# Development of Fingerprint Identification Based on Device Flow in Industrial Control System
## 3 Device Traffic Fingerprint Extraction and Identification
### Exact Matching to Identify Unknown Devices  
After building the device fingerprint database, the device identification can be completed. After collecting the traffic data of the unknown device, first it is abstracted into an unknown pattern sequence Trav according to the Formula (1), and then it is slidably divided into multiple subsequences \(Trav[i,j]\). The subsequences are matched with all fingerprint sequences in the fingerprint database, and the device with the highest matching degree is the identification result. The first step of matching is exact matching, that is, the subsequence is required to be a successful match only if it completely matches the device fingerprint sequence. The exact matching base adopts the FM index sequence matching algorithm, and the overall algorithm flow is shown in Algorithm 2. ```
0:\(f[1:n]:\) Sorted suffix first pattern sequence. \(l[1:n]:\) Sorted suffix preceding pattern series. \(position[1:n]:\) The starting position of the pattern in the f sequence. \(pattern:\) pattern sequence to be queried. \(count[1:n]:\) The number of occurrences of the pattern in the f sequence. \(l2f:\) The correspondence between the f sequence and the l sequence elements. \(match[1,m]:\)Record the position where the query pattern sequence appears in the original pattern sequence. 1: Calculate the position \(p_{f}\) where the character c at the end of the pattern sequence appears in the sequence f using the count array and the position array. 2: Determine whether the element at the position of \(p_{f}\) in the l sequence is equal to the previous element of c, If it is not equal, it will be discarded, and if it is equal, it will be recorded in \(p_{l}\). 3: Reverse mapping \(p_{l}\) to the f sequence via l2f produces a new position array \(p_{f}\), and updates c to its previous character. 4: Execute step (2), if the number of elements of \(p_{l}\) is 0, it means that there is no strict match, and the calculation is terminated. 5: When the pattern sequence traversal is completed, the final sequence \(p_{f}\) is obtained. 6: Map \(p_{f}\) to the position array match where the pattern sequence appears in the original pattern sequence through the suffix array \(SA\). ```  
**Algorithm 2** FM index matching algorithm  
For the original pattern sequence \(Trav=ACCGATG\), the query sequence pattern = GA. The matching process is shown in Figure 4.  
After obtaining the position match of the query sequence pattern in the original pattern sequence _Trav_, the matching score with the fingerprint sequence will be calculated by Equation (4), and the fingerprint sequence with the highest matching score will be determined as the final recognition result. \[sc=\sum_{1}^{n}(\sum_{1}^{m}\sum_{i}^{j}len_{pattern}/len_{Trav}*totallen_{ pattern})/totallen_{Trav} \tag{4}\]  
\(totalLen_{Trav}\) represents the total length of the fingerprint sequence. \(len_{pattern}\) indicated the number of consecutive repetitions of each matching pattern in the query subsequence. \(len_{Trav}\) indicates the number of repetitions of the matching pattern in the fingerprint sequence. \(totalLen_{pattern}\) indicates the length of each subsequence of the query sequence. Finally, the evaluation scores of all subsequences are accumulated to caluculate the evaluation score of the query sequence. Match the query sequence with the fingerprints in the fingerprint database one by one, and the device with the highest matching score is the final identification result. However, relying only on exact matching is not ideal in many cases, because there is a lot of noise in the industrial control system, filled with a large number of redundant data packets with an indeterminate number, and the content or type of data packets in different periods are not the same. Periods are not stable. The conditions for exact matching are strict, and all fingerprint matching scores may be 0, resulting in the device not being recognized.