Full Text:   <1481>

CLC number: 

On-line Access: 2021-05-20

Received: 2020-12-19

Revision Accepted: 2021-04-15

Crosschecked: 0000-00-00

Cited: 0

Clicked: 2749

Citations:  Bibtex RefMan EndNote GB/T7714

-   Go to

Article info.
Open peer comments

Journal of Zhejiang University SCIENCE C 1998 Vol.-1 No.-1 P.

http://doi.org/10.1631/FITEE.2000709


Automatic protocol reverse-engineering for industrial control systems with dynamic taint analysis


Author(s):  Rongkuan MA, Hao ZHENG, Jingyi WANG, Mufeng WANG, Qiang WEI, Qingxian WANG

Affiliation(s):  State Key Laboratory of Mathematical Engineering and Advanced Computing, Zhengzhou 450001, China; more

Corresponding email(s):   rongkuan233@gmail.com, zjuzhenghao@gmail.com, wangjyee@gmail.com, csewmf@zju.edu.cn, weiqiang66@126.com, wangqingxian2015@163.com

Key Words:  ICS protocol reverse-engineering, Dynamic taint analysis, Protocol format


Rongkuan MA, Hao ZHENG, Jingyi WANG, Mufeng WANG, Qiang WEI, Qingxian WANG. Automatic protocol reverse-engineering for industrial control systems with dynamic taint analysis[J]. Frontiers of Information Technology & Electronic Engineering, 1998, -1(-1): .

@article{title="Automatic protocol reverse-engineering for industrial control systems with dynamic taint analysis",
author="Rongkuan MA, Hao ZHENG, Jingyi WANG, Mufeng WANG, Qiang WEI, Qingxian WANG",
journal="Frontiers of Information Technology & Electronic Engineering",
volume="-1",
number="-1",
pages="",
year="1998",
publisher="Zhejiang University Press & Springer",
doi="10.1631/FITEE.2000709"
}

%0 Journal Article
%T Automatic protocol reverse-engineering for industrial control systems with dynamic taint analysis
%A Rongkuan MA
%A Hao ZHENG
%A Jingyi WANG
%A Mufeng WANG
%A Qiang WEI
%A Qingxian WANG
%J Journal of Zhejiang University SCIENCE C
%V -1
%N -1
%P
%@ 2095-9184
%D 1998
%I Zhejiang University Press & Springer
%DOI 10.1631/FITEE.2000709

TY - JOUR
T1 - Automatic protocol reverse-engineering for industrial control systems with dynamic taint analysis
A1 - Rongkuan MA
A1 - Hao ZHENG
A1 - Jingyi WANG
A1 - Mufeng WANG
A1 - Qiang WEI
A1 - Qingxian WANG
J0 - Journal of Zhejiang University Science C
VL - -1
IS - -1
SP -
EP -
%@ 2095-9184
Y1 - 1998
PB - Zhejiang University Press & Springer
ER -
DOI - 10.1631/FITEE.2000709


Abstract: 
Proprietary (or semi-proprietary) protocols are widely adopted in Industrial Control Systems (ICSs). Inferring protocol format by reverse engineering is important for many network security applications, e.g., program tests and intrusion detection. Conventional works have proposed protocol reverse engineering methods with manual effort, which are considered time-consuming, tedious and error-prone. More recent works propose automatically protocol reverse engineering methods that are however either not effective in handling binary-based ICS protocols based on network traffic analysis or not accurate in extracting protocol fields from protocol implementations. In this paper, we present a framework called the Industrial Control System Protocol Reverse-engineering Framework (ICSPRF) that aims to extract ICS protocol fields with better accuracy. ICSPRF is based on the key insight that an individual field in a message is typically handled in the same execution context (e.g., BBL group). As a result, by monitoring the program execution, we can collect the tainted data information processed in every BBL group in the execution trace and cluster them to derive the protocol format. We evaluated our approach with six open-source ICS protocol implementations. The results show that ICSPRF can identify individual protocol fields with high accuracy (on average 94.3% match ratio compared with Wireshark). ICSPRF also has a low coarse-grained and overly fine-grained match ratio. For the same metric, ICSPRF is more accurate than AutoFormat (88.5% for all evaluated protocols and 80.0% for binary-based protocols).

Darkslateblue:Affiliate; Royal Blue:Author; Turquoise:Article

Open peer comments: Debate/Discuss/Question/Opinion

<1>

Please provide your name, email address and a comment





Journal of Zhejiang University-SCIENCE, 38 Zheda Road, Hangzhou 310027, China
Tel: +86-571-87952783; E-mail: cjzhang@zju.edu.cn
Copyright © 2000 - Journal of Zhejiang University-SCIENCE