Equipment network monitoring method and device, equipment and storage medium

Abstract

The invention relates to an equipment network monitoring method and device, computer equipment, a storage medium and a computer program product, and relates to the technical field of information security. The method comprises the following steps: acquiring an associated data packet of an equipment network; under the condition that the associated data packet does not access the equipment network, acquiring original data characteristics of the associated data packet, and monitoring the original data characteristics through a preset white list to obtain a first monitoring result; under the condition that the associated data packet is accessed to the network, obtaining interactive behavior characteristics of the associated data packet after the associated data packet is accessed to the equipment network, and monitoring through a white list to obtain a second monitoring result; obtaining a monitoring result of the equipment network based on the first monitoring result and the second monitoring result; wherein the white list is generated based on an attack chain model corresponding to the equipment network, and the attack chain model is constructed based on historical attack records. By adopting the method, the monitoring accuracy can be improved, and monitoring resources are saved.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a device network monitoring method, apparatus, computer equipment, storage medium and computer program product. Background Art

[0002] With the rapid development of industrial Ethernet technology and computer technology, banks have introduced industrial control computers into various production environments to achieve automated production and improve production efficiency. As the core of the control function of the industrial control system, industrial control computers connect the upper information network and the underlying production network, and face multiple security threats from the external Internet, internal industrial control networks, etc.

[0003] Currently, the measures taken for financial industrial control security monitoring are still based on traditional protection methods such as boundary isolation. The security monitoring of financial industrial control equipment networks is not accurate enough, and the monitoring resources are wasted. Summary of the invention

[0004] Based on this, it is necessary to provide a device network monitoring method, apparatus, computer equipment, computer-readable storage medium and computer program product capable of monitoring a device network in response to the above technical problems.

[0005] In a first aspect, the present application provides a device network monitoring method. The method comprises:

[0006] Get the associated data packets of the device network;

[0007] When the associated data packet is not connected to the device network, original data features of the associated data packet are obtained, and the original data features are monitored through a preset whitelist to obtain a first monitoring result of the associated data packet;

[0008] In the case where the associated data packet has been connected to the device network, obtaining the interaction behavior characteristics of the associated data packet after the associated data packet has been connected to the device network, and monitoring the interaction behavior characteristics through the whitelist to obtain a second monitoring result of the associated data packet;

[0009] Based on the first monitoring result and the second monitoring result, a monitoring result of the device network is obtained; wherein the whitelist is generated based on an attack chain model corresponding to the device network, and the attack chain model is constructed based on historical attack records corresponding to the device network.

[0010] In one embodiment, obtaining the original data features of the associated data packet includes:

[0011] Capture and parse the associated data packets to obtain the target field contents of the associated data packets corresponding to different network layers; use the target field contents as the original data features of the associated data packets.

[0012] In one embodiment, obtaining target field contents of associated data packets corresponding to different network layers includes:

[0013] Obtain the length of the associated data packet from the data frame corresponding to the physical layer of the associated data packet; obtain the source physical address, destination physical address and network layer protocol of the associated data packet from the Ethernet frame corresponding to the link layer of the associated data packet; obtain the source Internet Protocol address, destination Internet Protocol address and transport layer protocol of the associated data packet from the Internet Protocol data packet corresponding to the network layer of the associated data packet; obtain the source port and destination port of the associated data packet from the message corresponding to the transport layer of the associated data packet; obtain the source address, destination address, source port, destination port and command number of the associated data packet corresponding to the industrial control protocol from the industrial control protocol data corresponding to the application layer of the associated data packet;

[0014] The length, source physical address, destination physical address and network layer protocol, source Internet Protocol address, destination Internet Protocol address and transport layer protocol, source port and destination port, as well as the source address, destination address, source port, destination port and command number corresponding to the industrial control protocol are used as the target field contents of associated data packets corresponding to different network levels.

[0015] In one embodiment, the original data features are monitored by a preset whitelist, including:

[0016] Compare the length of the associated data packet with the preset maximum value in the whitelist to see whether it exceeds the preset maximum value;

[0017] If the maximum value is not exceeded, the source physical address, destination physical address and network layer protocol of the associated data packet are compared with the whitelist to see if they are consistent;

[0018] If they are consistent, the source Internet Protocol address, the destination Internet Protocol address and the transport layer protocol of the associated data packet are compared with the whitelist to see if they match;

[0019] In case of a match, the source port and the destination port of the associated data packet are matched with the whitelist;

[0020] If there is a match, the source address, destination address, source port, and destination port of the associated data packet corresponding to the industrial control protocol are matched with the whitelist; if there is a match, the type of the command number and the parsed feature value are obtained, and the whitelist is screened and matched.

[0021] In one embodiment, obtaining the interaction behavior characteristics after the associated data packet accesses the device network includes:

[0022] Event monitoring is performed on the associated data packet after it accesses the device network to obtain the activity event content after the associated data packet accesses the device network; the activity event content is used as the interactive behavior feature after the associated data packet accesses the device network.

[0023] In one embodiment, obtaining the activity event content after the associated data packet accesses the device network includes:

[0024] From the event activity generated by the associated data packet inside the device, the process information, system resources and operation information after the associated data packet accesses the device network are obtained; the process information, system resources and operation information are used as the activity event content.

[0025] In one embodiment, the interactive behavior feature is monitored through the whitelist to obtain a second monitoring result of the associated data packet, including:

[0026] The process information, system resources, and operation information are compared with the whitelist to obtain a second monitoring result of the associated data packet.

[0027] In one of the embodiments, when the first monitoring result is abnormal, the monitoring result of the device network is determined to be abnormal, and the associated data packet is blocked from accessing the device network and an abnormal warning message is sent to relevant personnel; when the first monitoring result is normal and the second monitoring result is abnormal, the monitoring result of the device network is determined to be abnormal, and the interaction of the associated data packet in the device network is interrupted and an abnormal warning message is sent to relevant personnel.

[0028] In one embodiment, the whitelist is constructed by the following steps, including:

[0029] Based on the historical attack records corresponding to the device network, an attack chain model corresponding to the device network is constructed; the attack chain model is used to construct abnormal data packets corresponding to the device network, and the abnormal data packets are connected to the device network to obtain abnormal data characteristics when the abnormal data packets are not connected to the device network, and abnormal interaction behavior characteristics when the abnormal data packets are connected to the device network; according to the abnormal data characteristics, abnormal interaction behavior characteristics and historical normal communication data packets, preset original data characteristics and preset interaction behavior characteristics are obtained; based on the preset original data characteristics and preset interaction behavior characteristics, a preset whitelist is constructed.

[0030] In one embodiment, according to the abnormal data features, the abnormal interaction behavior features and the historical normal communication data packets, the preset original data features and the preset interaction behavior features are obtained, including:

[0031] According to the historical normal communication data packets of the device network, the historical normal communication data packets are connected to the device network to obtain the normal original data characteristics when the historical normal communication data packets are not connected to the device network, and the normal interaction behavior characteristics when the historical normal communication data packets are connected to the device network;

[0032] Compare the normal original data features with the abnormal data features to obtain distinguishing data features, and use the distinguishing data features corresponding to the data features in the normal original data features as the preset original data features;

[0033] The normal interaction behavior features are compared with the abnormal interaction behavior features to obtain the distinguishing interaction behavior features, and the distinguishing interaction behavior features are compared with the behaviors in the normal interaction behavior features as the preset interaction behavior features.

[0034] In a second aspect, the present application also provides a device network monitoring apparatus. The apparatus comprises:

[0035] An acquisition module, used to acquire associated data packets of a device network;

[0036] A first monitoring module, configured to obtain original data features of the associated data packet when the associated data packet is not connected to the device network, and monitor the original data features through a preset whitelist to obtain a first monitoring result of the associated data packet;

[0037] A second monitoring module is used to obtain the interaction behavior characteristics of the associated data packet after the associated data packet has accessed the device network, and monitor the interaction behavior characteristics through a whitelist to obtain a second monitoring result of the associated data packet;

[0038] A result generating module, used for obtaining a monitoring result of the device network based on the first monitoring result and the second monitoring result;

[0039] Among them, the whitelist is generated based on the attack chain model corresponding to the device network, and the attack chain model is constructed based on the historical attack records corresponding to the device network.

[0040] In a third aspect, the present application further provides a computer device. The computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the following steps when executing the computer program:

[0041] Get the associated data packets of the device network;

[0042] When the associated data packet is not connected to the device network, original data features of the associated data packet are obtained, and the original data features are monitored through a preset whitelist to obtain a first monitoring result of the associated data packet;

[0043] In the case where the associated data packet has been connected to the device network, obtaining the interaction behavior characteristics of the associated data packet after the associated data packet is connected to the device network, and monitoring the interaction behavior characteristics through the whitelist to obtain a second monitoring result of the associated data packet;

[0044] Based on the first monitoring result and the second monitoring result, a monitoring result of the device network is obtained; wherein the whitelist is generated based on an attack chain model corresponding to the device network, and the attack chain model is constructed based on historical attack records corresponding to the device network.

[0045] In a fourth aspect, the present application further provides a computer-readable storage medium. The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the following steps are implemented:

[0046] Get the associated data packets of the device network;

[0047] When the associated data packet is not connected to the device network, original data features of the associated data packet are obtained, and the original data features are monitored through a preset whitelist to obtain a first monitoring result of the associated data packet;

[0048] In the case where the associated data packet has been connected to the device network, obtaining the interaction behavior characteristics of the associated data packet after the associated data packet is connected to the device network, and monitoring the interaction behavior characteristics through the whitelist to obtain a second monitoring result of the associated data packet;

[0049] Based on the first monitoring result and the second monitoring result, a monitoring result of the device network is obtained; wherein the whitelist is generated based on an attack chain model corresponding to the device network, and the attack chain model is constructed based on historical attack records corresponding to the device network.

[0050] In a fifth aspect, the present application further provides a computer program product. The computer program product includes a computer program, and when the computer program is executed by a processor, the following steps are implemented:

[0051] Get the associated data packets of the device network;

[0052] When the associated data packet is not connected to the device network, original data features of the associated data packet are obtained, and the original data features are monitored through a preset whitelist to obtain a first monitoring result of the associated data packet;

[0053] In the case where the associated data packet has been connected to the device network, obtaining the interaction behavior characteristics of the associated data packet after the associated data packet is connected to the device network, and monitoring the interaction behavior characteristics through the whitelist to obtain a second monitoring result of the associated data packet;

[0054] Based on the first monitoring result and the second monitoring result, a monitoring result of the device network is obtained; wherein the whitelist is generated based on an attack chain model corresponding to the device network, and the attack chain model is constructed based on historical attack records corresponding to the device network.

[0055] The above-mentioned device network monitoring method, apparatus, computer equipment, storage medium and computer program product construct an attack chain model based on historical attack records, and correspond the attack chain model to the device network to determine the white list of the device network; then based on this white list, the device network is monitored before and after the associated data packets access, so as to realize the monitoring of the device network; compared with the white list verification of all network data, the content of the white list determined by the attack chain model in this application is to perform protection monitoring on the characteristics of the attack chain model, rather than comprehensive protection monitoring of the network, so this application can monitor and protect the device network relatively accurately, improve the monitoring accuracy, and save monitoring resources. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] Figure 1 An application environment diagram of a device network monitoring method in an embodiment;

[0057] Figure 2 A schematic diagram of a flow chart of a device network monitoring method in one embodiment;

[0058] Figure 3 A schematic diagram of a flow chart of a device network monitoring method in another embodiment;

[0059] Figure 4 is a structural block diagram of a device network monitoring system in one embodiment;

[0060] Figure 5 A schematic diagram of a whitelist in a device network monitoring method in an embodiment;

[0061] Figure 6 A schematic diagram of a flow chart of a device network monitoring method in another embodiment;

[0062] Figure 7 is a structural block diagram of a device network monitoring apparatus in one embodiment;

[0063] Figure 8 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0064] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0065] The device network monitoring method provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown. Among them, the device 102 communicates with the server 104 through the network. The data storage system can store the data that the server 104 needs to process. The data storage system can be integrated on the server 104, or it can be placed on the cloud or other network servers. The server 104 obtains the associated data packet with the device 102 network. When the associated data packet is not connected to the device 102 network, the server 104 obtains the original data characteristics of the associated data packet, monitors the original data characteristics through the preset white list, and obtains the first monitoring result; when the associated data packet is connected to the device 102 network, the server 104 obtains the interactive behavior characteristics after the associated data packet is connected, monitors the interactive behavior characteristics through the preset white list, and obtains the second monitoring result. The monitoring result of the device 102 network is obtained based on the first monitoring result and the second monitoring result. Among them, the device 102 can be various industrial control equipment under the banking system, such as consulting machines, business machines, monitoring machines, etc. The server 104 can be implemented with an independent server or a server cluster consisting of multiple servers.

[0066] In one embodiment, Figure 2 As shown, a device network monitoring method is provided, which is applied to Figure 1 The server in the example is used to illustrate the following steps:

[0067] Step S202, obtaining the associated data packet of the device network.

[0068] Among them, the equipment can be industrial control equipment used in the financial industry, referred to as financial industrial control equipment, which is usually used in the automation system of financial institutions, including automatic teller machines, card swiping terminals, payment terminals, automatic storage machines, etc. The financial industrial control equipment network can refer to the network that connects these devices together, or it can refer to the network that connects these devices with the external Internet and the internal upper network. The associated data packet can be a data packet composed of information such as requests issued by other devices when accessing the financial industrial control equipment network, or it can be a communication data packet transmitted by the external Internet, or it can be a control data packet issued by the upper network. The server can capture the financial industrial control equipment network communication data packet in real time through the mirror port of the industrial control system; it can also use professional network monitoring tools to capture and analyze data packets on the financial industrial control equipment network. These tools can monitor network traffic through network cards or network devices, and save the captured data packets for subsequent analysis; it can also use special network packet capture equipment to insert it into the financial industrial control equipment network to capture and record network communication data packets.

[0069] Step S204, when the associated data packet is not connected to the device network, the original data features of the associated data packet are obtained, and the original data features are monitored through a preset whitelist to obtain a first monitoring result of the associated data packet.

[0070] Among them, the original data characteristics may refer to the characteristics or attributes of the data in the associated data packet before any processing or conversion, that is, the data characteristics or attributes before the associated data packet is connected to the financial industrial control equipment network for data interaction, such as data type, data range, etc.; when the associated data packet is not connected to the financial industrial control equipment network, that is, the associated data packet flows to the financial industrial control equipment network, the server obtains the data packet in time before it is connected to the financial industrial control equipment network, and parses it to obtain the original data characteristics of the associated data packet; the whitelist is a network security mechanism used to limit access to the system, network or resources to only specific users, devices or programs. The preset whitelist The principle is to define the entities that are allowed to access in advance. Only the entities in the whitelist can be authorized and allowed to access. For example, in the field of network security, a preset whitelist can limit access to specific Internet Protocol addresses or Internet Protocol address ranges at the network level. Only Internet Protocol addresses listed in the whitelist can access restricted resources through firewalls or routers; access to specific users or user groups can be restricted at the application level. Only users or user groups listed in the whitelist can log in, access or execute specific applications or functions; the execution of specific programs or processes can also be restricted at the program level. Only programs or processes listed in the whitelist can be executed by the system, and other programs or processes will be blocked. The aforementioned raw data features are monitored by the preset whitelist, and the comparison and matching are checked to see if there is any data content inconsistent with the whitelist, so as to obtain the first monitoring result.

[0071] Step S206, when the associated data packet has accessed the device network, obtain the interaction behavior characteristics of the associated data packet after accessing the device network, and monitor the interaction behavior characteristics through the whitelist to obtain a second monitoring result of the associated data packet.

[0072] Among them, the interactive behavior may refer to a series of communication behaviors, data interaction and other activities performed by the associated data packet after it is connected to the financial industrial control equipment network; after the associated data packet is connected to the financial industrial control equipment network, the server may collect and store the activity event content generated after the associated data packet is connected to the financial industrial control equipment network through the network event monitoring tool. The server verifies the collected activity event content through the whitelist to obtain the second monitoring result, and can promptly discover abnormal activity events, and can prevent them through relevant modules.

[0073] Step S208: obtaining a monitoring result of the device network based on the first monitoring result and the second monitoring result.

[0074] Among them, the whitelist is generated based on the attack chain model corresponding to the device network, and the attack chain model is constructed based on the historical attack records corresponding to the device network.

[0075] It should be understood that if any of the first monitoring result and the second monitoring result is abnormal, the monitoring result of the financial industrial control equipment network is abnormal. The attack chain may refer to a series of steps or stages taken by an attacker when carrying out an attack. The attack chain model of the present application is constructed based on the idea of ​​the attack chain. The server analyzes and counts the historical attack records of the financial industrial control equipment network to establish an attack chain model with a relatively comprehensive attack method and attack path. Through the attack chain model and the simulated attack test of the financial industrial control equipment network, the weak parts or links corresponding to the financial industrial control equipment network are obtained, so as to determine the content that needs to be protected by the whitelist. The content may be, for example, the original data features corresponding to the associated data packets before accessing the financial industrial control equipment network in the attack chain model, and the interactive behavior features corresponding to the associated data packets after accessing the financial industrial control equipment network in the attack chain model.

[0076] In the above-mentioned device network monitoring method, an attack chain model is constructed based on historical attack records, and the attack chain model is corresponded to the device network to determine the white list of the device network; then, based on this white list, the device network is monitored before and after the associated data packets access, so as to realize the monitoring of the device network; compared with the white list verification of all network data, the content of the white list determined by the attack chain model in this application is to protect the characteristics of the attack chain model, rather than to protect the entire network, so this application can monitor and protect the device network relatively accurately, which has the effect of improving the monitoring accuracy and saving monitoring resources.

[0077] In one embodiment, obtaining the original data features of the associated data packets includes: capturing and parsing the associated data packets, obtaining the target field contents of the associated data packets corresponding to different network layers, and using the target field contents as the original data features of the associated data packets.

[0078] Among them, the process of the server capturing and parsing the associated data packets can be to use a crawler program or a data crawler tool to obtain the original data, then clean and pre-process the data, and then use appropriate parsing techniques to convert the data into a readable and processable form based on the structure and format of the data, and then extract the required information or target field content from the parsed data based on the monitoring requirements, which can be the content requirements corresponding to the whitelist that needs to be monitored. The information or target field content can be specific fields, tags, keywords or other structured data.

[0079] In this embodiment, by obtaining the target field contents corresponding to different network levels in the associated data packets so as to analyze the original data characteristics in the associated data packets, it is possible to preliminarily determine whether there are any abnormalities in the associated data packets. By monitoring by obtaining the target field contents corresponding to different network levels, the device network can be monitored more accurately.

[0080] In one embodiment, obtaining the target field contents of the associated data packets corresponding to different network layers includes: obtaining the length of the associated data packets from the data frames corresponding to the physical layer of the associated data packets. Obtaining the source physical address, destination physical address and network layer protocol of the associated data packets from the Ethernet frames corresponding to the link layer of the associated data packets. Obtaining the source Internet Protocol address, destination Internet Protocol address and transport layer protocol of the associated data packets from the Internet Protocol data packets corresponding to the network layer of the associated data packets. Obtaining the source port and destination port of the associated data packets from the message corresponding to the transport layer of the associated data packets. Obtaining the source address, destination address, source port, destination port and command number of the associated data packets corresponding to the industrial control protocol from the industrial control protocol data corresponding to the application layer of the associated data packets. The length, source physical address, destination physical address and network layer protocol, source Internet Protocol address, destination Internet Protocol address and transport layer protocol, source port and destination port and the source address, destination address, source port, destination port and command number corresponding to the industrial control protocol are used as the target field contents of the associated data packets corresponding to different network layers.

[0081] Among them, the physical layer is the lowest layer in the network hierarchy and is responsible for transmitting the original bit stream. The link layer is located above the physical layer and is responsible for transmitting data frames between directly connected nodes. The data link layer usually uses physical addresses to identify network devices. The network layer is the core layer in the network hierarchy and is responsible for routing and forwarding between networks. It handles the routing, addressing and grouping of data packets to ensure that data can be transmitted between different networks. The network layer uses Internet Protocol addresses to identify network devices and networks. The transport layer is located above the network layer and is responsible for end-to-end data transmission. The transport layer uses port numbers to identify different applications and services. The application layer is the highest layer in the network hierarchy and is responsible for communication and data exchange between applications. The application layer uses various protocols and standards to implement different application requirements. The length of the data packet can be the value of the data packet flow. The industrial control protocol can refer to a communication protocol used for communication between devices in an industrial control system. In this embodiment, it can refer to a communication protocol used for financial industrial control devices in a financial industrial control system. In this embodiment, the server can use protocol deep parsing technology to obtain information corresponding to different network layers of associated data packets. It should be understood that, corresponding to the whitelist, the target field content of the associated data packets corresponding to different layers can be as shown above.

[0082] In this embodiment, by acquiring information of associated data packets corresponding to different network layers, the information to be monitored can be made more detailed, thereby improving the accuracy of monitoring.

[0083] In one embodiment, Figure 3 As shown, the original data features are monitored through a preset whitelist, including:

[0084] Step S302: Compare the length of the associated data packet with a preset maximum value in the whitelist to see whether it exceeds the preset maximum value.

[0085] Among them, the server can determine the preset maximum value based on the flow size of historical data packets and the flow size that the financial industrial control equipment network can bear, so as to avoid malicious malformed data packets from causing paralysis of financial industrial control network equipment.

[0086] Step S304: If the maximum value is not exceeded, the source physical address, destination physical address and network layer protocol of the associated data packet are compared with the white list to see if they are consistent. If they are consistent, the source Internet Protocol address, destination Internet Protocol address and transport layer protocol of the associated data packet are compared with the white list to see if they are consistent. If they are consistent, the source port and destination port of the associated data packet are matched with the white list.

[0087] Among them, in the above-mentioned comparison process, if the current step is judged to be inconsistent with the preset value in the whitelist, it can be considered that there is an abnormality and an early warning is issued; the address, protocol and port can be fully verified for matching. If any one of them is not met, there is no corresponding whitelist, and the corresponding address, protocol or port can be considered abnormal.

[0088] Step S306, if there is a match, match the source address, destination address, source port, and destination port of the associated data packet corresponding to the industrial control protocol with the whitelist; if there is a match, obtain the type of the command number and the parsed feature value, and filter and match with the whitelist.

[0089] The parsed feature value can be used to represent the feature of the command number, so that a whitelist can be used to perform feature matching verification.

[0090] In this embodiment, the information corresponding to different network layers in the associated data packets is verified in layers through a whitelist. When an abnormality is found in the partial verification of the information at any layer, it can be considered that an abnormality has occurred and an early warning is issued, thereby saving monitoring time and improving monitoring efficiency.

[0091] In one embodiment, obtaining the interactive behavior characteristics after the associated data packet accesses the device network includes: monitoring the events after the associated data packet accesses the device network, obtaining the content of the activity events after the associated data packet accesses the device network, and using the content of the activity events as the interactive behavior characteristics after the associated data packet accesses the device network.

[0092] Among them, event monitoring may refer to the process of real-time monitoring and recording of events occurring in the system, application or network. The server may collect the content of active events occurring in the financial industrial control equipment network through various monitoring tools and techniques. In one embodiment, the content of the active event may be the process information, system resources and operation information after the associated data packet is connected to the financial industrial control equipment network. Accordingly, in one embodiment, the monitoring process may be to monitor the interactive behavior characteristics through a whitelist to obtain a second monitoring result of the associated data packet, including: comparing the process information, system resources and operation information with the whitelist to obtain the second monitoring result of the associated data packet. Among them, comparing the process information, system resources and operation information with the whitelist may be to extract the corresponding feature values ​​of the process information, system resources and operation information through a pre-trained model to compare with the whitelist, and the range interval of the feature values ​​in the whitelist may be determined by the pre-trained model and the corresponding historical data.

[0093] In the above embodiment, by monitoring the process information, system resources and operation information of the associated data packets after accessing the device network through the whitelist, abnormal activities can be discovered in time to reduce the losses caused by abnormal activities.

[0094] In one embodiment, the device network monitoring method includes: when the first monitoring result is abnormal, determining the monitoring result of the device network is abnormal, preventing the associated data packet from accessing the device network, and sending abnormal warning information to relevant personnel. When the first monitoring result is normal and the second monitoring result is abnormal, determining the monitoring result of the device network is abnormal, interrupting the interaction of the associated data packet in the device network, and sending abnormal warning information to relevant personnel.

[0095] In this embodiment, by sending abnormal warning information to relevant personnel, the relevant personnel can be informed of the abnormal situation in time and take corresponding measures to reduce the possible losses.

[0096] In one embodiment, the whitelist is constructed by the following steps, including: constructing an attack chain model corresponding to the device network based on the historical attack records corresponding to the device network. Using the attack chain model to construct an abnormal data packet corresponding to the device network, connecting the abnormal data packet to the device network, obtaining abnormal data features when the abnormal data packet is not connected to the device network, and abnormal interactive behavior features when the abnormal data packet is connected to the device network. According to the historical normal communication data packet of the device network, the historical normal communication data packet is connected to the device network, and the normal original data features when the historical normal communication data packet is not connected to the device network are obtained, and the normal interactive behavior features when the historical normal communication data packet is connected to the device network. Compare the normal original data features with the abnormal data features to obtain distinguishing data features, and use the distinguishing data features corresponding to the data features in the normal original data features as the preset original data features. Compare the normal interactive behavior features with the abnormal interactive behavior features to obtain distinguishing interactive behavior features, and use the distinguishing interactive behavior features corresponding to the behavior features in the normal interactive behavior features as the preset interactive behavior features. Based on the preset original data features and the preset interactive behavior features, a preset whitelist is constructed.

[0097] Among them, the abnormal data feature can refer to the data feature captured and parsed from all the data in the abnormal data packet; the abnormal interactive behavior feature can refer to the content of all active events generated after the abnormal data packet is connected to the financial industrial control equipment; the normal original data feature can be all data features obtained based on the historical normal communication data packet; the normal interactive behavior feature can be all the content of active events after the historical normal communication data packet is connected to the financial industrial control equipment network; the above-mentioned feature acquisition method can refer to the acquisition method in the aforementioned embodiment, which will not be repeated here. Therefore, by comparing the abnormal data feature with the normal original data feature, the distinguished data features can be screened out. The data feature is the data feature part with specific abnormalities, and the part of the normal original data feature corresponding to the data feature can be screened out as the preset original data feature. Similarly, the preset interactive behavior feature can be obtained after comparing and screening the abnormal interactive behavior feature with the normal interactive behavior feature; a preset whitelist can be constructed based on the preset original data and the preset interactive behavior feature.

[0098] In this embodiment, an attack chain model is constructed through historical attack records, and an abnormal data packet is constructed corresponding to the device network through the attack chain model. Then, the abnormal data packet and the historical normal data packet are compared with the two stages before and after the access to the device network to obtain different related features, namely, abnormal features that may be attacks, and the historical normal features corresponding to the abnormal features that may be attacks are used to construct a whitelist; the whitelist construction method of the present application is based on the attack chain model, and can determine the places that need targeted protection through the whitelist. Compared with full network protection, it can save monitoring resources and improve monitoring efficiency.

[0099] In a specific embodiment, the present application can be applied to financial industrial control equipment, and its system structure framework is as follows: Figure 3 As shown, in the system structure, the attack chain preset module is mainly used to set the attack chain stage model and generate the whitelist rule base for each stage of the attack chain. The attack chain feature collection module is responsible for maintaining the data collection configuration function, such as the time period of collection, etc. It is responsible for automatically collecting the feature attributes of each stage of the attack chain according to the collection configuration requirements, and storing them in the feature database. The automatic monitoring module adopts a detection method based on abnormal behavior and realizes automatic monitoring based on the security detection technology of the whitelist. It promptly detects abnormal attack behaviors by matching the feature attributes automatically collected in the feature collection stage with the expected whitelist rule base. The active early warning module is used to predict the security situation of financial industrial control equipment in real time. The active response module enables timely decision-making when the precursor features of suspicious attack behaviors occur. The event recording module provides the ability to trace industrial control security incidents; the network monitoring process of financial industrial control equipment is as follows: Figure 5 As shown, it may include:

[0100] Obtain the associated data packets of the financial industrial control equipment network; wherein, the industrial control network communication data packets can be captured in real time through the industrial control system mirror port, and then the packet capture technology and protocol deep analysis technology are used to automatically realize the collection of characteristic data in the stage of network access to the industrial control equipment, and the key target field content is extracted layer by layer from the physical layer to the application layer when the associated data packet is not connected to the financial industrial control equipment network: that is, from the data frame corresponding to the physical layer of the associated data packet, the length of the associated data packet is obtained; the capture time and length of the data packet can be first analyzed from the data frame of the physical layer; the source physical address, destination physical address and network layer protocol of the associated data packet are obtained from the Ethernet frame corresponding to the link layer of the associated data packet; the source physical and destination physical addresses and the protocol type of the network layer can be analyzed from the Ethernet frame of the data link layer. Since the communication channel in the industrial control system is single and the protocol used is single, the upper layer protocol type field value is analyzed from the Ethernet frame of the data link layer. If the field value is 0x0800, that is, the Internet Protocol version 4 protocol, the network layer Internet Protocol data packet is continued to be analyzed. If not, the upper layer protocol field type is recorded. From the Internet Protocol data packet corresponding to the network layer of the associated data packet, the source Internet Protocol address, the destination Internet Protocol address and the transport layer protocol of the associated data packet can be obtained; the source Internet Protocol, the destination Internet Protocol address and the protocol type of the upper layer protocol can be parsed from the Internet Protocol data packet of the network layer. If the upper layer protocol number is 06 (Transmission Control Protocol), the transport layer transmission control protocol message is continued to be parsed. If not, the upper layer protocol field type is recorded. From the message corresponding to the transport layer of the associated data packet, the source port and the destination port of the associated data packet are obtained; from the industrial control protocol data corresponding to the application layer of the associated data packet, the source address, destination address, source port, destination port and command number of the industrial control protocol corresponding to the associated data packet are obtained. The application layer industrial control protocol can be parsed, and the destination address, destination port, source address, source port and command number of the industrial control protocol can be extracted based on the characteristic data model of the network access financial industrial control equipment stage corresponding to the predefined industrial control protocol. The content of the application layer protocol data field is parsed according to the value of the command number.

[0101] In the industrial control equipment automation monitoring module, the monitoring rules for actively monitoring the associated data packets accessing financial industrial control equipment based on the whitelist are as follows: compare the length of the associated data packet with the preset maximum value in the whitelist to see if it exceeds the preset maximum value. If it exceeds, an early warning is issued, which may be a malicious malformed data packet constructed by an attacker. If it does not exceed the maximum value, compare the source physical address, destination physical address and network layer protocol of the associated data packet with the whitelist to see if they are consistent; if they are consistent, compare the source Internet Protocol address, destination Internet Protocol address and transport layer protocol of the associated data packet with the whitelist to see if they match; if they match, match the source port and destination port of the associated data packet with the whitelist; among them, if the above-mentioned source physical address, destination physical address, source Internet Protocol address, destination Internet Protocol address, source port and destination port do not meet the requirements of the whitelist, there may be a newly connected working node or other ports are used for communication, and an early warning is required. If there is a match, the source address, destination address, source port, and destination port of the associated data packet corresponding to the industrial control protocol are matched with the whitelist; if there is a match, the type of the command number and the parsed feature value are obtained, and the whitelist is screened and matched to obtain the first monitoring result of the associated data packet.

[0102] When the associated data packet has been connected to the financial industrial control equipment network, the process information, system resources and operation information of the associated data packet after it is connected to the financial industrial control equipment network are obtained from the event activities corresponding to the associated data packet inside the financial industrial control equipment; it can be based on the characteristic data indicators of the destruction phase of the intrusion into the industrial control equipment, and the WMI technology is used to automatically collect the characteristic data inside the industrial control equipment. The extended class tools defined by WMI and the event monitoring function it provides are used to automatically collect process information, system resources, and operation information of power supplies and equipment in industrial control equipment. The collection results are stored in the corresponding disk file in the form of a list. Among them, WMI is a Microsoft system management technology, and its full name is Windows Management Instrumentation, which is Microsoft System Management Specification.

[0103] The process information, system resources and operation information are compared with the whitelist to obtain the second monitoring result of the associated data packet. The process information, system resources and operation information can be matched with the corresponding whitelist rules to determine whether they are consistent with the expected value. If they are inconsistent with the expected value, it is determined that the associated data packet after accessing the financial industrial control equipment network is abnormal, and an early warning is issued. Through the abnormal detection at this stage, it can be found whether there is a performance bottleneck in the financial industrial control equipment, whether the necessary system patches are updated, whether the process is a Trojan process or whether the process is maliciously opened and closed, whether the financial industrial control equipment has opened unnecessary services, whether the industrial control data has been maliciously tampered with, etc.

[0104] Based on the first monitoring result and the second monitoring result, the monitoring result of the financial industrial control equipment network is obtained. When the first monitoring result is abnormal, the monitoring result of the financial equipment network is determined to be abnormal, and the associated data packet is blocked from accessing the financial industrial control equipment network and abnormal warning information is sent to relevant personnel; when the first monitoring result is normal and the second monitoring result is abnormal, the monitoring result of the financial industrial control equipment network is determined to be abnormal, and the interactive behavior of the associated data packet in the financial industrial control equipment network is interrupted and abnormal warning information is sent to relevant personnel. The active early warning module can provide early warning information to the administrator in real time and visualize it, and the active response module can organize abnormal network communication behaviors in a timely manner. Among them, the security visualization module can be divided into abnormal display of data and abnormal display of internal assets of industrial control equipment.

[0105] Among them, in the active warning module, according to the whitelist, warning rules for each stage of the attack chain can be set. For example, some warning rules for financial industrial control equipment can be described as: [Action:Alert / Deny][T_name:not in filename][T_path:not equal T_name.filepath][T_hash:not equal T_name.hash], where Action represents the warning action, Alert represents the execution of the warning action, Deny represents the non-execution of the warning action, T_name represents the collected industrial control device file name, not in filename represents the industrial control device file name is not in the list, T_path represents the path of the industrial control device file, not equal T_name.filepath represents the file path of the industrial control device file is inconsistent with the file path corresponding to the collected industrial control device file name, T_hash represents the measurement value of the industrial control device file, not equal T_name.hash represents the measurement value of the industrial control device file is inconsistent with the measurement value corresponding to the collected industrial control device file name. The event recording module provides the ability to trace industrial control security events.

[0106] Among them, based on the historical attack records corresponding to the financial industrial control equipment network, an attack chain model corresponding to the financial industrial control equipment network is constructed. The attack chain model is used to construct an abnormal data packet corresponding to the financial industrial control equipment network, and the abnormal data packet is connected to the financial industrial control equipment network to obtain the abnormal data characteristics when the abnormal data packet is not connected to the financial industrial control equipment network, and the abnormal interactive behavior characteristics when the abnormal data packet is connected to the financial industrial control equipment network. According to the historical normal communication data packet of the financial industrial control equipment network, the historical normal communication data packet is connected to the financial industrial control equipment network to obtain the normal original data characteristics when the historical normal communication data packet is not connected to the financial industrial control equipment network, and the normal interactive behavior characteristics when the historical normal communication data packet is connected to the financial industrial control equipment network. The normal original data characteristics are compared with the abnormal data characteristics to obtain the distinguishing data characteristics, and the distinguishing data characteristics are used as the data characteristics in the normal original data characteristics as the preset original data characteristics. The normal interactive behavior characteristics are compared with the abnormal interactive behavior characteristics to obtain the distinguishing interactive behavior characteristics, and the distinguishing interactive behavior characteristics are used as the behavior characteristics in the normal interactive behavior characteristics as the preset interactive behavior characteristics. Based on the preset original data characteristics and the preset interactive behavior characteristics, a preset whitelist is constructed.

[0107] Among them, the whitelist corresponding to some preset raw data features can be specifically as follows Figure 4 As shown, the basic part can be represented by [serial number 1, source physical address, destination physical address, source Internet protocol, destination Internet protocol, source port, destination port]; the industrial control protocol feature part can be represented by [serial number 2, industrial control protocol source address, industrial control protocol source port, industrial control protocol destination address, industrial control protocol destination port, command number, serial number 1]; the command parsing part can be represented by [serial number 3, data, serial number 2].

[0108] Based on the whitelist constructed by the above method, a whitelist update method is provided to scan each record in the normal communication data packet set. And the following operations are performed on each record: first, the length information of the data packet is obtained and compared with the preset length value. If it is greater than the preset length value, the length of the data packet is updated to the preset length value. Then, the values ​​of the characteristic indicators source physical address, destination physical address, source Internet protocol, destination Internet protocol, source port, and destination port are obtained, and matched with the whitelist corresponding to the above-mentioned part of the preset original data features. If the rule does not exist, the characteristic indicator value is recorded to the basic characteristic whitelist. Continue to determine the application layer protocol type. Based on the industrial control protocol type, obtain the characteristic indicators of the industrial control protocol application layer: the source address and source port of the industrial control protocol, the destination address and destination port of the industrial control protocol, and the value of the command number. If the industrial control protocol whitelist does not have this rule, update the rule to the industrial control protocol whitelist. Finally, determine the command type of the command number, and obtain the data content of the data field (such as device status, data length, etc.) according to the command number. If the command parsing feature whitelist does not have this rule, it is updated. In this way, the construction of the corresponding protocol whitelist is automatically completed. Then, based on expert experience rules, the characteristic data content of normal communication data packets after accessing the financial industrial control equipment network is collected to complete the construction of the characteristic data indicator whitelist at this stage.

[0109] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0110] Based on the same inventive concept, the embodiment of the present application also provides a device network monitoring apparatus for implementing the device network monitoring method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more device network monitoring apparatus embodiments provided below can refer to the limitations of the device network monitoring method above, and will not be repeated here.

[0111] In one embodiment, Figure 7 As shown, a device network monitoring apparatus is provided, including: an acquisition module 701, a first monitoring module 702, a second monitoring module 703 and a result generation module 704, wherein:

[0112] The acquisition module 701 is used to acquire the associated data packets of the device network.

[0113] The first monitoring module 702 is used to obtain the original data features of the associated data packet when the associated data packet is not connected to the device network, and monitor the original data features through a preset whitelist to obtain a first monitoring result of the associated data packet.

[0114] The second monitoring module 703 is used to obtain the interaction behavior characteristics of the associated data packet after accessing the device network when the associated data packet has accessed the device network, and monitor the interaction behavior characteristics through the whitelist to obtain the second monitoring result of the associated data packet.

[0115] The result generating module 704 is used to obtain the monitoring result of the device network based on the first monitoring result and the second monitoring result.

[0116] Among them, the whitelist is generated based on the attack chain model corresponding to the device network, and the attack chain model is constructed based on the historical attack records corresponding to the device network.

[0117] In one embodiment, the first monitoring module 702 is further used to capture and parse the associated data packets, obtain the target field contents of the associated data packets corresponding to different network layers, and use the target field contents as the original data features of the associated data packets.

[0118] In one embodiment, the first monitoring module 702 is further used to obtain the length of the associated data packet from the data frame of the physical layer corresponding to the associated data packet; obtain the source physical address, destination physical address and network layer protocol of the associated data packet from the Ethernet frame of the link layer corresponding to the associated data packet; obtain the source Internet Protocol address, destination Internet Protocol address and transport layer protocol of the associated data packet from the Internet Protocol data packet of the network layer corresponding to the associated data packet; obtain the source port and destination port of the associated data packet from the message of the transport layer corresponding to the associated data packet; obtain the source address, destination address, source port, destination port and command number of the associated data packet corresponding to the industrial control protocol from the industrial control protocol data of the application layer corresponding to the associated data packet; and use the length, source physical address, destination physical address and network layer protocol, source Internet Protocol address, destination Internet Protocol address and transport layer protocol, source port and destination port and the source address, destination address, source port, destination port and command number corresponding to the industrial control protocol as the target field content of the associated data packet corresponding to different network layers.

[0119] In one embodiment, the first monitoring module 702 is also used to compare the length of the associated data packet with a preset maximum value in the whitelist to see whether it exceeds the preset maximum value; if it does not exceed the maximum value, the source physical address, destination physical address and network layer protocol of the associated data packet are compared with the whitelist to see if they are consistent; if they are consistent, the source Internet Protocol address, destination Internet Protocol address and transport layer protocol of the associated data packet are compared with the whitelist to see if they match; if they match, the source port and destination port of the associated data packet are matched with the whitelist; if there is a match, the source address, destination address, source port and destination port of the associated data packet corresponding to the industrial control protocol are matched with the whitelist; if there is a match, the type of the command number and the parsed feature value are obtained, and the whitelist is screened and matched.

[0120] In one embodiment, the second monitoring module 703 is also used to monitor events after the associated data packet accesses the device network, obtain the activity event content after the associated data packet accesses the device network; and use the activity event content as the interactive behavior feature after the associated data packet accesses the device network.

[0121] In one embodiment, the second monitoring module 703 is also used to obtain the process information, system resources and operation information after the associated data packet accesses the device network from the event activity generated by the associated data packet inside the device; and use the process information, system resources and operation information as the activity event content.

[0122] In one embodiment, the second monitoring module 703 is further used to compare the process information, system resources and operation information with the whitelist to obtain a second monitoring result of the associated data packet.

[0123] In one embodiment, the device network monitoring apparatus further includes a response warning module, which is used to determine that the monitoring result of the device network is abnormal when the first monitoring result is abnormal, and to prevent associated data packets from accessing the device network and to send abnormal warning information to relevant personnel; when the first monitoring result is normal and the second monitoring result is abnormal, determine that the monitoring result of the device network is abnormal, and to interrupt the interaction of associated data packets in the device network and to send abnormal warning information to relevant personnel.

[0124] In one embodiment, the device network monitoring device further includes a construction module, which is used to construct an attack chain model corresponding to the device network based on the historical attack records corresponding to the device network; use the attack chain model to construct an abnormal data packet corresponding to the device network, connect the abnormal data packet to the device network, obtain the abnormal data characteristics when the abnormal data packet is not connected to the device network, and the abnormal interactive behavior characteristics when the abnormal data packet is connected to the device network; according to the historical normal communication data packet of the device network, connect the historical normal communication data packet to the device network, obtain the normal original data characteristics when the historical normal communication data packet is not connected to the device network, and the normal interactive behavior characteristics when the historical normal communication data packet is connected to the device network; compare the normal original data characteristics with the abnormal data characteristics to obtain distinguishing data characteristics, and use the distinguishing data characteristics corresponding to the data characteristics in the normal original data characteristics as the preset original data characteristics; compare the normal interactive behavior characteristics with the abnormal interactive behavior characteristics to obtain distinguishing interactive behavior characteristics, and use the distinguishing interactive behavior characteristics corresponding to the behavior characteristics in the normal interactive behavior characteristics as the preset interactive behavior characteristics. Based on the preset original data characteristics and the preset interactive behavior characteristics, a preset whitelist is constructed.

[0125] Each module in the above-mentioned equipment network monitoring device can be implemented in whole or in part by software, hardware and their combination. Each module can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory in the computer device in the form of software, so that the processor can call and execute the corresponding operations of each module above.

[0126] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 7 As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. The processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store data generated during the network monitoring process. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a device network monitoring method is implemented.

[0127] Those skilled in the art will understand that Figure 7 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0128] In one embodiment, a computer device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above method embodiments when executing the computer program.

[0129] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0130] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0131] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards of relevant countries and regions.

[0132] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0133] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0134] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A device network monitoring method, characterized in that: The method comprises: Get the associated data packets of the device network; When the associated data packet is not connected to the device network, original data features of the associated data packet are acquired, and the original data features are monitored through a preset whitelist to obtain a first monitoring result of the associated data packet; In the case where the associated data packet has accessed the device network, acquiring an interactive behavior feature of the associated data packet after accessing the device network, and monitoring the interactive behavior feature through the whitelist to obtain a second monitoring result of the associated data packet; Based on the first monitoring result and the second monitoring result, a monitoring result of the device network is obtained; wherein the whitelist is generated based on an attack chain model corresponding to the device network, and the attack chain model is constructed based on historical attack records corresponding to the device network.

2. The method according to claim 1, characterized in that The obtaining of original data features of the associated data packet includes: Capturing and parsing the associated data packets to obtain target field contents of the associated data packets corresponding to different network layers; The target field content is used as the original data feature of the associated data packet.

3. The method according to claim 2, characterized in that The obtaining of target field contents of the associated data packets corresponding to different network layers includes: Acquire the length of the associated data packet from a data frame of the physical layer corresponding to the associated data packet; Acquire the source physical address, destination physical address and network layer protocol of the associated data packet from the Ethernet frame corresponding to the link layer of the associated data packet; Acquire the source Internet Protocol address, the destination Internet Protocol address and the transport layer protocol of the associated data packet from the Internet Protocol data packet of the network layer corresponding to the associated data packet; Acquire the source port and the destination port of the associated data packet from the message corresponding to the transport layer of the associated data packet; From the industrial control protocol data corresponding to the application layer of the associated data packet, obtain the source address, destination address, source port, destination port and command number of the associated data packet corresponding to the industrial control protocol; The length, the source physical address, the destination physical address and the network layer protocol, the source Internet Protocol address, the destination Internet Protocol address and the transport layer protocol, the source port and the destination port, and the source address, destination address, source port, destination port and command number corresponding to the industrial control protocol are used as the target field contents of the associated data packet corresponding to different network levels.

4. The method according to claim 3, characterized in that The monitoring of the original data features by using a preset whitelist includes: Compare the length of the associated data packet with a preset maximum value in the whitelist to see whether it exceeds the preset maximum value; If the maximum value is not exceeded, comparing the source physical address, the destination physical address and the network layer protocol of the associated data packet with the whitelist to see if they are consistent; If they are consistent, comparing the source Internet Protocol address, the destination Internet Protocol address and the transport layer protocol of the associated data packet with the whitelist to see if they are consistent; In the case of a match, matching the source port and the destination port of the associated data packet with the whitelist; If there is a match, the source address, destination address, source port, and destination port of the associated data packet corresponding to the industrial control protocol are matched with the whitelist; if there is a match, the type of the command number and the parsed feature value are obtained, and filtered and matched with the whitelist.

5. The method according to claim 1, characterized in that: The acquiring of the interactive behavior characteristics of the associated data packet after accessing the device network includes: Event monitoring is performed on the associated data packet after it accesses the device network to obtain the activity event content after the associated data packet accesses the device network; and the activity event content is used as the interactive behavior feature after the associated data packet accesses the device network.

6. The method according to claim 5, characterized in that The obtaining of the activity event content after the associated data packet accesses the device network includes: Acquire, from the event activities generated within the device corresponding to the associated data packet, process information, system resources, and operation information after the associated data packet accesses the device network; The process information, system resources and operation information are used as activity event content.

7. The method according to claim 6, characterized in that The monitoring of the interactive behavior feature through the whitelist to obtain a second monitoring result of the associated data packet includes: The process information, system resources and operation information are compared with the whitelist to obtain a second monitoring result of the associated data packet.

8. The method according to any one of claims 1 to 7, characterized in that: The method comprises: In the case where the first monitoring result is abnormal, determining that the monitoring result of the device network is abnormal, preventing the associated data packet from accessing the device network and sending abnormal warning information to relevant personnel; When the first monitoring result is normal and the second monitoring result is abnormal, the monitoring result of the device network is determined to be abnormal, the interaction of the associated data packet in the device network is interrupted, and abnormal warning information is sent to relevant personnel.

9. The method according to claim 1, characterized in that: The whitelist is constructed by the following steps, including: Based on the historical attack records corresponding to the device network, an attack chain model corresponding to the device network is constructed; Using the attack chain model to construct an abnormal data packet corresponding to the device network, connecting the abnormal data packet to the device network, and obtaining abnormal data features when the abnormal data packet is not connected to the device network, and abnormal interaction behavior features when the abnormal data packet is connected to the device network; According to the abnormal data features, the abnormal interactive behavior features and historical normal communication data packets, a preset original data feature and a preset interactive behavior feature are obtained; The preset whitelist is constructed based on the preset original data features and the preset interactive behavior features.

10. The method according to claim 9, characterized in that The step of obtaining preset original data features and preset interactive behavior features according to the abnormal data features, the abnormal interactive behavior features and historical normal communication data packets includes: According to the historical normal communication data packets of the device network, the historical normal communication data packets are connected to the device network to obtain normal original data features when the historical normal communication data packets are not connected to the device network, and normal interaction behavior features when the historical normal communication data packets are connected to the device network; Compare the normal original data feature with the abnormal data feature to obtain a distinguishing data feature, and use the data feature of the distinguishing data feature corresponding to the normal original data feature as the preset original data feature; The normal interaction behavior feature is compared with the abnormal interaction behavior feature to obtain a distinguishing interaction behavior feature, and the distinguishing interaction behavior feature corresponding to the behavior in the normal interaction behavior feature is used as the preset interaction behavior feature.

11. A device network monitoring apparatus, characterized in that: The device comprises: An acquisition module, used to acquire associated data packets of a device network; A first monitoring module, configured to obtain original data features of the associated data packet when the associated data packet is not connected to the device network, and monitor the original data features through a preset whitelist to obtain a first monitoring result of the associated data packet; A second monitoring module is used to obtain, when the associated data packet has been connected to the device network, the interactive behavior characteristics of the associated data packet after accessing the device network, and monitor the interactive behavior characteristics through the whitelist to obtain a second monitoring result of the associated data packet; A result generating module, configured to obtain a monitoring result of the device network based on the first monitoring result and the second monitoring result; The whitelist is generated based on an attack chain model corresponding to the device network, and the attack chain model is constructed based on historical attack records corresponding to the device network.

12. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 10 are implemented.

13. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 10 are implemented.

Images