Industrial control data evidence obtaining method and device, electronic equipment and storage medium

Abstract

The invention relates to the technical field of industrial control security, in particular to an industrial control data evidence obtaining method and device, electronic equipment and a storage medium, industrial control flow data and engineering data of an industrial controller are obtained, and the engineering data comprise variable addresses of a plurality of engineering variables; on the basis of the variable address of each engineering variable, a corresponding target variable name is obtained by combining a preset mapping relation between each engineering variable and the variable name, and corresponding first sensitive operation information is obtained from the engineering data on the basis of each target variable name; analyzing the industrial control flow data to obtain each piece of second sensitive operation information; and generating a sensitive operation information set containing the first sensitive operation information and the second sensitive operation information, and performing corresponding processing based on the sensitive operation information set. Therefore, the engineering variables which are difficult to understand are converted into the variable names, the readability of sensitive operation information can be improved, and the efficiency and accuracy of industrial control data evidence obtaining can be improved.

Description

technical field [0001] The present application relates to the technical field of industrial control security, and in particular to an industrial control data forensics method, device, electronic equipment and storage medium. Background technique [0002] At present, with the development of industrial control technology, there are more and more accidents in industrial control systems. For example, industrial control systems and industrial control equipment have been in disrepair for a long time, and their own functions have malfunctioned, resulting in industrial control accidents; another example, targeted and concealed attacks on industrial control systems, resulting in industrial control accidents. Therefore, in order to preserve the evidence of industrial control accidents, forensics of industrial control data is required. [0003] In related technologies, when obtaining evidence for industrial control data, traditional IT forensics methods are usually used to obtain evid...

AI Technical Summary

Problems solved by technology

[0003] In related technologies, when obtaining evidence for industrial control data, traditional IT forensics methods are usually used to obtain evidence for industrial control accidents. H

Images