Abnormal Industrial Control Protocol Identification Based on Feature Boosting

The development of the Internet has brought great convenience to people's life, but it has also brought potential dangers, such as zero-day vulnerabilities and DoS attacks. Abnormal industrial control protocol identification is an important part of industrial control security. It detects whether the behavior violates the security policy by collecting some key point data in the computer network and system for analysis. Aiming at the increasingly stealthy network attacks, we explore a feature generation method and several classification algorithm are applied to identify. In the feature extraction stage, we used a technique called feature boosting and generated new feature set, and then we used a variety of classification models to identify the new feature set, including Naive Bayes, KNN, SVM, Knowledge Distillation. For new feature set, the above classification models are applied and perform well. Our work demonstrates that anomalous control protocol can be effectively identified even with commonly used classification models after employing feature boosting techniques, which provides a potential approach for industrial control Protocol recognition.