An Entropy-based Field Segmentation Method for Unknown Protocols in Industrial IoT

Unknown industrial control protocols (ICPs) seriously hamper the device intercommunication and security analysis of the Industrial Internet of Things due to the absence of public specification information. Protocol reverse analysis has emerged as a promising technology to infer their specifications, where the primary step is to extract protocol fields by locating their boundaries in the network packet. Previous works leverage various algorithms, such as sequence alignment, keyword mining, and statistic analysis for field extraction. However, they have limitations in excavating the unique features of ICP fields, leading to inaccuracies in boundary localization. To address this problem, we propose an entropy-based field segmentation method for unknown ICPs. After stacking protocol packets vertically, we calculate the information entropy and information gain ratio of data values at each location in the packet. By analyzing the distribution variations of these entropy features in diverse ICP fields, we derive multiple packet segmentation rules to locate the field boundaries. Extensive comparative experiments demonstrate the superiority of our method for ICP field extraction.