Protocol state analysis and annotation methodology based on deep learning

Reverse engineering of agnostic industrial control protocols (ICPs) based on traffic traces is significant for the security analysis of industrial control systems. Field semantics deduction is an essential step in protocol reverse engineering following the discovery of the message field. Most existing methods rely on knowledge-based analysis for specific fields of common protocols, which require too numerous assumptions and lack semantic knowledge about ICPs. In this paper, we propose a new concept, pattern series, and design the first classification framework for inferring the semantic types of unknown ICPs. Specifically, we first present the definition of pattern series and design the field pattern series generation algorithm for building training data, then develop a field semantics classification model to learn and apply semantic features from known protocols to predict semantic types in unknown protocols. Lastly, we implement a probability-maximizing selection algorithm to obtain optimal semantic types. We demonstrate the effectiveness of the proposed method through extensive experiments with five popular ICPs, including their mixed protocols. Evaluations show that our approach significantly outperforms baseline methods in field semantic recognition, achieving ≥90.8% F1-score.

Unsupervised field segmentation of unknown protocol messages

Research on unknown network protocol reverse engineering is of great significance in many network security applications. Currently most of methods are limited in analyzing plain-text protocols, and a few of method can partly analyze the encryption protocol which is powerless for multiple encryption protocol or sectional encryption protocol. This paper proposes a method of encrypted protocol reverse engineering based on dynamic taint analysis. The method uses Pin to record executed instructions, and then conducts off-line analysis of the data dependencies to build two taint propagation graphs on instruction and function level, then recover the decryption process. The decrypted plaintext can be located due to the decryption process feature. And then, the format of protocol can be parsed. Experiments show that the method can accurately locate the decrypted protocol data of the multiple encryption and sectional encryption protocol, and restore the original format.

The protocol reverse engineering technique can be used to extract the specification of an unknown protocol. However, there is no standardized method, and in most cases, the extracting process is executed manually or semiautomatically. Since only frequently seen values are extracted as fields from the messages of a protocol, it is difficult to understand the complete specification of the protocol. Therefore, if the information about the structure of an unknown protocol could be acquired in advance, it would be easy to conduct reverse engineering. As such, one of the most important techniques for classifying unknown protocols is a feature extraction algorithm. In this paper, we propose a new feature extraction algorithm based on average histogram for classification of an unknown protocol and design unknown protocol classifier using deep belief networks, one of deep learning algorithms. In order to verify the performance of the proposed system, we performed the training using eight open protocols to evaluate the performance using unknown data. Experimental results show that the proposed technique gives significantly more reliable results of about 99% classification performance, regardless of the strength of the modification of the protocol.

In order to solve the problem that there are a large number of unknown protocols on the network, which affect the network management and network security in varying degrees, an unknown binary protocol identification method is proposed. On the premise that the center cluster of unknown protocols is obtained by the clustering algorithm, the unknown protocols for network traffic are identified by combining one‐class of classification with one‐dimensional CNN classification technology. At first, a class of classification algorithm is used to select the unknown protocols, and then, the labeled protocol data obtained by clustering are used to train the one‐dimensional CNN model, and the classified binary protocol packets are directly used as the input of the one‐dimensional convolution neural network. After the classification of the CNN model, the unknown protocols are finally identified. The experimental results show that the proposed classification and recognition method is better than the traditional CNN and SVM algorithms, and the maximum frequency pooling is better than the traditional pooling method.

<p>Clustering is an important technique for data analysis and knowledge discovery. In the context of big data, the density-based clustering algorithm faces three challenging problems: unreasonable division of data gridding, poor parameter optimization ability and low efficiency of parallelization. In this study, a density-based clustering algorithm by using improve fruit fly optimization based on MapReduce (MR-DBIFOA) is proposed to tackle these three problems. Firstly, based on KD-Tree, a division strategy (KDG) is proposed to divide the cell of grid adaptively. Secondly, an improve fruit fly optimization algorithm (IFOA) which use the step strategy based on knowledge learn (KLSS) and the clustering criterion function (CFF) is designed. In addition, based on IFOA algorithm, the optimal parameters of local clustering are dynamically selected, which can improve the clustering effect of local clustering. Meanwhile, in order to improve the parallel efficiency, the density-based clustering algorithm using IFOA (MR-QRMEC) are proposed to parallel compute the local clusters of clustering algorithm. Finally, based on QR-Tree and MapReduce, a cluster merging algorithm (MR-QRMEC) is proposed to get the result of clustering algorithm more quickly, which improve the core clusters merging efficiency of density-based clustering algorithm. The experimental results show that the MR-DBIFOA algorithm has better clustering results and performs better parallelization in big data.</p> <p> </p>

We adopt clustering algorithm to improve segmentation accuracy. In this paper, 3D laser scanning platform was built to obtain the spatial 3D point cloud data. And then we extracted the point cloud data for two planar features. K-means algorithm, density-based clustering algorithm and density peak clustering algorithm were employed to split the 3D point cloud of the two planes. After clustering, we compared and analyzed the clustering results of the three clustering algorithms. More importantly, we also found that for peak density clustering, the threshold value is related to its sensitivity to noise points. After fitting the two planes, the verticality of two planes was also calculated. We analyzed the results and summarized the criterion for selecting thresholds.

Protocol reverse engineering is of great significance for discovering protocol vulnerabilities, improving protocol security and reusing protocol. The existing protocol reverse analysis methods usually need a great deal of computation and often takes a long time, which seriously affects the effect of real-time analysis. This paper proposes an incremental protocol format extraction algorithm, which divides the network traffic into different substreams, and introduces error decision mechanism to avoid local errors caused by partition, so as to ensure the correctness. By dynamic evaluation of the complexity of the protocol analysis, the incremental protocol analysis method can effectively improve the efficiency of the protocol reverse engineering.

Improved heart disease detection from ECG signal using deep learning based ensemble model

Protocol reverse-engineering technique can be used to extract the specification of an unknown protocol. However, there is no standardized method and in most cases, the extracting process is done manually or semi-automatically. Since only frequently seen values are extracted as fields from the messages of a protocol, it is difficult to understand complete specification of the protocol. Therefore, if the information about the structure of the unknown protocol could be acquired in advance, it would be easy to conduct reverse engineering. This paper suggests a method of recognizing 8 commercial protocols and transformed protocols of their own using deep learning techniques. When the proposed method is conducted prior to APRE (Automatic Protocol Reverse Engineering) process, it is possible to obtain useful information beforehand when similarities exist between unknown protocols and learned protocols.

Stochastic subspace identification uses the frequency stability graph as the judgment standard of recognition results, and the introduction of clustering algorithm makes the automatic recognition of stability graph possible. At present, the clustering algorithm generally has subjective input parameter selection, complex algorithm theory and human intervention. The characteristic of stability chart is that the physical mode density is large, while the false mode density is small. DBSCAN clustering is a density based clustering algorithm, which can identify any shape of the class. According to the characteristics of the stability diagram, this paper proposes an automated operational modal analysis algorithm based on DBSCAN clustering, which is applied to the benchmark model of Z24 bridge in Switzerland. The results show that the method is feasible in the automated operational modal analysis of bridge structures.

Statistical and density-based clustering of geographical flows for crowd movement patterns recognition

Protocol's abnormal behavior analysis is an important task in protocol reverse analysis. Traditional protocol reverse analysis focus on the protocol message format, but protocol behavior especially the abnormal behavior is rare studied. In this paper, protocol behavior is represented by the labeled behavior instruction sequences. Similar behavior instruction sequences mean the similar protocol behavior. Using our developed virtual analysis platform HiddenDisc, we can capture a variety of known or unknown protocols' behavior instruction sequences. All kinds of executed or unexecuted instruction sequences can automatic clustering by our designed instruction clustering algorithm. Thereby we can distinguish and mine the unknown protocols' potential abnormal behavior. The mined potential abnormal behavior instruction sequences are executed, monitored and analyzed on HiddenDisc to determine whether it is an abnormal behavior and what is the behavior's nature. Using the instruction clustering algorithm, we have analyzed 1297 protocol samples, mined 193 potential abnormal instruction sequences, and determined 187 malicious abnormal behaviors by regression testing. Experimental results show that our proposed instruction clustering algorithm has high efficiency and accuracy, can mine unknown protocols' abnormal behaviors effectively, and enhance the initiative defense capability of network security.

Oral cancer is the most commonly occurring ‘head and neck cancers’ across the globe. Most of the oral cancer cases are diagnosed at later stages due to absence of awareness among public. Since earlier identification of disease is essential for improved outcomes, Artificial Intelligence (AI) and Machine Learning (ML) models are used in this regard. In this background, the current study introduces Artificial Intelligence with Deep Transfer Learning driven Oral Cancer detection and Classification Model (AIDTL-OCCM). The primary goal of the proposed AIDTL-OCCM model is to diagnose oral cancer using AI and image processing techniques. The proposed AIDTL-OCCM model involves fuzzy-based contrast enhancement approach to perform data pre-processing. Followed by, the densely-connected networks (DenseNet-169) model is employed to produce a useful set of deep features. Moreover, Chimp Optimization Algorithm (COA) with Autoencoder (AE) model is applied for oral cancer detection and classification. Furthermore, COA is employed to determine optimal parameters involved in AE model. A wide range of experimental analyses was conducted on benchmark datasets and the results were investigated under several aspects. The extensive experimental analysis outcomes established the enhanced performance of AIDTL-OCCM model compared to other approaches with a maximum accuracy of 90.08%.

With the growth of network equipment, the security of network access environment becomes particularly important. Many network security technologies, such as vulnerability mining, fuzzy testing and intrusion detection, have attracted more and more attention. However, the effectiveness of these security technologies will be greatly reduced in the face of unknown protocols. By automatically extracting the format information of unknown protocols through the protocol reverse technology, the processing capability of the above security technologies in the face of unknown protocols can be enhanced. In this paper, by analyzing the changing characteristics of protocol fields, a field sequence coding method is proposed, which is suitable for reflecting the field sequence characteristics of different protocols and can improve the generalization ability of the model. Using the above field sequence coding method, a field classification model for unknown protocols is implemented based on the LSTM-FCN network, which is widely used in time series classification tasks. Finally, a binary protocol reverse method based on deep learning is proposed. The method is based on the field classification model and realizes the division and type identification of unknown protocol fields according to the classification results. In the experiment, the field classification model has high accuracy and recall in different protocols, which shows that the model has the ability to identify the field type according to the changing characteristics of the field. The proposed protocol reverse method also accurately and quickly identifies the field and its type, proving the reverse ability of the method to unknown binary protocols.KeywordsBinary protocol reverseProtocol field classificationDeep learning