Abnormal flow detection method, system, electronic device and storage medium

Abstract

The present invention discloses an abnormal flow detection method, system, electronic device and storage medium, and relates to the field of abnormal flow detection technology. The method comprises: parsing the three-layer message in the target industrial control flow to obtain multiple first source data groups of the target industrial control flow; parsing the two-layer message in the target industrial control flow to obtain multiple second source data groups of the target industrial control flow; classifying and aggregating the data in all the first source data groups and the second source data groups according to the MAC address of the target industrial control flow to obtain multiple asset entries; classifying the data with the same IP address of the target industrial control flow in the asset entry as application services to obtain an application service set; judging whether the matching factor and the source data group and the application service set in the deployed asset strategy are consistent; if so, the target industrial control flow is normal flow; if not, it is abnormal flow. The present invention improves the protection capability of the industrial control firewall.

Description

Technical Field

[0001] The present invention relates to the technical field of abnormal flow detection, and in particular to an abnormal flow detection method, system, electronic equipment and storage medium. Background Art

[0002] Currently, industrial control firewalls generally detect abnormal traffic through access control lists (ACLs), industrial whitelist rules, and industrial intrusion detection rules. However, they do not use asset information as a protection dimension to detect abnormal traffic and generate alarm events, making the protection of industrial control firewalls relatively one-sided and with low protection capabilities. Summary of the invention

[0003] The purpose of the present invention is to provide an abnormal traffic detection method, system, electronic device and storage medium, which increase the mechanism of abnormal traffic detection and improve the protection capability of industrial control firewalls.

[0004] To achieve the above object, the present invention provides the following solutions:

[0005] An abnormal traffic detection method, comprising:

[0006] Obtaining target industrial control traffic; the target industrial control traffic is the traffic flowing into the industrial control firewall;

[0007] Parse the layer 3 messages in the target industrial control traffic to obtain multiple first source data groups of the target industrial control traffic; one layer 3 message corresponds to one first source data group; the first source data group includes: the interface name, MAC address, IP address, port number, transport layer protocol, application layer protocol, traffic rate, system manufacturer and system version number of the industrial control firewall;

[0008] Parse the layer 2 message in the target industrial control traffic to obtain multiple second source data groups of the target industrial control traffic; one layer 2 message corresponds to one second source data group; the second source data group includes: the interface name, MAC address, Ethernet protocol number, system manufacturer and system version number of the industrial control firewall;

[0009] Classify and aggregate all data in the first source data group and the second source data group according to the MAC address of the target industrial control traffic to obtain multiple asset entries;

[0010] Classify the data with the same IP address as the target industrial control traffic in the asset entry as application services, and obtain an application service set of the target industrial control traffic;

[0011] Determine the first source data group, the second source data group, and the application service set of the target industrial control traffic as the data group to be matched of the target industrial control traffic;

[0012] Determine whether the matching factor in the deployed asset strategy is consistent with the data in the to-be-matched data group; the matching factor includes: one or more of the MAC address, IP address, interface name of the industrial control firewall, flow rate, and application service set;

[0013] If yes, the target industrial control flow is normal flow;

[0014] If not, the target industrial control traffic is abnormal traffic.

[0015] Optionally, parsing one of the layer-3 messages to obtain one of the first source data groups specifically includes:

[0016] Parse the three-layer message to obtain the interface name, the MAC address, the IP address, the port number and the transport layer protocol of the industrial control firewall;

[0017] Performing application identification and traffic statistics on the three-layer message to obtain the application layer protocol and the traffic rate;

[0018] The system manufacturer and the system version number are determined according to the application layer protocol.

[0019] Optionally, parsing one of the layer 2 messages to obtain one of the second source data groups specifically includes:

[0020] Parsing the layer 2 message to obtain the interface name, the MAC address and the Ethernet protocol number of the industrial control firewall;

[0021] The system manufacturer and the system version number are determined according to the Ethernet protocol number.

[0022] Optionally, before parsing the layer-3 message in the target industrial control traffic to obtain a plurality of first source data groups of the target industrial control traffic, the method further includes:

[0023] The messages in the target industrial control traffic are divided into layer 2 messages and layer 3 messages.

[0024] Optionally, determining the system manufacturer and the system version number according to the application layer protocol specifically includes:

[0025] According to the application layer protocol, the corresponding callback function is called to perform deep message analysis to determine the system manufacturer and the system version number.

[0026] Optionally, determining the system manufacturer and the system version number according to the Ethernet protocol number specifically includes:

[0027] Determine the Ethernet protocol type according to the Ethernet protocol number;

[0028] According to the Ethernet protocol type, the corresponding callback function is called to perform deep message analysis to determine the system manufacturer and the system version number.

[0029] An abnormal flow detection system, comprising:

[0030] A target industrial control traffic acquisition module is used to acquire target industrial control traffic; the target industrial control traffic is the traffic flowing into the industrial control firewall;

[0031] A first parsing module is used to parse the three-layer message in the target industrial control traffic to obtain multiple first source data groups of the target industrial control traffic; one of the three-layer messages corresponds to one of the first source data groups; the first source data group includes: the interface name, MAC address, IP address, port number, transport layer protocol, application layer protocol, traffic rate, system manufacturer and system version number of the industrial control firewall;

[0032] A second parsing module is used to parse the layer 2 message in the target industrial control traffic to obtain multiple second source data groups of the target industrial control traffic; one layer 2 message corresponds to one second source data group; the second source data group includes: the interface name, MAC address, Ethernet protocol number, system manufacturer and system version number of the industrial control firewall;

[0033] An asset entry determination module, configured to classify and aggregate the data in all the first source data group and the second source data group according to the MAC address of the target industrial control traffic to obtain a plurality of asset entries;

[0034] An application service set determination module, used to classify data with the same IP address as the target industrial control flow in the asset entry as application services, and obtain an application service set for the target industrial control flow;

[0035] A to-be-matched data group determination module, configured to determine the first source data group, the second source data group, and the application service set of the target industrial control flow as the to-be-matched data group of the target industrial control flow;

[0036] A judgment module, used to judge whether the matching factor in the deployed asset strategy is consistent with the data in the to-be-matched data group; the matching factor includes: one or more of the MAC address, IP address, interface name of the industrial control firewall, flow rate and application service set;

[0037] A first execution module, configured to: if yes, the target industrial control flow is normal flow;

[0038] The second execution module is used to: if not, the target industrial control flow is abnormal flow.

[0039] An electronic device, comprising:

[0040] one or more processors;

[0041] a storage device having one or more programs stored thereon;

[0042] When the one or more programs are executed by the one or more processors, the one or more processors are enabled to implement the above-described methods.

[0043] A storage medium, characterized in that a computer program is stored thereon, wherein the computer program implements the method described above when executed by a processor.

[0044] According to the specific embodiments provided by the present invention, the present invention discloses the following technical effects:

[0045] The present invention discloses an abnormal flow detection method, system, electronic device and storage medium, which use asset information, i.e. data in a source data group, as a factor for abnormal flow detection, increase the protection means of the working condition firewall, and improve the protection capability of the industrial control firewall. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0047] Figure 1 A schematic diagram of a flow chart of an abnormal traffic flow detection method provided in Example 1 of the present invention;

[0048] Figure 2 This is a schematic diagram of the structure of the abnormal flow detection system provided in Example 2 of the present invention. DETAILED DESCRIPTION

[0049] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0050] The purpose of the present invention is to provide an abnormal traffic detection method, system, electronic device and storage medium, aiming to increase the mechanism of abnormal traffic detection and improve the protection capability of industrial control firewalls, which can be applied to the field of abnormal traffic detection technology.

[0051] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0052] Example 1

[0053] Figure 1 This is a flow chart of the abnormal traffic detection method provided in Example 1 of the present invention. Figure 1 As shown, the abnormal traffic detection method in this embodiment includes:

[0054] Step 101: Obtain target industrial control traffic; the target industrial control traffic is the traffic flowing into the industrial control firewall.

[0055] Step 102: Parse the layer 3 message in the target industrial control traffic to obtain multiple first source data groups of the target industrial control traffic; one layer 3 message corresponds to one first source data group; the first source data group includes: the interface name, MAC address, IP address, port number, transport layer protocol, application layer protocol, traffic rate, system manufacturer and system version number of the industrial control firewall;

[0056] Step 103: parse the layer 2 message in the target industrial control traffic to obtain multiple second source data groups of the target industrial control traffic; one layer 2 message corresponds to one second source data group; the second source data group includes: the interface name, MAC address, Ethernet protocol number, system manufacturer and system version number of the industrial control firewall.

[0057] Specifically, the MAC address includes a source MAC address and a destination MAC address, the IP address includes a source IP address and a destination IP address, and the port number includes a source port number and a destination port number. The interface name of the industrial control firewall is the name of the first interface, and the target industrial control traffic flows into the industrial control firewall through the first interface.

[0058] Step 104: Classify and aggregate the data in all the first source data groups and the second source data groups according to the MAC address of the target industrial control traffic to obtain multiple asset entries.

[0059] Step 105: Classify the data with the same IP address as the target industrial control traffic in the asset entry as application services, and obtain the application service set of the target industrial control traffic.

[0060] Specifically, an asset entry may include an asset name, an asset description, a MAC address, an IP address list, an application service set, a minimum traffic rate, a maximum traffic rate, an interface name (associated interface) flowing into the firewall, a manufacturer, and a system version number.

[0061] All metadata are classified under different MAC addresses and the same information is aggregated (classified according to MAC address. The same MAC address is aggregated, and different MAC addresses generate another one) to form the information of each asset (asset item). If the MAC address is the same, the IP address is classified to form an IP address list (one MAC address can have multiple IP addresses); if the IP is the same, the application service is classified to form an application service set (or application service list). Application services are identified based on the transport layer and above content in the message. If they cannot be identified, they are replaced by the transport layer protocol (TCP, UDP) and destination port number.

[0062] Step 106: Determine the first source data group, the second source data group, and the application service set of the target industrial control traffic as the data group to be matched of the target industrial control traffic.

[0063] Step 107: Determine whether the matching factors in the deployed asset policy are consistent with the data in the to-be-matched data group; the matching factors include: one or more of the MAC address, IP address, interface name of the industrial control firewall, flow rate, and application service set.

[0064] Step 107: If yes, the target industrial control traffic is normal traffic.

[0065] Step 109: If not, the target industrial control traffic is abnormal traffic.

[0066] Specifically, if the relevant data in the message (i.e., the data group to be matched) completely matches one or more policies (i.e., matching factors) in the deployed asset policy, that is, the message is within the range of the policy matching factor or the policy does not specify the relevant matching factor (e.g., the deployed policy only specifies a MAC address matching factor, then as long as the MAC address in the message matches it, it will not detect whether the IP address in the message matches), then the match is considered successful. If the policy matches successfully, the industrial control traffic message is considered to be a legitimate message from a legitimate asset, and no abnormal traffic event will be generated.

[0067] Specifically, if the MAC address, IP address, or interface name of the firewall in the message does not match one of the factors of the deployed asset policy, it is considered a mismatch, which is called an asset mismatch; if the message traffic rate is not within the minimum traffic rate and maximum traffic rate matching factor of the deployed asset policy, it is called a traffic rate mismatch; if the application service in the message is not in the application service list of the deployed asset policy, it is called an application service mismatch; all of the above are considered asset policy match failures, which will be identified as abnormal traffic, and abnormal traffic events will be recorded along with the cause of the event (asset mismatch, traffic rate mismatch, or application service mismatch). Among them, asset mismatch is considered to be an unknown asset connected to the protected network; traffic rate mismatch is considered to be the traffic generated on a known asset exceeding the threshold, which may be an emergency; and application service mismatch is considered to be an illegal application service enabled on a known asset.

[0068] As an optional implementation manner, a layer-3 message is parsed to obtain a first source data group, which specifically includes:

[0069] Parse the layer 3 message to obtain the interface name, MAC address, IP address, port number, and transport layer protocol of the industrial control firewall.

[0070] Perform application identification and traffic statistics on layer 3 packets to obtain application layer protocols and traffic rates.

[0071] Determine the system manufacturer and system version number based on the application layer protocol.

[0072] As an optional implementation manner, a layer 2 message is parsed to obtain a second source data group, which specifically includes:

[0073] Parse the Layer 2 message to obtain the interface name, MAC address, and Ethernet protocol number of the industrial control firewall.

[0074] Determine the system manufacturer and system version number based on the Ethernet protocol number.

[0075] As an optional implementation manner, before step 102, the method further includes:

[0076] The packets in the target industrial control traffic are divided into Layer 2 packets and Layer 3 packets.

[0077] As an optional implementation, the system manufacturer and system version number are determined according to the application layer protocol, specifically including:

[0078] According to the application layer protocol, the corresponding callback function is called to perform deep message analysis to determine the system manufacturer and system version number.

[0079] As an optional implementation, the system manufacturer and system version number are determined according to the Ethernet protocol number, specifically including:

[0080] Determine the Ethernet protocol type based on the Ethernet protocol number.

[0081] According to the Ethernet protocol type, the corresponding callback function is called to perform deep message analysis to determine the system manufacturer and system version number.

[0082] Example 2

[0083] Figure 2 This is a schematic diagram of the structure of the abnormal flow detection system provided by Example 2 of the present invention. Figure 2 As shown, the abnormal flow detection system in this embodiment includes:

[0084] The target industrial control traffic acquisition module 201 is used to acquire the target industrial control traffic; the target industrial control traffic is the traffic flowing into the industrial control firewall.

[0085] The first parsing module 202 is used to parse the three-layer messages in the target industrial control traffic to obtain multiple first source data groups of the target industrial control traffic; one of the three-layer messages corresponds to one of the first source data groups; the first source data group includes: the interface name, MAC address, IP address, port number, transport layer protocol, application layer protocol, traffic rate, system manufacturer and system version number of the industrial control firewall.

[0086] The second parsing module 203 is used to parse the layer 2 messages in the target industrial control traffic to obtain multiple second source data groups of the target industrial control traffic; one layer 2 message corresponds to one second source data group; the second source data group includes: the interface name, MAC address, Ethernet protocol number, system manufacturer and system version number of the industrial control firewall.

[0087] The asset entry determination module 204 is used to classify and aggregate the data in all the first source data groups and the second source data groups according to the MAC address of the target industrial control traffic to obtain multiple asset entries.

[0088] The application service set determination module 205 is used to classify the data with the same IP address of the target industrial control flow in the asset entry as application services, and obtain the application service set of the target industrial control flow.

[0089] The to-be-matched data group determining module 206 is configured to determine the first source data group, the second source data group, and the application service set of the target industrial control traffic as the to-be-matched data group of the target industrial control traffic.

[0090] The judgment module 207 is used to judge whether the matching factors in the deployed asset strategy are consistent with the data in the to-be-matched data group; the matching factors include: one or more of the MAC address, IP address, interface name of the industrial control firewall, flow rate and application service set.

[0091] The first execution module 208 is configured to determine that if yes, the target industrial control traffic is normal traffic.

[0092] The second execution module 209 is used to determine if no, the target industrial control flow is abnormal flow.

[0093] Example 3

[0094] An electronic device, comprising:

[0095] One or more processors.

[0096] A storage device having one or more programs stored thereon.

[0097] When one or more programs are executed by one or more processors, the one or more processors implement the method in Embodiment 1.

[0098] Example 4

[0099] A storage medium stores a computer program, wherein the computer program implements the method in embodiment 1 when executed by a processor.

[0100] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the system disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0101] The principles and implementation methods of the present invention are described in this article using specific examples. The description of the above embodiments is only used to help understand the method and core idea of ​​the present invention. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as limiting the present invention.

Claims

1. A method for detecting abnormal traffic, characterized in that: The method comprises: Obtaining target industrial control traffic; the target industrial control traffic is the traffic flowing into the industrial control firewall; Parse the layer 3 messages in the target industrial control traffic to obtain multiple first source data groups of the target industrial control traffic; one layer 3 message corresponds to one first source data group; the first source data group includes: the interface name, MAC address, IP address, port number, transport layer protocol, application layer protocol, traffic rate, system manufacturer and system version number of the industrial control firewall; Parse the layer 2 message in the target industrial control traffic to obtain multiple second source data groups of the target industrial control traffic; one layer 2 message corresponds to one second source data group; the second source data group includes: the interface name, MAC address, Ethernet protocol number, system manufacturer and system version number of the industrial control firewall; Classify and aggregate all data in the first source data group and the second source data group according to the MAC address of the target industrial control traffic to obtain multiple asset entries; Classify the data with the same IP address as the target industrial control traffic in the asset entry as application services, and obtain an application service set of the target industrial control traffic; Determine the first source data group, the second source data group, and the application service set of the target industrial control traffic as the data group to be matched of the target industrial control traffic; Determine whether the matching factor in the deployed asset strategy is consistent with the data in the to-be-matched data group; the matching factor includes: one or more of the MAC address, IP address, interface name of the industrial control firewall, flow rate, and application service set; If yes, the target industrial control flow is normal flow; If not, the target industrial control traffic is abnormal traffic; If the MAC address, IP address, or interface name of the industrial control firewall does not match a matching factor with the deployed asset policy, it is considered a mismatch, which is called an asset mismatch; if the traffic rate is not within the range of the minimum and maximum traffic rates of the deployed asset policy, it is called a traffic rate mismatch; if the application service is not in the application service list of the deployed asset policy, it is called an application service mismatch; asset mismatch, traffic rate mismatch, and application service mismatch are all asset policy matching failures, and the target industrial control traffic is identified as abnormal traffic. The abnormal traffic event is recorded and the cause of the event is recorded, whether the cause of the event is an asset mismatch, a traffic rate mismatch, or an application service mismatch.

2. The abnormal flow detection method according to claim 1, characterized in that: Parsing the layer-3 message to obtain the first source data group specifically includes: Parse the three-layer message to obtain the interface name, the MAC address, the IP address, the port number and the transport layer protocol of the industrial control firewall; Performing application identification and traffic statistics on the three-layer message to obtain the application layer protocol and the traffic rate; The system manufacturer and the system version number are determined according to the application layer protocol.

3. The abnormal flow detection method according to claim 1, characterized in that: Parsing one of the layer 2 messages to obtain a second source data group specifically includes: Parsing the layer 2 message to obtain the interface name, the MAC address and the Ethernet protocol number of the industrial control firewall; The system manufacturer and the system version number are determined according to the Ethernet protocol number.

4. The abnormal flow detection method according to claim 1, characterized in that: Before parsing the layer-3 message in the target industrial control traffic to obtain a plurality of first source data groups of the target industrial control traffic, the method further includes: The messages in the target industrial control traffic are divided into layer 2 messages and layer 3 messages.

5. The abnormal flow detection method according to claim 2, characterized in that: Determining the system manufacturer and the system version number according to the application layer protocol specifically includes: According to the application layer protocol, the corresponding callback function is called to perform deep message analysis to determine the system manufacturer and the system version number.

6. The abnormal flow detection method according to claim 3, characterized in that: Determining the system manufacturer and the system version number according to the Ethernet protocol number specifically includes: Determine the Ethernet protocol type according to the Ethernet protocol number; According to the Ethernet protocol type, the corresponding callback function is called to perform deep message analysis to determine the system manufacturer and the system version number.

7. An abnormal flow detection system, characterized in that: The system comprises: A target industrial control traffic acquisition module is used to acquire target industrial control traffic; the target industrial control traffic is the traffic flowing into the industrial control firewall; A first parsing module is used to parse the three-layer message in the target industrial control traffic to obtain multiple first source data groups of the target industrial control traffic; one of the three-layer messages corresponds to one of the first source data groups; the first source data group includes: the interface name, MAC address, IP address, port number, transport layer protocol, application layer protocol, traffic rate, system manufacturer and system version number of the industrial control firewall; A second parsing module is used to parse the layer 2 message in the target industrial control traffic to obtain multiple second source data groups of the target industrial control traffic; one layer 2 message corresponds to one second source data group; the second source data group includes: the interface name, MAC address, Ethernet protocol number, system manufacturer and system version number of the industrial control firewall; An asset entry determination module, configured to classify and aggregate the data in all the first source data group and the second source data group according to the MAC address of the target industrial control traffic to obtain a plurality of asset entries; An application service set determination module, used to classify data with the same IP address as the target industrial control flow in the asset entry as application services, and obtain an application service set for the target industrial control flow; A to-be-matched data group determination module, configured to determine the first source data group, the second source data group, and the application service set of the target industrial control flow as the to-be-matched data group of the target industrial control flow; A judgment module, used to judge whether the matching factor in the deployed asset strategy is consistent with the data in the to-be-matched data group; the matching factor includes: one or more of the MAC address, IP address, interface name of the industrial control firewall, flow rate and application service set; A first execution module, configured to: if yes, the target industrial control flow is normal flow; A second execution module, for: if no, the target industrial control flow is abnormal flow; If the MAC address, IP address, or interface name of the industrial control firewall does not match a matching factor with the deployed asset policy, it is considered a mismatch, which is called an asset mismatch; if the traffic rate is not within the range of the minimum and maximum traffic rates of the deployed asset policy, it is called a traffic rate mismatch; if the application service is not in the application service list of the deployed asset policy, it is called an application service mismatch; asset mismatch, traffic rate mismatch, and application service mismatch are all asset policy matching failures, and the target industrial control traffic is identified as abnormal traffic. The abnormal traffic event is recorded and the cause of the event is recorded, whether the cause of the event is an asset mismatch, a traffic rate mismatch, or an application service mismatch.

8. An electronic device, characterized in that: include: one or more processors; a storage device having one or more programs stored thereon; When the one or more programs are executed by the one or more processors, the one or more processors are enabled to implement the method according to any one of claims 1 to 6.

9. A storage medium, characterized in that: A computer program is stored thereon, wherein when the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images