Industrial control network malicious code detection method, system, device and storage medium

Abstract

The application relates to an industrial control network malicious code detection method, system, device and storage medium, which comprises the following steps: performing static security detection on files restored from local traffic and files submitted by a terminal security system based on an edge side platform; the edge side platform forms a dynamic strategy from the dimensions of file types, port risk degrees, security event occurrence risk values and to-be-sent data volumes, marks suspicious files by screening the files, and sends the suspicious files to a center side platform; the center side platform receives and stores the suspicious files reported by the edge side platform, detects the security of the suspicious files based on a sandbox, records the detection results in a sandbox detection result database; the center side platform analyzes abnormal behaviors based on the detection results of a sandbox detection cluster and a threat intelligence database, and sends security events to the edge side platform; the static features and dynamic sandbox detection technology are fused to improve the malicious code detection rate, the file transmission is optimized to reduce the bandwidth pressure, the resource utilization rate is improved in an intensive manner, and the calculation cost is reduced.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a method, system, and computer equipment for detecting malicious code in an industrial control network. Background Art

[0002] With the continuous advancement of new technologies, the application of the Industrial Internet has significantly increased, and security issues are becoming increasingly prominent. This is particularly true given the increasingly advanced and evolving nature of attacks on computer networks and industrial control systems. Virus propagation and damage are among the primary threats to industrial control networks. In recent years, ransomware has wreaked havoc, causing significant losses to affected businesses. Furthermore, organized hacker attacks are becoming increasingly frequent. Advanced persistent threat malware is highly stealthy, often employing encryption and packing to evade signature detection, allowing it to easily penetrate target networks and infect victim hosts.

[0003] At present, the technical solutions for malicious code detection related to industrial control network scenarios mainly include terminal virus detection technology represented by EDR (Endpoint Detection & Response), which can detect virus threats based on known feature detection and unknown threats based on abnormal behavior detection; the second is antivirus gateway technology, which generally uses network equipment to protect the security of network inbound and outbound data, and can perform file restoration and virus scanning mainly based on static feature detection for data of protocols such as HTTP, FTP, SMTP, IMAP; the third is sandbox detection technology, which provides a virtualized or simulated system environment for running programs, detects malicious code under isolated conditions, and can detect unknown threats based on behavior; the fourth is cloud detection technology, which mainly detects code behavior based on big data engine technology, artificial intelligence scanning technology, genetic detection technology, etc., and transfers files to cloud servers through the network for automatic analysis and processing, and returns the results to the client.

[0004] However, these detection methods are slow to update malicious code detection signature libraries for EDR (Endpoint Detection and Response) technology within closed industrial control networks, and the isolated network environment prevents the sharing of detection results. Antivirus gateways primarily use static signature detection, which is insufficient for detecting highly concealed malicious code. Malicious code such as APTs can evade detection through methods such as shelling and encryption. For sandbox detection technology, deploying dynamic sandboxes on each industrial control network is very expensive and difficult to maintain. Furthermore, due to the limited file transfer scenarios in industrial control production networks, the sandbox load is low, and computing resources are easily wasted. Traditional cloud-based detection methods face challenges such as the prohibition of internet access for monitoring devices and the poor file transfer performance of dedicated communication lines with narrow bandwidth (typically 5Mbps). Summary of the Invention

[0005] Based on this, the present application provides a method, system and computer equipment for detecting malicious code in industrial control networks, so as to improve the detection rate of malicious code by integrating static features and dynamic sandbox detection technology, optimize file transmission to reduce bandwidth pressure, improve resource utilization in an intensive manner, and reduce computing costs.

[0006] In the first aspect, the present application provides a method for detecting malicious code in an industrial control network, the method comprising: an edge-side platform performs static security detection on files restored from local traffic and files submitted by a terminal security system; the edge-side platform forms a dynamic strategy to detect and analyze files based on the dimensions of file type, port risk, risk value of security incident occurrence, and amount of data to be sent, filters and marks suspicious files, and sends the suspicious files to a central-side platform; the central-side platform receives and stores the suspicious files reported by the edge-side platform, detects the security of the suspicious files based on a sandbox detection cluster and a threat intelligence library, and records the detection results in a sandbox detection result library; the central-side platform analyzes abnormal behavior based on the detection results of the sandbox detection cluster and the threat intelligence library, and sends security events to the edge-side platform and other security platforms.

[0007] Optionally, the edge-side platform performs static security detection on files restored from local traffic and files submitted by the terminal security system, including: the edge-side platform sends the file to be detected to the virus detection module, the virus detection module detects malicious code based on static features, and calculates the hash value Hash_n of the file to be detected, and saves the detection result to the file information library; the edge-side platform reports the file information containing malicious code to the center-side platform.

[0008] Optionally, the edge-side platform forms a dynamic strategy to detect and analyze files from the dimensions of file type, port risk, security incident risk value, and amount of data to be sent, filters and marks suspicious files, and sends the suspicious files to the center-side platform, including: obtaining the file type of the suspicious file, establishing the suspicious file sending priority FP for the reported suspicious file according to the type based on a preset file priority table, the larger the corresponding value, the higher the priority; obtaining the port risk of the suspicious file, evaluating the risk PR of the port service involved in the transmission of the suspicious file, if the protocol standard port is used, the PR is 0, otherwise the PR is greater than 0; obtaining the security incident risk value of the suspicious file, checking the transmission of the suspicious file Whether the IP address involved has a recent security incident, its associated risk is set as CR. If an incident has occurred recently, calculate CR based on the interval between the current time and the time of the previous incident; obtain the amount of data c to be sent of the suspicious file, check the amount of data to be sent c, and calculate the suspicious file detection threshold DT based on the amount of data to be sent c; according to the time sequence of the suspicious file generation, add the priority FP corresponding to the file type of the suspicious file, the port risk, and the security incident risk value obtained by analysis and calculation, and subtract the amount of data to be sent to obtain the number set as the sending value; if the sending value is greater than 0, send the suspicious file to the central platform, otherwise, ignore the suspicious file.

[0009] Optionally, the edge-side platform forms a dynamic strategy from the dimensions of file type, port risk, security incident risk value, and amount of data to be sent to detect and analyze files, screen and mark suspicious files, and send the suspicious files to the central-side platform, further comprising: the edge-side platform uses a dynamic strategy to screen out the suspicious files and names them File_n with hash values, and queries from the file information library whether there is a hash value of a sent file that is equal to the hash value Hash_n of the suspicious file; if there is no equal hash value, the content of the main file File_n of the suspicious file is first sent to the central-side platform, and a record related to File_n is added to the file information library, and the record lifetime TTL is set; if there is an equal hash value, that is, the hash value of the historically sent file File_o is retrieved to be equal to Hash_n, then only the basic information of File_o and the basic information of File_n are sent to the central-side platform, and then the lifetime TTL of the corresponding record of File_o is updated.

[0010] Optionally, the central-side platform receives and stores the suspicious file reported by the edge-side platform, detects the security of the suspicious file based on the sandbox, and records the detection results in the sandbox detection result library, including: the central-side platform receives the suspicious file information sent by the edge-side platform, names the file with a hash value, and queries the file object repository for historical files to see whether there is a file with the same file name as the suspicious file information; if not, receives the main body file contained in the file information of the suspicious file, and stores the main body file in the file object repository with the hash value as the file name; if yes, does not process the suspicious file for storage.

[0011] Optionally, the central-side platform receives and stores the suspicious files reported by the edge-side platform, detects the security of the suspicious files based on the sandbox, and records the detection results in the sandbox detection result library. It also includes: receiving information of the file to be detected, and querying the sandbox detection result library based on the file named with the hash value; if there is no historical record, calling the idle sandbox in combination with the threat intelligence library to carry out detection, and recording the detection results to the sandbox detection result library, setting the lifetime TTL of the record; if there is a historical record, directly referencing the detection results of the historical record.

[0012] Optionally, the central-side platform analyzes abnormal behavior based on the detection results of the sandbox detection cluster and the threat intelligence library, and sends security events to the edge-side platform and other security components, including: the central-side platform analyzes abnormally propagated files based on big data statistics based on the detection results of the sandbox detection cluster and the threat intelligence library, records security events, and sends security events to the edge-side platform and other security platforms.

[0013] In the second aspect, the present application provides an industrial control network malicious code detection system, which includes: an edge-side static detection module: used for the edge-side platform to perform static security detection based on files restored from local traffic and files submitted by the terminal security system; an edge-side dynamic detection module: used for the edge-side platform to form a dynamic strategy from the dimensions of file type, port risk, security incident risk value, and amount of data to be sent to detect and analyze files, screen and mark suspicious files, and send the suspicious files to the central-side platform; a central-side detection module: used for the central-side platform to receive and store the suspicious files reported by the edge-side platform, detect the security of the suspicious files based on the sandbox detection cluster and the threat intelligence library, and record the detection results in the sandbox detection result library; a central-side feedback module: used for the central-side platform to analyze abnormal behavior based on the detection results of the sandbox detection cluster and the threat intelligence library, and send security events to the edge-side platform and other security platforms.

[0014] In a third aspect, the present application also provides a computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above-described method when executing the computer program.

[0015] In a fourth aspect, the present application also provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, the steps of the above-mentioned method are implemented.

[0016] This application has at least the following advantages:

[0017] According to the technical content provided by the embodiment of the present application, first of all, the edge-side platform receives files restored from local traffic and files submitted by the terminal security system, performs static detection through the virus detection module, and reports the detected suspicious files to the central-side platform. In addition, the edge-side platform also combines dynamic detection strategies to perform multi-dimensional detection on the reported files, screens out suspicious files more comprehensively and specifically, and uploads the suspicious files to the central-side platform. Before uploading, it is also possible to query whether there are historical files based on the hash value, thereby reducing dedicated line file transmission communication and saving communication resources. Then the communication module of the central-side platform receives the suspicious files sent by the edge-side platform, and searches and compares them with the file object repository to find out whether there are the same suspicious files. If there are the same files, there is no need to detect again, and the historical results can be directly queried to reduce the detection pressure.

[0018] The sandbox detection cluster receives the file information to be detected sent by the communication module, and queries the sandbox detection result library based on the file hash value. If there is no historical record, it calls the idle sandbox in combination with the threat intelligence library to perform detection, and records the detection results in the sandbox detection result library, setting the record's lifetime TTL; if there is a historical record, it directly references the detection results of the historical record. The central platform retrieves and references recent detection results through file hash values ​​to reduce the sandbox computing pressure. The threat analysis module receives the detection results of the sandbox detection cluster combined with the threat intelligence library, analyzes abnormally propagated files based on big data statistics, records security events in the security event library, and sends security events to the edge platform and other security platforms, thereby enabling the edge platform and the central platform to collaboratively carry out malicious code detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 A diagram showing an application environment of a method for detecting malicious code in an industrial control network according to an embodiment;

[0020] Figure 2 A schematic diagram showing a flow chart of a method for detecting malicious code in an industrial control network according to an embodiment;

[0021] Figure 3A flowchart showing a method for detecting malicious code in an industrial control network according to an embodiment;

[0022] Figure 4 FIG2 is a flow chart showing step 201 in one embodiment;

[0023] Figure 5 FIG. 1 is a flow chart showing step 203 in one embodiment;

[0024] Figure 6 The figure shows a schematic structural diagram of a computer device in one embodiment. DETAILED DESCRIPTION

[0025] The present application will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not intended to limit the present application.

[0026] For ease of understanding, the system to which this application is applicable is first described. This application provides a method for detecting malicious code in an industrial control network, which can be applied to Figure 1 In the system architecture shown. The system includes: a user space file server 103 and a terminal device 101, and the terminal device 101 communicates with the user space file server 103 through the network. Among them, the user space file server 103 can be a file server based on the NFSv3\v4 protocol, running in a Linux environment, and NFS (Network File System) is a network abstraction above the file system, which allows remote clients running on the terminal device 101 to access through the network in a manner similar to the local file system. The terminal device 101 can be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, etc., and the user space file server 103 can be implemented with an independent server or a server cluster consisting of multiple servers.

[0027] Figure 2 A flowchart of a method for detecting malicious code in an industrial control network provided by an embodiment of the present application can be performed as follows: Figure 1 The user space file server is executed in the system shown. Figure 2 、 Figure 3 As shown, the method may include the following steps:

[0028] Step 201: The edge platform performs static security detection based on the files restored from local traffic and the files submitted by the terminal security system;

[0029] In this embodiment, it should be noted that the industrial control network malicious code detection system is divided into an edge-side platform and a central-side platform based on its functions. The edge-side platform is deployed locally in each industrial control network, such as the production area or management area of ​​a power station. The edge-side platform includes a file restoration module and a log collection module.

[0030] Before files need to be inspected, the edge-side platform first receives network traffic data collected from traffic collection devices, and then uses the file restoration module to analyze HTTP, FTP, SMTP, IMAP and other protocols from the traffic to extract and restore relevant file information. The log collection module receives logs reported by the EDR (Endpoint Detection and Response) system on each host or terminal, and extracts files that need further inspection for static security testing. The EDR system is terminal detection and response. EDR tools record a large number of terminal and network events and store these data locally on the terminal or in a cloud database. They perform IOC comparison, behavioral analysis and machine learning on these data to continuously analyze these data, identify threats, and respond quickly.

[0031] The edge-side platform also includes a virus detection module, which sends the restored files and files reported by the log collection module to the virus detection module for static security detection.

[0032] Step 203: The edge-side platform forms a dynamic strategy based on the file type, port risk, security incident risk value, and amount of data to be sent to detect and analyze the files, screen and mark suspicious files, and send the suspicious files to the center-side platform.

[0033] In this embodiment, it should be noted that the edge-side platform performs a multi-dimensional assessment based on the acquired file type, port risk, security incident risk value, amount of data to be sent, etc., and analyzes and evaluates the acquired files through the above dimensions according to a specific algorithm, thereby dynamically screening out suspicious files.

[0034] Reference Figure 2 、 Figure 3 As shown, step 205: the central side platform receives and stores the suspicious file reported by the edge side platform, detects the security of the suspicious file based on the sandbox, and records the detection result in the sandbox detection result library;

[0035] In this embodiment, it should be noted that the malicious code detection system based on the industrial control network is divided into an edge-side platform and a center-side platform according to its function, and the center-side platform is centrally deployed in a remote center. Both the center-side platform and the edge-side platform include a communication module, which enables the center-side platform and the edge-side platform to communicate with each other through a dedicated line. The center-side platform also includes a sandbox detection cluster and a sandbox detection result library. The sandbox detection cluster is used to perform security detection on suspicious files sent by the edge-side platform and save the detection results in the sandbox detection result library. Among them, the sandbox (Sandboxie), also known as a sandbox or sandbox, is a virtual system program. In the field of computer security, it is a security mechanism that provides an isolated environment for running programs. In network security, a sandbox refers to a tool used to test untrusted, destructive, or program behaviors that cannot determine the program's intention in an isolated environment.

[0036] Step 207: The central platform analyzes abnormal behavior based on the detection results of the sandbox detection cluster and the threat intelligence library, and sends security events to the edge platform and other security platforms;

[0037] In this embodiment, it should be noted that the central platform also includes a threat intelligence library. This platform uses a sandbox detection cluster in conjunction with the threat intelligence library to detect suspicious files. Threat intelligence is a data-based approach that predicts upcoming attacks on an organization. By combining the sandbox detection cluster with the threat intelligence library, suspicious files can be tested for security, enabling more comprehensive and secure detection. After detection, security events are generated and sent to the corresponding edge platform or other security platform.

[0038] Reference Figure 2 、 Figure 4 As shown, in some embodiments, in step 201, the edge-side platform performs static security detection based on the files restored from local traffic and the files submitted by the terminal security system, specifically including:

[0039] Step 2011: The edge platform sends the file to be detected to the virus detection module. The virus detection module detects malicious code based on static features, calculates the hash value Hash_n of the file to be detected, and saves the detection result to the file information library.

[0040] Step 2012: The edge-side platform reports the file information containing malicious code to the central-side platform.

[0041] In this embodiment, it should be noted that static feature detection refers to malicious code detection technology based on static content analysis. Here, the file to be tested is first checked for feature codes to determine whether it contains malicious file information. During static detection, the file's hash value, Hash_n, is also detected, the detection results are saved to a file information repository, and the detected file information containing malicious code is uploaded to the central platform. Saving the detection results to the file information repository constructs a comparison library, allowing subsequent receipt of the same file to directly reference the saved historical files, thereby reducing communication pressure.

[0042] Reference Figure 2 、 Figure 5 As shown, in some embodiments, in step 203, the edge-side platform forms a dynamic strategy based on the file type, port risk, security incident risk value, and amount of data to be sent to detect and analyze the file, filter and mark suspicious files, and send the suspicious files to the central-side platform, specifically including:

[0043] Step 2031: Obtain the file type of the suspicious file, and determine the sending priority FP of the suspicious file according to the type of the reported suspicious file based on a preset file priority table. The larger the corresponding value, the higher the priority.

[0044] Step 2032: Obtain the port risk of the suspicious file and evaluate the risk PR of the port service involved in the transmission of the suspicious file. If a standard protocol port is used, the PR is 0; otherwise, the PR is greater than 0.

[0045] Step 2033: Obtain the security incident risk value of the suspicious file, check whether the IP address involved in the suspicious file transmission has recently experienced a security incident, and set its associated risk as CR. If there is an incident recently, calculate the CR based on the interval between the current time and the time of the previous incident;

[0046] Step 2034: Obtain the amount of data to be sent c of the suspicious file, check the amount of data to be sent c, and calculate the suspicious file detection threshold DT based on the amount of data to be sent c;

[0047] Step 2035: Based on the generation time sequence of the suspicious files, the priority FP corresponding to the file type of the suspicious files, the port risk, and the security incident risk value obtained by analysis and calculation are added and subtracted from the amount of data to be sent, and the result is set as the sending value.

[0048] In the embodiment, it is necessary to explain that the file type of the suspicious file is acquired, and the suspicious file sending priority FP is established based on the preset file priority table according to the type of the reported suspicious file. For example, the preset file priority table includes the file type and different priorities FP corresponding to different file types. Here, the file type can be Bin executable file, dynamic library, script, Word, PPT, PDF, Zip, and other, and the corresponding priorities FP are 9.0, 8.5, 9.0, 8.0, 7.0, 7.0, 7.5, and 4.0, respectively.

[0049] The port risk degree of the suspicious file is acquired, and the risk PR of the port service involved in the transmission of the suspicious file is evaluated. The risk PR is 0 if the protocol standard port is used, and the risk PR is greater than 0 if the non-standard port is used.

[0050] The security event occurrence risk value of the suspicious file is acquired, and the associated risk CR is set. If there is a recent event, the CR is calculated based on the interval between the current time and the last event occurrence time. The specific calculation formula is CR(t) = CR0 x e-αt, where t represents the interval (seconds) between the current time and the last event occurrence time, a is the exponential decay constant, and CR0 represents the risk value at the last event occurrence time.

[0051] The to-be-sent data amount c of the suspicious file is acquired, and the to-be-sent data amount c is checked. Based on the to-be-sent data amount c, the suspicious file detection threshold DT is calculated. Specifically, the to-be-sent data amount c is checked, and the detection threshold DT for judging whether the file can be sent is calculated. When the to-be-sent data amount c is less than or equal to the buffer capacity b, the DT is the basic threshold DT0. When c is greater than b, the DT calculation formula is DT(c) = DT0 + W x (1-e-α(c-b)), where the data amount unit is MB, a represents the decay constant, and W represents the maximum DT floating value.

[0052] According to the time sequence of the suspicious file, the priority FP corresponding to the file type of the suspicious file, the port risk degree, and the security event occurrence risk value calculated by analysis are added and subtracted from the number obtained by the to-be-sent data amount to obtain the sending value. The specific formula is R = FP + PR + CR - DT, where FP represents the priority corresponding to the file type, PR represents the corresponding service port risk value, CR represents the corresponding IP address associated risk, that is, the security event occurrence risk value, and DT represents the detection threshold. R is calculated by the calculation formula. When R is greater than 0, the file is sent to the central side platform, otherwise the file is ignored.

[0053] By obtaining the file type, port risk, security incident risk value, and amount of data to be sent from multiple dimensions, a dynamic strategy is formed to determine whether to upload suspicious files to the central platform, so as to screen and inspect the files more comprehensively and as much as possible to ensure the accuracy of detection.

[0054] Reference Figure 2 、 Figure 3 As shown, in some embodiments, step 203, the edge-side platform forms a dynamic strategy based on the file type, port risk, security incident risk value, and amount of data to be sent to detect and analyze the file, screen and mark suspicious files, and send the suspicious files to the central-side platform, further comprising:

[0055] The edge platform uses a dynamic strategy to filter out suspicious files and names them File_n based on their hash values. It then queries the file information database to see whether the hash value of a sent file is equal to the hash value Hash_n of the suspicious file.

[0056] If there is no equal hash value, the suspicious file's main body file File_n content is first sent to the central platform, and a record related to File_n is added to the file information library, and the record expiration time TTL is set;

[0057] If there are equal hash values, that is, the hash value of the historically sent file File_o is retrieved to be equal to Hash_n, then only the basic information of File_o and File_n will be sent to the central platform, and then the TTL of the corresponding record of File_o will be updated.

[0058] In this embodiment, it should be noted that by naming the filtered suspicious files with hash values, a unified naming convention is established, facilitating the recording and management of suspicious files. After a new suspicious file is filtered out and named with the hash value, a search is performed in the file information library to see if there is an identical file name. If no identical file name exists, indicating that this is the first time the file has been received and detected, the file is recorded in the file information library, updated, and sent to the central platform. If an identical file name exists, indicating that the same file has been received before, the previous file is used as the reference, and the file text does not need to be sent to the central platform again, thereby reducing communication resources.

[0059] In some embodiments, step 205, the central-side platform receives and stores the suspicious file reported by the edge-side platform, detects the security of the suspicious file based on the sandbox detection cluster and the threat intelligence library, and records the detection results in the sandbox detection result library, and also includes: the central-side platform receives the suspicious file information sent by the edge-side platform, names the file with a hash value, and queries the file object repository for historical files to see if there is a file with the same file name as the suspicious file information; if not, receives the main body file contained in the file information of the suspicious file, and stores the main body file in the file object repository with the hash value as the file name; if yes, does not process the suspicious file for storage.

[0060] For example, if the central platform receives a suspicious file with a hash value of Hash_3, it will name the suspicious file File_3 and search the central platform's file object repository for historical files. If no file with the same name as File_3 is found, the central platform will rename the original file of the received suspicious file using the hash value and update the file object repository. If a file with the same name as the suspicious file is found in the file object repository, the suspicious file will not be stored. The central platform uses file hash values ​​to retrieve and reference recent detection results to reduce the sandbox's computational pressure.

[0061] In addition, the sandbox detection cluster receives the file information to be detected sent by the communication module, and queries the sandbox detection result library based on the file hash value. If there is no historical record, the idle sandbox is called in combination with the threat intelligence library to carry out detection, and the detection results are recorded in the sandbox detection result library, and the record's lifetime TTL is set (for example, 24 hours); if there is a historical record, the detection results of the historical record are directly referenced.

[0062] In some embodiments, in step 207, the central-side platform analyzes abnormal behavior based on the detection results of the sandbox detection cluster and the threat intelligence library, and sends security events to the edge-side platform and other security components. Specifically, the central-side platform analyzes abnormally propagated files based on the detection results of the sandbox detection cluster and the threat intelligence library according to big data statistics, records security events, and sends security events to the edge-side platform and other security platforms.

[0063] In this embodiment, it should be noted that it also includes a threat analysis module and a security event library. The central side platform is built based on cloud computing technology, receives and stores files sent by the edge side platform, detects the security of suspicious files based on the sandbox detection cluster and combines it with the threat intelligence library, and eliminates duplicate detections by querying the sandbox detection result library in the cloud; and sends the detection results to the threat analysis module, analyzes abnormal behaviors based on big data, sends the detected security events to the security event library, and sends the security events to the edge side platform and other security platforms through the security event library.

[0064] The above steps primarily involve the edge platform receiving files restored from local traffic and submitted by the terminal security system, performing static detection through the virus detection module, and reporting suspicious files to the central platform. Furthermore, the edge platform combines dynamic detection strategies with multi-dimensional detection of reported files to filter out suspicious files and upload them to the central platform. Before uploading, the hash value can be used to query whether there are any historical files. If so, there is no need to receive the suspicious file's body information, thereby reducing dedicated line file transmission communications and conserving communication resources.

[0065] The communication module of the central platform receives suspicious files sent by the edge platform, and queries and compares them with the file object repository to find out whether there are identical suspicious files. If there are identical suspicious files, the files will not be put into the database; if not, the file object repository will be updated and sent to the sandbox detection cluster for detection.

[0066] The sandbox detection cluster receives the file information to be tested from the communication module and queries the sandbox detection results database based on the file hash value. If no historical records exist, it calls an idle sandbox and combines it with the threat intelligence database to perform detection. The detection results are recorded in the sandbox detection results database and a TTL (for example, 24 hours) is set for the record. If historical records exist, the detection results from the historical records are directly referenced. The central platform retrieves and references recent detection results based on file hash values ​​to reduce sandbox computing pressure.

[0067] The threat analysis module receives detection results from the sandbox detection cluster and the threat intelligence library. It then uses big data statistics to analyze abnormally transmitted files, records security events in the security event library, and transmits them to the edge platform and other security platforms. This enables the edge and central platforms to collaborate on malicious code detection.

[0068] This application also provides an industrial control network malicious code detection system, which can include: an edge-side static detection module, an edge-side dynamic detection module, a center-side detection module, and a center-side feedback module. The main functions of each component module are as follows:

[0069] The edge-side static detection module is used by the edge-side platform to perform static security detection based on files restored from local traffic and files submitted by the terminal security system;

[0070] The edge-side dynamic detection module is used for the edge-side platform to form a dynamic strategy to detect and analyze files based on the file type, port risk, security incident risk value, and the amount of data to be sent, filter and mark suspicious files, and send the suspicious files to the central-side platform;

[0071] A central-side detection module is configured to receive and store the suspicious files reported by the edge-side platform on the central-side platform, detect the security of the suspicious files based on the sandbox detection cluster and the threat intelligence library, and record the detection results in the sandbox detection result library;

[0072] The center-side feedback module is used for the center-side platform to analyze abnormal behaviors based on the detection results of the sandbox detection cluster and the threat intelligence library, and send security events to the edge-side platform and other security platforms.

[0073] According to an embodiment of the present application, the present application also provides a computer device and a computer-readable storage medium.

[0074] like Figure 6 , which is a block diagram of a computer device according to an embodiment of the present application. The term "computer device" is intended to refer to various forms of digital computers or mobile devices. Digital computers may include desktop computers, portable computers, workstations, personal digital assistants, servers, mainframe computers, and other suitable computers. Mobile devices may include tablet computers, smartphones, wearable devices, and the like.

[0075] like Figure 6 As shown, device 600 includes a computing unit 601, ROM 602, RAM 603, a bus 604, and an input / output (I / O) interface 605. Computing unit 601, ROM 602, and RAM 603 are connected to each other via bus 604. Input / output (I / O) interface 605 is also connected to bus 604.

[0076] The computing unit 601 can perform various processes in the method embodiment of the present application according to the computer instructions stored in the read-only memory (ROM) 602 or the computer instructions loaded from the storage unit 608 into the random access memory (RAM) 603. The computing unit 601 can be various general and / or special processing components with processing and computing capabilities. The computing unit 601 may include but is not limited to a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units for running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. In some embodiments, the method provided in the embodiment of the present application can be implemented as a computer software program, which is tangibly contained in a computer-readable storage medium, such as the storage unit 608.

[0077] The RAM 603 may also store various programs and data required for the operation of the device 600. Part or all of the computer program may be loaded and / or installed onto the device 600 via the ROM 602 and / or the communication unit 609.

[0078] The input unit 606, output unit 607, storage unit 608, and communication unit 609 in device 600 can be connected to I / O interface 605. Input unit 606 can be, for example, a keyboard, mouse, touch screen, microphone, etc.; output unit 607 can be, for example, a display, speaker, indicator light, etc. Device 600 can exchange information, data, etc. with other devices via communication unit 609.

[0079] It should be noted that the device may also include other components necessary for normal operation, or may only include components necessary for implementing the solution of this application, rather than all the components shown in the figure.

[0080] Various implementations of the systems and techniques described herein can be realized in digital electronic circuitry, integrated circuitry, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on a chip (SOCs), programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof.

[0081] The computer instructions for implementing the method of the present application can be written in any combination of one or more programming languages. These computer instructions can be provided to the computing unit 601, so that when the computer instructions are executed by the computing unit 601, such as a processor, the steps involved in the method embodiments of the present application are performed.

[0082] The computer-readable storage medium provided herein may be a tangible medium that may contain or store computer instructions for executing the steps involved in the method embodiments of the present application. The computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, and other forms of storage media.

[0083] The above specific embodiments do not constitute a limitation on the scope of protection of this application. Those skilled in the art will appreciate that various modifications, combinations, sub-combinations, and substitutions may be made based on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this application shall be included within the scope of protection of this application.

Claims

1. A method for detecting malicious code in an industrial control network, characterized in that: The method includes: The edge platform performs static security checks on files restored from local traffic and files submitted by the terminal security system, and reports information about files containing malicious code to the central platform. The edge-side platform forms a dynamic strategy based on file type, port risk, security incident risk value, and the amount of data to be sent to detect and analyze files, screen and mark suspicious files, and send the suspicious files to the central-side platform; The central platform receives and stores the suspicious file reported by the edge platform, detects the security of the suspicious file based on the sandbox, and records the detection result in the sandbox detection result library; The central platform analyzes abnormal behaviors based on the detection results of the sandbox detection cluster and the threat intelligence library, and sends security events to the edge platform and other security platforms; The edge platform forms a dynamic strategy to detect and analyze files based on file type, port risk, security incident risk value, and the amount of data to be sent, including: Obtaining the file type of the suspicious file, and determining the suspicious file sending priority FP for the reported suspicious file based on the type and a preset file priority table, where the larger the corresponding value, the higher the priority; Obtain the port risk of the suspicious file and evaluate the risk PR of the port service involved in the transmission of the suspicious file. If a standard protocol port is used, the PR is 0; otherwise, the PR is greater than 0. Obtain the security incident risk value of the suspicious file, check whether the IP address involved in the suspicious file transmission has recently experienced a security incident, and set its associated risk as CR. If there is an incident recently, calculate the CR based on the interval between the current time and the previous incident time; Obtaining the amount of data to be sent c of the suspicious file, checking the amount of data to be sent c, and calculating the suspicious file detection threshold DT based on the amount of data to be sent c; The screening and marking of suspicious files and sending the suspicious files to the central platform include: According to the generation time sequence of the suspicious files, the priority FP corresponding to the file type of the suspicious files, the port risk, and the security incident occurrence risk value obtained by analysis and calculation are added together, and the amount of data to be sent is subtracted to obtain the value obtained as the sending value; If the sending value is greater than 0, the suspicious file is sent to the central platform; Otherwise, ignore the suspicious file.

2. The method for detecting malicious code in an industrial control network according to claim 1, wherein: The edge platform performs static security checks on files restored from local traffic and files submitted by the terminal security system, including: The edge platform sends the file to be detected to the virus detection module. The virus detection module detects malicious code based on static features, calculates the hash value Hash_n of the file to be detected, and saves the detection result to the file information library; The edge-side platform reports the file information containing malicious code to the center-side platform.

3. The method for detecting malicious code in an industrial control network according to claim 1, wherein: The edge-side platform forms a dynamic strategy based on file type, port risk, security incident risk value, and amount of data to be sent to detect and analyze files, screen and mark suspicious files, and send the suspicious files to the central-side platform, further comprising: The edge-side platform uses a dynamic strategy to filter out the suspicious file and names it as File_n based on the hash value, and queries the file information library to see whether there is a sent file with a hash value equal to the hash value Hash_n of the suspicious file; If there is no equal hash value, the content of the suspicious file File_n is first sent to the central platform, and a record related to File_n is added to the file information library, and the record expiration time TTL is set; If there is an equal hash value, that is, the hash value of the historically sent file File_o is retrieved to be equal to Hash_n, only the basic information of File_o and File_n is sent to the central platform, and then the TTL of the corresponding record of File_o is updated.

4. The method for detecting malicious code in an industrial control network according to claim 1, wherein: The central platform receives and stores the suspicious file reported by the edge platform, detects the security of the suspicious file based on the sandbox, and records the detection result in the sandbox detection result library, including: The central platform receives the suspicious file information sent by the edge platform, names the file with the hash value, and queries the file object repository for historical files to determine whether there is a file with the same file name as the suspicious file information; If not, receiving the body file included in the file information of the suspicious file, and storing the body file in the file object repository with the hash value as the file name; If so, the suspicious file will not be stored in the database.

5. The method for detecting malicious code in an industrial control network according to claim 4, wherein: The central platform receives and stores the suspicious file reported by the edge platform, detects the security of the suspicious file based on a sandbox, and records the detection result in a sandbox detection result library, further comprising: Receive the file information to be tested and query the sandbox detection result library based on the file named by the hash value. If there is no historical record, call the idle sandbox to perform detection in conjunction with the threat intelligence library, and record the detection result in the sandbox detection result library, setting the TTL of the record. If there is a historical record, the test result of the historical record is directly referenced.

6. The method for detecting malicious code in an industrial control network according to claim 5, wherein: The central platform analyzes abnormal behavior based on the detection results of the sandbox detection cluster and the threat intelligence library, and sends security events to the edge platform and other security platforms, including: The central platform analyzes abnormally propagated files based on the detection results of the sandbox detection cluster and the threat intelligence library according to big data statistics, records security incidents, and sends security incidents to the edge platform and other security platforms.

7. A system based on the method for detecting malicious code in an industrial control network according to any one of claims 1 to 6, characterized in that: The system comprises: The edge-side static detection module is used by the edge-side platform to perform static security detection on files restored from local traffic and files submitted by the terminal security system, and report file information containing malicious code to the central-side platform; The edge-side dynamic detection module is used for the edge-side platform to form a dynamic strategy to detect and analyze files based on the file type, port risk, security incident risk value, and amount of data to be sent, filter and mark suspicious files, and send the suspicious files to the central-side platform; A central-side detection module, configured to receive and store the suspicious files reported by the edge-side platform on the central-side platform, detect the security of the suspicious files based on a sandbox detection cluster and a threat intelligence library, and record the detection results based on a sandbox detection result library; The center-side feedback module is used for the center-side platform to analyze abnormal behaviors based on the detection results of the sandbox detection cluster and the threat intelligence library, and send security events to the edge-side platform and other security platforms.

8. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images