A sandbox application method and device for an industrial control network and a storage medium

Abstract

The application relates to a sandbox application method and device of an industrial control network and a storage medium, the method comprising the following steps: intercepting API requests for an operating system and SQL instructions for a database in the industrial control network; in the case of determining that the API requests are intercepted, importing the API requests into an operating system sandbox; and determining whether the API requests are legal through the operating system sandbox, and in the case of determining that the API requests are legal, sending the API requests to the operating system; in the case of determining that the SQL instructions are intercepted, importing the SQL instructions into a database sandbox; and determining whether the SQL instructions are legal through the database sandbox, and in the case of determining that the SQL instructions are legal, sending the SQL instructions to the database. The method avoids the execution of illegal API requests or SQL instructions by the operating system or the database, prevents the network security of the industrial control network from being threatened, and effectively guarantees the network security of the industrial control network.

Description

Technical Field

[0001] This invention relates to the field of industrial control network security, and in particular to a sandbox application method, apparatus and storage medium for industrial control networks. Background Technology

[0002] With the application of computer technology and network communication technology to industrial control systems, industrial control systems face many network security problems, such as viruses, information leakage and tampering, and unauthorized control of the system. These problems greatly reduce the stability of industrial control systems.

[0003] Industrial control systems generate a large number of service requests during daily operation, some of which are hacker attacks. How to promptly capture these attacks and proactively block them from the large volume of service requests is a problem that network security operations and maintenance personnel urgently need to solve. Summary of the Invention

[0004] To overcome the problems existing in related technologies, the present invention provides a sandbox application method, device and storage medium for industrial control networks.

[0005] According to a first aspect of the present invention, a sandbox application method for an industrial control network is provided, comprising:

[0006] Intercepting API requests to the operating system and SQL commands to the database in the industrial control network;

[0007] If the API request is intercepted, the API request is imported into the operating system sandbox; and the validity of the API request is determined by the operating system sandbox. If the API request is found to be valid, the API request is sent to the operating system.

[0008] If the SQL instruction is intercepted, the SQL instruction is imported into the database sandbox; and the validity of the SQL instruction is determined through the database sandbox. If the SQL instruction is found to be valid, the SQL instruction is sent to the database.

[0009] Optionally, determining the validity of the API request through the operating system sandbox includes:

[0010] Determine whether the operation type corresponding to the API request is an illegal operation type;

[0011] If it is determined that the operation type corresponding to the API request is an illegal operation type, it is determined whether the operation object corresponding to the API request is a whitelisted object;

[0012] If it is determined that the operation object corresponding to the API request is not a whitelisted object, the API request is determined to be an illegal request.

[0013] Optionally, determining the validity of the API request through the operating system sandbox further includes:

[0014] If it is determined that the operation object corresponding to the API request is a whitelisted object, the API request is redirected to obtain the redirected file path;

[0015] Execute the API request based on the redirected file path;

[0016] If, after executing the API request, there is an anomaly with the file at the redirected file path, the API request is determined to be an illegal request.

[0017] Optionally, determining the validity of the SQL command through the database sandbox includes:

[0018] The SQL command is parsed to obtain the parsed command.

[0019] Determine whether the parsing instruction is a whitelist instruction;

[0020] If it is determined that the parsing instruction is not a whitelisted instruction, the SQL instruction is determined to be an illegal instruction.

[0021] Optionally, parsing the SQL instruction to obtain the parsed instruction includes:

[0022] Lexical analysis is performed on the SQL command to obtain the lexical chain;

[0023] The SQL instruction is parsed into a syntax tree, and the SQL semantic information is determined. The parsing instruction includes the lexical chain and the SQL semantic information.

[0024] Optionally, determining whether the parsing instruction is a whitelist instruction includes:

[0025] The lexical chain is compared with the target lexical chain in the whitelist to obtain the first comparison result;

[0026] If the first comparison result indicates that the lexical chain matches the target lexical chain, the SQL semantic information is compared with the semantic library in the whitelist to obtain the second comparison result;

[0027] If the first comparison result indicates that the lexical chain does not match the target lexical chain, and / or the second comparison result indicates that the SQL semantic information does not match the semantic library in the whitelist, then the parsing instruction is determined to be a whitelist instruction.

[0028] Optionally, the method further includes:

[0029] If the API request is determined to be an invalid request, or the SQL instruction is determined to be an invalid instruction, the API request or the SQL instruction is converted into a target operation log according to a preset conversion method; and

[0030] Write the target operation log into the exception log database.

[0031] According to a second aspect of the present invention, a sandbox application device for an industrial control network is provided, the device comprising:

[0032] The interception module is used to intercept API requests to the operating system and SQL commands to the database in the industrial control network.

[0033] The first import module is used to import the API request into the operating system sandbox when it is determined that the API request has been intercepted; and to determine whether the API request is legitimate through the operating system sandbox. If the API request is legitimate, the module sends the API request to the operating system.

[0034] The second import module is used to import the SQL instruction into the database sandbox when it is determined that the SQL instruction has been intercepted; and to determine whether the SQL instruction is valid through the database sandbox. If the SQL instruction is valid, the SQL instruction is sent to the database.

[0035] According to a third aspect of the present invention, a sandbox application device for an industrial control network is provided, comprising:

[0036] processor;

[0037] Memory used to store processor-executable instructions;

[0038] The processor is configured as follows:

[0039] Intercepting API requests to the operating system and SQL commands to the database in the industrial control network;

[0040] If the API request is intercepted, the API request is imported into the operating system sandbox; and the validity of the API request is determined by the operating system sandbox. If the API request is found to be valid, the API request is sent to the operating system.

[0041] If the SQL instruction is intercepted, the SQL instruction is imported into the database sandbox; and the validity of the SQL instruction is determined through the database sandbox. If the SQL instruction is found to be valid, the SQL instruction is sent to the database.

[0042] According to a fourth aspect of the present invention, a computer-readable storage medium is provided having computer program instructions stored thereon, which, when executed by a processor, implement the steps of the method described in any of the first aspects of the present invention.

[0043] The technical solutions provided by the embodiments of the present invention can include the following beneficial effects: by intercepting API requests and SQL commands in the industrial control network and importing the API requests and SQL commands into the corresponding sandbox environment, the legality of the corresponding API requests and SQL commands can be determined in the sandbox environment. Only when they are legal are the API requests or SQL commands forwarded to the operating system or database, thus avoiding the execution of illegal API requests or SQL commands by the operating system or database, which would threaten the network security of the industrial control network and effectively ensure the network security of the industrial control network.

[0044] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit the invention. Attached Figure Description

[0045] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0046] Figure 1 This is a flowchart illustrating a sandbox application method for an industrial control network according to an exemplary embodiment.

[0047] Figure 2 This is a flowchart illustrating a method for determining the validity of an API request according to an exemplary embodiment.

[0048] Figure 3 This is a flowchart illustrating a method for determining the validity of an SQL command according to an exemplary embodiment.

[0049] Figure 4 This is a block diagram illustrating a sandbox application device for an industrial control network according to an exemplary embodiment.

[0050] Figure 5 This is a block diagram illustrating another sandbox application device for an industrial control network according to an exemplary embodiment.

[0051] Figure 6 This is a block diagram illustrating yet another sandbox application device for an industrial control network according to an exemplary embodiment. Detailed Implementation

[0052] Embodiments of the present invention will now be described in more detail with reference to the accompanying drawings. While some embodiments of the invention are shown in the drawings, it should be understood that the invention can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of the invention. It should be understood that the accompanying drawings and embodiments are for illustrative purposes only and are not intended to limit the scope of protection of the invention.

[0053] It should be understood that the various steps described in the method embodiments of the present invention may be performed in different orders and / or in parallel. Furthermore, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present invention is not limited in this respect.

[0054] The term "comprising" and its variations as used herein are open-ended inclusions, meaning "including but not limited to". The term "based on" means "at least partially based on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". Definitions of other terms will be given in the description below.

[0055] It should be noted that the concepts of "first" and "second" mentioned in this invention are only used to distinguish different devices, modules or units, and are not used to limit the order of functions performed by these devices, modules or units or their interdependencies.

[0056] It should be noted that the terms "a" and "a plurality of" used in this invention are illustrative rather than restrictive. Those skilled in the art should understand that, unless otherwise expressly indicated in the context, they should be understood as "one or more".

[0057] The names of the messages or information exchanged between the multiple devices in the embodiments of the present invention are for illustrative purposes only and are not intended to limit the scope of these messages or information.

[0058] It is understood that before using the technical solutions disclosed in the various embodiments of the present invention, users should be informed of the types, scope of use, and usage scenarios of the personal information involved in the present invention and their authorization should be obtained in accordance with relevant laws and regulations through appropriate means.

[0059] To enable those skilled in the art to better understand the improvements of the technical solutions provided by this invention, this invention will first further introduce the relevant technologies.

[0060] With the application of computer and network communication technologies to industrial control systems, cybersecurity issues have arisen, such as viruses, information leaks and tampering, and unauthorized system control. These cybersecurity problems significantly reduce the stability of industrial control systems. Therefore, how to proactively prevent and promptly detect cyberattacks is a pressing issue that needs to be addressed in this field.

[0061] In related technologies, honeypots are often used to protect the network security of industrial control systems. Honeypots can lure network attackers to exploit vulnerabilities or flaws by leaving them unattended. They can also intercept and record network data packets entering and leaving the honeypot, then use a data forwarder to transfer all network data packets. Finally, the honeypot's simulated operating system and services can capture all system logs, user operations, and actions, thereby achieving data capture.

[0062] A honeypot is essentially a "fake computer with security vulnerabilities and insufficient safeguards" designed to lure hackers into attacks and collect data on network attacks. Because of these characteristics, honeypots cannot run on real application servers; they must be hosted on a separate server and completely isolated from the real application. This limits the use of honeypot systems as a protective measure.

[0063] To address the problems existing in related technologies, this invention provides a sandbox application method, device, and storage medium for industrial control networks. Based on a sandbox approach, it implements application-layer software capable of capturing attack behaviors from the network and recording and analyzing network access, database access, and operating system access corresponding to the attack behaviors. This provides conditions for analyzing unknown network attack behaviors targeting industrial control networks.

[0064] Figure 1 This invention illustrates a sandbox application method for an industrial control network according to an exemplary embodiment. This method can be applied to control terminals within an industrial control network, or to servers communicatively connected to the control terminals; however, this invention does not limit the application to these applications. It is understood that an industrial control network can include various field devices. These field devices can connect to the control terminal in the master station via communication channels to send or receive instructions from the control terminal to the application server and data server in the master station, thereby writing / reading data from the database or executing corresponding applications. Figure 1 As shown, the method includes:

[0065] S101. Intercept API (Application Programming Interface) requests to the operating system and SQL commands to the database in the industrial control network.

[0066] Specifically, API requests can be intercepted through API hooks. API hooks can include various types such as Inline Hook, SSDT Hook, and Shadow SSDT Hook to implement API calls to the operating system, such as Windows. Inline Hook encapsulates API functions, rewrites the function execution flow, and implements filtering control over the driver function. SSDT Hook (System Services Descriptor Table) and Shadow SSDT Hook primarily intercept API calls to the system service descriptor table.

[0067] S102. If the API request is intercepted, the API request is imported into the operating system sandbox; and the validity of the API request is determined by the operating system sandbox. If the API request is determined to be valid, the API request is sent to the operating system.

[0068] Optionally, to prevent the operating system sandbox process from being terminated by malicious programs, on 64-bit Windows systems, the kernel function ObRegisterCallbacks() can be used to utilize callback function pointers to ensure that the operating system sandbox process is not terminated, thereby further ensuring the security performance of the industrial control network.

[0069] S103. If the SQL instruction is intercepted, the SQL instruction is imported into the database sandbox; and the database sandbox is used to determine whether the SQL instruction is valid. If the SQL instruction is valid, the SQL instruction is sent to the database.

[0070] It is understandable that the aforementioned operating system sandbox and database sandbox can be virtual system operating environments deployed at the application layer. When attackers launch attacks against the system or database, they can respond in the virtual environment of the sandbox without affecting the actual system or server in the industrial control network. Furthermore, the sandbox can roll back the environment to the state before the attack at any time after receiving an attack.

[0071] In this embodiment of the invention, by intercepting API requests and SQL commands in the industrial control network and importing them into the corresponding sandbox environment, the legality of the corresponding API requests and SQL commands is determined in the sandbox environment. Only when they are legal are the API requests or SQL commands forwarded to the operating system or database. This prevents illegal API requests or SQL commands from being executed by the operating system or database, thus avoiding threats to the network security of the industrial control network and effectively ensuring the network security of the industrial control network.

[0072] In some alternative implementations, determining the legitimacy of the API request through the operating system sandbox includes:

[0073] Determine whether the operation type corresponding to the API request is an illegal operation type;

[0074] If it is determined that the operation type corresponding to the API request is an illegal operation type, it is determined whether the operation object corresponding to the API request is a whitelisted object;

[0075] If it is determined that the operation object corresponding to the API request is not a whitelisted object, the API request is determined to be an illegal request.

[0076] Furthermore, if it is determined that the operation type corresponding to the API request is not an illegal operation type, or if it is determined that the operation type corresponding to the API request is an illegal operation type, the API request can be determined as a legal request, so that the operating system can perform the corresponding real file operation.

[0077] Illegal operation types can include, for example, write, delete, or create operations. It's understood that the whitelist objects can be pre-configured. For instance, a file object with the path XX can be whitelisted if its modification will not affect the normal operation of the operating system or industrial control network. Alternatively, the whitelist objects can also include user objects; for example, an API request initiated by a specific user can be considered a legitimate request.

[0078] By adopting the above scheme, API requests are imported into the operating system sandbox, which allows the operating system sandbox to determine the operation type and target of the API request. If the API request is determined to be an illegal operation type and the target is not in the whitelist, the API request is identified as an illegal request. When the API request is identified as illegal, it is not sent to the kernel layer of the operating system for execution. This effectively ensures the security performance of the operating system in the industrial control network and prevents illegal API requests from being executed and affecting files in the operating system.

[0079] In some optional embodiments, determining the validity of the API request through the operating system sandbox further includes:

[0080] If it is determined that the operation object corresponding to the API request is a whitelisted object, the API request is redirected to obtain the redirected file path;

[0081] Execute the API request based on the redirected file path;

[0082] If, after executing the API request, there is an anomaly with the file at the redirected file path, the API request is determined to be an illegal request.

[0083] It's important to understand that the redirected file path doesn't correspond to a physical disk, but rather a virtual disk allocated in memory. When performing a file redirection operation, the full path of the file to be operated on in the API request can be determined, and all file operations can be transferred to the virtual disk in memory that has already been allocated.

[0084] For example, a file redirection operation could be redirecting the accessed file to a specified file. For instance, all API requests for files on drive C could be redirected to the C:\Sample\ directory. If the API request indicates an operation on the file at path C:\password, after redirection, the redirected file path would be C:\Sample\password. Further, the corresponding file operations can be performed on the redirected file. After the file operations, it can be determined whether there are any problems with the sandbox environment. If problems are found, it can be determined that the file operations corresponding to the API request will affect the operating system. Therefore, the API request can be identified as an illegal request to avoid executing the file operations corresponding to the API request in a real environment.

[0085] By adopting the above scheme, the file path corresponding to the API request is redirected in the operating system sandbox, thereby enabling the API request to be executed in the sandbox environment to determine whether the API request is legitimate. This not only accurately identifies illegitimate API requests but also prevents illegitimate requests from affecting the real operating system, effectively ensuring the security of the industrial control network.

[0086] In some alternative embodiments, determining the validity of the SQL command through the database sandbox includes:

[0087] The SQL command is parsed to obtain the parsed command.

[0088] Determine whether the parsing instruction is a whitelist instruction;

[0089] If it is determined that the parsing instruction is not a whitelisted instruction, the SQL instruction is determined to be an illegal instruction.

[0090] This database sandbox can be understood as a virtual database capable of executing request statements for all types of databases. For example, it can authenticate users by using IP addresses, usernames, passwords, and digital certificates to distinguish legitimate users from unauthorized intruders; design SQL statement libraries; perform syntax and semantic parsing of SQL statements; and implement access control for SQL statements based on parsing instructions.

[0091] Specifically, in one possible implementation, the database sandbox can be implemented based on JDBC (Java Database Connectivity) SQL proxy technology. For example, the database sandbox may include a JDBC driver, a JDBC interface adapter, and an SQL filtering module, thereby enabling support for various types of databases such as Oracle, DB2, and SQL Server.

[0092] The whitelist corresponding to the SQL command can be pre-configured. Parsing of the SQL command can include, for example, lexical analysis and syntax analysis.

[0093] By adopting the above scheme, the SQL commands are parsed and the parsing results are compared with a pre-configured whitelist to filter out illegal SQL commands that are not in the whitelist. This can effectively prevent illegal SQL commands from being executed by the real database, which could lead to unauthorized modification of the database and cause security threats to the industrial control network.

[0094] Optionally, parsing the SQL instruction to obtain the parsed instruction includes:

[0095] Lexical analysis is performed on the SQL command to obtain the lexical chain;

[0096] The SQL instruction is parsed into a syntax tree, and the SQL semantic information is determined. The parsing instruction includes the lexical chain and the SQL semantic information.

[0097] Understandably, an SQL command can be represented by a sequence of characters separated by spaces, called a word. Lexical analysis of an SQL command reveals each word within it. These words can then be organized into a word chain, and a word substitution strategy can be used to replace user-inputted words with placeholders, resulting in a lexical chain. Syntactic analysis of an SQL statement yields a syntax tree, which includes the structure of the parsed SQL command. Furthermore, syntactic analysis determines the semantic information of the SQL command, including the SQL operation type (delete, query, insert) and the target table (which table is being operated on).

[0098] By employing the above scheme, lexical and syntactic analysis of SQL commands can be performed to obtain the lexical chain excluding user input information, as well as information such as the SQL operation type and operation object corresponding to the SQL command.

[0099] Furthermore, determining whether the parsing instruction is a whitelist instruction includes:

[0100] The lexical chain is compared with the target lexical chain in the whitelist to obtain the first comparison result;

[0101] If the first comparison result indicates that the lexical chain matches the target lexical chain, the SQL semantic information is compared with the semantic library in the whitelist to obtain the second comparison result;

[0102] If the first comparison result indicates that the lexical chain does not match the target lexical chain, and / or the second comparison result indicates that the SQL semantic information does not match the semantic library in the whitelist, then the parsing instruction is determined to be a whitelist instruction.

[0103] The target lexical chain can be obtained by parsing the legal SQL commands in the whitelist, and the semantic library can also be obtained by parsing the legal SQL commands in the whitelist into a syntax tree.

[0104] By adopting this scheme, after determining the lexical chain and the SQL operation type and operation object corresponding to the SQL instruction, the lexical chain can be compared based on a pre-stored whitelist. If the lexical chain is found to be valid, the SQL instruction can be determined to be a valid instruction and can be executed in the real database environment. If the lexical chain is invalid, but the semantic information is valid, the SQL instruction can be determined to be a valid instruction. If both the lexical chain and the semantic information are invalid, the SQL instruction can be determined to be invalid, thereby preventing the SQL instruction from being executed in the real database environment and effectively ensuring the security of the database in the industrial control network.

[0105] In some alternative embodiments, the method further includes:

[0106] If the API request is determined to be an illegal request, or the SQL instruction is determined to be an illegal instruction, the API request or the SQL instruction is converted into a target operation log according to a preset conversion method; and the target operation log is written into the exception log database.

[0107] Specifically, the target operation log can include log levels, with different levels representing varying degrees of threat posed by API or SQL requests to the security performance of the industrial control network. For example, it can include five levels: DEBUG, INFO, WARNING, ERROR, and FATAL. The target operation log can also include login information, such as user login and logout information, the number of online users, login time, and IP address. For SQL commands, the target operation log can also include the corresponding database operations, such as operation time, data source information, data table information, and data operation type. For API requests, the target operation log can also include feedback information on operating system anomalies, such as the anomaly time, anomaly type, anomaly feedback information, and anomaly data.

[0108] By adopting the above scheme, illegal API requests and SQL commands are converted into operation logs in the target format and stored in the exception log database. This allows staff to directly view various information corresponding to illegal API requests and SQL commands in the industrial control network by querying the exception log database. This facilitates staff in adjusting the security settings of the industrial control network and effectively ensures the network security of the industrial control network.

[0109] To enable those skilled in the art to better understand the technical solutions provided by the present invention, the present invention also provides, for example... Figure 2 The flowchart shown illustrates a method for determining the validity of an API request according to an exemplary embodiment. The execution entity of this method can be an operating system sandbox running at the application layer, such as... Figure 2 As shown, the method includes:

[0110] S201. Obtain API requests intercepted via API Hook.

[0111] S202. Determine whether the operation type corresponding to the API request is an illegal operation type.

[0112] Among them, illegal operation types can include write operations, delete operations, and create operations.

[0113] If it is determined that the operation type corresponding to the API request is an illegal operation type, proceed to steps S204 and S205; if it is determined that the operation type corresponding to the API request is not an illegal operation type, proceed to step S203.

[0114] S203. Determine whether the operation object corresponding to the API request is a whitelisted object.

[0115] If it is determined that the operation object corresponding to the API request is a whitelisted object, proceed to step S206; if it is determined that the operation object corresponding to the API request is not a whitelisted object, proceed to steps S204 and S205.

[0116] S204. Perform the file operation corresponding to the API request in the sandbox environment.

[0117] S205. Determine if the operating system sandbox environment is abnormal.

[0118] If the operating system sandbox environment is determined to be abnormal, proceed to step S207; if the operating system sandbox process is determined to be normal, proceed to step S206.

[0119] S206. Perform the file operation corresponding to the API request in the operating system.

[0120] S207. Convert the API request into a target operation log and write it to the exception log database.

[0121] In addition, it also provides, such as Figure 3 The flowchart shown illustrates a method for determining the validity of an SQL command according to an exemplary embodiment. The execution subject of this method can be a database sandbox, such as... Figure 3 As shown, the method includes:

[0122] S301, Obtain SQL commands.

[0123] S302. Perform lexical analysis on the SQL command to obtain the lexical chain.

[0124] S303. Determine whether the word's syntax chain matches the white name word's syntax chain.

[0125] S304. Perform syntax parsing on the SQL command to obtain semantic information.

[0126] S305. Determine whether the semantic information matches the whitelist semantic information.

[0127] S306. The SQL command is invalid.

[0128] S307. Convert the SQL command into the target operation log and write it to the exception log database.

[0129] S308. Determine if the SQL command is valid.

[0130] S309. Execute the SQL command in the database.

[0131] The above-described technical solution utilizes operating system and database sandboxes to implement an application-layer software. This software possesses honeypot characteristics, meaning it can capture attack behaviors originating from the network and record and analyze the corresponding network, database, and operating system accesses. This provides analytical capabilities for unknown network attacks targeting industrial control networks. Furthermore, based on the operating system and database sandboxes, a virtual runtime environment can be established through API hooking, enabling the direct execution of API requests or SQL commands within the sandbox. This avoids the drawbacks of traditional honeypot software, such as the need for highly realistic simulation of object functionality and the inability to execute real API requests and SQL commands.

[0132] Figure 4 This is a block diagram illustrating a sandbox application device 40 for an industrial control network according to an exemplary embodiment, such as... Figure 4 As shown, the device 40 includes:

[0133] The interception module 41 is used to intercept API requests to the operating system and SQL commands to the database in the industrial control network.

[0134] The first import module 42 is used to import the API request into the operating system sandbox when it is determined that the API request has been intercepted; and to determine whether the API request is legitimate through the operating system sandbox, and if the API request is legitimate, to send the API request to the operating system.

[0135] The second import module 43 is used to import the SQL instruction into the database sandbox when it is determined that the SQL instruction has been intercepted; and to determine whether the SQL instruction is valid through the database sandbox. If the SQL instruction is valid, the SQL instruction is sent to the database.

[0136] Optionally, the first import module 42 is further configured to:

[0137] Determine whether the operation type corresponding to the API request is an illegal operation type;

[0138] If it is determined that the operation type corresponding to the API request is an illegal operation type, it is determined whether the operation object corresponding to the API request is a whitelisted object;

[0139] If it is determined that the operation object corresponding to the API request is not a whitelisted object, the API request is determined to be an illegal request.

[0140] Optionally, the first import module 42 is further configured to:

[0141] If it is determined that the operation object corresponding to the API request is a whitelisted object, the API request is redirected to obtain the redirected file path;

[0142] Execute the API request based on the redirected file path;

[0143] If, after executing the API request, there is an anomaly with the file at the redirected file path, the API request is determined to be an illegal request.

[0144] Optionally, the second import module 44 is further configured to:

[0145] The SQL command is parsed to obtain the parsed command.

[0146] Determine whether the parsing instruction is a whitelist instruction;

[0147] If it is determined that the parsing instruction is not a whitelisted instruction, the SQL instruction is determined to be an illegal instruction.

[0148] Optionally, the second import module 44 is further configured to:

[0149] Lexical analysis is performed on the SQL command to obtain the lexical chain;

[0150] The SQL instruction is parsed into a syntax tree, and the SQL semantic information is determined. The parsing instruction includes the lexical chain and the SQL semantic information.

[0151] Optionally, the second import module 44 is further configured to:

[0152] The lexical chain is compared with the target lexical chain in the whitelist to obtain the first comparison result;

[0153] If the first comparison result indicates that the lexical chain matches the target lexical chain, the SQL semantic information is compared with the semantic library in the whitelist to obtain the second comparison result;

[0154] If the first comparison result indicates that the lexical chain does not match the target lexical chain, and / or the second comparison result indicates that the SQL semantic information does not match the semantic library in the whitelist, then the parsing instruction is determined to be a whitelist instruction.

[0155] Optionally, the device 40 is further configured to:

[0156] If the API request is determined to be an invalid request, or the SQL instruction is determined to be an invalid instruction, the API request or the SQL instruction is converted into a target operation log according to a preset conversion method; and

[0157] Write the target operation log into the exception log database.

[0158] Regarding the apparatus in the above embodiments, the specific manner in which each module performs its operation has been described in detail in the embodiments related to the method, and will not be elaborated upon here.

[0159] The present invention also provides a computer-readable storage medium storing computer program instructions thereon, which, when executed by a processor, implement the steps of the sandbox application method for industrial control networks provided by the present invention.

[0160] Figure 5 This is a block diagram illustrating a device 500 for a sandbox application in an industrial control network according to an exemplary embodiment. For example, device 500 may be a mobile phone, computer, digital broadcast terminal, messaging device, game console, tablet device, medical device, fitness equipment, personal digital assistant, etc.

[0161] Reference Figure 5 The device 500 may include one or more of the following components: a processing component 502, a memory 504, a power component 506, a multimedia component 508, an audio component 510, an input / output (I / O) interface 512, a sensor component 514, and a communication component 516.

[0162] Processing component 502 typically controls the overall operation of device 500, such as operations associated with display, telephone calls, data communication, camera operation, and recording. Processing component 502 may include one or more processors 520 to execute instructions to complete all or part of the steps of the methods described above. Furthermore, processing component 502 may include one or more modules to facilitate interaction between processing component 502 and other components. For example, processing component 502 may include a multimedia module to facilitate interaction between multimedia component 508 and processing component 502.

[0163] Memory 504 is configured to store various types of data to support the operation of device 500. Examples of such data include instructions for any application or method operating on device 500, contact data, phonebook data, messages, pictures, videos, etc. Memory 504 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0164] The power supply component 506 provides power to the various components of the device 500. The power supply component 506 may include a power management system, one or more power sources, and other components associated with generating, managing, and distributing power to the device 500.

[0165] Multimedia component 508 includes a screen that provides an output interface between the device 500 and the user. In some embodiments, the screen may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen may be implemented as a touchscreen to receive input signals from the user. The touch panel includes one or more touch sensors to sense touches, swipes, and gestures on the touch panel. The touch sensors may sense not only the boundaries of the touch or swipe action but also the duration and pressure associated with the touch or swipe operation. In some embodiments, multimedia component 508 includes a front-facing camera and / or a rear-facing camera. When the device 500 is in an operating mode, such as a shooting mode or a video mode, the front-facing camera and / or the rear-facing camera may receive external multimedia data. Each front-facing camera and rear-facing camera may be a fixed optical lens system or have focal length and optical zoom capabilities.

[0166] Audio component 510 is configured to output and / or input audio signals. For example, audio component 510 includes a microphone (MIC) configured to receive external audio signals when device 500 is in an operating mode, such as call mode, recording mode, and voice recognition mode. The received audio signals may be further stored in memory 504 or transmitted via communication component 516. In some embodiments, audio component 510 also includes a speaker for outputting audio signals.

[0167] I / O interface 512 provides an interface between processing component 502 and peripheral interface modules, such as keyboards, click wheels, buttons, etc. These buttons may include, but are not limited to, home buttons, volume buttons, power buttons, and lock buttons.

[0168] Sensor assembly 514 includes one or more sensors for providing status assessments of various aspects of device 500. For example, sensor assembly 514 may detect the on / off state of device 500, the relative positioning of components such as the display and keypad of device 500, changes in the position of device 500 or a component of device 500, the presence or absence of user contact with device 500, the orientation or acceleration / deceleration of device 500, and temperature changes of device 500. Sensor assembly 514 may include a proximity sensor configured to detect the presence of nearby objects without any physical contact. Sensor assembly 514 may also include a light sensor, such as a CMOS or CCD image sensor, for use in imaging applications. In some embodiments, sensor assembly 514 may also include an accelerometer, a gyroscope, a magnetometer, a pressure sensor, or a temperature sensor.

[0169] Communication component 516 is configured to facilitate wired or wireless communication between device 500 and other devices. Device 500 can access wireless networks based on communication standards, such as WiFi, 2G, or 3G, or combinations thereof. In one exemplary embodiment, communication component 516 receives broadcast signals or broadcast-related information from an external broadcast management system via a broadcast channel. In one exemplary embodiment, communication component 516 also includes a near-field communication (NFC) module to facilitate short-range communication. For example, the NFC module may be implemented based on radio frequency identification (RFID) technology, Infrared Data Association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology, and other technologies.

[0170] In an exemplary embodiment, the apparatus 500 may be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to perform the methods described above.

[0171] In an exemplary embodiment, a non-transitory computer-readable storage medium including instructions is also provided, such as a memory 504 including instructions, which can be executed by a processor 520 of the device 500 to perform the above-described method. For example, the non-transitory computer-readable storage medium may be a ROM, random access memory (RAM), CD-ROM, magnetic tape, floppy disk, and optical data storage device, etc.

[0172] In another exemplary embodiment, a computer program product is also provided, the computer program product comprising a computer program executable by a programmable device, the computer program having a code portion for performing the above-described industrial control network sandbox application method when executed by the programmable device.

[0173] Figure 6 This is a block diagram illustrating a sandbox application device 600 for an industrial control network according to an exemplary embodiment. For example, device 600 may be provided as a server. (Refer to...) Figure 6 The device 600 includes a processing component 622, which further includes one or more processors, and memory resources represented by memory 632 for storing instructions, such as application programs, that can be executed by the processing component 622. The application programs stored in memory 632 may include one or more modules, each corresponding to a set of instructions. Furthermore, the processing component 622 is configured to execute instructions to perform the aforementioned sandbox application method for industrial control networks.

[0174] Device 600 may also include a power supply component 626 configured to perform power management of device 600, a wired or wireless network interface 650 configured to connect device 600 to a network, and an input / output (I / O) interface 658. Device 600 can operate on an operating system, such as Windows Server, stored in memory 632. TM Mac OS X TM Unix TM Linux TM FreeBSD TM Or similar.

[0175] Other embodiments of the invention will readily occur to those skilled in the art upon consideration of the specification and practice of the invention. This application is intended to cover any variations, uses, or adaptations of the invention that follow the general principles of the invention and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of the invention are indicated by the following claims.

[0176] The above description is merely a preferred embodiment of the present invention and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of disclosure in this invention is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-described concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features with similar functions disclosed in this invention.

[0177] Furthermore, while the operations are described in a specific order, this should not be construed as requiring these operations to be performed in the specific order shown or in sequential order. In certain circumstances, multitasking and parallel processing may be advantageous. Similarly, while several specific implementation details are included in the above discussion, these should not be construed as limiting the scope of the invention. Certain features described in the context of individual embodiments may also be implemented in combination in a single embodiment. Conversely, various features described in the context of a single embodiment may also be implemented individually or in any suitable sub-combination in multiple embodiments.

[0178] Although the subject matter has been described using language specific to structural features and / or methodological logic, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. Rather, the specific features and actions described above are merely illustrative forms of implementing the claims. Regarding the apparatus in the above embodiments, the specific manner in which the various modules perform their operations has been described in detail in the embodiments relating to the method, and will not be elaborated upon here.

Claims

1. A sandbox application method for industrial control networks, characterized in that, include: Intercepting API requests to the operating system and SQL commands to the database in the industrial control network; If the API request is confirmed to be intercepted, the API request will be imported into the operating system sandbox. The system uses the operating system sandbox to determine whether the API request is valid. If the API request is valid, the system sends the API request to the operating system. If the SQL command is confirmed to be intercepted, the SQL command will be imported into the database sandbox. The database sandbox is used to determine whether the SQL command is valid. If the SQL command is valid, it is sent to the database. The step of determining the validity of the API request through the operating system sandbox includes: Determine whether the operation type corresponding to the API request is an illegal operation type; If it is determined that the operation type corresponding to the API request is an illegal operation type, it is determined whether the operation object corresponding to the API request is a whitelisted object; If it is determined that the operation object corresponding to the API request is not a whitelisted object, the API request is determined to be an illegal request; The step of determining the validity of the API request through the operating system sandbox also includes: If it is determined that the operation object corresponding to the API request is a whitelisted object, the API request is redirected to obtain the redirected file path; Execute the API request based on the redirected file path; If, after executing the API request, an anomaly is found in the file at the redirected file path, the API request is determined to be an illegal request. The step of determining the validity of the SQL command through the database sandbox includes: The SQL command is parsed to obtain the parsed command. Determine whether the parsing instruction is a whitelist instruction; If it is determined that the parsing instruction is not a whitelisted instruction, the SQL instruction is determined to be an illegal instruction; The process of parsing the SQL command to obtain the parsed command includes: Lexical analysis is performed on the SQL command to obtain the lexical chain; The SQL instruction is parsed into a syntax tree, and the SQL semantic information is determined. The parsing instruction includes the lexical chain and the SQL semantic information. The step of determining whether the parsing instruction is a whitelist instruction also includes: The lexical chain is compared with the target lexical chain in the whitelist to obtain the first comparison result; If the first comparison result indicates that the lexical chain matches the target lexical chain, the SQL semantic information is compared with the semantic library in the whitelist to obtain the second comparison result; If the first comparison result indicates that the lexical chain does not match the target lexical chain, and / or the second comparison result indicates that the SQL semantic information does not match the semantic library in the whitelist, it is determined that the parsing instruction is not a whitelist instruction; The method further includes: If the API request is determined to be an invalid request, or the SQL instruction is determined to be an invalid instruction, the API request or the SQL instruction is converted into a target operation log according to a preset conversion method; and Write the target operation log into the exception log database.

Images