Industrial control flow acquisition and protocol analysis method

Abstract

The invention discloses an industrial control flow acquisition and protocol analysis method. The method comprises the following steps: acquiring data based on a mirror image port of an industrial control network switch; preprocessing the acquired data, wherein the preprocessing comprises restoring a network session of a transmission layer, identifying an application protocol and extracting structured metadata; respectively carrying out classified storage on the network session passing through the reduction transmission layer, identifying an application protocol and extracting various types ofdata subjected to structured metadata processing; and according to a set rule, monitoring and analyzing the classified and stored data, and finding out abnormal data. According to the invention, flowdata is accessed in a mirror image mode, so that risk hidden troubles during deployment of series equipment are avoided. Meanwhile, a five-layer processing architecture of acquisition, preprocessing,analysis, storage and return is established, the effect of each architecture level is clear, a clear guiding effect is achieved for acquisition and analysis of industrial control flow, and role overlapping of each layer is avoided.

Description

technical field [0001] The invention belongs to the technical field of computer systems, and in particular relates to a method for collecting and analyzing industrial control traffic. Background technique [0002] In recent years, as the industry has vigorously advocated the integration of the two (informatization and industrialization), the core business system represented by the MES system has connected the office network and the industrial control production network due to its own management and data interaction requirements. The tradition exists in The industrial control network and information system of the production workshop and elevated warehouse are no longer closed and isolated. The industrial control network has gradually integrated into the cigarette factory’s internal office network and even physically connected to the external WAN network, becoming an important part of the cigarette factory’s corporate network. [0003] Subsequently, information security manage...

AI Technical Summary

Problems solved by technology

[0003] Subsequently, information security management has gradually exposed some problems, mainly in the following aspects: First, with the deepening of the integration of "two modernizations", the production network (wired and wireless), office network (wired and wireless) ) and the Internet have realized interconnection, and the industrial control network and system have directly faced the security threats brought by the Internet; second, the core business system of the industrial control network is mainly concentrated in the industrial control network layer (involving silk making, coiling, warehouse management and other systems) , has the characteristics of high informatization and multi-system interaction, and system operations cannot be replaced manually. Once a security incident occurs, the impact on production is obvious; third, the current industrial control network layer lacks unified and effective technical protection measures for industrial production networks. The level of security defense needs to be improved urgently. It belongs to the blind area and short board of network information security protection. Once an industrial control network security incident occurs, it may affect the safe and stable operation of the industrial control network and information system of the entire factory production workshop.

Images