Publication detail

Deep Neural Networks for Industrial Protocol Recognition and Cipher Suite Used

HOLASOVÁ, E. FUJDIAK, R.

Original Title

Deep Neural Networks for Industrial Protocol Recognition and Cipher Suite Used

Type

conference paper

Language

English

Original Abstract

The main objective of this paper is to determine the network traffic parameters to classify the industrial protocol and the cipher suite used without prior knowledge of the network using deep learning. To recognize industrial protocols, our test environment was used to generate a dataset because suitable, publicly available datasets are not available. The testbed generated an unsecured version of Modbus/TCP and three types of Modbus/TCP Security with different cipher using with the same data flow. This allows us to avoid the influence caused by the transmitted content. In this paper, three scenarios are provided, in which different numbers of input parameters are used for model training. Using the presented approach, it is possible to recognize the industrial protocol and the cipher suite with an accuracy of 0.945 with 17 input parameters taken from the link, network, and transport layers of the reference ISO/OSI model (not the application layer). Each scenario is validated on training, testing, and validation data. Based on the reached results, the presented approach is also applicable in real-time processing for protocol recognition with identification of the used cipher suite. The use of neural networks to recognize the industrial protocol and encryption set used enables big data processing with minimal time overhead to perform traffic classification. Packet-by-packet classification allows the detection of changes made to the industrial protocol, the use of a new protocol in the network, or the tunneling of traffic through another protocol.

Keywords

Protocol recognition, OT, Modbus, TLS, Traffic classification, Cipher suite, Industrial testbed

Authors

HOLASOVÁ, E.; FUJDIAK, R.

Released

26. 9. 2022

Publisher

Institute of Electrical and Electronics Engineers Inc.

ISBN

978-1-6654-9363-5

Book

2022 IEEE International Carnahan Conference on Security Technology (ICCST)

Pages from

1

Pages to

7

Pages count

7

URL

https://ieeexplore.ieee.org/document/9896532

BibTex

@inproceedings{BUT179342,
  author="Eva {Holasová} and Radek {Fujdiak}",
  title="Deep Neural Networks for Industrial Protocol Recognition and Cipher Suite Used",
  booktitle="2022 IEEE International Carnahan Conference on Security Technology (ICCST)",
  year="2022",
  pages="1--7",
  publisher="Institute of Electrical and Electronics Engineers Inc.",
  doi="10.1109/ICCST52959.2022.9896532",
  isbn="978-1-6654-9363-5",
  url="https://ieeexplore.ieee.org/document/9896532"
}