Industrial Control Network Traffic Processing Method, Device, Electronic Equipment and Storage Medium

Abstract

The present invention provides an industrial control network traffic processing method, apparatus, electronic device and storage medium. The method includes: obtaining a first query request; based on the association relationship determined in advance between the industrial control point table and the traffic log of the industrial control network, obtaining a first query result based on the first query request; wherein, the first query request includes information of a first industrial control point table, and the first query result includes a first traffic log; the first traffic log is associated with the first industrial control point table; or, the first query request includes information of a first traffic log, and the first query result includes a first industrial control point table. The industrial control network traffic processing method, apparatus, electronic device and storage medium provided by the present invention can realize bidirectional search between the industrial control point table and the traffic log through the association relationship determined in advance between the industrial control point table and the traffic log of the industrial control network, which helps to discover the internal relationship in the industrial control process.

Description

Technical Field

[0001] The present invention relates to the technical field of industrial control, and in particular, to an industrial control network traffic processing method, device, electronic device and storage medium. Background Art

[0002] Industrial data communication and control network, abbreviated as industrial control network, is a network technology in the field of automatic control developed in recent years, and is a product of the combination of computer network, communication technology and automatic control technology.

[0003] Generally, network security devices are set in industrial control networks, and the network security devices can isolate different systems. A typical network security device is an industrial firewall, and the industrial firewall can separate the production system, business system and industrial control system. Only industrial control network traffic that meets specific requirements is allowed to pass through the network security device to realize data transmission between different systems.

[0004] In the prior art, network security devices in industrial control networks can process (such as analyze and control) industrial control network traffic. However, this analysis and control process only involves the data contained in the industrial control network traffic itself. In fact, other types of information are also included in the industrial control system, such as the industrial control point table in the industrial control system. This makes the existing industrial control network traffic processing methods have problems of incomplete types of processed data and limited processing capabilities. Summary of the Invention

[0005] In view of the problems existing in the prior art, the present invention provides an industrial control network traffic processing method, device, electronic device and storage medium.

[0006] The present invention provides an industrial control network traffic processing method, including:

[0007] Obtain a first query request;

[0008] Based on the association relationship between the pre-determined industrial control point table and the traffic log of the industrial control network, obtain a first query result based on the first query request;

[0009] Wherein, the first query request includes information of a first industrial control point table, and the first query result includes a first traffic log; the first traffic log is associated with the first industrial control point table;

[0010] Or, the first query request includes information of a first traffic log, and the first query result includes a first industrial control point table.

[0011] According to an industrial control network traffic processing method provided by the present invention, the first traffic log is a traffic log related to a fault; correspondingly, the obtaining of the first query request includes:

[0012] Determine the first traffic log according to the traffic logs of the industrial control network;

[0013] The obtaining of the first query result based on the first query request according to the association relationship between the pre-determined industrial control point table and the traffic logs of the industrial control network includes:

[0014] Obtain the first industrial control point table based on the first query request according to the association relationship between the pre-determined industrial control point table and the traffic logs of the industrial control network;

[0015] Determine the points where faults occur according to the first industrial control point table.

[0016] According to an industrial control network traffic processing method provided by the present invention, before obtaining the first query result based on the first query request according to the association relationship between the pre-determined industrial control point table and the traffic logs of the industrial control network, the method further includes:

[0017] Establish the association relationship between the industrial control point table and the traffic logs of the industrial control network according to the information contained in the industrial control point table and the information contained in the traffic logs of the industrial control network;

[0018] Wherein, the information contained in the industrial control point table and the information contained in the traffic logs of the industrial control network both include one or a combination of the following information: operation method name, operation object, operation value, operation address.

[0019] According to an industrial control network traffic processing method provided by the present invention, the establishing of the association relationship between the industrial control point table and the traffic logs of the industrial control network according to the information contained in the industrial control point table and the information contained in the traffic logs of the industrial control network includes:

[0020] Determine that the information contained in the industrial control point table matches the information contained in the traffic log;

[0021] Save the identification information of the industrial control point table in the matching traffic log;

[0022] And save the identification information of the traffic log in the matching industrial control point table.

[0023] According to an industrial control network traffic processing method provided by the present invention, before establishing an association relationship between the industrial control point table and the traffic log of the industrial control network according to the information contained in the industrial control point table and the information contained in the traffic log of the industrial control network, the method further includes:

[0024] Filter the industrial control point table.

[0025] According to an industrial control network traffic processing method provided by the present invention, the method further includes:

[0026] Obtain a second query request;

[0027] According to the pre-determined association relationship between the industrial control point table and the control strategy of the industrial control network, obtain a second query result based on the second query request;

[0028] Wherein, the second query request includes information of a second industrial control point table, and the second query result includes an actual control strategy; the second industrial control point table is associated with the actual control strategy;

[0029] Or, the second query request includes information of an actual control strategy, and the second query result includes a second industrial control point table.

[0030] According to an industrial control network traffic processing method provided by the present invention, the second query request includes information of a second industrial control point table, and the second query result includes an actual control strategy;

[0031] After obtaining the second query result based on the second query request according to the pre-determined association relationship between the industrial control point table and the control strategy of the industrial control network, the method further includes:

[0032] Determine a theoretical control strategy corresponding to the second industrial control point table;

[0033] Compare the theoretical control strategy with the actual control strategy to determine the effectiveness of the actual control strategy corresponding to the second industrial control point table.

[0034] According to an industrial control network traffic processing method provided by the present invention, before obtaining the second query result based on the second query request according to the pre-determined association relationship between the industrial control point table and the control strategy of the industrial control network, the method further includes:

[0035] Establish an association relationship between the industrial control point table and the control strategy of the industrial control network according to the information contained in the industrial control point table and the information contained in the control strategy of the industrial control network;

[0036] Among them, the information included in the industrial control point table and the information included in the control strategy of the industrial control network both include one or a combination of the following information: operation method name, operation object, operation value, and operation address.

[0037] According to an industrial control network traffic processing method provided by the present invention, before establishing the association relationship between the industrial control point table and the control strategy of the industrial control network according to the information included in the industrial control point table and the information included in the control strategy of the industrial control network, the method further includes:

[0038] Filter the industrial control point table.

[0039] According to an industrial control network traffic processing method provided by the present invention, the control strategy of the industrial control network is any one or a combination of the following:

[0040] A strategy for determining the security of industrial control network traffic;

[0041] A strategy for releasing secure traffic in industrial control network traffic;

[0042] A strategy for intercepting insecure traffic in industrial control network traffic.

[0043] The present invention also provides an industrial control network traffic processing device, including:

[0044] A first query request acquisition module, configured to acquire a first query request;

[0045] A query module, configured to obtain a first query result based on the first query request according to the pre-determined association relationship between the industrial control point table and the traffic log of the industrial control network;

[0046] Among them, the first query request includes information of a first industrial control point table, and the first query result includes a first traffic log; the first traffic log is associated with the first industrial control point table;

[0047] Alternatively, the first query request includes information of a first traffic log, and the first query result includes a first industrial control point table.

[0048] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored on the memory and executable on the processor. When the processor executes the program, the steps of the industrial control network traffic processing method are implemented.

[0049] The present invention also provides a non-transitory computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the industrial control network traffic processing method are implemented.

[0050] The present invention also provides a computer program product, which includes computer-executable instructions that, when executed, are used to implement the steps of the industrial control network traffic processing method as described above.

[0051] The industrial control network traffic processing method, device, electronic device, and storage medium provided by the present invention can realize two-way lookup between the industrial control point table and the traffic log through the pre-determined association relationship between the industrial control point table and the traffic log of the industrial control network, which helps to discover the internal connections in the industrial control process. Description of the Drawings

[0052] To more clearly illustrate the technical solutions in the present invention or the prior art, the following will briefly introduce the drawings required for the description of the embodiments or the prior art. Obviously, the drawings in the following description are some embodiments of the present invention. For those of ordinary skill in the art, without creative efforts, other drawings can also be obtained based on these drawings.

[0053] Figure 1 is a flowchart of the industrial control network traffic processing method provided by the present invention;

[0054] Figure 2 is a schematic diagram of the industrial control network traffic processing device provided by the present invention;

[0055] Figure 3 is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Embodiments

[0056] To make the objectives, technical solutions, and advantages of the present invention clearer, the following will clearly and completely describe the technical solutions in the present invention with reference to the drawings in the present invention. Obviously, the described embodiments are some, but not all, of the embodiments of the present invention. Based on the embodiments in the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts belong to the scope of protection of the present invention.

[0057] The following combines Figures 1 - 3 to describe the industrial control network traffic processing method, device, electronic device, and storage medium of the present invention.

[0058] Figure 1 is a flowchart of the industrial control network traffic processing method provided by the present invention. As Figure 1 shown, the industrial control network traffic processing method provided by the present invention is applied to a network security device, and the method includes:

[0059] Step 101, obtain a first query request;

[0060] Step 102: Obtain a first query result based on the first query request according to the association relationship between the pre-determined industrial control point table and the traffic log of the industrial control network.

[0061] The traffic log of the industrial control network traffic records the basic traffic information of the industrial control network traffic, such as timestamp, source IP, destination IP, source port, destination port, incoming and outgoing traffic, etc., and also records the relevant information of the industrial control process, such as operation method, operation object, operation value, operation address, etc.

[0062] The industrial control point table in the industrial control network is the "command post" for operations in industrial control business. It is the key to business records, operations, and automation control.

[0063] The industrial control point table is a description of the operations performed on a certain address at a certain site in the industrial field. Generally speaking, an industrial control point table can describe all the devices in a site and the related operations on all the devices. There can be multiple sites in the industrial control network, so there can be multiple corresponding industrial control point tables.

[0064] The content of the entries in the industrial control point table is related to the industrial control protocol adopted in the industrial control network. If the types of industrial control protocols are different, there will be certain differences in the entries of the corresponding industrial control point tables. For example, when the industrial control protocol adopted by the industrial control system is the OPC protocol, the industrial control point table corresponding to the first site in the industrial control system is the industrial control point table X; when the industrial control protocol adopted by the industrial control system is the Modbus protocol, the industrial control point table corresponding to the first site in the industrial control system is the industrial control point table Y; there will be certain differences in the content of the entries between the industrial control point table X and the industrial control point table Y.

[0065] As an exemplary description, an industrial control point table may include the following entry content:

[0066] a. Description information, which is used to describe the operations to be performed by the devices in the site. For example, to measure the inlet pressure of the 1# incoming flowmeter.

[0067] b. Device type, which is used to describe the type information of the device. For example, the device type is Device3.

[0068] c. Operation program variable, which is used to describe the variable information involved in the operation program. For example, when measuring the inlet pressure of the 1# incoming flowmeter, the variable related to the operation of measuring the inlet pressure is the operation switch.

[0069] d. Operation object description, which is used to describe the specific type of the operation object. For example, when measuring the inlet pressure of the 1# incoming flowmeter, the object related to the operation of measuring the inlet pressure is the switch.

[0070] e. Point address information, which is used to describe the operation address of the actuator in the device. For example, 0x01 is the operation address of the switch.

[0071] f. Device address information, which is used to describe the IP address or MAC address of the device. The value of the device address information will vary depending on the industrial control protocol. For example, in general, the device address information is the IP address of the PLC or DCS system within the site; however, if the gateway can directly read the PLC information, the device address information includes the rack number, slot number, and port number; if using OPC protocol for communication, the device address information is the OPC Server name; if using Modbus protocol for communication, the device address information is the Modbus slave address.

[0072] g. Device port number / channel, which is used to describe the port number of the device or the information of the data channel adopted by the device, such as Channel3.

[0073] h. Data type, which is used to describe the data type of the program running in the device, such as string, bit, etc.

[0074] i. Data, which is used to describe the specific content of the data.

[0075] The industrial control point table can also include several custom columns, and the content in the custom columns can be extended according to the type of industrial control protocol and / or actual application requirements. For example, there can be three custom columns in the industrial control point table to describe the dump information. The first column is used to describe the dump task name, the second column is used to describe the table name, and the third column is used to describe the fields.

[0076] The industrial control point table with the above table item content is shown in Table 1 below:

[0077] Table 1

[0078]

[0079]

[0080] Due to different usage habits of different users and different types of industrial control protocols used by the devices within the site, the content of the custom columns in different industrial control point tables may vary. Table 2 is an example of an S7 industrial control point table.

[0081] Table 2

[0082]

[0083] In the prior art, the traffic logs of industrial control networks and the industrial control point tables are independent of each other. In the present invention, in view of the fact that certain entries in the traffic logs of industrial control networks are of the same type as certain entries in the industrial control point tables, and the values of the aforementioned same-type entries in some traffic logs are the same as the values of the aforementioned same-type entries in some industrial control point tables, an association relationship can be established in advance for these traffic logs and industrial control point tables.

[0084] For example, the identical information existing between the industrial control point table and the traffic logs of industrial control network traffic can be one or a combination of the following information: operation method name, operation object, operation value, operation address.

[0085] The above operation method, operation object, operation value, and operation address are abstract descriptions. In different industrial control protocols, there will be certain differences in the information contained in the industrial control network traffic / the information in the traffic logs. For example, in Opcda, the information is the method name and interface name; in Modbus, the information is the operation variable and address range; in S7, the information is the operation, register, address, area, and point type.

[0086] According to the pre-determined association relationship between the industrial control point table and the traffic logs of the industrial control network, the search for traffic logs based on the industrial control point table or the search for the industrial control point table based on the traffic logs can be realized.

[0087] Specifically, the information of the first industrial control point table can be set as the first query request. According to the association relationship between the industrial control point table and the traffic logs, the first query result can be obtained, and the first query result is the first traffic log related to the first industrial control point table.

[0088] Alternatively, the information of the first traffic log can be set as the first query request. According to the association relationship between the industrial control point table and the traffic logs, the first query result can be obtained, and the first query result is the first industrial control point table related to the first traffic log.

[0089] The industrial control network traffic processing method provided by the present invention can realize two-way search between the industrial control point table and the traffic logs through the pre-determined association relationship between the industrial control point table and the traffic logs of the industrial control network, which helps to discover the internal connections in the industrial control process and provides support for industrial control requirements such as fault location.

[0090] Based on any of the above embodiments, in this embodiment, the first traffic log is a traffic log related to a fault; correspondingly, the obtaining of the first query request includes:

[0091] Determine the first traffic log according to the traffic logs of the industrial control network;

[0092] Based on the correlation relationship between the pre-determined industrial control point table and the traffic logs of the industrial control network, obtaining a first query result based on the first query request, including:

[0093] According to the correlation relationship between the pre-determined industrial control point table and the traffic logs of the industrial control network, obtaining a first industrial control point table based on the first query request;

[0094] Determining the faulty points according to the first industrial control point table.

[0095] In this embodiment, a specific application scenario of the industrial control network traffic processing method is described.

[0096] When a fault occurs inside the industrial control network, by analyzing the data of the traffic logs of the industrial control network, the traffic logs related to the fault can be determined. In this embodiment, the traffic logs related to the fault are recorded as the first traffic logs.

[0097] Analyzing the data of the traffic logs of the industrial control network can be implemented by using existing technologies, such as the situation awareness technology in network security technology. In this embodiment, no further discussion is made on its specific implementation.

[0098] In this embodiment, a mapping has been pre-made between the industrial control point table and the traffic logs with a correlation relationship. According to the correlation relationship between the pre-determined industrial control point table and the traffic logs of the industrial control network, an industrial control point table associated with the first traffic logs can be determined for the first traffic logs, and then the faulty points can be found in this industrial control point table.

[0099] For example, according to the correlation relationship between the industrial control point table and the traffic logs, it can be determined that the industrial control point table related to the first traffic logs is the aforementioned Table 1. By searching in Table 1, it can be known that the faulty point is the switch with the point address of 0x01.

[0100] Optionally, after obtaining the first industrial control point table based on the first traffic logs, within a first time period, counting the number of times each point in the first industrial control point table matches the first traffic logs; then determining the points with the number of matching times greater than or equal to the first threshold as the faulty points.

[0101] In the aforementioned Table 1 and Table 2, only the relevant information of one point within the site is described. As common knowledge in the art, the number of points included in the industrial control point table can be more than one. Therefore, in an optional embodiment, the matching situation between each point in the first industrial control point table and the first traffic logs is counted.

[0102] The matching means that the specified information of the point is exactly the same as the specified information in the first traffic log. For example, if the specified information of a certain point includes PLC / DCS system information, point name, and point address, and the specified information in the first traffic log also includes these three items; if the values of these three items are all the same, then the point matches the first traffic log.

[0103] It should be noted that the first traffic log is dynamically changing, that is, as time goes by, the content of the first traffic log will continue to grow. Therefore, the number of matches between the point and the first traffic log will change over time. In this embodiment, it is necessary to count the matching situation within a fixed first time period as the basis for subsequent judgment. The first time period can be 15 minutes, 1 hour, 24 hours, one month, etc.

[0104] After obtaining the statistical result, the points with the number of matches greater than or equal to the first threshold are determined as the faulty points.

[0105] Previously, the matching situation between each point in the first industrial control point table and the first traffic log within the first time period has been obtained. To avoid accidental errors, the points with the number of matches greater than or equal to the first threshold are determined as the faulty points. The specific value of the first threshold can be set according to the actual situation. For example, it can be the number of matches of a point within one hour, one day, or one week, or other statistical methods, which are not limited in this embodiment.

[0106] The industrial control network traffic processing method provided by the present invention can find out the faulty points according to the traffic log of the industrial control network and the association relationship between the industrial control point table and the traffic log, and can realize the rapid positioning of the faulty points.

[0107] Based on any of the above embodiments, in this embodiment, before obtaining the first query result based on the first query request according to the association relationship between the pre-determined industrial control point table and the traffic log of the industrial control network, the method further includes:

[0108] Establish the association relationship between the industrial control point table and the traffic log of the industrial control network according to the information contained in the industrial control point table and the information contained in the traffic log of the industrial control network;

[0109] Among them, the information contained in the industrial control point table and the information contained in the traffic log of the industrial control network both include one or a combination of the following information: operation method name, operation object, operation value, operation address.

[0110] According to the definition of the industrial control point table and the traffic log of the industrial control network traffic, it can be known that there is the same information between the industrial control point table and the traffic log of the industrial control network traffic. The same information includes one or a combination of the following information: operation method name, operation object, operation value, operation address.

[0111] The above operation method, operation object, operation value, and operation address are abstract descriptions. In different industrial control protocols, there will be certain differences in the information contained in the industrial control network traffic / the information in the traffic log. For example, in Opcda, the information is the method name and interface name; in Modbus, the information is the operation variable and address range; in S7, the information is the operation, register, address, area, and point type.

[0112] In view of the same information existing between the industrial control point table and the traffic log of the industrial control network traffic, in this embodiment, an association relationship between the industrial control point table and the traffic log can be established according to the same information.

[0113] Specifically, it is determined that the information contained in the industrial control point table matches the information contained in the traffic log;

[0114] Save the identification information of the industrial control point table in the matching traffic log;

[0115] And save the identification information of the traffic log in the matching industrial control point table.

[0116] For example, set a separate column in the traffic log of the industrial control network traffic, and save the identification information of the relevant industrial control point table in this column, such as the name and storage address of the industrial control point table.

[0117] As a preferred implementation method, the identification information of the industrial control point table can also be the hyperlink relationship of the industrial control point table. For example, set a separate column in the traffic log, and save the hyperlink address information of the relevant industrial control point table in this column. When needed, it can jump to the corresponding industrial control point table based on the hyperlink address information of the industrial control point table saved in the traffic log.

[0118] Similarly, a separate table entry can be set in the industrial control point table, and the identification information of the relevant traffic log, such as the name and storage address of the traffic log, can be recorded in this table entry.

[0119] As a preferred implementation method, the identification information of the traffic log can also be the hyperlink address information of the traffic log.

[0120] The industrial control network traffic processing method provided by the present invention can create conditions for the rapid positioning of subsequent fault points by establishing an association relationship between the industrial control point table and the traffic log of the industrial control network.

[0121] Based on any of the above embodiments, in this embodiment, before establishing the association relationship between the industrial control point table and the traffic log of the industrial control network according to the information contained in the industrial control point table and the information contained in the traffic log of the industrial control network, the method further includes:

[0122] Filter the industrial control point table.

[0123] Before filtering the industrial control point table, the industrial control point table needs to be obtained first. In this embodiment, the industrial control point table can be obtained by file import. The imported file can be in the format of excel, txt, xml, json, etc. When importing the industrial control point table file, an overwriting import method (that is, deleting the original industrial control point table file and then importing a new industrial control point table file) or an appending import method (that is, adding a new industrial control point table file on the basis of the existing industrial control point table file) can be adopted. In this embodiment, no specific limitation is imposed on the import method.

[0124] In view of the fact that there may be redundancy, errors, etc. in the data in the industrial control point table, it is also necessary to filter the industrial control point table.

[0125] Filtering the industrial control point table may include the following situations:

[0126] a. Whether there are exactly the same industrial control point tables. If there are exactly the same industrial control point tables, the redundant industrial control point tables can be deleted;

[0127] b. Whether there are the same operation addresses of the same device. If so, the same content is merged;

[0128] c. Whether there are the same devices at different locations. If so, an error is reported and it is prompted whether to stop the modification or whether to ignore and continue;

[0129] d. Whether there are the same description information. If so, an error is reported and it is prompted whether to stop the modification or whether to ignore and continue.

[0130] When filtering the industrial control point table, some fields (columns) in the industrial control point table can also be selected for analysis in a custom manner according to requirements to determine the problem table items.

[0131] For example, in actual applications, "device type" and "device address information" are required. When filtering the industrial control point table, the "device type" table items and "device address information" table items in multiple industrial control point tables can be analyzed to determine whether there are problem table items in the multiple industrial control point tables.

[0132] The problem table entries can be completely duplicate entries. For example, the content of the "device address information" entry in an industrial control point table is the address range "001 - 010", and the content of the "device address information" entry in another industrial control point table is also the address range "001 - 010". These two entries belong to completely duplicate entries; they can also be entries containing redundancy. For example, the content of the "device address information" entry in an industrial control point table is the address range "001 - 010", and the content of the "device address information" entry in another industrial control point table is the address range "005 - 006". These two entries belong to entries containing redundancy; they can also be other types of problem table entries.

[0133] The industrial control network traffic processing method provided by the present invention can remove redundant and incorrect industrial control point tables by filtering the industrial control point tables, effectively reducing unnecessary computing overhead and saving computing resources.

[0134] Based on any of the above embodiments, in this embodiment, the method further includes:

[0135] Obtain a second query request;

[0136] Based on the association relationship between the pre-determined industrial control point table and the control strategy of the industrial control network, obtain a second query result based on the second query request;

[0137] Wherein, the second query request includes information of a second industrial control point table, and the second query result includes an actual control strategy; the second industrial control point table is associated with the actual control strategy;

[0138] Or, the second query request includes information of an actual control strategy, and the second query result includes a second industrial control point table.

[0139] The control strategy of the industrial control network traffic is used to determine whether to intercept the industrial control network traffic according to the information contained in the industrial control network traffic.

[0140] Specifically, the control strategy of the industrial control network is any one of the following or a combination thereof:

[0141] A strategy for determining the security of the industrial control network traffic;

[0142] A strategy for releasing the secure traffic in the industrial control network traffic;

[0143] A strategy for intercepting the insecure traffic in the industrial control network traffic.

[0144] For example, the whitelist mechanism is a typical control strategy. According to the whitelist, a network security device can determine which industrial control network traffic received is allowed to pass and which industrial control network traffic will be intercepted. In this embodiment, the control strategy actually used by the network security device is denoted as the actual control strategy to distinguish it from the theoretical control strategy described in subsequent embodiments.

[0145] The control strategy for industrial control network traffic can adopt the description method of "condition - conclusion". For example, the information contained in the industrial control network traffic is used as the condition, and allowing or intercepting is used as the conclusion. After receiving industrial control network traffic A, information is extracted from this network traffic A, and then the extracted information is compared with the "condition" in the control strategy. If the "condition" of a certain control strategy B is met, then the "conclusion" corresponding to this control strategy B is used as the basis to determine whether to intercept this industrial control network traffic.

[0146] The industrial control point table can not only establish an association relationship with the traffic log, but also establish an association relationship with the control strategy of the industrial control network. After establishing the association relationship, it is possible to implement the search for the actual control strategy based on the industrial control point table, or implement the search for the industrial control point table based on the actual control strategy.

[0147] The industrial control network traffic processing method provided by the present invention can realize the two - way search between the industrial control point table and the actual control strategy through the pre - determined association relationship between the industrial control point table and the control strategy of the industrial control network, which helps to discover the internal connections in the industrial control process and provides support for industrial control requirements such as the verification of the effectiveness of the control strategy.

[0148] Based on any of the above - mentioned embodiments, in this embodiment, the second query request includes the information of the second industrial control point table, and the second query result includes the actual control strategy;

[0149] After obtaining the second query result based on the second query request according to the pre - determined association relationship between the industrial control point table and the control strategy of the industrial control network, the method further includes:

[0150] Determine the theoretical control strategy corresponding to the second industrial control point table;

[0151] Compare the theoretical control strategy with the actual control strategy to determine the effectiveness of the actual control strategy corresponding to the second industrial control point table.

[0152] The control strategy for industrial control network traffic has various generation methods. For example, it can be generated by manual setting or by machine learning. However, no matter which generation method is used to generate the control strategy, its effectiveness needs to be verified.

[0153] In this embodiment, first, determine the theoretical control strategy corresponding to the second industrial control point table.

[0154] For example, according to the principle of industrial control, the operations described in the second industrial control point table should be allowed to pass. Therefore, the theoretical control strategy corresponding to this second industrial control point table should be a whitelist strategy.

[0155] Next, based on the pre-determined association relationship between the industrial control point table and the control strategy of the industrial control network, determine the actual control strategy corresponding to the second industrial control point table.

[0156] In this embodiment, the association relationship between the industrial control point table and the control strategy of the industrial control network has been determined in advance. Therefore, by looking up the association relationship, the actual control strategy corresponding to the second industrial control point table can be determined.

[0157] Finally, compare the theoretical control strategy with the actual control strategy to determine the effectiveness of the actual control strategy corresponding to the second industrial control point table.

[0158] For example, if the actual control strategy corresponding to the second industrial control point table is a whitelist strategy, which is consistent with the theoretical control strategy, it indicates that the actual control strategy corresponding to the second industrial control point table is effective. On the contrary, if the actual control strategy corresponding to the second industrial control point table is not a whitelist strategy, or there is no corresponding control strategy, then it indicates that the actual control strategy corresponding to the second industrial control point table is ineffective.

[0159] After determining the effectiveness of the actual control strategy, the actual control strategy can be further improved. For example, in the process of training the control strategy by using machine learning, the industrial control point table can be used as the training sample data; after obtaining the control strategy as the training result, determine whether the content of the industrial control point table that should be included theoretically is included in the control strategy. If not, it indicates that the training of the control strategy is insufficient, and continue training to adjust the content of the control strategy.

[0160] The industrial control network traffic processing method provided by the present invention can verify the effectiveness of the control strategy by comparing the actual control strategy of the industrial control point table with the theoretical control strategy, thereby improving the accuracy of the control strategy.

[0161] Based on any of the above embodiments, in this embodiment, before obtaining the second query result based on the second query request according to the pre-determined association relationship between the industrial control point table and the control strategy of the industrial control network, the method further includes:

[0162] Establish the association relationship between the industrial control point table and the control strategy of the industrial control network according to the information contained in the industrial control point table and the information contained in the control strategy of the industrial control network;

[0163] Among them, the information included in the industrial control point table and the information included in the control strategy of the industrial control network both include one or a combination of the following information: operation method name, operation object, operation value, operation address.

[0164] According to the definitions of the industrial control point table and the control strategy of the industrial control network traffic, it can be known that there is the same information between the industrial control point table and the control strategy of the industrial control network traffic. The same information includes one or a combination of the following information: operation method name, operation object, operation value, operation address.

[0165] The above operation method, operation object, operation value, and operation address are abstract descriptions. In different industrial control protocols, there will be certain differences in the information included in the industrial control network traffic / the information used as conditions in the control strategy. For example, in Opcda, the information is the method name and interface name; in Modbus, the information is the operation variable and address range; in S7, the information is the operation, register, address, area, and point type.

[0166] In view of the same information between the industrial control point table and the control strategy of the industrial control network traffic, in this embodiment, an association relationship between the industrial control point table and the control strategy can be established according to the same information.

[0167] For example, a certain control strategy is a whitelist strategy, which includes fields such as address, operation, location, and point address. The content of the address field is "172.24.21.4", the content of the operation field is "read", the content of the location field is "DB234", and the content of the point address field is "0x88". In a certain industrial control point table, the above fields also exist and the field contents are exactly the same. That is, there is the same information between the above industrial control point table and the above whitelist control strategy. Therefore, the two can be associated.

[0168] The specific process of establishing the association relationship is described in the previous embodiments, so it will not be repeated here.

[0169] The industrial control network traffic processing method provided by the present invention can create conditions for the subsequent verification of the control strategy by establishing an association relationship between the industrial control point table and the control strategy of the industrial control network.

[0170] Based on any of the above embodiments, in this embodiment, before establishing the association relationship between the industrial control point table and the control strategy of the industrial control network according to the information included in the industrial control point table and the information included in the control strategy of the industrial control network, the method further includes:

[0171] Filter the industrial control point table.

[0172] In the previous embodiments, the filtering process of the industrial control point table has been described in detail, so it will not be described repeatedly in this embodiment.

[0173] The industrial control network traffic processing method provided by the present invention can remove redundant and incorrect industrial control point tables by filtering the industrial control point table, effectively reducing unnecessary computing overhead and saving computing resources.

[0174] The industrial control network traffic processing device provided by the present invention will be described below. The industrial control network traffic processing device described below can be correspondingly referred to the industrial control network traffic processing method described above.

[0175] Figure 2 is a schematic diagram of the industrial control network traffic processing device provided by the present invention, as Figure 2 shown, the industrial control network traffic processing device provided by the present invention includes:

[0176] A first query request acquisition module 201, configured to acquire a first query request;

[0177] A query module 202, configured to obtain a first query result based on the first query request according to the association relationship determined in advance between the industrial control point table and the traffic log of the industrial control network;

[0178] Wherein, the first query request includes information of a first industrial control point table, and the first query result includes a first traffic log; the first traffic log is associated with the first industrial control point table;

[0179] Or, the first query request includes information of a first traffic log, and the first query result includes a first industrial control point table.

[0180] The industrial control network traffic processing device provided by the present invention can realize two-way lookup between the industrial control point table and the traffic log through the association relationship determined in advance between the industrial control point table and the traffic log of the industrial control network, which helps to discover the internal connection in the industrial control process and provides support for industrial control requirements such as fault location.

[0181] Based on any of the above embodiments, in this embodiment, the first traffic log is a traffic log related to a fault; correspondingly, the first query request acquisition module 201 is configured to:

[0182] Determine the first traffic log according to the traffic log of the industrial control network;

[0183] The query module 202 includes:

[0184] A query unit, configured to obtain a first industrial control point table based on the first query request according to the pre-determined association relationship between the industrial control point table and the traffic log of the industrial control network.

[0185] A fault point determination unit, configured to determine the points where faults occur according to the first industrial control point table.

[0186] The industrial control network traffic processing device provided by the present invention can find out the points where faults occur according to the traffic log of the industrial control network and the association relationship between the industrial control point table and the traffic log, and can realize the rapid positioning of the fault points.

[0187] Based on any of the above embodiments, in this embodiment, the device further includes:

[0188] A first association relationship establishment module, configured to establish an association relationship between the industrial control point table and the traffic log of the industrial control network according to the information included in the industrial control point table and the information included in the traffic log of the industrial control network.

[0189] Wherein, the information included in the industrial control point table and the information included in the traffic log of the industrial control network both include one or a combination of the following information: operation method name, operation object, operation value, operation address.

[0190] The industrial control network traffic processing device provided by the present invention can create conditions for the rapid positioning of subsequent fault points by establishing an association relationship between the industrial control point table and the traffic log of the industrial control network.

[0191] Based on any of the above embodiments, in this embodiment, the device further includes:

[0192] A filtering module, configured to filter the industrial control point table.

[0193] The industrial control network traffic processing device provided by the present invention can remove redundant and incorrect industrial control point tables by filtering the industrial control point table, can effectively reduce unnecessary computing overhead, and save computing resources.

[0194] Based on any of the above embodiments, in this embodiment, the device further includes:

[0195] A second query request acquisition module, configured to acquire a second query request.

[0196] A second query module, configured to obtain a second query result based on the second query request according to the pre-determined association relationship between the industrial control point table and the control strategy of the industrial control network.

[0197] Among them, the second query request includes information of a second industrial control point table, and the second query result includes an actual control strategy; the second industrial control point table is associated with the actual control strategy;

[0198] Or, the second query request includes information of an actual control strategy, and the second query result includes a second industrial control point table.

[0199] The industrial control network traffic processing device provided by the present invention can realize two-way search between an industrial control point table and an actual control strategy through the association relationship between the pre-determined industrial control point table and the control strategy of the industrial control network, which helps to discover the internal connection in the industrial control process and provides support for industrial control requirements such as verification of the effectiveness of the control strategy.

[0200] Based on any of the above embodiments, in this embodiment, the second query request includes information of a second industrial control point table, and the second query result includes an actual control strategy;

[0201] The device further includes:

[0202] A theoretical control strategy determination module, configured to determine a theoretical control strategy corresponding to the second industrial control point table;

[0203] An effectiveness judgment module, configured to compare the theoretical control strategy with the actual control strategy to determine the effectiveness of the actual control strategy corresponding to the second industrial control point table.

[0204] The industrial control network traffic processing device provided by the present invention can test the effectiveness of the control strategy by comparing the actual control strategy of the industrial control point table with the theoretical control strategy, thereby improving the accuracy of the control strategy.

[0205] Based on any of the above embodiments, in this embodiment, the device further includes:

[0206] A second association relationship establishment module, configured to establish an association relationship between the industrial control point table and the control strategy of the industrial control network according to the information included in the industrial control point table and the information included in the control strategy of the industrial control network;

[0207] Among them, the information included in the industrial control point table and the information included in the control strategy of the industrial control network both include one or a combination of the following information: operation method name, operation object, operation value, operation address.

[0208] The industrial control network traffic processing device provided by the present invention can create conditions for subsequent verification of the control strategy by establishing an association relationship between the industrial control point table and the control strategy of the industrial control network.

[0209] Figure 3It is a schematic structural diagram of the electronic device provided by the present invention. As Figure 3 shown, the electronic device may include: a processor 310, a communications interface 320, a memory 330, and a communication bus 340. Among them, the processor 310, the communications interface 320, and the memory 330 complete communication with each other through the communication bus 340. The processor 310 may call logic instructions in the memory 330 to execute an industrial control network traffic processing method, and the method includes:

[0210] Obtain a first query request;

[0211] According to the association relationship between the pre-determined industrial control point table and the traffic log of the industrial control network, obtain a first query result based on the first query request;

[0212] Among them, the first query request includes information of a first industrial control point table, and the first query result includes a first traffic log; the first traffic log is associated with the first industrial control point table;

[0213] Or, the first query request includes information of a first traffic log, and the first query result includes a first industrial control point table.

[0214] In addition, when the logic instructions in the above-mentioned memory 330 are implemented in the form of software functional units and sold or used as independent products, they may be stored in a computer-readable storage medium. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or a part of this technical solution, may be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in various embodiments of the present invention. The foregoing storage medium includes: various media such as USB flash drives, mobile hard disks, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), magnetic disks, or optical discs that can store program codes.

[0215] On the other hand, the present invention also provides a computer program product. The computer program product includes a computer program stored on a non-transitory computer-readable storage medium. The computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute the industrial control network traffic processing method provided by the above-mentioned various methods. The method includes:

[0216] Obtain a first query request;

[0217] Obtain a first query result based on the first query request according to the pre-determined association relationship between the industrial control point table and the traffic log of the industrial control network;

[0218] wherein, the first query request includes information of a first industrial control point table, and the first query result includes a first traffic log; the first traffic log is associated with the first industrial control point table;

[0219] or, the first query request includes information of a first traffic log, and the first query result includes a first industrial control point table.

[0220] In another aspect, the present invention also provides a non-transitory computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, it is configured to execute the industrial control network traffic processing method provided above, and the method includes:

[0221] Obtain a first query request;

[0222] Obtain a first query result based on the first query request according to the pre-determined association relationship between the industrial control point table and the traffic log of the industrial control network;

[0223] wherein, the first query request includes information of a first industrial control point table, and the first query result includes a first traffic log; the first traffic log is associated with the first industrial control point table;

[0224] or, the first query request includes information of a first traffic log, and the first query result includes a first industrial control point table.

[0225] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or may be distributed to multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment. Those of ordinary skill in the art can understand and implement it without creative efforts.

[0226] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on such an understanding, the essence of the above technical solution, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0227] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that they can still modify the technical solutions recorded in the foregoing embodiments, or perform equivalent replacements for some of the technical features; and these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. An industrial control network traffic processing method, characterized in that Including: Obtain a first query request; Based on the pre-determined association relationship between the industrial control point table and the traffic log of the industrial control network, obtain a first query result based on the first query request; Wherein, the first query request includes information of a first industrial control point table, and the first query result includes a first traffic log; the first traffic log is associated with the first industrial control point table; Or, the first query request includes information of a first traffic log, and the first query result includes a first industrial control point table; The obtaining the first query result based on the first query request according to the pre-determined association relationship between the industrial control point table and the traffic log of the industrial control network includes: In view of the same information existing between the industrial control point table and the traffic log of the industrial control network traffic, establish an association relationship between the industrial control point table and the traffic log according to the same information; Determine that the information contained in the industrial control point table matches the information contained in the traffic log, save the identification information of the industrial control point table in the matching traffic log, and save the identification information of the traffic log in the matching industrial control point table.

2. The industrial control network traffic processing method according to claim 1, wherein The first traffic log is a traffic log related to a fault; correspondingly, the obtaining the first query request includes: Determine a first traffic log according to the traffic log of the industrial control network; The obtaining the first query result based on the first query request according to the pre-determined association relationship between the industrial control point table and the traffic log of the industrial control network includes: Based on the pre-determined association relationship between the industrial control point table and the traffic log of the industrial control network, obtain a first industrial control point table based on the first query request; Determine the point where the fault occurs according to the first industrial control point table.

3. The industrial control network traffic processing method according to claim 1, wherein Before obtaining the first query result based on the first query request according to the pre-determined association relationship between the industrial control point table and the traffic log of the industrial control network, the method further includes: Establish an association relationship between the industrial control point table and the traffic log of the industrial control network according to the information contained in the industrial control point table and the information contained in the traffic log of the industrial control network; Wherein, the information contained in the industrial control point table and the information contained in the traffic log of the industrial control network both include one or a combination of the following information: operation method name, operation object, operation value, operation address.

4. The industrial control network traffic processing method according to claim 3, wherein The establishing the association relationship between the industrial control point table and the traffic log of the industrial control network according to the information contained in the industrial control point table and the information contained in the traffic log of the industrial control network includes: Determine that the information contained in the industrial control point table matches the information contained in the traffic log; Save the identification information of the industrial control point table in the matching traffic log; And save the identification information of the traffic log in the matching industrial control point table.

5. The industrial control network traffic processing method according to claim 3, characterized in that Before establishing the association relationship between the industrial control point table and the traffic log of the industrial control network according to the information contained in the industrial control point table and the information contained in the traffic log of the industrial control network, the method further includes: Filter the industrial control point table.

6. The industrial control network traffic processing method according to claim 1, characterized in that The method further includes: Obtain a second query request; Obtain a second query result based on the second query request according to the pre-determined association relationship between the industrial control point table and the control strategy of the industrial control network; Wherein, the second query request includes information of a second industrial control point table, and the second query result includes an actual control strategy; the second industrial control point table is associated with the actual control strategy; Or, the second query request includes information of the actual control strategy, and the second query result includes a second industrial control point table.

7. The industrial control network traffic processing method according to claim 6, characterized in that The second query request includes information of a second industrial control point table, and the second query result includes an actual control strategy; After obtaining the second query result based on the second query request according to the pre-determined association relationship between the industrial control point table and the control strategy of the industrial control network, the method further includes: Determine a theoretical control strategy corresponding to the second industrial control point table; Compare the theoretical control strategy with the actual control strategy to determine the effectiveness of the actual control strategy corresponding to the second industrial control point table.

8. The industrial control network traffic processing method according to claim 6, wherein Before obtaining the second query result based on the second query request according to the pre-determined association relationship between the industrial control point table and the control strategy of the industrial control network, the method further includes: Establish an association relationship between the industrial control point table and the control strategy of the industrial control network according to the information included in the industrial control point table and the information included in the control strategy of the industrial control network; Wherein, the information included in the industrial control point table and the information included in the control strategy of the industrial control network both include one or a combination of the following information: operation method name, operation object, operation value, operation address.

9. The industrial control network traffic processing method according to claim 8, wherein Before establishing the association relationship between the industrial control point table and the control strategy of the industrial control network according to the information included in the industrial control point table and the information included in the control strategy of the industrial control network, the method further includes: Filter the industrial control point table.

10. The industrial control network traffic processing method according to claim 6, wherein The control strategy of the industrial control network is any one or a combination of the following: A strategy for determining the security of industrial control network traffic; A strategy for allowing the safe traffic in the industrial control network traffic to pass through; A strategy for intercepting the insecure traffic in the industrial control network traffic.

11. An industrial control network traffic processing device, characterized in that, Includes: A first query request acquisition module, configured to acquire a first query request; A query module, configured to obtain a first query result based on the first query request according to the pre-determined association relationship between the industrial control point table and the traffic log of the industrial control network; Wherein, the first query request includes information of a first industrial control point table, and the first query result includes a first traffic log; the first traffic log is associated with the first industrial control point table; Or, the first query request includes information of the first traffic log, and the first query result includes a first industrial control point table, The obtaining the first query result based on the first query request according to the pre-determined association relationship between the industrial control point table and the traffic log of the industrial control network includes: In view of the same information existing between the industrial control point table and the traffic log of the industrial control network traffic, an association relationship between the industrial control point table and the traffic log is established according to the same information; It is determined that the information contained in the industrial control point table matches the information contained in the traffic log, the identification information of the industrial control point table is saved in the matching traffic log, and the identification information of the traffic log is saved in the matching industrial control point table.

12. An electronic device, comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, When the processor executes the program, the steps of the industrial control network traffic processing method according to any one of claims 1 to 10 are implemented.

13. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, the steps of the industrial control network traffic processing method according to any one of claims 1 to 10 are implemented.

14. A computer program product, the computer program product comprising computer-executable instructions, characterized in that, When the instruction is executed, it is used to implement the steps of the industrial control network traffic processing method according to any one of claims 1 to 10.

Images