# Development of Fingerprint Identification Based on Device Flow in Industrial Control System
## 2 Related Work  
With the increasing openness of industrial control systems, the attacks are increasing day by day. Once the industrial control system is successfully attacked, it will cause very serious consequences and even cause danger to life [19]. Therefore, it is very important to detect abnormalities and make timely countermeasures. The basis of anomaly detection is device identification. IP address and MAC address are considered to be the ID card of the device, but the address can be tampered with and forged, so relying on the address to identify the device is not reliable. In order to ensure the reliability of device identification, the unique features of the device are extracted and a fingerprint library is constructed. We outline closely related works that fall into three broad categories: protocol-specific fingerprinting, time-based fingerprinting, and packet feature-based fingerprinting. 1. Fingerprints based on specific protocols. Nmap [20] is one of the most well-known active fingerprinting tools, which sends a series of specific requests to identify a device. It can determine the open network ports, running services, and operating system of the device. Nmap also provides a script library based on specific industrial control protocols such as Modbus and EtherNet/IP for collecting service-specific configuration details. GrassMarlin is a passive fingerprint identification tool dedicated to industrial control networks, developed by the National Security Agency (NSA). It provides a database of 54 industrial control protocol fingerprints that identify the types and roles of devices in the network. [PERSON] et al. [21] construct device fingerprints using the difference between different manufacturers implementing the Modbus protocol. Since each device supporting the Modbus protocol has a set of vendor-specific registers and coil addresses in memory, often containing important details such as the vendor name and firmware version, they read these registers directly through the Modbus protocol to identify industrial control devices. [PERSON] [22] et al. propose a range of techniques for DNP3 critical infrastructure reconnaissance. The algorithm can discover DNP3 slaves with their DNP3 addresses and corresponding masters. [PERSON] et al. [23] analyze 17 industrial control protocols widely used in industrial control systems and adopt standardized communication to identify industrial control devices. These methods are effective, but rely on specific industrial control protocols, and they are not suitable for other devices that do not support specific protocols. 2. Time-based fingerprinting. Some work focuses on timing analysis of network traffic to identify devices and device types. Literature [6] proposes that using the TCP timestamp option in the TCP header to detect the clock deviation of a single device for single device fingerprinting. In [24], researchers use wavelet analysis to identify wireless access points based on frame arrival interval time increments, but this type of technology is not suitable for an industrial control device, as it relies on access points to route data to fingerprint readers. [PERSON] et al. [25] introduce another time-based device fingerprinting technique called \"GTID\" to identify wireless devices and their types using the distribution of packet arrival intervals. GTID takes advantage of the heterogeneity of different device hardware compositions and variations in device clock skew. [PERSON] [26] et al. propose two methods for device fingerprinting in industrial control networks. The first method identifies industrial control devices by measuring their Cross-Layer Response Time (CLRT), but it only supports industrial control protocols that use \"read\" and \"response\" messages. Another physical fingerprinting method identifies industrial control devices by analyzing differences in their operating time. It requires high-resolution operation time, but not all industrial control protocols provide this capability. [PERSON] et al.