Industrial control asset risk identification method and system based on semi-supervised anomaly detection

Abstract

The invention discloses an industrial control asset risk identification method and system based on semi-supervised anomaly detection, and relates to the technical field of network security, and the method comprises the steps: obtaining related asset information through combining active scanning, passive scanning and log detection, and extracting asset feature flow based on the related asset information; performing flow anomaly detection on the asset characteristic flow by using a semi-supervised anomaly detection model, and updating asset data characteristics with abnormal flow; and performing feature traffic hash value matching and feature library comparison on the updated asset data features, then judging whether the asset information has a vulnerability risk, and judging the risk level of the asset. According to the method, an asset change monitoring function is added on the basis of risk asset identification, asset change can be sensed, and a data basis is provided for abnormal flow analysis; moreover, offline updating of the feature library of the risk asset identification system is realized, and the real-time performance and traceability of asset data are ensured.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a method and system for identifying industrial control asset risks based on semi-supervised anomaly detection. Background Art

[0002] With the rapid development of Internet technology, technologies such as cloud computing, big data, the Internet of Things, and artificial intelligence are becoming increasingly popular, and industrial control systems have become more intelligent and complex. In this context, there are more and more patents and applications related to asset identification. However, due to the uniqueness of industrial control systems, their asset identification faces many challenges. Unlike traditional equipment and traffic characteristics, industrial control systems have their own uniqueness, so existing asset identification technologies are rarely optimized specifically for industrial control systems. In existing asset identification systems, asset information is usually collected through active scanning or passive scanning. Among them, active scanning often simply sends a scan request similar to nmap, and for industrial control systems, this simple scan may not obtain enough data, or may even not return traffic data. In addition, for a small amount of returned data, existing technologies may not be able to accurately identify them.

[0003] In addition, the existing asset identification system also has obvious deficiencies in risk asset identification. At present, this function can usually only update the feature library manually or online, and cannot achieve offline iterative updates of the risk feature library. This means that when the network is not connected, the system cannot obtain the latest risk feature information, which affects the accuracy of risk identification. More seriously, the existing asset identification modules generally lack effective monitoring of sudden changes in assets. Once an asset is artificially changed, the system is likely to misjudge it as a risky asset, resulting in the device being incorrectly blocked, causing unnecessary losses. Summary of the invention

[0004] In view of the above existing problems, the present invention is proposed.

[0005] Therefore, the present invention provides an industrial control asset risk identification method and system based on semi-supervised anomaly detection to solve the problems that the existing asset identification technology is not optimized for industrial control systems, the asset information collection method is ineffective, there are deficiencies in risk asset identification and feature library updates, and there is a lack of effective monitoring of asset changes.

[0006] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0007] In the first aspect, the present invention provides an industrial control asset risk identification method based on semi-supervised anomaly detection, comprising: obtaining relevant asset information by combining active scanning, passive scanning and log detection, and extracting asset characteristic traffic based on the relevant asset information; using a semi-supervised anomaly detection model to perform traffic anomaly detection on the asset characteristic traffic, and updating the asset data features of the traffic anomaly; performing feature traffic hash value matching and feature library comparison on the updated asset data features, determining whether the asset information has a vulnerability risk, and determining the risk level of the asset.

[0008] As a preferred solution of the industrial control asset risk identification method based on semi-supervised anomaly detection described in the present invention, the acquisition of relevant asset information by combining active scanning, passive scanning and log detection includes:

[0009] Connect the detection device to the switch closest to the target object to be tested. The active scan is to actively send detection traffic to scan all devices in the subnet domain of the target object to be tested, monitor the traffic between industrial control devices in a proxy manner, and link the host scan log to obtain various information related to industrial control assets;

[0010] The passive scan is to use the monitoring equipment deployed in the network to capture and analyze the network traffic flowing through the subnet domain of the target object to be tested without actively sending any detection traffic, so as to identify the industrial control equipment, service type, and protocol usage in the subnet. In addition, the collected network traffic data can be deeply mined in combination with log analysis tools to extract key information related to the security status of industrial control assets.

[0011] The log detection is to receive log files that can mainly obtain asset information from the target log folder, pre-process the log files, delete the information in service initialization, startup logs, non-critical permission changes and authentication failure steps, parse the log files and search for fields related to asset information.

[0012] As a preferred solution of the industrial control asset risk identification method based on semi-supervised anomaly detection described in the present invention, it also includes:

[0013] The fixed traffic obtained after multiple traffic detections is uploaded to the blockchain after being encrypted with md5. The blockchain stores the hash value of the fixed traffic. If an asset needs to be modified or changed, the operation and maintenance personnel need to upload a regular standard traffic hash value for the corresponding asset in the blockchain to update the previous fixed traffic, and set the change label and change personnel;

[0014] Extract asset characteristic traffic based on the relevant asset information, determine whether the hash value of the asset characteristic traffic is consistent with the hash value of the fixed traffic in the blockchain, and then confirm whether the asset characteristic traffic is the inherent traffic characteristic of the asset. If so, it means that the asset has not changed. If not, upload the traffic to the blockchain as the asset's regular standard traffic to determine whether the subsequent asset has changed;

[0015] Based on the relevant asset information, the asset characteristic flow is extracted again and matched with the latest conventional standard flow corresponding to the asset in the blockchain. If there is no match, the asset is marked as a pending risk asset, and the characteristic flow hash value is matched for further judgment. If there is a match, it is judged whether the conventional standard flow corresponding to the asset in the blockchain has changed, so as to determine whether the asset is an unchanged asset or a changed asset.

[0016] As a preferred solution of the industrial control asset risk identification method based on semi-supervised anomaly detection described in the present invention, the method of performing flow anomaly detection on the asset characteristic flow using the semi-supervised anomaly detection model includes:

[0017] The semi-supervised anomaly detection model is used to detect the flow anomaly of the asset characteristic flow. After obtaining the abnormal flow data of the asset, the flow feature extraction algorithm is used to extract the data features, and the data with features is used as the input of the risk asset feature learning module. The input space and output space are set to be and Let φ(·; w):χ→Z be a neural network with L hidden layers, where w = {W 1 ,W 2 ,…,W L} is the weighted value, represents n unlabeled samples, Represents m labeled data samples, where γ={-1,+1}, when When , it indicates a known normal sample. Indicates known abnormal samples;

[0018] Through training and learning, the closed data sphere of the output space Z with the center point c is minimized. After learning and training, the new risk asset feature flow is obtained and stored in the feature library. The loss function of the semi-supervised anomaly detection deep learning model is expressed as:

[0019]

[0020] Among them, W l represents the weight, and Represent the data samples of input space and output control respectively, ||.|| Frepresents the Frobenius norm, λ represents a hyperparameter, and the parameter η>0 is used to control the balance between labeled samples and unlabeled samples. η>1 indicates that labeled samples are more emphasized, and η<1 indicates that unlabeled samples are more emphasized.

[0021] As a preferred solution of the industrial control asset risk identification method based on semi-supervised anomaly detection described in the present invention, the process of comparing the feature library includes:

[0022] Preprocessing the updated asset data features, wherein the preprocessing includes basic information extraction, hash value conversion, and binary bytecode conversion, and during the preprocessing process, identifying assets with abnormalities in the basic information and marking them as risky assets;

[0023] The traffic type and traffic protocol are used as search indexes for the feature library. If there is no problem with the traffic, the processed traffic is obtained by removing ARP broadcast traffic, duplicate traffic, and unreachable non-critical traffic.

[0024] When the amount of data in the processed traffic is small, a linear search algorithm is used to find risk points. When the amount of data in the processed traffic is large, a comparison is performed according to the hash value in the feature library. The feature library stores hash values ​​with labels for risky assets. It is only necessary to search and compare in the traffic information of the asset. If the labeled hash value is found, the asset is marked as a risky asset.

[0025] As a preferred solution of the industrial control asset risk identification method based on semi-supervised anomaly detection described in the present invention, it also includes:

[0026] Abnormal traffic analysis is performed based on the asset corresponding traffic library and the collected asset traffic data. After receiving the traffic of a pending risk asset or discovering abnormal traffic, it is necessary to compare the pending risk asset with the corresponding traffic of the asset on the blockchain. If the comparison fails, the pending risk asset is positioned as a risky asset. If the comparison succeeds, it is positioned as a normal asset.

[0027] As a preferred solution of the industrial control asset risk identification method based on semi-supervised anomaly detection described in the present invention, the risk level of the asset is determined as follows:

[0028] Risk assets are scanned using various scanning technologies to identify potential security vulnerabilities. Each scanning technology generates a score for each potential vulnerability detected. The formula is:

[0029]

[0030] Where L(x) represents the preliminary vulnerability score of asset x, and d i (x) represents the vulnerability depth assessment of asset x by the i-th technology, αi represents the weight factor of the i-th technology, h j (x) represents the square root of the jth vulnerability severity index, N and M represent the number of different scanning techniques and vulnerability severity indexes, respectively;

[0031] Each identified potential vulnerability is analyzed for severity, and the difficulty, scope, and potential damage of exploitation are calculated. The scores of all individual technologies are combined to form a comprehensive score, expressed as:

[0032]

[0033] Where K represents the number of different evaluation methods, c k and β k Represent the weight factor and adjustment parameter respectively, L k (x) represents K different vulnerability assessment methods;

[0034] After obtaining the comprehensive score of each asset, the risk level of the asset is determined and a risk determination report is generated.

[0035] In a second aspect, the present invention provides an industrial control asset risk identification system based on semi-supervised anomaly detection, comprising:

[0036] The asset collection module is used to obtain relevant asset information by combining active scanning, passive scanning and log detection;

[0037] The asset change monitoring module is used to extract the asset characteristic flow based on the relevant asset information, and upload the fixed flow obtained after multiple flow detections to the blockchain after encryption through md5. The blockchain stores the hash value of the fixed flow. If the asset needs to be modified or changed, the operation and maintenance personnel need to upload a regular standard flow hash value for the corresponding asset in the blockchain to update the previous fixed flow, and set the change label and change personnel;

[0038] A deep learning module, used for performing flow anomaly detection on the asset characteristic flow using a semi-supervised anomaly detection model, and updating asset data features of flow anomaly;

[0039] The risk asset identification module is used to determine whether the asset information has a vulnerability risk and determine the risk level of the asset after matching the feature traffic hash value and comparing it with the feature library of the updated asset data features.

[0040] In a third aspect, the present invention provides a computing device, comprising:

[0041] Memory and processor;

[0042] The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions. When the computer-executable instructions are executed by the processor, the steps of the method are implemented.

[0043] In a fourth aspect, the present invention provides a computer-readable storage medium storing computer-executable instructions, which implement the steps of the method when executed by a processor.

[0044] Compared with the prior art, the beneficial effects of the present invention are as follows: the present invention obtains relevant asset information by combining active scanning, passive scanning and log detection, so as to collect assets more comprehensively and accurately; on the basis of risk asset identification, the function of asset change monitoring is added, so as to perceive asset changes and provide a data basis for abnormal traffic analysis; and the conventional standard traffic hash value is saved in the blockchain of the present invention, and a simpler solution is provided for operation and maintenance personnel to change assets, which only requires resubmitting a new conventional standard traffic hash value, thereby ensuring the real-time and traceability of asset data; in addition, the present invention, based on having a basic risk library and new abnormal traffic as input, can output a relatively accurate new risky feature value to supplement the feature library, thereby realizing the offline update of the risk asset identification system feature library, thereby ensuring the real-time and traceability of asset data. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0046] Figure 1 This is an overall flow chart of an industrial control asset risk identification method based on semi-supervised anomaly detection according to an embodiment of the present invention;

[0047] Figure 2 This is a flow chart of a method for identifying industrial control asset risks based on semi-supervised anomaly detection according to an embodiment of the present invention;

[0048] Figure 3 This is a system flow chart of an industrial control asset risk identification method based on semi-supervised anomaly detection according to an embodiment of the present invention. DETAILED DESCRIPTION

[0049] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0050] Example 1

[0051] Reference Figure 1 to Figure 3 As an embodiment of the present invention, a method for identifying industrial control asset risks based on semi-supervised anomaly detection is provided. Figure 2 As shown, asset collection module, asset change monitoring module, deep learning module and asset risk identification module are set up respectively. Through the collaborative work of these modules, asset information in the industrial control system can be collected more accurately, asset changes can be monitored in real time, and deep learning technology can be used to identify asset risks, which can significantly improve the accuracy and reliability of asset risk identification and provide strong protection for the safe and stable operation of the industrial control system. Specifically, the following steps are included:

[0052] S100: Acquire relevant asset information by combining active scanning, passive scanning and log detection, and extract asset feature traffic based on the relevant asset information;

[0053] In the embodiment of the present application, the detection device is connected to the switch closest to the target object to be tested, and the active scan is to actively send detection traffic to scan all devices in the subnet domain of the target object to be tested, monitor the traffic between industrial control devices in a proxy manner, and link the host scan log to obtain various types of information related to industrial control assets, wherein the various types of information related to industrial control assets obtained include specific devices and models in the industrial control system, operating systems and versions running on industrial control devices, business dependencies between various devices and applications in the industrial control system, network communication protocols used by devices, and open port information;

[0054] In the embodiment of the present application, passive scanning is to use the monitoring device deployed in the network to capture and analyze the network traffic flowing through the subnet domain of the target object to be tested without actively sending any detection traffic, so as to identify the industrial control equipment, service type, and protocol usage in the subnet. In addition, the collected network traffic data can be deeply mined in combination with log analysis tools to extract key information related to the security status of industrial control assets.

[0055] In the embodiment of the present application, log detection is to receive and filter log files that can mainly harvest asset information from a target log folder, pre-process the log files, delete information in service initialization, startup logs, non-critical permission changes, and authentication failure steps, parse the log files, and search for fields related to asset information;

[0056] It should be noted that the initial active scan relies on public template traffic and detects the ports and services of the target device based on public conventional network protocols. Passive scanning is to establish a proxy in the target object to be tested and statically collect the traffic to and from the target object to be tested. After obtaining the scan results, it is necessary to obtain relevant asset IP, MAC, open ports, open services, system version and device type information from the detected traffic, and store the corresponding asset information in the asset library for scanning.

[0057] It should be noted that the services of industrial control equipment contain various log information, including error information, service operation information, host port information, etc. The log scanning module collects a small amount of information, including error information caused by IP and traffic.

[0058] It should be noted that due to the different protocols of industrial control equipment and more private configurations, active scanning and passive scanning may receive very small amounts of disorganized data on certain devices or ports. Relying on GPT's traffic identification capabilities, this small amount of data can be identified as a protocol or even restored to a complete format of traffic data, and a new template traffic for the protocol is generated for the traffic and stored in the template traffic library for active scanning. In addition, this module uses a plug-in developed by the gpt-3.5-turbo model released by OpenAI as a local function for traffic identification in the system.

[0059] Furthermore, based on the relevant asset information, the asset characteristic flow is extracted, and the fixed flow obtained after multiple flow detections is uploaded to the blockchain after being encrypted with md5. The hash value of the fixed flow is saved in the blockchain. If the asset needs to be modified or changed, the operation and maintenance personnel need to upload a regular standard flow hash value for the corresponding asset in the blockchain to update the previous fixed flow, and set the change label and change personnel;

[0060] Further, such as Figure 3 As shown, based on the relevant asset information, the asset characteristic flow is extracted, and it is determined whether the hash value of the asset characteristic flow is consistent with the hash value of the fixed flow in the blockchain, and then it is confirmed whether the asset characteristic flow is the inherent flow characteristic of the asset. If so, it means that the asset has not changed. If not, the flow is processed and uploaded to the blockchain as the regular standard flow of the asset to determine whether the subsequent asset has changed;

[0061] Furthermore, the asset characteristic flow is extracted based on the relevant asset information and matched with the latest conventional standard flow corresponding to the asset in the blockchain. If there is a mismatch, the asset is marked as a pending risk asset, and the characteristic flow hash value is matched for further judgment. If there is a match, it is determined whether the conventional standard flow corresponding to the asset in the blockchain has changed, thereby obtaining whether the asset is an unchanged asset or a changed asset.

[0062] S200: using a semi-supervised anomaly detection model to perform flow anomaly detection on asset feature flow, and updating asset data features with flow anomaly;

[0063] In the embodiment of the present application, the semi-supervised anomaly detection model is used to detect the flow anomaly of the asset characteristic flow. After obtaining the abnormal flow data of the asset, the flow feature extraction algorithm is used to extract the data features, and the data with features is used as the input of the risk asset feature learning module. The input space and the output space are set to be and Let φ(·; w):χ→Z be a neural network with L hidden layers, where w = {W 1 ,W 2 ,…,W L} is the weighted value, represents n unlabeled samples, Represents m labeled data samples, where γ={-1,+1}, when When , it indicates a known normal sample. Indicates known abnormal samples;

[0064] In the embodiment of the present application, the closed data sphere of the output space Z with the center point c is minimized through training and learning, and the new risk asset feature flow is obtained after training and stored in the feature library, wherein the loss function of the semi-supervised anomaly detection deep learning model is expressed as:

[0065]

[0066] Among them, W l represents the weight, and Represent the data samples of input space and output control respectively, ||.|| F represents the Frobenius norm, λ represents a hyperparameter, and the parameter η>0 is used to control the balance between labeled samples and unlabeled samples. η>1 indicates that labeled samples are more emphasized, and η<1 indicates that unlabeled samples are more emphasized.

[0067] S300: After matching the updated asset data features with feature traffic hash values ​​and comparing them with the feature library, determine whether the asset information has a vulnerability risk, and determine the risk level of the asset;

[0068] In the embodiments of the present application, Figure 3 As shown in the figure, the process of feature library comparison includes:

[0069] Preprocess the updated asset data features, including basic information extraction, hash value conversion, and binary bytecode conversion. During the preprocessing process, identify assets with abnormalities in the basic information and mark them as risky assets;

[0070] The traffic type and traffic protocol are used as search indexes for the feature library. If there is no problem with the traffic, the processed traffic is obtained by removing ARP broadcast traffic, duplicate traffic, and unreachable non-critical traffic.

[0071] When the amount of processed traffic is small, a linear search algorithm is used to find risk points. When the amount of processed traffic is large, a comparison is performed based on the hash value in the feature library. The feature library stores the hash values ​​with labels of risky assets. Only the flow information of the asset needs to be searched and compared. If a hash value with a label is found, the asset is marked as a risky asset.

[0072] It should be noted that the linear search algorithm, that is, traversing the entire data set to find a specific element, can complete the search for most application scenarios when the data volume is between hundreds and thousands of records. However, the data set in this embodiment is frequently updated, so when the amount of data in the processed traffic does not exceed 500, the linear search algorithm is used to find risk points; when the amount of data grows to a certain extent, the hash search can quickly locate the data by calculating the hash value and optimize the system performance. Therefore, when the amount of data in the processed traffic exceeds 500, it is compared according to the hash value in the feature library.

[0073] In an embodiment of the present application, abnormal traffic analysis is performed based on the asset corresponding traffic library and the collected asset traffic data. After receiving the traffic of a pending risk asset or discovering abnormal traffic, it is necessary to compare the pending risk asset with the corresponding traffic of the asset on the blockchain. If the comparison fails, the pending risk asset is positioned as a risky asset. If the comparison is successful, it is positioned as a normal asset.

[0074] In the embodiment of the present application, determining the risk level of an asset includes:

[0075] Risk assets are scanned using various scanning technologies to identify potential security vulnerabilities. Each scanning technology generates a score for each potential vulnerability detected. The formula is:

[0076]

[0077] Where L(x) represents the preliminary vulnerability score of asset x, and d i(x) represents the vulnerability depth assessment of asset x by the i-th technology, α i represents the weight factor of the i-th technology, h j (x) represents the square root of the jth vulnerability severity index, N and M represent the number of different scanning techniques and vulnerability severity indexes, respectively;

[0078] Each identified potential vulnerability is analyzed for severity, and the difficulty, scope, and potential damage of exploitation are calculated. The scores of all individual technologies are combined to form a comprehensive score, expressed as:

[0079]

[0080] Where K represents the number of different evaluation methods, c k and β k Represent the weight factor and adjustment parameter respectively, L k (x) represents K different vulnerability assessment methods;

[0081] After obtaining the comprehensive score of each asset, the risk level of the asset is determined and a risk determination report is generated.

[0082] From the above, it can be seen that the present invention obtains relevant asset information by combining active scanning, passive scanning and log detection, which can collect assets more comprehensively and accurately; on the basis of risk asset identification, the function of asset change monitoring is added, which can perceive asset changes and provide a data basis for abnormal traffic analysis; and the blockchain of the present invention saves conventional standard traffic hash values, and provides a simpler solution for operation and maintenance personnel to change assets. They only need to resubmit a new conventional standard traffic hash value, which ensures the real-time and traceability of asset data; in addition, the present invention, based on having a basic risk library and new abnormal traffic as input, can output a relatively accurate new risky feature value to supplement the feature library, thereby realizing the offline update of the risk asset identification system feature library to ensure the real-time and traceability of asset data.

[0083] The above is a schematic scheme of an industrial control asset risk identification method based on semi-supervised anomaly detection in this embodiment. It should be noted that the technical scheme of the industrial control asset risk identification system based on semi-supervised anomaly detection and the technical scheme of the industrial control asset risk identification method based on semi-supervised anomaly detection belong to the same concept. The details of the technical scheme of the industrial control asset risk identification system based on semi-supervised anomaly detection in this embodiment that are not described in detail can all be referred to the description of the technical scheme of the industrial control asset risk identification method based on semi-supervised anomaly detection.

[0084] This embodiment also provides an industrial control asset risk identification system based on semi-supervised anomaly detection, including:

[0085] The asset collection module is used to obtain relevant asset information by combining active scanning, passive scanning and log detection;

[0086] The asset change monitoring module is used to extract asset characteristic traffic based on relevant asset information, and upload the fixed traffic obtained after multiple traffic detections to the blockchain after encryption through md5. The hash value of the fixed traffic is saved in the blockchain. If the asset needs to be modified or changed, the operation and maintenance personnel need to upload a regular standard traffic hash value for the corresponding asset in the blockchain to update the previous fixed traffic, and set the change label and change personnel;

[0087] A deep learning module is used to detect flow anomalies on asset feature flows using a semi-supervised anomaly detection model and update asset data features with flow anomalies;

[0088] The risk asset identification module is used to determine whether the asset information has vulnerability risks and the risk level of the asset after matching the feature traffic hash value and comparing it with the feature library of the updated asset data features.

[0089] The above-mentioned unit modules may be embedded in or independent of a processor in a computer device in the form of hardware, or may be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to the above-mentioned modules.

[0090] This embodiment also provides a computing device, which includes a processor, a memory, a communication interface, a display screen and an input device connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be achieved through WIFI, an operator network, NFC (near field communication) or other technologies. When the computer program is executed by the processor, a method for identifying industrial control asset risks based on semi-supervised anomaly detection is implemented. The display screen of the computer device can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covered on the display screen, or a key, trackball or touchpad set on the computer device housing, or an external keyboard, touchpad or mouse.

[0091] This embodiment also provides a storage medium on which a computer program is stored. When the program is executed by a processor, the method proposed in the above embodiment is implemented.

[0092] The storage medium proposed in this embodiment and the method proposed in the above embodiment belong to the same inventive concept. The technical details not fully described in this embodiment can be referred to the above embodiment, and this embodiment has the same beneficial effects as the above embodiment.

[0093] Through the above description of the implementation methods, the technicians in the relevant field can clearly understand that the present invention can be implemented by means of software and necessary general hardware, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as a computer floppy disk, read-only memory (ReadOnly, Memory, ROM), random access memory (RandomAccess Memory, RAM), flash memory (FLASH), hard disk or optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform the methods of various embodiments of the present invention.

[0094] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

[0095] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of complete hardware embodiments, complete software embodiments, or embodiments in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code. The scheme in the embodiments of the present application can be implemented in various computer languages, for example, object-oriented programming language Java and literal scripting language JavaScript, etc.

[0096] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0097] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0098] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0099] Although the preferred embodiments of the present application have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0100] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A method for industrial control asset risk identification based on semi-supervised anomaly detection, characterized in that: include: Relevant asset information is obtained by combining active scanning, passive scanning and log detection, and asset characteristic traffic is extracted based on the relevant asset information; Using a semi-supervised anomaly detection model to perform flow anomaly detection on the asset characteristic flow, and updating the asset data features of the flow anomaly; After matching the updated asset data features with feature traffic hash values ​​and comparing them with feature libraries, it is determined whether the asset information has vulnerability risks and the risk level of the assets is determined.

2. The method for industrial control asset risk identification based on semi-supervised anomaly detection according to claim 1, characterized in that: The acquisition of relevant asset information by combining active scanning, passive scanning and log detection includes: Connect the detection device to the switch closest to the target object to be tested. The active scan is to actively send detection traffic to scan all devices in the subnet domain of the target object to be tested, monitor the traffic between industrial control devices in a proxy manner, and link the host scan log to obtain various information related to industrial control assets; The passive scan is to capture and analyze the network traffic flowing through the subnet domain of the target object to be tested by using the monitoring equipment deployed in the network without actively sending any detection traffic, and then identify the industrial control equipment, service type, and protocol usage in the subnet. In combination with the log analysis tool, the collected network traffic data is deeply mined to extract key information related to the security status of industrial control assets; The log detection is to receive log files that can mainly obtain asset information from the target log folder, pre-process the log files, delete the information in service initialization, startup logs, non-critical permission changes and authentication failure steps, parse the log files and search for fields related to asset information.

3. The method for industrial control asset risk identification based on semi-supervised anomaly detection as claimed in claim 2, characterized in that: Also includes: The fixed traffic obtained after multiple traffic detections is uploaded to the blockchain after being encrypted with md5. The blockchain stores the hash value of the fixed traffic. If an asset needs to be modified or changed, the operation and maintenance personnel need to upload a regular standard traffic hash value for the corresponding asset in the blockchain to update the previous fixed traffic, and set the change label and change personnel; Extract asset characteristic traffic based on the relevant asset information, determine whether the hash value of the asset characteristic traffic is consistent with the hash value of the fixed traffic in the blockchain, and then confirm whether the asset characteristic traffic is the inherent traffic characteristic of the asset. If so, it means that the asset has not changed. If not, upload the traffic to the blockchain as the asset's regular standard traffic to determine whether the subsequent asset has changed; Based on the relevant asset information, the asset characteristic flow is extracted again and matched with the latest conventional standard flow corresponding to the asset in the blockchain. If there is no match, the asset is marked as a pending risk asset, and the characteristic flow hash value is matched for further judgment. If there is a match, it is judged whether the conventional standard flow corresponding to the asset in the blockchain has changed, so as to determine whether the asset is an unchanged asset or a changed asset.

4. The industrial control asset risk identification method based on semi-supervised anomaly detection according to claim 1 or 3, characterized in that: The performing flow anomaly detection on the asset characteristic flow using the semi-supervised anomaly detection model comprises: The semi-supervised anomaly detection model is used to detect the flow anomaly of the asset characteristic flow. After obtaining the abnormal flow data of the asset, the flow feature extraction algorithm is used to extract the data features, and the data with features is used as the input of the risk asset feature learning module. The input space and output space are set to be and Let φ(·; w):χ→Z be a neural network with L hidden layers, where w = {W 1 ,W 2 ,…,W L } is the weighted value, represents n unlabeled samples, Represents m labeled data samples, where γ={-1,+1}, when When , it indicates a known normal sample. Indicates known abnormal samples; Through training and learning, the closed data sphere of the output space Z with the center point c is minimized. After learning and training, the new risk asset feature flow is obtained and stored in the feature library. The loss function of the semi-supervised anomaly detection deep learning model is expressed as: Among them, W l represents the weight, and They represent the data samples of input space and output control, respectively.||.|| F represents the Frobenius norm, λ represents a hyperparameter, and the parameter η>0 is used to control the balance between labeled samples and unlabeled samples. η>1 represents more emphasis on labeled samples, and η<1 represents more emphasis on unlabeled samples.

5. The method for industrial control asset risk identification based on semi-supervised anomaly detection as claimed in claim 4, characterized in that: The process of comparing the feature library includes: Preprocessing the updated asset data features, wherein the preprocessing includes basic information extraction, hash value conversion, and binary bytecode conversion, and during the preprocessing process, identifying assets with abnormalities in the basic information and marking them as risky assets; The traffic type and traffic protocol are used as search indexes for the feature library. If there is no problem with the traffic, the processed traffic is obtained by removing ARP broadcast traffic, duplicate traffic, and unreachable non-critical traffic. When the amount of data in the processed traffic is small, a linear search algorithm is used to find risk points. When the amount of data in the processed traffic is large, a comparison is performed according to the hash value in the feature library. The feature library stores hash values ​​with labels for risky assets. It is only necessary to search and compare in the traffic information of the asset. If the labeled hash value is found, the asset is marked as a risky asset.

6. The method for industrial control asset risk identification based on semi-supervised anomaly detection as claimed in claim 5, characterized in that: Also includes: Abnormal traffic analysis is performed based on the asset corresponding traffic library and the collected asset traffic data. After receiving the traffic of a pending risk asset or discovering abnormal traffic, it is necessary to compare the pending risk asset with the corresponding traffic of the asset on the blockchain. If the comparison fails, the pending risk asset is positioned as a risky asset. If the comparison succeeds, it is positioned as a normal asset.

7. The method for industrial control asset risk identification based on semi-supervised anomaly detection as claimed in claim 6, characterized in that: The risk level of the asset is determined as follows: Risk assets are scanned using various scanning technologies to identify potential security vulnerabilities. Each scanning technology generates a score for each potential vulnerability detected. The formula is: Where L(x) represents the preliminary vulnerability score of asset x, and d i (x) represents the vulnerability depth assessment of asset x by the i-th technology, α i represents the weight factor of the i-th technology, h j (x) represents the square root of the jth vulnerability severity index, N and M represent the number of different scanning techniques and vulnerability severity indexes, respectively; Each identified potential vulnerability is analyzed for severity, and the difficulty, scope, and potential damage of exploitation are calculated. The scores of all individual technologies are combined to form a comprehensive score, expressed as: Where K represents the number of different evaluation methods, c k and β k Represent the weight factor and adjustment parameter respectively, L k (x) represents K different vulnerability assessment methods; After obtaining the comprehensive score of each asset, the risk level of the asset is determined and a risk determination report is generated.

8. A system using the industrial control asset risk identification method based on semi-supervised anomaly detection as described in any one of claims 1 to 7, characterized in that: include: The asset collection module is used to obtain relevant asset information by combining active scanning, passive scanning and log detection; The asset change monitoring module is used to extract the asset characteristic flow based on the relevant asset information, and upload the fixed flow obtained after multiple flow detections to the blockchain after encryption through md5. The blockchain stores the hash value of the fixed flow. If the asset needs to be modified or changed, the operation and maintenance personnel need to upload a regular standard flow hash value for the corresponding asset in the blockchain to update the previous fixed flow, and set the change label and change personnel; A deep learning module, used for performing flow anomaly detection on the asset characteristic flow using a semi-supervised anomaly detection model, and updating asset data features of flow anomaly; The risk asset identification module is used to determine whether the asset information has a vulnerability risk and determine the risk level of the asset after matching the feature traffic hash value and comparing it with the feature library of the updated asset data features.

9. An electronic device, comprising: Memory and processor; The memory is used to store computer executable instructions, and the processor is used to execute the computer executable instructions. When the computer executable instructions are executed by the processor, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having computer program instructions stored thereon, wherein the computer-executable instructions, when executed by a processor, implement the steps of the method according to any one of claims 1 to 7.

Images