We present the first technique of passive fingerprinting for Supervisory Control And Data Acquisition (SCADA) networks without Deep Packet Inspection (DPI) and experience on real environment. Unlike existing work, our method does not rely on the functions of a specific product or DPI of the SCADA protocol. Our inference method, which is based on the intrinsic characteristics of SCADA, first identifies the network port used for the SCADA protocol, then consecutively infers the field devices and master server. We evaluated the effectiveness of our method using two network traces collected from a real environment for a month and a half, three days from different CI respectively. This confirmed the ability of our method to capture most of the SCADA with high F-score nearly 1, except for HMIs connected to master server, and demonstrated the practical applicability of the method.
@cite_7: Protocol reverse engineering has often been a manual process that is considered time-consuming, tedious and error-prone. To address this limitation, a number of solutions have recently been proposed to allow for automatic protocol reverse engineering. Unfortunately, they are either limited in extracting protocol fields due to lack of program semantics in network traces or primitive in only revealing the flat structure of protocol format. In this paper, we present a system called AutoFormat that aims at not only extracting protocol fields with high accuracy, but also revealing the inherently “non-flat”, hierarchical structures of protocol messages. AutoFormat is based on the key insight that different protocol fields in the same message are typically handled in different execution contexts (e.g., the runtime call stack). As such, by monitoring the program execution, we can collect the execution context information for every message byte (annotated with its offset in the entire message) and cluster them to derive the protocol format. We have evaluated our system with more than 30 protocol messages from seven protocols, including two text-based protocols (HTTP and SIP), three binary-based protocols (DHCP, RIP, and OSPF), one hybrid protocol (CIFS SMB), as well as one unknown protocol used by a real-world malware. Our results show that AutoFormat can not only identify individual message fields automatically and with high accuracy (an average 93.4 match ratio compared with Wireshark), but also unveil the structure of the protocol format by revealing possible relations (e.g., sequential, parallel, and hierarchical) among the message fields. ∗Part of this research has been supported by the National Science Foundation under grants CNS-0716376 and CNS-0716444. The bulk of this work was performed when the first author was visiting George Mason University in Summer 2007.
The other applicable existing work is protocol reverse engineering that the process of the inferring the specification of an unknown network protocol @cite_7 . These techniques leverage approach for automatically extracting information of unknown target protocol. Even though they contribute to analysis of unknown network environment and helpful to provide major SCADA protocols, it is difficult to cover for analysis of all our CIs in the field. The main difficulty of this problem is closed SCADA information that cannot be provided in public. These techniques based on assumption that we require enough samples from target environment or classification from other distinct types of protocols. Understandably, our CI network information is not public and some major vendors do not public their SCADA protocol specification and information. Even though, these techniques help to analysis several famous SCADA protocol, but this approach is extremely expensive cost to cover all of environment. As SCADA market grows, our CI environment becomes heterogeneous for SCADA device and network protocol. Considering the possibility that customized protocol from standard also can make different result from identified signatures, our method can be applied complementary for analysis of CI that cannot be covered by protocol reversing efforts.