Simplified aggregation method and device for industrial control security incidents

Abstract

This application provides a simplified aggregation method, apparatus, computer equipment, and storage medium for industrial control system (ICS) security events. The method includes: acquiring a data source; configuring corresponding location identifiers and global identifiers for the data source; and inputting the data source configured with the location identifiers and global identifiers into an aggregation model to obtain the events corresponding to the data source. This application addresses the issues of effective utilization of network security resources, particularly for ICS network security, and effective data aggregation.

Description

Technical Field

[0001] This application relates to the fields of industrial control technology and information security, and in particular to a simplified aggregation method, apparatus, computer equipment, and storage medium for industrial control security events. Background Technology

[0002] Traditional data cleaning ETL (extract, transform, load) is responsible for extracting data from scattered, heterogeneous data sources, such as relational data and flat data files, to a temporary intermediate layer for cleaning, transformation, and integration. Finally, it loads the data into a data warehouse or data mart, providing decision support for online analytical processing and data mining. ETL is a crucial part of building a data warehouse. Users extract the required data from the data source, clean it, and then load it into the data warehouse according to a predefined data warehouse model. Its definition has existed for over a decade, and the technology should be quite mature. At first glance, it may seem simple and unremarkable, but in actual projects, this stage often consumes a significant amount of manpower, and subsequent maintenance is often even more challenging. A project may involve hundreds of ETL processes from the data source to the final target table, or at least a dozen. The dependencies between these processes, error control, and recovery processes are all key considerations that the tool must address.

[0003] Compared to traditional ETL, security ETL for information and industrial control systems has its unique advantages. Industrial control network resources are limited. Source data from hosts, security devices, and network devices typically originates from devices within fixed service areas. When these devices experience resource alerts or are subjected to network attacks, they report large amounts of data. For example, a common DDoS (Denial of Service) attack exhausts the resources of the attacked server, rendering it unable to provide normal service and indirectly denying it access. Furthermore, if these devices experience alerts regarding CPU, memory, or hard drive resources, they continuously generate large amounts of data. Traditional ETL technologies simply collect this data, but the very act of collecting this data results in a significant waste of computing, network, and storage resources.

[0004] In the security field, there are several traditional methods for implementing ETL, with three commonly used ones. The first is using ETL tools such as Oracle's OWB, SQL Server 2000's DTS, SQL Server 2005's SSIS service, and Informatics. The second is implementation using SQL. The third is a combination of ETL tools and SQL. The first two methods each have their advantages and disadvantages. Using tools allows for rapid ETL project setup, shielding complex coding tasks, increasing speed, and reducing difficulty, but lacks flexibility. The SQL method offers flexibility and improves ETL efficiency, but the coding is complex and requires higher technical skills. The third method combines the advantages of the first two, greatly improving ETL development speed and efficiency, but it still falls short in terms of data effectiveness. Summary of the Invention

[0005] In view of this, the purpose of this application is to propose a simplified aggregation method, apparatus, computer equipment and storage medium for industrial control system security events, so as to solve the problem of effective utilization of network security resources and effective aggregation of data, especially industrial control system network security.

[0006] To achieve the above objectives, this application proposes a simplified aggregation method for industrial control security events, the method comprising:

[0007] Obtain the data source;

[0008] Configure corresponding location identifiers and global identifiers for each of the data sources;

[0009] The data source configured with the location identifier and global identifier is input into the aggregation model to obtain the event corresponding to the data source.

[0010] In one embodiment, the data source includes log data and traffic data.

[0011] In one embodiment, configuring corresponding location identifiers and global identifiers for the data source includes:

[0012] Configure the corresponding location identifier and global identifier for the log data and traffic data respectively to obtain the log data and traffic data configured with the identifiers.

[0013] In one embodiment, configuring corresponding location identifiers and global identifiers for the log data and traffic data respectively to obtain log data and traffic data configured with identifiers includes:

[0014] Search the device fingerprint database for the device feature values ​​corresponding to the log data and traffic data respectively;

[0015] Based on the device characteristic values, the location identifier and global identifier corresponding to the log data and traffic data are determined respectively.

[0016] In one embodiment, determining the location identifiers corresponding to the log data and traffic data based on the device characteristic values ​​includes:

[0017] The device feature values ​​are precisely analyzed to obtain word vectors for the device feature values.

[0018] The word vectors are then subjected to similarity calculation to obtain similarity results;

[0019] If the similarity result is greater than the preset result threshold, then the corresponding location identifier and global identifier are set for the log data and traffic data, respectively.

[0020] In one embodiment, the step of inputting the data source configured with a home location identifier and a global identifier into the aggregation model to obtain the event corresponding to the data source includes:

[0021] The FlinkCEP distributed streaming data engine is used to split the log data and traffic data configured with location identifiers and global identifiers, respectively.

[0022] The split log data and traffic data are semantically parsed to obtain parsed log data and traffic data;

[0023] The engine processes the parsed log data and traffic data according to the defined rules, and outputs the events corresponding to the log data and traffic data to the message queue respectively.

[0024] A simplified aggregation device for industrial control security incidents, the device comprising:

[0025] The acquisition module is used to acquire data sources;

[0026] The configuration module is used to configure the corresponding home location identifier and global identifier for the data source respectively;

[0027] The event output module is used to input the data source configured with the location identifier and global identifier into the aggregation model to obtain the event corresponding to the data source.

[0028] A computer device includes a memory and a processor, the memory storing a computer program, the processor executing the computer program to implement the steps of the method as described in any of the preceding claims.

[0029] A computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method described in any of the preceding claims.

[0030] This application provides a simplified aggregation method, apparatus, computer equipment, and storage medium for industrial control system (ICS) security events. The method includes: acquiring a data source; configuring corresponding location identifiers and global identifiers for the data source; and inputting the data source configured with the location identifiers and global identifiers into an aggregation model to obtain the events corresponding to the data source. This application addresses the issues of effective utilization of network security resources, particularly for ICS network security, and effective data aggregation. Attached Figure Description

[0031] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0032] Figure 1 This is a flowchart illustrating a simplified aggregation method for industrial control security events according to an embodiment of this application.

[0033] Figure 2 This application's embodiment is a flowchart illustrating the data configuration of the location identifier;

[0034] Figure 3 A schematic diagram illustrating the process of configuring a location identifier for data according to another embodiment of this application;

[0035] Figure 4 A flowchart illustrating the process of configuring a global identifier for data in an embodiment of this application;

[0036] Figure 5 This is a schematic diagram of the configuration aggregation rule details structure in an embodiment of this application;

[0037] Figure 6 This is a schematic diagram of the data validity aggregation process in an embodiment of this application;

[0038] Figure 7 This is a schematic diagram of the structure of an industrial control security event simplification and aggregation device according to an embodiment of this application;

[0039] Figure 8 This is a schematic diagram of the internal structure of a computer device according to an embodiment of this application. Detailed Implementation

[0040] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with specific embodiments and the accompanying drawings.

[0041] It should be noted that, unless otherwise defined, the technical or scientific terms used in the embodiments of this application should have the ordinary meaning understood by one of ordinary skill in the art to which this disclosure pertains. The terms "first," "second," and similar terms used in this disclosure do not indicate any order, quantity, or importance, but are merely used to distinguish different components. Terms such as "comprising" or "including" mean that the element or object preceding the word encompasses the elements or objects listed following the word and their equivalents, without excluding other elements or objects. Terms such as "connected" or "linked" are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. Terms such as "upper," "lower," "left," and "right" are used only to indicate relative positional relationships; when the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0042] To facilitate understanding of this application, the following keywords need to be explained, as follows:

[0043] Source data: refers to the logs and traffic data generated by hosts, network devices, and security devices running various industrial control software in an industrial control environment.

[0044] Event: Refers to standardized data after the source data has been generalized and enhanced.

[0045] Event PID: PlaceIdentity, which refers to the device to which the event belongs. There are eight levels: province, city, county, factory area, security zone, system, IP, and MAC.

[0046] Event EID: EventIdentity, a globally unique identifier assigned to an event according to inspection rules.

[0047] Validity aggregation: Based on a set of industrial control rules that users can use, users can add their own protocol rules according to their actual situation.

[0048] The key feature of this method is that it identifies and aggregates the validity of data generated by industrial control equipment and network equipment, analyzes and intercepts massive amounts of metadata, and ultimately forms valid events for subsequent analysis and utilization.

[0049] See Figure 1 This application proposes a simplified aggregation method for industrial control security events, the method comprising:

[0050] Step S10: Obtain the data source;

[0051] Step S20: Configure the corresponding home location identifier and global identifier for the data source respectively;

[0052] Step S30: Input the data source configured with the location identifier and global identifier into the aggregation model to obtain the event corresponding to the data source.

[0053] In one embodiment, the data source includes log data and traffic data.

[0054] In one embodiment, step S20 includes:

[0055] Step S201: Configure the corresponding location identifier and global identifier for the log data and traffic data respectively to obtain the log data and traffic data configured with the identifiers.

[0056] In one embodiment, step S201 includes:

[0057] Step S2011: Query the device feature value corresponding to the log data and traffic data respectively in the device fingerprint database;

[0058] Step S2012: Based on the device characteristic values, determine the location identifier and global identifier corresponding to the log data and traffic data, respectively.

[0059] In one embodiment, step S2012 includes:

[0060] Step S2012a: Accurately analyze the device feature values ​​to obtain word vectors for the device feature values;

[0061] Step S2012b: Calculate the similarity of the word vectors to obtain the similarity results;

[0062] Step S2012c: If the similarity result is greater than the preset result threshold, then set the corresponding location identifier and global identifier for the log data and traffic data respectively.

[0063] In one embodiment, step S30 includes:

[0064] Step S301: Use the FlinkCEP distributed streaming data engine to split the log data and traffic data configured with the home location identifier and global identifier respectively;

[0065] Step S302: Perform semantic parsing on the split log data and traffic data respectively to obtain parsed log data and traffic data;

[0066] Step S303: Use the engine to process the parsed log data and traffic data according to the defined rules, and output the events corresponding to the log data and traffic data to the message queue respectively.

[0067] In one embodiment, see Figure 2-4The specific implementation process of step S201 of this application will be described in detail below.

[0068] I. Data Location Identifier (PID)

[0069] Data location identifiers categorize data into two types: logs and traffic. Log data supports transmission protocols such as TCP / UDP, Syslog, and SNMP; traffic data supports port mirroring. These data correspond to relevant process services for processing.

[0070] This process of generating library files is divided into several modules:

[0071] The log receiving module is used to receive logs from all devices in the network.

[0072] The device fingerprint module is used to update the latest device location information.

[0073] The device fingerprint annotation module extracts device feature information.

[0074] The PID module links device fingerprint, device location, and device data.

[0075] The detailed procedure is as follows:

[0076] After receiving log and traffic data, the system queries the device fingerprint database for the associated device feature values. The fingerprint database stores the features of each device that generates data, such as HP ProLiant DL380 G7, ESXI6.5, etc. The feature extraction program first performs precise word segmentation (jieba) on the source data according to the feature values, and then converts it into word vectors for similarity calculation. Data with similarity greater than the threshold are added to the local database.

[0077] II. Global Data Identifier (EID)

[0078] After the event data is supplemented with the location ID, it undergoes a global ID encoding module. This module standardizes the data for subsequent validity aggregation.

[0079] This process is divided into several modules:

[0080] The log feature value module is used to generate IDs for all data according to log rules.

[0081] The traffic rule library module is used to generate IDs for all data according to traffic rules.

[0082] The intelligence database module identifies data by IP address and marks it with an ID to determine if the corresponding data belongs to the intelligence database.

[0083] The IP reputation database module labels IDs based on whether the corresponding data for an IP query belongs to the IP reputation database.

[0084] The vulnerability database module uses vulnerability characteristic values ​​to query whether corresponding data belongs to the vulnerability database module and then labels it with an ID.

[0085] The detailed procedure is as follows:

[0086] After the event data is supplemented with the location information, it enters this module. The data is then sequentially entered into knowledge bases such as logs, traffic, intelligence, reputation, and vulnerabilities. The ID is supplemented by querying and matching according to the corresponding feature values. The execution logic of this module prioritizes matching rules, that is, it exits the matching logic after a rule is matched in the knowledge base.

[0087] In one embodiment, see Figure 5-6 The following details the specific implementation process of step S30 of this application.

[0088] This module is the core of this design. After the data has been standardized by location and global ID as described above, it is configured here for validity aggregation. The following is defined as the rule format, divided into 5 domains:

[0089] [Event Name] [Aggregate Field 1 | ... | Aggregate Field n] [Location] [Window Day | Hour | Minute | Second | Count | Threshold] [Output zero | one | all Implementation Class]

[0090] Detailed explanation:

[0091] The event name field defines the object being aggregated.

[0092] Aggregate field fields and customize aggregation conditions.

[0093] Geographical location is the default aggregation condition.

[0094] Window field, values ​​are optional: day|hour|minute|second|number of times|threshold.

[0095] Output field, value is optional: zero|one|all|implementation class.

[0096] Standardized data prepares the data for aggregation rules. The aggregation engine executes the aggregation logic according to the defined rules, generates valid data, reduces redundant data transmission, saves resources, especially network transmission, and improves data utilization efficiency.

[0097] This process is divided into several modules:

[0098] The aggregation engine module is used to employ the FlinkCEP distributed streaming data stream engine.

[0099] The rule parsing module is used to perform semantic parsing on the defined rules.

[0100] The output module, where the aggregation engine outputs aggregated data to the message queue Kafka according to the defined rules.

[0101] It should be understood that, although Figure 1 The steps in the flowchart are shown sequentially as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order in which these steps are executed, and they can be performed in other orders. Figure 1 At least some of the steps in the process may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least some of the sub-steps or stages of other steps.

[0102] like Figure 7 As shown, an industrial control security incident simplification and aggregation device includes:

[0103] Module 100 is used to obtain the data source;

[0104] Configuration module 200 is used to configure the corresponding home location identifier and global identifier for the data source respectively;

[0105] The event output module 300 is used to input the data source configured with the location identifier and the global identifier into the aggregation model to obtain the event corresponding to the data source.

[0106] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 8 As shown, the computer device includes a processor, memory, network interface, and database connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and database. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The database stores data required by the computer programs. The network interface communicates with external terminals via a network connection. When the computer program is executed by the processor, it implements an information decoupling method.

[0107] Those skilled in the art will understand that Figure 8The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0108] In one embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the steps described in the method above.

[0109] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, performs the steps described in the method above.

[0110] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), Rambus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0111] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0112] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. A simplified aggregation method for industrial control security events, characterized in that, The method includes: Obtain the data source; Configure corresponding location identifiers and global identifiers for each of the data sources; The data source configured with the location identifier and global identifier is input into the aggregation model to obtain the event corresponding to the data source; The data source includes: Log data and traffic data; Configure the corresponding home location identifier and global identifier respectively, including: Configure the corresponding location identifier and global identifier for the log data and traffic data respectively to obtain log data and traffic data configured with identifiers; The step of configuring corresponding location identifiers and global identifiers for the log data and traffic data respectively, to obtain log data and traffic data configured with identifiers, includes: Search the device fingerprint database for the device feature values ​​corresponding to the log data and traffic data respectively; Based on the device characteristic values, the location identifier and global identifier corresponding to the log data and traffic data are determined respectively; The step of determining the location identifier corresponding to the log data and traffic data based on the device characteristic values ​​includes: The device feature values ​​are precisely analyzed to obtain word vectors for the device feature values. The word vectors are then subjected to similarity calculation to obtain similarity results; If the similarity result is greater than the preset result threshold, then the corresponding location identifier and global identifier are set for the log data and traffic data respectively; The step of inputting the data source configured with a location identifier and a global identifier into the aggregation model to obtain the events corresponding to the data source includes: The FlinkCEP distributed streaming data engine is used to split the log data and traffic data configured with location identifiers and global identifiers, respectively. The split log data and traffic data are semantically parsed to obtain parsed log data and traffic data; The engine processes the parsed log data and traffic data according to the defined rules, and outputs the events corresponding to the log data and traffic data to the message queue respectively. The rule definition is divided into 5 domains: event name, aggregate field 1 | ... | aggregate field n, location, window day | hour | minute | second | number of times | threshold, and output zero | one | all implementation class.

2. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method of claim 1.

3. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method of claim 1.

Images