A method, device, equipment and medium for auditing private industrial control protocols

Abstract

The present application discloses a method, apparatus, device, and medium for auditing a private industrial control protocol, relating to the field of industrial control. The method comprises: obtaining a target data packet collected by bypassing traffic collection through a mirrored interface of an access switch, and transmitting the target data packet to a preset network intrusion detection system pre-configured with a private protocol, so that the preset network intrusion detection system decodes the target data packet, determines a target plug-in based on the target private protocol corresponding to the decoded data packet, and transmits the decoded data packet to a service engine using the target plug-in; uses the service engine to read the decoded data packet and determines a target data packet audit policy based on the data packet transmission mode of the decoded data packet; the data transmission mode is unidirectional or bidirectional; and the decoded data packet is audited based on the target private protocol and using the target data packet audit policy. The present invention can realize customized configuration and auditing of industrial control private protocols.

Description

Technical Field

[0001] The present invention relates to the field of industrial control, and in particular to an audit method, device, equipment and medium for a private industrial control protocol. Background Art

[0002] In industrial control equipment environments, general traffic auditing and testing typically targets publicly available industrial control protocols. However, some users utilize proprietary industrial control protocols for communication between their industrial control devices. Therefore, without a solution tailored to these requirements, these protocols cannot be audited or tested. However, due to the proprietary nature of these protocols, developers are often reluctant to provide their parsing specifications, allowing them to customize their own versions, out of concern for user privacy.

[0003] As can be seen from the above, in the process of auditing industrial control private protocols, how to provide a solution that is convenient for users to customize private protocols and facilitates auditing is a problem to be solved in this field. Summary of the Invention

[0004] In view of this, the purpose of the present invention is to provide a method, apparatus, device and medium for auditing private industrial control protocols, which can facilitate users to configure and audit private industrial control protocols. The specific scheme is as follows:

[0005] In a first aspect, this application discloses a method for auditing a private industrial control protocol, comprising:

[0006] Obtaining a target data packet collected by performing bypass traffic collection through a mirrored interface of an access switch, and transmitting the target data packet to a preset network intrusion detection system that has been pre-configured with a private protocol, so that the preset network intrusion detection system decodes the target data packet, determines a target plug-in based on a target private protocol corresponding to the decoded data packet, and transmits the decoded data packet to a service engine using the target plug-in;

[0007] The service engine is used to read the decoded data packet, and a target data packet audit strategy is determined based on the data packet transmission mode of the decoded data packet; the data transmission mode is unidirectional transmission or bidirectional transmission;

[0008] Based on the target private protocol, the decoded data packet is audited using a target data packet audit policy.

[0009] Optionally, before acquiring the target data packet collected by performing bypass traffic collection through the mirror interface of the access switch, the method further includes:

[0010] When the private protocol validation command is obtained, the received private protocol data is added to the configuration file of the preset network intrusion detection system, and the preset network intrusion detection system is restarted.

[0011] Optionally, before obtaining the private protocol validation command, adding the received private protocol data to a configuration file of a preset network intrusion detection system, and restarting the preset network intrusion detection system, the method further includes:

[0012] Receive private protocol configuration data through a preset protocol configuration interface; the private protocol configuration data includes a protocol name, a data packet transmission mode, a transport layer type, a destination port, a protocol feature code, a session identifier, parsed field information, and a flood attack frequency value; wherein the protocol name, the data packet transmission mode, the transport layer type, the destination port, and the parsed field are mandatory configuration items; the feature code, the session identifier, and the flood attack frequency value are optional configuration items;

[0013] receiving private protocol detection item data in the private protocol configuration data through the preset protocol configuration interface; the private protocol detection item data includes a target detection item and a detection condition corresponding to the target detection item;

[0014] A proprietary protocol is generated based on the proprietary protocol configuration data, the target detection item, and a detection condition corresponding to the target detection item.

[0015] Optionally, receive parsed field information through a preset protocol configuration interface, including:

[0016] The received value parsing format of the interface is ASCII string format, decimal unsigned integer format, hexadecimal format or bit format parsing field information through the preset protocol configuration interface;

[0017] Correspondingly, the receiving, through the preset protocol configuration interface, the private protocol detection item data in the private protocol configuration data includes:

[0018] The preset protocol configuration interface receives the filled-in value detection data of the parsed field information in the private protocol configuration data, and generates a detection condition corresponding to the parsed field information based on the filled-in value detection data.

[0019] Optionally, the process of auditing the decoded data packet based on the target private protocol and using a target data packet audit policy includes:

[0020] Determine the magnitude relationship between the current request packet sending frequency and the flood attack frequency value in the private protocol configuration data corresponding to the target private protocol;

[0021] If the current request packet sending frequency is greater than the flood attack frequency value in the private protocol configuration data corresponding to the target private protocol, a flood attack alarm is triggered, and the historical data request packets pre-cached in the preset database are released.

[0022] Optionally, the transmitting the decoded data packet to the service engine by using the target plug-in includes:

[0023] Using the target plug-in to store the decoded data packet into a preset shared memory;

[0024] Control the service engine to read the decoded data packet from the preset shared memory.

[0025] Optionally, determining the target data packet audit policy based on the data packet transmission mode of the decoded data packet includes:

[0026] Determining a data packet transmission mode for the decoded data packet;

[0027] If the data packet transmission mode of the decoded data packet is unidirectional transmission, auditing the decoded data packet using a preset audit method;

[0028] If the data packet transmission mode of the decoded data packet is bidirectional transmission, the session identifier in the decoded data packet is used to determine the data request packet corresponding to the decoded data packet, and then the decoded data packet and the data request packet are audited using a preset audit method.

[0029] In a second aspect, the present application discloses an audit device for a private industrial control protocol, comprising:

[0030] a data packet acquisition module, configured to acquire target data packets collected by performing bypass traffic collection via a mirrored interface of an access switch, and transmit the target data packets to a preset network intrusion detection system pre-configured with a private protocol, so that the preset network intrusion detection system decodes the target data packets, determines a target plug-in based on a target private protocol corresponding to the decoded data packets, and transmits the decoded data packets to a service engine using the target plug-in;

[0031] A service engine application module is configured to utilize the service engine to read the decoded data packet and determine a target data packet audit policy based on a data packet transmission mode of the decoded data packet; the data transmission mode is one-way transmission or two-way transmission;

[0032] The data packet audit module is used to audit the decoded data packet based on the target private protocol and using the target data packet audit policy.

[0033] In a third aspect, the present application discloses an electronic device, comprising:

[0034] Memory, used to store computer programs;

[0035] The processor is configured to execute the computer program to implement the aforementioned audit method for the private industrial control protocol.

[0036] In a fourth aspect, the present application discloses a computer storage medium for storing a computer program; wherein, when the computer program is executed by a processor, the steps of the audit method of the aforementioned disclosed private industrial control protocol are implemented.

[0037] This application first obtains the target data packet collected by the access switch mirror interface in a bypass traffic collection manner, and transmits the target data packet to a preset network intrusion detection system that has been pre-configured with a private protocol, so that the preset network intrusion detection system decodes the target data packet and determines the target plug-in based on the target private protocol corresponding to the decoded data packet, and uses the target plug-in to transmit the decoded data packet to the business engine; uses the business engine to read the decoded data packet, and determines the target data packet audit policy based on the data packet transmission mode of the decoded data packet; the data transmission mode is one-way transmission or two-way transmission; based on the target private protocol, the decoded data packet is audited using the target data packet audit policy. In this way, this embodiment determines the target plug-in for processing the data packet by the target private protocol corresponding to the decoded data packet in the preset network intrusion detection system that is pre-configured with a private protocol, and audits the traffic packet collected by the bypass traffic detection method using the business engine, thereby realizing custom configuration and custom auditing of the private protocol. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are merely embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0039] Figure 1 A flowchart of an audit method for a private industrial control protocol provided for this application;

[0040] Figure 2 A flowchart of a specific audit method for a private industrial control protocol provided for this application;

[0041] Figure 3 A schematic diagram of the audit process provided for this application;

[0042] Figure 4A diagram of the configuration process of a private protocol data provided by this application;

[0043] Figure 5 A schematic diagram of the structure of an audit device for a private industrial control protocol provided in this application;

[0044] Figure 6 A device connection diagram of an audit device for a private industrial control protocol provided by this application;

[0045] Figure 7 This is a structural diagram of an electronic device provided in this application. DETAILED DESCRIPTION

[0046] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0047] In the prior art, industrial control private protocols cannot be audited and tested. In this application, it is convenient for users to configure and audit industrial control private protocols.

[0048] The embodiment of the present invention discloses an audit method for a private industrial control protocol, see Figure 1 Said method comprises:

[0049] Step S11: Obtain target data packets collected by accessing the switch mirror interface in a bypass traffic collection manner, and transmit the target data packets to a preset network intrusion detection system that has been pre-configured with a private protocol, so that the preset network intrusion detection system decodes the target data packets and determines a target plug-in based on the target private protocol corresponding to the decoded data packets, and uses the target plug-in to transmit the decoded data packets to the service engine.

[0050] In the present invention, the service detection network port is connected to the switch mirror port of the user environment to collect bypass traffic. The present invention is suitable for bypass traffic auditing and detection of TCP (Transmission Control Protocol) and UDP (User Datagram Protocol).

[0051] Concrete, preset network intrusion detection system described in the present invention is preferably snort, the preset network intrusion detection system that is preconfigured with proprietary protocol is preferably the snort that is preconfigured with plug-in unit, each plug-in unit all represents the user to want a kind of proprietary protocol of customization audit and detection in the future, the user can carry out the configuration of proprietary protocol according to the preset protocol configuration interface, in each plug-in unit code, all identical default listening port 1024 is set, the plug-in unit does not carry out any parsing process in the message parsing callback function of request and response, only the payload (effective load) of message and the header message information of TCP or UDP are passed to the service engine by the mode of shared memory to go and process.The number of described plug-in unit can be provided with according to different application scenes, generally allows 5 proprietary protocols of user customization at most in the page, i.e. prefabricated 5 plug-ins.But technically speaking, the plug-in unit expansion based on snort is not restricted, so that more can be supported.

[0052] In this embodiment, before obtaining the target data packet collected by bypass traffic collection through the access switch mirror interface, it can also include: receiving private protocol configuration data through a preset protocol configuration interface; the private protocol configuration data includes a protocol name, a data packet transmission mode, a transport layer type, a destination port, a protocol feature code, a session identifier, parsing field information and a flood attack frequency value; wherein the protocol name, the data packet transmission mode, the transport layer type, the destination port, and the parsing field are mandatory configuration items; the feature code, the session identifier and the flood attack frequency value are optional configuration items; receiving private protocol detection item data in the private protocol configuration data through the preset protocol configuration interface; the private protocol detection item data includes a target detection item and a detection condition corresponding to the target detection item; and generating a private protocol based on the private protocol configuration data, the target detection item and the detection condition corresponding to the target detection item.

[0053] It is understood that when configuring a private protocol, the user may define the protocol's configuration data and detection item data. The configuration data may include:

[0054] 1. Protocol name: indicates the user's private protocol name;

[0055] 2. Data packet transmission mode: unidirectional transmission or bidirectional transmission, indicating whether the protocol has only request packets or request-response packets;

[0056] 3. Transport layer type: indicates whether the protocol communicates based on TCP or UDP or both TCP and UDP;

[0057] 4. Destination port: indicates the destination port sent from the client to the server during protocol communication;

[0058] 5. Protocol signature code: Indicates that the protocol message contains identifiable signature information, including:

[0059] Starting offset: indicates the byte offset calculated from the first byte of the payload as the starting address of the first byte of the signature value;

[0060] Length: indicates the length of the signature in bytes;

[0061] Value: represents the signature data, which can be expressed in decimal or hexadecimal format;

[0062] 6. Session Identifier (i.e., Session ID): Indicates whether a Modbus-like session ID exists in the request-response packet, including:

[0063] Starting offset: indicates the number of bytes calculated from the first byte of the payload as the starting address of the first byte of the session identifier

[0064] Length: Indicates the length in bytes of the session identifier value

[0065] Value: Indicates the session identification data, which can be expressed in decimal or hexadecimal format.

[0066] 7. Parsing Field 1: Indicates the fields that the user is concerned about and needs to be parsed, including:

[0067] Starting offset: Indicates the byte offset calculated from the first byte of the payload as the starting address of the first byte of the field value

[0068] Length: Indicates the length of the field value in bytes

[0069] Field name: indicates the fixed name of the field

[0070] Value parsing format: Indicates the parsing format of the field value. You can choose from the following 4 formats:

[0071] (1) ASCII (American Standard Code for Information Interchange) code string

[0072] (2) Decimal unsigned integer

[0073] (3) Hexadecimal

[0074] (4) Bit (0 or 1): Bit offset, which indicates the offset of the bit value from bit 0 when the bit is selected. For example, 2 indicates the second bit from bit 0 at the low address.

[0075] 8. Parsing field 2 to parsing field n: Same as parsing field 1

[0076] 9. Flood: Indicates that the user wants to detect the frequency of flood attacks on the protocol

[0077] It's important to note that in the above configuration data, the protocol name, packet transmission method, transport layer type, destination port, and parsing fields are mandatory; the signature code, session identifier, and flood attack frequency value are optional. It's understood that when configuring parsing fields, users must configure at least one parsing field, namely parsing field 1. Parsing fields 2 through n are optional and can be customized based on user preferences for different application scenarios.

[0078] In addition, the above configuration data can be described in the following Table 1:

[0079] Table 1

[0080]

[0081]

[0082] When configuring a private protocol, the user also defines detection item data of the protocol. The detection item data includes target detection items and detection conditions corresponding to the target detection items.

[0083] In one embodiment, when a protocol feature code is received through a preset protocol configuration interface, an instruction to use the protocol feature code as a target detection item can be received through the preset protocol configuration interface, and information indicating whether the protocol feature code needs to be verified during a data packet audit can be received. If information indicating that the protocol feature code needs to be verified during a data packet audit is received at this time, a detection condition is generated for comparing the protocol feature code in the data packet with the preset protocol feature code, and a risk alarm is thrown when the feature code values are inconsistent.

[0084] In a second embodiment, when a data packet transmission mode is received through a preset protocol configuration interface, an instruction to use the data packet transmission mode as a target detection item can be received through the preset protocol configuration interface, and a response packet configuration format can be accepted for characterizing whether the response packet retains the protocol feature code, session identifier and parsing field information when the data packet transmission mode is bidirectional transmission, and detection conditions corresponding to the data packet transmission mode can be generated based on the above-mentioned response packet configuration format.

[0085] In this embodiment, receiving parsed field information through a preset protocol configuration interface may include: receiving, through the preset protocol configuration interface, parsed field information in an ASCII string format, a decimal unsigned integer format, a hexadecimal format, or a bit format; correspondingly, receiving, through the preset protocol configuration interface, private protocol detection item data in the private protocol configuration data, may include: receiving, through the preset protocol configuration interface, filled-in value detection data of the parsed field information in the private protocol configuration data, and generating, based on the filled-in value detection data, a detection condition corresponding to the parsed field information. That is, in the third embodiment, when receiving, through the preset protocol configuration interface, parsed field information in an ASCII string format, a decimal unsigned integer format, a hexadecimal format, or a bit format, that is, when the user defines the parsed field information, a command to use the parsed field information as a target detection item may be received through the preset protocol configuration interface, and the filled-in value detection data corresponding to the parsed field information may be obtained, and then, based on the filled-in value detection data, a detection condition corresponding to the parsed field information may be generated. In a specific implementation, the target detection item can be received as a parsing field through the preset protocol configuration interface, and the filled-in value detection data with the value parsing format of "decimal unsigned integer format" can be received as "<", ">", "=", "!=", and a detection condition corresponding to the "decimal unsigned integer" can be generated; the filled-in value detection data with the value parsing format of "ASCII code string" can also be received as "include", "does not contain", and a detection condition corresponding to the "ASCII code string" can be generated; the filled-in value detection data with the value parsing format of "hexadecimal format" or "bit format" can also be received as "=", "!=", and a detection condition corresponding to the "hexadecimal format" and "bit format" can be generated.

[0086] The detection conditions generated at this time are used for subsequent data packet audits. If the above detection conditions are not met, a risk alarm is thrown.

[0087] That is, in the present invention, users can customize the private protocol through the preset protocol configuration interface. By configuring the target detection items in the private protocol configuration data, they can define the detection rules for subsequent data packet audits, thereby realizing customization of customized protocols and audit tests.

[0088] Step S12: using the service engine to read the decoded data packet, and determining the target data packet audit strategy based on the data packet transmission mode of the decoded data packet; the data transmission mode is unidirectional transmission or bidirectional transmission.

[0089] In this embodiment, the service engine is a pre-configured engine for reading decoded data packets and auditing the decoded data packets. Specifically, a target data packet audit policy is first determined based on the data packet transmission mode of the decoded data packets. If the data packet transmission mode of the decoded data packets is unidirectional transmission, the target data packet audit policy is determined to be the target data packet audit policy corresponding to the unidirectional transmission mode. If the data packet transmission mode of the decoded data packets is bidirectional transmission, the target data packet audit policy is determined to be the target data packet audit policy corresponding to the bidirectional transmission mode.

[0090] Step S13: Based on the target private protocol, the decoded data packet is audited using the target data packet audit policy.

[0091] In this embodiment, the process of auditing the decoded data packet based on the target private protocol and using the target data packet audit policy may include: judging the relationship between the current request packet sending frequency and the flood attack frequency value in the private protocol configuration data corresponding to the target private protocol; if the current request packet sending frequency is greater than the flood attack frequency value in the private protocol configuration data corresponding to the target private protocol, triggering a flood attack alarm and releasing the historical data request packet pre-cached in the preset database. In this embodiment, the private protocol pre-configured in the preset network intrusion detection system may contain a flood attack frequency value. When it does, during the data packet audit, the flood attack frequency value defined in the protocol and the current request packet sending frequency may be used to determine whether to issue a flood attack alarm and release the historical data request packet pre-cached in the preset database.

[0092] This embodiment solves the problems of difficult and cumbersome configuration of existing industrial control protocols. The device provides a preset protocol configuration interface to facilitate users to customize the configuration of private protocols, covering protocol communication processes with one-way or two-way data packet transmission modes, rich data types, and setting session IDs and flood attack detection frequencies; and this embodiment proposes to support the auditing and detection of multiple private protocols at the same time. From a technical point of view, there is no restriction on the plug-in extension based on snort and it can support multiple; and this embodiment proposes to support the auditing and detection of multiple fields, the data type of each field can be set differently, and it is not limited to the industrial control instruction function code, supports field comparison operators such as "=", "<">", "!=" and "contains", and implements conditional detection for different data types in the parsed field, including string type, integer type, hexadecimal number type, and bit data type; it can also detect whether the user's private protocol is under external flood attack based on the configured flood attack frequency.

[0093] This embodiment first obtains the target data packet collected by the access switch mirror interface in a bypass traffic collection manner, and transmits the target data packet to a preset network intrusion detection system that has been pre-configured with a private protocol, so that the preset network intrusion detection system decodes the target data packet and determines the target plug-in based on the target private protocol corresponding to the decoded data packet, and uses the target plug-in to transmit the decoded data packet to the service engine; uses the service engine to read the decoded data packet and determines the target data packet audit policy based on the data packet transmission mode of the decoded data packet; the data transmission mode is one-way transmission or two-way transmission; based on the target private protocol, the decoded data packet is audited using the target data packet audit policy. In this way, this embodiment determines the target plug-in for processing the data packet by using the target private protocol corresponding to the decoded data packet in the preset network intrusion detection system that is pre-configured with a private protocol, and audits the traffic packet collected by the bypass traffic detection method using the service engine, thereby realizing custom configuration and custom auditing of the private protocol.

[0094] Figure 2 A flowchart of a specific audit method for a private industrial control protocol provided in an embodiment of the present application.

[0095] See also Figure 2 As shown, the method includes:

[0096] Step S21: receiving private protocol configuration data through a preset protocol configuration interface.

[0097] In this embodiment, the private protocol configuration data includes a protocol name, a data packet transmission mode, a transport layer type, a destination port, a protocol feature code, a session identifier, parsing field information, and a flood attack frequency value; wherein the protocol name, the data packet transmission mode, the transport layer type, the destination port, and the parsing field are required configuration items; the feature code, the session identifier, and the flood attack frequency value are optional configuration items.

[0098] For a more specific processing procedure of step S21 , reference may be made to the corresponding contents disclosed in the aforementioned embodiments, which will not be described in detail here.

[0099] Step S22: receiving private protocol detection item data in the private protocol configuration data through the preset protocol configuration interface; the private protocol detection item data includes a target detection item and a detection condition corresponding to the target detection item.

[0100] For a more specific processing procedure of step S22, reference may be made to the corresponding contents disclosed in the aforementioned embodiments, which will not be described in detail here.

[0101] Step S23: Generate a private protocol based on the private protocol configuration data, the target detection item, and the detection condition corresponding to the target detection item.

[0102] For a more specific processing procedure of step S23, reference may be made to the corresponding contents disclosed in the aforementioned embodiment, which will not be described in detail here.

[0103] Step S24: When the private protocol validation command is obtained, the received private protocol data is added to the configuration file of the preset network intrusion detection system, and the preset network intrusion detection system is restarted.

[0104] It is understood that the private protocol data shown in this embodiment includes private protocol configuration data and private protocol detection item data. In this embodiment, the private protocol configured by the user will be stored in the MySQL database. After the user configures the customized audit and detection data of the private protocol on the page, the present invention provides a switch for the user to select. If the user wants to immediately take effect on the private protocol, the switch can be triggered. When the activation switch is triggered, the service engine will be notified to load the corresponding configuration data from the MySQL database. The service engine will add the key port information configured by the user in the MySQL database together with the plug-in name to the Snort configuration file and restart Snort at the same time. It is understood that the database storing the private protocol data includes but is not limited to the MySQL database.

[0105] Step S25: Obtain target data packets collected by accessing the switch mirror interface through bypass traffic collection, and transmit the target data packets to a preset network intrusion detection system that has been pre-configured with a private protocol, so that the preset network intrusion detection system decodes the target data packets and determines the target plug-in based on the target private protocol corresponding to the decoded data packets, and uses the target plug-in to transmit the decoded data packets to the service engine.

[0106] In this embodiment, the use of the target plug-in to transmit the decoded data packet to the business engine may include: using the target plug-in to store the decoded data packet in a preset shared memory; controlling the business engine to read the decoded data packet from the preset shared memory.

[0107] In this embodiment, when accessing a switch's mirrored interface for bypass traffic collection, in a specific implementation, when traffic is detected, it is first monitored by the collection engine. The collection engine can then pass the raw data packet to Snort via shared memory. Snort decodes the data packet, which contains TCP or UDP header information and IP header information. This data is then passed to the plug-in corresponding to the destination port within the Snort internal framework. Based on user configuration, the data packet flows to the added plug-in, which does not perform any parsing but simply passes the data packet to the service engine via shared memory. The service engine then reads the data from the shared memory.

[0108] Step S26: using the service engine to read the decoded data packet, and determining the target data packet audit strategy based on the data packet transmission mode of the decoded data packet; the data transmission mode is unidirectional transmission or bidirectional transmission.

[0109] In this embodiment, the target data packet audit strategy is determined based on the data packet transmission mode of the decoded data packet, which may include: determining the data packet transmission mode of the decoded data packet; if the data packet transmission mode of the decoded data packet is unidirectional transmission, auditing the decoded data packet using a preset audit method; if the data packet transmission mode of the decoded data packet is bidirectional transmission, determining the data request packet corresponding to the decoded data packet using the session identifier in the decoded data packet, and then auditing the decoded data packet and the data request packet using a preset audit method.

[0110] It will be appreciated that the present invention audits the decoded data packet based on the private protocol configuration data and private protocol detection item data in the target private protocol and utilizes the target data packet audit policy. Specifically, when the service engine parses the data based on the loaded private protocol configuration data and private protocol detection item data in the target private protocol, it simultaneously performs real-time audit analysis based on the user-configured detection rules during the parsing process.

[0111] Specifically, when the business engine parses and audits the data packet, it first detects whether the destination port is the port configured in the private protocol. If so, it parses the data according to the private protocol configuration data and private protocol detection item data in the loaded target private protocol. During the parsing process, it also performs real-time audit analysis according to the detection rules configured by the user.

[0112] like Figure 3As shown, in a specific implementation, in the process of parsing the data according to the private protocol configuration data and private protocol detection item data in the loaded target private protocol, it is first determined whether the target private protocol is set to check whether the protocol feature code match is required. If a match is required, the protocol feature code is parsed. If a match is required, it is determined whether the data packet transmission mode in the decoded data packet is bidirectional transmission. If so, the request packet will be cached in the business engine, and the corresponding request packet will be matched through the session identifier when the response packet arrives. After a successful match, a bidirectional parsing audit and real-time risk detection will be performed. In the process of bidirectional parsing audit and risk detection, the request packet and the response packet can be detected according to the target detection item pre-set in the target private protocol to see if they meet the detection conditions. If they meet, the request packet and the response packet will be audited and stored normally. If they do not meet, an error message alarm will be generated to characterize the parsed field information. If the data packet transmission mode in the decoded data packet is not bidirectional transmission, that is, unidirectional transmission, the request packet is directly detected according to the target detection items pre-set in the target private protocol to see whether the request packet meets the detection conditions. If it meets the conditions, the request packet and the response packet are audited and stored normally. If it does not meet the conditions, an error message alarm is generated to characterize the parsed field information. It can be understood that regardless of whether the decoded data packet is unidirectional or bidirectional, the sending frequency of the request packet can be compared with the flood attack frequency value in the target private protocol to determine whether a flood alarm is triggered. If triggered, all cached request packets are released at the same time. That is Figure 3 The process indicated by the dotted arrow is that the current processing process flows to another processing process concurrently while flowing to the next processing process.

[0113] Step S27: Based on the target private protocol, the decoded data packet is audited using the target data packet audit policy.

[0114] like Figure 4The present invention provides a schematic diagram of a configuration process for private protocol data. In the figure, a user configures private protocol configuration data and private protocol detection item data on a page according to the data in Table 1, and then stores the private protocol data in a database. After the user selects a switch on the page to trigger the private protocol, the service engine loads the private protocol data from the database, updates the Snort configuration file, and restarts Snort. Snort loads the corresponding plug-in and begins monitoring using the collection engine. After monitoring traffic, it outputs the value to Snort via shared memory. Snort, through the corresponding plug-in, outputs the information after decoding the TCP or UDP packet header to the service engine via shared memory. The service engine parses the traffic as required based on the user-configured private protocol detection item data and the target data packet audit policy. Traffic that does not trigger an alarm is stored normally, while traffic that does not trigger a corresponding alarm is triggered. The user can finally receive information or an alarm message on the page indicating that the audited data packet has been stored normally. This implements the process of user-defined private protocol and protocol audit testing.

[0115] See also Figure 5 As shown, the embodiment of the present application discloses an audit device for a private industrial control protocol, which may specifically include:

[0116] The data packet acquisition module 11 is configured to acquire target data packets collected by performing bypass traffic collection via a mirrored interface of an access switch, and transmit the target data packets to a preset network intrusion detection system pre-configured with a private protocol, so that the preset network intrusion detection system decodes the target data packets, determines a target plug-in based on a target private protocol corresponding to the decoded data packets, and transmits the decoded data packets to a service engine using the target plug-in;

[0117] The service engine application module 12 is configured to use the service engine to read the decoded data packet and determine a target data packet audit policy based on the data packet transmission mode of the decoded data packet; the data transmission mode is unidirectional transmission or bidirectional transmission;

[0118] The data packet audit module 13 is configured to audit the decoded data packet based on the target private protocol and using a target data packet audit policy.

[0119] Figure 6 This is a device connection diagram of the audit device for the private industrial control protocol proposed by the present invention. In the diagram, a switch or router can be connected to the device through a PLC (programmable logic controller) and a DCS (distributed control system). The service detection network port of this device is connected to the switch mirror port in the user environment for bypass traffic collection.

[0120] In this embodiment, the target data packet collected by the access switch mirror interface in a bypass traffic collection manner is first obtained, and the target data packet is transmitted to a preset network intrusion detection system that has been pre-configured with a private protocol, so that the preset network intrusion detection system decodes the target data packet and determines the target plug-in based on the target private protocol corresponding to the decoded data packet, and uses the target plug-in to transmit the decoded data packet to the service engine; the decoded data packet is read by the service engine, and the target data packet audit policy is determined based on the data packet transmission mode of the decoded data packet; the data transmission mode is one-way transmission or two-way transmission; based on the target private protocol, the decoded data packet is audited using the target data packet audit policy. In this way, this embodiment determines the target plug-in for processing the data packet by the target private protocol corresponding to the decoded data packet in the preset network intrusion detection system that is pre-configured with a private protocol, and audits the traffic packet collected by the bypass traffic detection method using the service engine, thereby realizing custom configuration and custom audit of the private protocol.

[0121] Furthermore, the embodiment of the present application also discloses an electronic device, Figure 7 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content in the diagram should not be considered as any limitation to the scope of application of the present application.

[0122] Figure 7 This is a schematic diagram of the structure of an electronic device 20 provided in an embodiment of the present application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a display 24, an input / output interface 25, a communication interface 26, and a communication bus 27. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps of the audit method for a private industrial control protocol disclosed in any of the aforementioned embodiments. Furthermore, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0123] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 26 can create a data transmission channel between the electronic device 20 and the external device. The communication protocol it follows is any communication protocol that can be applied to the technical solution of this application and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world. Its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0124] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, a magnetic disk, or an optical disk. The resources stored thereon may include an operating system 221, a computer program 222, and virtual machine data 223. The virtual machine data 223 may include various data. The storage method may be temporary storage or permanent storage.

[0125] The operating system 221 is used to manage and control the hardware devices on the electronic device 20 and the computer program 222, which can be Windows Server, NetWare, Unix, Linux, etc. In addition to including a computer program capable of implementing the audit method of the private industrial control protocol executed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 222 can further include computer programs capable of performing other specific tasks.

[0126] Furthermore, the present application also discloses a computer-readable storage medium, where the computer-readable storage medium includes a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a magnetic disk, or an optical disk, or any other form of storage medium known in the technical field. When the computer program is executed by a processor, the audit method for the aforementioned private industrial control protocol is implemented. For the specific steps of the method, reference can be made to the corresponding content disclosed in the aforementioned embodiments, and no further details will be given here.

[0127] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part description. Professionals can also further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented with electronic hardware, computer software or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0128] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0129] Finally, it should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or device comprising the element.

[0130] The above is a detailed introduction to the audit method, device, equipment, and storage medium of the private industrial control protocol provided by the present invention. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core ideas. At the same time, for general technical personnel in this field, based on the ideas of the present invention, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A method for auditing a private industrial control protocol, characterized in that: include: Obtaining a target data packet collected by performing bypass traffic collection through a mirrored interface of an access switch, and transmitting the target data packet to a preset network intrusion detection system that has been pre-configured with a private protocol, so that the preset network intrusion detection system decodes the target data packet, determines a target plug-in based on a target private protocol corresponding to the decoded data packet, and transmits the decoded data packet to a service engine using the target plug-in; Using the service engine to read the decoded data packet, and determining a target data packet audit strategy based on the data packet transmission mode of the decoded data packet; The data packet transmission mode is unidirectional transmission or bidirectional transmission; Based on the target private protocol, the decoded data packet is audited using a target data packet audit policy.

2. The audit method for a private industrial control protocol according to claim 1, characterized in that: Before acquiring the target data packet collected by the bypass traffic collection method through the mirror interface of the access switch, the method further includes: When the private protocol validation command is obtained, the received private protocol data is added to the configuration file of the preset network intrusion detection system, and the preset network intrusion detection system is restarted.

3. The audit method for a private industrial control protocol according to claim 2, characterized in that: When the private protocol validation command is obtained, the received private protocol data is added to a configuration file of a preset network intrusion detection system, and before the preset network intrusion detection system is restarted, the method further includes: Receive private protocol configuration data through a preset protocol configuration interface; the private protocol configuration data includes a protocol name, a data packet transmission mode, a transport layer type, a destination port, a protocol feature code, a session identifier, parsed field information, and a flood attack frequency value; wherein the protocol name, the data packet transmission mode, the transport layer type, the destination port, and the parsed field are mandatory configuration items; the feature code, the session identifier, and the flood attack frequency value are optional configuration items; receiving private protocol detection item data in the private protocol configuration data through the preset protocol configuration interface; the private protocol detection item data includes a target detection item and a detection condition corresponding to the target detection item; A proprietary protocol is generated based on the proprietary protocol configuration data, the target detection item, and a detection condition corresponding to the target detection item.

4. The audit method for a private industrial control protocol according to claim 3, characterized in that: Receive parsed field information through the preset protocol configuration interface, including: The received value parsing format of the interface is ASCII string format, decimal unsigned integer format, hexadecimal format or bit format parsing field information through the preset protocol configuration interface; Correspondingly, the receiving, through the preset protocol configuration interface, the private protocol detection item data in the private protocol configuration data includes: The preset protocol configuration interface receives the filled-in value detection data of the parsed field information in the private protocol configuration data, and generates a detection condition corresponding to the parsed field information based on the filled-in value detection data.

5. The audit method for a private industrial control protocol according to claim 1, characterized in that: The process of auditing the decoded data packet based on the target private protocol and using the target data packet audit policy includes: Determine the magnitude relationship between the current request packet sending frequency and the flood attack frequency value in the private protocol configuration data corresponding to the target private protocol; If the current request packet sending frequency is greater than the flood attack frequency value in the private protocol configuration data corresponding to the target private protocol, a flood attack alarm is triggered, and the historical data request packets pre-cached in the preset database are released.

6. The audit method for a private industrial control protocol according to claim 1, characterized in that: The step of transmitting the decoded data packet to the service engine by using the target plug-in includes: Using the target plug-in to store the decoded data packet into a preset shared memory; Control the service engine to read the decoded data packet from the preset shared memory.

7. The audit method for a private industrial control protocol according to any one of claims 1 to 6, characterized in that: The determining of the target data packet audit policy based on the data packet transmission mode of the decoded data packet includes: Determining a data packet transmission mode for the decoded data packet; If the data packet transmission mode of the decoded data packet is unidirectional transmission, auditing the decoded data packet using a preset audit method; If the data packet transmission mode of the decoded data packet is bidirectional transmission, the session identifier in the decoded data packet is used to determine the data request packet corresponding to the decoded data packet, and then the decoded data packet and the data request packet are audited using a preset audit method.

8. An audit device for a private industrial control protocol, characterized in that: include: a data packet acquisition module, configured to acquire target data packets collected by performing bypass traffic collection via a mirrored interface of an access switch, and transmit the target data packets to a preset network intrusion detection system pre-configured with a private protocol, so that the preset network intrusion detection system decodes the target data packets, determines a target plug-in based on a target private protocol corresponding to the decoded data packets, and transmits the decoded data packets to a service engine using the target plug-in; A service engine application module, configured to read the decoded data packet using the service engine and determine a target data packet audit policy based on a data packet transmission mode of the decoded data packet; The data packet transmission mode is unidirectional transmission or bidirectional transmission; The data packet audit module is used to audit the decoded data packet based on the target private protocol and using the target data packet audit policy.

9. An electronic device, characterized in that: The method comprises a processor and a memory; wherein, when the processor executes the computer program stored in the memory, the method for auditing the private industrial control protocol as claimed in any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium, characterized in that Used to store a computer program; wherein, when the computer program is executed by a processor, the audit method for a private industrial control protocol as described in any one of claims 1 to 7 is implemented.

Images