Industrial control traffic abnormal behavior protection method and system

Abstract

The present invention provides a method and system for protecting industrial control traffic from abnormal behavior, including: passing the industrial control traffic through a coarse-grained five-tuple whitelist access control strategy layer, a fine-grained protocol whitelist traffic monitoring strategy layer, and a protocol blacklist traffic audit strategy layer in sequence, to determine abnormal behavior in the industrial control traffic; wherein the coarse-grained five-tuple whitelist access control strategy layer is used to determine abnormal behavior of traffic from unknown source addresses and traffic from unknown ports at known addresses; the fine-grained protocol whitelist traffic monitoring strategy layer is used to determine abnormal behavior of unknown function codes of known protocols and unknown parameters of known protocols; the protocol blacklist traffic audit strategy layer is used to determine abnormal behavior of unknown function codes of known protocols, unknown parameters of known protocols, and abnormal timing. The present invention is used to solve the defect that the protection effect of existing protection technologies is not efficient enough, and realizes a multi-level protection function from shallow to deep, thereby improving the protection effect.

Description

Technical Field

[0001] The present invention relates to the technical field of industrial control equipment security protection, and in particular to a method and system for protecting industrial control flow from abnormal behavior. Background Art

[0002] With the continuous development of information technology, the industrial control environment has gradually changed from the previous independent operation of industrial control equipment to the networking operation of industrial control equipment, and from the previous single business domain to the networking and joint operation of multiple domains. While the networking model improves business efficiency, it will also inevitably generate many risks, such as abnormal traffic attacks, malicious code propagation, information leakage and other risks. Looking at the global industrial control network environment, attacks caused by abnormal traffic have threatened the production of some countries. How to effectively analyze and protect against the risk of abnormal traffic attacks on industrial control is crucial.

[0003] In the industrial control scenario, traffic that is considered abnormal is mainly divided into the following situations: traffic with unknown source addresses, traffic with known addresses and unknown ports, traffic with known protocols and unknown function codes, traffic with known protocols and unknown parameters, abnormal timing, etc. Traffic with unknown source addresses mainly refers to the unclear source of industrial control traffic data; traffic with known addresses and unknown ports mainly refers to the industrial control traffic data source being a known server, but the port through which the data flows is unknown, and most of them are custom ports; unknown function codes of known protocols mainly refer to the large number of private protocols in the industrial control environment. During the communication process of industrial control equipment, the industrial control protocol is legal, but the function codes in the industrial control protocol are not fully understood, and some function codes can produce abnormal behaviors; unknown parameters of known protocols mainly refer to the fact that during the normal industrial control protocol interaction process, some parameters exceed the normal value range and produce abnormalities; abnormal timing mainly refers to the fact that in the industrial control communication traffic, some operations will also produce abnormal effects if the timing changes. The above situations cover most of the abnormal processes of industrial control, and there are abnormal risks in the changes in the situation, so it is particularly important to protect against these risks.

[0004] In response to the risks brought by abnormal behavior of industrial control traffic, some companies and research institutions have done a lot of related research and launched many protective products. The most typical product is the industrial control firewall. Looking at various firewalls, most of them achieve the purpose of protection by configuring fine-grained access control policies to intercept traffic. This protection method is also used in traditional firewalls, but this configuration is too cumbersome. Although it can play a good protective effect, it also requires operators to be quite familiar with the business. In the field of industrial control, the business capabilities of personnel need to be strong. Once there is a problem with the configuration, it will affect the business. Therefore, the industrial control traffic protection method has the problem of insufficient protection effect due to the cumbersome configuration. Summary of the invention

[0005] The present invention provides a method and system for protecting industrial control traffic from abnormal behavior, so as to solve the defect that the industrial control traffic protection method in the prior art has the problem that the configuration is too complicated, resulting in insufficient protection effect, and realizes a multi-level protection function from shallow to deep, thereby improving the protection effect.

[0006] The present invention provides a method for protecting industrial control traffic from abnormal behavior, comprising:

[0007] Obtain industrial control traffic, and sequentially pass the industrial control traffic through a coarse-grained five-tuple whitelist access control policy layer, a fine-grained protocol whitelist traffic monitoring policy layer, and a protocol blacklist traffic audit policy layer to determine abnormal behavior in the industrial control traffic;

[0008] If the industrial control traffic has abnormal behavior, the industrial control traffic is blocked and an alarm message is generated;

[0009] Wherein, the coarse-grained five-tuple whitelist access control policy layer is used to determine the abnormal behavior of unknown source address traffic and known address unknown port traffic in the industrial control traffic;

[0010] The fine-grained protocol whitelist traffic monitoring strategy layer is used to monitor the industrial control traffic and determine the abnormal behavior of the known protocol unknown function code and the known protocol unknown parameter in the industrial control traffic;

[0011] The protocol blacklist traffic audit strategy layer is used to determine the abnormal behaviors of known protocol unknown function codes, known protocol unknown parameters and abnormal timing in the industrial control traffic.

[0012] According to a method for protecting industrial control traffic from abnormal behavior provided by the present invention, the industrial control traffic is passed through a coarse-grained five-tuple whitelist access control policy layer to determine abnormal behavior in the industrial control traffic, including:

[0013] Obtaining five-tuple information in the industrial control traffic;

[0014] Comparing the five-tuple information with the five-tuple access control list of the coarse-grained five-tuple whitelist access control policy layer;

[0015] If the five-tuple access control list does not include the five-tuple information, it is determined that the industrial control traffic includes abnormal behavior.

[0016] According to a method for protecting industrial control traffic from abnormal behavior provided by the present invention, the five-tuple information includes a source IP address, a source port, a destination IP address, a destination port, and a transmission protocol.

[0017] According to a method for protecting industrial control traffic from abnormal behavior provided by the present invention, the industrial control traffic is passed through a fine-grained protocol whitelist traffic monitoring strategy layer to determine abnormal behavior in the industrial control traffic, including:

[0018] Obtaining industrial control protocol information in the industrial control traffic;

[0019] Comparing the industrial control protocol information with the protocol flow monitoring strategy list of the fine-grained protocol whitelist flow monitoring strategy layer;

[0020] If the protocol traffic monitoring strategy list does not include the industrial control protocol information, it is determined that the industrial control traffic has abnormal behavior.

[0021] According to a method for protecting industrial control traffic from abnormal behavior provided by the present invention, the industrial control traffic is passed through a protocol blacklist traffic audit policy layer to determine abnormal behavior in the industrial control traffic, including:

[0022] Obtaining industrial control protocol information in the industrial control traffic;

[0023] Comparing the industrial control protocol information with the protocol traffic audit policy list of the protocol blacklist traffic audit policy layer;

[0024] If the protocol traffic audit policy list includes the industrial control protocol information, it is determined that the industrial control traffic includes abnormal behavior.

[0025] The present invention also provides an industrial control traffic abnormal behavior protection system, the industrial control traffic abnormal behavior protection system is used to execute any of the above industrial control traffic abnormal behavior protection methods, the industrial control traffic abnormal behavior protection system includes a five-tuple access control engine, an industrial control protocol monitoring engine and an industrial control protocol audit engine;

[0026] Among them, the five-tuple access control engine is deployed with the coarse-grained five-tuple whitelist access control policy layer, the industrial control protocol monitoring engine is deployed with the fine-grained protocol whitelist traffic monitoring policy layer, and the industrial control protocol audit engine is deployed with the protocol blacklist traffic audit policy layer.

[0027] The present invention also provides an industrial control flow abnormal behavior protection device, comprising:

[0028] An abnormal behavior monitoring module is used to obtain industrial control traffic, pass the industrial control traffic through the coarse-grained five-tuple whitelist access control policy layer, the fine-grained protocol whitelist traffic monitoring policy layer and the protocol blacklist traffic audit policy layer in sequence, and determine the abnormal behavior in the industrial control traffic;

[0029] An alarm module is used to block the industrial control traffic and generate an alarm message if the industrial control traffic has abnormal behavior;

[0030] Wherein, the coarse-grained five-tuple whitelist access control policy layer is used to determine the abnormal behavior of unknown source address traffic and known address unknown port traffic in the industrial control traffic;

[0031] The fine-grained protocol whitelist traffic monitoring strategy layer is used to monitor the industrial control traffic and determine the abnormal behavior of the known protocol unknown function code and the known protocol unknown parameter in the industrial control traffic;

[0032] The protocol blacklist traffic audit strategy layer is used to determine the abnormal behaviors of known protocol unknown function codes, known protocol unknown parameters and abnormal timing in the industrial control traffic.

[0033] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the method for protecting against abnormal industrial control traffic behavior as described above is implemented.

[0034] The present invention also provides a non-transitory computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the method for protecting against abnormal behavior of industrial control traffic as described in any one of the above is implemented.

[0035] The present invention also provides a computer program product, including a computer program, which, when executed by a processor, implements any of the above-mentioned methods for protecting against abnormal behavior of industrial control traffic.

[0036] The method and system for protecting industrial control traffic from abnormal behavior provided by the present invention improve the traditional method of using only one access control policy by targeting existing technical problems, and divide the protection strength into layers, namely "coarse-grained five-tuple whitelist access control + fine-grained protocol whitelist traffic monitoring + protocol blacklist traffic auditing". The industrial control traffic is sequentially passed through the coarse-grained five-tuple whitelist access control policy layer, the fine-grained protocol whitelist traffic monitoring policy layer and the protocol blacklist traffic auditing policy layer to determine whether the industrial control traffic has abnormal behavior, thereby realizing a multi-level protection function from shallow to deep and improving the protection effect. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0038] Figure 1This is one of the flow charts of the method for protecting against abnormal behavior of industrial control traffic provided by the present invention;

[0039] Figure 2 This is the second flow chart of the method for protecting against abnormal behavior of industrial control traffic provided by the present invention;

[0040] Figure 3 This is the third flow chart of the method for protecting against abnormal behavior of industrial control traffic provided by the present invention;

[0041] Figure 4 This is the fourth flow chart of the method for protecting against abnormal behavior of industrial control traffic provided by the present invention;

[0042] Figure 5 This is the fifth flow chart of the method for protecting against abnormal behavior of industrial control traffic provided by the present invention;

[0043] Figure 6 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0044] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0045] Combine the following Figure 1-Figure 5 The invention describes the method for protecting industrial control traffic from abnormal behavior.

[0046] Please refer to Figure 1 The present invention proposes a method for protecting industrial control traffic from abnormal behavior, comprising:

[0047] Step 10, obtaining industrial control traffic, passing the industrial control traffic through the coarse-grained five-tuple whitelist access control policy layer, the fine-grained protocol whitelist traffic monitoring policy layer, and the protocol blacklist traffic audit policy layer in sequence, to determine abnormal behavior in the industrial control traffic;

[0048] Step 20: If the industrial control traffic has abnormal behavior, the industrial control traffic is blocked and an alarm message is generated;

[0049] Wherein, the coarse-grained five-tuple whitelist access control policy layer is used to determine the abnormal behavior of unknown source address traffic and known address unknown port traffic in the industrial control traffic;

[0050] The fine-grained protocol whitelist traffic monitoring strategy layer is used to monitor the industrial control traffic and determine the abnormal behavior of the known protocol unknown function code and the known protocol unknown parameter in the industrial control traffic;

[0051] The protocol blacklist traffic audit strategy layer is used to determine the abnormal behaviors of known protocol unknown function codes, known protocol unknown parameters and abnormal timing in the industrial control traffic.

[0052] Please refer to Figure 2 , in the coarse-grained five-tuple whitelist access control policy layer: In the industrial control environment, since business personnel may not fully understand the traffic content, some unknown traffic in the industrial control traffic can be filtered through the five-tuple whitelist. It should be noted that in the normal use of industrial control equipment, the address of the device is clear. If there are some unclear device addresses, when the industrial control traffic passes through the coarse-grained five-tuple whitelist access control policy layer, it will be detected by the coarse-grained five-tuple whitelist access control policy layer as having abnormal behavior, and the industrial control traffic with some unclear device addresses will be blocked and alarm processing will be performed, thereby filtering out the industrial control traffic with some unclear device addresses. The coarse-grained five-tuple whitelist access control policy layer can detect abnormal behavior of traffic with unknown source addresses and traffic with known addresses and unknown ports.

[0053] In the fine-grained protocol whitelist traffic monitoring strategy layer: Although the coarse-grained five-tuple whitelist can play a certain protective role, there is still abnormal traffic in the industrial control traffic of the compliant address. However, if you want to effectively detect this part of the traffic, you need to be familiar with the business. If the configuration is wrong, it will affect the normal business. In this case, this part of the traffic cannot be filtered. Therefore, the industrial control traffic is input into the fine-grained protocol whitelist traffic monitoring strategy layer. The fine-grained protocol whitelist traffic monitoring strategy layer monitors the industrial control traffic of the compliant address. If unknown traffic is found, an alarm will be issued. This can effectively make up for the shortcomings of a single five-tuple filter. The fine-grained protocol whitelist traffic monitoring strategy layer can detect abnormal behaviors of unknown function codes and unknown parameters of known protocols.

[0054] In the protocol blacklist traffic audit strategy layer: quintuple whitelist filtering and protocol whitelist monitoring have handled abnormal traffic to a large extent, but there are still some situations where there are hidden dangers if the handling is not in place. For example, some abnormal traffic is generated by changes in the timing of some protocol function codes, which can still cause damage. However, this traffic is identified as normal traffic every time it is identified. Therefore, for these flows, the protocol blacklist traffic audit method is adopted, and then the industrial control traffic is passed through the protocol blacklist traffic audit strategy layer to record the protocol information. Afterwards, the traffic information can be audited and analyzed, and the known protocol unknown function code, known protocol unknown parameters, and abnormal timing in the industrial control traffic can be detected. Although it is not as time-effective as the previous two strategies, it can be effectively compensated through post-analysis. The protocol blacklist traffic audit strategy layer can detect the known protocol unknown function code, known protocol unknown parameters, and abnormal timing in the industrial control traffic.

[0055] If the industrial control traffic has abnormal behavior through the coarse-grained five-tuple whitelist access control policy layer, the fine-grained protocol whitelist traffic monitoring policy layer, and the protocol blacklist traffic audit policy layer, the industrial control traffic with abnormal behavior will be blocked and an alarm message will be generated. Among them, the alarm information can be output through reports, emails, text messages, real-time video broadcasts, real-time voice broadcasts, etc., to prompt relevant technical personnel to pay attention.

[0056] The method for protecting industrial control traffic from abnormal behavior provided by the present invention improves the traditional method of using only one access control policy by targeting the existing technical problems, and layers the protection strength, namely "coarse-grained five-tuple whitelist access control + fine-grained protocol whitelist traffic monitoring + protocol blacklist traffic auditing". The industrial control traffic is sequentially passed through the coarse-grained five-tuple whitelist access control policy layer, the fine-grained protocol whitelist traffic monitoring policy layer and the protocol blacklist traffic auditing policy layer to determine whether the industrial control traffic has abnormal behavior, thereby realizing a multi-level protection function from shallow to deep and improving the protection effect.

[0057] In one possible embodiment, please refer to Figure 3 Step 10: passing the industrial control traffic through a coarse-grained five-tuple whitelist access control policy layer to determine abnormal behavior in the industrial control traffic, including:

[0058] Step 101, obtaining five-tuple information in the industrial control traffic;

[0059] Step 102, comparing the five-tuple information with the five-tuple access control list of the coarse-grained five-tuple whitelist access control policy layer;

[0060] Step 103: If the five-tuple access control list does not include the five-tuple information, it is determined that the industrial control traffic includes abnormal behavior.

[0061] The five-tuple information includes the source IP address, source port, destination IP address, destination port and transport protocol.

[0062] It should be noted that a five-tuple access control policy list is pre-configured in the coarse-grained five-tuple whitelist access control policy layer, and the policy is loaded into the memory space.

[0063] This embodiment will specifically explain how to identify industrial control traffic containing abnormal behavior in the coarse-grained five-tuple whitelist access control policy layer. Specifically, first obtain the five-tuple information in the industrial control traffic, and compare the five-tuple information with the five-tuple access control list pre-configured in the coarse-grained five-tuple whitelist access control policy layer to determine whether the five-tuple information exists in the five-tuple access control list. If the five-tuple access control list does not contain the five-tuple information, it is determined that the industrial control traffic corresponding to the five-tuple information contains abnormal behavior, and the industrial control traffic corresponding to the five-tuple information needs to be blocked; if the five-tuple access control list contains the five-tuple information, it is determined that the industrial control traffic does not contain abnormal behavior, and the industrial control traffic can be released.

[0064] In this embodiment, by pre-configuring a five-tuple access control list in the coarse-grained five-tuple whitelist access control policy layer, industrial control traffic containing abnormal behavior is identified, thereby improving the ability to detect abnormal traffic in the five-tuple whitelist access control policy layer and improving the effect of protecting against the risk of industrial control abnormal traffic attacks.

[0065] In one possible embodiment, please refer to Figure 4 Step 10: passing the industrial control traffic through a fine-grained protocol whitelist traffic monitoring strategy layer to determine abnormal behavior in the industrial control traffic, including:

[0066] Step 111, obtaining industrial control protocol information in the industrial control traffic;

[0067] Step 112, comparing the industrial control protocol information with the protocol traffic monitoring strategy list of the fine-grained protocol whitelist traffic monitoring strategy layer;

[0068] Step 113: If the protocol traffic monitoring strategy list does not include the industrial control protocol information, it is determined that the industrial control traffic has abnormal behavior.

[0069] It should be noted that the protocol traffic monitoring strategy list is configured. The strategy relies on five-tuple information. The protocol information contains five-tuple information. For example, the Modbus protocol includes function code, sub-function code, parameters, etc. The protocol information is configured and the strategy is loaded into the memory space. If some industrial control protocols are not clear, the protocol can be not configured, and no alarm will be issued.

[0070] This embodiment will specifically explain how to identify industrial control traffic containing abnormal behavior in the fine-grained protocol whitelist traffic monitoring strategy layer. Specifically, first obtain the industrial control protocol information in the industrial control traffic, and compare the industrial control protocol information with the pre-configured protocol traffic monitoring strategy list in the coarse-grained protocol whitelist traffic monitoring strategy layer to determine whether the industrial control protocol information exists in the protocol traffic monitoring strategy list. If the protocol traffic monitoring strategy list does not contain the industrial control protocol information, it is determined that the industrial control traffic corresponding to the industrial control protocol information contains abnormal behavior, and the industrial control traffic corresponding to the industrial control protocol information needs to be blocked; if the protocol traffic monitoring strategy list contains the industrial control protocol information, it is determined that the industrial control traffic corresponding to the industrial control protocol information does not contain abnormal behavior, and the industrial control traffic can be released.

[0071] In this embodiment, by pre-configuring a protocol traffic monitoring policy list in the fine-grained protocol whitelist traffic monitoring policy layer, industrial control traffic containing abnormal behavior is identified, thereby improving the ability to detect abnormal traffic in the fine-grained protocol whitelist traffic monitoring policy layer and improving the effect of protecting against the risk of industrial control abnormal traffic attacks.

[0072] In one possible embodiment, please refer to Figure 5 , passing the industrial control traffic through the protocol blacklist traffic audit policy layer to determine abnormal behavior in the industrial control traffic, including:

[0073] Step 121, obtaining industrial control protocol information in the industrial control traffic;

[0074] Step 122, comparing the industrial control protocol information with the protocol traffic audit policy list of the protocol blacklist traffic audit policy layer;

[0075] Step 123: If the protocol traffic audit policy list includes the industrial control protocol information, it is determined that the industrial control traffic includes abnormal behavior.

[0076] It should be noted that the protocol traffic audit policy list is pre-configured in the protocol blacklist traffic audit policy. The policy records the protocol. The configuration information can directly select the protocol to be audited, so that the traffic that conforms to the protocol can be retained. After configuration, the policy is loaded into the memory. In general, the audit policy configuration can be larger in scope and record more audit information to provide data for future analysis.

[0077] This embodiment will specifically explain how to identify industrial control traffic containing abnormal behavior in the protocol blacklist traffic audit policy layer. Specifically, first obtain the industrial control protocol information in the industrial control traffic, and compare the industrial control protocol information with the protocol traffic audit policy list pre-configured in the protocol blacklist traffic audit policy layer to determine whether the industrial control protocol information exists in the protocol traffic audit policy list. If the industrial control protocol information is included in the protocol traffic monitoring policy list, then record and further audit whether the industrial control protocol information contains abnormal behavior, and determine whether the industrial control traffic corresponding to the industrial control protocol information contains abnormal behavior based on the audit results, and it is necessary to block the industrial control traffic corresponding to the abnormal behavior; if the protocol traffic monitoring policy list does not contain the industrial control protocol information, then determine that the industrial control traffic corresponding to the industrial control protocol information does not contain abnormal behavior, and the industrial control traffic can be released.

[0078] Among them, audit methods may include audit detection through deep learning models, traffic monitoring algorithms, manual verification and judgment, etc.

[0079] In this embodiment, by pre-configuring the protocol traffic audit policy list in the protocol blacklist traffic audit policy layer, industrial control traffic containing abnormal behavior is identified, thereby improving the detection capability of abnormal traffic and improving the effect of protecting against industrial control abnormal traffic attack risks.

[0080] The present invention also provides an industrial control traffic abnormal behavior protection system, the industrial control traffic abnormal behavior protection system is used to execute any of the above industrial control traffic abnormal behavior protection methods, the industrial control traffic abnormal behavior protection system includes a five-tuple access control engine, an industrial control protocol monitoring engine and an industrial control protocol audit engine;

[0081] Among them, the five-tuple access control engine is deployed with the coarse-grained five-tuple whitelist access control policy layer, the industrial control protocol monitoring engine is deployed with the fine-grained protocol whitelist traffic monitoring policy layer, and the industrial control protocol audit engine is deployed with the protocol blacklist traffic audit policy layer.

[0082] For ease of understanding, based on the above embodiment, a specific example is proposed, and the specific steps include:

[0083] Step 1: Configure a five-tuple access control policy list and load the policy into the memory space;

[0084] Step 2: Configure the industrial control protocol monitoring strategy list. The strategy relies on five-tuple information. The protocol information contains five-tuple information. For example, Modbus protocol includes function code, sub-function code, parameters, etc. Configure the protocol information and load the strategy into the memory space. If you are not sure about some industrial control protocols, you can also not configure the protocol and no alarm will be issued;

[0085] Step 3: Configure the industrial control protocol audit policy list. This policy records the protocol. The configuration information can directly select the protocol to be audited, so that the traffic that conforms to the protocol can be retained. After configuration, load the policy into the memory. In general, the audit policy configuration can be larger in scope and record more audit information to provide data for future analysis;

[0086] Step 4: These three strategic matching engines run independently in memory. When industrial control traffic passes through, the traffic passes through the five-tuple access control engine, while the industrial control protocol monitoring engine and the industrial control protocol audit engine capture the shared bypass traffic;

[0087] Step 5: The five-tuple access control uses a whitelist approach. In this engine, the industrial control traffic is analyzed serially to obtain the five-tuple information of the traffic, and the five-tuple information is compared with the five-tuple access control list. If the five-tuple is in the list, the traffic will be released. If not, the traffic will be blocked and an alarm will be generated.

[0088] Step 6: Protocol traffic monitoring uses a whitelist approach. In this engine, the traffic information captured by the bypass is analyzed, mainly comparing the industrial control protocol information with the protocol traffic monitoring strategy list. If the protocol information is in the list, the traffic will not be processed. If it is not in the list, an alarm will be issued.

[0089] Step 7: Protocol traffic audit uses a blacklist method. In this engine, the traffic information captured by the bypass is analyzed, and the industrial control protocol information is compared with the protocol traffic audit policy list. If the protocol information is in the list, the traffic information will be recorded. If not in the list, no processing will be done.

[0090] Step 8: Finally, analyze the logs returned by the three engines to achieve effective protection.

[0091] The industrial control flow abnormal behavior protection device provided by the present invention is described below. The industrial control flow abnormal behavior protection device described below and the industrial control flow abnormal behavior protection method described above can be referenced to each other.

[0092] The industrial control flow abnormal behavior protection device provided by the present invention includes:

[0093] An abnormal behavior monitoring module is used to obtain industrial control traffic, pass the industrial control traffic through the coarse-grained five-tuple whitelist access control policy layer, the fine-grained protocol whitelist traffic monitoring policy layer and the protocol blacklist traffic audit policy layer in sequence, and determine the abnormal behavior in the industrial control traffic;

[0094] An alarm module is used to block the industrial control traffic and generate an alarm message if the industrial control traffic has abnormal behavior;

[0095] Wherein, the coarse-grained five-tuple whitelist access control policy layer is used to determine the abnormal behavior of unknown source address traffic and known address unknown port traffic in the industrial control traffic;

[0096] The fine-grained protocol whitelist traffic monitoring strategy layer is used to monitor the industrial control traffic and determine the abnormal behavior of the known protocol unknown function code and the known protocol unknown parameter in the industrial control traffic;

[0097] The protocol blacklist traffic audit strategy layer is used to determine the abnormal behaviors of known protocol unknown function codes, known protocol unknown parameters and abnormal timing in the industrial control traffic.

[0098] Furthermore, the abnormal behavior monitoring module is also used to:

[0099] Obtaining five-tuple information in the industrial control traffic;

[0100] Comparing the five-tuple information with the five-tuple access control list of the coarse-grained five-tuple whitelist access control policy layer;

[0101] If the five-tuple access control list does not include the five-tuple information, it is determined that the industrial control traffic includes abnormal behavior.

[0102] Furthermore, the five-tuple information includes a source IP address, a source port, a destination IP address, a destination port and a transmission protocol.

[0103] Furthermore, the abnormal behavior monitoring module is also used to:

[0104] Obtaining industrial control protocol information in the industrial control traffic;

[0105] Comparing the industrial control protocol information with the protocol flow monitoring strategy list of the fine-grained protocol whitelist flow monitoring strategy layer;

[0106] If the protocol traffic monitoring strategy list does not include the industrial control protocol information, it is determined that the industrial control traffic has abnormal behavior.

[0107] Furthermore, the abnormal behavior monitoring module is also used to:

[0108] Obtaining industrial control protocol information in the industrial control traffic;

[0109] Comparing the industrial control protocol information with the protocol traffic audit policy list of the protocol blacklist traffic audit policy layer;

[0110] If the protocol traffic audit policy list includes the industrial control protocol information, it is determined that the industrial control traffic includes abnormal behavior.

[0111] Figure 6 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 6 As shown, the electronic device may include: a processor (processor) 610, a communication interface (Communications Interface) 620, a memory (memory) 630 and a communication bus 640, wherein the processor 610, the communication interface 620, and the memory 630 communicate with each other through the communication bus 640. The processor 610 can call the logic instructions in the memory 630 to execute the method for protecting industrial control traffic from abnormal behavior, which includes: obtaining industrial control traffic, passing the industrial control traffic through the coarse-grained five-tuple whitelist access control policy layer, the fine-grained protocol whitelist traffic monitoring policy layer and the protocol blacklist traffic audit policy layer in sequence, and determining the abnormal behavior in the industrial control traffic; if the industrial control traffic has abnormal behavior, the industrial control traffic is blocked and an alarm message is generated; wherein the coarse-grained five-tuple whitelist access control policy layer is used to determine the abnormal behavior of unknown source address traffic and known address unknown port traffic in the industrial control traffic; the fine-grained protocol whitelist traffic monitoring policy layer is used to monitor the industrial control traffic and determine the abnormal behavior of known protocol unknown function codes and known protocol unknown parameters in the industrial control traffic; the protocol blacklist traffic audit policy layer is used to determine the abnormal behavior of known protocol unknown function codes, known protocol unknown parameters and abnormal timing in the industrial control traffic.

[0112] In addition, the logic instructions in the above-mentioned memory 630 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0113] On the other hand, the present invention also provides a computer program product, which includes a computer program, which can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the industrial control traffic abnormal behavior protection method provided by the above methods, the method comprising: obtaining industrial control traffic, passing the industrial control traffic through a coarse-grained five-tuple whitelist access control policy layer, a fine-grained protocol whitelist traffic monitoring policy layer and a protocol blacklist traffic audit policy layer in sequence, and determining abnormal behavior in the industrial control traffic; if the industrial control traffic has abnormal behavior, the industrial control traffic is blocked and an alarm message is generated; wherein the coarse-grained five-tuple whitelist access control policy layer is used to determine the abnormal behavior of unknown source address traffic and known address unknown port traffic in the industrial control traffic; the fine-grained protocol whitelist traffic monitoring policy layer is used to monitor the industrial control traffic and determine the abnormal behavior of known protocol unknown function codes and known protocol unknown parameters in the industrial control traffic; the protocol blacklist traffic audit policy layer is used to determine the abnormal behavior of known protocol unknown function codes, known protocol unknown parameters and abnormal timing in the industrial control traffic.

[0114] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute the industrial control traffic abnormal behavior protection method provided by the above-mentioned methods, the method comprising: obtaining industrial control traffic, passing the industrial control traffic through a coarse-grained five-tuple whitelist access control policy layer, a fine-grained protocol whitelist traffic monitoring policy layer and a protocol blacklist traffic audit policy layer in sequence, and determining abnormal behavior in the industrial control traffic; if the industrial control traffic has abnormal behavior, blocking the industrial control traffic and generating an alarm message; wherein the coarse-grained five-tuple whitelist access control policy layer is used to determine abnormal behavior of unknown source address traffic and known address unknown port traffic in the industrial control traffic; the fine-grained protocol whitelist traffic monitoring policy layer is used to monitor the industrial control traffic and determine abnormal behavior of known protocol unknown function codes and known protocol unknown parameters in the industrial control traffic; the protocol blacklist traffic audit policy layer is used to determine abnormal behavior of known protocol unknown function codes, known protocol unknown parameters and abnormal timing in the industrial control traffic.

[0115] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0116] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0117] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for protecting industrial control traffic from abnormal behavior, characterized in that: include: Obtain industrial control traffic, and sequentially pass the industrial control traffic through a coarse-grained five-tuple whitelist access control policy layer, a fine-grained protocol whitelist traffic monitoring policy layer, and a protocol blacklist traffic audit policy layer to determine abnormal behavior in the industrial control traffic; If the industrial control traffic has abnormal behavior, the industrial control traffic is blocked and an alarm message is generated; Wherein, the coarse-grained five-tuple whitelist access control policy layer is used to determine the abnormal behavior of unknown source address traffic and known address unknown port traffic in the industrial control traffic; The fine-grained protocol whitelist traffic monitoring strategy layer is used to monitor the industrial control traffic and determine the abnormal behavior of the known protocol unknown function code and the known protocol unknown parameter in the industrial control traffic; The protocol blacklist traffic audit strategy layer is used to determine the abnormal behavior of known protocol unknown function codes, known protocol unknown parameters and abnormal timing in the industrial control traffic; Passing the industrial control traffic through a coarse-grained five-tuple whitelist access control policy layer to determine abnormal behavior in the industrial control traffic, including: Obtaining five-tuple information in the industrial control traffic; Comparing the five-tuple information with the five-tuple access control list of the coarse-grained five-tuple whitelist access control policy layer; If the five-tuple access control list does not include the five-tuple information, it is determined that the industrial control traffic includes abnormal behavior; The industrial control traffic is passed through a fine-grained protocol whitelist traffic monitoring strategy layer to determine abnormal behavior in the industrial control traffic, including: Obtaining industrial control protocol information in the industrial control traffic; Comparing the industrial control protocol information with the protocol flow monitoring strategy list of the fine-grained protocol whitelist flow monitoring strategy layer; If the industrial control protocol information is not included in the protocol traffic monitoring strategy list, it is determined that the industrial control traffic has abnormal behavior; The industrial control traffic is passed through the protocol blacklist traffic audit policy layer to determine abnormal behavior in the industrial control traffic, including: Obtaining industrial control protocol information in the industrial control traffic; Comparing the industrial control protocol information with the protocol traffic audit policy list of the protocol blacklist traffic audit policy layer; If the protocol traffic audit policy list includes the industrial control protocol information, it is determined that the industrial control traffic includes abnormal behavior.

2. The method for protecting against abnormal behavior of industrial control traffic according to claim 1, characterized in that: The five-tuple information includes source IP address, source port, destination IP address, destination port and transmission protocol.

3. An industrial control traffic abnormal behavior protection system, characterized in that: The industrial control traffic abnormal behavior protection system is used to execute the industrial control traffic abnormal behavior protection method according to any one of claims 1 to 2, and the industrial control traffic abnormal behavior protection system includes a five-tuple access control engine, an industrial control protocol monitoring engine, and an industrial control protocol audit engine; Among them, the five-tuple access control engine is deployed with the coarse-grained five-tuple whitelist access control policy layer, the industrial control protocol monitoring engine is deployed with the fine-grained protocol whitelist traffic monitoring policy layer, and the industrial control protocol audit engine is deployed with the protocol blacklist traffic audit policy layer.

4. A device for protecting industrial control traffic from abnormal behavior, characterized in that: include: An abnormal behavior monitoring module is used to obtain industrial control traffic, pass the industrial control traffic through the coarse-grained five-tuple whitelist access control policy layer, the fine-grained protocol whitelist traffic monitoring policy layer and the protocol blacklist traffic audit policy layer in sequence, and determine the abnormal behavior in the industrial control traffic; An alarm module is used to block the industrial control traffic and generate an alarm message if the industrial control traffic has abnormal behavior; Wherein, the coarse-grained five-tuple whitelist access control policy layer is used to determine the abnormal behavior of unknown source address traffic and known address unknown port traffic in the industrial control traffic; The fine-grained protocol whitelist traffic monitoring strategy layer is used to monitor the industrial control traffic and determine the abnormal behavior of the known protocol unknown function code and the known protocol unknown parameter in the industrial control traffic; The protocol blacklist traffic audit strategy layer is used to determine the abnormal behavior of known protocol unknown function codes, known protocol unknown parameters and abnormal timing in the industrial control traffic; The abnormal behavior monitoring module is further used to obtain the industrial control protocol information in the industrial control traffic; compare the industrial control protocol information with the protocol traffic audit policy list of the protocol blacklist traffic audit policy layer; if the protocol traffic audit policy list contains the industrial control protocol information, it is determined that the industrial control traffic contains abnormal behavior; The abnormal behavior monitoring module is further used to obtain the five-tuple information in the industrial control traffic; compare the five-tuple information with the five-tuple access control list of the coarse-grained five-tuple whitelist access control policy layer; if the five-tuple access control list does not contain the five-tuple information, it is determined that the industrial control traffic contains abnormal behavior; The abnormal behavior monitoring module is also used to obtain the industrial control protocol information in the industrial control traffic; compare the industrial control protocol information with the protocol traffic monitoring strategy list of the fine-grained protocol whitelist traffic monitoring strategy layer; if the industrial control protocol information is not included in the protocol traffic monitoring strategy list, it is determined that the industrial control traffic has abnormal behavior.

5. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the method for protecting industrial control traffic from abnormal behavior as described in any one of claims 1 to 2 is implemented.

6. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method for protecting industrial control traffic from abnormal behavior as described in any one of claims 1 to 2 is implemented.

7. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the method for protecting industrial control traffic from abnormal behavior as described in any one of claims 1 to 2 is implemented.

Images