## 5 Experiments and Results
### Results  
We take the IEC 61850-MMS protocol as an example to illustrate the accuracy of the keyword feature extraction method for the industrial control protocol in this paper. Since  
Figure 4: SWAT and EPIC testbeds by iTRUST in Singapore.  
Figure 5: The meaning of TP, FP, TN, FN.  
the keyword features are usually concentrated in the protocol header, we unify the length of the protocol payload as 50 bytes and add \"\(-1\)\" to the packet whose length is less than 50. Experiments are carried out according to the feature extraction method described in this paper and the confidence threshold is set as 0.5. The results of each step when extracting features are shown in Figure 6. Finally, the 0 th, 2 nd, 3 rd, 6 th, and 8 th bytes are extracted as the keyword bytes of the IEC 61850-MMS protocol.  
The format of the IEC 61850-MMS protocol is shown in Table 3. It can be seen that the 0 th, 2 nd, 3 rd, and 6 th bytes are successfully extracted as the keywords of the IEC 61850-MMS protocol by comparing with the protocol format. The 8 th byte is also regarded as a keyword, the reason is that this byte represents a service type (tag). The 11 th, 13 th, and 15 th bytes also belong to the tag flag, while their confidence levels are lower than the threshold specified, which means not enough packets use the bytes as a tag, so they are not considered a keyword byte. On the whole, the key feature extraction method of the industrial control protocol proposed in this paper can successfully extract the feature information of the industrial control protocol.  
Feature extraction is performed on the IEC 61850-MMS and ethernet/IP protocols in the dataset. The comparison between the feature dataset and the original dataset is shown in Table 4. It can be found that the number of features is reduced from 50 to 13, and data memory footprint is reduced by 74%.  
We take 80% of the samples in the original dataset and feature dataset as the training set and 20% as the test set, then train the decision tree classifier and test the performance of the classifier. The accuracy and time cost comparison of the two classifiers are shown in Figure 7, and the precision and recall rate of a single category are shown in Tables 5 and 6. The results show that the feature dataset removes the interference features in the original  
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**Dataset** & **Number of Samples** & **Number of Features** & **Data Memory** \\ \hline Feature dataset & 140,000 & 13 & 7.28 MB \\ Original dataset & 140,000 & 50 & 28 MB \\ \hline \hline \end{tabular}
\end{table}
Table 4: The comparison between feature dataset and original dataset.  
Figure 6: The diagram of each step of the feature extraction method.  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Protocol Message Type** & **Subsequent Data Length** & **Frame Start Flag** \\ \hline
1 Bytes & 1 Byte & 2 Bytes \\ \hline
**invoke id** & **Service type** & **subsequent data length** \\ \hline
2 Bytes & 1 Byte & 1 Byte \\ \hline \hline \end{tabular}
\end{table}
Table 3: IEC 61850-MMS protocol message format.  
data. The decision tree classifier trained with the feature dataset is more concise and efficient; the average precision of the classifier is 99.99%, the average recall rate is 99.98%, the training time is only 0.34 s, and the predicting time is only 0.264 s, outperforming the classifier trained by the original dataset.