Deep Neural Networks for Industrial Protocol Recognition and Cipher Suite Used

Kód výsledku v IS VaVaI

<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F00216305%3A26220%2F22%3APU145720" target="_blank" >RIV/00216305:26220/22:PU145720 - isvavai.cz</a>

Výsledek na webu

<a href="https://ieeexplore.ieee.org/document/9896532" target="_blank" >https://ieeexplore.ieee.org/document/9896532</a>

DOI - Digital Object Identifier

<a href="http://dx.doi.org/10.1109/ICCST52959.2022.9896532" target="_blank" >10.1109/ICCST52959.2022.9896532</a>

Jazyk výsledku

angličtina

Název v původním jazyce

Deep Neural Networks for Industrial Protocol Recognition and Cipher Suite Used

Popis výsledku v původním jazyce

The main objective of this paper is to determine the network traffic parameters to classify the industrial protocol and the cipher suite used without prior knowledge of the network using deep learning. To recognize industrial protocols, our test environment was used to generate a dataset because suitable, publicly available datasets are not available. The testbed generated an unsecured version of Modbus/TCP and three types of Modbus/TCP Security with different cipher using with the same data flow. This allows us to avoid the influence caused by the transmitted content. In this paper, three scenarios are provided, in which different numbers of input parameters are used for model training. Using the presented approach, it is possible to recognize the industrial protocol and the cipher suite with an accuracy of 0.945 with 17 input parameters taken from the link, network, and transport layers of the reference ISO/OSI model (not the application layer). Each scenario is validated on training, testing, and validation data. Based on the reached results, the presented approach is also applicable in real-time processing for protocol recognition with identification of the used cipher suite. The use of neural networks to recognize the industrial protocol and encryption set used enables big data processing with minimal time overhead to perform traffic classification. Packet-by-packet classification allows the detection of changes made to the industrial protocol, the use of a new protocol in the network, or the tunneling of traffic through another protocol.

Název v anglickém jazyce

Deep Neural Networks for Industrial Protocol Recognition and Cipher Suite Used

Popis výsledku anglicky

The main objective of this paper is to determine the network traffic parameters to classify the industrial protocol and the cipher suite used without prior knowledge of the network using deep learning. To recognize industrial protocols, our test environment was used to generate a dataset because suitable, publicly available datasets are not available. The testbed generated an unsecured version of Modbus/TCP and three types of Modbus/TCP Security with different cipher using with the same data flow. This allows us to avoid the influence caused by the transmitted content. In this paper, three scenarios are provided, in which different numbers of input parameters are used for model training. Using the presented approach, it is possible to recognize the industrial protocol and the cipher suite with an accuracy of 0.945 with 17 input parameters taken from the link, network, and transport layers of the reference ISO/OSI model (not the application layer). Each scenario is validated on training, testing, and validation data. Based on the reached results, the presented approach is also applicable in real-time processing for protocol recognition with identification of the used cipher suite. The use of neural networks to recognize the industrial protocol and encryption set used enables big data processing with minimal time overhead to perform traffic classification. Packet-by-packet classification allows the detection of changes made to the industrial protocol, the use of a new protocol in the network, or the tunneling of traffic through another protocol.

Druh

D - Stať ve sborníku

CEP obor

—

OECD FORD obor

20203 - Telecommunications

Projekt

<a href="/cs/project/FW01010474" target="_blank" >FW01010474: Analýza, detekce a mitigace hrozeb dostupnosti síťových služeb</a><br>

Návaznosti

P - Projekt vyzkumu a vyvoje financovany z verejnych zdroju (s odkazem do CEP)

Rok uplatnění

2022

Kód důvěrnosti údajů

S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů

Název statě ve sborníku

2022 IEEE International Carnahan Conference on Security Technology (ICCST)

ISBN

978-1-6654-9363-5

ISSN

—

e-ISSN

—

Počet stran výsledku

7

Strana od-do

1-7

Název nakladatele

Institute of Electrical and Electronics Engineers Inc.

Místo vydání

neuveden

Místo konání akce

Valeč u Hrotovic

Datum konání akce

7. 9. 2022

Typ akce podle státní příslušnosti

WRD - Celosvětová akce

Kód UT WoS článku

—