|
|
Energy protocol recognition using artificial intelligence
Racka, Jan ; Holasová, Eva (referee) ; Bohačík, Antonín (advisor)
The master's thesis focuses on classification of secure network traffic of energy protocols using convolutional neural network. The theoretical part discusses the issues of neural networks and their use in network traffic classification. In addition, the energy protocols Modbus, IEC 104, TASE.2, DNP3, GOOSE, SMV, MMS, and the standard DLMS/COSEM are analyzed, including their security. In the subsequent practical part, a convolutional neural network is implemented to recognize the mentioned protocols in their secured versions. Unsecured traffic records from publicly available repositories and from traffic simulators of the mentioned protocols, and captured data in an energy polygon were used to train the neural network. TLS and GOOSE convertotrs were developed to obtain secured traffic, which ensured that the protocols using same security mechanisms were secured uniformly. The resulting secured traffic was preprocessed into a two-dimensional format and was presented as input to the neural network for learning. The input image was created from the application parts of packets of the energy protocol session and formatted to the 28 × 28 byte image. The resulting network accuracy on the test data was 95,75 %. Furthermore, the network was tested on real traffic in an energy polygon, where it correctly recognized several protocols. A classifier for the operational state of a station that communicates using IEC 104 secured with TLS was developed as part of a partial objective of the thesis. The task of the classifier was to recognize, using encrypted messages, the state of the tested station. The classifier consisted of a convolutional neural network, which were usinga two-dimensional image consisting of information from a sequence of five consecutive packets as input. The information consisted of the interarrival time between packets, the length of the TLS encrypted application data, and the encrypted application data up to size 64 B. To obtain enough data to train the convolutional network, a simulator of characteristic messages for each state was developed. The classifier showed an accuracy of 43,05 % on the test data after the learning phase. Next, the classifier underwent testing on the test stations, where it was able to distinguish normal state of the state from events, but could not distinguish certain events of similar nature from each other.
|
guest ::
