# Development of Fingerprint Identification Based on Device Flow in Industrial Control System
## 3 Device Traffic Fingerprint Extraction and Identification
### Device Fingerprint Extraction  
The flow data of all devices can be collected from the SCADA system. For a single data packet in the flow data, it is abstracted into a mode \(s_{i}\). The calculation process is as Equation (1):  
\[s_{i}=f(u,l,t,m) \tag{1}\]  
\(f\) is an abstract function, the specific implementation depends on the type of industrial control protocol. \(u\) represents the specific industrial control protocol, \(l\) represents the length of the data packet, \(t\) represents the function of the protocol, and m represents the information carried by the protocol. The more information there is, the more patterns are abstracted, resulting in a large difference in the pattern sequence of the same device in different time periods, which cannot be recognized. On the contrary, if the selected information is less, the pattern sequence between different devices will be more similar, causing device confusion. Therefore, characteristic fields with high identification and few changes in the protocol are usually selected. For example, Modbus is a data communication protocol that is based on a request-response model, and is used for transmitting information between devices that are connected to buses or networks over serial lines or Ethernet. The format of Modbus protocol is illustrated in Figure 1. This paper adopts MAC layer, IP layer, TCP layer, transaction, function code, unit, and address information instead of coil value information, because the coil value has a high rate of change and is not suitable for abstraction. After abstracting the data packet into a pattern, a pattern sequence \(Trav\ =\ <s_{1},s_{2},...,s_{n}>\) can be obtained. The traffic collected from the industrial control network often has a large number of repeated data packets. If the repeated data packets are not preprocessed, it will not only waste storage space, affect the efficiency of device identification, but also affect the identification accuracy due to the irregular number of repetitions. Therefore, this paper stores the number of repeating patterns and patterns separately, as shown in Figure 2.  
The kernel of the industrial control system is a fixed cyclic operation process, and the work that all devices are responsible for will not change easily. Therefore, the collected traffic data has a certain regularity. The pattern sequence can be used as the fingerprint of the device, and then it is identified based on pattern matching. If only the pattern sequence of the device is kept, each match is time-intensive and inefficient. Therefore, this paper uses the suffix matching algorithm to process the pattern sequence. The matching process in the identification only needs \(O(k*n)\) time complexity, where \(n\) is the length of the query sequence, and \(k\) is the number of times the query sequence appears in the fingerprint sequence. Suffix matching can be stored in suffix array or suffix tree. Compared with suffix tree, the time overhead of suffix array in matching is almost the same, but it can save storage space. Therefore, this paper adopts the form of suffix array to store. In order to explain the suffix array generation algorithm more clearly, the concepts used in the algorithm are listed first, as shown in Table 1:  
Figure 1: Modbus protocol format. Figure 2: Pattern sequence before and after compression. The \(SA\) array and the \(RK\) array have a reciprocal relationship, that is, \(SA[RK[i]]=i\), as shown in Figure 3. The time complexity of suffix array-based matching is relatively low, and can be roughly divided into three categories: multiplication algorithm, induced copy algorithm and divide and conquer recursive algorithm. The average time complexity of the multiplication algorithm is \(O(n*logn)\), but the space overhead is large, and the order of prefixes needs to be stored. The induced copy algorithm first sorts the selected suffixes according to certain rules, and then induces sorting of all suffixes through the sorted suffixes.