Industrial control asset identification method and system based on industrial control system

Abstract

The present invention relates to an industrial control asset identification method based on an industrial control system, comprising: S01, obtaining the flow data of the current industrial control system; S02, parsing the flow data, obtaining the operation instructions contained in the flow data, the identity information of the industrial control asset and the used port information, and using the port information and the operation instructions as the behavior characteristics corresponding to the identity information; S03, matching the behavior characteristics based on a pre-established industrial control behavior feature library, and obtaining the industrial control behavior identification result of the identity information; S04, for an industrial control asset to be identified, obtaining all the industrial control behaviors recorded under the identity information of the industrial control asset, matching the industrial control behaviors based on a pre-established asset behavior baseline library, and obtaining the asset type identification result of the industrial control asset. The method of the present invention can effectively shield the software and hardware differences between various industrial control assets in the industrial control network, and improve the identification accuracy of industrial control assets.

Description

Technical Field

[0001] The present invention relates to the technical field of industrial control asset identification, and in particular to an industrial control asset identification method and system based on an industrial control system. Background Art

[0002] Industrial control systems are widely used in important industries related to national economy and people's livelihood, such as electricity, petrochemical, transportation, municipal administration, and key manufacturing industries. Various industrial control equipment in industrial control systems are the core of industrial production, also known as industrial control assets. When managing industrial control security for industrial control assets, it is usually necessary to identify industrial control assets based on processors and use identification methods as a technical means of monitoring industrial control assets, timely identify abnormal status of industrial control assets and issue alarms, prompting administrators to handle abnormal situations and ensure industrial control security of industrial control networks.

[0003] In an industrial control system, there are usually a large number of industrial control assets of different equipment models produced by different manufacturers. The identification method provided by the prior art usually identifies the industrial control assets based on the fingerprint information such as the protocol type, the first three bytes of the MAC address, the open port number, the sliding window size in the TCP protocol of its own protocol stack, the life span of the IP protocol, and the clock offset contained in the traffic data sent by the industrial control assets. However, in actual applications, different equipment types may have the same fingerprint features, which may easily lead to misidentification of industrial control assets and reduce the identification accuracy of industrial control assets. In addition, the identification result of this identification method is usually a certain industrial control asset produced by a certain manufacturer, while the administrator is actually more concerned about the role of an industrial control asset in the industrial control system in order to better manage industrial control security. However, there is no research or product in this direction in the prior art. Therefore, when the administrator manages the industrial control assets based on the identification results, he still needs to spend energy to analyze the various information under the name of the industrial control asset and determine the role of the industrial control asset in the industrial system before making appropriate processing decisions. Summary of the invention

[0004] 1. Technical issues to be resolved

[0005] In view of the above-mentioned shortcomings and deficiencies of the prior art, the present invention provides an industrial control asset identification method and system based on an industrial control system, which solves the technical problems that the prior art is prone to misidentification of industrial control assets in industrial control systems, has low identification accuracy of industrial control assets, and is more troublesome for administrators to manage industrial control assets.

[0006] (II) Technical solution

[0007] In order to achieve the above object, the main technical solutions adopted by the present invention include:

[0008] In a first aspect, an embodiment of the present invention provides an industrial control asset identification method based on an industrial control system, comprising:

[0009] S01, based on an industrial control network of an industrial control system, obtaining flow data of the current industrial control system from a port of a switch in the industrial control network;

[0010] S02. According to a predefined parsing strategy, the flow data is parsed to obtain the identity information and the port information used by the industrial control asset that sends the flow data, and to obtain at least one operation instruction contained in the flow data, and the port information and the operation instruction are used as the behavior features corresponding to the identity information;

[0011] S03, based on a pre-established industrial control behavior feature library, matching the behavior features, obtaining an industrial control behavior recognition result of the identity information, and recording the industrial control behavior recognition result under the identity information;

[0012] S04. For an industrial control asset of a type to be identified, all industrial control behaviors recorded within a first preset period of time under the identity information of the industrial control asset are obtained, and the industrial control behaviors are matched based on a pre-established asset behavior baseline library to obtain an asset type identification result of the industrial control asset;

[0013] The asset behavior baseline library includes multiple asset types and a behavior baseline corresponding to each asset type, and a behavior baseline of an asset type includes at least one industrial control behavior.

[0014] The industrial control asset identification method proposed in the embodiment of the present invention extracts behavioral features including operation instructions from the traffic data sent by the industrial control assets, matches the industrial control behaviors of the industrial control assets according to the behavioral features, and determines the asset type of the industrial control assets in the industrial control system through all the industrial control behaviors of the industrial control assets. The above-mentioned industrial control asset identification method identifies the asset type based on the industrial control behaviors generated by the industrial control assets in the industrial control system. In essence, the industrial control assets are identified according to the specific roles they play in the industrial control system, thereby shielding the software and hardware differences between various industrial control assets in the industrial control system, effectively improving the identification accuracy of industrial control assets, and facilitating the administrator to manage industrial control assets.

[0015] Optionally, the traffic data is data link layer traffic data, and accordingly, the S02 includes:

[0016] S021. Perform data link layer protocol parsing, network layer protocol parsing, and transport layer protocol parsing on the data link layer traffic data in sequence, respectively obtain the MAC address, IP address, and application layer traffic data of the industrial control asset that sends the traffic data, and use the MAC address and IP address as the identity information of the industrial control asset;

[0017] S022. Divide the application layer traffic data into a plurality of application layer sessions through session management, determine the application layer traffic data sent by the session initiator in the application layer traffic data according to the direction of the session, and use the MAC address and IP address corresponding to the session initiator as the first identity information, and use the MAC address and IP address corresponding to the session receiver as the second identity information;

[0018] S023, parsing the application layer traffic data sent by the session initiator to obtain one or more operation instructions arranged in chronological order;

[0019] S024. When the session ends, the destination port of the current session and all operation instructions under the current session are used as the behavior features corresponding to the first identity information.

[0020] Optionally, the traffic data sent by the session initiator includes at least one application layer data packet, and S023 includes:

[0021] S023-1. Determine the protocol type of the application layer data packet based on a keyword of the application layer data packet and / or a destination port of the application layer data packet;

[0022] S023-2. Based on the protocol type, searching the offset and field length of the operation instruction in the application layer data packet from a pre-established index table;

[0023] The index table includes a plurality of protocol types, and in a data packet corresponding to a protocol type, the offset and field length of the field where the operation instruction is located.

[0024] S023-3, reading the corresponding field of the application layer data packet according to the offset and the field length, and obtaining the operation instruction in the application layer data packet;

[0025] When the number of the operation instructions is at least two, the operation instructions are arranged in the order of the time of acquisition.

[0026] Optionally, the S021 further includes:

[0027] Match the obtained identity information with the current asset information table. If the identity information does not exist in the asset information table, create new asset information to which the current identity information belongs in the asset information table.

[0028] The asset information table includes identity information of multiple industrial control assets, and the identity information of one industrial control asset includes the MAC address and IP address of the industrial control asset.

[0029] Optionally, in S03, the industrial control behavior feature library includes multiple initiator industrial control behaviors, a behavior feature corresponding to each initiator industrial control behavior, and a receiver industrial control behavior corresponding to each initiator industrial control behavior;

[0030] The S03 includes:

[0031] Based on the industrial control behavior feature library, the behavior features corresponding to the first identity information are matched, and the initiator's industrial control behavior that matches the behavior features is used as the industrial control behavior identification result of the first identity information, and the responder's industrial control behavior that matches the behavior features is used as the industrial control behavior identification result of the second identity information; the industrial control behavior identification results are recorded respectively under the corresponding identity information.

[0032] Optionally, the industrial control system is one or more of a computer centralized control system, a distributed control system, a field bus control system and a PLC control system;

[0033] If the industrial control system is a distributed control system, the operation instruction includes one or more of the following: a function code based on the MODBUS-TCP protocol, a control instruction based on the MELSEC-Q protocol, or a control instruction based on the OMRON-FINS-TCP protocol.

[0034] Optionally, the S04 includes:

[0035] S041. For an industrial control asset of a type to be identified, obtaining all industrial control behaviors of the industrial control asset within a first preset time period;

[0036] S042. Match the industrial control behavior based on the asset behavior baseline library.

[0037] If the industrial control behavior is completely consistent with the behavior baseline corresponding to only a certain asset type, the current asset type is used as the asset type identification result of the industrial control asset;

[0038] Otherwise, the identity information of the industrial control asset is moved into a list to be confirmed.

[0039] Optionally, for the industrial control assets in the to-be-confirmed list, the following steps are executed repeatedly until the to-be-confirmed list is empty:

[0040] A01. Wait for a second preset time and reacquire all industrial control behaviors of the industrial control assets in the list to be confirmed;

[0041] A02. Based on the asset behavior baseline library, the retrieved industrial control behaviors are matched.

[0042] If the re-acquired industrial control behavior is completely consistent with the behavior baseline corresponding to only a certain asset type, the current asset type is used as the asset type identification result of the industrial control asset, and the identity information row of the industrial control asset is removed from the list to be confirmed.

[0043] Optionally, for an industrial control asset in the to-be-confirmed list, if an asset type manually assigned by an administrator is received, the identity information of the industrial control asset is removed from the to-be-confirmed list.

[0044] In a second aspect, an embodiment of the present invention provides an industrial control asset identification system based on an industrial control system, comprising:

[0045] A flow data acquisition module is used for acquiring the flow data of the current industrial control system from the port of the switch in the industrial control network based on the industrial control network of the industrial control system;

[0046] A first parsing module, used to parse the flow data, extract the identity information of the industrial control asset sending the flow data and the application layer flow data in the flow data;

[0047] A session management module, used for dividing the application layer traffic data into different sessions;

[0048] The second parsing module is used to parse the operation instructions contained in the application layer traffic data sent by the initiator asset in a session.

[0049] An industrial control behavior identification module, used to identify the industrial control behavior of an industrial control asset based on the behavior characteristics of the industrial control asset; and

[0050] The asset type identification module is used to identify the asset type of the industrial control asset based on all industrial control behaviors of the industrial control asset.

[0051] The industrial control asset identification system proposed in the embodiment of the present invention can obtain data traffic from the industrial control network, parse the obtained data traffic, extract the identity information and behavior characteristics of the industrial control asset that sends the data traffic, identify the industrial control behavior of the industrial control asset based on the behavior characteristics, and then identify the asset type of the industrial control asset based on the industrial control behavior of the industrial control asset. The industrial control asset identification system identifies the industrial control asset based on the industrial control behavior generated by the industrial control asset in the industrial control network, and can shield the software and hardware differences between various industrial control assets in the industrial control network, thereby improving the identification accuracy of the industrial control assets.

[0052] (III) Beneficial effects

[0053] In an embodiment of the present invention, the traffic data obtained from the industrial control network is parsed to obtain the industrial control behavior corresponding to the industrial control asset that sends the traffic data. Then, based on the asset behavior baseline library, the asset type is identified according to the industrial control behavior of the industrial control asset. This can effectively shield the software and hardware differences between various industrial control assets in the industrial control network, improve the identification accuracy of industrial control assets, and facilitate administrators to manage industrial control assets.

[0054] In the process of parsing the traffic data obtained from the industrial control network and obtaining the industrial control behavior corresponding to the industrial control asset that sent the traffic data, the behavior characteristics of the operation instructions contained in the traffic data are first obtained, and the behavior characteristics are matched based on the industrial control behavior feature library to obtain the industrial control behavior. The parsing process can adapt to different communication protocols and accurately identify the industrial control behavior, thereby further improving the recognition accuracy of the industrial control assets. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] Figure 1 A flowchart of an industrial control asset identification method based on an industrial control system provided in an embodiment;

[0056] Figure 2 The figure is a flowchart of a method for identifying industrial control assets in a list to be confirmed in another embodiment. DETAILED DESCRIPTION

[0057] In order to better explain the present invention and facilitate understanding, the present invention is described in detail below through specific implementation modes in conjunction with the accompanying drawings.

[0058] The industrial control asset identification method proposed in the embodiment of the present invention mainly focuses on the industrial control behavior generated by industrial control assets in the industrial control network, and identifies the industrial control assets based on the industrial control behavior. In essence, the industrial control assets are identified based on the role they play in the industrial control system, thereby shielding the software and hardware differences between various industrial control assets in the industrial control system, effectively improving the identification accuracy of industrial control assets, and facilitating administrators to manage the industrial control security of the industrial control network.

[0059] In order to better understand the above technical solution, exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be limited by the embodiments described herein. On the contrary, these embodiments are provided to enable a clearer and more thorough understanding of the present invention and to fully convey the scope of the present invention to those skilled in the art.

[0060] It should be noted that in the prior art, industrial control systems mainly include computer centralized control systems, distributed control systems, field bus control systems and PLC control systems.

[0061] like Figure 1 As shown, this embodiment provides an industrial control asset identification method based on an industrial control system. The method of this embodiment can be implemented on any computer device. The method of this embodiment includes the following steps:

[0062] S01. Based on an industrial control network of an industrial control system, flow data of a current industrial control system is obtained from a port of a switch in the industrial control network.

[0063] Here, the switch can be any switch in the industrial control network. Preferably, the switch is a core switch in the industrial control network, so as to obtain the flow data in the entire industrial control system, thereby realizing the identification of the industrial control assets in the entire industrial control network. In addition, in order not to affect the normal communication between the industrial control assets in the industrial control network, the flow data of the current industrial control system is generally obtained through the mirror port of the switch.

[0064] S02. According to a predefined parsing strategy, the traffic data is parsed to obtain the identity information of the industrial control asset that sends the traffic data and the port information used, and to obtain at least one operation instruction contained in the traffic data, and the port information and operation instruction are used as the behavior features corresponding to the identity information.

[0065] It should be noted that, in the prior art, industrial control systems mainly include computer centralized control systems, distributed control systems, fieldbus control systems, and PLC control systems, etc. Regardless of which of the above industrial control systems is targeted, the industrial control asset identification method of this embodiment actually focuses on the industrial control behavior of industrial control assets in the industrial control network, and an industrial control behavior generated by an industrial control asset is actually composed of one or more minimum control instruction units issued by the industrial control asset and arranged in chronological order. By identifying these minimum control instruction units, the behavior generated by the industrial control asset can be inferred.

[0066] The above-mentioned minimum control instruction unit may have different names according to the usage habits of different users. Generally, it is collectively referred to as an operation instruction in the field of industrial control. In different communication protocols, the operation instructions also correspond to different names. For example, in a distributed control system, the operation instruction corresponds to the following names: function code based on MODBUS-TCP communication protocol, control instruction based on MELSEC-Q communication protocol, or control instruction based on OMRON-FINS-TCP communication protocol, etc.

[0067] The operation instruction is actually a string of characters based on the communication protocol. This string of characters can represent specific operation instructions only under the communication protocol it obeys. Therefore, when obtaining operation instructions from data traffic, it is necessary to know the communication protocol that the operation instruction obeys. The communication protocol corresponds to the port information one by one. Therefore, when parsing the traffic data, it is necessary to obtain the operation instructions and port information at the same time.

[0068] It should be noted that the communication protocol may be a general protocol or a private protocol. When the communication protocol is a private protocol, the port information corresponding to the private protocol is the port information pre-assigned by the administrator.

[0069] S03, based on a pre-established industrial control behavior feature library, matching the behavior features, obtaining an industrial control behavior recognition result of the identity information, and recording the industrial control behavior recognition result under the identity information;

[0070] The industrial control behavior feature library includes multiple industrial control behaviors and a behavior feature corresponding to each industrial control behavior.

[0071] S04. For an industrial control asset of a type to be identified, all industrial control behaviors recorded within a preset first preset time period under the identity information of the industrial control asset are obtained, and the industrial control behaviors are matched based on a pre-established asset behavior baseline library to obtain an asset type identification result of the industrial control asset; the first preset time period can be set according to the operation status of the industrial control system. Generally, the more industrial control assets there are in the industrial control system, or the more frequent the industrial control behaviors generated by the industrial control assets, the shorter the first preset time period; specifically, the first preset time period can be 5 minutes, 30 minutes, 1 hour, 2 hours, 4 hours, 8 hours, 12 hours or longer.

[0072] The asset behavior baseline library includes multiple asset types and a behavior baseline corresponding to each asset type, and a behavior baseline of an asset type includes at least one industrial control behavior.

[0073] In a specific industrial control system, the asset type can be divided according to the actual management needs of the administrator. For example, in a distributed control system, according to the role of the industrial control assets in the distributed control system, the asset type can be divided into one or more of the following: engineer station, operator station, controller, OPC server, MODBUS master station, MODBUS slave station, clock synchronization server, data backup server.

[0074] Generally, a behavior baseline refers to the behavior performance of an industrial control asset under normal conditions. The behavior baseline of an asset type may include, under normal conditions, the industrial control behavior generated by the asset type, the frequency of the industrial control behavior generated by the asset type, the time when a certain industrial control behavior of the asset type is generated, etc. In a specific industrial control system, for an industrial control asset of a certain asset type, the industrial control behavior generated by it under natural conditions should be one or more certain ones. Therefore, the method of this embodiment only focuses on the industrial control behavior in the behavior baseline.

[0075] For example, in a distributed control system, the asset types in the asset behavior baseline library include engineer stations, operator stations, controllers, OPC servers, MODBUS master stations, MODBUS slave stations, clock synchronization servers, and data backup servers, and,

[0076] For an industrial control asset whose asset type is an engineering station, its corresponding behavior baseline includes the following industrial control behaviors: configuration download, tag reading, tag writing, tag debugging, and firmware update;

[0077] For an industrial control asset whose asset type is an operator station, its corresponding behavior baseline includes the following industrial control behaviors: read bit number, write bit number, and bit number debugging;

[0078] An industrial control asset whose asset type is a controller has a corresponding behavior baseline including the following industrial control behaviors: a bit number is read and a bit number is written.

[0079] For an industrial control asset of a type to be identified, when all industrial control behaviors recorded by the industrial control asset within a preset first preset time period include reading bit numbers, writing bit numbers, and bit number debugging, and the industrial control behavior of the industrial control asset is completely consistent with the behavior baseline of the asset type being an operator station, the operator station is taken as the asset type of the industrial control asset as the identification result.

[0080] In addition, it can be seen that there is partial overlap in the behavioral baselines of different asset types. When the preset first preset time is too short, it is easy to make the industrial control behaviors of an industrial control asset of a to-be-identified type less and less representative, thereby making the asset type identification of the industrial control asset inaccurate. Therefore, the first preset time in this method should be reasonably set according to the actual situation of the specific industrial control system. Generally, the first preset time should be as long as possible to further improve the recognition accuracy of this method.

[0081] The industrial control asset identification method of this embodiment identifies the asset type based on the industrial control behavior generated by the industrial control assets in the industrial control system. In essence, it identifies the industrial control assets according to the specific roles they play in the industrial control system, thereby shielding the software and hardware differences between various industrial control assets in the industrial control system and effectively improving the identification accuracy of industrial control assets.

[0082] Embodiment 2

[0083] In order to better understand the first embodiment, this embodiment is described in detail with reference to specific sub-steps.

[0084] The industrial control asset identification method of this embodiment includes the following steps:

[0085] S01. Based on an industrial control network of an industrial control system, flow data of a current industrial control system is obtained from a port of a switch in the industrial control network.

[0086] S02. According to a predefined parsing strategy, the traffic data is parsed to obtain the identity information of the industrial control asset that sends the traffic data and the port information used, and to obtain at least one operation instruction contained in the traffic data, and the port information and operation instruction are used as the behavior features corresponding to the identity information.

[0087] The flow data may be data link layer flow data obtained from the switch port. In order to better understand the above step S02, the following is a detailed description in conjunction with sub-steps S021 to S024.

[0088] S021. Perform data link layer protocol parsing, network layer protocol parsing, and transport layer protocol parsing on the data link layer traffic data in sequence, respectively obtain the MAC address, IP address, and application layer traffic data of the industrial control asset that sends the traffic data, and use the MAC address and IP address as the identity information of the industrial control asset;

[0089] In order to identify the industrial control assets newly connected to the industrial control network, the obtained identity information is matched with the current asset information table. If the identity information does not exist in the asset information table, new asset information to which the current identity information belongs is created in the asset information table;

[0090] The asset information table includes identity information of multiple industrial control assets, and the identity information of one industrial control asset includes the MAC address and IP address of the industrial control asset.

[0091] The data link layer traffic data is subjected to data link layer protocol parsing, network layer protocol parsing and transport layer protocol parsing in sequence, and the MAC address, IP address and application layer traffic data of the industrial control asset sending the traffic data are respectively obtained. The parsing process is progressive, specifically, firstly, the data link layer traffic data is subjected to link layer protocol parsing to obtain the MAC address and network layer traffic data; then, the obtained network layer traffic data is subjected to network layer protocol parsing to obtain the IP address and transport layer traffic data; then, the obtained transport layer traffic data is subjected to transport layer protocol parsing to obtain the application layer traffic data. Among them, data link layer protocol parsing, network layer protocol parsing and transport layer protocol parsing are all existing technologies and will not be elaborated here.

[0092] S022. Divide the application layer traffic data into a plurality of application layer sessions through session management, determine the application layer traffic data sent by the session initiator in the application layer traffic data according to the direction of the session, and use the MAC address and IP address corresponding to the session initiator as the first identity information, and use the MAC address and IP address corresponding to the session recipient as the second identity information.

[0093] The session management is a prior art. Generally, a session includes direction information corresponding to the session, and the direction information includes source MAC address, destination MAC address, source IP address, destination IP address, source port and destination port corresponding to the session. Determining the application layer traffic data sent by the session initiator in the application layer traffic data according to the direction of the session means obtaining the source MAC address, destination MAC address, source IP address, destination IP address, source port and destination port corresponding to each application layer data packet in the application layer traffic data for the session, and comparing the above information of the application layer data packet with the direction information of the session. If the above information of the application layer data packet is the same as the direction information of the session, it means that the application layer data packet is sent by the session initiator; if the above information of the application layer data packet is opposite to the direction information of the session, it means that the application layer data packet is sent by the session receiver.

[0094] S023. Analyze the application layer traffic data sent by the session initiator to obtain one or more operation instructions arranged in chronological order.

[0095] Specifically, the traffic data sent by the session initiator includes at least one application layer data packet, and S023 includes the following sub-steps:

[0096] S023-1. Determine a protocol type of the application layer data packet based on a keyword of the application layer data packet and / or a destination port of the application layer data packet.

[0097] S023-2. Based on the protocol type, search for the offset and field length of the operation instruction in the application layer data packet from a pre-established index table.

[0098] The index table includes a plurality of protocol types, and in a data packet corresponding to a protocol type, the offset and field length of the field where the operation instruction is located.

[0099] S023-3, reading the corresponding field of the application layer data packet according to the offset and the field length, and obtaining the operation instruction in the application layer data packet;

[0100] When the number of the operation instructions is at least two, the operation instructions are arranged in the order of the time of acquisition.

[0101] In a specific industrial control system, the number of operation instructions is limited. Sometimes, an operation instruction based on a communication port corresponds to an industrial control behavior; sometimes, multiple operation instructions arranged in chronological order correspond to an industrial control behavior. For example, corresponding to the industrial control behavior of configuration download, its behavior characteristics include the following multiple operation instructions arranged in chronological order: read register status-write register status-read register-write register status.

[0102] Therefore, if there are at least two operation instructions in a session, the operation instructions should be arranged in the order of the time of acquisition.

[0103] S024. When the session ends, the destination port of the current session and all operation instructions under the current session are used as the behavior features corresponding to the first identity information.

[0104] In a session, the industrial control behaviors generated by the session initiator and the session receiver correspond. Specifically, in an industrial control system, a session is usually initiated by an industrial control asset and answered by another industrial control asset. The industrial control asset that initiates the session is the initiator corresponding to the session. Corresponding to the first identity information, the industrial control behavior generated by the industrial control asset that initiates the session is called the initiator's industrial control behavior; the industrial control asset that answers the session is the receiver corresponding to the session. Corresponding to the second identity information, the industrial control behavior generated by the industrial control asset that answers the session is called the receiver's industrial control behavior. Correspondingly, each initiator's industrial control behavior has a corresponding receiver's industrial control behavior. For example, in a session, the session initiator wants to execute the initiator's industrial control behavior of downloading the configuration on the session receiver. The corresponding receiver's industrial control behavior is to respond to the initiator's industrial control behavior and execute the industrial control behavior of downloading the configuration.

[0105] Therefore, for a session, after identifying the initiator's industrial control behavior generated by the session initiator, the corresponding session receiver's industrial control behavior is known accordingly. Therefore, in a session, after obtaining the behavior characteristics of the session initiator, the industrial control behaviors of both parties in the session can be identified at the same time. The industrial control behavior identification method here is also reflected in the definition of the industrial control behavior feature library in the following step S03.

[0106] S03. Based on the industrial control behavior feature library, match the behavior feature corresponding to the first identity information, use the initiator's industrial control behavior that matches the behavior feature as the industrial control behavior identification result of the first identity information, and use the responder's industrial control behavior that matches the behavior feature as the industrial control behavior identification result of the second identity information; and record the industrial control behavior identification results under the corresponding identity information respectively;

[0107] The industrial control behavior feature library includes multiple initiator industrial control behaviors, a behavior feature corresponding to each initiator industrial control behavior, and a receiver industrial control behavior corresponding to each initiator industrial control behavior.

[0108] S04. For an industrial control asset to be identified, all industrial control behaviors recorded within a first preset time period under the identity information of the industrial control asset are obtained, and based on a pre-established asset behavior baseline library, the industrial control behaviors are matched to obtain an asset type identification result of the industrial control asset.

[0109] Specifically, the S04 includes the following sub-steps:

[0110] S041. For an industrial control asset of a type to be identified, obtain all industrial control behaviors of the industrial control asset within a first preset time period.

[0111] S042. Match the industrial control behavior based on the asset behavior baseline library.

[0112] If the industrial control behavior is completely consistent with the behavior baseline corresponding to only a certain asset type, the current asset type is used as the asset type identification result of the industrial control asset, and the identification of the current industrial control asset is terminated;

[0113] Otherwise, the identity information of the industrial control asset is moved into a list to be confirmed.

[0114] In some extreme cases, for example, when the first preset time period is too short, for an industrial control asset to be identified, the industrial control behaviors generated within a period of time may be too few and not representative. Based on the pre-established asset behavior baseline library, the industrial control behaviors are matched. It may happen that the industrial control behaviors generated by the industrial control asset within this period of time may partially conform to the behavior baselines of multiple asset types, but not fully conform to the behavior baselines of all asset types. In view of the above situation, the identity information of the industrial control asset needs to be put into the list to be confirmed to facilitate its subsequent re-identification.

[0115] Specifically, Figure 2 As shown, for the industrial control assets in the list to be confirmed, the following steps can be performed to identify them:

[0116] A001. Obtain the identity information of an industrial control asset in the list to be confirmed.

[0117] A002. Wait for a second preset time period and reacquire all industrial control behaviors recorded under the identity information; the second preset time period can be set according to actual needs. Preferably, the second preset time period should be greater than the first preset time period.

[0118] A003. Based on the asset behavior baseline library, the re-acquired industrial control behavior is matched to determine whether the re-acquired industrial control behavior is completely consistent with the behavior baseline corresponding to a certain asset type.

[0119] If yes, the current asset type is used as the asset type identification result of the industrial control asset, and the identity information row of the industrial control asset is removed from the list to be confirmed, and the process jumps to A001;

[0120] Otherwise jump to A004.

[0121] A004. For an industrial control asset in the to-be-confirmed list, if an asset type manually assigned by an administrator is received, the identity information of the industrial control asset is removed from the to-be-confirmed list.

[0122] A005. Determine whether the pending confirmation list is empty.

[0123] If not, jump to A001;

[0124] If yes, it means that all industrial control assets in the list to be confirmed have been identified, and the operation ends.

[0125] Embodiment 3

[0126] This embodiment also provides an industrial control asset identification system based on an industrial control system, including:

[0127] A flow data acquisition module is used for acquiring the flow data of the current industrial control system from the port of the switch in the industrial control network based on the industrial control network of the industrial control system;

[0128] A first parsing module, used to parse the flow data, extract the identity information of the industrial control asset sending the flow data and the application layer flow data in the flow data;

[0129] A session management module, used for dividing the application layer traffic data into different sessions;

[0130] The second parsing module is used to parse the operation instructions contained in the application layer traffic data sent by the initiator asset in a session.

[0131] An industrial control behavior identification module, used to identify the industrial control behavior of an industrial control asset based on the behavior characteristics of the industrial control asset; and

[0132] The asset type identification module is used to identify the asset type of the industrial control asset based on all industrial control behaviors of the industrial control asset.

[0133] Since the system / device described in the above embodiments of the present invention is a system / device used to implement the method of the above embodiments of the present invention, a person skilled in the art can understand the specific structure and deformation of the system / device based on the method described in the above embodiments of the present invention, and thus will not be described in detail here. All systems / devices used in the method of the above embodiments of the present invention belong to the scope of protection of the present invention.

[0134] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, systems or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0135] The present invention is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products according to the embodiments of the present invention. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions.

[0136] It should be noted that in the claims, any reference numerals placed between brackets shall not be construed as limiting the claims. The word "comprising" does not exclude the presence of components or steps not listed in the claims. The word "a" or "an" preceding a component does not exclude the presence of a plurality of such components. The invention may be implemented by means of hardware comprising several different components and by means of a suitably programmed computer. In the claims enumerating several means, several of these means may be embodied by the same hardware. The use of the words first, second, third, etc., is for convenience of expression only and does not indicate any order. These words may be understood as part of the component name.

[0137] In addition, it should be noted that, in the description of this specification, the description of the terms "one embodiment", "some embodiments", "embodiment", "example", "specific example" or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, unless they are contradictory.

[0138] Although the preferred embodiments of the present invention have been described, those skilled in the art may make other changes and modifications to these embodiments after knowing the basic creative concept. Therefore, the claims should be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present invention.

[0139] Obviously, those skilled in the art can make various modifications and variations to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention should also include these modifications and variations.

Claims

1. A method for identifying industrial control assets based on industrial control systems, characterized in that: include: S01, based on an industrial control network of an industrial control system, obtaining flow data of the current industrial control system from a port of a switch in the industrial control network; S02. According to a predefined parsing strategy, the flow data is parsed to obtain the identity information and the port information used by the industrial control asset that sends the flow data, and to obtain at least one operation instruction contained in the flow data, and the port information and the operation instruction are used as the behavior features corresponding to the identity information; S03, based on a pre-established industrial control behavior feature library, matching the behavior features, obtaining an industrial control behavior recognition result of the identity information, and recording the industrial control behavior recognition result under the identity information; S04. For an industrial control asset to be identified, all industrial control behaviors recorded within a first preset period of time under the identity information of the industrial control asset are obtained, and the industrial control behaviors are matched based on a pre-established asset behavior baseline library to obtain an asset type identification result of the industrial control asset; The asset behavior baseline library includes multiple asset types and a behavior baseline corresponding to each asset type, and a behavior baseline of an asset type includes at least one industrial control behavior; In S03, the industrial control behavior feature library includes multiple initiator industrial control behaviors, a behavior feature corresponding to each initiator industrial control behavior, and a receiver industrial control behavior corresponding to each initiator industrial control behavior; The S03 includes: Based on the industrial control behavior feature library, the behavior feature corresponding to the first identity information is matched, the initiator's industrial control behavior matching the behavior feature is used as the industrial control behavior identification result of the first identity information, and the receiver's industrial control behavior matching the behavior feature is used as the industrial control behavior identification result of the second identity information; and the industrial control behavior identification results are recorded under the corresponding identity information respectively; The industrial control asset that initiates the session is the initiator of the session, corresponding to the first identity information; the industrial control asset that responds to the session is the receiver of the session, corresponding to the second identity information.

2. The industrial control asset identification method according to claim 1, characterized in that: The flow data is data link layer flow data, and accordingly, S02 includes: S021. Perform data link layer protocol parsing, network layer protocol parsing, and transport layer protocol parsing on the data link layer traffic data in sequence, respectively obtain the MAC address, IP address, and application layer traffic data of the industrial control asset that sends the traffic data, and use the MAC address and IP address as the identity information of the industrial control asset; S022. Divide the application layer traffic data into a plurality of application layer sessions through session management, determine the application layer traffic data sent by the session initiator in the application layer traffic data according to the direction of the session, and use the MAC address and IP address corresponding to the session initiator as the first identity information, and use the MAC address and IP address corresponding to the session receiver as the second identity information; S023, parsing the application layer traffic data sent by the session initiator to obtain one or more operation instructions arranged in chronological order; S024. When the session ends, the destination port of the current session and all operation instructions under the current session are used as the behavior features corresponding to the first identity information.

3. The industrial control asset identification method according to claim 2, characterized in that: The traffic data sent by the session initiator includes at least one application layer data packet, and S023 includes: S023-1. Determine the protocol type of the application layer data packet based on a keyword of the application layer data packet and / or a destination port of the application layer data packet; S023-2. Based on the protocol type, searching the offset and field length of the operation instruction in the application layer data packet from a pre-established index table; The index table includes a plurality of protocol types, and in a data packet corresponding to a protocol type, the offset and field length of the field where the operation instruction is located; S023-3, reading the corresponding field of the application layer data packet according to the offset and the field length, and obtaining the operation instruction in the application layer data packet; When the number of the operation instructions is at least two, the operation instructions are arranged in the order of the time of acquisition.

4. The industrial control asset identification method according to claim 2, characterized in that: The S021 further includes: Match the obtained identity information with the current asset information table. If the identity information does not exist in the asset information table, create new asset information to which the current identity information belongs in the asset information table. Wherein, the asset information table includes identity information of multiple industrial control assets.

5. The industrial control asset identification method according to any one of claims 1 to 4, characterized in that: The industrial control system is one or more of a computer centralized control system, a distributed control system, a field bus control system and a PLC control system; If the industrial control system is a distributed control system, the operation instruction includes one or more of the following: a function code based on the MODBUS-TCP protocol, a control instruction based on the MELSEC-Q protocol, or a control instruction based on the OMRON-FINS-TCP protocol.

6. The industrial control asset identification method according to any one of claims 1 to 4, characterized in that: The S04 includes: S041. For an industrial control asset of a type to be identified, obtaining all industrial control behaviors of the industrial control asset within a first preset time period; S042. Match the industrial control behavior based on the asset behavior baseline library. If the industrial control behavior is completely consistent with the behavior baseline corresponding to only a certain asset type, the current asset type is used as the asset type identification result of the industrial control asset; Otherwise, the identity information of the industrial control asset is moved into a list to be confirmed.

7. The industrial control asset identification method according to claim 6, characterized in that: For the industrial control assets in the pending confirmation list, repeat the following steps until the pending confirmation list is empty: A01. Wait for a second preset time and reacquire all industrial control behaviors of the industrial control assets in the list to be confirmed; A02. Based on the asset behavior baseline library, the retrieved industrial control behaviors are matched. If the re-acquired industrial control behavior is completely consistent with the behavior baseline corresponding to only a certain asset type, the current asset type is used as the asset type identification result of the industrial control asset, and the identity information row of the industrial control asset is removed from the list to be confirmed.

8. The industrial control asset identification method according to claim 7, characterized in that: For an industrial control asset in the to-be-confirmed list, if an asset type manually assigned by an administrator is received, the identity information of the industrial control asset is removed from the to-be-confirmed list.

9. An industrial control asset identification system based on an industrial control system, characterized in that: include: A flow data acquisition module is used for acquiring the flow data of the current industrial control system from the port of the switch in the industrial control network based on the industrial control network of the industrial control system; A first parsing module, used to parse the flow data, extract the identity information of the industrial control asset that sends the flow data and the application layer flow data in the flow data; A session management module, used for dividing the application layer traffic data into different sessions; The second parsing module is used to parse the operation instructions contained in the application layer traffic data sent by the initiator asset in a session; An industrial control behavior identification module, used to identify the industrial control behavior of an industrial control asset based on the behavior characteristics of the industrial control asset; and An asset type identification module, used to identify the asset type of an industrial control asset based on all industrial control behaviors of the industrial control asset; The industrial control behavior identification module matches the behavior characteristics corresponding to the first identity information based on the industrial control behavior characteristic library, takes the initiator's industrial control behavior matching the behavior characteristics as the industrial control behavior identification result of the first identity information, takes the receiver's industrial control behavior matching the behavior characteristics as the industrial control behavior identification result of the second identity information; and records the industrial control behavior identification results under the corresponding identity information respectively; The industrial control asset that initiates the session is the initiator of the session, corresponding to the first identity information; the industrial control asset that responds to the session is the receiver of the session, corresponding to the second identity information; The industrial control behavior feature library includes multiple initiator industrial control behaviors, a behavior feature corresponding to each initiator industrial control behavior, and a receiver industrial control behavior corresponding to each initiator industrial control behavior.

Images