Method, device and computer equipment for vulnerability mining of industrial networking equipment

Abstract

The present application provides a vulnerability mining method, device, and computer equipment for industrial networking equipment, which relates to the field of network security technology and is used to improve the accuracy and efficiency of vulnerability mining for industrial networking equipment. The method mainly includes: obtaining the behavior data of the industrial networking equipment; determining whether the behavior data of the industrial networking equipment exists in the industrial networking equipment fingerprint information library, and the industrial networking equipment fingerprint information library stores the behavior data of the industrial networking equipment in normal working state; if not, determining the behavior data of the industrial networking equipment as abnormal behavior data; inputting the abnormal behavior data into the decision tree vulnerability identification model to obtain the vulnerability identification result corresponding to the abnormal behavior data.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a vulnerability mining method, device, computer equipment and storage medium for industrial networking equipment. Background Art

[0002] In recent years, the number of public industrial control hardware vulnerabilities has increased year by year. Therefore, research on vulnerability mining technology for industrial control hardware is of great significance to improving the security of industrial control systems. The current industrial networking vulnerability mining technology mainly mines protocol layer vulnerabilities of core industrial control systems. However, the industrial networking equipment of my country's key infrastructure is heavily dependent on industrially developed countries such as Europe, the United States, and Japan. Therefore, the vulnerability security of industrial networking equipment firmware is a severe challenge facing industrial networking security.

[0003] Traditional vulnerability mining technology for industrial Internet of Things equipment is mainly based on fuzzy testing, local sequence comparison, and static analysis. Traditional methods mainly mine vulnerabilities in the communication protocol layer of smart devices, but cannot discover vulnerabilities in the system layer of smart devices. There are also problems such as large mining errors, low efficiency, high false alarm and missed alarm rates, and susceptibility to interference from the external environment. Summary of the invention

[0004] The embodiments of the present application provide a method, device, computer equipment and storage medium for vulnerability mining of industrial networking equipment, which are used to improve the accuracy and efficiency of vulnerability mining of industrial networking equipment.

[0005] An embodiment of the present invention provides a vulnerability mining method for industrial networking equipment, the method comprising:

[0006] Obtain behavioral data of industrial networking devices;

[0007] Determine whether there is behavior data of the industrial networking device in the industrial networking device fingerprint information library, the industrial networking device fingerprint information library stores the behavior data of the industrial networking device in a normal working state;

[0008] If not, determining the behavior data of the industrial networking device as abnormal behavior data;

[0009] The abnormal behavior data is input into a decision tree vulnerability identification model to obtain a vulnerability identification result corresponding to the abnormal behavior data.

[0010] An embodiment of the present invention provides a vulnerability mining device for industrial networking equipment, the device comprising:

[0011] An acquisition module is used to obtain the behavior data of industrial networking devices;

[0012] A determination module, used to determine whether there is behavior data of the industrial networking device in the industrial networking device fingerprint information library, wherein the industrial networking device fingerprint information library stores the behavior data of the industrial networking device in a normal working state;

[0013] The determination module is further configured to determine the behavior data of the industrial networking device as abnormal behavior data if it does not exist;

[0014] The identification module is used to input the abnormal behavior data into a decision tree vulnerability identification model to obtain a vulnerability identification result corresponding to the abnormal behavior data.

[0015] A computer device comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the processor implements the vulnerability mining method for the industrial networking device when executing the computer program.

[0016] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the vulnerability mining method for the industrial networking device.

[0017] The present invention provides a vulnerability mining method, device, computer equipment and storage medium for industrial networking equipment. First, the behavior data of the industrial networking equipment is obtained; it is determined whether the behavior data of the industrial networking equipment exists in the industrial networking equipment fingerprint information library, and the industrial networking equipment fingerprint information library stores the behavior data of the industrial networking equipment under normal working conditions; if not, the behavior data of the industrial networking equipment is determined as abnormal behavior data; and then the abnormal behavior data is input into the decision tree vulnerability identification model to obtain the vulnerability identification result corresponding to the abnormal behavior data. That is, the present invention mines the vulnerabilities existing in the industrial networking equipment from the system and network levels, which makes up for the problem that the traditional industrial networking equipment vulnerability mining method can only mine protocol layer vulnerabilities, and more effectively discovers the possible vulnerabilities of industrial networking equipment. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 A flow chart of a vulnerability mining method for industrial networking equipment provided by this application;

[0019] Figure 2 A flow chart of another vulnerability mining method for industrial networking equipment provided by this application;

[0020] Figure 3 A schematic diagram of the structure of a vulnerability mining device for industrial networking equipment provided by this application;

[0021] Figure 4 A schematic diagram of a computer device provided for this application. DETAILED DESCRIPTION

[0022] In order to better understand the above-mentioned technical scheme, the technical scheme of the embodiments of the present application is described in detail below through the accompanying drawings and specific embodiments. It should be understood that the embodiments of the present application and the specific features in the embodiments are detailed descriptions of the technical scheme of the embodiments of the present application, rather than limitations on the technical scheme of the present application. In the absence of conflict, the embodiments of the present application and the technical features in the embodiments may be combined with each other.

[0023] See also Figure 1 , an embodiment of the present invention provides a vulnerability mining method for industrial networking equipment, the method specifically includes steps S101-step S104:

[0024] Step S101, obtaining behavior data of industrial networking equipment.

[0025] The main difference between the industrial networking device in this embodiment and the traditional networking device is that the system is more closed and the working state is relatively simple. For example, the industrial networking device can be a PLC, a smart camera, a smart router, a smart robot and other devices, which are not specifically limited in the embodiment of the present invention.

[0026] The behavior data includes host behavior data and network behavior data. The host behavior data includes but is not limited to instructions, system calls, function calls, and API interfaces; the network behavior data includes but is not limited to quintuples and function codes. The function code is a protocol code that can be received by industrial interconnection energy devices. For example, according to the protocol type given by the manufacturer, filling in the corresponding function code can control the device to start or stop working.

[0027] Step S102, determining whether there is behavior data of the industrial networking device in the industrial networking device fingerprint information database, and the industrial networking device fingerprint information database stores the behavior data of the industrial networking device in a normal working state.

[0028] In this embodiment, in view of the single function characteristic of industrial networking devices during actual operation, this embodiment can record the behavior data of industrial networking devices during normal operation. The behavior data includes system behavior data such as instructions, system calls, function calls, API interfaces, and network behavior data such as quintuples and function codes. Then, based on the behavior data of industrial networking devices under normal working conditions, an industrial networking device fingerprint information database is constructed.

[0029] Step S103: If not present, the behavior data of the industrial networking device is determined as abnormal behavior data.

[0030] For an embodiment of the present invention, if the behavior data of the industrial networking device does not exist in the industrial networking device fingerprint information database, it means that the behavior data of the industrial networking device is abnormal data, that is, the behavior data of the industrial networking device is determined as abnormal behavior data, so as to facilitate mining vulnerabilities in the industrial networking device based on the abnormal behavior data in subsequent steps.

[0031] Specifically, by mining the behavior data of industrial networking devices, discovering the host behavior and network behavior of industrial networking devices, and comparing them with the fingerprint information database of industrial networking devices, abnormal behaviors of industrial networking devices are discovered, including but not limited to sending high-risk instructions, modifying sensitive data, modifying the original execution process of the program, modifying the registry settings for automatic startup, creating processes, etc. Among them, high-risk instructions can be instructions that change the operating status of the device or have a significant impact on the current operation of the industrial networking device.

[0032] Step S104: input the abnormal behavior data into a decision tree vulnerability identification model to obtain a vulnerability identification result corresponding to the abnormal behavior data.

[0033] In an embodiment of the present invention, before the abnormal behavior data is input into the decision tree vulnerability identification model, the decision tree vulnerability identification model needs to be trained. The training process of the model can be: obtaining abnormal behavior data of known samples within a preset number or preset time interval and combining them to obtain abnormal behavior data group samples; converting the abnormal behavior data group samples into corresponding feature vectors; performing model training according to the feature vectors of the abnormal behavior data group samples and the corresponding vulnerability identification labels to obtain the decision tree vulnerability identification model.

[0034] Among them, the preset number or preset time interval can be set according to actual needs, such as setting the preset number to 3, 4 or 5; setting the preset time interval to 2 minutes, 3 minutes or 5 minutes, which is not specifically limited in the embodiment of the present invention. Specifically, if the present embodiment obtains abnormal behavior data within the preset time interval, the abnormal behavior data can be deduplicated, and then the deduplicated abnormal behavior data is combined to obtain an abnormal behavior data group sample, and then the abnormal behavior data group sample is converted into a corresponding feature vector, so as to facilitate model training based on the feature vector and the corresponding vulnerability identification label to obtain a decision tree vulnerability identification model. It should be noted that the deduplication processing in this embodiment can be data that is continuous and repeated in time. For example, the abnormal behavior data obtained within the preset time interval is: data 1, data 2, data 3, data 3, data 4, data 3 and data 5, then the abnormal behavior data group sample obtained after deduplication of the abnormal behavior data is: data 1, data 2, data 3, data 4, data 3, data 5.

[0035] If the present embodiment obtains a preset number of abnormal behavior data and combines them to obtain abnormal behavior data samples, there is no need to filter repeated data, and the number of times each abnormal behavior data appears repeatedly can be counted, and then the abnormal behavior data and the corresponding number of occurrences can be converted into corresponding feature vectors, and then model training can be performed based on the feature vectors and corresponding vulnerability identification labels to obtain a decision tree vulnerability identification model. Among them, the statistics of the number of times abnormal behavior data appears repeatedly in the present embodiment can also determine the number of times the corresponding abnormal behavior data appears based on the number of consecutive occurrences in time. For example, the abnormal behavior data of the preset number (10) obtained are: data 1, data 2, data 3, data 3, data 3, data 4, data 3, data 3, data 5, data 5, and then the abnormal behavior data group samples obtained by statistics are: data 1*(1), data 2*(1), data 3*(3), data 4*(1), data 3*(2), data 5*(2), and then the abnormal behavior data group samples are converted into corresponding feature vectors, so as to facilitate model training based on the feature vectors and corresponding vulnerability identification labels to obtain a decision tree vulnerability identification model.

[0036] In this embodiment, a decision tree vulnerability identification model is constructed based on mining abnormal behavior data of industrial networking devices. The device vulnerabilities that may exist in the abnormal behavior data of various industrial networking devices are discovered through a tree structure combination. That is, the vulnerabilities of industrial networking devices are identified according to the decision tree vulnerability identification model.

[0037] Furthermore, this embodiment can also continuously improve the vulnerability mining capability of industrial networking in practical applications based on the feedback of the judgment results (vulnerability identification results). That is, the model judgment results can be corrected to a certain extent based on the feedback of the vulnerability results, and the model can be equipped with continuous learning capabilities.

[0038] In an optional embodiment provided by the present invention, the inputting the abnormal behavior data into a decision tree vulnerability identification model to obtain a vulnerability identification result corresponding to the abnormal behavior data includes:

[0039] Step S1041, combining the determined abnormal behavior data at a preset time interval to obtain an abnormal behavior data group; or combining a preset number of abnormal behavior data to obtain an abnormal behavior data group.

[0040] It should be noted that the method of processing the abnormal behavior data set in this embodiment is the same as the method of processing the abnormal behavior data set sample, and this embodiment will not be repeated here.

[0041] Step S1042: input the abnormal behavior data group into a decision tree vulnerability identification model to obtain a vulnerability identification result corresponding to the abnormal behavior data.

[0042] In this embodiment, since the decision tree vulnerability identification model is trained based on abnormal behavior data group samples and their corresponding vulnerability identification labels, the corresponding vulnerabilities can be identified through the decision tree vulnerability identification model, that is, based on the decision tree vulnerability identification model, the feature relationship within the abnormal behavior data group can be deeply mined, and then the vulnerability identification result corresponding to the acquired abnormal behavior data (abnormal behavior data group) is determined according to the feature relationship, so that the vulnerability identification accuracy of industrial networking equipment can be improved through this embodiment.

[0043] The embodiment of the present invention provides a vulnerability mining method for industrial networking equipment, which first obtains the behavior data of the industrial networking equipment; determines whether the behavior data of the industrial networking equipment exists in the industrial networking equipment fingerprint information library, and the industrial networking equipment fingerprint information library stores the behavior data of the industrial networking equipment under normal working conditions; if not, the behavior data of the industrial networking equipment is determined as abnormal behavior data; and then the abnormal behavior data is input into the decision tree vulnerability identification model to obtain the vulnerability identification result corresponding to the abnormal behavior data. That is, the present invention mines the vulnerabilities existing in the industrial networking equipment from the system and network levels, which makes up for the problem that the traditional industrial networking equipment vulnerability mining method can only mine protocol layer vulnerabilities, and more effectively discovers the possible vulnerabilities of industrial networking equipment.

[0044] See also Figure 2 , another vulnerability mining method for industrial networking equipment provided by an embodiment of the present invention, the method specifically includes steps S201-step S207:

[0045] Step S201, obtaining status data of industrial networking equipment.

[0046] Among them, status data is used to represent various operating data of industrial networking equipment.

[0047] Step S202: Match the state data with a preset state data table to determine whether there is a vulnerability identification result corresponding to the state data in the preset state table.

[0048] Among them, the preset status data table stores vulnerability identification results corresponding to various abnormal status data. The abnormal status data in the preset status data table can be a combination of one or more abnormal status data. For example, the abnormal status data corresponding to vulnerability A stored in the preset status data table is: a combination of data 1 and data 2. If the acquired status data contains data 1 and data 2, that is, it matches data 1 and data 2 in the preset status data table, then it can be determined that the vulnerability corresponding to the acquired status data is A.

[0049] It should be noted that the vulnerability identification results corresponding to the status data in the preset status data table can be obtained by manual statistics, or can be determined by the decision tree vulnerability identification model in this embodiment. Specifically, when determining a vulnerability through the decision tree vulnerability identification model, this embodiment obtains the status data of the industrial networking device in the corresponding time period, and then stores the obtained status data and the corresponding vulnerability identification results in the preset status data table.

[0050] For example, the behavior data of an industrial networking device between 10:00-11:00 is obtained. If it is determined that the obtained behavior data is not in the industrial networking device fingerprint information database, the behavior data of the industrial networking device is used as abnormal behavior data and input into the decision tree vulnerability identification model to obtain a vulnerability identification result corresponding to the abnormal behavior data. Then, the status data of the industrial networking device between 10:00-11:00 is obtained, and then the obtained status data and the vulnerability identification result obtained according to the decision tree vulnerability identification model are stored in a preset status table accordingly.

[0051] Step S203: If there is a vulnerability identification result corresponding to the state data in the preset state table, the vulnerability identification result matching the state data in the preset state table is used as the vulnerability identification result corresponding to the state data.

[0052] Step S204: If there is no vulnerability identification result corresponding to the status data in the preset status table, obtain the behavior data of the industrial networking device.

[0053] In this embodiment, if it is not determined whether the industrial networking device has a vulnerability according to the preset status table, it is necessary to obtain the behavior data of the industrial networking device, and then further determine whether the industrial networking device has a vulnerability based on the behavior data.

[0054] Step S205, determining whether there is behavior data of the industrial networking device in the industrial networking device fingerprint information database, wherein the industrial networking device fingerprint information database stores the behavior data of the industrial networking device in a normal working state.

[0055] The host behavior and network behavior of the device during the intelligent operation of the industrial network are collected in real time, and compared with the fingerprint information database to detect abnormal behavior. When the industrial intelligent device is working, the behavior is single and continuously looped. If an unknown behavior suddenly appears during the loop, this behavior will be very suspicious.

[0056] Step S206: If not, the behavior data of the industrial networking device is determined as abnormal behavior data.

[0057] Step S207, inputting the abnormal behavior data into a decision tree vulnerability identification model to obtain a vulnerability identification result corresponding to the abnormal behavior data, wherein the decision tree vulnerability identification model is trained based on the behavior data sample and the corresponding vulnerability identification label.

[0058] It should be noted that steps S204 to S207 in this embodiment are similar to Figure 1 The descriptions of the corresponding steps in are the same and will not be repeated in this embodiment.

[0059] The embodiments of the present invention mine possible vulnerabilities in industrial networking devices from the system and network levels, compare the normal behaviors of industrial networking smart devices, and discover abnormal behaviors that occur during their operation, which makes up for the problem that traditional industrial networking device vulnerability mining methods can only mine protocol layer vulnerabilities, and more effectively discovers remote execution vulnerabilities, pre-made backdoors, etc. that may exist in the industrial networking smart device system.

[0060] By recording the behavior of industrial networking devices (host behavior and network behavior), abnormal behaviors are discovered, and multiple abnormal behaviors within a period of time are combined to discover possible vulnerabilities or backdoors. For example, the abnormal behavior data obtained includes: instructions, system calls, function calls, and API interfaces. 1. Backdoor vulnerabilities are discovered based on instructions and quintuples. First, we find instructions for collecting system status, including traversing system files and system logs. Then, through the traffic side protocol restoration, we find that it opens an unconventional port and connects to an external IP or domain name through this port. Through these behaviors, we can determine that the device has a backdoor vulnerability; 2. Abnormal vulnerabilities are discovered based on system calls. Based on behavior records, we find abnormal behaviors such as modifying the registry, setting the program to start automatically, hooking the process query program, and hiding its own process. By combining these abnormal behaviors, we can find that the smart device may have a remote execution vulnerability and the device has been remotely implanted with a persistent program; 3. Based on function calls, API interfaces, and traffic side quintuple data, first, we monitor an unknown external device accessing the smart device through the quintuple data, and then through the API call records, we can see that the external device bypasses the API's permission authentication and directly queries the device's status or reads the device's data through the API. By combining these anomalies, we can find that the device has a permission bypass vulnerability.

[0061] The embodiment of the present invention provides a vulnerability mining method for industrial networking equipment, which first obtains the behavior data of the industrial networking equipment; determines whether the behavior data of the industrial networking equipment exists in the industrial networking equipment fingerprint information library, and the industrial networking equipment fingerprint information library stores the behavior data of the industrial networking equipment under normal working conditions; if not, the behavior data of the industrial networking equipment is determined as abnormal behavior data; and then the abnormal behavior data is input into the decision tree vulnerability identification model to obtain the vulnerability identification result corresponding to the abnormal behavior data. That is, the present invention mines the vulnerabilities existing in the industrial networking equipment from the system and network levels, which makes up for the problem that the traditional industrial networking equipment vulnerability mining method can only mine protocol layer vulnerabilities, and more effectively discovers the possible vulnerabilities of industrial networking equipment.

[0062] It should be understood that the order of execution of the steps in the above embodiment does not necessarily mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present invention.

[0063] In one embodiment, a vulnerability mining device for industrial networking equipment is provided, and the vulnerability mining device for industrial networking equipment corresponds one-to-one to the vulnerability mining method for industrial networking equipment in the above embodiment. Figure 3 As shown, the functional modules of the vulnerability mining device for industrial networking equipment are described in detail as follows:

[0064] An acquisition module 31 is used to acquire behavior data of industrial networking devices;

[0065] A determination module 32, used to determine whether there is behavior data of the industrial networking device in the industrial networking device fingerprint information library, and the industrial networking device fingerprint information library stores the behavior data of the industrial networking device in a normal working state;

[0066] The determination module 32 is further configured to determine the behavior data of the industrial networking device as abnormal behavior data if it does not exist;

[0067] The identification module 33 is used to input the abnormal behavior data into the decision tree vulnerability identification model to obtain a vulnerability identification result corresponding to the abnormal behavior data.

[0068] In an optional embodiment, the identification module 33 is specifically used to:

[0069] Combining the determined abnormal behavior data at preset time intervals to obtain an abnormal behavior data group; or combining a preset number of abnormal behavior data to obtain an abnormal behavior data group;

[0070] The abnormal behavior data group is input into a decision tree vulnerability identification model to obtain a vulnerability identification result corresponding to the abnormal behavior data.

[0071] In an optional embodiment, the device further includes: a conversion module 34 and a training module 35;

[0072] The acquisition module 31 is further used to acquire abnormal behavior data of known samples within a preset number or preset time interval and combine them to obtain abnormal behavior data group samples;

[0073] A conversion module 34, used to convert the abnormal behavior data group sample into a corresponding feature vector;

[0074] The training module 35 is used to perform model training according to the feature vectors of the abnormal behavior data group samples and the corresponding vulnerability identification labels to obtain the decision tree vulnerability identification model.

[0075] In an optional embodiment, the acquisition module 31 is further used to acquire status data of the industrial networking device;

[0076] The determination module 32 is further used to match the state data with a preset state data table to determine whether there is a vulnerability identification result corresponding to the state data in the preset state table; the preset state data table stores vulnerability identification results corresponding to various abnormal state data;

[0077] The identification module 33 is configured to use the vulnerability identification result in the preset state table that matches the state data as the vulnerability identification result corresponding to the state data if there is a vulnerability identification result corresponding to the state data in the preset state table.

[0078] In an optional embodiment, the acquisition module 31 is specifically configured to:

[0079] If there is no vulnerability identification result corresponding to the status data in the preset status table, the behavior data of the industrial networking device is obtained.

[0080] In an optional embodiment, the behavior data includes host behavior data and network behavior data, wherein the host behavior data includes but is not limited to instructions, system calls, function calls, and API interfaces; the network behavior data includes but is not limited to quintuples and function codes.

[0081] For the specific definition of the vulnerability mining device of industrial networking equipment, please refer to the definition of the vulnerability mining method of industrial networking equipment above, which will not be repeated here. Each module in the above-mentioned device can be implemented in whole or in part by software, hardware and a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0082] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 4 As shown. The computer device includes a processor, a memory, a network interface and a database connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a vulnerability mining method for industrial networked equipment is implemented.

[0083] In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the following steps when executing the computer program:

[0084] Obtain behavioral data of industrial networking devices;

[0085] Determine whether there is behavior data of the industrial networking device in the industrial networking device fingerprint information library, the industrial networking device fingerprint information library stores the behavior data of the industrial networking device in a normal working state;

[0086] If not, determining the behavior data of the industrial networking device as abnormal behavior data;

[0087] The abnormal behavior data is input into a decision tree vulnerability identification model to obtain a vulnerability identification result corresponding to the abnormal behavior data.

[0088] In one embodiment, a computer readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

[0089] Obtain behavioral data of industrial networking devices;

[0090] Determine whether there is behavior data of the industrial networking device in the industrial networking device fingerprint information library, the industrial networking device fingerprint information library stores the behavior data of the industrial networking device in a normal working state;

[0091] If not, determining the behavior data of the industrial networking device as abnormal behavior data;

[0092] The abnormal behavior data is input into a decision tree vulnerability identification model to obtain a vulnerability identification result corresponding to the abnormal behavior data.

[0093] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing related hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0094] Those skilled in the art can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example. In actual applications, the above-mentioned functions can be distributed and completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above.

[0095] The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be included in the protection scope of the present invention.

Claims

1. A vulnerability mining method for industrial networking equipment, characterized in that: The method comprises: Obtain status data of industrial networking equipment; Matching the state data with a preset state data table to determine whether there is a vulnerability identification result corresponding to the state data in the preset state table; If there is a vulnerability identification result corresponding to the state data in the preset state table, the vulnerability identification result matching the state data in the preset state table is used as the vulnerability identification result corresponding to the state data; If there is no vulnerability identification result corresponding to the status data in the preset status table, obtaining behavior data of the industrial networking device; Determine whether there is behavior data of the industrial networking device in the industrial networking device fingerprint information library, the industrial networking device fingerprint information library stores the behavior data of the industrial networking device in a normal working state; If not, determining the behavior data of the industrial networking device as abnormal behavior data; If the abnormal behavior data is abnormal behavior data within a preset time interval, deduplication of abnormal behavior data within adjacent preset time intervals is performed, and the deduplication of abnormal behavior data is combined to obtain an abnormal behavior data group; If the abnormal behavior data is a preset number of abnormal behavior data, the number of times each abnormal behavior data appears repeatedly is counted, and each abnormal behavior data and the corresponding number of occurrences are taken as a combination to obtain an abnormal behavior data group; The abnormal behavior data group is input into a decision tree vulnerability identification model to obtain a vulnerability identification result corresponding to the abnormal behavior data.

2. The method according to claim 1, characterized in that The method further comprises: Acquire abnormal behavior data of known samples within a preset number or a preset time interval and combine them to obtain an abnormal behavior data group sample; Converting the abnormal behavior data group samples into corresponding feature vectors; Model training is performed according to the feature vectors of the abnormal behavior data group samples and the corresponding vulnerability identification labels to obtain the decision tree vulnerability identification model.

3. The method according to claim 1, characterized in that The behavior data includes host behavior data and network behavior data; The host behavior data includes but is not limited to: instructions, system calls, function calls, and API interfaces; The network behavior data includes but is not limited to: quintuple and function code.

4. A vulnerability mining device for industrial networking equipment, characterized in that: The device comprises: An acquisition module is used to obtain the behavior data of industrial networking devices; A determination module, used to determine whether there is behavior data of the industrial networking device in the industrial networking device fingerprint information library, wherein the industrial networking device fingerprint information library stores the behavior data of the industrial networking device in a normal working state; The determination module is further configured to determine the behavior data of the industrial networking device as abnormal behavior data if it does not exist; An identification module, used to input the abnormal behavior data into a decision tree vulnerability identification model to obtain a vulnerability identification result corresponding to the abnormal behavior data; The acquisition module is further used to acquire the status data of the industrial networking device; if there is no vulnerability identification result corresponding to the status data in the preset status table, the behavior data of the industrial networking device is acquired; The determination module is further used to match the state data with a preset state data table to determine whether there is a vulnerability identification result corresponding to the state data in the preset state table; The identification module is also used for, if there is a vulnerability identification result corresponding to the status data in the preset status table, then using the vulnerability identification result matching the status data in the preset status table as the vulnerability identification result corresponding to the status data; if the abnormal behavior data is abnormal behavior data within a preset time interval, then deduplicating the abnormal behavior data within adjacent preset time intervals, and combining the deduplicated abnormal behavior data to obtain an abnormal behavior data group; if the abnormal behavior data is a preset number of abnormal behavior data, then counting the number of repeated occurrences of each abnormal behavior data, and taking each abnormal behavior data and the corresponding number of occurrences as a combination to obtain an abnormal behavior data group.

5. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the vulnerability mining method for industrial networking equipment according to any one of claims 1 to 3 is implemented.

6. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method for exploiting vulnerabilities in industrial networking devices according to any one of claims 1 to 3 is implemented.

Images