Method and device of identifying OPC (OLE for Process Control) traffic

Abstract

The embodiment of the invention discloses a method and a device of identifying OPC traffic. According to the method, a transmitted target data packet is acquired after a server and a terminal establish a communication connection, if it is judged that the target data packet is transmitted by calling a DCOM sub-connection negotiation interface, a dynamic interface and a protocol interface of transmission of the target data packet are detected after it is detected that a sub-connection is created on the basis of the communication connection, and if the dynamic interface transmitting the target data packet is a dynamic interface of the sub-connection and the protocol interface is also a protocol interface belonging to OPC, it is determined that traffic generated by the target data packet is the OPC traffic. According to the method, the characteristics of OPC communication service are fully considered, the dynamic interface created in a communication process and the protocol interface usedin the communication process are combined for judging whether the traffic generated by the transmitted data packet belongs to OPC traffic, precise identification on the OPC traffic is realized, security hidden-troubles existing in data transmission are eliminated, and a guarantee is also provided for accurate counting of the OPC traffic.

Description

technical field [0001] Embodiments of the present invention relate to the technical field of industrial control network security, in particular to a method and device for identifying OPC traffic. Background technique [0002] With the continuous advancement of the integration of IT (Information Technology) and OT (Operation Technology), the original closed industrial control intranet is increasingly connected with the enterprise IT network. Industrial control automation and informatization have brought a lot of convenience to enterprises, but at the same time they have also brought security risks. At present, the prevention of potential safety hazards is mainly to deploy industrial security network equipment at the border of IT and industrial control networks to properly isolate network risks. [0003] OPC (OLE for Process Control, OLE for process control, is a kind of industrial standard. OPC in this application refers to OPC-Classic) protocol is based on Microsoft's DCOM ...

AI Technical Summary

Problems solved by technology

[0005] The present invention aims to solve the problem that the existing identification method for OPC traffic is only based on the DCOM service and MSRPC protocol header characteristics, and the misidentification rate is high, which makes data transmission have potential safety hazards and is not conducive to accurate statistics of traffic.

Images