SYSTEM AND METHOD FOR IDENTIFYING APPLICATION LAYER BEHAVIOR

• US 20190166138A1
• Filed: 12/07/2017
• Published: 05/30/2019
• Est. Priority Date: 11/29/2017
• Status: Active Grant

• Current Assignee: Institute For Information Industry
• Original Assignee: Institute For Information Industry
• Inventors: LIN, Chih-Ta, WU, Sung-Lin, LEE, Mei-Ling
• Granted Patent: US 10,630,701 B2
• Time in Patent Office: Days
• CPC Class Codes: G05B 19/0425 Safety, monitoring
• CPC Class Codes: G05B 23/024 Quantitative history assessment, e.g. mathematical relationships between available data; Functions therefor; Principal component analysis [PCA]; Partial least square [PLS]; Statistical classifiers, e.g. Bayesian networks, linear regression or correlation analysis; Neural networks
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

A system and method for identifying application layer behavior are disclosed. In order to detect intrusion into an industrial control system, the system and method determine a current status of application layer behavior of the industrial control system by analyzing a current packet which is propagated between a master device and a slave device in the industrial control system, and identify whether the current status of the application layer behavior is normal according to a normal behavior status list.

Claims

1. A system for identifying application layer behavior, comprising:

a storage, being configured to store a normal behavior status list;

a transmitter, being configured to transmit to the system for identifying application layer behavior a current packet which is propagated between a master device and a slave device in an industrial control system; and

a processor electrically connected with the storage and the transmitter, being configured to determine a current status of the application layer behavior of the industrial control system by analyzing the current packet and identify whether the current status of the application layer behavior is normal according to the normal behavior status list.

2. The system for identifying application layer behavior of claim 1, wherein:

the transmitter is further configured to transmit to the system for identifying application layer behavior a plurality of reference packets propagated between the master device and the slave device within a reference time interval; and

the processor is further configured to;

detect from the plurality of reference packets a plurality of groups of reference values stored for a plurality of parameters respectively in a plurality of memory addresses of the slave device within the reference time interval;

calculate a plurality of groups of correlation features of the plurality of groups of reference values respectively, calculate correlations between the plurality of parameters by analyzing the plurality of groups of correlation features, and divide the plurality of parameters into a plurality of parameter groups according to the correlations between the plurality of parameters;

calculate status feature combinations of parameters comprised in each of the plurality of parameter groups, and define all the calculated status feature combinations as a plurality of normal behavior statuses to create the normal behavior status list that records the plurality of normal behavior statuses; and

detect from the current packet a corresponding value stored for a corresponding parameter in a corresponding memory address among the plurality of memory addresses of the slave device, and determine the current status of the application layer behavior of the industrial control system according to the corresponding value and values stored in the slave device for other parameters in the parameter group to which the corresponding parameter belongs.

3. The system for identifying application layer behavior of claim 2, wherein the processor analyzes the plurality of groups of correlation features through feature comparison processing.

4. The system for identifying application layer behavior of claim 2, wherein the processor analyzes the plurality of groups of correlation features through machine learning processing.

5. The system for identifying application layer behavior of claim 2, wherein each of the status feature combinations is related to at least one of a value dispersion degree, a value tendency and a value potential tendency.

6. The system for identifying application layer behavior of claim 1, wherein the industrial control system adopts a Modbus communication protocol.

7. A method for identifying application layer behavior, comprising:

transmitting to a system for identifying application layer behavior a current packet which is propagated between a master device and a slave device in an industrial control system; and

determining, by the system for identifying application layer behavior, a current status of the application layer behavior of the industrial control system by analyzing the current packet and identifying, by the system for identifying application layer behavior, whether the current status of the application layer behavior is normal according to a normal behavior status list.

8. The method for identifying application layer behavior of claim 7, further comprising:

transmitting to the system for identifying application layer behavior a plurality of reference packets propagated between the master device and the slave device within a reference time interval;

detecting, by the system for identifying application layer behavior, from the plurality of reference packets a plurality of groups of reference values stored for a plurality of parameters respectively in a plurality of memory addresses of the slave device within the reference time interval;

calculating, by the system for identifying application layer behavior, a plurality of groups of correlation features of the plurality of groups of reference values respectively, calculating, by the system for identifying application layer behavior, correlations between the plurality of parameters by analyzing the plurality of groups of correlation features, and dividing, by the system for identifying application layer behavior, the plurality of parameters into a plurality of parameter groups according to the correlations between the plurality of parameters;

calculating, by the system for identifying application layer behavior, status feature combinations of parameters comprised in each of the plurality of parameter groups, and defining, by the system for identifying application layer behavior, all the calculated status feature combinations as a plurality of normal behavior statuses to create the normal behavior status list that records the plurality of normal behavior statuses; and

detecting, by the system for identifying application layer behavior, from the current packet a corresponding value stored for a corresponding parameter in a corresponding memory address among the plurality of memory addresses of the slave device, and determining, by the system for identifying application layer behavior, the current status of the application layer behavior of the industrial control system according to the corresponding value and values stored in the slave device for other parameters in the parameter group to which the corresponding parameter belongs.

9. The method for identifying application layer behavior of claim 8, wherein the system for identifying application layer behavior analyzes the plurality of groups of correlation features through feature comparison processing.

10. The method for identifying application layer behavior of claim 8, wherein the system for identifying application layer behavior analyzes the plurality of groups of correlation features through machine learning processing.

11. The method for identifying application layer behavior of claim 8, wherein each of the status feature combinations is related to at least one of a value dispersion degree, a value tendency and a value potential tendency.

12. The method for identifying application layer behavior of claim 7, wherein the industrial control system adopts a Modbus communication protocol.