unknown protocol reverse.

Key words: industrial control protocol, protocol reverse, interactive learning, protocol state machine

中图分类号:

TP393.0

付安民,毛安,黄涛,胡超,刘莹,张晓明,王占丰. 基于主动交互式学习的工控协议逆向分析[J]. 西安电子科技大学学报, 2023, 50(4): 22-33.

FU Anmin,MAO An,HUANG Tao,HU Chao,LIU Ying,ZHANG Xiaoming,WANG Zhanfeng. Industrial control protocol reverse analysis based on active interactive learning[J]. Journal of Xidian University, 2023, 50(4): 22-33.

图/表 11

图1

表1

表2

表3

表4

表5

图2

表6

表7

图3

表8

参考文献 26

[1]	郝文涛, 鲁晔, 水永莉. 工业控制网络入侵检测技术研究[J]. 工业控制计算机, 2022, 35(4):1-6.
	HAO Wentao, LU Ye, SHUI Yongli. Research on Intrusion Detection Technology of Industrial Control Network[J]. Industrial Control Computer, 2022, 35(4):1-6.
[2]	LUO Z, ZUO F, SHEN Y, et al. ICS Protocol Fuzzing:Coverage Guided Packet Crack and Generation[C]// 2020 57th ACM/IEEE Design Automation Conference.Piscataway:IEEE, 2020:1-6.
[3]	柴艳娜, 李坤伦, 宋焕生. 智能汽车的入侵检测系统安全研究[J]. 西安电子科技大学学报, 2021, 48(3):31-39.
	CHAI Yanna, LI Kunlun, SONG Huansheng. Research on the Security of Intrusion Detection System for Intelligent Vehicles[J]. Journal of Xidian University, 2021, 48(3):31-39.
[4]	杨欣, 毛雅淇, 王伶. 无人机辅助通信的密集无线网络MAC协议[J]. 西安电子科技大学学报, 2022, 49(3):10-20.
	YANG Xin, MAO Yaqi, WANG Ling. MAC Protocol of Dense Wireless Network for UAV Auxiliary Communication[J]. Journal of Xidian University, 2022, 49(3):10-20.
[5]	CABALLERO J, YIN H, LIANG Z, et al. Polyglot:Automatic Extraction of Protocol Message Format Using Dynamic Binary Analysis[C]// Proceedings of the 14th ACM Conference on Computer and Communications Security. New York: ACM, 2007:317-329.
[6]	JI Y, HUANG T, MA C, et al. IMCSA:Providing Better Sequence Alignment Space for Industrial Control Protocol Reverse Engineering (2022)[J/OL].[2022-12-31]. https://www.hindawi.com/journals/scn/2022/8026280/.
[7]	YE Y, ZHANG Z, WANG F, et al. NETPLIER:Probabilistic Network Protocol Reverse Engineering from Message Traces(2021)[C/OL].[2021-03-01]. https://www.ndss-symposium.org/wp-content/uploads/ndss2021_4A-5_24531_paper.pdf.
[8]	WANG Q, SUN Z, WANG W, et al. A Practical Format and Semantic Reverse Analysis Approach for Industrial Control Protocols[J]. Security and Communication Networks, 2021, 2021:1-11.
[9]	王占丰, 程光, 马玮骏, 等. 基于网络轨迹的协议逆向技术研究进展[J]. 软件学报, 2022, 33(1):254-273.
	WANG Zhanfeng, CHENG Guang, MA Weijun, et al. Research Progress of Protocol Reverse Technology Based on Network Trajectory[J]. Software Journal, 2022, 33(1):254-273.
[10]	JIANG D, LI C, MA L, et al. ABInfer:A Novel Field Boundaries Inference Approach for Protocol Reverse Engineering[C]// 2020 IEEE 6^th International Conference on Big Data Security on Cloud.Piscataway:IEEE, 2020:19-23.
[11]	HUANG Y, SHU H, KANG F, et al. Protocol Reverse-Engineering Methods and Tools:A Survey.Computer Communications[J]. Computer Communications, 2022, 182:238-254. doi: 10.1016/j.comcom.2021.11.009
[12]	黄涛, 付安民, 季宇凯, 等. 工控协议逆向分析技术研究进展与挑战[J]. 计算机研究与发展, 2022, 59(5):1015-1034.
	HUANG Tao, FU Anmin, JI Yukai, et al. Research and Challenges of Reverse Analysis Technology of Industrial Control Protocol[J]. Computer Research and Development, 2022, 59(5):1015-1034.
[13]	FOWZE F, TIAN D, HERNANDEZ G, et al. ProXray:Protocolmodel Learning and Guided Firmware Analysis[J]. IEEE Transactions on Software Engineering, 2021, 47(9):1907-1928.
[14]	BOSSERT G, GUIHÉRY F, HIET G, et al. Towards Automated Protocol Reverse Engineering Using Semantic Information[C]// Proceedings of the 9th ACM Symposium on Information,Computer and Communications Security. New York: ACM, 2014:51-62.
[15]	KOO H, CHEN Y, LU L, et al. Compiler-Assisted Code Randomization[C]// Proceedings of 2018 IEEE Symposium on Security and Privacy.Piscataway:IEEE, 2018:461-477.
[16]	YOU W, LIANG B, SHI W, et al. TaintMan:An Art-Compatible Dynamic Taint Analysis Framework on Unmodified and Non-Rooted Android Devices[J]. IEEE Transactions on Dependable & Secure Computing, 2020, 17(1):209-222.
[17]	魏骁, 刘仁辉, 许凤凯. 基于静态二进制分析的工控协议逆向解析[J]. 计算机技术与应用, 2018, 44(3):126-130.
	WEI Xiao, LIU Renhui, XU Fengkai. Reverse Analysis of Industria Control Protocol Based on Static Binary Analysis[J]. Computer Technology and Its Applications, 2018, 44(3):126-130.
[18]	CHEN K, ZHANG N, WANG L, et al. Automatic Identification of Industrial Control Network Protocol Field Boundary Using Memory Propagation Tree[C]// Proceeding International Conference on Information and Communications Security.Berlin:Springer, 2018:551-565
[19]	LIU K, YANG M, LING Z, et al. On Manually Reverse Engineering Communication Protocols of Linux Based IoT Systems[J]. IEEE Internet of Things Journal, 2021, 8(8):6815-6827. doi: 10.1109/JIOT.2020.3036232
[20]	ZHANG W, MENG X, ZHANG Y. Dual-Track Protocol Reverse Analysis Based on Share Learning[C]// International Conference on Computer Communications.Piscataway:IEEE, 2022:51-60.
[21]	张蔚瑶, 张磊, 毛建瓴, 等. 未知协议的逆向分析与自动化测试[J]. 计算机学报, 2020, 43(4):653-667.
	ZHANG Weiyao, ZHANG Lei, MAO Jianling, et al. Reverse Analysis and Automated Testing of Unknown Protocols[J]. Journal of Computer Science, 2020, 43(4):653-667.
[22]	BEDDOE M. The Protocol Informatics Project (2020)[R/OL].[2020-12-31]. http://www.phreakocious.net/PI/PI_Toorcon.pdf.
[23]	CUI W, KANNAN J, WANG H. Discoverer:Automatic Protocol Reverse Engineering from Network Traces[C]// USENIX Security Symposium.Berkeley:USENIX, 2007:1-14.
[24]	SHEVERTALOV M, MANCORIDIS S. A Reverse Engineering Tool for Extracting Protocols of Networked Applications[C]// 14th Working Conference on Reverse Engineering.Piscataway:IEEE, 2007:229-238.
[25]	ANTUNES J, NEVES N, VERISSIMO P. Reverse Engineering of Protocols from Network Traces[C]// 2011 18th Working Conference on Reverse Engineering.Piscataway:IEEE, 2011:169-178.
[26]	KRUEGER T, KRAMER N, RIECK K. ASAP:Automatic Semantics-Aware Analysis of Network Payloads[C]// Proceedings of International Workshop on Privacy and Security Issues in Data Mining and Machine Learning.Berlin:Springer: 2010:50-63.

测试机	Intel(R) Core(TM) i7-6700 CPU @3.40GHz 8 192MB 2 400MH Windows10 professional
目标机	Intel(R) Core(TM) i7-6700 CPU @3.40GHz 8 192MB 2 400MH Windows10 professional
Modbus模拟器	ModSim32
IEC104模拟器	SimulateAnalyzer
MQTT服务器	broker.emqx.io

序号	字段	变异器策略	原有样本描述	实验结果
1	功能码	FuncMutator	01~03	01~24
2	请求数目	GetNMutator	验证字段语义	语义分析正确
3	请求地址	PosMutator	验证字段语义	语义分析正确
4	长静态字段	FieldSplitMutator	长静态字段划分	静态字段+动态字段+动态字段

序号	字段	变异器策略	原有样本描述	实验结果
1	控制字段	FuncMutator	启动命令、启动命令确认、测试命令、测试命令确认字段	额外探测到停止命令和停止命令确认的新控制域样本
2	数据长度	LenMutator	验证字段语义	语义分析正确
3	传送原因	SendReMutator	64,67	暂定01~67
4	请求地址	PosMutator	验证字段语义	语义分析正确

序号	字段	变异器策略	原有样本描述	实验结果
1	控制字段	FuncMutator	01,02,03,04,09	01,02,03,04,09
2	数据字段	DataNMutator	验证字段语义	语义分析正确
3	未知字段	PosMutator	探测字段语义	语义探测成功
4	长度字段	LenMutator	验证字段语义	语义分析正确

名称	描述
A	初始状态
B	连接成功状态
C	数据传输状态
D	等待测试

基于主动交互式学习的工控协议逆向分析

Industrial control protocol reverse analysis based on active interactive learning

RichHTML

PDF (PC)

赞

可视化

摘要/Abstract

引用本文

使用本文

图/表 11

参考文献 26

相关文章 15

Metrics

本文评价

推荐阅读 10

类型	新探测结果	描述
新状态	E	在没连接成功下对服务器端传输数据传输指令,服务端不给响应报文,且后续的连接报文被判定为已有TCP连接,无法建立连接,探测出新状态E
新状态转化序列	A->E	新的状态转化序列,A->E,在A状态发送数据传输报文
	B->B	新的状态转化序列,B->B,在B的状态下,再次发送建立连接和数据传输报文,探测出B->B的状态转化序列
	B->E	新的状态序列,B->E,在B的状态下发送I格式报文,然后发送请求数据传输的报文,出现状态E
	C->C	新的状态转化,C->C,在C的状态下,发送数据传输报文命令,一直发送,响应正常,都处于C状态
	A->E	新的状态转化序列,A->E,在A状态发送测试请求报文
功能码依赖	具有一定的功能码依赖	达到D状态需要在C状态的情况下,达到C状态需要在B的状态下

类型	新探测结果	描述
新状态转化序列	A->A	新的状态转化序列,A->A,在A状态下与服务器端建立连接失败或服务端连续收到两个连接报文
	A-A	新的状态转化序列,A ->A,在A的状态下,不建立连接直接发送发布报文给服务器端
	B->C	新的状态序列,B->C,在B的状态下,一个心跳间隔内,没有收到服务器端的心跳反馈,进入C状态
控制字段依赖	具有控制字段依赖	达到B状态需要在A状态的情况下,达到C状态需要在B的状态下

[1]	张越,陈庆旺,刘宝旭,于存威,谭儒,张方娇. 面向云原生的API攻击诱捕技术研究[J]. 西安电子科技大学学报, 2023, 50(4): 237-248.
[2]	潘森杉,徐腊梅. DorChain:利用休眠币提高交易验证效率[J]. 西安电子科技大学学报, 2022, 49(2): 182-189.
[3]	沈利香,慕德俊,曹国,谢光前,束方勇. 针对硬件木马的形式化验证模型构造方法[J]. 西安电子科技大学学报, 2021, 48(3): 146-153.
[4]	柴艳娜,李坤伦,宋焕生. 智能汽车的入侵检测系统安全研究[J]. 西安电子科技大学学报, 2021, 48(3): 31-39.
[5]	吕翊,朱博,吴大鹏. 一种负载均衡的FiWi网络视频多路径传输机制[J]. 西安电子科技大学学报, 2021, 48(3): 63-70.
[6]	刘华渊,苏云飞,李瑞林,唐朝京. 结构状态覆盖导向的灰盒模糊测试技术[J]. 西安电子科技大学学报, 2021, 48(1): 117-123.
[7]	张璐,慕德俊,胡伟,邰瑜. 能量隐通道安全高层综合设计方法[J]. 西安电子科技大学学报, 2020, 47(4): 64-69.
[8]	张书博,任淑霞,吴涛. 结合概率矩阵的改进谱聚类社区发现算法[J]. 西安电子科技大学学报, 2019, 46(3): 167-172.
[9]	董守玲;苏孟辉;林香鑫;李佳 . IPv6校园网拓扑自动节点获取与发现算法 [J]. J4, 2015, 42(2): 116-121.
[10]	王叶群;叶向阳;戚云军;黄国策;张衡阳. 一种跳频MAC协议的自适应机制[J]. J4, 2013, 40(5): 78-85.
[11]	张昌利;侯蓉晖. 社会化标签系统语义相关度的拓扑图法计算[J]. J4, 2012, 39(3): 196-201.
[12]	任方;马建峰;郝选文. 物联网感知层一种基于属性的访问控制机制[J]. J4, 2012, 39(2): 66-72.
[13]	唐迪;杨小牛;李建东. 一种具有概率预测机制的无线传感器网络安全路由协议[J]. J4, 2011, 38(6): 1-7.
[14]	苏锐丹;丁振国;周利华. 一种实用的面向Web的公平防抵赖协议[J]. J4, 2011, 38(5): 85-89.
[15]	周业军;李晖;马建峰. 一种防窃听的随机网络编码[J]. J4, 2009, 36(4): 696-701.