Deep Neural Networks for Industrial Protocol Recognition and Cipher Suite Used

• Published in: 2022 IEEE International Carnahan Conference on Security Technology (ICCST) pp. 1 - 7
• Main Authors: Holasova, Eva, Fujdiak, Radek
• Format: Conference Proceeding
• Language: English
• Published: IEEE 07-09-2022
• Subjects: Cipher suite; Ciphers; Deep learning; Industrial testbed; Knowledge engineering; Modbus; Neural networks; Protocol recognition; Protocols; Real-time systems; TLS; Traffic classification; Training
• ISSN: 2153-0742
• DOI: 10.1109/ICCST52959.2022.9896532

The main objective of this paper is to determine the network traffic parameters to classify the industrial protocol and the cipher suite used without prior knowledge of the network using deep learning. To recognize industrial protocols, our test environment was used to generate a dataset because suitable, publicly available datasets are not available. The testbed generated an unsecured version of Modbus/TCP and three types of Modbus/TCP Security with different cipher using with the same data flow. This allows us to avoid the influence caused by the transmitted content. In this paper, three scenarios are provided, in which different numbers of input parameters are used for model training. Using the presented approach, it is possible to recognize the industrial protocol and the cipher suite with an accuracy of 0.945 with 17 input parameters taken from the link, network, and transport layers of the reference ISO/OSI model (not the application layer). Each scenario is validated on training, testing, and validation data. Based on the reached results, the presented approach is also applicable in real-time processing for protocol recognition with identification of the used cipher suite. The use of neural networks to recognize the industrial protocol and encryption set used enables big data processing with minimal time overhead to perform traffic classification. Packet-by-packet classification allows the detection of changes made to the industrial protocol, the use of a new protocol in the network, or the tunneling of traffic through another protocol.