Asset identification method, device, equipment, storage medium and program product

Abstract

The present application discloses an asset identification method, device, equipment, storage medium and program product, which relate to the field of industrial Internet application technology. The method includes: receiving industrial scene traffic; detecting whether the industrial scene traffic is transmitted based on an industrial protocol; if so, obtaining equipment related to the industrial scene traffic; performing in-depth detection of the equipment based on native instructions of the operating technology to obtain detection results; and improving the asset information of the equipment based on the detection results. The present application can reduce industrial losses.

Description

Technical Field

[0001] The present application relates to the field of industrial Internet application technology, and in particular to an asset identification method, device, equipment, storage medium and program product. Background Art

[0002] As industrial automation gradually matures, the problem of accurately identifying and sorting assets needs to be solved urgently.

[0003] Currently, the identification of industrial assets is mainly achieved through active scanning and sending a large number of messages to identify assets.

[0004] However, active scanning that sends a large number of messages to identify assets can cause network congestion or asset downtime in industrial environments, resulting in industrial losses.

[0005] The above contents are only used to assist in understanding the technical solution of the present application and do not constitute an admission that the above contents are prior art. Summary of the invention

[0006] The main purpose of this application is to provide an asset identification method, device, equipment, storage medium and program product, aiming to solve the current technical problem that active scanning and sending of a large number of messages to identify assets can easily cause industrial losses.

[0007] To achieve the above objectives, the present application proposes an asset identification method, the method comprising:

[0008] Receive industrial scene traffic;

[0009] Detecting whether the industrial scene traffic is transmitted based on an industrial protocol;

[0010] If yes, then obtain the equipment related to the industrial scene traffic;

[0011] Performing in-depth detection on the device based on native instructions of the operating technology to obtain detection results;

[0012] The asset information of the device is improved based on the detection result.

[0013] In one embodiment, the step of detecting whether the industrial scene traffic is transmitted based on an industrial protocol includes:

[0014] The industrial scene traffic is copied to obtain mirrored traffic;

[0015] The step of detecting whether the industrial scene traffic is transmitted based on an industrial protocol includes:

[0016] It is detected whether the mirrored traffic is transmitted based on an industrial protocol.

[0017] In one embodiment, the step of obtaining the equipment related to the industrial scene flow includes:

[0018] The equipment is reported to the asset ledger, and the equipment is marked as industrial equipment in the asset ledger.

[0019] In one embodiment, the step of improving the asset information of the device based on the detection result includes:

[0020] If the detection result shows that the device responds to the operation technology native instruction, then obtaining response information returned by the device;

[0021] The industrial asset attributes of the equipment are completed in the asset ledger based on the response information.

[0022] In one embodiment, the step of performing deep detection on the device based on the operating technology native instruction to obtain the detection result includes:

[0023] Constructing a message request for accessing the device in an industrial scenario based on the native instructions of the operation technology;

[0024] Sending the message request to the device;

[0025] Receive the detection result returned by the device.

[0026] In one embodiment, the step of detecting whether the industrial scene traffic is transmitted based on an industrial protocol includes:

[0027] Detecting, by a detection module, whether the industrial scene traffic is transmitted based on the industrial protocol;

[0028] The step of performing deep detection on the device based on the native instruction of the operation technology to obtain the detection result comprises:

[0029] Sending detection strategies to active scanning modules through the detection module;

[0030] Through the active scanning module, the device is deeply detected based on the native instructions of the operating technology to obtain the detection result.

[0031] In addition, to achieve the above-mentioned purpose, the present application also proposes an asset identification device, the asset identification device comprising:

[0032] Traffic receiving module, used to receive industrial scene traffic;

[0033] A detection module, used to detect whether the industrial scene traffic is transmitted based on an industrial protocol;

[0034] A device acquisition module, used for acquiring devices related to the industrial scene traffic;

[0035] A detection module, used for performing in-depth detection on the device based on native instructions of the operation technology to obtain detection results;

[0036] The improvement module is used to improve the asset information of the device based on the detection result.

[0037] In addition, to achieve the above-mentioned purpose, the present application also proposes an asset identification device, which includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the asset identification method described above.

[0038] In addition, to achieve the above-mentioned purpose, the present application also proposes a storage medium, which is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the asset identification method described above are implemented.

[0039] In addition, to achieve the above-mentioned purpose, the present application also provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, the steps of the asset identification method described above are implemented.

[0040] One or more technical solutions proposed in this application have at least the following technical effects:

[0041] This application receives industrial scene traffic and detects whether the industrial scene traffic is transmitted based on an industrial protocol. If so, it obtains the equipment related to the industrial scene traffic, performs in-depth detection on the equipment based on the native instructions of the operating technology, obtains the detection results, and improves the asset information of the equipment based on the detection results, thereby avoiding a large number of detection packets to detect industrial assets and avoiding industrial assets from shutting down or abnormalities. In addition, this application can accurately identify industrial assets by using native instructions of operating technology, thereby achieving lossless acquisition of various asset information of industrial assets. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0043] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0044] Figure 1A flowchart of the first embodiment of the asset identification method of the present application is provided;

[0045] Figure 2 This is a schematic diagram of the architecture of the asset identification system for this application;

[0046] Figure 3 A brief flowchart of the asset identification method for this application is provided;

[0047] Figure 4 This is a schematic diagram of the module structure of the asset identification device according to an embodiment of the present application;

[0048] Figure 5 Schematic diagram of the device structure of the hardware operating environment involved in the asset identification method in the embodiment of the present application.

[0049] The purpose, features and advantages of this application will be further described in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0050] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the present application and are not used to limit the present application.

[0051] In order to better understand the technical solution of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.

[0052] The main solution of the embodiment of the present application is: receiving industrial scene traffic; detecting whether the industrial scene traffic is transmitted based on an industrial protocol; if so, obtaining the equipment related to the industrial scene traffic; performing in-depth detection of the equipment based on native instructions of the operating technology to obtain detection results; and completing the asset information of the equipment based on the detection results.

[0053] In this embodiment, for ease of description, the following description is made with the asset identification system as the execution entity.

[0054] At present, the identification of industrial assets is achieved by identifying network traffic analysis protocols or by IT network identification, such as snmp, icmp, arp, etc. Active detection methods mainly use a variety of high-speed network scanning technologies, such as host survival detection, port scanning and service identification technologies, by actively sending constructed detection data packets to target network assets, and extracting target features from the relevant information of the returned response data packets, and matching them with the feature fingerprints in the built-in feature library to achieve testing of operating systems, open ports, service application types and versions.

[0055] Industrial asset identification is different from network asset identification. Active scanning and sending of a large number of messages to identify assets will cause network congestion or asset downtime in the industrial environment, thereby causing industrial losses.

[0056] The current practice is to analyze the natural traffic in industrial scenarios to perform protocol analysis, thereby inferring the asset attributes of the device. This approach is relatively safe and simple, but because the natural traffic in industrial scenarios cannot identify all assets and their attributes, it also requires a large amount of CPU resources to process the protocol and perform protocol analysis.

[0057] In summary, this method consumes a lot of CPU resources but cannot identify all industrial assets and their attributes.

[0058] The present application provides a solution. The present application receives industrial scene traffic, detects whether the industrial scene traffic is transmitted based on an industrial protocol, and if so, obtains the equipment related to the industrial scene traffic, performs in-depth detection on the equipment based on the native instructions of the operating technology, obtains the detection results, and improves the asset information of the equipment based on the detection results, thereby avoiding a large number of detection packets to detect industrial assets and avoiding industrial assets from shutting down or abnormalities. In addition, the present application can accurately identify industrial assets by using native instructions of operating technology, thereby achieving lossless acquisition of various asset information of industrial assets.

[0059] It should be noted that the execution subject of this embodiment can be a computing service device with data processing, network communication and program running functions, such as a tablet computer, a personal computer, a mobile phone, etc., or an electronic device capable of realizing the above functions, an asset identification device, etc., or an electronic system capable of realizing the above functions, an asset identification system, etc. The following takes the asset identification system as an example to illustrate this embodiment and the following embodiments.

[0060] Based on this, the present application embodiment provides an asset identification method, referring to Figure 1 , Figure 1 A flowchart of the first embodiment of the asset identification method of the present application is provided.

[0061] In this embodiment, the asset identification method includes steps S10, S30, S40, S60-S70:

[0062] Step S10, receiving industrial scene traffic;

[0063] Among them, this application is applicable to industrial asset management platforms, and the industrial scenarios can be smart manufacturing and digital factories, electronic equipment manufacturers, or industrial control safety laboratories.

[0064] Step S30, detecting whether the industrial scene traffic is transmitted based on an industrial protocol;

[0065] Among them, industrial protocols such as Modbus, OPC UA, DNP3, etc. are standards or specifications for data exchange between devices in industrial environments.

[0066] Step S40: If yes, then obtain the equipment related to the industrial scene traffic;

[0067] Once it is confirmed that the traffic is transmitted based on an industrial protocol, the system will try to identify the specific devices associated with the traffic. This usually involves parsing the protocol data and extracting the identity information about the devices sending and receiving the data, such as IP address, MAC address, device type, etc.

[0068] Step S60, performing a deep detection on the device based on the native instruction of the operation technology to obtain a detection result;

[0069] Among them, native operation instructions for these devices (such as device type-specific commands) can be used to further explore the devices. This process may include querying device status, configuration, capabilities, and other information to gain a deeper understanding of the device's characteristics and status.

[0070] Step S70: improving the asset information of the device based on the detection result.

[0071] Among them, asset information may include the equipment’s hardware and software configuration, operating status, security status, maintenance records, etc.

[0072] This embodiment provides an asset identification method, which receives industrial scene traffic, detects whether the industrial scene traffic is transmitted based on an industrial protocol, and if so, obtains the device related to the industrial scene traffic, performs in-depth detection on the device based on the native instructions of the operating technology, obtains the detection result, and improves the asset information of the device based on the detection result, thereby avoiding a large number of detection packets to detect industrial assets and avoiding industrial assets from shutting down or abnormalities. In addition, this application can accurately identify industrial assets by using native instructions of operating technology, thereby achieving lossless acquisition of various asset information of industrial assets.

[0073] Based on the first embodiment of the present application, in the second embodiment of the present application, the same or similar contents as those in the first embodiment can be referred to the above description, and will not be repeated in the following. On this basis, before step S30, detecting whether the industrial scene traffic is transmitted based on the industrial protocol, the asset identification method further includes step S20:

[0074] Step S20, copying the industrial scene traffic to obtain mirrored traffic;

[0075] The system captures and copies network traffic in industrial scenarios in real time. This copying process usually does not cause network latency or affect the transmission of the original traffic because it is performed without affecting network performance. The copied traffic is called "mirror traffic" and contains exactly the same data packets as the original traffic. Mirror traffic is created to analyze, monitor or test traffic without interfering with normal network operations.

[0076] The step S30 of detecting whether the industrial scene traffic is transmitted based on the industrial protocol also includes step S31:

[0077] Step S31, detecting whether the mirrored traffic is transmitted based on an industrial protocol.

[0078] Among them, it is possible to detect whether the mirrored traffic is transmitted based on industrial protocols such as Modbus, OPC UA, DNP3, etc.

[0079] This embodiment provides an asset identification method. The present application obtains mirror traffic by replicating the industrial scenario traffic, and can analyze, monitor or test the traffic without interfering with normal network operations.

[0080] Based on the first embodiment of the present application, in the third embodiment of the present application, the same or similar contents as those in the first embodiment can be referred to the above description, and will not be repeated in the following. On this basis, in step S40, after obtaining the equipment related to the industrial scene flow, the asset identification method further includes step S50:

[0081] Step S50: reporting the equipment to the asset ledger, and marking the equipment as industrial equipment in the asset ledger.

[0082] In industrial scenarios, asset records are lists or files that record a company's fixed assets and other important asset information in detail. They are mainly used to track and manage various types of assets of a company, including equipment purchase, use, maintenance, depreciation, appreciation, and disposal.

[0083] After obtaining the equipment related to the industrial scene traffic, the equipment is reported to the asset ledger, and the equipment is marked as industrial equipment in the asset ledger.

[0084] Furthermore, the address (IP address or MAC address) of the industrial equipment can be reported to the asset ledger.

[0085] Furthermore, a detection module may be installed on a network node in an industrial scenario, and the detection module identifies the industrial protocol and reports it to the asset ledger.

[0086] This embodiment provides an asset identification method. By incorporating devices into the asset ledger, the application enables enterprises to manage and track these devices in a more systematic manner.

[0087] Based on the first embodiment of the present application, in the fourth embodiment of the present application, the same or similar contents as those in the first embodiment can be referred to the above description, and will not be described in detail later. On this basis, step S70, based on the detection result, improves the asset information of the device and also includes steps S71~S72:

[0088] Step S71, if the detection result shows that the device responds to the operation technology native instruction, then obtaining the response information returned by the device;

[0089] The system monitors the response to the native operation technology instructions issued in step S60. If the device responds to these instructions correctly, such as returning the expected data or status information, the system will capture the response information. This response information usually contains more detailed status, configuration, performance parameters, etc. of the device, which is crucial for subsequent device management and asset information improvement.

[0090] Step S72: completing the industrial asset attributes of the equipment in the asset ledger based on the response information.

[0091] Once the response information is obtained from the device, the system can use this information to further enrich and improve the industrial asset attributes of the device in the asset ledger. Industrial asset attributes may include but are not limited to the model, serial number, manufacturer, firmware version, current configuration, operating status, maintenance records, etc. of the device.

[0092] This embodiment provides an asset identification method. If the detection result shows that the device responds to the native instruction of the operation technology, the response information returned by the device is obtained; based on the response information, the industrial asset attributes of the device are improved in the asset ledger, thereby providing a method for device management and asset information improvement.

[0093] Based on the first embodiment of the present application, in the fifth embodiment of the present application, the same or similar contents as those in the first embodiment can be referred to the above description, and will not be described in detail later. On this basis, step S60, based on the native instruction of the operation technology, performs a deep detection on the device, and obtaining the detection result also includes steps S61~S63:

[0094] Step S61, constructing a message request for accessing the device in an industrial scenario based on the native instruction of the operation technology;

[0095] Among them, message requests suitable for industrial scenarios can be constructed based on known device types, protocol specifications, and native instructions for operating technologies that need to be executed. These message requests usually contain specific instruction codes, parameters, verification information, etc. to ensure that the message can be correctly parsed and executed by the target device.

[0096] Step S62, sending the message request to the device;

[0097] Step S63: receiving the detection result returned by the device.

[0098] Among them, if the detection result shows that the device responds to the native instruction of the operating technology, the response information returned by the device is obtained, and the industrial asset attributes of the device are improved in the asset ledger based on the response information.

[0099] This embodiment provides an asset identification method. This application constructs a message request for accessing the device in an industrial scenario based on the operation technology native instruction, and sends the message request to the device, thereby avoiding a large number of detection packets to detect industrial assets and avoiding industrial assets from shutting down or abnormalities. In addition, this application can accurately identify industrial assets by using operation technology native instructions, thereby achieving lossless acquisition of various asset information of industrial assets.

[0100] Based on the first embodiment of the present application, in the seventh embodiment of the present application, the same or similar contents as those in the first embodiment can be referred to the above description, and will not be repeated in the following. On this basis, step S30 detects whether the industrial scene traffic is transmitted based on the industrial protocol, and the asset identification method also includes step S31:

[0101] Step S31, detecting, by a detection module, whether the industrial scene traffic is transmitted based on the industrial protocol;

[0102] Reference Figure 2 , Figure 2 This is a schematic diagram of the architecture of the asset identification system of this application.

[0103] Among them, the asset identification system includes detection module, active scanning module, OT native instruction module (operation technology native instruction module), and asset ledger.

[0104] Step S60, performing a deep detection on the device based on the native instruction of the operation technology, and obtaining the detection result also includes steps S64-S65:

[0105] Step S64, sending a detection strategy to the active scanning module through the detection module;

[0106] like Figure 2As shown, the detection module first detects the industrial field flow, and then sends the detection strategy to the active scanning module through the detection module.

[0107] Step S65: Performing a deep detection on the device based on the native instruction of the operation technology through the active scanning module to obtain the detection result.

[0108] Among them, the active scanning module can automatically issue strategies to industrial assets.

[0109] This embodiment provides an asset identification method, which receives industrial scene traffic, detects whether the industrial scene traffic is transmitted based on an industrial protocol, and if so, obtains the device related to the industrial scene traffic, performs in-depth detection on the device based on the native instructions of the operating technology, obtains the detection result, and improves the asset information of the device based on the detection result, thereby avoiding a large number of detection packets to detect industrial assets and avoiding industrial assets from shutting down or abnormalities. In addition, this application can accurately identify industrial assets by using native instructions of operating technology, thereby achieving lossless acquisition of various asset information of industrial assets.

[0110] For example, to help understand the implementation process of the asset identification method of the above embodiment, please refer to Figure 3 , Figure 3 A brief flow chart of an asset identification method is provided. Specifically, the flow chart includes the following steps:

[0111] Step S101, receiving an industrial scenario message.

[0112] Step S102: copy the industrial scenario message traffic to obtain mirrored message traffic.

[0113] Step S103: Detect the mirrored message traffic through a detection module to detect whether it is transmitted based on an industrial protocol.

[0114] Step S104: If not, re-execute step S101.

[0115] Step S105: If yes, report the industrial equipment address (IP address or MAC address) to the asset ledger.

[0116] Step S106: Automatically issue policies to industrial asset equipment through the active scanning module.

[0117] Step S107, detecting whether the industrial asset equipment responds to the native operation technology instruction.

[0118] Step S107: If the industrial asset device responds to the native operation technology instruction, the response information returned by the device is obtained, and various attributes of the industrial assets in the asset ledger are reported based on the response information.

[0119] It should be noted that the above examples are only used to understand the present application and do not constitute a limitation on the asset identification method of the present application. More simple transformations based on this technical concept are all within the scope of protection of the present application.

[0120] This application also provides an asset identification device, please refer to Figure 4 , the asset identification device comprises:

[0121] The traffic receiving module 10 is used to receive industrial scene traffic;

[0122] A detection module 20, used to detect whether the industrial scene traffic is transmitted based on an industrial protocol;

[0123] A device acquisition module 30, configured to acquire devices related to the industrial scene traffic if yes;

[0124] A detection module 40, configured to perform a deep detection on the device based on the native instruction of the operation technology to obtain a detection result;

[0125] The improvement module 50 is used to improve the asset information of the device based on the detection result.

[0126] The asset identification device provided by the present application adopts the asset identification method in the above embodiment, which can solve the technical problem that actively scanning and sending a large number of messages to identify assets easily causes industrial losses. Compared with the prior art, the beneficial effects of the asset identification device provided by the present application are the same as the beneficial effects of the asset identification method provided by the above embodiment, and the other technical features in the asset identification device are the same as the features disclosed in the above embodiment method, which will not be repeated here.

[0127] The present application provides an asset identification device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the asset identification method in the above-mentioned embodiment one.

[0128] Reference below Figure 5, which shows a schematic diagram of the structure of an asset identification device suitable for implementing the embodiment of the present application. The asset identification device in the embodiment of the present application may include but is not limited to mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 5 The asset identification device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0129] like Figure 5 As shown, the asset identification device may include a processing device 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM: Read Only Memory) 1002 or a program loaded from a storage device 1003 to a random access memory (RAM: Random Access Memory) 1004. In RAM1004, various programs and data required for the operation of the asset identification device are also stored. The processing device 1001, ROM1002, and RAM1004 are connected to each other through a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Generally, the following systems can be connected to the I / O interface 1006: an input device 1007 including, for example, a touch screen, a touch pad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; an output device 1008 including, for example, a liquid crystal display (LCD: Liquid Crystal Display), a speaker, a vibrator, etc.; a storage device 1003 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 1009. The communication device 1009 can allow the asset identification device to communicate with other devices wirelessly or by wire to exchange data. Although the figure shows an asset identification device with various systems, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems can be implemented or have alternatively.

[0130] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device 1003, or installed from a ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0131] The asset identification device provided by the present application adopts the asset identification method in the above embodiment, which can solve the technical problem that actively scanning and sending a large number of messages to identify assets easily causes industrial losses. Compared with the prior art, the beneficial effects of the asset identification device provided by the present application are the same as the beneficial effects of the asset identification method provided by the above embodiment, and the other technical features in the asset identification device are the same as the features disclosed in the method of the previous embodiment, which will not be repeated here.

[0132] It should be understood that the various parts disclosed in this application can be implemented by hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0133] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0134] The present application provides a computer-readable storage medium having computer-readable program instructions (ie, computer programs) stored thereon, and the computer-readable program instructions are used to execute the asset identification method in the above-mentioned embodiment.

[0135] The computer-readable storage medium provided in the present application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, systems or devices, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM: Random Access Memory), a read-only memory (ROM: Read Only Memory), an erasable programmable read-only memory (EPROM: Erasable Programmable Read Only Memory or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM: CD-Read Only Memory), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, system or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency: Radio Frequency), etc., or any suitable combination of the above.

[0136] The computer-readable storage medium may be included in the asset identification device; or may exist independently without being assembled into the asset identification device.

[0137] The above-mentioned computer-readable storage medium carries one or more programs. When the above-mentioned one or more programs are executed by the asset identification device, the asset identification device: receives industrial scene traffic; detects whether the industrial scene traffic is transmitted based on an industrial protocol; if so, obtains the device related to the industrial scene traffic; performs in-depth detection of the device based on the native instructions of the operating technology to obtain the detection results; and improves the asset information of the device based on the detection results.

[0138] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0139] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0140] The modules involved in the embodiments described in this application may be implemented by software or hardware, wherein the name of the module does not constitute a limitation on the unit itself in some cases.

[0141] The readable storage medium provided in this application is a computer-readable storage medium, which stores computer-readable program instructions (i.e., computer programs) for executing the above-mentioned asset identification method, and can solve the technical problem that actively scanning and sending a large number of messages to identify assets easily causes industrial losses. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as the beneficial effects of the asset identification method provided in the above-mentioned embodiment, and will not be repeated here.

[0142] The present application also provides a computer program product, including a computer program, which implements the steps of the above-mentioned asset identification method when executed by a processor.

[0143] The computer program product provided by this application can solve the technical problem that actively scanning and sending a large number of messages to identify assets can easily cause industrial losses. Compared with the prior art, the beneficial effects of the computer program product provided by this application are the same as the beneficial effects of the asset identification method provided by the above embodiment, which will not be repeated here.

[0144] The above descriptions are only some embodiments of the present application, and are not intended to limit the patent scope of the present application. All equivalent structural changes made using the contents of the present application specification and drawings under the technical concept of the present application, or direct / indirect applications in other related technical fields are included in the patent protection scope of the present application.

Claims

1. An asset identification method, characterized in that: The method comprises the following steps: Receive industrial scene traffic; Detecting whether the industrial scene traffic is transmitted based on an industrial protocol; If yes, then obtain the equipment related to the industrial scene traffic; Performing in-depth detection on the device based on native instructions of the operating technology to obtain detection results; improving the asset information of the device based on the detection result; The step of improving the asset information of the device based on the detection result includes: If the detection result shows that the device responds to the operation technology native instruction, then obtaining response information returned by the device; Based on the response information, the industrial asset attributes of the equipment are completed in the asset ledger; The step of performing deep detection on the device based on the native instruction of the operation technology to obtain the detection result comprises: Constructing a message request for accessing the device in an industrial scenario based on the native instructions of the operation technology; Sending the message request to the device; receiving the detection result returned by the device; The step of detecting whether the industrial scene traffic is transmitted based on an industrial protocol includes: Detecting, by a detection module, whether the industrial scene traffic is transmitted based on the industrial protocol; The step of performing deep detection on the device based on the native instruction of the operation technology to obtain the detection result comprises: Sending detection strategies to active scanning modules through the detection module; Through the active scanning module, the device is deeply detected based on the native instructions of the operating technology to obtain the detection result.

2. The method according to claim 1, characterized in that The step of detecting whether the industrial scene traffic is transmitted based on an industrial protocol includes: The industrial scene traffic is copied to obtain mirrored traffic; The step of detecting whether the industrial scene traffic is transmitted based on an industrial protocol includes: It is detected whether the mirrored traffic is transmitted based on an industrial protocol.

3. The method according to claim 1, characterized in that The step of obtaining the equipment related to the industrial scene flow includes: The equipment is reported to the asset ledger, and the equipment is marked as industrial equipment in the asset ledger.

4. An asset identification device for implementing the asset identification method according to claim 1, characterized in that: The device comprises: Traffic receiving module, used to receive industrial scene traffic; A detection module, used to detect whether the industrial scene traffic is transmitted based on an industrial protocol; A device acquisition module, used for acquiring devices related to the industrial scene traffic; A detection module, used for performing in-depth detection on the device based on native instructions of the operation technology to obtain detection results; The detection module is also used to construct a message request for accessing the device in an industrial scenario based on the operation technology native instruction; send the message request to the device; and receive the detection result returned by the device; A completion module, used to complete the asset information of the device based on the detection result; The improvement module is also used for obtaining response information returned by the device if the detection result shows that the device responds to the operation technology native instruction; and improving the industrial asset attributes of the device in the asset ledger based on the response information; The detection module is also used to detect whether the industrial scene traffic is transmitted based on the industrial protocol through the detection module; The detection module is also used to send a detection strategy to the active scanning module through the detection module; through the active scanning module, the device is deeply detected based on the native instructions of the operating technology to obtain the detection result.

5. An asset identification device, characterized in that: The device comprises: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the asset identification method according to any one of claims 1 to 3.

6. A storage medium, characterized in that: The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the asset identification method according to any one of claims 1 to 3 are implemented.

7. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the steps of the asset identification method according to any one of claims 1 to 3 are implemented.

Images