A zero-copy data packet acquisition method for industrial control system network

Abstract

The invention discloses a data packet zero-copy acquiring method for an industrial control system network. By using improved and optimized zero-copy technology, the invention improves efficiency and instantaneity of data packet acquisition process by reducing the times of copying interface data and some control structures. The 'Zero-copy' technology, which bypasses the system protocol stack and reaches directly from a network card physical layer to a user application, may obtain easily in real time a network data packet at a ultra speed; meanwhile, in a manner that a data packet capturing host of the invention is located in parallel at a side of other network host, the method of the invention collects data and does not influence transfer of data packet which is originally in the network, and thus the invention achieves high-effective capturing of data.

Description

technical field [0001] The invention belongs to network security technology, in particular to a zero-copy acquisition method for data packets used in industrial control system networks. Background technique [0002] In the industrial network system, the security of the system is very important, so some application systems are needed to ensure the security and stability of the system, such as intrusion detection system, security audit system and so on. These systems need to capture, analyze and record the data packets in the network. At the same time, in order to ensure that the normal communication activities of the system are not affected, the system is usually designed as a bypass of the data link layer. [0003] In order to meet this requirement, the usual method is to capture packets through the libpcap interface library. The packet capture mechanism of libpcap is to add a bypass process at the data link layer. When a data packet arrives at the network interface and is ...

AI Technical Summary

Problems solved by technology

The network data flow of the industrial control system has strict real-time restrictions, such as the usual first and second types of data, even when the amount of data is not large, there is a fixed time limit (dead period) for most data packets, so network equipment Or the host will pre-allocate resources and reserve them for these real-time strict data. At this time, if the data packet acquisition program for network monitoring or collection is run on the hub host with strict policy presets, it is likely to affect the performance and policy traffic configuration. The efficiency of the host may even destroy the real-time performance of data packets; when the instantaneous flow of network data packets is very large, usually when the third type of data appears irregularly, the data packet rate of each node in the network may be very fast, so that even if the data packet The acquisition host is connected in parallel in the network, but it is very likely that the capture rate is lower than the network packet rate by using the traditional pcap packet capture method of multiple copies of the kernel user mode, resulting in packet loss or out-of-sequence packets, which becomes a bottleneck

Images