A process behavior detection system and method

Abstract

This invention relates to a process behavior detection system and method. The process behavior detection system includes a target protocol data acquisition module, used to filter target protocol data corresponding to pre-collected protocol data based on target screening conditions; a process behavior baseline determination module, used to determine repeating protocol sequences in the target protocol data and use these repeating protocol sequences as the process behavior baseline; and a process behavior detection module, used to detect the data packets corresponding to the target process behavior based on the process behavior baseline to determine whether the target process behavior is correct. The technical solution of this invention uses repeating protocol sequences from the protocol data as the process behavior baseline, making the process behavior baseline establishment process more efficient, convenient, and accurate. Using the process behavior baseline to detect whether industrial facilities are operating according to correct process behavior can promptly alarm against erroneous process behavior, thereby improving the security of the industrial control system.

Description

Technical Field

[0001] This invention relates to the field of industrial control technology, and in particular to a process behavior detection system and method. Background Technology

[0002] Traditional industrial control relies on human intervention to operate industrial facilities. This requires workers with extensive experience, and subjective judgment during processes can lead to variations in product quality or other problems. Furthermore, operational errors can even threaten human safety. With the rapid development of computer technology and the internet, computer technology has found widespread application in industrial control, giving rise to industrial control systems. These systems are responsible for automating the operation of industrial infrastructure and managing processing routes, greatly facilitating people's production and daily lives.

[0003] Industrial facilities controlled by industrial control systems ensure they operate according to predetermined technological processes. When these facilities operate correctly, they not only improve work and production efficiency but also guarantee product quality. However, when the technological processes controlled by an industrial control system are tampered with, causing the facilities to operate incorrectly, it can lead to significant economic losses and potentially threaten employee safety. To address these issues, it is necessary to monitor industrial control systems using technological baselines to ensure their safe and stable operation. Existing methods for establishing technological baselines are difficult to implement manually and prone to errors; machine learning methods are also imperfect and have limited ability to detect protocol content.

[0004] Therefore, this invention is proposed to address the above shortcomings. Summary of the Invention

[0005] The technical problem to be solved by this invention is how to establish the correct process behavior in the field of industrial control as the process behavior baseline, and how to monitor the erroneous process behavior in a timely manner when errors occur. In view of the deficiencies in the prior art, this invention provides a process behavior detection system and method.

[0006] To address the aforementioned technical problems, embodiments of the present invention provide a process behavior detection system, comprising:

[0007] The target protocol data acquisition module is used to filter target protocol data corresponding to the target filtering conditions from the pre-collected protocol data based on the target filtering conditions.

[0008] A process behavior baseline determination module is used to determine the repeating protocol sequence in the target protocol data and use the repeating protocol sequence as the process behavior baseline.

[0009] The process behavior detection module is used to detect the data packets corresponding to the target process behavior based on the process behavior baseline, and to determine whether the target process behavior is correct.

[0010] According to the technical solution provided by the embodiments of the present invention, the process behavior baseline determination module is used to generate a preset number of tree structure branches based on the protocol operation detail fragments of the target protocol data. The protocol operation details of the target protocol data include the preset number of protocol operation detail fragments. If the preset number of tree structure branches are arranged in descending order of branch length, each tree structure branch has one less first protocol operation detail fragment than the previous tree structure branch. The longest tree structure branch contains the preset number of protocol operation detail fragments, and the shortest tree structure branch contains one protocol operation detail fragment. The first protocol operation detail fragment is the first protocol operation detail fragment in the previous tree structure branch.

[0011] A preset number of tree structure branches are stored in the tree structure. Based on the tree structure, the repetitive protocol operation detail fragments in the tree structure branches are determined, and at least one repetitive protocol operation detail fragment is used as the process behavior baseline.

[0012] According to the technical solution provided by the embodiments of the present invention, the process behavior detection system further includes a protocol details preprocessing module, which is used to delete unnecessary content in the protocol operation details of the target protocol data before determining the repeating protocol sequence in the target protocol data, so as to obtain preprocessed protocol operation details, wherein the unnecessary content is content unrelated to the protocol operation.

[0013] According to the technical solution provided by the embodiments of the present invention, the process behavior detection module is used to load the rule file corresponding to the process behavior baseline. The rule file includes basic information and key information of the process behavior baseline. The basic information includes the protocol name, server Internet Protocol address, client Internet Protocol address, and behavior timeout time. The key information includes a behavior list, which includes expected process behavior information.

[0014] The process behavior detection module uses a concurrent state machine model to classify the data packets into data streams and compares the classified data streams with the expected process behavior information for each step in the key information to determine whether the target process behavior is correct.

[0015] If the target process behavior is determined to be correct, the process behavior detection module controls the concurrent state machine model to enter the next process waiting for detection.

[0016] According to the technical solution provided in the embodiments of the present invention, the process behavior detection system further includes an early warning module, which is used to generate early warning information and send it to the host computer when it is determined that the target process behavior is incorrect.

[0017] According to the technical solution provided by the embodiments of the present invention, the target filtering conditions include the target protocol name and the target server Internet Protocol address.

[0018] According to the technical solution provided in the embodiments of the present invention, the process behavior detection system further includes a protocol data pre-collection module for pre-collecting protocol data, wherein the pre-collected protocol data includes the protocol name, the server Internet Protocol address, the client Internet Protocol address, and protocol operation details.

[0019] This invention also provides a method for detecting process behavior, executed by the process behavior detection system described in any of the above claims, the method comprising:

[0020] The target protocol data acquisition module filters target protocol data that corresponds to the target filtering conditions from the pre-collected protocol data based on the target filtering conditions;

[0021] The process behavior baseline determination module determines the repeating protocol sequence in the target protocol data and uses the repeating protocol sequence as the process behavior baseline.

[0022] The process behavior detection module detects the data packets corresponding to the target process behavior based on the process behavior baseline to determine whether the target process behavior is correct.

[0023] According to the technical solution provided by the embodiments of the present invention, the process behavior baseline determination module determines the repeating protocol sequence in the target protocol data and uses the repeating protocol sequence as the process behavior baseline, including:

[0024] The process behavior baseline determination module generates a preset number of tree structure branches based on the protocol operation detail fragments of the target protocol data. The protocol operation details of the target protocol data include the preset number of protocol operation detail fragments. If the preset number of tree structure branches are arranged in descending order of branch length, each tree structure branch has one less first protocol operation detail fragment than the previous tree structure branch. The longest tree structure branch contains the preset number of protocol operation detail fragments, and the shortest tree structure branch contains one protocol operation detail fragment. The first protocol operation detail fragment is the first protocol operation detail fragment in the previous tree structure branch.

[0025] A preset number of tree structure branches are stored in the tree structure. Based on the tree structure, the repetitive protocol operation detail fragments in the tree structure branches are determined, and at least one repetitive protocol operation detail fragment is used as the process behavior baseline.

[0026] According to the technical solution provided by the embodiments of the present invention, the process behavior baseline determination module determines the repeating protocol sequence in the target protocol data and uses the repeating protocol sequence as the process behavior baseline, including:

[0027] The process behavior detection module loads the rule file corresponding to the process behavior baseline. The rule file includes basic information and key information of the process behavior baseline. The basic information includes the protocol name, server Internet Protocol address, client Internet Protocol address, and behavior timeout time. The key information includes a list of behaviors, which includes expected process behavior information.

[0028] The data packets are classified using a concurrent state machine model, and the classified data stream is compared with the expected process behavior information for each step in the key information to determine whether the target process behavior is correct.

[0029] If the target process behavior is determined to be correct, the process behavior detection module controls the concurrent state machine model to enter the next process waiting for detection.

[0030] The process behavior detection system and method of the present invention have the following beneficial effects:

[0031] The system employs a target protocol data acquisition module to filter target protocol data from pre-collected protocol data based on target filtering conditions. A process behavior baseline determination module identifies repeating protocol sequences within the target protocol data and uses these sequences as the process behavior baseline. A process behavior detection module detects data packets corresponding to the target process behavior based on the process behavior baseline to determine the correctness of the target process behavior. This solution overcomes the problems of existing methods where tampering with the process behavior controlled by the industrial control system leads to significant losses due to incorrect process behavior in industrial facilities, and the difficulty and error-prone nature of existing process behavior baseline establishment methods. By using repeating protocol sequences from the protocol data as the process behavior baseline, the establishment process becomes more efficient, convenient, and accurate. Furthermore, by using the process behavior baseline to detect whether industrial facilities are operating according to correct process behavior, timely alarms and tracking can be initiated when errors occur, thereby improving the security of the industrial control system. This method can be widely applied to the security monitoring of various industrial control systems, effectively reducing losses caused by process behavior errors and enhancing the security of industrial control systems. Attached Figure Description

[0032] Figure 1 This is a schematic diagram of the structure of a process behavior detection system provided in Embodiment 1 of the present invention;

[0033] Figure 2 This is a schematic diagram of a tree structure provided in Embodiment 1 of the present invention;

[0034] Figure 3 This is a schematic flowchart of a process behavior detection method provided in Embodiment 2 of the present invention.

[0035] In the diagram: 1: Target protocol data acquisition module; 2: Process behavior baseline determination module; 3: Process behavior detection module. Detailed Implementation

[0036] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0037] Example 1

[0038] like Figure 1As shown, the process behavior detection system provided in this embodiment of the invention includes a target protocol data acquisition module 1, a process behavior baseline determination module 2, and a process behavior detection module 3. The target protocol data acquisition module 1 is used to filter target protocol data corresponding to the target filtering conditions from pre-collected protocol data based on target filtering conditions. The process behavior baseline determination module 2 is used to determine the repeating protocol sequences in the target protocol data and use the repeating protocol sequences as the process behavior baseline. The process behavior detection module 3 is used to detect the data packets corresponding to the target process behavior based on the process behavior baseline to determine whether the target process behavior is correct.

[0039] In this embodiment, the pre-collected protocol data consists of industrial control protocols generated during the process. These industrial control protocols include protocol names, server internet protocol addresses, client internet protocol addresses, and protocol operation details. The pre-collected protocol data can include protocol data with different protocol names, different server internet protocol addresses, different client internet protocol addresses, and different protocol operation details. Preferably, the process behavior detection system may include a protocol data pre-collection module, which is used to pre-collect protocol data, including protocol names, server internet protocol addresses, client internet protocol addresses, and protocol operation details.

[0040] The target filtering criteria can be determined based on the actual process behavior detection needs, that is, based on the process behavior to be detected. Preferably, the target filtering criteria can be the target protocol name and the target server Internet Protocol address, that is, according to the actual process behavior detection needs, target protocol data with the target protocol name and the target server Internet Protocol address are filtered out. For example, the target filtering criteria can also be the target protocol name, or the target protocol name, the target server Internet Protocol address, and the target client Internet Protocol address, etc. In this embodiment, the number of target protocol data obtained by filtering can be one or more. In this embodiment, the repeating protocol sequence is the protocol operation detail fragment in the protocol operation details of the target protocol data, and the number of repeating protocol sequences corresponding to each target protocol data can be one or more.

[0041] The process behavior detection system provided in this embodiment includes a target protocol data acquisition module, which filters target protocol data corresponding to target screening conditions from pre-collected protocol data; a process behavior baseline determination module, which identifies repeating protocol sequences in the target protocol data and uses these repeating protocol sequences as the process behavior baseline; and a process behavior detection module, which detects data packets corresponding to the target process behavior based on the process behavior baseline to determine whether the target process behavior is correct. This technical solution overcomes the problems of existing methods where tampering with the process behavior controlled by the industrial control system leads to significant losses due to incorrect process behavior in industrial facilities, and the difficulty and error-prone nature of existing process behavior baseline establishment methods. By using repeating protocol sequences in the protocol data as the process behavior baseline, the establishment process becomes more efficient, convenient, and accurate. Furthermore, by using the process behavior baseline to detect whether industrial facilities are operating according to correct process behavior, timely alarms and tracking can be initiated when errors occur, thereby improving the security of the industrial control system. This method can be widely applied to the security monitoring of various industrial control systems, effectively reducing losses caused by process behavior errors and improving the security of industrial control systems.

[0042] Preferably, the process behavior baseline determination module 2 is used to generate a preset number of tree structure branches based on the protocol operation detail fragments of the target protocol data. The protocol operation details of the target protocol data include the preset number of protocol operation detail fragments. If the preset number of tree structure branches are arranged from longest to shortest according to their branch length, each tree structure branch has one less first protocol operation detail fragment than the previous tree structure branch. The longest tree structure branch contains the preset number of protocol operation detail fragments, and the shortest tree structure branch contains one protocol operation detail fragment. The first protocol operation detail fragment is the first protocol operation detail fragment in the previous tree structure branch.

[0043] A preset number of tree structure branches are stored in the tree structure. Based on the tree structure, the repetitive protocol operation detail fragments in the tree structure branches are determined, and at least one repetitive protocol operation detail fragment is used as the process behavior baseline.

[0044] For example, the protocol operation details of the target protocol data include 6 protocol operation detail fragments, which are xabxa$ in the order of protocol operations. The above-mentioned protocol operation detail fragments of the target protocol data generate a preset number of tree structure branches, that is, 6 tree structure branches are generated based on the 6 protocol operation detail fragments xabxa$. These 6 tree structure branches are xabxa$ (which is the longest tree structure branch), abxa$, bxa$, xa$, a$, and $ (which is the shortest tree structure branch). The above 6 tree structure branches are arranged in descending order of branch length. For example, compared with its predecessor xabxa$, tree structure branch abxa$ lacks protocol operation detail fragment x, which is the first protocol operation detail fragment in tree structure branch xabxa$. Similarly, compared with its predecessor abxa$, tree structure branch bxa$ lacks protocol operation detail fragment a, which is the first protocol operation detail fragment in tree structure branch abxa$.

[0045] Store the above 6 tree structure branches into a tree structure, and the resulting tree structure is as follows: Figure 2 As shown, from Figure 2 It can be seen that the tree structure branches xabxa$ and xa$ share the same protocol operation detail fragment xa, meaning that the protocol operation detail fragment xa is a repeating protocol sequence in the target protocol data xabxa$. Similarly, the tree structure branches abxa$ and a$ share the same protocol operation detail fragment a, meaning that the protocol operation detail fragment a is also a repeating protocol sequence in the target protocol data xabxa$. Preferably, the protocol operation detail fragments xa and / or a can be used as the process behavior baseline.

[0046] When processing the target protocol data as described above, in order to obtain the repeating protocol sequence of the target protocol data, the tree structure branches corresponding to the protocol operation details of the target protocol data can be stored in the tree structure according to the above steps. However, the amount of protocol data may be very large. When processing the data using the above method, the generated tree structure may be extremely large, leading to a long data processing time. Therefore, in order to improve the processing speed of protocol data, the length of the tree structure branches can be limited according to the operation process of the process behavior flow, thereby improving the data processing speed. Preferably, the length of the tree structure branches can be 30 or 35, that is, the tree structure branches can include 30 or 35 protocol operation detail fragments.

[0047] Furthermore, after determining the process behavior baseline, the process behavior baseline determination module 2 can store the process behavior baseline in a database table and deploy the process behavior baseline as a process behavior baseline rule.

[0048] Preferably, the process behavior detection system further includes a protocol details preprocessing module, used to delete unnecessary content in the protocol operation details of the target protocol data before determining the duplicate protocol sequence in the target protocol data, to obtain preprocessed protocol operation details, wherein the unnecessary content is content unrelated to the protocol operation.

[0049] To reduce the amount of data processing during the process of determining the repeating protocol sequence using a tree structure, and to improve the accuracy of the baseline content of the process behavior, this embodiment preferably removes content unrelated to the protocol operation from the protocol operation details of the target protocol data before determining the repeating protocol sequence.

[0050] Preferably, the process behavior detection module 3 is used to load the rule file corresponding to the process behavior baseline. The rule file includes basic information and key information of the process behavior baseline. The basic information includes the protocol name, server Internet Protocol address, client Internet Protocol address, and behavior timeout time. The key information includes a behavior list, which includes expected process behavior information.

[0051] The process behavior detection module 3 uses a concurrent state machine model to classify the data packets into data streams and compares the classified data streams with the expected process behavior information for each step in the key information to determine whether the target process behavior is correct.

[0052] If the target process behavior is determined to be correct, the process behavior detection module 3 controls the concurrent state machine model to enter the next process waiting for detection.

[0053] In this embodiment, the behavior list describes the expected process behavior for each step, and the end of the list signifies the completion of one round of process behavior. The aforementioned process behavior detection module 3 utilizes a state machine based on a rule file of the process behavior baseline to effectively monitor process behavior, thereby ensuring the safe and stable operation of the industrial control system.

[0054] Preferably, the process behavior detection system also includes an early warning module, which generates an early warning message and sends it to the host computer (i.e., the industrial control system) when the target process behavior is determined to be incorrect. At the same time, it can also destroy the state machine corresponding to the target process behavior to prevent industrial equipment under the control of the industrial control system from operating according to the incorrect process behavior.

[0055] Example 2

[0056] like Figure 3 As shown, the process behavior detection method provided in this embodiment of the invention is preferably executed by the process behavior detection system of Embodiment 1. The method includes:

[0057] S310, The target protocol data acquisition module filters target protocol data corresponding to the target filtering conditions from the pre-collected protocol data based on the target filtering conditions;

[0058] S320. The process behavior baseline determination module determines the repeating protocol sequence in the target protocol data and uses the repeating protocol sequence as the process behavior baseline.

[0059] S330. The process behavior detection module detects the data packets corresponding to the target process behavior based on the process behavior baseline to determine whether the target process behavior is correct.

[0060] The process behavior detection method provided in this embodiment utilizes a target protocol data acquisition module to filter target protocol data corresponding to target screening conditions from pre-collected protocol data; a process behavior baseline determination module identifies repeating protocol sequences in the target protocol data and uses these repeating protocol sequences as the process behavior baseline; and a process behavior detection module detects the data packets corresponding to the target process behavior based on the process behavior baseline to determine whether the target process behavior is correct. This technical solution overcomes the problems of existing methods where tampering with the process behavior controlled by the industrial control system leads to significant losses due to incorrect process behavior in industrial facilities, and the difficulty and error-prone nature of existing process behavior baseline establishment methods. By using repeating protocol sequences in the protocol data as the process behavior baseline, the establishment process becomes more efficient, convenient, and accurate. Furthermore, by using the process behavior baseline to detect whether industrial facilities are operating according to correct process behavior, timely alarms and tracking can be initiated when errors occur, thereby improving the security of the industrial control system. This method can be widely applied to the security monitoring of various industrial control systems, effectively reducing losses caused by process behavior errors and improving the security of industrial control systems.

[0061] Based on the above embodiments, the process behavior baseline determination module further determines the repeating protocol sequence in the target protocol data and uses the repeating protocol sequence as the process behavior baseline, including:

[0062] The process behavior baseline determination module generates a preset number of tree structure branches based on the protocol operation detail fragments of the target protocol data. The protocol operation details of the target protocol data include the preset number of protocol operation detail fragments. If the preset number of tree structure branches are arranged in descending order of branch length, each tree structure branch has one less first protocol operation detail fragment than the previous tree structure branch. The longest tree structure branch contains the preset number of protocol operation detail fragments, and the shortest tree structure branch contains one protocol operation detail fragment. The first protocol operation detail fragment is the first protocol operation detail fragment in the previous tree structure branch.

[0063] A preset number of tree structure branches are stored in the tree structure. Based on the tree structure, the repetitive protocol operation detail fragments in the tree structure branches are determined, and at least one repetitive protocol operation detail fragment is used as the process behavior baseline.

[0064] Based on the above embodiments, the process behavior baseline determination module further determines the repeating protocol sequence in the target protocol data and uses the repeating protocol sequence as the process behavior baseline, including:

[0065] The process behavior detection module loads the rule file corresponding to the process behavior baseline. The rule file includes basic information and key information of the process behavior baseline. The basic information includes the protocol name, server Internet Protocol address, client Internet Protocol address, and behavior timeout time. The key information includes a list of behaviors, which includes expected process behavior information.

[0066] The data packets are classified using a concurrent state machine model, and the classified data stream is compared with the expected process behavior information for each step in the key information to determine whether the target process behavior is correct.

[0067] If the target process behavior is determined to be correct, the process behavior detection module controls the concurrent state machine model to enter the next process waiting for detection.

[0068] Based on the above embodiments, further, before determining the repeating protocol sequence in the target protocol data, the process behavior detection method further includes: a protocol detail preprocessing module deleting unnecessary content in the protocol operation details of the target protocol data to obtain preprocessed protocol operation details, wherein the unnecessary content is content unrelated to the protocol operation.

[0069] Based on the above embodiments, when it is determined that the target process behavior is incorrect, the process behavior detection method further includes: an early warning module generating early warning information and sending it to a host computer.

[0070] Based on the above embodiments, the target filtering conditions further include the target protocol name and the target server Internet Protocol address.

[0071] Based on the above embodiments, before filtering target protocol data corresponding to the target filtering conditions from the pre-collected protocol data based on the target filtering conditions, the process behavior detection method further includes: a protocol data pre-collection module pre-collecting protocol data, wherein the pre-collected protocol data includes the protocol name, server Internet Protocol address, client Internet Protocol address, and protocol operation details.

[0072] The process behavior detection method provided in the embodiments of the present invention can be executed by the process behavior detection system provided in the system embodiments of the present invention, and its execution steps and beneficial effects will not be described in detail here.

[0073] In summary, the process behavior detection system and method provided by this invention, through a target protocol data acquisition module that filters target protocol data corresponding to target screening conditions from pre-collected protocol data, and a process behavior baseline determination module that identifies repeating protocol sequences in the target protocol data and uses these repeating protocol sequences as the process behavior baseline, and a process behavior detection module that detects the data packets corresponding to the target process behavior based on the process behavior baseline to determine whether the target process behavior is correct, overcomes the problems of existing methods that suffer significant losses when the process behavior controlled by the industrial control system is tampered with, leading to industrial facilities operating according to incorrect process behavior, and the difficulty and error-prone nature of existing process behavior baseline establishment methods. By using repeating protocol sequences in the protocol data as the process behavior baseline, the process behavior baseline establishment process becomes more efficient, convenient, and accurate. Simultaneously, by using the process behavior baseline to detect whether industrial facilities are operating according to correct process behavior, and when process behavior errors occur, timely alarms and tracking of erroneous process behavior can be initiated, thereby improving the security of the industrial control system. This method can be widely applied to the security monitoring of various industrial control systems, effectively reducing losses caused by process behavior errors and improving the security of industrial control systems.

[0074] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A process behavior detection system, characterized in that, include: The target protocol data acquisition module is used to filter target protocol data corresponding to the target filtering conditions from the pre-collected protocol data based on the target filtering conditions. The protocol data includes the protocol name, the server's Internet Protocol address, the client's Internet Protocol address, and protocol operation details; A process behavior baseline determination module is used to determine the repeating protocol sequence in the target protocol data and use the repeating protocol sequence as the process behavior baseline. The process behavior detection module is used to detect the data packets corresponding to the target process behavior based on the process behavior baseline, and to determine whether the target process behavior is correct. The process behavior baseline determination module is used to generate a preset number of tree structure branches based on the protocol operation detail fragments of the target protocol data. The protocol operation details of the target protocol data include the preset number of protocol operation detail fragments. If the preset number of tree structure branches are arranged in descending order of branch length, each tree structure branch has one less first protocol operation detail fragment than the previous tree structure branch. The longest tree structure branch contains the preset number of protocol operation detail fragments, and the shortest tree structure branch contains one protocol operation detail fragment. The first protocol operation detail fragment is the first protocol operation detail fragment in the previous tree structure branch. A preset number of tree structure branches are stored in the tree structure. Based on the tree structure, the repetitive protocol operation detail fragments in the tree structure branches are determined, and at least one repetitive protocol operation detail fragment is used as the process behavior baseline.

2. The system according to claim 1, characterized in that, It also includes a protocol details preprocessing module, which is used to remove unnecessary content from the protocol operation details of the target protocol data before determining the duplicate protocol sequence in the target protocol data, so as to obtain preprocessed protocol operation details, wherein the unnecessary content is content that is unrelated to the protocol operation.

3. The system according to claim 1, characterized in that, The process behavior detection module is used to load the rule file corresponding to the process behavior baseline. The rule file includes basic information and key information of the process behavior baseline. The basic information includes the protocol name, server Internet Protocol address, client Internet Protocol address, and behavior timeout time. The key information includes a list of behaviors, which includes expected process behavior information. The process behavior detection module uses a concurrent state machine model to classify the data packets into data streams and compares the classified data streams with the expected process behavior information for each step in the key information to determine whether the target process behavior is correct. If the target process behavior is determined to be correct, the process behavior detection module controls the concurrent state machine model to enter the next process waiting for detection.

4. The system according to claim 3, characterized in that, It also includes an early warning module, which generates an early warning message and sends it to the host computer when it is determined that the target process behavior is incorrect.

5. The system according to claim 1, characterized in that, The target filtering criteria include the target protocol name and the target server's Internet Protocol address.

6. The system according to claim 1, characterized in that, It also includes a protocol data pre-collection module for collecting protocol data in advance.

7. A method for detecting process behavior, characterized in that, Performed by the process behavior detection system according to any one of claims 1-6, comprising: The target protocol data acquisition module filters target protocol data corresponding to the target filtering conditions from pre-collected protocol data based on the target filtering conditions; the protocol data includes the protocol name, server Internet Protocol address, client Internet Protocol address, and protocol operation details; The process behavior baseline determination module determines the repeating protocol sequence in the target protocol data and uses the repeating protocol sequence as the process behavior baseline. The process behavior detection module detects the data packets corresponding to the target process behavior based on the process behavior baseline to determine whether the target process behavior is correct. The process behavior baseline determination module determines the repeating protocol sequence in the target protocol data and uses the repeating protocol sequence as the process behavior baseline, including: The process behavior baseline determination module generates a preset number of tree structure branches based on the protocol operation detail fragments of the target protocol data. The protocol operation details of the target protocol data include the preset number of protocol operation detail fragments. If the preset number of tree structure branches are arranged in descending order of branch length, each tree structure branch has one less first protocol operation detail fragment than the previous tree structure branch. The longest tree structure branch contains the preset number of protocol operation detail fragments, and the shortest tree structure branch contains one protocol operation detail fragment. The first protocol operation detail fragment is the first protocol operation detail fragment in the previous tree structure branch. A preset number of tree structure branches are stored in the tree structure. Based on the tree structure, the repetitive protocol operation detail fragments in the tree structure branches are determined, and at least one repetitive protocol operation detail fragment is used as the process behavior baseline.

8. The method according to claim 7, characterized in that, The process behavior baseline determination module determines the repeating protocol sequence in the target protocol data and uses the repeating protocol sequence as the process behavior baseline, including: The process behavior detection module loads the rule file corresponding to the process behavior baseline. The rule file includes basic information and key information of the process behavior baseline. The basic information includes the protocol name, server Internet Protocol address, client Internet Protocol address, and behavior timeout time. The key information includes a list of behaviors, which includes expected process behavior information. The data packets are classified using a concurrent state machine model, and the classified data stream is compared with the expected process behavior information for each step in the key information to determine whether the target process behavior is correct. If the target process behavior is determined to be correct, the process behavior detection module controls the concurrent state machine model to enter the next process waiting for detection.

Images