Method for real-time industrial control passive identification of Rokwell equipment

Abstract

The invention discloses a method for real-time industrial control passive identification of Rokwell equipment, and relates to the technical field of asset equipment identification, and the method comprises the following steps: presetting a Rokwell fingerprint database; preliminarily analyzing the message; backing up equipment basic information; deeply analyzing the message; continuously identifying engineer stations; and comparing a fingerprint database to obtain equipment information. According to the real-time industrial control method for passively identifying the Rockwell equipment, a fingerprint database is unique characteristics of the Rockwell industrial control equipment, such as brands, series, matching word strings and separators, and besides identifying an operating system, manufacturers and port services, the model, sequence codes and PLC version information of the equipment can also be identified; and through passive identification, an application layer message of a Rokwell communication protocol is analyzed, and the message is analyzed according to different function codes so as to obtain correct equipment information.

Description

technical field [0001] The invention relates to the technical field of asset equipment identification, in particular to a method for real-time industrial control passive identification of Rockwell equipment. Background technique [0002] Industrial control equipment identification is divided into active identification and passive identification. Active identification has the following problems. First, active identification requires active detection to obtain device information, but if the assembly of the detection package is not known, the device cannot be identified; second, active identification requires Access to the main network will affect the communication of the main network when sending detection packets, and may cause attacks on the main network, and if some main networks are equipped with firewalls for security, active identification cannot be performed; third, active identification cannot Knowing the operating equipment and the equipment being operated, only detec...

AI Technical Summary

Problems solved by technology

[0002] Industrial control equipment identification is divided into active identification and passive identification. Active identification has the following problems. First, active identification requires active detection to obtain device information, but if the assembly of the detection package is not known, the device cannot be identified; second, active identification requires Access to the main network will affect the communication of the main network when sending detection packets, and may cause attacks on the main network, and if some main networks are equipped with firewalls for security, active identification cannot be performed; third, active identification cannot Knowing the operating equipment and the equipment being operated, only detect the equipment that conforms to the active identification strategy, and the application has limitations; for example, the Chinese patent CN 106487879A is a network equipment identification method and device based on the equipment fingerprint database, and its identification method is Active identification, the identification method can only send messages for active detection, once the device is turned on the firewall will not be able to detect the device, and regular expressions cannot accurately analyze the application protocol of industrial control equipment

[0003] In addition, the current passive identification devices generally go up to the transport layer, and the identification content is only for the operating system, manufacturer, and port service, and the matching method is also corresponding to the content, mainly operating system, manufacturer, and port service matching fingerprint library Operating system information, OUI, port list, this matching method cannot accurately obtain detailed information of the device such as series, model, serial code and version cannot be accurately identified

[0004] Rockwell equipment is based on Rockwell PLC controller. Rockwell equipment has been widely used in various industries such as metallurgy, petroleum, chemical industry, building materials, machinery manufacturing, electric power, automobile and light industry. With the continuous improvement of the performance and price ratio of PCL, its application field is still expanding, but there is currently no targeted and accurate identification method for Rockwell equipment in the industrial control network

[0005] In addition, the current technology has relatively large limitations for passive asset identification. It is necessary to import the user's Rockwell equipment assets first, and manually maintain the ip address, model, type, operating system, etc. of these assets, and then By analyzing the data flow in the network, the quintuple is obtained. Only when the quintuple matches the preset device library can the device information be displayed. Otherwise, the unknown device will be displayed. In this way, the above method can be used to access the new device or change the device ip , information will not be able to update the Rockwell equipment library in real time

Images