Industrial host security protection method, device, system and storage medium

Abstract

The embodiment of the present invention discloses a security protection method, device, system and storage medium for an industrial host. The method is applied to a security protection system client installed on an industrial host, and includes: when it is detected that the target software is running in the industrial host, the data content of the executable file of the target software is automatically scanned to generate a target file feature code; the target file feature code is used to match the target whitelist from the whitelist library, and the working mode corresponding to the target file feature code is obtained from the target whitelist; the suspicious file feature code corresponding to the suspicious file executing the target software is determined, and whether there is a whitelist matching the suspicious file feature code in the whitelist library; if not, the suspicious file is subjected to corresponding alarm or blocking operations according to the working mode of the target software. The technical solution of the embodiment of the present invention prohibits abnormal programs from running in the industrial host by performing lightweight whitelist matching, thereby realizing security protection for the industrial host.

Description

Technical Field

[0001] Embodiments of the present invention relate to the field of industrial security technology, and in particular, to a security protection method, device, system and storage medium for an industrial host. Background Art

[0002] In the prior art, industrial hosts have the following characteristics in terms of security protection compared to ordinary IT system hosts: 1) Industrial hosts will run for many years after commissioning, and hardware resources are limited, so antivirus software cannot often be installed; 2) Industrial hosts will not be upgraded or add new software or plug-ins at will, and the antivirus library in the industrial control system cannot be upgraded regularly; 3) Ordinary antivirus software installed may accidentally kill key processes, causing abnormal operation of the industrial control system; 4) Antivirus software generally uses local engines or cloud virus libraries to detect and kill viruses on industrial hosts, which may cause processing delays for industrial software. These characteristics make it difficult to provide comprehensive security protection for industrial hosts. Summary of the invention

[0003] The embodiments of the present invention provide a method, device, system and storage medium for security protection of an industrial host, which prohibit abnormal programs from running in the industrial host by performing lightweight whitelist matching, thereby achieving security protection for the industrial host.

[0004] In a first aspect, an embodiment of the present invention provides a security protection method for an industrial host, which is applied to a security protection system client installed on the industrial host, comprising:

[0005] When it is detected that the target software is running in the industrial host, the data content of the executable file of the target software is automatically scanned to generate the target file feature code;

[0006] Use the target file signature to match the target whitelist from the whitelist library, and obtain the working mode corresponding to the target file signature from the target whitelist;

[0007] Determine the suspicious file signature code corresponding to the suspicious file executing the target software, and query whether there is a whitelist matching the suspicious file signature code in the whitelist library;

[0008] If it does not exist, the suspicious file will be warned or blocked accordingly according to the working mode of the target software.

[0009] Optionally, the working mode includes an alarm mode and a protection mode;

[0010] Alarm mode is used to issue a real-time alarm when an abnormal program executes a protected executable file, but does not block the execution of the abnormal program;

[0011] Protection mode is used to issue real-time alarms and block the execution of abnormal programs when abnormal programs execute protected executable files.

[0012] Optionally, also include:

[0013] If it is detected that the industrial host downloads or starts using new software, the working mode is set for the new software, and the data content of the executable file of the new software is automatically scanned to generate a new file signature code;

[0014] Generate a new whitelist using the new file signature and working mode, and store the new whitelist in the whitelist library for the update to take effect.

[0015] Optionally, also include:

[0016] When the access of the external storage device is detected, judging whether the external storage device has access permission based on the unique identifier of the external storage device;

[0017] If there is access permission, the device operation permission is obtained according to the unique identification of the external storage device, and the operation of the external storage device is responded to according to the device operation permission.

[0018] In a second aspect, an embodiment of the present invention further provides a security protection device for an industrial host, which is applied to a security protection system client installed on the industrial host, and includes:

[0019] The file scanning module is used to automatically scan the data content of the executable file of the target software and generate a target file feature code when detecting that the target software is running in the industrial host;

[0020] A whitelist matching module is used to match a target whitelist from a whitelist library using a target file signature, and obtain a working mode corresponding to the target file signature from the target whitelist;

[0021] A query module is used to determine the suspicious file signature code corresponding to the suspicious file executing the target software, and query whether there is a whitelist matching the suspicious file signature code in the whitelist library;

[0022] The alarm module is used to perform corresponding alarm or blocking operations on suspicious files according to the working mode of the target software if the suspicious files do not exist.

[0023] Optionally, the working mode includes an alarm mode and a protection mode;

[0024] Alarm mode is used to issue a real-time alarm when an abnormal program executes a protected executable file, but does not block the execution of the abnormal program;

[0025] Protection mode is used to issue real-time alarms and block the execution of abnormal programs when abnormal programs execute protected executable files.

[0026] In a third aspect, an embodiment of the present invention further provides an industrial host security protection system, the system comprising: a client installed on the industrial host and a control center installed on the server;

[0027] A client, used to execute the security protection method for the industrial host provided by the embodiment of the present invention;

[0028] The control center is used to centrally manage multiple industrial hosts in a networked environment.

[0029] Optional, the industrial host security protection system includes a stand-alone version and a network version;

[0030] The stand-alone version of the industrial host security protection system is used to provide security protection for isolated industrial hosts in isolation. The system includes: a client installed on the industrial host;

[0031] The network version of the industrial host security protection system is used to centrally control multiple industrial hosts in a networked environment. The system includes: a client installed on the industrial host and a control center installed on the server.

[0032] Optionally, the control center is used to collect log data reported by each client for analysis. If a network attack event is found, the propagation path of the network attack event is cut off, and a security protection strategy is generated and sent to the clients on all industrial hosts.

[0033] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium on which a computer program is stored, and when the program is executed by a processor, the security protection method for the industrial host provided by any embodiment of the present invention is implemented.

[0034] In the embodiment of the present invention, when the industrial host security protection system client detects that the target software is running in the industrial host, it automatically scans the data content of the executable file of the target software and generates a target file feature code; uses the target file feature code to match the target whitelist from the whitelist library, and obtains the working mode corresponding to the target file feature code from the target whitelist; determines the suspicious file feature code corresponding to the suspicious file executing the target software, and queries whether there is a whitelist matching the suspicious file feature code in the whitelist library; if not, performs corresponding alarm or blocking operations on the suspicious file according to the working mode of the target software, thereby solving the problem of difficulty in performing security protection on the industrial host in the prior art, and prohibits abnormal programs from running in the industrial host by performing lightweight whitelist matching, thereby achieving security protection for the industrial host. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1a It is a flow chart of a security protection method for an industrial host in Embodiment 1 of the present invention;

[0036] Figure 1b This is a schematic diagram of a whitelist architecture in Embodiment 1 of the present invention;

[0037] Figure 1c This is a flowchart of intercepting an abnormal program in Embodiment 1 of the present invention;

[0038] Figure 2 It is a structural schematic diagram of a safety protection device for an industrial host in Embodiment 2 of the present invention;

[0039] Figure 3a It is a structural schematic diagram of an industrial host security protection system in Embodiment 3 of the present invention;

[0040] Figure 3b This is an architecture diagram of a network version of an industrial host security protection system in Embodiment 3 of the present invention. DETAILED DESCRIPTION

[0041] The present invention will be further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are only used to explain the present invention, rather than to limit the present invention. It should also be noted that, for ease of description, only parts related to the present invention, rather than all structures, are shown in the accompanying drawings.

[0042] Embodiment 1

[0043] Figure 1a This is a flow chart of a security protection method for an industrial host in the first embodiment of the present invention. This embodiment is applicable to the case of comprehensive security protection for industrial hosts. The method can be executed by a security protection device for the industrial host. The device can be implemented by hardware and / or software and can generally be integrated in the industrial host security protection system client that provides industrial security protection services. Figure 1a As shown, the method includes:

[0044] Step 110: When it is detected that the target software is running in the industrial host, the data content of the executable file of the target software is automatically scanned to generate a target file feature code.

[0045] In this embodiment, in order to detect whether there is an abnormal program in the industrial host where the client is located, it is possible to detect in real time whether there is software running in the industrial host. If the running target software is captured, the executable file of the target software is automatically scanned to form a unique target file feature code. Among them, the file feature code does not depend on the file name, file path or extension of the executable file, but only on the data features of the executable file itself. As long as the executable file changes, the file feature code changes accordingly.

[0046] Step 120: Use the target file feature code to match the target whitelist from the whitelist library, and obtain the working mode corresponding to the target file feature code from the target whitelist.

[0047] In this embodiment, the whitelist includes the file signature code and working mode of the executable files that are pre-set and allowed to run in the industrial host. After determining the target file signature code, the target file signature code can be used to query the matching whitelist in the whitelist library. If the target whitelist including the target file signature code is queried, the target software is considered to be protected conventional software, and the working mode corresponding to the target file signature code needs to be obtained from the target whitelist to determine the security protection level of the target software. If the whitelist including the target file signature code is not queried, the target software is considered to be unprotected and no security protection operation is performed on it.

[0048] Optionally, the working modes include an alarm mode and a protection mode; the alarm mode is used to issue a real-time alarm when an abnormal program executes a protected executable file, but does not block the execution of the abnormal program; the protection mode is used to issue a real-time alarm when an abnormal program executes a protected executable file, and blocks the execution of the abnormal program.

[0049] In this embodiment, the working mode of the software to be protected can be set to an alarm mode or a protection mode according to its importance. When the working mode is the alarm mode, if the protected executable file is executed by an abnormal program, a real-time alarm will be issued based on the relevant information of the executable file and the abnormal program, but the execution of the abnormal program will not be blocked; when the working mode is the protection mode, if the protected executable file is executed by an abnormal program, an alarm will be issued and blocked at the same time, so that the abnormal program cannot run.

[0050] In this embodiment, when the system client is installed in the industrial host, the software used by the industrial host is selected, and the executable file of the software is automatically scanned to generate a file feature code to add to the whitelist, and then the corresponding working mode is set for the software to add to the whitelist, and the whitelist is added to the whitelist library for application to take effect. Figure 1bAs shown, it is convenient to judge whether the software in the host is allowed to run according to the whitelist in the whitelist library.

[0051] Step 130: determine the suspicious file feature code corresponding to the suspicious file executing the target software, and query whether there is a whitelist matching the suspicious file feature code in the whitelist library.

[0052] In this embodiment, after determining that the target software is protected software, it is necessary to further verify whether the executor of the target software is an abnormal program. The program that executes the target software can be first obtained as a suspicious file, and the data content of the suspicious file is scanned to generate a suspicious file feature code, and a whitelist match is performed in the whitelist library according to the suspicious file feature code. If the whitelist is matched, it is considered that the executor of the target software is not an abnormal program and can run normally.

[0053] Step 140: If it does not exist, a corresponding warning or blocking operation is performed on the suspicious file according to the working mode of the target software.

[0054] In this embodiment, if a whitelist matching the file feature code cannot be found in the whitelist library, the executor of the target software is considered to be an abnormal program and needs to perform corresponding protection processing. At this time, if the working mode of the target software is the alarm mode, a real-time alarm is issued based on the relevant information of the executable file and the abnormal program, but the operation of the abnormal program does not need to be blocked; if the working mode is the protection mode, the operation of the abnormal program will be blocked while issuing an alarm.

[0055] Optionally, it may also include: if it is detected that the industrial host downloads or starts using new software, setting a working mode for the new software, and automatically scanning the data content of the executable file of the new software to generate a new file feature code; using the new file feature code and working mode to generate a new whitelist, and storing the new whitelist in the whitelist library for update to take effect.

[0056] In this embodiment, Figure 1b As shown in the figure, when the industrial host needs to use new software and needs to update the whitelist software, you can add directories or files to release the whitelist, or set trusted directories or trusted files for full trust and release. When the whitelist is updated, it needs to be saved in the whitelist library for application to take effect. Among them, the whitelist of new software can be imported and generated, or scanned and generated. Import generation can directly import the generated whitelist into the client; scan generation can automatically scan the data content of the executable file of the new software to generate a new file feature code, and add the working mode of the new software and the new file feature code to the new whitelist. Among them, the whitelist library supports operations such as querying, importing, exporting, and displaying lists of whitelists.

[0057] Optionally, it may also include: when an external storage device is detected to be connected, judging whether the external storage device has access permission based on the unique identifier of the external storage device; if there is access permission, obtaining the device operation permission according to the unique identifier of the external storage device, and responding to the operation of the external storage device according to the device operation permission.

[0058] In this embodiment, Figure 1c As shown, in order to more comprehensively protect the industrial host, access permissions can be set for external storage devices in advance to prevent unauthorized external storage devices from introducing viruses. Therefore, when an external storage device is found to be connected to the industrial host, it can be determined whether it has access permissions based on the device ID of the device. If it is not authorized, the device is not allowed to access. If it is determined to be authorized, the device ID of the device is used to query the specific operation permissions, and only respond to operations with open permissions.

[0059] In this embodiment, in addition to authorizing access to external storage devices, the network defense engine and special killing tools built into the system for the "Eternal Blue" vulnerability can also be used to intercept network attacks of "Eternal Blue" and its variants in real time. By using technologies such as "vulnerability exploitation analysis-traffic analysis comparison-suspicious attack blocking", it is possible to predict and defend against the "Eternal Blue" ransomware virus without patching the industrial host or closing the port.

[0060] In this embodiment, the industrial host security protection system uses a lightweight "whitelist" technology to comprehensively protect the host's resource usage. According to the whitelist strategy, the industrial host security protection system will prohibit the operation of illegal processes, and prohibit the access of illegal USB devices through USB mobile storage peripheral management based on the unique device identifier. At the same time, it will perform permission management on legal USB devices, and can also combine vulnerability defense, network protection and other security protection measures to cut off the spread and destruction path of viruses and Trojans.

[0061] In the embodiment of the present invention, when the industrial host security protection system client detects that the target software is running in the industrial host, it automatically scans the data content of the executable file of the target software and generates a target file feature code; uses the target file feature code to match the target whitelist from the whitelist library, and obtains the working mode corresponding to the target file feature code from the target whitelist; determines the suspicious file feature code corresponding to the suspicious file executing the target software, and queries whether there is a whitelist matching the suspicious file feature code in the whitelist library; if not, performs corresponding alarm or blocking operations on the suspicious file according to the working mode of the target software, thereby solving the problem of difficulty in performing security protection on the industrial host in the prior art, and prohibits abnormal programs from running in the industrial host by performing lightweight whitelist matching, thereby achieving security protection for the industrial host.

[0062] Embodiment 2

[0063] Figure 2 This is a schematic diagram of the structure of a security protection device for an industrial host in the second embodiment of the present invention. This embodiment is applicable to the situation where comprehensive security protection is provided to the industrial host. The device can be implemented by hardware and / or software and can generally be integrated in the industrial host security protection system client that provides industrial security protection services. Figure 2 As shown, the device comprises:

[0064] The file scanning module 210 is used to automatically scan the data content of the executable file of the target software and generate a target file feature code when detecting that the target software is running in the industrial host;

[0065] A whitelist matching module 220 is used to match a target whitelist from a whitelist library using a target file feature code, and obtain a working mode corresponding to the target file feature code from the target whitelist;

[0066] The query module 230 is used to determine the suspicious file feature code corresponding to the suspicious file executing the target software, and query whether there is a whitelist matching the suspicious file feature code in the whitelist library;

[0067] The warning module 240 is used to perform corresponding warning or blocking operations on the suspicious file according to the working mode of the target software if it does not exist.

[0068] In the embodiment of the present invention, when the industrial host security protection system client detects that the target software is running in the industrial host, it automatically scans the data content of the executable file of the target software and generates a target file feature code; uses the target file feature code to match the target whitelist from the whitelist library, and obtains the working mode corresponding to the target file feature code from the target whitelist; determines the suspicious file feature code corresponding to the suspicious file executing the target software, and queries whether there is a whitelist matching the suspicious file feature code in the whitelist library; if not, performs corresponding alarm or blocking operations on the suspicious file according to the working mode of the target software, thereby solving the problem of difficulty in performing security protection on the industrial host in the prior art, and prohibits abnormal programs from running in the industrial host by performing lightweight whitelist matching, thereby achieving security protection for the industrial host.

[0069] Optionally, the working mode includes an alarm mode and a protection mode;

[0070] Alarm mode is used to issue a real-time alarm when an abnormal program executes a protected executable file, but does not block the execution of the abnormal program;

[0071] Protection mode is used to issue real-time alarms and block the execution of abnormal programs when abnormal programs execute protected executable files.

[0072] Optionally, also include:

[0073] The update module is used to set the working mode for the new software if it is detected that the industrial host downloads or starts using new software, and automatically scan the data content of the executable file of the new software to generate a new file signature code;

[0074] Generate a new whitelist using the new file signature and working mode, and store the new whitelist in the whitelist library for the update to take effect.

[0075] Optionally, also include:

[0076] An access detection module, for determining whether the external storage device has access permission based on a unique identifier of the external storage device when an external storage device is detected to be connected;

[0077] If there is access permission, the device operation permission is obtained according to the unique identification of the external storage device, and the operation of the external storage device is responded to according to the device operation permission.

[0078] The security protection device for an industrial host provided in an embodiment of the present invention can execute the security protection method for an industrial host provided in any embodiment of the present invention, and has functional modules and beneficial effects corresponding to the execution method.

[0079] Embodiment 3

[0080] Figure 3a FIG. 1 is a schematic diagram of the structure of an industrial host security protection system in Embodiment 3 of the present invention. This embodiment is applicable to the situation of providing comprehensive security protection for industrial hosts. Figure 3a As shown, the system includes: a client 310 installed on an industrial host and a control center 320 installed on a server;

[0081] The client 310 is used to execute the security protection method for the industrial host provided by any embodiment of the present invention;

[0082] The control center 320 is used to centrally manage the clients on multiple industrial hosts in a networked environment.

[0083] In this embodiment, the client 310 is deployed on the industrial host that needs to be protected, performs final whitelist scanning and protection, peripheral management, vulnerability defense and other security protection operations, and communicates with the control center to provide relevant security alarm information required for control center management.

[0084] Optionally, the control center 320 is used to collect log data reported by each client for analysis. If a network attack event is found, the propagation path of the network attack event is cut off, and a security protection strategy is generated and sent to the clients on all industrial hosts.

[0085] In this embodiment, Figure 3b As shown in the figure, the control center adopts B / S architecture, allowing access through a browser anytime and anywhere to manage and control the client, mainly including group management, policy formulation and issuance, unified whitelist scanning (and scheduled scanning), client software and hardware asset management, etc. In addition, the control center can also provide basic services for system operation and maintenance, such as: client upgrade service, data service, communication service, etc. Among them, a single control center can concurrently manage more than 6,000 host clients and perform security risk management based on the user organization structure. At the same time, flexible module configuration, permission configuration, page configuration, and scan time configuration can be performed for each client to meet the on-site customized security policy requirements of industrial hosts.

[0086] In this embodiment, the control center can understand the alarm information of the clients of the entire network, grasp the threat status of the entire network, and pre-set security protection strategies, such as intercepting common network attack events or viruses, etc. If the control center finds network attack events or viruses by analyzing the log data of the client, it will cut off its propagation and destruction path, and send the corresponding security protection strategy to the clients of all hosts for security protection.

[0087] Optionally, the industrial host security protection system includes a stand-alone version and a network version; the stand-alone version of the industrial host security protection system is used to provide security protection for isolated industrial hosts in an isolated situation, and the system includes: a client installed on the industrial host; the network version of the industrial host security protection system is used to centrally manage and control multiple industrial hosts in a networked situation, and the system includes: a client installed on the industrial host and a control center installed on the server.

[0088] In this embodiment, considering that the industrial host may be unable to communicate with the outside world due to networking conditions or other reasons, a stand-alone version and a network version of the industrial host security protection system are designed. The system can install a control center on the server. For isolated industrial hosts in isolation, since they cannot connect to the control center, the system client installed on the industrial host can be regarded as an industrial host security protection system alone, that is, the system is switched to a stand-alone version to achieve security protection for isolated industrial hosts. For networked industrial hosts, since the client on the host can be connected to the control center, the system can be switched to a network version, and the control center can manage security policies and issue configurations to the clients on all industrial hosts in the network, so as to achieve unified management and control and security risk analysis.

[0089] In this embodiment, the industrial host security protection system is a software product dedicated to the industrial control environment. By installing the system client on the industrial host and the system control center on the server, the industrial host can be intercepted by entry interception, operation interception, diffusion interception and other checkpoint-type viruses based on intelligent matching whitelist technology and USB mobile storage management based on device identification. It can prevent the operation of malicious programs and illegal peripheral access, and can perform comprehensive centralized management and security risk management of multiple industrial hosts, etc., to achieve comprehensive security protection for industrial hosts.

[0090] In addition, the industrial host security protection system can use an authorization recovery mechanism to deal with situations where the security protection software authorization cannot be replaced due to industrial equipment relocation, industrial replacement, etc., to ensure that the purchase points will not be lost and additional investment costs will not be increased in the event of equipment replacement, thereby saving user costs.

[0091] In this embodiment, the industrial host security protection system has strong software and hardware adaptability, supports various operating systems, and various system versions such as enterprise edition and professional edition. The hardware resources only require 256M memory and 400M available hard disk space, and are compatible with more than 100 industrial software.

[0092] In an embodiment of the present invention, the industrial host security protection system includes a client installed on the industrial host and a control center installed on the server; through the client, access authentication is performed on the external storage device, and the running malicious program is intercepted using the intelligent matching technology of the lightweight whitelist; through the control center, the log data reported by the client is analyzed, and if a network attack event is found, the propagation path of the network attack event is cut off, and a security protection strategy is generated and sent to the clients on all industrial hosts, so as to realize centralized management and security risk analysis of the clients on multiple industrial hosts in a networked state, solve the problem of difficulty in security protection of industrial hosts in the prior art, and prohibit abnormal programs from running in the industrial host by performing lightweight whitelist matching, so as to realize security protection of the industrial host.

[0093] Embodiment 4

[0094] Embodiment 4 of the present invention further discloses a computer storage medium on which a computer program is stored. When the program is executed by a processor, a security protection method for an industrial host is implemented, which is applied to a security protection system client installed on the industrial host, including:

[0095] When it is detected that the target software is running in the industrial host, the data content of the executable file of the target software is automatically scanned to generate the target file feature code;

[0096] Use the target file signature to match the target whitelist from the whitelist library, and obtain the working mode corresponding to the target file signature from the target whitelist;

[0097] Determine the suspicious file signature code corresponding to the suspicious file executing the target software, and query whether there is a whitelist matching the suspicious file signature code in the whitelist library;

[0098] If it does not exist, the suspicious file will be warned or blocked accordingly according to the working mode of the target software.

[0099] The computer storage medium of the embodiment of the present invention can adopt any combination of one or more computer-readable media. The computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. The computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples (non-exhaustive list) of computer-readable storage media include: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this document, a computer-readable storage medium can be any tangible medium containing or storing a program, which can be used by an instruction execution system, device or device or used in combination with it.

[0100] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, which carry computer-readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0101] The program code embodied on the computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0102] Computer program code for performing the operations of the present invention may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0103] Note that the above are only preferred embodiments of the present invention and the technical principles used. Those skilled in the art will understand that the present invention is not limited to the specific embodiments described herein, and that various obvious changes, readjustments and substitutions can be made by those skilled in the art without departing from the scope of protection of the present invention. Therefore, although the present invention has been described in more detail through the above embodiments, the present invention is not limited to the above embodiments, and may include more other equivalent embodiments without departing from the concept of the present invention, and the scope of the present invention is determined by the scope of the appended claims.

Claims

1. A security protection method for an industrial host, characterized in that: Applicable to the security protection system client installed on the industrial host, including: When it is detected that the target software is running in the industrial host, the data content of the executable file of the target software is automatically scanned to generate a target file feature code; Using the target file feature code to match a target whitelist from a whitelist library, and obtaining a working mode corresponding to the target file feature code from the target whitelist; Determine a suspicious file feature code corresponding to the suspicious file executing the target software, and query whether there is a whitelist matching the suspicious file feature code in a whitelist library; If it does not exist, a corresponding warning or blocking operation is performed on the suspicious file according to the working mode of the target software; When the target software is detected to be running in the industrial host, the data content of the executable file of the target software is automatically scanned to generate a target file feature code, including: Real-time detection of whether the target software is running in the industrial host; If the running target software is captured, the executable file of the target software is formed into a unique target file feature code through full disk automatic scanning; The whitelist includes pre-set file signatures and working modes of executable files that are allowed to run in the industrial host.

2. The method according to claim 1, characterized in that The working modes include an alarm mode and a protection mode; The alarm mode is used to issue a real-time alarm when an abnormal program executes a protected executable file, but does not block the execution of the abnormal program; The protection mode is used to issue a real-time alarm and block the execution of the abnormal program when the abnormal program executes the protected executable file.

3. The method according to claim 2, characterized in that Also includes: If it is detected that the industrial host downloads or starts using new software, the working mode is set for the new software, and the data content of the executable file of the new software is automatically scanned to generate a new file signature code; Generate a new whitelist using the new file signature and working mode, and store the new whitelist in the whitelist library for the update to take effect.

4. The method according to claim 1, characterized in that: Also includes: When detecting access to an external storage device, determining whether the external storage device has access permission based on the unique identifier of the external storage device; If there is access permission, the device operation permission is obtained according to the unique identification of the external storage device, and the operation of the external storage device is responded to according to the device operation permission.

5. A safety protection device for an industrial host, characterized in that: Applicable to the security protection system client installed on the industrial host, including: A file scanning module, which is used to automatically scan the data content of the executable file of the target software and generate a target file feature code when detecting that the target software is running in the industrial host; A whitelist matching module, used to match a target whitelist from a whitelist library using the target file feature code, and to obtain a working mode corresponding to the target file feature code from the target whitelist; A query module, used to determine a suspicious file feature code corresponding to a suspicious file executing the target software, and query whether there is a whitelist matching the suspicious file feature code in a whitelist library; An alarm module, used for performing corresponding alarm or blocking operations on the suspicious file according to the working mode of the target software if the suspicious file does not exist; The file scanning module is also used to detect in real time whether the target software is running in the industrial host; if the running target software is captured, the executable file of the target software is formed into a unique target file feature code through full disk automatic scanning; wherein the whitelist includes pre-set file feature codes and working modes of executable files allowed to run in the industrial host.

6. The device according to claim 5, characterized in that The working modes include an alarm mode and a protection mode; The alarm mode is used to issue a real-time alarm when an abnormal program executes a protected executable file, but does not block the execution of the abnormal program; The protection mode is used to issue a real-time alarm and block the execution of the abnormal program when the abnormal program executes the protected executable file.

7. An industrial host security protection system, characterized in that: The system comprises: a client installed on an industrial host and a control center installed on a server; The client is used to execute the security protection method for the industrial host according to any one of claims 1 to 4; The control center is used to centrally manage the clients on multiple industrial hosts in a networked environment.

8. The system according to claim 7, characterized in that The industrial host security protection system includes a stand-alone version and a network version; The stand-alone version of the industrial host security protection system is used to provide security protection for isolated industrial hosts in isolation. The system includes: a client installed on the industrial host; The network version of the industrial host security protection system is used to centrally control multiple industrial hosts in a networked environment. The system includes: a client installed on the industrial host and a control center installed on the server.

9. The system according to claim 7, characterized in that The control center is used to collect log data reported by each client for analysis. If a network attack event is found, the propagation path of the network attack event is cut off, and a security protection strategy is generated and sent to the clients on all industrial hosts.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the security protection method for an industrial host as described in any one of claims 1 to 4 is implemented.

Images