## 1 Introduction  
The development of the Internet of Things (IoT) and cloud computing promoted the upgrading of traditional ICSs to intelligence and automation [1], making the application of ICSs more extensive. Nowadays, ICSs are widely used in different critical infrastructures such as intelligent traffic management, smart grids, and smart manufacturing. As a subset of ICSs, supervisory control and data acquisition (SCADA) systems undertake the task of data monitoring, collection, and transmission, in which a large number of industrial control protocols with unknown structures are transmitted. The integration of the Internet and ICSs makes the network environment complicated. ICS protocol traffic classification is an important part of ICS network management, which can be used to prevent security threats and analyze network components. At present, there are four main internet application protocol traffic classification methods [2]: port-based, load-based, machine-learning-based, and deep-learning-based traffic classification methods. The port-based method classifies traffic according to the specified port number, which is simple and fast. However, the advent of port pooling and dynamic port techniques greatly reduced the accuracy of this approach [3]. The load-based classification method is also called deep packet inspection (DPI). DPI classifies the traffic by extracting the signatures from the protocol packets and matching them in the existing signature database [4]. However, the signature database must be generated in advance and the computational cost is high. It has low accuracy in classifying encrypted traffic. Traffic classification methods based on machine learning (ML) and deep learning (DL) became the hotspots of traffic classification research in recent years [5]. ML-based methods realize traffic classification through feature extraction and training ML classifiers [6]. [PERSON] [7] used network flow-level features to identify the type of traffic. However, expert experience is required for feature extraction, and features are hard to extract in private protocols, which limits the generalizability of the methods based on ML. DL-based methods avoid manual design and can automatically extract features [8], which can be used to classify traffic easily. [PERSON] et al. [9] used DL technology to extract features and classify traffic. However, DL-based methods require a large amount of data for learning and have a high time cost, which is not suitable for ICSs that need low latency. The commonly used network traffic classification methods are mainly used to classify multimedia traffic or internet application traffic with complex characteristics, and have the disadvantages of high algorithm complexity and a high time cost. Different from the internet protocol, the industrial control protocol has a concise structure and relatively fixed functions [10]. In the actual production process, the industrial control network traffic has periodicity and stability for meeting specific industrial processes [11]. Therefore, the method for internet traffic classification cannot be directly applied in ICSs because it cannot meet the high real-time requirement for ICSs. We designed a keyword feature extraction method for private industrial control protocol according to the characteristics of industrial control protocol and periodicity of data flow in ICSs. This algorithm can automatically extract the keyword features through data segmentation, filtering, and association rule mining from protocol payload without manual assistance. Then, we used the dataset after feature extraction to train a more concise decision tree, which can help classify the ICS protocol traffic quickly and accurately. Experiments were carried out on the SWAT and EPIC joint dataset.