IMCSA: Providing Better Sequence Alignment Space for Industrial Control Protocol Reverse Engineering

Nowadays, with the wide application of industrial control facilities, protocol reverse engineering has significant security implications. The method based on sequence alignment is current mainstream because its high accuracy. However, this will incur a huge time overhead due to unnecessary alignments during process. In paper, we optimize traditional by combining characteristics protocols. We improve frequent mining algorithm, Apriori, propose more efficient Bag-of-Words generation algorithm for finding keywords. Then, precluster messages generated similarity message within cluster. Finally, an preclustering model alignment, namely, IMCSA. evaluate it over five protocols, and results show that IMCSA can generate clusters higher similarity, which greatly reduce invalid existing in stage ultimately overall efficiency.