# Development of Fingerprint Identification Based on Device Flow in Industrial Control System
###### Abstract  
With the rapid development of industrial automation technology, a large number of industrial control devices have emerged in cyberspace, but the security of open cyberspace is difficult to guarantee. Attacks on industrial control devices can directly endanger the environment and even life safety. Therefore, how to monitor the industrial control system in real time has become the primary problem, and device identification is the basic guarantee of safety monitoring. There are limitations in building device identification model based on IP address or machine learning. The paper aim at the development of a device traffic fingerprint model and identify the device based on the periodicity of device traffic. The model generates device fingerprints based on pattern sequences abstracted from the traffic and suffix array algorithm. In the process of recognition, the exact pattern matching algorithm is used for preliminary judgment. If the exact pattern matching fails to hit, the final judgment is made by combination fuzzy pattern matching. This paper also proposes a diagonal jump algorithm to optimize the updating of the distance matrix, which saves on the computational cost of fuzzy pattern matching. Simulation results show that compared with SVM, random forest, and LSTM model, the device traffic fingerprint model has good performance advantages in accuracy, recall and precision.  
pattern matching; industrial control system; device traffic fingerprint; device identification +
Footnote †: journal: Applied Sciences  
bring multiple benefits to research and industry [3]. Network administrators can inventory devices, look for information leaked due to configuration errors, and determine whether devices are in an abnormal state.  
The device identification model is usually constructed based on the extraction of device fingerprints [4; 5; 6]. The collection methods from fingerprints can be divided into active fingerprints [7] and passive fingerprints [8; 9]. Active fingerprinting refers to sending constructed packets to unknown devices, and then constructing device fingerprints according to the response information of the devices. The passive fingerprint is constructed based on the state information of the device in operation without interfering with the normal operation of the device. From the types of fingerprints, it can be divided into physical fingerprints and traffic fingerprints. Physical fingerprints are based on the physical information of the device, such as clock offset, time series composed of register values, etc. The fingerprint built from the device traffic data is the traffic fingerprint. The redundant data packets in industrial control systems can affect normal production processes and even cause network outages. Collecting device physical information requires the deployment of specific monitors, which is expensive and less scalable. The Supervisory Control And Data Acquisition (SCADA) system [10] can easily collect the flow data of the devices in the system. Therefore, this paper will build a device traffic fingerprint library based on passive fingerprints and identify devices.