Method and system for resisting communication protocol replay attack

Abstract

The invention belongs to the technical field of communication, and discloses a method and system for resisting a communication protocol replay attack, and the method for resisting the communication protocol replay attack comprises the steps: capturing a communication message in real time based on a pre-deployed firewall, and building flow information; analyzing the communication message according to a preset learning duration, extracting an operation instruction, and establishing a contrast information base; and based on the contrast information base, identifying and replaying the attack message, and giving an alarm. According to the method, the communication message replay attack can be monitored in real time, the attack can be effectively shielded, and the alarm can be given in time without upgrading and transforming the existing network and replacing the communication protocol PLC, and the implementation cost and the technical threshold are greatly reduced by the non-intrusive protection strategy, so that the security upgrading of the industrial control system becomes simpler and more feasible, and the safety of the industrial control system is improved. The safety of the industrial control system can be effectively improved, and the influence on normal production and operation can be reduced to the greatest extent.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a method and system for resisting communication protocol replay attacks. Background Art

[0002] With the rapid development of communication technology, the digital transformation of the industrial field continues to deepen, and industrial control systems (ICS) play an increasingly important role in all walks of life. As the core of industrial infrastructure, ICS realizes the automated control and remote supervision of the production process, greatly improving production efficiency and management level. At present, my country is in a rapid development stage in the field of industrial control system network security technology research and industrial development, but the protection capability and emergency response capability are relatively low. Traditional physical isolation can no longer meet the needs of modern industrial production. How to effectively protect ICS from cyber attacks while ensuring system openness and interoperability has become a major challenge facing the current industrial community; especially in the field of critical infrastructure, such as electricity, petrochemical, water treatment and other industries, the security of ICS is directly related to national security and social stability, so it is urgent to establish a comprehensive and effective ICS security protection system.

[0003] In ICS, the programmable logic controller (PLC) is one of the most core control devices and is widely used in various types of automation control systems. PLC collects and processes field data in real time and issues corresponding control instructions by executing preset programs. It is a key component for realizing industrial automation. In order to realize remote monitoring and management, PLC usually uses a dedicated industrial communication protocol to exchange data with the host computer or other devices. Among them, the S7 communication protocol (S7comm) is one of the most widely used protocols. It is a binary protocol using TPKT and ISO8073. The S7comm protocol defines the communication rules and data formats between PLC and other devices, and supports functions such as reading and writing PLC internal data, downloading programs, and diagnosis; however, the S7comm protocol was mainly designed with functionality and compatibility in mind, and security considerations were relatively insufficient, which makes the PLC system based on S7comm not involve any anti-replay attack mechanism, which can be easily exploited by attackers and faces potential security risks.

[0004] Although existing technologies have proposed some security protection measures for communication protocols, such as encrypted communication and identity authentication, these methods often require large-scale transformation of existing hardware, which is costly and difficult to implement. In particular, for legacy systems that have been running for many years, upgrades and transformations may bring risks such as system instability and production interruptions. In addition, existing protection methods mainly focus on single-point protection and lack comprehensive monitoring and analysis capabilities for the entire communication process. It is difficult to effectively identify and defend against complex network attacks, especially replay attacks against the S7comm communication protocol. The alarm is after the attack occurs, and the replay attack cannot be stopped in time. The replay attack may cause the PLC to perform unauthorized operations by capturing and resending valid communication data packets, thereby seriously affecting the production process.

[0005] Therefore, how to detect and block replay attacks in a timely manner without upgrading the existing network and replacing the communication protocol PLC equipment, and achieve comprehensive monitoring and effective protection of automation control communications has become a technical problem that needs to be solved urgently. Summary of the invention

[0006] The embodiments of the present invention provide a method and system for resisting communication protocol replay attacks to solve the problems in the prior art that large-scale transformation of existing hardware is required, the implementation cost is high and difficult, and there may be risks such as system instability and production interruption, and the alarm is issued after the attack occurs, and the replay attack cannot be prevented in time.

[0007] In order to have a basic understanding of some aspects of the disclosed embodiments, a brief summary is given below. This summary is not a general review, nor is it intended to identify key / important components or to describe the scope of protection of these embodiments. Its only purpose is to present some concepts in a simple form as a prelude to the detailed description that follows.

[0008] According to a first aspect of an embodiment of the present invention, a method for resisting a communication protocol replay attack is provided.

[0009] In one embodiment, the method for resisting communication protocol replay attacks includes: Based on the pre-deployed firewall, communication messages are captured in real time and flow information is established; According to the preset learning time, the communication message is analyzed, and the operation instructions are extracted to establish a reference information library; Based on the reference information database, replay attack messages are identified and an alarm is issued.

[0010] In one embodiment, based on the pre-deployed firewall, real-time capture of messages and establishment of flow information include: Pre-deploy firewalls based on network architecture design; According to the communication protocol, set the firewall capture rules and capture all the communication messages passing through in real time; Based on the captured communication messages, the corresponding flow information is recorded and monitored in real time, wherein the corresponding flow information includes the source and destination MAC addresses, source and destination IP addresses, source and destination ports, and protocol types.

[0011] In one embodiment, according to the preset learning time, parsing the communication message, extracting the operation instruction, and establishing the reference information library includes: Determine the preset learning time based on the network environment and operation requirements; Based on the preset learning time, the captured communication messages are parsed and the operation instructions are extracted; According to the analysis result of the communication message, the asset information, session information and key operation time information are counted, and a reference information base is established, which includes an asset information table, a session information table and a key operation time information table.

[0012] In one embodiment, based on a preset learning time, parsing the captured communication message and extracting the operation instruction includes: Based on the preset learning time, the communication messages are continuously captured and a message cache pool is established; Use the communication protocol parser to analyze the messages in the message buffer pool one by one and extract key field information; Based on the extracted key field information, an operation instruction set is constructed and stored in association with the timestamp.

[0013] In one embodiment, the asset information includes a MAC address and an IP address; The session information includes source IP address, destination IP address, source port, destination port, transport protocol and application protocol; The key operation time information includes time, operation equipment and operation instructions.

[0014] In one embodiment, based on the reference information base, identifying the replay attack message and issuing an alarm includes: Based on the parsed communication messages, compare the session information table to determine whether there is abnormal access; Use the asset information table to verify the correspondence between the IP and MAC addresses of the message and identify whether there are forged addresses; According to the key operation time information table, analyze the execution time and sending device of the operation instructions to detect whether there are any illegal operations.

[0015] In one embodiment, based on the parsed communication message, comparing the session information table, determining whether there is abnormal access includes: Extracting session information features based on parsed communication messages; According to the characteristics of the session information, query the session information table and make an initial comparison; Based on the initial comparison result, determine whether there is abnormal access. If there is abnormal access, discard the current communication message and generate an alarm log.

[0016] In one embodiment, using the asset information table to verify the correspondence between the IP and MAC addresses of the message and identifying possible address forgery includes: Extract IP address and MAC address based on the parsed communication message; Based on the extracted IP address and MAC address, query the asset information table and compare them again; Based on the secondary comparison result, the address information matching degree is verified. If it does not match, the current communication message is discarded and an alarm log is generated.

[0017] In one embodiment, analyzing the execution time and sending device of the operation instruction according to the key operation time information table, and detecting abnormal operation behavior includes: Extract operation instructions and timestamps based on parsed communication messages; According to the operation instructions and timestamps, query the key operation time information table and compare it three times; Based on the three comparison results, the legality of the operation is analyzed. If it is illegal, the current communication message is discarded and an alarm log is generated.

[0018] According to a second aspect of an embodiment of the present invention, a system for resisting communication protocol replay attacks is provided.

[0019] In one embodiment, the system for resisting communication protocol replay attacks includes: The message capture module is used to capture communication messages in real time based on the pre-deployed firewall and establish flow information; A deep analysis module is used to analyze communication messages according to the preset learning time, extract operation instructions, and establish a reference information library; The identification and alarm module is used to identify the replay attack message based on the reference information base and issue an alarm.

[0020] According to a third aspect of an embodiment of the present invention, a computer device is provided.

[0021] In one embodiment, the computer device includes a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps of the above method when executing the computer program.

[0022] According to a fourth aspect of embodiments of the present invention, a computer-readable storage medium is provided.

[0023] In one embodiment, the computer-readable storage medium stores a computer program, which implements the steps of the above method when executed by a processor.

[0024] The technical solution provided by the embodiment of the present invention may have the following beneficial effects: (1) The present invention can monitor the replay attack of communication messages in real time, effectively shield the attack and issue an alarm in time without upgrading the existing network or replacing the communication PLC. This non-invasive protection strategy greatly reduces the implementation cost and technical threshold, making the security upgrade of industrial control systems simpler and more feasible. By deploying a firewall in the network and configuring specific capture rules, it can continuously capture and analyze communication messages and establish a comprehensive traffic monitoring mechanism. At the same time, by using the preset learning time, it can automatically build a multi-dimensional information library containing asset information, session information and key operation time information, providing reliable basic data for subsequent attack detection. Based on this information, it can make multiple judgments on the captured communication messages in real time, analyze them from multiple dimensions such as session legitimacy, address authenticity and operation time rationality, and effectively identify potential replay attacks. In addition, once an attack behavior is detected, it can immediately take blocking measures and generate detailed alarm logs to provide security managers with timely and accurate threat intelligence. This comprehensive and accurate protection mechanism can not only effectively improve the security of industrial control systems, but also minimize the impact on normal production operations.

[0025] (2) Strategic deployment of firewalls: By deploying firewalls at key communication nodes of the network, such as between the operator station and the PLC device, the present invention can comprehensively and accurately monitor key communication messages. This deployment strategy ensures that all communications must be checked by the firewall, effectively avoiding the appearance of monitoring blind spots. At the same time, the firewall can not only capture communication messages in real time, but also extract key information in the messages, such as source and destination MAC addresses, source and destination IP addresses, source and destination ports, and protocol types. These detailed traffic information provides a solid foundation for subsequent analysis and judgment. Through real-time monitoring and analysis of this information, the system can quickly identify abnormal communication patterns and suspicious message features. In addition, the deployment of firewalls also provides the possibility of implementing more complex security strategies, such as content-based filtering, dynamic access control, etc., further enhancing the system's protection capabilities. This key node-based monitoring strategy not only improves the accuracy and real-time nature of attack detection, but also minimizes the impact on normal network communications, achieving a balance between efficient protection and business continuity.

[0026] (3) Intelligent information database construction mechanism: By setting a preset learning time, the present invention can automatically capture and analyze communications in the network, thereby establishing a multi-dimensional information database containing asset information, session information and key operation time information. This self-learning mechanism greatly reduces the need for manual operation and avoids the tedious manual configuration process in traditional methods. At the same time, the present invention can automatically identify devices in the network, record normal communication modes, and count the execution time of important operations, thereby forming a comprehensive and accurate baseline database. This not only greatly improves the efficiency of information database establishment, but also ensures the timeliness and accuracy of information. In addition, the present method also supports manual modification and import and export functions, providing administrators with flexible intervention and optimization opportunities. This human-machine combination not only ensures the automation and intelligence of the information database, but also provides convenience for manual intervention, thereby ensuring that the integrity and accuracy of the information database are always in the best state, which not only improves the adaptability and maintainability of the system, but also provides flexible deployment options for industrial control systems of different sizes and types.

[0027] (4) Multi-level judgment mechanism: The present invention ensures high accuracy in judging replay attacks. By performing triple verification on the captured communication messages, a comprehensive analysis is conducted from three dimensions: session legitimacy, address authenticity, and operation time rationality. First, the present invention can check whether the session information of the message matches the pre-established session information database to identify possible abnormal access. Second, the present invention can verify the correspondence between the IP and MAC addresses in the message to detect potential address forgery. Finally, the present invention will analyze the execution time of the operation instruction and the sending device to determine whether there is abnormal operation behavior. Only when the message passes these three verifications will it be identified as legitimate communication. Otherwise, it will be identified as a replay attack and corresponding protective measures will be taken. This multi-level judgment mechanism not only improves the accuracy of attack detection, but also greatly reduces the possibility of false positives and false negatives. In addition, this mechanism is also highly flexible and scalable. Administrators can adjust the weights of each layer of verification or add new verification dimensions according to actual needs to adapt to different security needs and network environments. This refined and customizable protection strategy provides a comprehensive and accurate security barrier for industrial control systems, effectively improving the system's ability to resist replay attacks.

[0028] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0030] Figure 1It is a flowchart of a method for resisting communication protocol replay attack according to an exemplary embodiment; Figure 2 is a specific implementation diagram of a method for resisting communication protocol replay attacks according to an exemplary embodiment; Figure 3 is a structural block diagram of a system for resisting communication protocol replay attacks according to an exemplary embodiment; Figure 4 The diagram is a schematic structural diagram of a computer device according to an exemplary embodiment. DETAILED DESCRIPTION

[0031] The following description and accompanying drawings fully illustrate the specific embodiments of this article so that those skilled in the art can practice them. Parts and features of some embodiments may be included in or replace parts and features of other embodiments. The scope of the embodiments of this article includes the entire scope of the claims, as well as all available equivalents of the claims. Herein, the terms "first", "second", etc. are only used to distinguish one element from another, without requiring or implying any actual relationship or order between these elements. In fact, the first element can also be called the second element, and vice versa. Moreover, the terms "include", "comprise" or any other variant thereof are intended to cover non-exclusive inclusion, so that the structure, device or equipment including a series of elements includes not only those elements, but also other elements that are not explicitly listed, or also include elements inherent to such structure, device or equipment. In the absence of more restrictions, the elements defined by the sentence "including one..." do not exclude the existence of other identical elements in the structure, device or equipment including the elements. Each embodiment is described in a progressive manner herein, and each embodiment focuses on the differences from other embodiments, and the same and similar parts between the embodiments can be referred to each other.

[0032] The terms "longitudinal", "lateral", "upper", "lower", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside", etc. in this document indicate the orientation or position relationship based on the orientation or position relationship shown in the drawings, and are only for the convenience of describing this document and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operate in a specific orientation, and therefore cannot be understood as a limitation on the present invention. In the description of this document, unless otherwise specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a mechanical connection or an electrical connection, it can also be the internal communication of two elements, it can be a direct connection, or it can be an indirect connection through an intermediate medium. For ordinary technicians in this field, the specific meanings of the above terms can be understood according to specific circumstances.

[0033] As used herein, the term "plurality" means two or more than two, unless otherwise specified.

[0034] In this document, the character " / " indicates that the preceding and following objects are in an "or" relationship. For example, A / B means: A or B.

[0035] In this article, the term "and / or" is a description of the association relationship between objects, indicating that three relationships may exist. For example, A and / or B means: A or B, or, A and B.

[0036] It should be understood that, although the various steps in the flow chart are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear description in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the figure may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these sub-steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a portion of the sub-steps or stages of other steps.

[0037] Each module in the device or system of the present application can be implemented in whole or in part by software, hardware, or a combination thereof. The above modules can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to the above modules.

[0038] In the absence of conflict, the embodiments of the present invention and the features of the embodiments may be combined with each other.

[0039] Figure 1-Figure 2 An embodiment of a method for resisting communication protocol replay attacks of the present invention is shown.

[0040] In this optional embodiment, the method for resisting communication protocol replay attack includes: Step S101: Based on the pre-deployed firewall, communication messages are captured in real time and flow information is established; Step S103: according to the preset learning time, parse the communication message, extract the operation instruction, and establish a reference information library; Step S105: Based on the reference information base, identify the replay attack message and issue an alarm.

[0041] In this optional embodiment, based on the pre-deployed firewall, the message is captured in real time, and the flow information is established, including: Step S1011: pre-deploy a firewall based on network architecture design; Step S1013: according to the communication protocol, set the capture rules of the firewall, and capture all the passing communication messages in real time; Step S1015: Based on the captured communication messages, record the corresponding flow information and monitor it in real time, wherein the corresponding flow information includes the source and destination MAC addresses, source and destination IP addresses, source and destination ports and protocol types.

[0042] Specifically, taking the industrial control system of a chemical plant as an example, in this embodiment, the communication protocol adopts the most widely used S7comm protocol, and a firewall is deployed between the operator station and the PLC device. The firewall captures all S7comm messages passing through the firewall and establishes flow information for monitoring the S7comm messages; the flow information includes: source MAC address, target MAC address, source IP address, target IP address, source port, target port, and protocol type.

[0043] Specifically, the network administrator pre-installed a firewall between the operator station (IP address 192.168.1.10) and the PLC device (IP address 192.168.1.20). The firewall is configured to monitor S7comm messages transmitted through TCP port 102 to ensure that all communications are checked by this firewall.

[0044] Specifically, the traffic monitoring function of the firewall is used to capture all passing messages in real time and record relevant flow information, including source MAC address, destination MAC address, source IP address, destination IP address, source port, destination port and protocol type. In this embodiment, the firewall is configured to focus on the flow monitoring of the S7comm protocol to ensure that the communication behavior of the protocol can be identified and analyzed in a timely manner. In the above industrial control system, the firewall received an S7comm message during the monitoring process, with a source IP address of 192.168.1.10, a destination IP address of 192.168.1.20, a source port of 5000, and a destination port of 102. The message also contains a source MAC address and a destination MAC address. The configuration of the firewall enables it to identify and extract this information to form a flow information record.

[0045] Specifically, the flow information extracted from the received S7comm message is stored in a table named "flow information database", and the table structure includes fields: source IP address, destination IP address, source port, destination port, protocol type and timestamp. In the above embodiment, the timestamp of a message is 2024-07-02-18:05:06, and a record will be created: (192.168.1.10, 192.168.1.20, 5000, 102, TCP, 2024-07-02-18:05:06), so as to provide basic data for subsequent information analysis and comparison.

[0046] In this optional embodiment, according to the preset learning time, the communication message is parsed, and the operation instruction is extracted, and the comparison information library is established, including: Step S1031, determining a preset learning time according to the network environment and operation requirements; Specifically, in the above embodiment, the production cycle of the chemical plant is one week, including normal production, equipment maintenance, system update and other operations. In order to ensure that all regular operation modes are captured, the preset learning time is set to 10 days. This time span is sufficient to cover a complete production cycle and leave a margin to capture possible unconventional operations.

[0047] Step S1033: parsing the captured communication message based on the preset learning time, and extracting the operation instruction; Specifically, in the above embodiment, after the firewall captures an S7comm message, it uses a special parsing module to learn the flow information and operation instructions by specifying a preset learning time. During the learning process, the s7comm message is deeply parsed to parse out the corresponding operation instructions. In this embodiment, the operation instructions are obtained by parsing Function, funcgroup, and subfunc in the s7comm message.

[0048] Step S1035: According to the analysis result of the communication message, the asset information, session information and key operation time information are counted, and a reference information library is established. The reference information library includes an asset information table, a session information table and a key operation time information table.

[0049] Specifically, while learning, statistical information is collected, including asset information, session information, and key operation time information. Asset information includes MAC address and IP address; session information includes source IP address, destination IP address, source port, destination port, transmission protocol, and application protocol; key operation time information includes time, operation equipment, and operation instructions. Asset information, session information, and key operation time information are all stored in the database and placed in different tables (asset information table, session information table, and key operation time information table). To ensure the integrity and accuracy of the information database, the information database can be imported and exported, and a single piece of information can be added, deleted, modified, and checked based on the learning.

[0050] Specifically, in the above embodiment, based on all S7comm messages parsed within 10 days, a comparison information library is established, as shown in Tables 1 to 3, including an asset information table, a session information table, and a key operation time information table.

[0051] Table 1 Asset Information Table MAC Address IP address 00:1A:2B:3C:4D:5E 192.168.1.10 00:5E:4D:3C:2B:1A 192.168.1.20 Table 2 Session information table Source IP address Destination IP address Source Port Destination Port Transport Protocol Application Protocol 192.168.1.10 192.168.1.20 49152 102 TCP S7comm 192.168.1.20 192.168.1.10 102 50000 TCP S7comm Table 3 Key operation time information table time Source IP address Destination IP address Operation Instructions 2022-7-2 18:05:06 192.168.1.10 192.168.1.20 Function: PLC Stop (0x29) 2022-7-2 18:05:07 192.168.1.10 192.168.1.20 Current mode: Cold Restart (6) In this optional embodiment, based on the preset learning time, parsing the captured communication message and extracting the operation instruction includes: Step S10331: Based on the preset learning time, continuously capture communication messages and establish a message buffer pool; Step S10333: Analyze the messages in the message buffer pool one by one using a communication protocol parser to extract key field information; Step S10335: construct an operation instruction set based on the extracted key field information, and store it in association with the timestamp.

[0052] Specifically, during the set 10-day learning period, all S7comm messages are continuously captured through the firewall deployed between the operator station (IP: 192.168.1.10) and the PLC (IP: 192.168.1.20). These messages are stored in a high-performance memory buffer pool in real time, and the buffer pool size is set to 1GB to ensure that enough messages can be stored for analysis.

[0053] Specifically, a specially developed communication protocol parser (S7comm protocol parser in this embodiment) is used to perform in-depth parsing of each message in the buffer pool. In the above embodiment, for a certain S7comm message, the parser extracts the following key field information: TPKTHeader:0x03,0x00,0x00,0x1f; COTPHeader:0x02,0xf0,0x80; S7Header:0x32,0x01,0x00,0x00; Function:0x04(ReadVar); ItemCount:0x01; VarType:0x12(DB); Area:0x84(DB); DBNumber:0x0001; StartAddress:0x0000.

[0054] Specifically, based on the parsed key field information, an operation instruction set is constructed. For the above example message, the constructed operation instruction is: Operation instruction: read the data at the starting address 0x0000 of data block DB1; Timestamp — 2024-07-02-15:30:22; This operation instruction and its execution time are associated and stored in the operation instruction database, providing a basis for subsequent replay attack analysis.

[0055] In this optional embodiment, the asset information includes a MAC address and an IP address; The session information includes source IP address, destination IP address, source port, destination port, transport protocol and application protocol; The key operation time information includes time, operation equipment and operation instructions.

[0056] In this optional embodiment, based on the reference information base, identifying the replay attack message and issuing an alarm includes: Step S1051: Based on the parsed communication message, compare the session information table to determine whether there is abnormal access; Specifically, through step S103, the protective wall captures all s7comm messages passing through the firewall, and after establishing the flow information, it deeply analyzes the s7comm message to parse out the operation instruction. At this time, it first determines whether the flow session information sending the instruction is in the session information table. If not, it is determined to be an instruction initiated by an abnormal access device, which is a case of replay attack. The s7comm message is DROPed and an alarm log is generated.

[0057] Step S1053: Use the asset information table to verify the correspondence between the IP and MAC addresses of the message and identify whether there is a forged address; Specifically, if there is no problem with the session information, the IP and MAC addresses of the parsed s7comm message are compared with the asset information table to determine whether the MAC address corresponds to the IP address. If not, the IP address is determined to be a forged IP, which is a case of replay attack. The s7comm message is DROPed and an alarm log is generated.

[0058] Step S1055: Analyze the execution time and sending device of the operation instruction according to the key operation time information table to detect whether there is any illegal operation.

[0059] Specifically, when there are no problems with the session information and asset information, it is necessary to compare whether the time when the instruction information is sent is in the key operation time information table, including: write operation, stop PLC, cold start, warm start. These key operations are relatively fixed in the enterprise. If the important instruction operation does not occur within this time range, it is determined to be a case of replay attack, DROP the s7comm message, and generate an alarm log; if the time is met, further check whether the device sending the instruction is in the key operation time information table. If not, it is determined to be a case of replay attack, DROP the s7comm message, and generate an alarm log.

[0060] In this optional embodiment, based on the parsed communication message, comparing the session information table, determining whether there is abnormal access includes: Step S10511: extracting session information features based on the parsed communication message; Step S10513: query the session information table and perform an initial comparison based on the session information characteristics; Step S10515: Based on the initial comparison result, determine whether there is abnormal access. If there is abnormal access, discard the current communication message and generate an alarm log.

[0061] Specifically, in this embodiment, first, an S7comm message is captured and the following session information features are extracted: Source IP address – 192.168.1.15 Destination IP address—192.168.1.20 Source Port—50000; Destination port—102; Transport protocol — TCP; Application protocol—S7comm.

[0062] Specifically, then query the session information table and find the following records: Source IP address – 192.168.1.10 Destination IP address—192.168.1.20 Source port—**; Destination port—102; Transport protocol — TCP; Application protocol—S7comm.

[0063] Specifically, after the initial comparison, it is found that the source IP address (192.168.1.15) of the captured message does not match the record in the table; finally, it is determined that there is abnormal access, and the following operations are performed: ① Discard the current S7comm message; ② Generate an alarm log "Abnormal access attempt detected; Time: 2024-07-10-14:30:22; Source IP: 192.168.1.15; Target IP: 192.168.1.20; Possible replay attack".

[0064] In this optional embodiment, using the asset information table to verify the correspondence between the IP and MAC addresses of the message and identifying possible address forgery includes: Step S10531, extracting the IP address and MAC address based on the parsed communication message; Step S10533: query the asset information table and perform a secondary comparison based on the extracted IP address and MAC address; Step S10535: Based on the secondary comparison result, verify the matching degree of the address information. If it does not match, discard the current communication message and generate an alarm log.

[0065] Specifically, in the above embodiment, a certain S7comm message passes the initial comparison. First, the following information is extracted from the S7comm message: IP address – 192.168.1.10 MAC address—00:1B:2C:3D:4E:5F.

[0066] Specifically, then, query the asset information table and find the following records: IP address – 192.168.1.10 MAC address—00:1A:2B:3C:4D:5E.

[0067] Specifically, after a second comparison, it is found that the MAC address in the message does not match the record in the table; finally, it is determined that the address information does not match, and the following operations are performed: ① Discard the current S7comm message; ② Generate an alarm log "IP-MAC address mismatch detected; Time: 2024-07-10-15:45:33; IP: 192.168.1.10; MAC: 00:1B:2C:3D:4E:5F; address forgery may exist".

[0068] In this optional embodiment, analyzing the execution time and sending device of the operation instruction according to the key operation time information table, and detecting abnormal operation behavior includes: Step S10551, extracting operation instructions and timestamps based on the parsed communication message; Step S10553: query the key operation time information table according to the operation instruction and the timestamp and compare three times; Step S10555: Based on the three comparison results, analyze the legality of the operation. If it is illegal, discard the current communication message and generate an alarm log.

[0069] Specifically, in the above embodiment, a certain S7comm message is subjected to secondary comparison. First, the following information is extracted from the S7comm message: Operation instruction—Function:PLCStop(0x29); Timestamp — 2024-07-10-03:15:45; Source IP address—192.168.1.10.

[0070] Specifically, by querying the key operation time information table, the following records are found: Operation instruction—Function:PLCStop(0x29); Time—20:00:00-22:00:005; Source IP address – 192.168.1.10 Destination IP address—192.168.1.20.

[0071] Specifically, after three comparisons, it is found that the execution time of the current operation instruction (03:15:45) is not within the allowed time range; finally, the operation is determined to be illegal, and the following operations are performed: ① Discard the current S7comm message; ② Generate an alarm log "An illegal operation attempt was detected; time: 2024-07-10-03:15:45; source IP: 192.168.1.10; operation instruction: PLCStop; operation time exceeds the allowed range".

[0072] Figure 3 An embodiment of a system for resisting communication protocol replay attacks of the present invention is shown.

[0073] In this optional embodiment, the system for resisting communication protocol replay attacks includes: The message capture module 201 is used to capture communication messages in real time based on the pre-deployed firewall and establish flow information; The deep analysis module 203 is used to analyze the communication message according to the preset learning time, extract the operation instructions, and establish a reference information library; The identification and alarm module 205 is used to identify the replay attack message based on the reference information base and issue an alarm.

[0074] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 4 As shown. The computer device includes a processor, a memory and a network interface connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store static information and dynamic information data. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, the steps in the above method embodiment are implemented.

[0075] Those skilled in the art will understand that Figure 4 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present invention, and does not constitute a limitation on the computer device to which the solution of the present invention is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0076] In addition, the present invention also provides a computer device, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above method embodiment when executing the computer program.

[0077] In addition, the present invention further provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps in the above method embodiment are implemented.

[0078] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided by the present invention can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory or optical memory, etc. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM).

[0079] The present invention is not limited to the structures which have been described above and shown in the drawings, and various modifications and changes may be made without departing from the scope thereof. The scope of the present invention is limited only by the appended claims.

Claims

1. A method for resisting communication protocol replay attacks, characterized in that: The method for resisting automated control replay attacks includes: Based on the pre-deployed firewall, communication messages are captured in real time and flow information is established; According to the preset learning time, the communication message is analyzed, and the operation instructions are extracted to establish a reference information library; Based on the reference information database, replay attack messages are identified and an alarm is issued.

2. A method for resisting communication protocol replay attacks according to claim 1, characterized in that: The method of capturing messages in real time based on the pre-deployed firewall and establishing flow information includes: Pre-deploy firewalls based on network architecture design; According to the communication protocol, set the firewall capture rules and capture all the communication messages passing through in real time; Based on the captured communication messages, the corresponding flow information is recorded and monitored in real time, wherein the corresponding flow information includes the source and destination MAC addresses, source and destination IP addresses, source and destination ports, and protocol types.

3. A method for resisting communication protocol replay attacks according to claim 1, characterized in that: The method of parsing the communication message according to the preset learning time, extracting the operation instruction, and establishing the reference information library includes: Determine the preset learning time based on the network environment and operation requirements; Based on the preset learning time, the captured communication messages are parsed and the operation instructions are extracted; According to the analysis result of the communication message, the asset information, session information and key operation time information are counted, and a reference information base is established, which includes an asset information table, a session information table and a key operation time information table.

4. A method for resisting communication protocol replay attacks according to claim 3, characterized in that: The method of parsing the captured communication message based on the preset learning time and extracting the operation instruction includes: Based on the preset learning time, the communication messages are continuously captured and a message cache pool is established; Use the communication protocol parser to analyze the messages in the message buffer pool one by one and extract key field information; Based on the extracted key field information, an operation instruction set is constructed and stored in association with the timestamp.

5. A method for resisting communication protocol replay attacks according to claim 3, characterized in that: The asset information includes MAC address and IP address; The session information includes source IP address, destination IP address, source port, destination port, transport protocol and application protocol; The key operation time information includes time, operation equipment and operation instructions.

6. A method for resisting communication protocol replay attacks according to claim 3, characterized in that: The identifying the replay attack message based on the reference information base and issuing an alarm includes: Based on the parsed communication messages, compare the session information table to determine whether there is abnormal access; Use the asset information table to verify the correspondence between the IP and MAC addresses of the message and identify whether there are forged addresses; According to the key operation time information table, analyze the execution time and sending device of the operation instructions to detect whether there are any illegal operations.

7. A method for resisting communication protocol replay attacks according to claim 6, characterized in that: The determining whether there is abnormal access based on the parsed communication message and comparing the session information table includes: Extracting session information features based on parsed communication messages; According to the characteristics of the session information, query the session information table and make an initial comparison; Based on the initial comparison result, determine whether there is abnormal access. If there is abnormal access, discard the current communication message and generate an alarm log.

8. A method for resisting communication protocol replay attacks according to claim 6, characterized in that: The use of the asset information table to verify the correspondence between the IP and MAC addresses of the message and identify possible address forgery includes: Extract IP address and MAC address based on the parsed communication message; Based on the extracted IP address and MAC address, query the asset information table and compare them again; Based on the secondary comparison result, the address information matching degree is verified. If it does not match, the current communication message is discarded and an alarm log is generated.

9. A method for resisting communication protocol replay attacks according to claim 6, characterized in that: The analyzing the execution time and sending device of the operation instruction according to the key operation time information table and detecting abnormal operation behavior includes: Extract operation instructions and timestamps based on parsed communication messages; According to the operation instructions and timestamps, query the key operation time information table and compare it three times; Based on the three comparison results, the legality of the operation is analyzed. If it is illegal, the current communication message is discarded and an alarm log is generated.

10. A system for resisting communication protocol replay attacks, characterized in that: The system for resisting communication protocol replay attacks comprises: The message capture module is used to capture communication messages in real time based on the pre-deployed firewall and establish flow information; A deep analysis module is used to analyze communication messages according to the preset learning time, extract operation instructions, and establish a reference information library; The identification and alarm module is used to identify the replay attack message based on the reference information base and issue an alarm.

Images