Deep Neural Networks for Industrial Protocol Recognition and Cipher Suite Used

Result code in IS VaVaI

<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F00216305%3A26220%2F22%3APU145720" target="_blank" >RIV/00216305:26220/22:PU145720 - isvavai.cz</a>

Result on the web

<a href="https://ieeexplore.ieee.org/document/9896532" target="_blank" >https://ieeexplore.ieee.org/document/9896532</a>

DOI - Digital Object Identifier

<a href="http://dx.doi.org/10.1109/ICCST52959.2022.9896532" target="_blank" >10.1109/ICCST52959.2022.9896532</a>

Result language

angličtina

Original language name

Deep Neural Networks for Industrial Protocol Recognition and Cipher Suite Used

Original language description

The main objective of this paper is to determine the network traffic parameters to classify the industrial protocol and the cipher suite used without prior knowledge of the network using deep learning. To recognize industrial protocols, our test environment was used to generate a dataset because suitable, publicly available datasets are not available. The testbed generated an unsecured version of Modbus/TCP and three types of Modbus/TCP Security with different cipher using with the same data flow. This allows us to avoid the influence caused by the transmitted content. In this paper, three scenarios are provided, in which different numbers of input parameters are used for model training. Using the presented approach, it is possible to recognize the industrial protocol and the cipher suite with an accuracy of 0.945 with 17 input parameters taken from the link, network, and transport layers of the reference ISO/OSI model (not the application layer). Each scenario is validated on training, testing, and validation data. Based on the reached results, the presented approach is also applicable in real-time processing for protocol recognition with identification of the used cipher suite. The use of neural networks to recognize the industrial protocol and encryption set used enables big data processing with minimal time overhead to perform traffic classification. Packet-by-packet classification allows the detection of changes made to the industrial protocol, the use of a new protocol in the network, or the tunneling of traffic through another protocol.

Czech name

—

Czech description

—

Type

D - Article in proceedings

CEP classification

—

OECD FORD branch

20203 - Telecommunications

Project

<a href="/en/project/FW01010474" target="_blank" >FW01010474: Network Service Availability Threat Analysis, Detection and Mitigation</a><br>

Continuities

P - Projekt vyzkumu a vyvoje financovany z verejnych zdroju (s odkazem do CEP)

Publication year

2022

Confidentiality

S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů

Article name in the collection

2022 IEEE International Carnahan Conference on Security Technology (ICCST)

ISBN

978-1-6654-9363-5

ISSN

—

e-ISSN

—

Number of pages

7

Pages from-to

1-7

Publisher name

Institute of Electrical and Electronics Engineers Inc.

Place of publication

neuveden

Event location

Valeč u Hrotovic

Event date

Sep 7, 2022

Type of event by nationality

WRD - Celosvětová akce

UT code for WoS article

—