Industrial control honeypot defense system and method based on mirror simulation

Abstract

The present invention belongs to the technical field of industrial network defense, and discloses an industrial control honeypot defense system and method based on mirror simulation; the system comprises: identifying the industrial control network in a factory, obtaining device information data, industrial protocols, device topology structure and communication behavior data in the industrial control network; constructing a simulated industrial control honeypot network based on the obtained data; deploying an identification node in the simulated industrial control honeypot network, and generating a corresponding access identification verification code based on the simulated communication behavior data in the simulated industrial control honeypot network through the identification node, and encrypting the simulated communication behavior data to obtain encrypted simulated communication behavior data; verifying the access identification verification code obtained by decrypting the encrypted simulated communication behavior data by the visitor, and judging whether it is a normal access based on the inspection result, and making a corresponding response; thereby further improving the defense capability of the industrial control network in the factory.

Description

Technical Field

[0001] The present invention relates to the field of industrial network defense technology, and more specifically, to an industrial control honeypot defense system and method based on mirror simulation. Background Art

[0002] The patent application with application publication number CN116436653A discloses a honeypot dynamic configuration method, device, honeypot intrusion detection system and storage medium, including: based on an industrial control equipment network, determining the distribution of at least one honeypot in the industrial control equipment network; based on a predetermined honeypot defense strategy, generating a description file of the honeypot; based on the description file and the distribution, generating a corresponding honeypot in the industrial control equipment network; based on an access request to the industrial control equipment network, dynamically configuring the at least one honeypot, and timely adjusting the configuration of the honeypot or honeynet according to changes in the access request, thereby improving the accuracy and efficiency of intrusion detection and entrapment attacks, and solving the problem in the related art that industrial control network attacks change the attack method according to the honeypot identification situation to evade intrusion detection.

[0003] However, in the traditional industrial network defense process, the simulation accuracy of the industrial control network is low, which makes it easy for attackers to detect it. As a result, the attackers will not attack the simulated industrial control network, but instead look for the real industrial control network to attack, which reduces the role of the simulated industrial control network, resulting in a waste of computing and communication resources. Directly attacking the real industrial control network reduces the defense of the industrial control network and increases the risk of the industrial control network being invaded. The identity of the visitor is not identified, which may cause normal access to be misjudged as abnormal access, and normal visitors are defended, so that normal visitors cannot obtain the communication data of the device, and thus cannot perform normal analysis of the equipment in the industrial control network, which may cause abnormal operation of the equipment in the industrial control network, thereby affecting the production progress of the factory and reducing the factory's profits.

[0004] In view of this, the present invention proposes an industrial control honeypot defense system and method based on mirror simulation to solve the above problems. Summary of the Invention

[0005] In order to overcome the above-mentioned defects of the prior art and to achieve the above-mentioned purpose, the present invention provides the following technical solutions: an industrial control honeypot defense system based on mirror simulation, comprising a defense center, wherein the defense center is communicatively connected to an industrial control environment identification component, a simulation honeypot environment construction component, a security defense deployment component, and a behavior monitoring and response component;

[0006] The industrial control environment identification component is responsible for identifying the industrial control network within the factory and obtaining device information data, industrial protocols, device topology structure, and communication behavior data in the industrial control network;

[0007] The simulation honeypot environment construction component is responsible for building a simulation industrial control honeypot network based on the device information data, industrial protocols, device topology structure and communication behavior data in the industrial control network;

[0008] A security defense deployment component is responsible for deploying an authentication node in the simulated industrial control honeypot network, generating a corresponding access identification verification code based on the simulated communication behavior data in the simulated industrial control honeypot network through the authentication node, generating a simulated communication behavior data key, converting the simulated communication behavior data key into a two-dimensional array of simulated communication behavior data keys, encrypting the simulated communication behavior data using the two-dimensional array of simulated communication behavior data keys, and obtaining encrypted simulated communication behavior data;

[0009] The behavior monitoring and response component is responsible for verifying the access identification code obtained by the visitor by decrypting the encrypted simulated communication behavior data, and judging whether it is a normal access based on the test result, and making corresponding responses based on the judgment result.

[0010] Furthermore, the device information data includes the model, IP address, open port number and communication behavior feature table of all devices in the industrial control network;

[0011] The communication behavior data includes periodic communication data, event-driven communication data, broadcast behavior data, control instruction data, acknowledgement response data, and retry behavior data.

[0012] Furthermore, the method for constructing a simulated industrial control honeypot network based on device information data, industrial protocols, device topology, and communication behavior data in the industrial control network includes:

[0013] Build a simulated device unit based on Docker according to the device information data. At the same time, each simulated device unit is assigned a unique virtual IP address through Docker, and each simulated device unit is configured with the same open port number and communication behavior characteristic table as the corresponding real device.

[0014] The corresponding simulated device units are interconnected according to the device topology structure, and simulated PLC nodes are constructed based on Python's open source communication library. Simulated communication behavior data are generated according to the communication behavior data in the industrial control network. During the monitoring period, the simulated device units are controlled to communicate with each other through the simulated PLC nodes according to the corresponding industrial protocols and simulated communication behavior data to obtain a simulated industrial control honeypot network.

[0015] Furthermore, the method of deploying an authentication node in the simulated industrial control honeypot network and generating a corresponding access identification verification code according to the simulated communication behavior data in the simulated industrial control honeypot network through the authentication node includes:

[0016] An authentication node is deployed in each simulated device unit in the simulated industrial control honeypot network;

[0017] The monitoring period is divided into a monitoring sub-time period, converting the simulated communication behavior data transmitted to the simulation device unit during the monitoring sub-time period into English representation, converting each converted character into a corresponding ASCII code representation, converting the ASCII code of each character into an eight-bit binary representation, and combining the binary representations of all the characters to form a simulated communication behavior data stream;

[0018] The simulated communication behavior data stream is divided into simulated communication behavior data segments, specifically including:

[0019] Obtaining the length of the simulated communication behavior data stream and the length of the simulated communication behavior data segment, dividing the length of the simulated communication behavior data stream by the length of the simulated communication behavior data segment to obtain a division result, and determining whether to fill the simulated communication behavior data stream according to the division result; if the division result is an integer, then the simulated communication behavior data stream is not filled; if the division result is not an integer, then the simulated communication behavior data stream is filled;

[0020] The process of filling the simulated communication behavior data stream includes:

[0021] Obtain the remainder of the length of the simulated communication behavior data stream divided by the length of the simulated communication behavior data segment, and subtract the remainder of the length of the simulated communication behavior data stream divided by the length of the simulated communication behavior data segment from the length of the simulated communication behavior data segment to obtain the subtraction result. ;

[0022] Add at the end of the simulation communication behavior data flow binary ;

[0023] Every The simulated communication behavior data stream is split once to obtain the simulated communication behavior data segment. The length of the data segment for simulating communication behavior

[0024] The simulated communication behavior data segments are labeled as , , The number of data segments for simulating communication behavior;

[0025] The first binary bit of each simulated communication behavior data segment is obtained, and the obtained binary bits are combined according to the label sequence of the simulated communication behavior data segments to obtain an access identification check code corresponding to the monitoring sub-time period.

[0026] Furthermore, the method for generating the simulated communication behavior data key includes:

[0027] Random Generation A random value is set, and a random value threshold is set. When the random value is greater than or equal to the random value threshold, the random value is replaced by , when the random value is less than the random value threshold, the random value is replaced by , collect all replaced random values ​​and obtain the simulated communication behavior data key.

[0028] Furthermore, the method of converting the simulated communication behavior data key into a two-dimensional array of simulated communication behavior data keys includes:

[0029] Constructing a two-dimensional array , ,and , the front of the simulated communication behavior data key Binary mapping to a two-dimensional array In the first line of the simulation communication behavior data key to Binary mapping to a two-dimensional array In the second line of the simulation communication behavior data key to Binary mapping to a two-dimensional array In the third line, ..., the first to Binary mapping to a two-dimensional array No. In the row, obtain the two-dimensional array of simulated communication behavior data keys.

[0030] Furthermore, the method of encrypting the simulated communication behavior data by using the simulated communication behavior data key two-dimensional array to obtain the encrypted simulated communication behavior data includes:

[0031] Converting the simulated communication behavior data segment into a two-dimensional array of simulated communication behavior data segments using the same method as converting the simulated communication behavior data key into a two-dimensional array of simulated communication behavior data keys;

[0032] Obtain the start time of the monitoring sub-time period, and perform an XOR operation on the elements in the two-dimensional array of the simulated communication behavior data key and the elements in the two-dimensional array of the simulated communication behavior data segments according to the start time of the monitoring sub-time period to obtain an encrypted two-dimensional array of the simulated communication behavior data segments;

[0033] The encrypted simulation communication behavior data segment two-dimensional array is converted into the encrypted simulation communication behavior data segment, and the encrypted simulation communication behavior data segment is merged according to the segmentation order to obtain the encrypted simulation communication behavior data.

[0034] Furthermore, the method of converting the encrypted simulated communication behavior data segment two-dimensional array into the encrypted simulated communication behavior data segment includes:

[0035] The elements in the first row of the two-dimensional array of the encrypted simulation communication behavior data segment are used as the prefix of the encrypted simulation communication behavior data segment. The elements in the second row of the two-dimensional array of the encrypted simulation communication behavior data segment are used as the first bit of the encrypted simulation communication behavior data segment. to The elements in the third row of the two-dimensional array of the encrypted simulation communication behavior data segment are used as the first to Bit binary, ..., the encrypted simulation communication behavior data segment two-dimensional array The elements in the row are used as the first part of the encrypted simulation communication behavior data segment. to Bit binary.

[0036] Furthermore, the method of verifying the access identification verification code obtained by decrypting the encrypted simulated communication behavior data, and judging whether it is a normal access based on the verification result, and making a corresponding response based on the judgment result includes:

[0037] When a visitor accesses the simulation device unit, the authentication node in the simulation device unit is first entered to obtain the time when the visitor accesses the simulation device unit, and then the monitoring sub-time period to which the time when the visitor accesses the simulation device unit belongs is obtained and recorded as the access monitoring sub-time period;

[0038] The authentication node provides the visitor with the encrypted simulated communication behavior data of the simulated device unit in the previous monitoring sub-time period of the access monitoring sub-time period, the corresponding two-dimensional array of simulated communication behavior data keys, and the start time of the previous monitoring sub-time period. The visitor decrypts the encrypted simulated communication behavior data to obtain the corresponding access identification verification code, and inputs the access identification verification code to the authentication node, which verifies the input access identification verification code.

[0039] If the access identification code entered is correct, it is considered normal access and the visitor will be given the IP address of the industrial control network in the factory. If the access identification verification code entered is incorrect, it will be considered an abnormal access and the visitor will be permanently banned.

[0040] Industrial control honeypot defense methods based on mirror simulation include:

[0041] Step S1: Identify the industrial control network in the factory and obtain device information data, industrial protocols, device topology, and communication behavior data in the industrial control network;

[0042] Step S2: Constructing a simulated industrial control honeypot network based on device information data, industrial protocols, device topology, and communication behavior data in the industrial control network;

[0043] Step S3: deploying an authentication node in the simulated industrial control honeypot network, and generating a corresponding access identification verification code based on the simulated communication behavior data in the simulated industrial control honeypot network through the authentication node, and encrypting the simulated communication behavior data to obtain encrypted simulated communication behavior data;

[0044] Step S4: Check the access identification verification code obtained by the visitor decrypting the encrypted simulated communication behavior data, and determine whether it is a normal access based on the verification result, and make a corresponding response.

[0045] The technical effects and advantages of the industrial control honeypot defense system and method based on mirror simulation of the present invention are as follows:

[0046] 1. The industrial control network within the factory was identified, and device information data, industrial protocols, device topology, and communication behavior data in the industrial control network were obtained. Based on this data, a simulated industrial control honeypot network was constructed. The simulated industrial control honeypot network has high simulation accuracy and is not easily detected by attackers, attracting attackers to access the simulated industrial control honeypot network, thereby increasing the defense capability of the industrial control network.

[0047] 2. Deploy an identification node in the simulated industrial control honeypot network, and generate a corresponding access identification verification code based on the simulated communication behavior data in the simulated industrial control honeypot network through the identification node, and generate a simulated communication behavior data key, convert the simulated communication behavior data key into a simulated communication behavior data key two-dimensional array, encrypt the simulated communication behavior data through the simulated communication behavior data key two-dimensional array to obtain encrypted simulated communication behavior data, and the visitor needs to decrypt the encrypted simulated communication behavior data to obtain an access identification verification code, and judge whether it is a normal access or an abnormal access based on the access identification verification code, accurately distinguishing normal visitors from attackers, so that attackers are defended and normal visitors have normal access, thereby ensuring the normal production progress of the factory and improving the defense capability of the industrial control network. The access identification verification code is dynamic, which further improves the accuracy of judging whether it is a normal access or an abnormal access. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 Schematic diagram of the industrial control honeypot defense system based on mirror simulation of the present invention;

[0049] Figure 2 Schematic diagram of the industrial control honeypot defense method based on mirror simulation of the present invention;

[0050] Figure 3 This is a flowchart of the construction of a simulated industrial control honeypot network according to the present invention. DETAILED DESCRIPTION

[0051] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0052] Example 1

[0053] See also Figure 1 and Figure 3 As shown, the industrial control honeypot defense system based on mirror simulation described in this embodiment includes a defense center, which is communicatively connected to an industrial control environment identification component, a simulation honeypot environment construction component, a security defense deployment component, and a behavior monitoring and response component;

[0054] The industrial control environment identification component is responsible for identifying the industrial control network within the factory and obtaining device information data, industrial protocols, device topology structure, and communication behavior data in the industrial control network;

[0055] The simulation honeypot environment construction component is responsible for building a simulation industrial control honeypot network based on the device information data, industrial protocols, device topology structure and communication behavior data in the industrial control network;

[0056] A security defense deployment component is responsible for deploying an authentication node in the simulated industrial control honeypot network, generating a corresponding access identification verification code based on the simulated communication behavior data in the simulated industrial control honeypot network through the authentication node, generating a simulated communication behavior data key, converting the simulated communication behavior data key into a two-dimensional array of simulated communication behavior data keys, encrypting the simulated communication behavior data using the two-dimensional array of simulated communication behavior data keys, and obtaining encrypted simulated communication behavior data;

[0057] The behavior monitoring and response component is responsible for verifying the access identification code obtained by the visitor by decrypting the encrypted simulated communication behavior data, and judging whether it is a normal access based on the test result, and making corresponding responses based on the judgment result.

[0058] The process of identifying the industrial control network within a factory and obtaining device information data, industrial protocols, device topology, and communication behavior data in the industrial control network includes:

[0059] The device information data includes basic information such as the model, IP address, open port number, and communication behavior characteristic table of all devices in the industrial control network. The communication behavior characteristic table includes but is not limited to parameters such as device response delay, periodic communication interval, and error code return rules. The industrial protocol includes all industrial protocols used by the industrial control network. The communication behavior data includes periodic communication data, event-driven communication data, broadcast behavior data, control instruction data, acknowledgment response data, and retry behavior data.

[0060] The periodic communication data includes regularly uploaded or requested data from PLC, RTU, sensors, etc., for example, Modbus periodically reads coil status, etc.;

[0061] The event-driven communication data includes communication data caused by alarms, switch state changes, etc., for example, SCADA receives an alarm trigger response command, etc.;

[0062] The broadcast behavior data includes network discovery and synchronization communication behavior data, such as ARP, mDNS, DCP, S7Comm discovery requests, etc.

[0063] The control instruction data includes control instruction data issued by an operator or an automatic device, such as writing into a PLC register, controlling the start and stop of a pump, etc.;

[0064] The response data includes reply data to the controller request, such as reading temperature feedback value, device status confirmation, etc.;

[0065] The retry behavior data includes characteristic behavior data such as device abnormality, timeout, and retransmission, for example, resending a message after a communication failure;

[0066] Set up and configure the data acquisition terminal, generate a configuration channel, and connect to the factory server through the generated configuration channel. The data acquisition terminal obtains device information data, industrial protocols, device topology structure, and communication behavior data from the industrial control network within the factory server through the configuration channel.

[0067] The process of configuring the data acquisition terminal includes:

[0068] Pre-configure the IP address and communication port of the factory server in the configuration file of the data acquisition terminal, and configure the timeout period for connecting to the factory server and the number and interval of reconnections when the connection fails in the configuration file.

[0069] The process of building a simulated industrial control honeypot network based on device information data, industrial protocols, device topology, and communication behavior data in the industrial control network includes:

[0070] Based on the device information data, simulated device units are built based on Docker. Each simulated device unit is encapsulated as an independent container. At the same time, a unique virtual IP address is assigned to each simulated device unit through Docker, and each simulated device unit is configured with the same open port number and communication behavior feature table as the corresponding real device to enhance the behavioral credibility and deception ability of the simulated device units. The corresponding simulated device units are interconnected according to the device topology structure, and simulated PLC nodes are built based on Python's open source communication library. Simulated communication behavior data is generated based on the communication behavior data in the industrial control network. During the monitoring period, the simulated PLC nodes are used to control the communication between the simulated device units according to the corresponding industrial protocols and the simulated communication behavior data to obtain a simulated industrial control honeypot network.

[0071] It needs to be explained that in the traditional industrial network defense process, the simulation accuracy of the industrial control network is low, which makes it easy for attackers to detect it. As a result, the attackers will not attack the simulated industrial control network, but will look for the real industrial control network to attack, thereby reducing the role of the simulated industrial control network, thereby causing a waste of computing and communication resources, and directly attacking the real industrial control network, which reduces the defense of the industrial control network and increases the risk of the industrial control network being invaded. Therefore, the present invention constructs a simulated industrial control honeypot network. The simulation accuracy of the real industrial control honeypot network is high, which is not easy to be detected by attackers, and attracts attackers to access the simulated industrial control honeypot network, thereby increasing the defense capability of the industrial control network.

[0072] The process of deploying an authentication node in the simulated industrial control honeypot network and generating a corresponding access identification verification code based on the simulated communication behavior data in the simulated industrial control honeypot network through the authentication node includes:

[0073] An authentication node is deployed in each simulated device unit in the simulated industrial control honeypot network;

[0074] The monitoring period is divided into monitoring sub-periods, The value of can be set through experimental data analysis or experience;

[0075] For example, if the monitoring period is from 7:00:00 on February 18, 2025 to 8:00:00 on February 18, 2025, If it is set to 6, then 7:00:00 to 7:10:00 is a monitoring sub-time period, 7:10:01 to 7:20:00 is a monitoring sub-time period, 7:20:01 to 7:30:00 is a monitoring sub-time period, 7:30:01 to 7:40:00 is a monitoring sub-time period, 7:40:01 to 7:50:00 is a monitoring sub-time period, and 7:50:01 to 8:00:00 is a monitoring sub-time period.

[0076] converting the simulated communication behavior data transmitted to the simulation device unit during the monitoring sub-time period into English representation, converting each converted character into a corresponding ASCII code representation, converting the ASCII code of each character into an eight-bit binary representation, and combining the binary representations of all characters to form a simulated communication behavior data stream;

[0077] It should be explained that in each monitoring sub-time period, simulated communication behavior data is transmitted to the simulation device unit, and an identification node encrypts the simulated communication behavior data transmitted to the simulation device unit. For example, if there are two simulation device units, there are two identification nodes, one of which is responsible for one simulation device unit, and encrypts the simulated communication behavior data transmitted to the simulation device unit in each monitoring sub-time period, and obtains the encrypted simulated communication behavior data corresponding to the simulated communication behavior data transmitted to the simulation device unit in each monitoring sub-time period, that is, several encrypted simulated communication behavior data are obtained for several monitoring sub-time periods, and the other identification node adopts the same principle;

[0078] The simulated communication behavior data stream is divided into simulated communication behavior data segments, specifically including:

[0079] Obtaining the length of the simulated communication behavior data stream and the length of the simulated communication behavior data segment, dividing the length of the simulated communication behavior data stream by the length of the simulated communication behavior data segment to obtain a division result, and determining whether to fill the simulated communication behavior data stream according to the division result; if the division result is an integer, then the simulated communication behavior data stream is not filled; if the division result is not an integer, then the simulated communication behavior data stream is filled;

[0080] The process of filling the simulated communication behavior data stream includes:

[0081] Obtain the remainder of the length of the simulated communication behavior data stream divided by the length of the simulated communication behavior data segment, and subtract the remainder of the length of the simulated communication behavior data stream divided by the length of the simulated communication behavior data segment from the length of the simulated communication behavior data segment to obtain the subtraction result. ;

[0082] Add at the end of the simulation communication behavior data flow binary ;

[0083] Every The simulated communication behavior data stream is split once to obtain the simulated communication behavior data segment. The length of the data segment for simulating communication behavior;

[0084] The simulated communication behavior data segments are labeled as , , The number of data segments for simulating communication behavior;

[0085] Obtain the first binary bit of the first simulated communication behavior data segment, obtain the first binary bit of the second simulated communication behavior data segment, obtain the first binary bit of the third simulated communication behavior data segment, ..., obtain the first binary bit of the last simulated communication behavior data segment, combine the obtained binary bits according to the label order of the simulated communication behavior data segments, and obtain the access identification verification code corresponding to the monitoring sub-time period;

[0086] The process of generating the simulated communication behavior data key includes:

[0087] Generated by random value generation formula Random values, the random value generation formula is: ;

[0088] in, The random value generated by the random value generation formula, is a randomly changing value and ; Indicates a random generation of arrive Floating values ​​between Indicates a random generation of arrive Floating value between;

[0089] It needs to be explained that this Let the independent variable of the sine function be , introducing fast-growing frequencies and slow-growing logarithmic disturbances, making the fluctuations complex and unstable; this right Add periodic terms The absolute value of the square root is taken to make the result regular but difficult to predict; this one The output range of the sine function is [-1,1]. After being put into the exponential function, the output is Between, that is, [0.367, 2.718], this is an amplifier with periodic perturbation; this one Smooth increase, used to scale exponential results and prevent explosive growth; this High-order cosines introduce very fast variations in high frequencies; this overall term The control is good and will not be too large, but the change pattern is very complex, resulting in irregular and high-frequency fluctuations; this item Slightly perturb the denominator with a sine wave, Increases and becomes stable, providing a subtle noise fluctuation. This part has a greater impact on the This part can be almost ignored;

[0090] Set the random value threshold. The random value threshold can be set through experimental data analysis or experience. When the random value is greater than or equal to the random value threshold, the random value is replaced by , when the random value is less than the random value threshold, the random value is replaced by , collect all replaced random values ​​to obtain the simulated communication behavior data key;

[0091] Convert the simulation communication behavior data key into a two-dimensional array of simulation communication behavior data keys, specifically including:

[0092] Constructing a two-dimensional array , ,and , the front of the simulated communication behavior data key Binary mapping to a two-dimensional array In the first row of the two-dimensional array, as the element in the first row of the two-dimensional array, the first row of the simulated communication behavior data key to Binary mapping to a two-dimensional array In the second row of the two-dimensional array, as the element in the second row of the two-dimensional array, the first to Binary mapping to a two-dimensional array In the third row of the two-dimensional array, as the elements in the third row of the two-dimensional array, ..., the first row of the simulated communication behavior data key to Binary mapping to a two-dimensional array No. In the row, as a two-dimensional array The elements in the row,get the two-dimensional array of simulated communication behavior data keys;

[0093] The simulated communication behavior data is encrypted using the simulated communication behavior data key two-dimensional array. The process of obtaining the encrypted simulated communication behavior data includes:

[0094] Converting the simulated communication behavior data segment into a two-dimensional array of simulated communication behavior data segments using the same method as converting the simulated communication behavior data key into a two-dimensional array of simulated communication behavior data keys;

[0095] Obtain the start time of the monitoring sub-time period, and perform an XOR operation on the elements in the two-dimensional array of the simulated communication behavior data key and the elements in the two-dimensional array of the simulated communication behavior data segments according to the start time of the monitoring sub-time period to obtain an encrypted two-dimensional array of the simulated communication behavior data segments;

[0096] For example, if the start time of the monitoring sub-time period is 07:00:00 on February 18, 2025, the corresponding number is 20250218070000. If 0 is replaced by 1, the corresponding number is 21251218171111.

[0097] If the first two digits of the number corresponding to the start time of the monitoring sub-time period are 2 and 1, then the elements in the second row of the simulation communication behavior data key two-dimensional array are XORed with the elements in the first row of the simulation communication behavior data segment two-dimensional array, and the elements in the first row of the simulation communication behavior data segment two-dimensional array are replaced with the result of the XOR operation. If the third and fourth digits of the number corresponding to the start time of the monitoring sub-time period are 2 and 5 respectively, then the elements in the second row of the simulation communication behavior data key two-dimensional array are XORed with the elements in the fifth row of the simulation communication behavior data segment two-dimensional array, and the elements in the fifth row of the simulation communication behavior data segment two-dimensional array are replaced with the result of the XOR operation. ..., if the second to last digit and the first to last digit of the number corresponding to the start time of the monitoring sub-time period are 1 and 1, then the elements in the first row of the simulation communication behavior data key two-dimensional array are XORed with the elements in the first row of the simulation communication behavior data segment two-dimensional array, and the elements in the first row of the simulation communication behavior data segment two-dimensional array are replaced with the result of the XOR operation to obtain an encrypted simulation communication behavior data segment two-dimensional array;

[0098] Converting the encrypted simulation communication behavior data segment two-dimensional array into the encrypted simulation communication behavior data segment specifically includes:

[0099] The elements in the first row of the two-dimensional array of the encrypted simulation communication behavior data segment are used as the prefix of the encrypted simulation communication behavior data segment. The elements in the second row of the two-dimensional array of the encrypted simulation communication behavior data segment are used as the first to The elements in the third row of the two-dimensional array of the encrypted simulation communication behavior data segment are used as the first to Bit binary, ..., the encrypted simulation communication behavior data segment two-dimensional array The elements in the row are used as the first part of the encrypted simulation communication behavior data segment. to bit binary;

[0100] Merging the encrypted simulation communication behavior data segments in the order of segmentation to obtain encrypted simulation communication behavior data;

[0101] It should be explained that the traditional method does not identify the identity of the visitor, which may cause normal access to be misjudged as abnormal access, and defend normal visitors, so that normal visitors cannot obtain the communication data of the equipment, and thus cannot perform normal analysis on the equipment in the industrial control network, which may cause the equipment in the industrial control network to operate abnormally, thereby affecting the production progress of the factory and reducing the factory's revenue. Therefore, the present invention deploys an identification node in the simulated industrial control honeypot network, and generates a corresponding access identification verification code according to the simulated communication behavior data in the simulated industrial control honeypot network through the identification node, and generates a simulated communication behavior data key, and The real communication behavior data key is converted into a two-dimensional array of simulated communication behavior data keys. The simulated communication behavior data is encrypted by the two-dimensional array of simulated communication behavior data keys to obtain encrypted simulated communication behavior data. The visitor needs to decrypt the encrypted simulated communication behavior data to obtain an access identification verification code. The access identification verification code is used to determine whether it is a normal access or an abnormal access, accurately distinguishing between normal visitors and attackers, so that attackers are defended and normal visitors have normal access, thereby ensuring the normal production progress of the factory and improving the defense capability of the industrial control network. The access identification verification code is dynamic, which further improves the accuracy of judging whether it is a normal access or an abnormal access.

[0102] The process of verifying the access identification code obtained by the visitor by decrypting the encrypted simulated communication behavior data, determining whether the access is normal based on the verification result, and making a corresponding response based on the judgment result includes:

[0103] When a visitor visits a simulation device unit, he first enters the identification node in the simulation device unit, obtains the time when the visitor visits the simulation device unit, and then obtains the monitoring sub-time period to which the time when the visitor visits the simulation device unit belongs, and records it as the access monitoring sub-time period. The identification node provides the visitor with the encrypted simulation communication behavior data of the simulation device unit in the previous monitoring sub-time period of the access monitoring sub-time period and the corresponding simulation communication behavior data key two-dimensional array and the start time of the previous monitoring sub-time period. The visitor decrypts the encrypted simulation communication behavior data to obtain the corresponding access identification verification code, and inputs the access identification verification code into the identification node. The identification node verifies the input access identification verification code. If the input access identification verification code is correct, it is a normal access, and the visitor is given the IP address of the industrial control network in the factory. If it is continuous If the access identification verification code entered is incorrect, it will be considered an abnormal access and the visitor will be permanently banned. It can be set through experimental data analysis or experience;

[0104] It should be explained that the access permission of the simulation device unit is opened from the second monitoring sub-time period. Set to 3.

[0105] In this embodiment, the industrial control network in the factory is identified, and the device information data, industrial protocol, device topology structure and communication behavior data in the industrial control network are obtained. A simulated industrial control honeypot network is constructed based on the device information data, industrial protocol, device topology structure and communication behavior data in the industrial control network. The simulated industrial control honeypot network has high simulation accuracy and is not easily detected by attackers, which attracts attackers to access the simulated industrial control honeypot network, thereby increasing the defense capability of the industrial control network; an identification node is deployed in the simulated industrial control honeypot network, and a corresponding access identification verification code is generated by the identification node according to the simulated communication behavior data in the simulated industrial control honeypot network, and a corresponding access identification verification code is generated. The simulated communication behavior data key is converted into a two-dimensional array of simulated communication behavior data keys, and the simulated communication behavior data is encrypted by the two-dimensional array of simulated communication behavior data keys to obtain encrypted simulated communication behavior data. The visitor needs to decrypt the encrypted simulated communication behavior data to obtain an access identification verification code, and judge whether it is a normal access or an abnormal access according to the access identification verification code, accurately distinguishing normal visitors from attackers, so that attackers are defended and normal visitors have normal access, thereby ensuring the normal production progress of the factory and improving the defense capability of the industrial control network. Moreover, the access identification verification code is dynamic, which further improves the accuracy of judging whether it is a normal access or an abnormal access.

[0106] Example 2

[0107] See also Figure 2 As shown, for the parts not described in detail in this embodiment, please refer to the description of Example 1. An industrial control honeypot defense method based on mirror simulation is provided, including:

[0108] Step S1: Identify the industrial control network in the factory and obtain device information data, industrial protocols, device topology, and communication behavior data in the industrial control network;

[0109] Step S2: Constructing a simulated industrial control honeypot network based on device information data, industrial protocols, device topology, and communication behavior data in the industrial control network;

[0110] Step S3: deploying an authentication node in the simulated industrial control honeypot network, and generating a corresponding access identification verification code based on the simulated communication behavior data in the simulated industrial control honeypot network through the authentication node, and encrypting the simulated communication behavior data to obtain encrypted simulated communication behavior data;

[0111] Step S4: Check the access identification verification code obtained by the visitor decrypting the encrypted simulated communication behavior data, and determine whether it is a normal access based on the verification result, and make a corresponding response.

[0112] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed in the present invention can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0113] In the several embodiments provided by the present invention, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the division of the units is only one type. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0114] The above description is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with this technical field can easily think of changes or replacements within the technical scope disclosed by the present invention, which should be covered by the protection scope of the present invention.

[0115] Finally: The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. The industrial control honeypot defense system based on mirror simulation includes a defense center, which is characterized by: The following components are also included, which are in communication with the Defense Center: The industrial control environment identification component is responsible for identifying the industrial control network within the factory and obtaining device information data, industrial protocols, device topology structure, and communication behavior data in the industrial control network; The simulation honeypot environment construction component is responsible for building a simulation industrial control honeypot network based on the device information data, industrial protocols, device topology structure and communication behavior data in the industrial control network; A security defense deployment component is responsible for deploying an authentication node in the simulated industrial control honeypot network, generating a corresponding access identification verification code based on the simulated communication behavior data in the simulated industrial control honeypot network through the authentication node, generating a simulated communication behavior data key, converting the simulated communication behavior data key into a two-dimensional array of simulated communication behavior data keys, encrypting the simulated communication behavior data using the two-dimensional array of simulated communication behavior data keys, and obtaining encrypted simulated communication behavior data; The method of deploying an authentication node in a simulated industrial control honeypot network and generating a corresponding access identification verification code based on simulated communication behavior data in the simulated industrial control honeypot network through the authentication node includes: An authentication node is deployed in each simulated device unit in the simulated industrial control honeypot network; The monitoring period is divided into a monitoring sub-time period, converting the simulated communication behavior data transmitted to the simulation device unit during the monitoring sub-time period into English representation, converting each converted character into a corresponding ASCII code representation, converting the ASCII code of each character into an eight-bit binary representation, and combining the binary representations of all the characters to form a simulated communication behavior data stream; The simulated communication behavior data stream is divided into simulated communication behavior data segments, and the simulated communication behavior data segments are labeled as , , The number of data segments for simulating communication behavior; Obtain the first binary bit of each simulated communication behavior data segment, combine the obtained binary bits according to the label order of the simulated communication behavior data segments, and obtain the access identification verification code corresponding to the monitoring sub-time period; The behavior monitoring and response component is responsible for verifying the access identification code obtained by the visitor by decrypting the encrypted simulated communication behavior data, and judging whether it is a normal access based on the test result, and making corresponding responses based on the judgment result.

2. The industrial control honeypot defense system based on mirror simulation according to claim 1 is characterized in that: The device information data includes the model, IP address, open port number and communication behavior characteristic table of all devices in the industrial control network; The communication behavior data includes periodic communication data, event-driven communication data, broadcast behavior data, control instruction data, acknowledgement response data, and retry behavior data.

3. The industrial control honeypot defense system based on mirror simulation according to claim 2 is characterized in that: The method for constructing a simulated industrial control honeypot network based on device information data, industrial protocols, device topology, and communication behavior data in the industrial control network includes: Build a simulated device unit based on Docker according to the device information data. At the same time, each simulated device unit is assigned a unique virtual IP address through Docker, and each simulated device unit is configured with the same open port number and communication behavior characteristic table as the corresponding real device. The corresponding simulated device units are interconnected according to the device topology structure, and simulated PLC nodes are constructed based on Python's open source communication library. Simulated communication behavior data are generated according to the communication behavior data in the industrial control network. During the monitoring period, the simulated device units are controlled to communicate with each other through the simulated PLC nodes according to the corresponding industrial protocols and simulated communication behavior data to obtain a simulated industrial control honeypot network.

4. The industrial control honeypot defense system based on mirror simulation according to claim 3 is characterized in that: The method for generating a simulated communication behavior data key comprises: Random Generation A random value, To simulate the length of the communication behavior data segment, set the random value threshold. When the random value is greater than or equal to the random value threshold, replace the random value with , when the random value is less than the random value threshold, the random value is replaced by , collect all the replaced random values ​​and obtain the simulated communication behavior data key.

5. The industrial control honeypot defense system based on mirror simulation according to claim 4 is characterized in that: The method for converting the simulated communication behavior data key into a two-dimensional array of simulated communication behavior data keys comprises: Constructing a two-dimensional array , ,and , the front of the simulated communication behavior data key Binary mapping to a two-dimensional array In the first line of the simulation communication behavior data key to Binary mapping to a two-dimensional array In the second line of the simulation communication behavior data key to Binary mapping to a two-dimensional array In the third line, ..., the first to Binary mapping to a two-dimensional array No. In the row, obtain the two-dimensional array of simulated communication behavior data keys.

6. The industrial control honeypot defense system based on mirror simulation according to claim 5, characterized in that: The method of encrypting the simulated communication behavior data by using the simulated communication behavior data key two-dimensional array to obtain the encrypted simulated communication behavior data includes: Converting the simulated communication behavior data segment into a two-dimensional array of simulated communication behavior data segments using the same method as converting the simulated communication behavior data key into a two-dimensional array of simulated communication behavior data keys; Obtain the start time of the monitoring sub-time period, and perform an XOR operation on the elements in the two-dimensional array of the simulated communication behavior data key and the elements in the two-dimensional array of the simulated communication behavior data segments according to the start time of the monitoring sub-time period to obtain an encrypted two-dimensional array of the simulated communication behavior data segments; The encrypted simulation communication behavior data segment two-dimensional array is converted into the encrypted simulation communication behavior data segment, and the encrypted simulation communication behavior data segment is merged according to the segmentation order to obtain the encrypted simulation communication behavior data.

7. The industrial control honeypot defense system based on mirror simulation according to claim 6, characterized in that: The method for converting the encrypted simulation communication behavior data segment two-dimensional array into the encrypted simulation communication behavior data segment comprises: The elements in the first row of the two-dimensional array of the encrypted simulation communication behavior data segment are used as the prefix of the encrypted simulation communication behavior data segment. The elements in the second row of the two-dimensional array of the encrypted simulation communication behavior data segment are used as the first bit of the encrypted simulation communication behavior data segment. to The elements in the third row of the two-dimensional array of the encrypted simulation communication behavior data segment are used as the first to Bit binary, ..., the encrypted simulation communication behavior data segment two-dimensional array The elements in the row are used as the first part of the encrypted simulation communication behavior data segment. to Bit binary.

8. The industrial control honeypot defense system based on mirror simulation according to claim 7, characterized in that: The method of verifying the access identification verification code obtained by decrypting the encrypted simulated communication behavior data, and judging whether the access is normal according to the verification result, and making a corresponding response according to the judgment result includes: When a visitor accesses the simulation device unit, the authentication node in the simulation device unit is first entered to obtain the time when the visitor accesses the simulation device unit, and then the monitoring sub-time period to which the time when the visitor accesses the simulation device unit belongs is obtained and recorded as the access monitoring sub-time period; The authentication node provides the visitor with the encrypted simulated communication behavior data of the simulated device unit in the previous monitoring sub-time period of the access monitoring sub-time period, the corresponding two-dimensional array of simulated communication behavior data keys, and the start time of the previous monitoring sub-time period. The visitor decrypts the encrypted simulated communication behavior data to obtain the corresponding access identification verification code, and inputs the access identification verification code to the authentication node, which verifies the input access identification verification code. If the access identification code entered is correct, it is considered normal access and the visitor will be given the IP address of the industrial control network in the factory. If the access identification verification code entered is incorrect, it will be considered an abnormal access and the visitor will be permanently banned.

9. An industrial control honeypot defense method based on mirror simulation, which is applied to the industrial control honeypot defense system based on mirror simulation according to any one of claims 1 to 8, characterized in that: include: Step S1: Identify the industrial control network in the factory and obtain device information data, industrial protocols, device topology, and communication behavior data in the industrial control network; Step S2: Constructing a simulated industrial control honeypot network based on device information data, industrial protocols, device topology, and communication behavior data in the industrial control network; Step S3: deploying an authentication node in the simulated industrial control honeypot network, and generating a corresponding access identification verification code based on the simulated communication behavior data in the simulated industrial control honeypot network through the authentication node, and encrypting the simulated communication behavior data to obtain encrypted simulated communication behavior data; Step S4: Check the access identification verification code obtained by the visitor decrypting the encrypted simulated communication behavior data, and determine whether it is a normal access based on the verification result, and make a corresponding response.

Images