Ci a ion: Holaso a, E.; Fujdiak, R.;
Misu ec, J. Compa a i e Analysis o
Classi ica ion Me hods and Sui able
Da ase s o P o ocol Recogni ion in
Ope a ional Technologies. Algo i hms
2024,17, 208. h ps://doi.o g/
10.3390/a17050208
Academic Edi o s: Nuno Fachada
and Nuno Da id
Recei ed: 31 Ma ch 2024
Re ised: 8 May 2024
Accep ed: 9 May 2024
Published: 11 May 2024
Copy igh : © 2024 by he au ho s.
Licensee MDPI, Basel, Swi ze land.
This a icle is an open access a icle
dis ibu ed unde he e ms and
condi ions o he C ea i e Commons
A ibu ion (CC BY) license (h ps://
c ea i ecommons.o g/licenses/by/
4.0/).
algo i hms
A icle
Compa a i e Analysis o Classi ica ion Me hods and Sui able
Da ase s o P o ocol Recogni ion in Ope a ional Technologies
E a Holaso a * , Radek Fujdiak * and Ji i Misu ec
Depa men o Telecommunica ions, Facul y o Elec ical Enginee ing and Communica ion,
B no Uni e si y o Technology, Technicka 12, 616 00 B no, Czech Republic; [email p o ec ed]
*Co espondence: [email p o ec ed] (E.H.); [email p o ec ed] (R.F.)
Abs ac : The in e connec ion o Ope a ional Technology (OT) and In o ma ion Technology (IT)
has c ea ed new oppo uni ies o emo e managemen , da a s o age in he cloud, eal- ime da a
ans e o e long dis ances, o in eg a ion be ween di e en OT and IT ne wo ks. OT ne wo ks
equi e inc eased a en ion due o he con e gence o IT and OT, mainly due o he inc eased isk
o cybe -a acks a ge ing hese ne wo ks. This pape ocuses on he analysis o di e en me hods
and da a p ocessing o p o ocol ecogni ion and a ic classi ica ion in he con ex o OT speci ics.
The e o e, his pape summa izes he me hods used o classi y ne wo k a ic, analyzes he me hods
used o ecognize and iden i y he p o ocol used in he indus ial ne wo k, and desc ibes machine
lea ning me hods o ecognize indus ial p o ocols. The ou pu o his wo k is a compa a i e analysis
o app oaches speci ically o p o ocol ecogni ion and a ic classi ica ion in OT ne wo ks. In
addi ion, publicly a ailable da ase s a e compa ed in ela ion o hei applicabili y o indus ial
p o ocol ecogni ion. Resea ch challenges a e also iden i ied, highligh ing he lack o ele an da ase s
and de ining di ec ions o u he esea ch in he a ea o p o ocol ecogni ion and classi ica ion in
OT en i onmen s.
Keywo ds: classi ica ion me hods; da ase s; machine lea ning; ope a ional echnology; p o ocol
classi ica ion; p o ocol ecogni ion; secu i y
1. In oduc ion
Cybe secu i y is now an essen ial pa o indus ial ne wo ks. As a esul o he
in e connec ion o Ope a ional Technology (OT) and In o ma ion Technology (IT), new
possibili ies o emo e managemen , he use o cloud s o age, eal- ime da a ans e o e
long dis ances, o in eg a ion be ween di e en OT and IT ne wo ks, o example, a e
eme ging. On he o he hand, he e a e new secu i y isks o which OT ne wo ks a e
exposed [
1
]. OT ne wo ks used o be comple ely isola ed om IT ne wo ks, so he e was
no much emphasis on cybe secu i y [
2
]. Fo his eason, he e is a new emphasis on
moni o ing and analyzing OT a ic.
P o ocol ecogni ion and classi ica ion is an impo an ask in secu i y con ol and
can be conduc ed ia da a analysis [
3
]. Knowledge o he p o ocols used in he ne wo k
con ibu es o ne wo k op imiza ion and helps o unde s and how a ic is dis ibu ed and
wha da a a e p esen in he ne wo k. Based on p o ocol ecogni ion and da a classi ica ion,
a ic ou es can be op imized, he quali y o a ic and ansmi ed da a can be imp o ed,
and ne wo k managemen s a egies can be de eloped. Based on he au oma ic inspec ion
o a ic da a, edundan messages can be il e ed, and he olume o ansmi ed messages
can be educed, he eby educing he compu a ional complexi y and cos o ansmission.
In e ms o ne wo k secu i y, he use o p o ocol ecogni ion leads o ea lie and imely
de ec ion o h ea s, o example, in he case o a Man in he Middle a ack. I is also
possible o de ec and ind a i us ea ly. The e is a la ge numbe o me hods ha can
be used o achie e p o ocol iden i ica ion bo h in IT and OT ne wo ks. I is possible
Algo i hms 2024,17, 208. h ps://doi.o g/10.3390/a17050208 h ps://www.mdpi.com/jou nal/algo i hms
Algo i hms 2024,17, 208 2 o 20
o use adi ional me hods, which include classi ica ion based on po s used, o mo e
sophis ica ed app oaches using A i icial In elligence (AI). Using such app oaches, i is
possible o pe o m an in-dep h analysis o he moni o ed da a s eam (o o he da a
uni s) and classi y no only he p o ocol used bu also, o example, he ciphe sui e used.
Pe o ming classi ica ion in OT ne wo ks is cu en ly less common, bu i p o ides g ea
po en ial in e ms o secu i y bene i s o such ne wo ks. I is o his eason ha his pape
has been c ea ed, in o de o desc ibe and summa ize he di e en p o ocol classi ica ion
me hods (especially in OT ne wo ks) and also he a ailable da ase s.
This pape ocuses on he p o ocol ecogni ion aspec s o OT ne wo ks. Ad anced
me hods using AI echniques can be used o pe o m p o ocol ecogni ion wi h addi ional
ecogni ion capabili y. Con en ional echniques, such as elying on known po s, may
no be ully su icien and hus mo e ad anced echniques ha a e able o di ec ly de-
ec / ecognize he p o ocol i sel ( ained ma ks o he p o ocol) need o be employed.
Based on he analysis o he cu en s a e o he a , i is clea ha he ecogni ion o indus-
ial p o ocols is a he mino , as is he cu en s a e o publicly a ailable da ase s. Thus,
his pape poin s ou his gap ( esea ch gap), and o his eason, i pe o ms (i) a summa-
iza ion o me hods o ne wo k a ic classi ica ion, (ii) a summa iza ion o me hods o
ecogni ion and iden i ica ion o he p o ocol used in he ne wo k, (iii) he use o machine
lea ning me hods o indus ial p o ocol ecogni ion. Finally, (i ) an analysis o publicly
a ailable da ase s ha can be used o indus ial p o ocol classi ica ion was pe o med.
This a icle akes aim a he scien i ic ques ion: How can indus ial p o ocol classi ica ion
be achie ed? Wha publicly a ailable da ase s can cu en ly be used speci ically o he
pu pose o classi ying hese p o ocols? OT ne wo ks equi e inc eased a en ion due o IT
and OT con e gence, in pa icula , due o he inc eased isk o cybe -a acks ha may a ge
hese ne wo ks. Con e gence has caused, among o he hings, a p oli e a ion o a ack
ec o s, making ad anced da a moni o ing necessa y and using a so wa e-as-a-se ice
(SaaS) app oach. Indus ial p o ocol classi ica ion hus enables (i) au oma ic de ec ion o
he p o ocol used o assess secu i y, including he ciphe sui e used, (ii) diagnos ic da a,
ne wo k moni o ing (p o ocol usage wi hin di e en sec o s, e c.), (iii) au oma ion o audi
ools, and (i ) de elopmen o p o ocol adap i e solu ions—au oma ic p o ocol de ec ion
and u he ac ions ollowing his knowledge.
The s uc u e o his pape is as ollows: Sec ion 2desc ibes he speci ics o OT
ne wo ks, he e ec s o he con e gence o IT and OT ne wo ks, and, hence, he need
o use sophis ica ed me hods o enhance secu i y in he OT indus y. Sec ion 3p esen s
an analysis and compa ison o he cu en s a e o he a , ocusing mainly on he issues
o p o ocol ecogni ion and a ic classi ica ion. Fu he mo e, Sec ion 4p esen s a ious
me hods o he pu pose o a ic analysis. The sec ion p esen s app oaches o p o ocol
classi ica ion, ecogni ion and iden i ica ion, Machine Lea ning (ML) me hods, and me ics
used o e alua e models. Sec ion 5 ocuses on he a ailable da ase s usable o he pu pose
o a ic classi ica ion and he chosen p o ocol, and a compa ison o he mos ele an
da ase s in e ms o se e al pa ame e s is also p o ided.
2. Ope a ional Technology Ne wo ks Speci ics
A signi ican di e ence be ween classical IT ne wo ks and OT ne wo ks is hei pu -
pose and ela ed use. OT ne wo ks ha e he main pu pose o con olling and moni o ing
he indus ial p ocess, whe eas IT ne wo ks aim mainly a da a ansmission (by na u e
non-c i ical in compa ison wi h OT ne wo ks). Ano he dis inc ion is he elemen s and
componen s o he indi idual ne wo ks hemsel es. IT ne wo ks use end s a ions (lap ops,
desk op PCs, mobiles, able s, e c.). Ne wo k elemen s and in as uc u e p o ide da a
ans e mainly be ween end-use elemen s using da a s o ed on se e s (loca ed and con-
nec ed o he In e ne ). On he o he hand, OT ne wo ks ypically use speci ic de ices wi h
a well-de ined pu pose o p o ide/moni o a speci ic ac i i y wi hin an indus ial p ocess.
These can be single ac i e/passi e elemen s (ac ua o s and senso s), con ol PLCs, HMIs
(p o iding isualiza ion o he cu en p ocess s a us o he ope a o ), o SCADA/DCS
Algo i hms 2024,17, 208 3 o 20
componen s. Ano he di e ence is he da a ansmi ed i sel and he ypical o ien a ion o
he da a low. Wi hin IT, i is mainly he use o da a ob ained om highe laye s (In e ne )
and i s local modi ica ion/p ocessing/consump ion by he use . OT ne wo ks mainly
gene a e da a om senso s and pe o m ope a ions by ac ua o s. Thus, he da a occu -
ing in an indus ial ne wo k mainly con ains da a acqui ed om senso s ( empe a u e,
p essu e, speed—nume ical da a), and based on hese da a, ac ua o s (mo o s, pumps,
al es—bina y s a e I/O) a e ac i a ed/deac i a ed [4].
Ano he majo di e ence is he secu i y o indi idual ne wo ks. IT ne wo ks a e e ol -
ing a a e y as pace, he li e ime o equipmen wi hin IT ne wo ks is ypically
3–5 yea s
(se e s, wo ks a ions, lap ops and ne wo k componen s), and he equency o upda es
is also e y high. Sys ems and so wa e a e egula ly upda ed and upg aded o imp o e
pe o mance, secu i y, and unc ionali y. In e ms o basic equi emen s, he p io i y is
secu i y, i.e., con iden iali y o da a, ollowed by da a in eg i y, wi h a ailabili y (CIA iad)
coming in hi d. Thus, i is necessa y o ans e he da a p ima ily in a con iden ial man-
ne (enc yp ion), ensu ing hei in eg i y (p ese ing he con en wi hou modi ica ion),
ollowed by hei a ailabili y (sligh delays and ou ages a e ole a ed o p o ide mo e
c i ical se ices— he e is no secu i y isk no o deli e he message immedia ely). In
con as , OT ne wo ks a e comple ely iden ical in hese aspec s. De elopmen wi hin OT
is slow and g adual, equipmen li e imes a e ypically 10–20 yea s (i.e., decades), so he
equency o upda es is conduc ed a la ge in e als (indus ial p ocess is a ec ed—c ea ing
down ime and slowing p oduc ion e iciency). Sys ems o en equi e long- e m s abili y
and eliabili y, which means ha upda es o changes a e made less equen ly o a oid he
isk o dis up ing c i ical ope a ions [4].
In e ms o basic equi emen s, he p io i y is da a and se ice a ailabili y, ollowed by
in eg i y and hi dly con iden iali y (AIC iad). I is, he e o e, necessa y o ha e a ailable
da a om he indus ial p ocess a all imes o be able o moni o and manage he p ocess
adequa ely and in a imely manne . This is impo an because o he na u e o OT ne wo ks,
whe e c i ical pa s a e con olled and whe e he e is a isk o mal unc ion o dange o
human heal h in he e en o a p ocess dis u bance (nuclea powe plan s, he mal powe
plan s, e c.). I is also necessa y ha da a in eg i y is p ese ed, and only a e hese ea s a e
p ese ed is he sa e y conside ed. IT and OT ne wo ks di e in he na u e o he se ices
hey p o ide in e ms o hei impo ance. They di e in e ms o p io i ies and especially
in e ms o he secu i y o he da a ansmi ed. They also di e in he subjec /scope o
he da a ansmi ed. They also di e in he indi idual elemen s o he ne wo k. Ano he
di e ence is he upg ades pe o med, whe e OT is signi ican ly mo e complex han IT, as
well as he eplacemen /upg ade o equipmen (OT equi es a highe li e ime).
2.1. In o ma ion Technology and Ope a ional Technology Con e gence
IT and OT con e gence ep esen he cu en end o in e connec ion o indi idual
componen s, especially hei a ailabili y ia he In e ne . This con e gence in ol es he
in eg a ion o exis ing OT ne wo ks and s uc u es wi hin he IT ne wo k. This con e gence
acili a es he use o he cu en end o so wa e as a se ice, especially o he p ocessing
and e alua ion o a ailable da a, whe e his was o en no possible be o e, and da a could
no lea e he closed and isola ed ne wo k. I is equally possible o emo ely access and
manage hese da a. While his b ings a numbe o bene i s, i also in ol es challenges
ha need o be add essed, pa icula ly om he secu i y pe spec i e. The p oblem is he
long- e m enclosu e o OT in as uc u es, which has ensu ed secu i y in e ms o physical
secu i y. In o de o access he asse s, i was necessa y o o e come physical secu i y,
and only hen could he asse s be accessed. I is con e gence, howe e , ha signi ican ly
al e s his app oach. The e is no need o o e come physical secu i y, and i is possible
o access asse s om a SW pe spec i e wi hou b eaching he secu i y pe ime e ( om a
physical pe spec i e).
Con e gence inc eases he isk o a secu i y inciden compa ed o a closed app oach [
2
].
Due o he long- e m closed na u e and eliance on physical secu i y alone, secu i y mecha-
Algo i hms 2024,17, 208 4 o 20
nisms and p o ocols a e no a he same le el as in IT ne wo ks. OT ne wo ks use indus ial
p o ocols o he ansmission o indi idual da a, which a e speci ic p o ocols ailo ed o
he ansmission o senso da a and indi idual commands. Howe e , hese p o ocols o en
do no suppo con iden iali y and in eg i y, and hus, a ious ex ensions and addi ional
mechanisms ha e o be used. Thus, om a so wa e pe spec i e, OT ne wo ks ep esen ed
insecu i y by design. The challenges in ol ed a e o ensu e he secu i y o he unsecu ed
p o ocol in such a way ha he p io i ies o he equi emen s (a ailabili y i s ) a e no
a ec ed. Thus, i is no possible o use cu en mechanisms om IT ne wo ks and apply
hem di ec ly o he OT ne wo k en i onmen wi hou modi ica ion. Simila ly, a secu e
sepa a ion o he IT and OT ne wo k mus be implemen ed in such a way ha he OT
ne wo k is maximally sepa a ed om he es o he ne wo k. This equi es he use o
i ewalls, DMZ, IDS, and IPS mechanisms in conjunc ion wi h AI-enabled applica ions.
The impac s o he con e gence o IT and OT ne wo ks include a signi ican p oli e a-
ion o a ack ec o s. Con e gence has made hese ne wo ks “accessible” o he a acke ,
and physical secu i y is no longe he main secu i y measu e. Thus, i is now ( om a
cybe -secu i y pe spec i e) a basic block ha is as necessa y as i used o be bu no longe
ep esen s he main a ack ec o . A acke s can exploi he e y in e ace ha makes he
connec ion be ween IT and OT ne wo ks. In pa icula , his may include in e nal se ices
o managing and moni o ing indus ial p ocesses [
5
]. In conjunc ion wi h hese sys ems
and de ices, in gene al, wi hin OT ne wo ks he e a e passph ases and inbuil secu i y
measu es. Insu icien quali y/complexi y o passph ases and excessi e sys em measu es
also deg ade cybe -secu i y. The human ac o is also a isk, especially in e ms o social
enginee ing o phishing a acks. Acco ding o [
5
], he i s place in he a ack ec o is he
comp omise o IT sys ems, ollowed by he use o enginee ing wo ks a ions, and he hi d
place is ex e nal emo e se ices.
P o ocol classi ica ion will help, especially wi h p o ocol secu i y checks in he o m o
in e nal audi s, e c. Knowledge o he p o ocols will also help wi h diagnos ic da a and
ob aining an o e iew o he a ic occu ing wi hin he moni o ed OT ne wo ks. Finally,
he de elopmen o a good indus ial p o ocol classi ica ion me hod will help wi h he
de elopmen o new de ices. I is he au oma ic p o ocol ecogni ion ha will enable he
c ea ion o de ices ha au oma ically ecognize he p o ocol in he ne wo k and can use
his knowledge o, o example, au oma ically inspec and se i ewall ules. In o de o bes
secu e he OT ne wo k, hese app oaches need o be combined. I is necessa y o use ools
o de ec ing secu i y inciden s, classi ying he p o ocols used, as well as educa ing he
human ac o . The eme gence o au oma ed ools would enable e ec i e con ol (audi ing)
and also he supe ision o c i ical ne wo k elemen s. Indus ial p o ocol classi ica ion can
be used a indi idual indus ial acili ies ( ac o ies, plan s, e c.), bu also wi hin a ious
SaaS se ice p o ide s, which can moni o and classi y a ic wi hin he ne wo k. Las bu
no leas , his me hod can be used o pe o m non-in asi e secu i y checks o indus ial
p o ocols wi hou he need o access he da a hemsel es di ec ly. I is hus possible o use
he enc yp ed o m o he messages and o pe o m p o ocol classi ica ion on his basis,
including i s ciphe sui e.
The ea ly de ec ion o secu i y inciden s helps o ac i a e adequa e coun e measu es.
Using he knowledge o he ype o anomaly, i is possible o ac i a e app op ia e coun e -
measu es so ha he impac on he indus ial p ocess i sel is minimized. This is ela ed
o he c i ical na u e o he indus ial p ocesses hemsel es, whe e sys em shu down can
mean po en ial damage. I is hus ad isable o pe o m a imely, sa e sys em shu down.
Howe e , he aim is o p e en such sa e y inciden s. To do jus ha , i is ad isable o use
indus ial p o ocol classi ica ion in he o m o a secu i y audi and implemen app op ia e
coun e measu es o minimize he likelihood o a secu i y h ea .
2.2. Ope a ional Technology Hie a chy Model
The indi idual physical ope a ions and ela ed con ol and moni o ing componen s
a e so ed acco ding o IEC 62443 [
6
] (also known as he Pu due model) in o indi idual
Algo i hms 2024,17, 208 5 o 20
laye s (six in o al). This di ision is made acco ding o he pu pose o each laye so ha
indi idual ope a ions can be scaled and sa e y le els de ined wi hin he manu ac u ing
p ocess. Communica ion wi hin he model is e ical be ween he laye s o achie e e ec i e
con ol and moni o ing o he p ocess. The laye s close o he p oduc i sel (p ocessed
h ough he L0 laye ) o m he co e and basic building blocks o OT ne wo ks. As he
laye s g ow, hey gain abs ac ion and g adually mo e in o he IT ne wo k. The indi idual
laye s con ain di e en ly sensi i e in o ma ion, and he e o e, i is necessa y o main ain an
adequa e us le el (p e e ably ze o- us ) [
7
]. A g aphical isualiza ion o such a model
is shown in Figu e 1, which shows he Pu due model as well as he basic blocks om he
RAMI 4.0 model ( igh side). Le el 0 (Field le el) con ains componen s di ec ly dedica ed
o con ol, he ac ual execu ion o an ac i i y using senso s (ge ing alues) and ac ua o s
(execu ing ac i i ies).
Da a sen o/ om L0 is conduc ed om he L1 laye (Con ol le el). This laye con ains
he indi idual P og ammable Logic Con olle (PLC), Dis ibu ed Con ol Sys em (DCS),
and PID de ices. These a e he componen s ha acqui e da a om senso s and ac ua o s
(simpli ied as he i s logic uni ha e alua es he acqui ed da a and can con e hem in o
digi al o m). These uni s di ec ly con ol he p ocess h ough he connec ed ac ua o s. The
decision o in e ene in he p ocess can be ini ia ed di ec ly om L1 o by de ices om L2
(Supe iso y le el) [4].
Wi hin L2 he e a e pa en PLCs ha collec da a om he sla e PLCs and make p ocess
modi ica ions based on he de ined ope a ions/schemes and se ings. This laye (L2) also
houses wo ks a ions (ope a o /a endan wo ks a ions) and he local Human Machine
In e ace (HMI), which is used o display he cu en s a us o he ope a o . The p ocess can
hus be con olled ia he HMI, wo ks a ions, o s a us e alua ion by he supe iso PLC
om L2, hen he da a a e passed o he PLCs on he L1 le el, and hey igge he equi ed
ac ions on L0.
The ou h laye (L3—Planning le el) se es mainly as a suppo laye o he whole
sys em. Global HMI and o he se e se ices can be loca ed wi hin his laye . This may
include Dynamic Hos Con igu a ion P o ocol (DHCP), Domain Name Sys em (DNS),
Ligh weigh Di ec o y Access P o ocol (LDAP), and Ne wo k Time P o ocol (NTP) se e s.
In addi ion, his o ian se e s a e o en loca ed a his le el o p o ide speci ic se ices
such as s o ing his o ical da a (desc ibing he beha io and s a e o he p ocess o e ime),
analyzing s o ed alues, and a chi ing e en s/p ocess s a es o e ime. This laye also
con ains Supe iso y Con ol and Da a Acquisi ion (SCADA) o DSC.
Bo h sys ems a e used o da a acquisi ion om he OT ne wo k and p ocess con ol.
The main objec i e o SCADA is da a acquisi ion; ne wo ks consis o mul iple Remo e
Te minal Uni s (RTUs) ha a e used o collec da a back o he cen al con ol sys em whe e
hey can be used o make highe -le el decisions (based on a global iew o he da a). DCS
is mainly used o on-si e p ocess con ol, connec ing PLCs, senso s/ac ua o s s a e, and
wo ks a ions. The main objec i e is o collec da a and con ol he p ocess om de ices
loca ed close o L0. The main di e ence be ween DCS and SCADA is, he e o e, in hei
ocus and applica ion. DCS is mo e ocused on au oma ing and con olling manu ac u -
ing p ocesses wi hin a single acili y o complex, while SCADA ocuses on moni o ing
and con olling equipmen sp ead o e la ge a eas wi h an emphasis on da a collec ion
and su eillance.
Laye L4, as well as L5 can be e e ed o as he managemen le el. L4 is used o
p o ide scheduling and p o isioning o o he local se ices (e.g., p in ing, web se e ,
o domain con olle ), so i is he Plan ope a ional le el. This laye can also con ain a
his o ian mi o and a emo e access se e . In gene al, Manu ac u ing Execu ion Sys-
ems (MES) a e so wa e solu ions ha ac i ely imp o e he quali y and e iciency o
manu ac u ing p ocesses.
The L5 laye ocuses on en e p ise applica ions and En e p ise Resou ce Planning
(ERP). Howe e , he L4 and L5 laye s a e e y in e wined.

Algo i hms 2024,17, 208 6 o 20
This model can also be supplemen ed wi h a laye ha e ically connec s all he
laye s. This concep is e e ed o as NAMUR Open A chi ec u e (NOA) [
8
]. The aim is o
enable secu e, lexible, and e icien in e connec ion o OT wi h IT wi hou comp omising
he unc ioning o c i ical p ocess con ol sys ems. This may in ol e he collec ion o da a
om addi ional senso s loca ed on he equipmen . Whe e hese de ices canno di ec ly
comp omise he p ocess i sel ( he e is no di ec connec ion be ween he senso s and he
OT in as uc u e), he e is a one-way da a low om OT o IT.
LEVEL 0LEVEL 0 LEVEL 1LEVEL 1 LEVEL 2LEVEL 2 LEVEL 4LEVEL 4 LEVEL 5LEVEL 5
LEVEL 3
Field
le el
Con ol
le el
Supe iso y
le el
Planning
le el
Managemen
le el
Con ol zone (OT)Con ol zone (OT) Co po a ion zone (IT)Co po a ion zone (IT)
ERP
En e p ise le el
En e p ise esou ce planning
MES
Plan ope a ional le el
Manu ac u ing execu ion sys ems
SCADA/HMI
P ocess con ol & moni o ,
da a acquisi ion
PLC, DCS, PID
Con ol de ices
Senso s, ac ua o s
Field le el
P oduc P oduc
WWWWWW
Figu e 1. Hie a chical s uc u e wi hin OT ne wo ks exp essed h ough he Pu due model.
Fo comple eness, i should be no ed ha he e m OT e e s o ha dwa e and so wa e
ha di ec ly moni o s and con ols physical equipmen , p ocesses and e en s in an indus-
ial en i onmen . OT includes Indus ial Con ol Sys ems (ICS), which a e speci ically
designed o con ol and au oma e indus ial p ocesses. ICS includes a a ie y o sys ems,
including SCADA o DCS. OT ne wo ks ha e di e en equi emen s compa ed o IT ne -
wo ks. This is due o he na u e o hese ne wo ks and, in pa icula , hei pu pose. In he
de elopmen o hese ne wo ks, i is necessa y o use up- o-da e app oaches such as ML
and NN echniques, bo h o he de ec ion o secu i y inciden s ( a ic classi ica ion) and
o he ecogni ion and iden i ica ion o he indus ial p o ocols used. The con e gence o
IT and OT ne wo ks is pu ing p essu e on he secu i y o hese ne wo ks, bu i is always
necessa y o conside he app op ia eness o indi idual measu es in such a way ha he
unc ionali y o he OT ne wo ks hemsel es is no comp omised. The use o ML and NN
echniques has he po en ial o enhance he secu i y o OT ne wo ks and, in pa icula , can
be used in such a way ha hey do no cause addi ional load o hese ne wo ks. I used
app op ia ely, a non-in asi e way o using he a ailable da a can be achie ed.
3. S a e o he A
P o ocol classi ica ion p o ides bene i s, especially o au oma ic p ocessing and
au oma ic moni o ing o da a on he ne wo k. The use o classi ica ion in OT b ings he
bene i s o enabling he de elopmen o p o ocol-independen app oaches, especially in
he a ea o cybe secu i y. The e o e, i enables he au oma ed managemen o da a lows,
he c ea ion and modi ica ion o de ec ion and mi iga ion ules, e c. Table 1shows an
Algo i hms 2024,17, 208 7 o 20
o e iew o he cu en app oaches o p o ocol ecogni ion and a ic classi ica ion in bo h
IT and OT indus ies. In gene al, supe ised app oaches, e.g., machine lea ning and neu al
ne wo ks, a e equi ed in classi ica ion. A common app oach is he use o con olu ional
neu al ne wo ks, whe e da a s eams, ames, o o he da a s uc u es a e isualized in o
image da a and hese a e hen iden i ied h ough con olu ional neu al ne wo ks.
In gene al, a ic classi ica ion is also mo e common han p o ocol ecogni ion. P o-
ocol classi ica ion can be mo e challenging han a ic classi ica ion ( his is e iden om
he success a es achie ed by he models). Pe o ming p o ocol classi ica ion in he OT
sec o is pa icula ly impo an in he case o enc yp ed a ic. In he case o enc yp ion, i
is no possible o use common (gene ic) p o ocol iden i ica ion me hods, such as known
po ecogni ion a he anspo laye le el, o o use mul iple pa se s o ind a ma ch. Due
o IT and OT con e gence, i is also necessa y o assume di e en masking echniques pe -
o med by he a acke , also o his eason, hese classi ica ion me hods a e e y impo an .
Simila ly, in he case o p o ocol ecogni ion in OT, i is possible o ecognize no only he
indus ial p o ocol i sel bu also o he pa ame e s, such as he ype o ciphe sui e chosen.
In o al, a compa ison o 20 di e en app oaches is made, whe e p o ocol ecogni ion
in OT ne wo ks is only add essed in a minimum o cu en li e a u e, and mos o hem
a ge IT ne wo ks. In he case o a ic classi ica ion, he a io is mo e balanced. In he case
o p o ocol ecogni ion, OT ne wo ks a e pa icula and p esen a signi ican challenge due
o hei dis inc di e ences. Simila ly, a small numbe o publicly a ailable da ase s ocus
on his issue. Finally, i o en elies only on selec ed po s a he anspo laye le el. AI
me hods a e no used in he case o p o ocol ecogni ion in OT ne wo ks, e en hough hese
me hods can ep esen a g ea cybe bene i (especially in connec ion wi h Indus y 4.0+). A
la ge numbe o wo ks ha e ocused on a ic classi ica ion in IT and OT ne wo ks. Mos o
he wo ks ocus on cybe -secu i y wi h he aim o ne wo k anomaly de ec ion/classi ica ion.
This app oach ( a ic classi ica ion) hus ep esen s he implemen a ion o a classi ica ion
o he da a ansmi ed inside a chosen a ic p o ocol.
Fo classi ica ion easons, a supe ised app oach is gene ally used, o en in combi-
na ion wi h con olu ional neu al ne wo ks (CNNs). This app oach ep esen s a me hod
in which da a blocks a e exp essed using isual ep esen a ion, i.e., he con e sion o
in o ma ion in o image da a. This may be p ocessing a he le el o da a s eams, pack-
e s, o o he da a uni s. Some pape s also ocus on he enc yp ed da a s eam (encoding
column). This a ea p esen s g ea po en ial om he cybe secu i y pe spec i e, whe e
i is possible o pe o m a ic ecogni ion wi hou ha ing o dec yp he a ic. This
can be pa icula ly bene icial when p ocessing la ge amoun s o da a, o example, a he
ne wo k adminis a o le el o o he pu pose o moni o ing whe he indus ial da a a e
lea ing speci ied sec ions. Also, mos app oaches do no ocus on eal- ime classi ica ion,
bu delay-independen classi ica ion is pe o med. I is he low delay in he classi ica ion
pe o med ha allows he use o hese me hods (p o ocol ecogni ion, a ic classi ica-
ion) in he con ol mechanisms pe o ming he classi ica ion o he ac ual ne wo k a ic.
O en, au ho s do no p o ide da ase s, so he classi ica ion o he p o ocol o ne wo k
a ic is pe o med on a da ase ha is no publicly a ailable. Thus, i is no possible
o e-e alua e he esul s, di ec ly ela e he esul s o he ob ained esul s, o compa e
di e en app oaches o classi ica ion pu poses. Cus om (own) da ase s ha a e no longe
a ailable b ing signi ican limi a ions in he de elopmen and compa ison o a ailable ools
and app oaches.
Based on he analysis o he cu en s a e o he a , he main challenges can be iden i-
ied as (i) he c ea ion o sui able and publicly a ailable da ase s ha a e o ien ed owa ds
indus ial p o ocols. These da ase s mus also con ain mul iple indus y p o ocols in o de
o alida e he disc imina i e capabili ies o each app oach. Fu he mo e, (ii) ocusing on
he po en ial in he a ea o enc yp ed a ic (p o ocols) in OT ne wo ks. (iii) Compa ing
he di e en p ocessing app oaches o he de eloped da ase and iden i ying he main
esea ch di ec ion.
Algo i hms 2024,17, 208 8 o 20
Table 1. Compa ison o ele an li e a u e in p o ocol ecogni ion and a ic classi ica ion om he pe spec i e o IT and OT in as uc u es.
Me hods Type Yea Technique Model ML Type P o ocols Encoding Real-Time Epochs Laye s Accu acy [%] Da ase s Re .
P o ocol
ecogni ion
OT 2021 CNN AM-ADCNN + LSTM Supe ised 4 No No 20 - 93.0 Own [9]
2023 DNN PREIUD Unsupe ised 1 No No - - - Own [10]
IT
2011 Ne wo k Packe
Inspec ion
De e minis ic Fini e-s a e
Au oma on - 9 No No - - - Own [11]
2012 Finge p in ing - - 4 No Yes - - 95.0 Own [12]
2017 CNN + RNN CNN + RNN-2a Supe ised 15 No No 60–90 9 99.6 RedIRIS [13] [14]
2020 CNN P CNN Supe ised 4 No Yes 20 8 96–100 DARPA [15] [16]
2020 CNN - Bo h 3 No No - - 75.8–89.8 Own [17]
2021 Pa e n ma ching
algo i hm - Supe ised 4 No No - - 93.8–100 DARPA [15] [18]
2021 CNN ICLSTM Supe ised 12 Yes No - - 97.5 ISCX 2016 [19] [20]
2023 CNN - Supe ised 8 Yes No - - 98.2 ISCX VPN-nonVPN [19] [21]
T a ic
classi ica ion
OT
2019 ML DT, KNN, SVM, NB Supe ised 1 Yes No - - 95.0 Own [22]
2019 T a ic
Finge p in ing CART - - No No - - 94.8
SWaT [23],
SCADA Ne wo k Da a Se s
o In usion De ec ion Resea ch [24]
[25]
2020 ML KNN, SVM, DT, NBG, BKNN,
BT, RF, AdaBoos , GB Bo h 1 No No - - 99.7 Own [26]
2022 DNN - Supe ised 1 Yes No 100 10 94.5 Own [27]
2022 ML DT Supe ised 2 No No - - 99.9 Own [28]
2022 RNN - Supe ised 1 No No - - 97.5 Own [29]
IT
2009 ML C4.5, AdaBoos , NB,
SVM, RIPPER Supe ised 8 Yes No - - 98.4
DARPA [15],
AMP [30],
MAWI [31]
[32]
2017 CNN 1D-CNN Supe ised 12 Yes No 40 7 99.5 ISCX VPN-nonVPN [19] [33]
2018 CNN CNN-LSTM Supe ised 9 Yes No 30 8 91.0 ISCX VPN-nonVPN [19] [34]
2021 Fuzzy In e ence Sys em Fuzy In e ence Sys em - 6 Yes Yes - - 90.9 ISCXVPN2016 [33] [35]
A “-” indica es poin s ha we e no included in he publica ion.
Algo i hms 2024,17, 208 9 o 20
4. T a ic Analysis Me hods
P o ocol Classi ica ion is a e m ypically used o desc ibe he p ocess by which
ne wo k a ic is classi ied in o di e en ca ego ies o classes based on he cha ac e is ics
o he communica ion. Classi ica ion can be made based on ac o s such as po s, add esses,
packe heade s, o a ic pa e ns. Classi ica ion aims o unde s and ne wo k a ic be e
and allow di e en le els o ne wo k managemen policy o manage his a ic as needed.
P o ocol Recogni ion is a e m usually used o desc ibe he p ocess by which he cha -
ac e is ics o ne wo k communica ions a e analyzed o iden i y he p o ocols in use. This
p ocess can be au oma ed using a a ie y o echniques, including in-dep h examina ion o
ne wo k a ic and pa e n ma ching agains a da abase o known p o ocols. The goal is o
iden i y wha p o ocols a e used wi hin a gi en communica ion.
P o ocol Iden i ica ion is a e m o en used as a synonym o p o ocol ecogni ion, bu
i can also be used in a mo e speci ic sense when e e ing o he p ocess o de e mining
speci ic a ibu es o p ope ies o a p o ocol ha a e obse ed in a gi en ne wo k a ic.
P o ocol iden i ica ion can be impo an o a numbe o pu poses, including secu i y
analysis, ne wo k op imiza ion, and pe o mance uning.
4.1. T a ic Classi ica ion Technique
Se e al me hods o a ic classi ica ion exis , each handling a ic in o ma ion
di e en ly. These echniques a e po -based classi ica ion, payload-based classi ica ion,
s a is ical-based classi ica ion, beha io al-based classi ica ion, and co ela ion-based classi-
ica ion [36,37].
The po -based classi ica ion me hod is widely used o classi ying a ic using he
po s o he co esponding applica ions. The me hod is based on examining packe head-
e s and compa ing po numbe s o egis e ed applica ions. Examining only he packe
heade s p esen s a as and simple classi ica ion [
36
]. This ype o classi ica ion is especially
impo an o iden i ying ne wo k applica ions in la ge ne wo k a ic [
36
]. The alse
nega i e a e inc eases because o dynamic po numbe s and he use o non-s anda d
applica ions. Simila ly, i applica ions a e hidden behind a commonly known po , he alse
posi i e a e inc eases. In gene al, his classi ica ion me hod is as and simple, p o ided
he applica ions a e used wi h hei usual po s [37].
The payload-based classi ica ion me hod mainly uses he packe ’s da a con en o
p o ocol ecogni ion. The payload in o ma ion con ains cha ac e is ic pa e ns, messages,
o p o ocol-speci ic da a s uc u es [
36
]. Payload-based classi ica ion can be di ided in o
Deep Packe Inspec ion (DPI) and S ochas ic Packe Inspec ion (SPI) [
37
]. DPI wo ks wi h
ne wo k a ic and packe con en and achie es high accu acies in a ic classi ica ion,
making i a well-known echnique o a ic managemen , a ack p e en ion, and o e all
ne wo k secu i y analysis [
37
,
38
]. SPI is a echnique complemen a y o DPI o classi ying
enc yp ed a ic. This me hod wo ks wi h s a is ical payload in o ma ion o c ea e a
pa e n o p o ocol beha io and hen au oma ically dis inguish i om o he p o ocols.
This me hod achie es high accu acy in classi ying enc yp ed da a. Howe e , i is complex
and compu a ionally in ensi e [
38
]. The me hod ep esen s a sligh imp o emen o e
he po -based classi ica ion me hod bu does no achie e highe accu acy in high-speed
ne wo ks. The signi ican disad an age o his me hod is ne wo k p i acy. Since he
me hod uses da a inside he packe , he con iden iali y o he ansmi ed da a and ne wo k
secu i y policies a e iola ed.
The s a is ical-based classi ica ion me hod, unlike he packe -based me hod and he
payload-based me hod, does no wo k wi h in o ma ion inside he packe bu measu es
s a is ical a ic pa ame e s. Based on hese s a is ical a ic pa ame e s, i is possible o
dis inguish be ween di e en ypes o applica ions [
36
]. These pa ame e s include he
minimum packe size, he maximum packe size, he mean packe size, and he numbe o
packe s, e c. [
37
]. This me hod is also known as he a ional-based classi ica ion me hod [
36
].
The ad an age o his me hod is ha i can e icien ly ecognize enc yp ed a ic wi hou
iola ing p i acy. The disad an age is a la ge numbe o pa ame e s, which may be
Algo i hms 2024,17, 208 16 o 20
Table 3. O e iew o he mos ele an da ase s o machine lea ning and neu al ne wo k esea ch.
Link Name o Da ase Yea IT/OT Classes Fea u e Coun Fo ma Time-Se ies Labeled Classi ica ion o Cybe -sec. Sou ce P o ocol Volume Docu.
[15] DARPA 1998 IT 2 NR PCAP Yes No Anomaly Yes Real * IT - Yes
[44] KDD Cup 1999 1999 IT 5 41 CSV No Yes Anomaly Yes Simula ed - 4,000,000 Yes *
[31] MAWI/Wide/Keio 2000 IT ? NR PCAP Yes Yes * P o ocol No Real * IT - Yes *
[45] CAIDA 2008 IT ? NR PCAP Yes No P o ocol No Real IT - Yes *
[46] NSL-KDD 2009 IT 2 41 CSV No Yes Anomaly Yes Simula ed - 148,000 Yes
[47] MAWILab 2010 IT 4 NR PCAP Yes Yes Anomaly Yes Real * IT - Yes
[48] ISCX-IDS-2012 2012 IT 2 NR PCAP Yes Yes Anomaly Yes Real * IT - Yes
[49] CTU-13 2014 IT 3 NR PCAP;
BIGARUS Yes Yes Anomaly Yes Real * IT - Yes
[50] ISCX-Bo -2014 2014 IT 2 NR PCAP Yes Yes Anomaly Yes Real * IT - Yes
[51] UNSW-NB15 2015 IT 10 49 CSV No Yes Anomaly Yes Real * IT 2,500,000 Yes
[52] CTU-Mixed (cap u e 1–8) 2015 IT 2 NR PCAP;
BIGARUS Yes No Anomaly Yes Real IT - Yes
[53] USTC-TFC2016 2016 IT 20 NR PCAP Yes Yes P o ocol;
Anomaly Yes Real * IT - Yes
[54] CIC-IDS-2017 2017 IT 2 78 CSV No Yes Anomaly Yes Real * IT 692,703 Yes
[55] CAN 2017 2017 IT 4 11 TXT No Yes * OT anomaly Yes Real * CAN 4,613,909 Yes
[54] CSE-CIC-IDS2018 2018 IT 7 80 CSV No Yes Anomaly Yes Real * IT 16,233,002 Yes
[56] CIRA-CIC-DoHB w-2020 2020 IT 2 34 CSV No Yes Anomaly Yes Real * IT 371,836 Yes
[57] NSS Mi ai 2021 IT 11 12 CSV No Yes Anomaly Yes Real * IT 64,025 Yes *
[58] Elec a da ase 2010 OT 4 10 CSV No Yes OT anomaly Yes Simula ed Modbus, S7comm 1,048,575 Yes *
[23] SWAT 2015 OT 2 NR PCAP; CSV Yes Yes OT anomaly Yes Real Senzo ic da a - Yes *
[19] ISCX VPN-nonVPN 2016 IT/OT 14 NR PCAP; CSV Yes Yes P o ocol No Real * IT - Yes
[59] Ba adal 2016 OT 2 45 CSV Yes Yes * OT anomaly Yes Real * Senzo ic da a 23,788 Yes *
[24]P o iding SCADA Ne wo k Da a Se s
o In usion De ec ion Resea ch 2016 OT 2 NR PCAP; CSV Yes Yes * OT anomaly Yes Real * Modbus;
Senzo ic da a - Yes *
[60] WADI 2017 OT 2 NR PCAP; CSV Yes Yes OT anomaly Yes Real Senzo ic da a 1,221,372 Yes *
[61] BoT-IoT 2019 OT 5 46 CSV No Yes Anomaly Yes Real * IT 72,000,000 Yes
[62] DNP3 In usion De ec ion Da ase 2022 OT ? NR PCAP; CSV Yes Yes OT anomaly Yes ? DNP3 - Yes *
[63] CIC Modbus da ase 2023 2023 OT ? NR PCAP Yes No OT anomaly Yes Simula ed Modbus - Yes
[64] IEC 60870-5-104 In usion De ec ion Da ase 2023 OT ? NR PCAP; CSV Yes Yes OT anomaly Yes ? IEC 60870-5-104 - Yes *
[65] HIL-based augmen ed ICS secu i y 2023 OT 53 225 (HAIEnd) CSV No Yes OT anomaly Yes Real Senzo ic da a ? Yes *
* indica es incomple e ul ilmen o he c i e ion; NR = No Rele an ; ? = unable o ind.

Algo i hms 2024,17, 208 17 o 20
6. Discussion
The pu pose o his pape was o answe he wo main scien i ic ques ions p esen ed
in he in oduc ion. How can indus ial p o ocol classi ica ion be achie ed? Wha publicly
a ailable da ase s can cu en ly be used speci ically o classi y hese p o ocols? Classi ica-
ion, ecogni ion, and iden i ica ion o p o ocols a e closely ela ed echniques ha use he
same me hods. The mos commonly used me hods o a ic classi ica ion and p o ocol
ecogni ion ha e been p esen ed and compa ed. Each me hod has i s speci ic use and
depends on he pu pose o which i is o be used. Among he s a e-o - he-a me hods
a e machine lea ning algo i hms and especially neu al ne wo ks. These algo i hms allow
o as a ic classi ica ion and p o ocol ecogni ion and p o ide high-quali y me ics.
Howe e , hese algo i hms a e limi ed in e ms o inpu da a. An analysis o he s a e o
he a e ealed ha he majo i y o esea ch is in he IT domain. Simila ly, esea ch is no
a ge ed a enc yp ed e sions o p o ocols.
The a ailable da ase s o en do no achie e he quali ies needed o good and accu a e
classi ica ion, such as he numbe o eco ds, he di e si y o eco ds, o he numbe o logs
in he da ase . Cu en ly, he numbe o da ase s om IT en i onmen s exceeds he numbe
o da ase s. Al hough i is possible o use some IT p o ocols in OT sys ems om he poin
o iew o he con e gence o IT and OT ne wo ks, i is no ad isable o ely on his ac
alone. OT ne wo ks equi e speci ic p o ocols and equi emen s ha a e no as s ic in
IT ne wo ks. Based on he analysis o publicly a ailable da ase s, key equi emen s o
u u e esea ch we e iden i ied. Namely, he c ea ion o a ep esen a i e da ase con aining
indus ial p o ocols using eal indus ial de ices. Cu en ly, no sui able da ase has been
ound o p o ocol ecogni ion esea ch in OT. I is he c ea ion o such a da ase ha would
enable ollow-up esea ch and he compa ison o di e en me hods om he ML and
NN domains.
7. Conclusions
The issue o p o ocol ecogni ion and a ic classi ica ion is a b oad a ea wi h o e lap
om IT o OT ne wo ks. In conjunc ion wi h he con e gence o IT and OT ne wo ks, i is
necessa y o ocus on cybe -secu i y wi hin OT ne wo ks and o use cu en echniques om
IT and implemen hem in he OT domain in o de o inc ease he cu en le el o secu i y.
Simila ly, wi h he end o Indus y 4.0+, da a (no only IT bu also OT) a e lea ing isola ed
ne wo ks o p ocessing on emo e se e s o o using so wa e as a se ice. Fo his eason,
his pape has ocused on he analysis o di e en me hods and p ocessing o da a low (o
o he uni s) o he pu pose o p o ocol ecogni ion and a ic classi ica ion in connec ion
wi h OT speci ics. Fu he mo e, publicly a ailable da ase s ha e been compa ed in e ms
o hei con ibu ion, usabili y, e c. The ou pu o his wo k is hus a compa a i e analysis
o app oaches speci ically o p o ocol ecogni ion and a ic classi ica ion. The analysis
shows ha he e is cu en ly only a e y limi ed numbe o publicly a ailable da ase s ha
would allow de elopmen in he a ea o p o ocol ecogni ion and a ic classi ica ion in OT
ne wo ks. Thus, i is necessa y o build on he IT ne wo ks and he knowledge gained in
he a ea o p o ocol ecogni ion and a ic classi ica ion in IT ne wo ks and, on he basis o
a good and obus da ase , o compa e hese app oaches, o make modi ica ions and, in
pa icula , o e alua e hem in OT ne wo ks.
Au ho Con ibu ions: Concep ualiza ion, E.H., R.F. and J.M.; me hodology, E.H. and R.F.; alida ion,
E.H., R.F. and J.M.; o mal analysis, E.H. and R.F.; in es iga ion, E.H.; esou ces, E.H.; da a cu a ion,
E.H. and R.F.; w i ing—o iginal d a p epa a ion, E.H.; w i ing— e iew and edi ing, E.H., R.F. and
J.M.; isualiza ion, E.H. and R.F.; supe ision, R.F. and J.M.; p ojec adminis a ion, R.F. and J.M.;
unding acquisi ion, R.F. All au ho s ha e ead and ag eed o he published e sion o he manusc ip .
Funding: This a icle is a esul o he p ojec FW07010004, which was suppo ed by he Technology
Agency o he Czech Republic in he P og am TREND.
Da a A ailabili y S a emen : Da a a e con ained wi hin he a icle.
Algo i hms 2024,17, 208 18 o 20
Con lic s o In e es : The au ho s decla e no con lic s o in e es .
Re e ences
1.
San os, M.F.O.; Melo, W.S.; Machado, R. Cybe -Physical Risks iden i ica ion on Indus y 4.0. In P oceedings o he 2022 IEEE
In e na ional Wo kshop on Me ology o Indus y 4.0 & IoT (Me oInd4.0&IoT), T en o, I aly, 7–9 June 2022; pp. 300–305.
[C ossRe ]
2.
San os, S.; Cos a, P.; Rocha, A. IT/OT Con e gence in Indus y 4.0. In P oceedings o he 2023 18 h Ibe ian Con e ence on
In o ma ion Sys ems and Technologies (CISTI), A ei o, Po ugal, 20–23 June 2023; pp. 1–6. [C ossRe ]
3. Duan, L.; Da Xu, L. Da a Analy ics in Indus y 4.0: A Su ey. In . Sys . F on . 2021, ahead o p in . [C ossRe ]
4.
Knapp, E.D.; Langill, J.T. Chap e 8—Risk and Vulne abili y Assessmen s. In Indus ial Ne wo k Secu i y, 2nd ed.; Knapp, E.D.,
Langill, J.T., Eds.; Syng ess: Bos on, MA, USA, 2015; pp. 1–439.
5.
Pa sons, D. SANS ICS/OT Cybe secu i y Su ey: 2023’s Challenges and Tomo ow’s De enses, Sans.o g; SANS Ins i u e: Rock ille Pike,
MD, USA, 2023; pp. 1–19.
6.
ISA-99—Indus ial Au oma ion and Con ol Sys ems Secu i y; In e na ional Socie y o Au oma ion (ISA): Pi sbu gh, PA, USA, 2007.
7.
Pe duca , C.; Mazu , D.C.; Mukai, W.; Sandle , S.N.; An hony, M.J.; Mills, J.A. E olu ion and T ends o Cloud on Indus ial OT
Ne wo ks. IEEE Open J. Ind. Appl. 2023,4, 291–303. [C ossRe ]
8.
G üne , S.; T os en, A. A Cloud-Na i e So wa e A chi ec u e o NAMUR Open A chi ec u e Ve i ica ion o Reques using OPC
UA PubSub Ac ions o e MQTT. In P oceedings o he 2023 IEEE 28 h In e na ional Con e ence on Eme ging Technologies and
Fac o y Au oma ion (ETFA), Sinaia, Romania, 12–15 Sep embe 2023; pp. 1–8. [C ossRe ]
9.
Zhai, L.; Zheng, Q.; Zhang, X.; Hu, H.; Yin, W.; Zeng, Y.; Wu, T. Iden i ica ion o P i a e ICS P o ocols Based on Raw T a ic.
Symme y 2021,13, 1743. [C ossRe ]
10.
Ning, B.; Zong, X.; He, K.; Lian, L. PREIUD: An Indus ial Con ol P o ocols Re e se Enginee ing Tool Based on Unsupe ised
Lea ning and Deep Neu al Ne wo k Me hods. Symme y 2023,15, 706. [C ossRe ]
11.
Chen, C.; Wang, F.; Lin, F.; Guo, S.; Gong, B. Fas P o ocol Recogni ion by Ne wo k Packe Inspec ion. Neu al In . P ocess. 2011,
7063, 37–44. [C ossRe ]
12.
Liu, Q.; Zhang, J.; Zhao, B. T a ic Classi ica ion Using Compac P o ocol Finge p in . In P oceedings o he 2012 In e na ional
Con e ence on Indus ial Con ol and Elec onics Enginee ing, Xi’an, China, 23–25 Augus 2012; pp. 147–151. [C ossRe ]
13.
Vulne abili y Da abases. Redi is.es 2001. A ailable online: h ps://www. edi is.es/ce /links/ uldb.h ml.en (accessed on
21 Ma ch 2024).
14.
Lopez-Ma in, M.; Ca o, B.; Sanchez-Esgue illas, A.; Llo e , J. Ne wo k T a ic Classi ie Wi h Con olu ional and Recu en
Neu al Ne wo ks o In e ne o Things. IEEE Access 2017,5, 18042–18050. [C ossRe ]
15.
Lippmann, R.; Haines, J.W.; F ied, D.J.; Ko ba, J.; Das, K. Analysis and Resul s o he 1999 DARPA O -Line In usion De ec ion
E alua ion. Recen Ad . In usion De ec . 2000,1907, 162–182. [C ossRe ]
16.
Feng, W.; Hong, Z.; Wu, L.; Fu, M.; Li, Y.; Lin, P. Ne wo k p o ocol ecogni ion based on con olu ional neu al ne wo k. China
Commun. 2020,17, 125–139. [C ossRe ]
17.
Xue, J.; Chen, Y.; Li, O.; Li, F. Classi ica ion and iden i ica ion o unknown ne wo k p o ocols based on CNN and T-SNE. J. Phys.
Con . Se . 2020,1617, 012071. [C ossRe ]
18. Shi, J.; Yu, X.; Liu, Z.; Niu, B. Nowhe e o Hide. Secu . Commun. Ne w. 2021,2021, 6672911. [C ossRe ]
19.
D ape -Gil, G.; Lashka i, A.H.; Mamun, M.S.I.; Gho bani, A.A. Cha ac e iza ion o Enc yp ed and VPN T a ic using Time-
ela ed Fea u es. In P oceedings o he 2nd In e na ional Con e ence on In o ma ion Sys ems Secu i y and P i acy, Rome, I aly,
19–21 Feb ua y 2016; pp. 407–414. [C ossRe ]
20. Lu, B.; Luk a han, N.; Ding, C.; Zhang, W. ICLSTM. Symme y 2021,13, 1080. [C ossRe ]
21.
Zhu, P.; Wang, G.; He, J.; Chang, Y.; Kong, L.; Liu, J. Enc yp ed T a ic P o ocol Iden i ica ion Based on Tempo al and Spa ial
Fea u es. In P oceedings o he 2023 4 h In e na ional Semina on A i icial In elligence, Ne wo king and In o ma ion Technology
(AINIT), Nanjing, China, 16–18 June 2023; pp. 255–262. [C ossRe ]
22.
de Toledo, T.; To isi, N. Enc yp ed DNP3 T a ic Classi ica ion Using Supe ised Machine Lea ning Algo i hms. Mach. Lea n.
Knowl. Ex . 2019,1, 384–399. [C ossRe ]
23.
Ma hu , A.P.; Tippenhaue , N.O. SWaT. In P oceedings o he 2016 In e na ional Wo kshop on Cybe -Physical Sys ems o Sma
Wa e Ne wo ks (CySWa e ), Vienna, Aus ia, 11 Ap il 2016; pp. 31–36. [C ossRe ]
24.
Lemay, A.; Fe nandez, J.M. P o iding SCADA Ne wo k Da a Se s o In usion De ec ion Resea ch. In P oceedings o he 9 h
Wo kshop on Cybe Secu i y Expe imen a ion and Tes (CSET 16), Aus in, TX, USA, 8 Augus 2016.
25.
Sheng, C.; Yao, Y.; Yang, W.; Liu, Y.; Fu, Q. How o Finge p in A ack T a ic agains Indus ial Con ol Sys em Ne wo k. In
P oceedings o he 2019 1s In e na ional Con e ence on Indus ial A i icial In elligence (IAI), Shenyang, China, 23–27 July 2019;
pp. 1–6. [C ossRe ]
26.
Lan, H.; Zhu, X.; Sun, J.; Li, S. T a ic Da a Classi ica ion o De ec Man-in- he-Middle A acks in Indus ial Con ol Sys em. In
P oceedings o he 2019 6 h In e na ional Con e ence on Dependable Sys ems and Thei Applica ions (DSA), Ha bin, China,
23–27 July 2020; pp. 430–434. [C ossRe ]
Algo i hms 2024,17, 208 19 o 20
27.
Holaso a, E.; Fujdiak, R. Deep Neu al Ne wo ks o Indus ial P o ocol Recogni ion and Ciphe Sui e Used. In P oceedings o
he 2022 IEEE In e na ional Ca nahan Con e ence on Secu i y Technology (ICCST), Valec, Czech Republic, 7–9 Sep embe 2022;
pp. 1–7. [C ossRe ]
28.
Yu, C.; Zhang, Z.; Gao, M. An ICS T a ic Classi ica ion Based on Indus ial Con ol P o ocol Keywo d Fea u e Ex ac ion
Algo i hm. Appl. Sci. 2022,12, 11193. [C ossRe ]
29.
Wang, W.; Zhang, B.; Yu, Z.; Gao, X. Anomaly De ec ion Me hod o Unknown P o ocol in Powe Indus ial Con ol Sys em Based
on RNN. In P oceedings o he 2022 5 h In e na ional Con e ence on Renewable Ene gy and Powe Enginee ing (REPE), Beijing,
China, 28–30 Sep embe 2022; pp. 68–72. [C ossRe ]
30.
Zhang, F.; Wei, K.; Slowikowski, K.; Fonseka, C.Y.; Rao, D.A.; Kelly, S.; Goodman, S.M.; Tabechian, D.; Hughes, L.B.;
Salomon-Esco o, K.; e al.
De ining in lamma o y cell s a es in heuma oid a h i is join syno ial issues by in eg a ing single-cell
ansc ip omics and mass cy ome y. Na . Immunol. 2019,20, 928–942. [C ossRe ] [PubMed]
31.
Cho, K. MAWI Wo king G oup T a ic A chi e. A ailable online: h p://mawi.wide.ad.jp/mawi/ (accessed on 20 Ma ch 2024).
32.
Alshamma i, R.; Zinci -Heywood, A.N. Machine lea ning based enc yp ed a ic classi ica ion. In P oceedings o he 2009 IEEE
Symposium on Compu a ional In elligence o Secu i y and De ense Applica ions, O awa, ON, Canada, 8–10 July 2009; pp. 1–8.
[C ossRe ]
33.
Wang, W.; Zhu, M.; Wang, J.; Zeng, X.; Yang, Z. End- o-end enc yp ed a ic classi ica ion wi h one-dimensional con olu ion
neu al ne wo ks. In P oceedings o he 2017 IEEE In e na ional Con e ence on In elligence and Secu i y In o ma ics (ISI), Beijing,
China, 22–24 July 2017; pp. 43–48. [C ossRe ]
34.
Zou, Z.; Ge, J.; Zheng, H.; Wu, Y.; Han, C.; Yao, Z. Enc yp ed T a ic Classi ica ion wi h a Con olu ional Long Sho -Te m
Memo y Neu al Ne wo k. In P oceedings o he 2018 IEEE 20 h In e na ional Con e ence on High Pe o mance Compu ing and
Communica ions; IEEE 16 h In e na ional Con e ence on Sma Ci y; IEEE 4 h In e na ional Con e ence on Da a Science and
Sys ems (HPCC/Sma Ci y/DSS), Exe e , UK, 28–30 June 2018; pp. 329–334. [C ossRe ]
35.
Kim, S.W.; Kim, K.C. T a ic Type Recogni ion Me hod o Unknown P o ocol—Applying Fuzzy In e ence. Elec onics 2021,10, 36.
[C ossRe ]
36.
Sheikh, M.S.; Peng, Y. P ocedu es, C i e ia, and Machine Lea ning Techniques o Ne wo k T a ic Classi ica ion: A Su ey. IEEE
Access 2022,10, 61135–61158. [C ossRe ]
37. Zhao, J.; Jing, X.; Yan, Z.; Ped ycz, W. Ne wo k a ic classi ica ion o da a usion. In . Fusion 2021,72, 22–47. [C ossRe ]
38.
Xu, C.; Chen, S.; Su, J.; Yiu, S.M.; Hui, L.C.K. A Su ey on Regula Exp ession Ma ching o Deep Packe Inspec ion: Applica ions,
Algo i hms, and Ha dwa e Pla o ms. IEEE Commun. Su . Tu o . 2016,18, 2991–3029. [C ossRe ]
39.
Zhao, H.; Li, Z.; Wei, H.; Shi, J.; Huang, Y. SeqFuzze : An Indus ial P o ocol Fuzzing F amewo k om a Deep Lea ning
Pe spec i e. In P oceedings o he 2019 12 h IEEE Con e ence on So wa e Tes ing, Valida ion and Ve i ica ion (ICST), Xi’an,
China, 22–27 Ap il 2019; pp. 59–67. [C ossRe ]
40. Elhanashi, A.; Dini, P.; Sapona a, S.; Zheng, Q. In eg a ion o Deep Lea ning in o he IoT. Elec onics 2023,12, 4952. [C ossRe ]
41.
K upski, J.; G aniszewski, W.; Iwanowski, M. Da a T ans o ma ion Schemes o CNN-Based Ne wo k T a ic Analysis: A Su ey.
Elec onics 2021,10, 2042. [C ossRe ]
42.
Yan, J. A Su ey o T a ic Classi ica ion Valida ion and G ound T u h Collec ion. In P oceedings o he 2018 8 h In e na ional
Con e ence on Elec onics In o ma ion and Eme gency Communica ion (ICEIEC), Beijing, China, 15–17 June 2018; pp. 255–259.
[C ossRe ]
43.
Jou dan, N.; Longa d, L.; Biegel, T.; Me e nich, J. Machine Lea ning o In elligen Main enance and Quali y Con ol: A Re iew
o Exis ing Da ase s and Co esponding Use Cases. In P oceedings o he Con e ence on P oduc ion Sys ems and Logis ics: CPSL
2021, Hanno e , Ge many, 25–28 May 2021; Volume 2. [C ossRe ]
44.
Sal a o e, S.; Wei, F.; Wenke, L.; And eas, P.; Philip, C. KDD Cup 1999 Da a; UCI Machine Lea ning Reposi o y: I ine, CA, USA
1999. [C ossRe ]
45. UCSD C. The CAIDA Anonymized In e ne T aces Da ase (Ap il 2008–Janua y 2019); CAIDA: La Jolla, CA, USA, 2018.
46.
Ta allaee, M.; Baghe i, E.; Lu, W.; Gho bani, A.A. A de ailed analysis o he KDD CUP 99 da a se . In P oceedings o he 2009
IEEE Symposium on Compu a ional In elligence o Secu i y and De ense Applica ions, O awa, ON, Canada, 8–10 July 2009;
pp. 1–6. [C ossRe ]
47.
Fon ugne, R.; Bo gna , P.; Ab y, P.; Fukuda, K. MAWILab. In P oceedings o he 6 h In e na ional COn e ence, New Yo k, NY,
USA, 26–28 Augus 2010; pp. 1–12. [C ossRe ]
48.
Shi a i, A.; Shi a i, H.; Ta allaee, M.; Gho bani, A.A. Towa d de eloping a sys ema ic app oach o gene a e benchma k da ase s
o in usion de ec ion. Compu . Secu . 2012,31, 357–374. [C ossRe ]
49.
Ga cía, S.; G ill, M.; S ibo ek, J.; Zunino, A. An empi ical compa ison o bo ne de ec ion me hods. Compu . Secu . J. 2014,
45, 100–123. [C ossRe ]
50.
Beigi, E.B.; Jazi, H.H.; S akhano a, N.; Gho bani, A.A. Towa ds e ec i e ea u e selec ion in machine lea ning-based bo ne
de ec ion app oaches. In P oceedings o he 2014 IEEE Con e ence on Communica ions and Ne wo k Secu i y, San F ancisco,
CA, USA, 29–31 Oc obe 2014; pp. 247–255. [C ossRe ]
51.
Mous a a, N.; Slay, J. UNSW-NB15. In P oceedings o he 2015 Mili a y Communica ions and In o ma ion Sys ems Con e ence
(MilCIS), Canbe a, ACT, Aus alia, 10–12 No embe 2015; pp. 1–6. [C ossRe ]
52. Ga cia, S. Malwa e Cap u e Facili y P ojec , 2018. A ailable online: h ps://s a osphe eips.o g (accessed on 20 Ma ch 2024).
Algo i hms 2024,17, 208 20 o 20
53.
Wang, W.; Zhu, M.; Zeng, X.; Ye, X.; Sheng, Y. Malwa e a ic classi ica ion using con olu ional neu al ne wo k o ep esen a ion
lea ning. In P oceedings o he 2017 In e na ional Con e ence on In o ma ion Ne wo king (ICOIN), Da Nang, Vie nam,
11–13 Janua y 2017; pp. 712–717. [C ossRe ]
54.
Sha a aldin, I.; Lashka i, A.H.; Gho bani, A.A. Towa d Gene a ing a New In usion De ec ion Da ase and In usion T a ic
Cha ac e iza ion. In P oceedings o he 4 h In e na ional Con e ence on In o ma ion Sys ems Secu i y and P i acy, Funchal,
Po ugal, 22–24 Janua y 2018; pp. 108–116. [C ossRe ]
55.
Lee, H.; Jeong, S.H.; Kim, H.K. OTIDS. In P oceedings o he 2017 15 h Annual Con e ence on P i acy, Secu i y and T us (PST),
Calga y, AB, Canada, 28–30 Augus 2017; pp. 57–5709. [C ossRe ]
56.
Mon aze iSha oo i, M.; Da idson, L.; Kau , G.; Lashka i, A.H. De ec ion o DoH Tunnels using Time-se ies Classi ica ion o
Enc yp ed T a ic. In P oceedings o he 2020 IEEE In e na ional Con e ence on Dependable, Au onomic and Secu e Compu ing,
In e na ional Con e ence on Pe asi e In elligence and Compu ing, In e na ional Con e ence on Cloud and Big Da a Compu ing,
In e na ional Con e ence on Cybe Science and Technology Cong ess (DASC/PiCom/CBDCom/Cybe SciTech), Calga y, AB,
Canada, 17–22 Augus 2020; pp. 63–70. [C ossRe ]
57.
Kalupahana Liyanage, K.S.; Di aka an, D.M.; Singh, R.P.; Gu usamy, M. NSS Mi ai Da ase . A ailable online: h ps://ieee-
da apo .o g/documen s/nss-mi ai-da ase (accessed on 20 Ma ch 2024).
58.
Elec a Da ase : Anomaly De ec ion ICS Da ase . A ailable online: h p://pe cep ion.in .um.es/ICS-da ase s/ (accessed on
20 Ma ch 2024).
59.
Tao mina, R.; Galelli, S.; Tippenhaue , N.O.; Salomons, E.; Os eld, A.; Eliades, D.G.; Aghashahi, M.; Sunda a ajan, R.; Pou ahmadi,
M.; Banks, M.K.; e al. Ba le o he A ack De ec ion Algo i hms. J. Wa e Resou . Plan. Manag. 2018,144, 1–11 . [C ossRe ]
60.
Ahmed, C.M.; Palle i, V.R.; Ma hu , A.P. WADI. In P oceedings o he 3 d In e na ional Wo kshop on Cybe -Physical Sys ems o
Sma Wa e Ne wo ks, Pi sbu gh, PA, USA, 21 Ap il 2017; pp. 25–28. [C ossRe ]
61.
Ko onio is, N.; Mous a a, N.; Si niko a, E.; Tu nbull, B.P. Towa ds he De elopmen o Realis ic Bo ne Da ase in he In e ne o
Things o Ne wo k Fo ensic Analy ics: Bo -IoT Da ase . a Xi 2018, a Xi :1811.00701.
62.
Radoglou-G amma ikis, P.; Kelli, V.; Lagkas, T.; A gy iou, V.; Sa igiannidis, P. DNP3 In usion De ec ion Da ase . 2022. A ailable
online: h ps://ieee-da apo .o g/documen s/dnp3-in usion-de ec ion-da ase (accessed on 20 Ma ch 2024).
63.
Boakye-Boa eng, K.; Gho bani, A.A.; Lashka i, A.H. Secu ing Subs a ions wi h T us , Risk Pos u e, and Mul i-Agen Sys ems.
In P oceedings o he 2023 20 h Annual In e na ional Con e ence on P i acy, Secu i y and T us (PST), Copenhagen, Denma k,
21–23 Augus 2023; pp. 1–12. [C ossRe ]
64.
Radoglou-G amma ikis, P.; Rompolos, K.; Lagkas, T.; A gy iou, V.; Sa igiannidis, P. IEC 60870-5-104 In usion De ec ion
Da ase . 2022. A ailable online: h ps://ieee-da apo .o g/documen s/iec-60870-5-104-in usion-de ec ion-da ase (accessed on
20 Ma ch 2024).
65.
Shin, H.K.; Lee, W.; Yun, J.H.; Kim, H. HAI 1.0: HIL-based Augmen ed ICS Secu i y Da ase . In P oceedings o he 13 h USENIX
Wo kshop on Cybe Secu i y Expe imen a ion and Tes (CSET 20), Online, 10 Augus 2020; USENIX Associa ion: Be keley, CA,
USA, 2020.
Disclaime /Publishe ’s No e: The s a emen s, opinions and da a con ained in all publica ions a e solely hose o he indi idual
au ho (s) and con ibu o (s) and no o MDPI and/o he edi o (s). MDPI and/o he edi o (s) disclaim esponsibili y o any inju y o
people o p ope y esul ing om any ideas, me hods, ins uc ions o p oduc s e e ed o in he con en .