Industrial control system security analysis method, device and computer readable medium

Abstract

The present invention provides an industrial control system security analysis method, device and computer-readable medium, the industrial control system security analysis method comprising: collecting communication data packets from a first industrial control system, wherein the operational technology OT network includes a first industrial control system and at least one second industrial control system connected to each other, and the communication data packets are interactive data transmitted between control devices in the first industrial control system; extracting network identifiable information from the communication data packets; judging whether the network identifiable information is located in a pre-created event database; if the network identifiable information is located in the event database, determining that the communication data packet is a malicious data packet, obtaining the security policies of the first industrial control system and each second industrial control system, and determining the threat coefficient of the communication data packet to each second industrial control system according to the network identifiable information and each security policy. This scheme can more accurately analyze the security of the industrial control system.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to an industrial network behavior analysis method, device and computer-readable medium. Background Art

[0002] With the continuous development and progress of the Internet of Things (IOT) technology and operational technology (OT), large-scale manufacturing companies require that all industrial control systems be monitored within the same security monitoring system. Therefore, different industrial control systems will be connected to the same security monitoring system to form an OT network. However, due to the weak security defense capabilities of industrial control systems, the risk of OT networks being maliciously attacked is relatively high.

[0003] Currently, when analyzing the security of industrial control systems, communication data packets transmitted between various control devices in the industrial control system to be analyzed are collected, and then the security analysis of the industrial control system to be analyzed is performed based on the collected communication data packets to determine whether the industrial control system to be analyzed is at risk of being maliciously attacked.

[0004] Regarding the current method of security analysis of industrial control systems, the security of the industrial control system to be analyzed is analyzed based on the communication data packets collected from the industrial control system to be analyzed, and the impact between different industrial control systems in the same OT network is not considered. When an industrial control system is attacked maliciously, it may affect the security of another industrial control system in the same OT network. Therefore, it is impossible to accurately analyze the security of the industrial control system. Summary of the invention

[0005] In view of this, the industrial control system security analysis method, device and computer-readable medium provided by the present invention can more accurately analyze the security of the industrial control system.

[0006] In a first aspect, an embodiment of the present invention provides an industrial control system security analysis method comprising:

[0007] Collecting communication data packets from a first industrial control system, wherein the operational technology (OT) network includes the first industrial control system and at least one second industrial control system connected to the first industrial control system, and the communication data packets are interactive data transmitted between control devices in the first industrial control system;

[0008] Extracting network identifiable information from the communication data packet, wherein the network identifiable information is used to identify at least one of a communication object, a communication rule, and a communication content;

[0009] determining whether the network identifiable information is located in a pre-created event database;

[0010] If the network identifiable information is in the event database, then performing:

[0011] Determining that the communication data packet is a malicious data packet;

[0012] Obtaining a security policy of the first industrial control system and each of the second industrial control systems in the OT network, wherein the security policy is used to characterize a rule for processing malicious data packets;

[0013] The threat coefficient of the communication data packet to each of the second industrial control systems is determined based on the network identifiable information and each of the security policies, wherein the threat system is used to characterize the threat level of the communication data packet to the corresponding second industrial control system.

[0014] In a first possible implementation manner, in combination with the first aspect, determining whether the network identifiable information is located in a pre-created event database includes:

[0015] Acquire at least one identification parameter included in the network identifiable information, wherein the identification parameter includes at least one of device asset information of a control device that sends and receives the communication data packet, an Internet Protocol (IP) address of the control device that sends and receives the communication data packet, a port and a protocol used to transmit the communication data packet, application information of an application that sends and receives the communication data packet, and an identifier of a protocol used to transmit the communication data packet;

[0016] Determine whether at least one of the identification parameters exists in the event database;

[0017] If at least one of the identification parameters exists in the event database, determining that the network identifiable information is located in the event database;

[0018] If any one of the identification parameters does not exist in the event database, it is determined that the network identifiable information is not located in the event database.

[0019] In a second possible implementation, in combination with the first aspect, respectively obtaining the security policies of the first industrial control system and each of the second industrial control systems includes:

[0020] For each of the second industrial control systems, obtaining the security policy from a firewall between the second industrial control system and the first industrial control system;

[0021] For each of the control devices in the first industrial control system, obtaining the security policy from a firewall of the control device;

[0022] For each of the control devices in the second industrial control system, the security policy is obtained from the firewall of the control device.

[0023] In a third possible implementation manner, in combination with the above-mentioned second possible implementation manner, determining the threat coefficient of the communication data packet to each of the second industrial control systems according to the network identifiable information and each of the security policies includes:

[0024] For one of the control devices located in one of the second industrial control systems, the following steps are performed:

[0025] Determine, according to the network identifiable information and the first security policy, a first probability that the communication data packet passes through a firewall between the second industrial control system where the control device is located and the first industrial control system, wherein the first security policy is a security policy used by the firewall between the second industrial control system where the control device is located and the first industrial control system;

[0026] Determine, based on the network identifiable information and the second security policy, a second probability that the communication data packet poses a threat to the control device after passing through a firewall between the first industrial control system and the second industrial control system where the control device is located, wherein the second security policy is a security policy used by the firewall of the control device;

[0027] Determine a threat coefficient component of the control device according to the first probability, the second probability and the importance weight of the control device, wherein the importance weight is positively correlated with the importance coefficient of the control device in the second industrial control system;

[0028] For each of the second industrial control systems, the threat coefficient of the communication data packet to each of the second industrial control systems is determined according to the threat coefficient components of each control device in the second industrial control system.

[0029] In a fourth possible implementation manner, in combination with the first aspect and any one of the first possible implementation manner, the second possible implementation manner, and the third possible implementation manner of the first aspect, after respectively obtaining the security policies of the first industrial control system and each of the second industrial control systems, further comprising:

[0030] Determine, based on the extracted network identifiable information and each of the security policies, a target control device in the OT network that is at risk of being attacked by the communication data packet;

[0031] Determine the threat factor of the communication data packet to each of the target control devices according to the network identifiable information;

[0032] Sending the threat factor of each target control device to an administrator;

[0033] After receiving a confirmation instruction issued by the administrator according to the threat coefficient of each of the target control devices, an optimization suggestion for optimizing at least one of the acquired security policies is generated according to the network identifiable information.

[0034] In a second aspect, an embodiment of the present invention further provides an industrial control system security analysis device, including:

[0035] a data acquisition module, configured to acquire communication data packets from a first industrial control system, wherein the operational technology (OT) network includes the first industrial control system and at least one second industrial control system connected to the first industrial control system, and the communication data packets are interactive data transmitted between control devices in the first industrial control system;

[0036] an information extraction module, configured to extract network identifiable information from the communication data packets collected by the data collection module, wherein the network identifiable information is used to identify at least one of a communication object, a communication rule, and a communication content;

[0037] a determination module, configured to determine whether the network identifiable information extracted by the information extraction module is located in a pre-created event database;

[0038] a first analysis module, configured to determine that the communication data packet is a malicious data packet when the determination module determines that the network identifiable information is located in the event database;

[0039] a policy acquisition module, configured to respectively acquire the security policies of the first industrial control system and each of the second industrial control systems when the judgment module determines that the network identifiable information is located in the event database, wherein the security policies are used to characterize rules for processing malicious data packets;

[0040] A second analysis module is used to determine the threat coefficient of the communication data packet to each second industrial control system based on the network identifiable information extracted by the information extraction module and the various security policies acquired by the policy acquisition module, wherein the threat system is used to characterize the threat level of the communication data packet to the corresponding second industrial control system.

[0041] In a first possible implementation manner, in combination with the second aspect, the determination module includes:

[0042] a parameter identification unit, configured to obtain at least one identification parameter included in the network identifiable information, wherein the identification parameter includes at least one of device asset information of a control device that sends and receives the communication data packet, an Internet Protocol (IP) address of the control device that sends and receives the communication data packet, a port and a protocol used to transmit the communication data packet, application information of an application that sends and receives the communication data packet, and an identifier of a protocol used to transmit the communication data packet;

[0043] a parameter search unit, configured to determine whether at least one of the identification parameters acquired by the parameter identification unit exists in the event database;

[0044] a first judgment unit, configured to determine that the network identifiable information is located in the event database if the parameter search unit determines that at least one of the identification parameters exists in the event database;

[0045] A second judgment unit is used to determine that the network identifiable information is not located in the event database if the parameter search unit determines that any of the identification parameters does not exist in the event database.

[0046] In a second possible implementation, in combination with the second aspect, the policy acquisition module includes:

[0047] a first policy acquisition unit, configured to acquire the security policy from a firewall between the second industrial control system and the first industrial control system for each of the second industrial control systems;

[0048] a second policy acquisition unit, configured to acquire the security policy from a firewall of each control device in the first industrial control system;

[0049] A third policy acquisition unit is used to acquire the security policy from the firewall of each control device in the second industrial control system.

[0050] In a third possible implementation manner, in combination with the foregoing second possible implementation manner, the second analysis module includes:

[0051] a first computing unit, for determining, for one of the control devices located in one of the second industrial control systems, a first probability that the communication data packet passes through a firewall between the second industrial control system where the control device is located and the first industrial control system according to the network identifiable information and a first security policy, wherein the first security policy is a security policy used by the firewall between the second industrial control system where the control device is located and the first industrial control system;

[0052] a second computing unit, for determining, for one of the control devices located in the second industrial control system, a second probability that the communication data packet poses a threat to the control device after passing through a firewall between the first industrial control system and the second industrial control system where the control device is located, according to the network identifiable information and a second security policy, wherein the second security policy is a security policy used by the firewall of the control device;

[0053] a third calculation unit, configured to determine, for one of the control devices located in one of the second industrial control systems, a threat coefficient component of the control device according to an importance weight of the control device, the first probability determined by the first calculation unit, and the second probability determined by the second calculation unit, wherein the importance weight is positively correlated with the importance coefficient of the control device in the second industrial control system;

[0054] A fourth calculation unit is used to determine, for each of the second industrial control systems, the threat coefficient of the communication data packet to each of the second industrial control systems based on the threat coefficient components of each control device in the second industrial control system determined by the third calculation unit.

[0055] In a fourth possible implementation, in combination with the second aspect and any one of the first possible implementation, the second possible implementation, and the third possible implementation of the second aspect, the industrial control system security analysis device further includes:

[0056] a device screening module, used to determine a target control device in the OT network that is at risk of being attacked by the communication data packet based on the network identifiable information acquired by the information extraction module and each of the security policies acquired by the policy acquisition module;

[0057] a coefficient calculation module, configured to determine, based on the network identifiable information acquired by the information extraction module, a threat coefficient of the communication data packet to each of the target control devices determined by the device screening module;

[0058] an information sending module, configured to send the threat coefficient of each target control device determined by the coefficient calculation module to an administrator;

[0059] A policy optimization module is used to generate optimization suggestions for optimizing at least one of the security policies obtained by the policy acquisition module based on the network identifiable information after receiving a confirmation instruction issued by the administrator based on the threat coefficient of each target control device sent by the information sending module.

[0060] In a third aspect, an embodiment of the present invention further provides another industrial control system security analysis device, including: at least one memory and at least one processor;

[0061] The at least one memory is used to store a machine-readable program;

[0062] The at least one processor is used to call the machine-readable program to execute the method provided by the above-mentioned first aspect and any possible implementation manner of the first aspect.

[0063] In a fourth aspect, an embodiment of the present invention further provides a computer-readable medium having computer instructions stored thereon, and when the computer instructions are executed by a processor, the processor executes the method provided by the first aspect and any possible implementation of the first aspect.

[0064] It can be seen from the above technical solution that the OT network includes at least two industrial control systems. After the communication data packet is collected from the first industrial control system in the OT network, the network identifiable information is extracted from the collected communication data packet, and then the collected communication data packet is determined to be a malicious data packet based on the extracted network identifiable information and the pre-created event database. If it is determined that the collected communication data packet is a malicious data packet that may maliciously attack the first industrial control system, the security policy of each industrial control system in the OT network is further obtained, and the threat coefficient of the malicious data packet to each second industrial control system in the OT network except the first industrial control system is determined based on the obtained security policies and the extracted network identifiable information. It can be seen that for any industrial control system in the OT network, not only will the communication data packet transmitted between the control devices in the industrial control system be analyzed to be a malicious data packet, but also the threat of malicious data packets transmitted in other industrial control systems to the industrial control system will be analyzed based on the security policies of each industrial control system in the OT network. Therefore, the security problems existing in the industrial control system can be analyzed more comprehensively, so that the security of the industrial control system can be analyzed more accurately. BRIEF DESCRIPTION OF THE DRAWINGS

[0065] Figure 1 is a flow chart of a method for analyzing the security of an industrial control system provided by an embodiment of the present invention;

[0066] Figure 2 It is a flow chart of a method for determining a threat coefficient of an industrial control system provided by an embodiment of the present invention;

[0067] Figure 3 It is a flow chart of a method for generating security policy optimization suggestions provided by an embodiment of the present invention;

[0068] Figure 4 is a schematic diagram of an industrial control system security analysis device provided by an embodiment of the present invention;

[0069] Figure 5 is a schematic diagram of another industrial control system security analysis device provided by an embodiment of the present invention;

[0070] Figure 6 is a schematic diagram of another industrial control system security analysis device provided by an embodiment of the present invention;

[0071] Figure 7 is a schematic diagram of another industrial control system security analysis device provided by an embodiment of the present invention;

[0072] Figure 8 is a schematic diagram of an industrial control system security analysis device including a strategy optimization module provided by an embodiment of the present invention;

[0073] Fig. 9 It is a schematic diagram of an industrial control system security analysis device including a memory and a processor provided by an embodiment of the present invention.

[0074] List of reference numerals:

[0075] 101: Collecting communication data packets from the first industrial control system

[0076] 102: Extract network-identifiable information from communication packets

[0077] 103: Determine whether network identifiable information is in a pre-created event database

[0078] 104: If the network identifiable information is in the event database, the communication packet is determined to be a malicious packet

[0079] 105: Obtain the security policy of the first industrial control system and each second industrial control system in the OT network

[0080] 106: Determine the threat factor of communication data packets to the second industrial control system based on network identifiable information and security policies

[0081] 201: Determine a first probability based on the network identifiable information and the first security policy

[0082] 202: Determine a second probability according to the network identifiable information and the second security policy

[0083] 203: Determine the threat coefficient component of the control device according to the first probability, the second probability and the importance weight of the control device

[0084] 204: Determine the threat coefficient based on the threat coefficient components of each control device in the second industrial control system

[0085] 301: Based on the network identifiable information and various security policies, determine the target control device that is at risk of being attacked by communication data packets

[0086] 302: Determine the threat factor of the communication data packet to each target control device based on the network identifiable information

[0087] 303: Send the threat factor of each target control device to the administrator

[0088] 304: After receiving the confirmation instruction, generate optimization suggestions based on network identifiable information

[0089] 41: Data collection module 42: Information extraction module 43: Judgment module

[0090] 44: First analysis module 45: Strategy acquisition module 46: Second analysis module

[0091] 47: Equipment screening module 48: Coefficient calculation module 49: Information sending module

[0092] 410: Strategy optimization module 411: Memory 412: Processor

[0093] 431: parameter identification unit 432: parameter search unit 433: first judgment unit

[0094] 434: second judgment unit 451: first strategy acquisition unit 452: second strategy acquisition unit

[0095] 453: third strategy acquisition unit 461: first calculation unit 462: second calculation unit

[0096] 463: third computing unit 464: fourth computing unit DETAILED DESCRIPTION

[0097] As mentioned above, in an OT network composed of multiple industrial control systems, communication data packets transmitted between control devices in the industrial control system can be collected, and then the security of the industrial control system can be analyzed based on the collected communication data packets, where the communication data packets can be control instructions, device status information, etc. At present, when analyzing the security of industrial control systems, communication data packets transmitted between control devices in each industrial control system are collected separately, and then the security of the corresponding industrial control system is analyzed based on the collected communication data packets. However, industrial control systems in the same OT network will affect each other. When an industrial control system is attacked maliciously, it may affect the security of another industrial control system in the same OT network. Therefore, when the security of each industrial control system is analyzed independently based on the communication data packets between the control devices, it cannot fully reflect the malicious attacks that the industrial control system may be subjected to, resulting in the inability to accurately analyze the security of the industrial control system.

[0098] In an embodiment of the present invention, communication data packets are collected from an industrial control system. When it is determined that the collected communication data packets are malicious data packets, the security policies of each industrial control system in the OT network where the industrial control system is located are obtained, and then the threat coefficient of the malicious data packet to other industrial control systems in the OT network can be analyzed based on the obtained security policies. It can be seen that when analyzing the security of the industrial control system, not only is it detected whether the communication data packets between the control devices in the current industrial control system are malicious data packets, but also the threat of malicious data collected in other industrial control systems to the current industrial control system is determined based on the security policies of each industrial control system in the same OT network, so that the security of the industrial control system can be analyzed more comprehensively to ensure the accuracy of the security analysis of the industrial control system.

[0099] The industrial control system security analysis method and device provided by the embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0100] like Figure 1 As shown, an embodiment of the present invention provides an industrial control system security analysis method, which may include the following steps:

[0101] Step 101: Collect communication data packets from a first industrial control system, wherein the OT network includes the first industrial control system and at least one second industrial control system connected to the first industrial control system, and the communication data packets are interactive data transmitted between control devices in the first industrial control system;

[0102] Step 102: extracting network identifiable information from the communication data packet, wherein the network identifiable information is used to identify at least one of a communication object, a communication rule, and a communication content;

[0103] Step 103: Determine whether the network identifiable information is located in a pre-created event database;

[0104] Step 104: If the network identifiable information is located in the event database, determining that the communication data packet is a malicious data packet;

[0105] Step 105: Obtain security policies of the first industrial control system and each second industrial control system in the OT network, wherein the security policies are used to characterize rules for processing malicious data packets;

[0106] Step 106: Determine the threat coefficient of the communication data packet to each second industrial control system based on the network identifiable information and each security policy, wherein the threat system is used to characterize the threat degree of the communication data packet to the corresponding second industrial control system.

[0107] In an embodiment of the present invention, the OT network includes at least two industrial control systems. After a communication data packet is collected from a first industrial control system in the OT network, network identifiable information is extracted from the collected communication data packet, and then it is determined whether the collected communication data packet is a malicious data packet based on the extracted network identifiable information and a pre-created event database. If it is determined that the collected communication data packet is a malicious data packet that may maliciously attack the first industrial control system, the security policies of each industrial control system in the OT network are further obtained, and the threat coefficient of the malicious data packet to each second industrial control system in the OT network other than the first industrial control system is determined based on the obtained security policies and the extracted network identifiable information. It can be seen that for any industrial control system in the OT network, not only will the communication data packet transmitted between the control devices in the industrial control system be analyzed as a malicious data packet, but also the threat of malicious data packets transmitted in other industrial control systems to the industrial control system will be analyzed based on the security policies of each industrial control system in the OT network, so that the security problems existing in the industrial control system can be analyzed more comprehensively, so that the security of the industrial control system can be analyzed more accurately.

[0108] In an embodiment of the present invention, when collecting communication data packets from a first industrial control system, the traffic of the first industrial control system can be intercepted, thereby obtaining communication data packets transmitted between various control devices in the first industrial control system. Specifically, a probe (data acquisition sensor) can be set in the first industrial control system, and the probe can be used to intercept traffic from an access switch and a system bus in the first industrial control system, wherein the system bus is used to connect a programmable logic controller (PLC) with an engineer station and an operator station, and the access switch is used to connect an operation center with an engineer station and an operator station.

[0109] Optionally, in Figure 1 On the basis of the industrial control system security analysis method shown, the collected communication data packets are interactive data transmitted between control devices in the industrial control system, such as control instructions, status feedback information, etc. In order to facilitate the security analysis of the industrial control system based on the communication data packets, it is necessary to extract network identifiable information from the communication data packets. The network identifiable information is used to identify the communication object, communication rules, and communication content of the corresponding communication data packet. Then, it is possible to judge whether the communication data packet is a malicious data packet from multiple aspects such as the communication object, communication rules, and communication content, and determine the threat of the communication data packet to other industrial control systems based on determining that the communication data packet is a malicious data packet.

[0110] The network identifiable parameters may include any one or more of the following identification parameters: asset information, IP address, communication port, communication protocol, application information, and special identifiers in the protocol. Among them, the asset information is the device asset information of the control device that sends and receives the corresponding communication data packet, such as the device name, device type, device supplier, device operating system / firmware version number, etc., the IP address is the IP address of the control device that receives the corresponding communication data packet, the communication port is the port used when sending and receiving the corresponding communication data packet, the communication protocol is the protocol used when sending and receiving the corresponding communication data packet, and the application information is the application information of the application that sends and receives the corresponding communication data packet, such as the application name and version, etc.

[0111] In an embodiment of the present invention, after extracting network identifiable information from a communication data packet, it is possible to detect whether at least one of the identification parameters included in the network identifiable information exists in a pre-created event database. If at least one identification parameter included in the network identifiable information exists in the event database, the collected communication data packet is determined to be a malicious data packet, and if any identification parameter included in the network identifiable information does not exist in the event database, the collected communication data packet is determined to be a legitimate data packet. By storing the identification parameters of the malicious data packet in the event database, and then matching the identification parameters included in the network identifiable information with the identification parameters in the event database, it is possible to accurately determine whether the communication data packet corresponding to the network identifiable information is a malicious data packet, thereby further ensuring the accuracy of the security analysis of the industrial control system.

[0112] Optionally, in Figure 1 Based on the security analysis method of industrial control systems shown in the figure, after determining that a communication data packet is a malicious data packet, the security policies of each industrial control system in the OT network can be obtained, and then the threats of the communication data packet to each industrial control system can be analyzed according to the obtained security policies. Specifically, the security policies of each industrial control system in the OT network can be obtained in the following ways:

[0113] For each second industrial control system in the OT network, obtain a security policy from a firewall between the second industrial control system and the first industrial control system;

[0114] For each control device included in the first industrial control system in the OT network, obtain a security policy from a firewall of the control device;

[0115] For each control device included in the second industrial control system in the OT network, a security policy is obtained from a firewall of the control device.

[0116] In an embodiment of the present invention, after determining that the communication data packet collected from the first industrial control system is a malicious data packet, the communication data packet may be transmitted from one control device in the first industrial control system to another control device, and may also be transmitted from the first industrial control system to the second industrial control system, and may also be transmitted from one control device in the second industrial control system to another control device, and the firewall of the control device is used to filter the malicious data packets received by the control device, and the firewall between the industrial control systems is used to filter the malicious data packets transmitted between the industrial control systems, and the firewall filters the malicious data packets according to the corresponding security policy. Therefore, by obtaining the security policy from the firewall of each control device and the firewall between the industrial control systems, the threat coefficient caused by the malicious data packet being transmitted to the corresponding industrial control system through different paths can be analyzed, and the control devices that may be attacked by the malicious data packet and the specific degree of impact can also be analyzed, so that the security of the industrial control system can be analyzed more comprehensively.

[0117] In the embodiment of the present invention, the security policy is the basis for the firewall to filter and process malicious data packets. The security policy can specifically allow / deny source addresses, allow / deny target addresses, allow / deny services / protocols, and allow / deny security areas, etc.

[0118] Optionally, after obtaining security policies from the firewalls of each control device in the OT network and the firewalls between each industrial control system, the threat coefficient of the communication data packet to each second industrial control system can be determined based on the network identifiable information extracted from the communication data packet and the obtained security policies. Figure 2 As shown, the threat factor of the communication data packet to a second industrial control system can be determined in the following manner:

[0119] Step 201: for each control device in the second industrial control system, determine, based on the network identifiable information and the first security policy, a first probability that a communication data packet passes through a firewall between the second industrial control system where the control device is located and the first industrial control system, wherein the first security policy is a security policy used by the firewall between the second industrial control system where the control device is located and the first industrial control system;

[0120] Step 202: for each control device in the second industrial control system, determining, based on the network identifiable information and the second security policy, a second probability that a communication data packet poses a threat to the control device after passing through a firewall between the first industrial control system and the second industrial control system where the control device is located, wherein the second security policy is a security policy used by the firewall of the control device;

[0121] Step 203: for each control device in the second industrial control system, determine the threat coefficient component of the control device according to the first probability, the second probability and the importance weight of the control device, wherein the importance weight is positively correlated with the importance coefficient of the control device in the second industrial control system;

[0122] Step 204: Determine the threat coefficient of the communication data packet to each second industrial control system according to the threat coefficient components of each control device in the second industrial control system.

[0123] In an embodiment of the present invention, the first probability is used to characterize the probability of a communication data packet passing through a firewall between a first industrial control system and a second industrial control system, and the second probability is used to characterize the probability of a communication data packet posing a threat to a corresponding control device in the second industrial control system after passing through the first industrial control system and the second industrial control system. The first security policy is a security policy obtained from the firewall between the first industrial control system and the second industrial control system, and the second security policy is a security policy for a corresponding control device in the second industrial control system. The first probability can be determined based on the matching relationship between the network identifiable information and the first security policy, and the second probability can be determined based on the matching relationship between the network identifiable information and the second security policy.

[0124] In the embodiment of the present invention, since the same industrial control system usually includes multiple control devices, and different control devices are responsible for performing different tasks in the industrial control system, different control devices have different importance levels for the industrial control system. According to the importance of the control device to the industrial control system, corresponding importance weights can be preset for different control devices, so that the importance weight of the control device corresponds to the importance of the control device in the industrial control system. For a control device located in a second industrial control system, the threat coefficient component of the control device can be determined according to the first probability, the second probability and the importance weight corresponding to the control device, and then the threat coefficient components of each control device in the same second industrial control system are summed up to obtain the threat coefficient of the communication data packet to the second industrial control system.

[0125] In an embodiment of the present invention, based on the security policy obtained from the firewall between the industrial control systems and the security policy obtained from the firewall of the control device, the probability of a malicious data packet passing through the firewall to reach each control device can be determined, the threat coefficient component of the control device can be determined based on the probability of the malicious data packet reaching the control device and the importance of the control device to the industrial control system, and the threat coefficient of the communication data packet to the industrial control system can be determined based on the threat coefficient component of each control device in the same industrial control system. When determining the threat coefficient of the communication data packet to the industrial control system, the probability of each control device in the industrial control system being affected by the communication data packet and the importance of each control device to the industrial control system are combined, so that the determined threat coefficient is more accurate, thereby further improving the accuracy of security analysis of the industrial control system.

[0126] Optionally, based on the industrial control system security analysis methods provided in the above embodiments, after obtaining the security policies of the first industrial control system and each second industrial control system, all control devices that may be attacked by communication data packets can be determined according to the obtained security policies, and optimization suggestions for optimizing the security policies can be generated according to all control devices that may be attacked by communication data packets. Figure 3 As shown, the method for optimizing the security policy may include the following steps:

[0127] Step 301: Determine the target control device in the OT network that is at risk of being attacked by the communication data packet based on the extracted network identifiable information and various security policies;

[0128] Step 302: Determine the threat factor of the communication data packet to each target control device according to the network identifiable information;

[0129] Step 303: Send the threat coefficient of each target control device to the administrator;

[0130] Step 304: after receiving a confirmation instruction issued by the administrator according to the threat coefficient of each target control device, an optimization suggestion for optimizing at least one acquired security policy is generated according to the network identifiable information.

[0131] In the embodiment of the present invention, for the control device in the first industrial control system, the probability of the control device being attacked by the communication data packet is determined according to the degree of matching between the security policy obtained from the firewall of the control device and the network identifiable information, and for the control device in the second industrial control system, the probability of the control device being attacked by the communication data packet is determined according to the degree of matching between the first security policy and the second security policy corresponding to the control device and the network identifiable information. An attack probability threshold is set in advance, and when the total probability of a control device being attacked by the communication data packet is greater than the attack probability threshold, the control device is determined as a target control device.

[0132] In an embodiment of the present invention, for each target control device, if the target control device is located in a first industrial control system, the threat coefficient of the communication data packet to the target control device is equal to the probability that the target control device is attacked by the communication data packet; if the target control device is located in a second industrial control system, the threat coefficient of the communication data packet to the target control device is equal to the product of the first probability and the second probability corresponding to the target control device.

[0133] In an embodiment of the present invention, after determining the threat coefficient of each target control device, each target control device and the threat coefficient of each target control device are sent to an administrator, who confirms whether a communication data packet is an illegal data packet based on the threat coefficient of each target control device. When a user issues a confirmation instruction indicating that the communication data packet is an illegal data packet, an optimization suggestion for optimizing at least one acquired security policy is generated based on network identifiable information.

[0134] In an embodiment of the present invention, after determining the target control devices that may be attacked by communication data packets, the identification information and threat coefficient of each target control device are sent to the administrator, who confirms whether the communication data packet is indeed an illegal data packet based on the identification information and threat coefficient of each target control device. If the administrator determines that the communication data packet is indeed an illegal data packet, optimization suggestions for optimizing the security policy are automatically generated based on the network identifiable information, and the generated optimization suggestions are sent to the policy optimization software or the administrator to optimize the security policy, so that the optimized security policy can effectively handle the communication data packets determined to be illegal data packets, thereby improving the security of industrial control systems and OT networks.

[0135] In an embodiment of the present invention, after the administrator confirms that the communication data packet is an illegal data packet, the relevant information of the communication data packet and the identification information of each target control device are sent to the alarm module. The alarm module issues an alarm message so that the network maintenance personnel can process the communication data packet in time to avoid the communication data packet from causing more serious attacks on the OT network.

[0136] Optionally, after extracting the network identifiable information from the communication data packet, it is detected whether the extracted network identifiable information is included in the pre-created untrusted asset database. If the extracted network identifiable information is included in the untrusted asset database, the service or application traffic statistics corresponding to the communication data packet are determined based on the information stored in the untrusted asset database, and the determined service or application traffic statistics are sent to the administrator so that the administrator can determine whether the communication data packet is an illegal data packet. In addition, if the administrator confirms that the communication data packet is an illegal data packet based on the identification of each target control device and the threat coefficient of each target control device, the network identifiable information extracted from the communication data packet is stored in the untrusted asset database so as to perform service or application traffic statistics for malicious data packets detected subsequently.

[0137] Optionally, after determining that the communication data packet is a malicious data packet, the severity of the event corresponding to the communication data packet is detected. If the event corresponding to the communication data packet is serious, check each security policy to determine whether the firewall allows the communication data packet to pass through, so as to prevent the communication data packet from causing serious damage to the industrial control system and OT network.

[0138] like Figure 4 As shown, one embodiment of the present invention provides an industrial control system security analysis device, including:

[0139] a data acquisition module 41, configured to acquire communication data packets from a first industrial control system, wherein the operational technology OT network includes the first industrial control system and at least one second industrial control system connected to the first industrial control system, and the communication data packets are interactive data transmitted between control devices in the first industrial control system;

[0140] an information extraction module 42, configured to extract network identifiable information from the communication data packets collected by the data collection module 41, wherein the network identifiable information is used to identify at least one of a communication object, a communication rule, and a communication content;

[0141] a determination module 43, used to determine whether the network identifiable information extracted by the information extraction module 42 is located in a pre-created event database;

[0142] a first analysis module 44, configured to determine that the communication data packet is a malicious data packet when the determination module 43 determines that the network identifiable information is located in the event database;

[0143] a policy acquisition module 45, configured to respectively acquire the security policy of the first industrial control system and each of the second industrial control systems when the determination module 43 determines that the network identifiable information is located in the event database, wherein the security policy is used to characterize the rules for processing malicious data packets;

[0144] A second analysis module 46 is used to determine the threat coefficient of the communication data packet to each second industrial control system based on the network identifiable information extracted by the information extraction module 42 and the various security policies obtained by the policy acquisition module 45, wherein the threat system is used to characterize the threat level of the communication data packet to the corresponding second industrial control system.

[0145] In an embodiment of the present invention, the data acquisition module 41 can be used to execute step 101 in the above method embodiment, the information extraction module 42 can be used to execute step 102 in the above method embodiment, the judgment module 43 can be used to execute step 103 in the above method embodiment, the first analysis module 44 can be used to execute step 104 in the above method embodiment, the strategy acquisition module 45 can be used to execute step 105 in the above method embodiment, and the second analysis module 46 can be used to execute step 106 in the above method embodiment.

[0146] Optionally, in Figure 4 Based on the industrial control system security analysis device shown, Figure 5 As shown, the judging module 43 includes:

[0147] a parameter identification unit 431, configured to obtain at least one identification parameter included in the network identifiable information, wherein the identification parameter includes at least one of device asset information of a control device for sending and receiving communication data packets, an Internet Protocol IP address of the control device for sending and receiving communication data packets, a port and a protocol used for transmitting communication data packets, application information of an application for sending and receiving communication data packets, and an identifier of a protocol used for transmitting communication data packets;

[0148] a parameter search unit 432, used to determine whether there is at least one identification parameter obtained by the parameter identification unit 431 in the event database;

[0149] a first determination unit 433, configured to determine that the network identifiable information is located in the event database if the parameter search unit 432 determines that at least one identification parameter exists in the event database;

[0150] A second determination unit 434 is configured to determine that the network identifiable information is not located in the event database if the parameter search unit 432 determines that any identification parameter does not exist in the event database.

[0151] Optionally, in Figure 4 Based on the industrial control system security analysis device shown, Figure 6 As shown, the strategy acquisition module 45 includes:

[0152] a first policy acquisition unit 451, configured to acquire, for each second industrial control system, a security policy from a firewall between the second industrial control system and the first industrial control system;

[0153] a second policy acquisition unit 452, configured to acquire a security policy from a firewall of each control device in the first industrial control system;

[0154] A third policy acquisition unit 453 is used to acquire a security policy from a firewall of each control device in the second industrial control system.

[0155] Optionally, in Figure 6 Based on the industrial control system security analysis device shown, Figure 7 As shown, the second analysis module 46 includes:

[0156] a first calculation unit 461, for determining, for a control device located in a second industrial control system, a first probability that a communication data packet passes through a firewall between the second industrial control system where the control device is located and the first industrial control system according to the network identifiable information and the first security policy, wherein the first security policy is a security policy used by the firewall between the second industrial control system where the control device is located and the first industrial control system;

[0157] a second calculation unit 462, for determining, for a control device located in a second industrial control system, a second probability that a communication data packet poses a threat to the control device after passing through a firewall between the first industrial control system and the second industrial control system where the control device is located, based on the network identifiable information and the second security policy, wherein the second security policy is a security policy used by the firewall of the control device;

[0158] a third calculation unit 463, for determining, for a control device located in a second industrial control system, a threat coefficient component of the control device according to an importance weight of the control device, a first probability determined by the first calculation unit 461, and a second probability determined by the second calculation unit 462, wherein the importance weight is positively correlated with the importance coefficient of the control device in the second industrial control system;

[0159] A fourth calculation unit 464 is used to determine the threat coefficient of the communication data packet to each second industrial control system according to the threat coefficient components of each control device in the second industrial control system determined by the third calculation unit 463.

[0160] In an embodiment of the present invention, the first computing unit 461 may be used to execute step 201 in the above method embodiment, the second computing unit 462 may be used to execute step 202 in the above method embodiment, the third computing unit 463 may be used to execute step 203 in the above method embodiment, and the fourth computing unit 464 may be used to execute step 204 in the above method embodiment.

[0161] Optionally, in Figures 4 to 7 Based on the industrial control system security analysis device shown in any of the attached drawings, Figure 8 As shown, the industrial control system security analysis device further includes:

[0162] A device screening module 47, for determining target control devices in the OT network that are at risk of being attacked by communication data packets based on the network identifiable information obtained by the information extraction module 42 and the various security policies obtained by the policy acquisition module 45;

[0163] A coefficient calculation module 48, for determining the threat coefficient of the communication data packet to each target control device determined by the device screening module 47 according to the network identifiable information obtained by the information extraction module 42;

[0164] An information sending module 49, used to send the threat coefficient of each target control device determined by the coefficient calculation module 48 to the administrator;

[0165] A policy optimization module 410 is used to generate optimization suggestions for optimizing at least one security policy obtained by the policy acquisition module 45 based on network identifiable information after receiving a confirmation instruction issued by the administrator based on the threat coefficient of each target control device sent by the information sending module 49.

[0166] In an embodiment of the present invention, the device screening module 47 can be used to execute step 301 in the above method embodiment, the coefficient calculation module 48 can be used to execute step 302 in the above method embodiment, the information sending module 49 can be used to execute the steps in the above method embodiment, and the strategy optimization module 410 can be used to execute step 410 in the above method embodiment.

[0167] like Fig. 9 As shown, an embodiment of the present invention provides an industrial control system security analysis device, including: at least one memory 411 and at least one processor 412;

[0168] The at least one memory 411 is used to store a machine-readable program;

[0169] The at least one processor 412 is used to call the machine-readable program to execute the industrial control system security analysis method provided by the above-mentioned embodiments.

[0170] The present invention also provides a computer-readable medium storing instructions for causing a computer to execute the industrial control system security analysis method as described herein. Specifically, a system or device equipped with a storage medium can be provided, on which a software program code for implementing the functions of any of the above embodiments is stored, and a computer (or CPU or MPU) of the system or device reads and executes the program code stored in the storage medium.

[0171] In this case, the program code itself read from the storage medium can realize the function of any one of the above-mentioned embodiments, and thus the program code and the storage medium storing the program code constitute a part of the present invention.

[0172] The storage medium embodiments for providing the program code include a floppy disk, a hard disk, a magneto-optical disk, an optical disk (such as CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RAM, DVD-RW, DVD+RW), a magnetic tape, a non-volatile memory card, and a ROM. Alternatively, the program code can be downloaded from a server computer by a communication network.

[0173] In addition, it should be clear that the functions of any of the above embodiments can be implemented not only by executing the program code read by the computer, but also by enabling an operating system operating on the computer to complete part or all of the actual operations based on instructions from the program code.

[0174] In addition, it can be understood that the program code read from the storage medium is written to a memory provided in an expansion board inserted into the computer or written to a memory provided in an expansion unit connected to the computer, and then based on the instructions of the program code, a CPU installed on the expansion board or the expansion unit is enabled to perform part or all of the actual operations, thereby realizing the functions of any of the above-mentioned embodiments.

[0175] It should be noted that not all steps and modules in the above-mentioned processes and system structure diagrams are necessary, and some steps or modules can be ignored according to actual needs. The execution order of each step is not fixed and can be adjusted as needed. The system structure described in the above-mentioned embodiments can be a physical structure or a logical structure, that is, some modules may be implemented by the same physical entity, or some modules may be implemented by multiple physical entities, or some components in multiple independent devices may be implemented together.

[0176] In the above embodiments, the hardware unit can be realized by mechanical means or electrical means. For example, a hardware unit can include permanent dedicated circuits or logic (such as special processors, FPGA or ASIC) to complete the corresponding operation. The hardware unit can also include programmable logic or circuits (such as general-purpose processors or other programmable processors), which can be temporarily set by software to complete the corresponding operation. Concrete implementation (mechanical means or dedicated permanent circuits or temporarily set circuits) can be determined based on cost and time considerations.

[0177] The present invention is shown and described in detail above through the accompanying drawings and preferred embodiments. However, the present invention is not limited to these disclosed embodiments. Based on the above multiple embodiments, those skilled in the art can know that the code review methods in the above different embodiments can be combined to obtain more embodiments of the present invention, and these embodiments are also within the protection scope of the present invention.

Claims

1. Industrial control system security analysis methods, including: Collecting communication data packets from a first industrial control system, wherein the operational technology (OT) network includes the first industrial control system and at least one second industrial control system connected to the first industrial control system, and the communication data packets are interactive data transmitted between control devices in the first industrial control system; Extracting network identifiable information from the communication data packet, wherein the network identifiable information is used to identify at least one of a communication object, a communication rule, and a communication content; determining whether the network identifiable information is located in a pre-created event database; If the network identifiable information is in the event database, then performing: Determining that the communication data packet is a malicious data packet; Obtaining a security policy of the first industrial control system and each of the second industrial control systems in the OT network, wherein the security policy is used to characterize a rule for processing malicious data packets; Determining, according to the network identifiable information and each of the security policies, a threat coefficient of the communication data packet to each of the second industrial control systems, wherein the threat coefficient is used to characterize the degree of threat of the communication data packet to the corresponding second industrial control system; Determining the threat coefficient of the communication data packet to each of the second industrial control systems according to the network identifiable information and each of the security policies includes: For one of the control devices located in one of the second industrial control systems, the following steps are performed: Determine, according to the network identifiable information and the first security policy, a first probability that the communication data packet passes through a firewall between the second industrial control system where the control device is located and the first industrial control system, wherein the first security policy is a security policy used by the firewall between the second industrial control system where the control device is located and the first industrial control system; Determine, based on the network identifiable information and the second security policy, a second probability that the communication data packet poses a threat to the control device after passing through a firewall between the first industrial control system and the second industrial control system where the control device is located, wherein the second security policy is a security policy used by the firewall of the control device; Determine a threat coefficient component of the control device according to the first probability, the second probability and the importance weight of the control device, wherein the importance weight is positively correlated with the importance coefficient of the control device in the second industrial control system; For each of the second industrial control systems, the threat coefficient of the communication data packet to each of the second industrial control systems is determined according to the threat coefficient components of each control device in the second industrial control system.

2. The method according to claim 1, wherein: The determining whether the network identifiable information is located in a pre-created event database includes: Acquire at least one identification parameter included in the network identifiable information, wherein the identification parameter includes at least one of device asset information of a control device that sends and receives the communication data packet, an Internet Protocol (IP) address of the control device that sends and receives the communication data packet, a port and a protocol used to transmit the communication data packet, application information of an application that sends and receives the communication data packet, and an identifier of a protocol used to transmit the communication data packet; Determine whether at least one of the identification parameters exists in the event database; If at least one of the identification parameters exists in the event database, determining that the network identifiable information is located in the event database; If any one of the identification parameters does not exist in the event database, it is determined that the network identifiable information is not located in the event database.

3. The method according to claim 1, wherein: The obtaining of the security policies of the first industrial control system and each of the second industrial control systems respectively includes: For each of the second industrial control systems, obtaining the security policy from a firewall between the second industrial control system and the first industrial control system; For each of the control devices in the first industrial control system, obtaining the security policy from a firewall of the control device; For each of the control devices in the second industrial control system, the security policy is obtained from the firewall of the control device.

4. The method according to any one of claims 1 to 3, wherein: After respectively acquiring the security policies of the first industrial control system and each of the second industrial control systems, the method further includes: Determine, based on the extracted network identifiable information and each of the security policies, a target control device in the OT network that is at risk of being attacked by the communication data packet; Determine the threat factor of the communication data packet to each of the target control devices according to the network identifiable information; Sending the threat factor of each target control device to an administrator; After receiving a confirmation instruction issued by the administrator according to the threat coefficient of each of the target control devices, an optimization suggestion for optimizing at least one of the acquired security policies is generated according to the network identifiable information.

5. Industrial control system security analysis device, including: a data acquisition module (41) for collecting communication data packets from a first industrial control system, wherein the operational technology (OT) network includes the first industrial control system and at least one second industrial control system connected to the first industrial control system, and the communication data packets are interactive data transmitted between control devices in the first industrial control system; an information extraction module (42) for extracting network identifiable information from the communication data packet collected by the data collection module (41), wherein the network identifiable information is used to identify at least one of a communication object, a communication rule and a communication content; a determination module (43) for determining whether the network identifiable information extracted by the information extraction module (42) is located in a pre-created event database; a first analysis module (44), configured to determine that the communication data packet is a malicious data packet when the judgment module (43) determines that the network identifiable information is located in the event database; a policy acquisition module (45), configured to respectively acquire the security policies of the first industrial control system and each of the second industrial control systems when the judgment module (43) determines that the network identifiable information is located in the event database, wherein the security policies are used to characterize rules for processing malicious data packets; a second analysis module (46) for determining a threat coefficient of the communication data packet to each of the second industrial control systems based on the network identifiable information extracted by the information extraction module (42) and each of the security policies acquired by the policy acquisition module (45), wherein the threat coefficient is used to characterize the threat degree of the communication data packet to the corresponding second industrial control system; The second analysis module (46) comprises: a first computing unit (461), for determining, for a control device located in a second industrial control system, a first probability that the communication data packet passes through a firewall between the second industrial control system where the control device is located and the first industrial control system according to the network identifiable information and a first security policy, wherein the first security policy is a security policy used by the firewall between the second industrial control system where the control device is located and the first industrial control system; a second computing unit (462), for determining, for one of the control devices located in the second industrial control system, a second probability that the communication data packet poses a threat to the control device after passing through a firewall between the first industrial control system and the second industrial control system where the control device is located, based on the network identifiable information and a second security policy, wherein the second security policy is a security policy used by the firewall of the control device; a third calculation unit (463), for determining, for one of the control devices located in one of the second industrial control systems, a threat coefficient component of the control device according to an importance weight of the control device, the first probability determined by the first calculation unit (461), and the second probability determined by the second calculation unit (462), wherein the importance weight is positively correlated with the importance coefficient of the control device in the second industrial control system; A fourth calculation unit (464) is used to determine, for each of the second industrial control systems, the threat coefficient of the communication data packet to each of the second industrial control systems based on the threat coefficient components of each control device in the second industrial control system determined by the third calculation unit (463).

6. The device according to claim 5, wherein: The judgment module (43) comprises: a parameter identification unit (431), used to obtain at least one identification parameter included in the network identifiable information, wherein the identification parameter includes at least one of device asset information of a control device for sending and receiving the communication data packet, an Internet Protocol (IP) address of the control device for sending and receiving the communication data packet, a port and a protocol used for transmitting the communication data packet, application information of an application for sending and receiving the communication data packet, and an identifier of a protocol used for transmitting the communication data packet; a parameter search unit (432), used for determining whether at least one of the identification parameters acquired by the parameter identification unit (431) exists in the event database; a first judgment unit (433), configured to determine, when the parameter search unit (432) determines that at least one of the identification parameters exists in the event database, that the network identifiable information is located in the event database; A second judgment unit (434) is used to determine that if the parameter search unit (432) determines that any of the identification parameters does not exist in the event database, then determine that the network identifiable information is not located in the event database.

7. The device according to claim 5, wherein: The strategy acquisition module (45) comprises: a first policy acquisition unit (451), configured to acquire the security policy from a firewall between the second industrial control system and the first industrial control system for each second industrial control system; a second policy acquisition unit (452), configured to acquire the security policy from a firewall of each control device in the first industrial control system; A third policy acquisition unit (453) is used to acquire the security policy from the firewall of each control device in the second industrial control system.

8. The device according to any one of claims 5 to 7, wherein: Further including: a device screening module (47) for determining, based on the network identifiable information acquired by the information extraction module (42) and the respective security policies acquired by the policy acquisition module (45), target control devices in the OT network that are at risk of being attacked by the communication data packets; a coefficient calculation module (48) for determining, based on the network identifiable information acquired by the information extraction module (42), a threat coefficient of the communication data packet to each of the target control devices determined by the device screening module (47); an information sending module (49), configured to send the threat coefficient of each target control device determined by the coefficient calculation module (48) to an administrator; A policy optimization module (410) is used to generate an optimization suggestion for optimizing at least one of the security policies obtained by the policy acquisition module (45) based on the network identifiable information after receiving a confirmation instruction issued by the administrator based on the threat coefficient of each target control device sent by the information sending module (49).

9. Industrial control system security analysis device, including: at least one memory (411) and at least one processor (412); The at least one memory (411) is used to store a machine-readable program; The at least one processor (412) is configured to call the machine-readable program to execute the method according to any one of claims 1 to 4.

10. A computer-readable medium having computer instructions stored thereon, wherein when the computer instructions are executed by a processor, the processor is caused to execute the method according to any one of claims 1 to 4.

Images