With the development of the Industrial Internet in recent years, security issues have been a hot topic of the industrial control system (ICS) network management. Identifying the protocol traffic in the communication process of the ICS is an important prerequisite to avoid security problems, especially in ICSs that use many private protocols. The private protocols cannot be analyzed due to the unknown internal structure of the protocols, which makes the ICS protocol identification work more difficult. However, the Internet-oriented protocol identification method is not applicable to the scenario of the private ICS protocols network environment. With this problem in mind, this paper proposes a method of ICS protocol identification based on the raw traffic payload. The method firstly performs data preprocessing such as data selection, interception, cleaning conversion, and labeling on the raw traffic of the protocol based on the characteristics of the industrial control protocol. Then it uses an AM-1DCNN+LSTM deep learning model to extract temporal and spatial features of the ICS raw traffic, and performs protocol identification. This method can effectively extract ICS protocol features in scenarios where protocol parsing is impossible compared with existing methods. We constructed a dataset for ICS protocol identification based on open-source data and tested the proposed method for experiments, and the identification accuracy rate reached 93%.

中文翻译：

---

基于原始流量识别私有 ICS 协议

近年来，随着工业互联网的发展，安全问题已经成为工业控制系统（ICS）网络管理的热门话题。识别ICS通信过程中的协议流量是避免安全问题的重要前提，特别是在使用许多私有协议的ICS中。由于协议的内部结构未知，无法分析私有协议，这使得ICS协议识别工作更加困难。但是，面向Internet的协议识别方法不适用于私有ICS协议网络环境的场景。考虑到这个问题，本文提出了一种基于原始流量有效载荷的 ICS 协议识别方法。该方法首先进行数据选择、截取、清洗转换，并根据工控协议的特点对协议的原始流量进行标记。然后使用AM-1DCNN+LSTM深度学习模型提取ICS原始流量的时空特征，并进行协议识别。该方法可以在与现有方法相比无法进行协议解析的场景中有效地提取ICS协议特征。我们基于开源数据构建了ICS协议识别数据集，并对该方法进行了实验测试，识别准确率达到93%。并进行协议识别。该方法可以在与现有方法相比无法进行协议解析的场景中有效地提取ICS协议特征。我们基于开源数据构建了ICS协议识别数据集，并对该方法进行了实验测试，识别准确率达到93%。并进行协议识别。该方法可以在与现有方法相比无法进行协议解析的场景中有效地提取ICS协议特征。我们基于开源数据构建了ICS协议识别数据集，并对该方法进行了实验测试，识别准确率达到93%。