Survey of domain specific languages to build packet parsers for industrial protocols

Abstract

The advent of the industrial automation due to the fourth industrial revolution (Industry 4.0) in industrial sectors is shifting the focus of industrial systems, such as Programmable Logic Controllers (PLC), Distributed Control Systems (DCS), etc. inside a production network towards Internet of Things (IoT). In the production network, these industrial systems communicate with each other by exchanging data packets. Due to this shift, the traditional industrial systems which were not connected to the Internet are now transformed into ‘smart factories’, where these systems are able to communicate via the Internet. However, making the industrial system online also imposes threats of being attacked by malware and viruses. Industrial automation needs security measures, such as Intrusion Detection System (IDS), to analyze the data packets in order to protect the industrial systems and production network from these threats. These data packets contain headers of industrial protocols, such as Modbus and Profinet. Present approaches such as hand-written parsers face some challenges to parse these packets. Therefore, this paper sheds some light on some of these approaches to be able to make parser development simple, fast, and easy to maintain considering especially the industrial protocols. Parsers for several protocols such as Modbus, Profinet, OPC UA, and S7comm have been developed and evaluated. Evaluation of the implementation shows that these protocols can be parsed correctly and efficiently. This output of this parser is being used as inputs of an Industrial IDS system.