PREE: Heuristic builder for reverse engineering of network protocols in industrial control systems

Area of Science:

• Computer Science
• Cybersecurity
• Industrial Control Systems

Background:

• Industrial control systems (ICS) are vital for critical infrastructures, using proprietary protocols for communication.
• Reverse engineering these protocols is crucial for enhancing digital forensics and investigating ICS attacks.
• Existing methods for ICS protocol reverse engineering are often manual or limited in scope.

Purpose of the Study:

• To introduce PREE, a heuristic builder for reverse engineering ICS protocols.
• To test the hypothesis that knowledge of one ICS protocol can aid in reverse engineering others.
• To improve the efficiency and accuracy of ICS protocol analysis.

Main Methods:

• Developed PREE, a heuristic builder enabling control engineers to create field identification heuristics.
• Created seven heuristic variants using rolling window, vertical window, and frequency table techniques.
• Evaluated heuristics on six ICS protocols (Modbus TCP, UMAS, ENIP, Omron FINS, CLICK, PCCC) across five PLCs from four vendors.

Main Results:

• PREE effectively identified common fields like function code, message type, and PLC memory address across multiple protocols.
• PREE demonstrated superior accuracy, conciseness, completeness, and consistency compared to existing tools (NetPlier, Netzob, Discoverer).
• Applications in a vulnerability study on CLICK Koyo PLC and generation of SNORT rules for attack investigation were shown.

Conclusions:

• Knowledge transfer between ICS protocols is feasible for reverse engineering.
• PREE offers a novel and effective approach for ICS protocol analysis and security.
• The developed heuristics and tool enhance ICS security, vulnerability assessment, and digital forensics capabilities.