Method for real-time industrial control passive identification of Rokwell equipment

Abstract

The invention discloses a method for real-time industrial control passive identification of Rokwell equipment, and relates to the technical field of asset equipment identification, and the method comprises the following steps: presetting a Rokwell fingerprint database; preliminarily analyzing the message; backing up equipment basic information; deeply analyzing the message; continuously identifying engineer stations; and comparing a fingerprint database to obtain equipment information. According to the real-time industrial control method for passively identifying the Rockwell equipment, a fingerprint database is unique characteristics of the Rockwell industrial control equipment, such as brands, series, matching word strings and separators, and besides identifying an operating system, manufacturers and port services, the model, sequence codes and PLC version information of the equipment can also be identified; and through passive identification, an application layer message of a Rokwell communication protocol is analyzed, and the message is analyzed according to different function codes so as to obtain correct equipment information.

Description

technical field [0001] The invention relates to the technical field of asset equipment identification, in particular to a method for real-time industrial control passive identification of Rockwell equipment. Background technique [0002] Industrial control equipment identification is divided into active identification and passive identification. Active identification has the following problems. First, active identification requires active detection to obtain device information, but if the assembly of the detection package is not known, the device cannot be identified; second, active identification requires Access to the main network will affect the communication of the main network when sending detection packets, and may cause attacks on the main network, and if some main networks are equipped with firewalls for security, active identification cannot be performed; third, active identification cannot Knowing the operating equipment and the equipment being operated, only detec...

AI Technical Summary

Problems solved by technology

[0002] Industrial control equipment identification is divided into active identification and passive identification. Active identification has the following problems. First, active identification requires active detection to obtain device information, but if the assembly of the detection package is not known, the device cannot be identified; second, active identification requires Access to the main network will affect the communication of the main network when sending detection packets, and may cause attacks on the main network, and if some main networks are equipped with firewalls for security, active identification cannot be performed; third, active identification cannot Knowing the operating equipment and the equipment being operated, only detect the equipment that conforms to the active identification strategy, and the application has limitations; for example, the Chinese patent CN 106487879A is a network equipment identification method and device based on the equipment fingerprint database, and its identification method is Active identification, the identification method can only send messages for active detection, once the device is turned on the firewall will not be able to detect the device, and regular expressions cannot accurately analyze the application protocol of industrial control equipment

[0003] In addition, the current passive identification devices generally go up to the transport layer, and the identification content is only for the operating system, manufacturer, and port service, an...

Images