An industrial control host software hardening method, system, terminal and storage medium

Abstract

The application relates to an industrial host software reinforcement method and system, a terminal and a storage medium, and belongs to the field of software security protection. The industrial host software reinforcement method comprises the following steps: obtaining a target process; calling a historical process with a similarity to the target process reaching a threshold from a preset temporary database; obtaining list information of the target process according to the historical process based on a preset process analysis rule, wherein the list information indicates whether the historical process belongs to an industrial process white list or an industrial process black list; and storing the target process into the industrial process white list or the industrial process black list according to the list information. The application has the effect of improving the use safety of an industrial system.

Description

Technical Field

[0001] This application relates to the field of software security protection, and in particular to a method, system, terminal and storage medium for hardening industrial control host software. Background Technology

[0002] An industrial control system is a computer system used to control machines and equipment. Traditional industrial control systems require an industrial control network for data transmission and processing. Since an industrial control network is a closed environment and not directly connected to the internet, upgrading the industrial control system itself is difficult, and whitelisting is generally used. For the sake of system stability and business continuity, companies do not proactively upgrade their industrial control systems. This results in many traditional industrial control systems running for extended periods, leading to numerous security vulnerabilities and significant safety hazards to production. Summary of the Invention

[0003] To upgrade industrial control systems, this application provides a method, system, terminal, and storage medium for hardening industrial control host software.

[0004] The purpose of this application is to provide a method for hardening industrial control host software.

[0005] The aforementioned objective of this application is achieved through the following technical solution:

[0006] A method for hardening industrial control host software includes:

[0007] Obtain the target process;

[0008] Retrieve historical processes from a preset temporary database that have a similarity to the target process that reaches a threshold.

[0009] Based on preset process analysis rules, the list information of the target process is obtained according to the historical process. The list information indicates whether the historical process belongs to the industrial control process whitelist or the industrial control process blacklist.

[0010] The target process is stored in the industrial control process whitelist or the industrial control process blacklist based on the list information.

[0011] By adopting the above technical solution, historical processes similar to the target process are first found in the temporary database. Based on the operation records of the historical processes, the list information of the target process can be analyzed. Finally, the target process is stored in the corresponding list. In this way, the list can be updated in the intranet environment, which improves the security of the industrial control system.

[0012] The application can be further configured in a preferred example to include:

[0013] obtaining a similarity value of the historical process;

[0014] obtaining an operation record of the historical process from the temporary database;

[0015] obtaining a credibility value of the historical process according to the operation record of the historical process based on a preset credibility calculation rule; comparing the ratio of the similarity value and the credibility value of a plurality of historical processes, and selecting a historical process with the largest ratio, and marking the historical process with the largest ratio as a first historical process;

[0016] obtaining a list information of the first historical process;

[0017] determining a list information of the target process according to the list information of the first historical process.

[0018] The application can be further configured in a preferred example to include:

[0019] obtaining a total running number, an allowed running number and a prohibited running number of the historical process according to the operation record of the historical process; determining a first credibility value according to the credibility calculation rule, the total running number of the historical process, the allowed running number of the historical process and the prohibited running number of the historical process;

[0020] obtaining identity information of an operator who operates the historical process each time according to the operation record of the historical process;

[0021] determining permission information of the operator according to the identity information of the operator;

[0022] determining a second credibility value according to the credibility calculation rule and the permission information of the operator;

[0023] obtaining the credibility value of the historical process according to the first credibility value and the second credibility value.

[0024] The application can be further configured in a preferred example to include:

[0025] obtaining an allowed running proportion value according to the total running number and the allowed running number of the historical process;

[0026] The forbidden running ratio value is obtained according to the total running times and the forbidden running times of the historical process;

[0027] The list information of the historical process is determined according to the allowed running ratio value and the forbidden running ratio value.

[0028] A first credibility value is determined according to the list information of the historical process and the credibility calculation rule.

[0029] In a preferred example, the method can further comprise that the determination of the list information of the historical process according to the allowed running ratio value and the forbidden running ratio value comprises:

[0030] When the allowed running ratio value is greater than a first threshold value, the list information of the historical process belongs to the white list of the industrial control process; when the forbidden running ratio value is greater than the first threshold value, the list information of the historical process belongs to the black list of the industrial control process; when neither the allowed running ratio value nor the forbidden running ratio value is greater than the first threshold value, a difference value between the allowed running ratio value and the forbidden running ratio value is calculated.

[0031] If the difference value is not less than a second threshold value, the list information of the historical process belongs to the white list of the industrial control process.

[0032] If the difference value is less than the second threshold value, the list information of the historical process belongs to the black list of the industrial control process.

[0033] In a preferred example, the method can further comprise that the retrieving of the historical process with a similarity reaching a threshold value from the preset temporary database comprises:

[0034] The identity information of the target process is obtained according to the target process.

[0035] The historical process is retrieved from the preset temporary database, and the identity information of the historical process is obtained.

[0036] The identity information of the historical process is matched with the identity information of the target process to obtain a similarity value.

[0037] The historical process in the temporary database is retrieved according to the similarity value and a preset similarity threshold value.

[0038] In a preferred example, the method can further comprise that, after the target process is obtained, it is necessary to determine whether the target process belongs to the white list of the industrial control process or the black list of the industrial control process, which comprises:

[0039] The white list of the industrial control process and the black list of the industrial control process are retrieved, the white list of the industrial control process is used to store compliant processes, and the black list of the industrial control process is used to store non-compliant processes.

[0040] According to the target process, identity information of the target process is obtained;

[0041] The identity information of the target process is matched with the identity information of the process in the industrial process white list, and if the matching is successful, it indicates that the target process belongs to the industrial process white list;

[0042] The identity information of the target process is matched with the identity information of the process in the industrial process black list, and if the matching is successful, it indicates that the target process belongs to the industrial process black list;

[0043] When the target process does not belong to the industrial process white list or the industrial process black list, a historical process with a similarity to the target process reaching a threshold is retrieved from a preset temporary database.

[0044] The second application purpose of the present application is to provide an industrial host software reinforcement system.

[0045] The above-mentioned second application purpose of the present application is achieved by the following technical solution:

[0046] An industrial host software reinforcement system comprises:

[0047] An acquisition module is configured to acquire a target process.

[0048] A retrieval module is configured to retrieve a historical process with a similarity to the target process reaching a threshold from a preset temporary database.

[0049] An analysis module is configured to obtain identity information of the target process based on a preset process analysis rule according to the historical process, wherein the identity information indicates that the historical process belongs to an industrial process white list or an industrial process black list.

[0050] The third application purpose of the present application is to provide a terminal.

[0051] The above-mentioned third application purpose of the present application is achieved by the following technical solution:

[0052] A terminal comprises a memory and a processor, and the memory stores computer program instructions of the above-mentioned industrial host software reinforcement method which can be loaded and executed by the processor.

[0053] The fourth application purpose of the present application is to provide a computer medium capable of storing corresponding programs.

[0054] The above-mentioned fourth application purpose of the present application is achieved by the following technical solution:

[0055] A computer readable storage medium stores a computer program capable of being loaded by a processor and executing any of the above industrial control host software reinforcement methods.

[0056] In summary, the present application includes at least one of the following beneficial technical effects:

[0057] By finding a plurality of historical processes similar to the target process from the temporary database, the required historical process is found by similarity and credibility from the plurality of historical processes; then the list information of the target process is determined according to the analysis of the historical process, and finally the target process is stored in the corresponding list; In this way, the update of the list in the intranet environment can be realized, the stability of the industrial control system and the continuity of the production business are ensured, and the security of the industrial control system is improved. DETAILED DESCRIPTION

[0058] The specific embodiments are only an explanation of the present application, and are not a limitation of the present application. Those skilled in the art can make non-creative modifications to the embodiments according to the needs after reading the present specification, but as long as the scope of the claims of the present application is within the scope of the patent law.

[0059] To make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be described clearly and completely below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of the present application.

[0060] The embodiments of the present application will be further described in detail below in conjunction with the drawings of the specification.

[0061] The present application provides an industrial control host software reinforcement method, and the main process of the method is described as follows.

[0062] Step S101: Obtain a target process.

[0063] In the embodiments of the present application, an industrial control process white list, an industrial control process black list and a temporary database are provided in the industrial control system; the related information of all historical processes in the industrial control system is stored in the temporary database, the industrial control process white list stores all compliant processes, and the industrial control process black list stores all non-compliant processes.

[0064] The running processes in the industrial control software in the current industrial control system can be obtained by rapidly scanning the local disk; the running processes all belong to target processes; after obtaining the target processes, the target processes need to be screened; that is, after obtaining the target processes, it is determined whether the target processes belong to the industrial control process whitelist or the industrial control process blacklist.

[0065] The industrial control process whitelist and the industrial control process blacklist are called, the industrial control process whitelist is used to store compliant processes, and the industrial control process blacklist is used to store non-compliant processes; identity information of the target process is obtained according to the target process; the identity information of the target process is matched with identity information of processes in the industrial control process whitelist, if the matching is successful, it indicates that the target process belongs to the industrial control process whitelist; if the matching fails, it indicates that the target process does not belong to the industrial control process whitelist; the identity information of the target process is matched with identity information of processes in the industrial control process blacklist, if the matching is successful, it indicates that the target process belongs to the industrial control process blacklist; if the matching fails, it indicates that the target process does not belong to the industrial control process blacklist, and when the target process does not belong to the industrial control process whitelist or the industrial control process blacklist, a historical process with a similarity to the target process reaching a threshold is called from a preset temporary database.

[0066] It can be understood that in the above process, the identity information of the process is matched; the identity information here can be understood as name information of the process or characteristic information of the process, and the identity information of the process is not limited here as long as it can represent the process; some common processes have specific names, for example, “agentsvr.exe is an ActiveX plug-in for multimedia programs”, and for example, “bttnserv.exe is used to support Compaq EasyAccess multimedia keyboard buttons, removing the process will cause the additional buttons to be unavailable”, the temporary database stores related information about the process, including name information of the process, actual operation information of the process, permission information of the process, execution time information of the process, identity information and permission information of an operator who allows the process to run or prohibits the process from running, etc.; therefore, the identity information of the process can be obtained through the temporary database.

[0067] The name information of the process and the actual operation information of the process are stored in the above-mentioned industrial control process whitelist and industrial control process blacklist, and in the embodiment of the application, the name information of the process can be regarded as the identity information.

[0068] When the processes are matched through the identity information of the processes, if it is found that the target process does not belong to the industrial control process whitelist or the industrial control process blacklist, the target process needs to be further analyzed and judged.

[0069] Step S102: retrieving a historical process with a similarity to the target process reaching a threshold value from a preset temporary database.

[0070] Specifically, identity information of the target process is obtained according to the target process; a historical process is retrieved from the preset temporary database, and identity information of the historical process is obtained; the identity information of the historical process and the identity information of the target process are matched to obtain a similarity value according to a similarity matching technique; the similarity value is compared with a preset similarity threshold value, and if the similarity value is greater than the similarity threshold value, the corresponding historical process is selected out.

[0071] It can be understood that in the above process, the historical process with a similarity higher than the threshold value is found from the temporary database through the identity information of the target process; it can be known from step S101 that the identity information refers to name information of the process, and then there can be some processes with similar name information, but the actual operation information of the processes is not similar; therefore, when the historical process similar to the target process is selected, the actual operation information can be further screened, and if the actual operation information of the target process and the actual operation information of the historical process have a similarity higher than the threshold value, the historical process can be determined as the historical process similar to the target process.

[0072] Step S103: obtaining list information of the target process according to the historical process based on a preset process analysis rule.

[0073] The list information herein indicates that the historical process belongs to a white list of industrial control processes or belongs to a black list of industrial control processes, that is, the historical process belongs to the white list of industrial control processes or the black list of industrial control processes can be obtained through the step.

[0074] Specifically, the process analysis rule includes obtaining a similarity value of the historical process; obtaining operation records of the historical process according to the temporary database; obtaining a credibility value of the historical process based on a preset credibility calculation rule according to the operation records of the historical process; comparing the ratio of the similarity value and the credibility value of a plurality of historical processes, and selecting a historical process with the largest ratio, and marking the historical process with the largest ratio as a first historical process; obtaining list information of the first historical process; and determining the list information of the target process according to the list information of the first historical process.

[0075] It can be understood that the historical processes with similarity higher than the threshold value to the target process can be screened out from the temporary database through the step S101 and the step S102, so that the similarity values of the historical processes can be obtained; then the operation records of the historical processes are obtained according to the temporary database, and then the credibility values of the historical processes can be obtained based on the preset credibility calculation rule; then the ratio of the credibility value and the similarity value of the historical process can be calculated, and the ratio can represent the credibility brought by each unit of similarity, so that the ratio can be used to compare which historical process is the historical process with the highest credibility; then the historical process with the highest credibility is marked as the first historical process, so that the first historical process can be considered as the process most similar to the target process, and the list to which the first historical process belongs is the list to which the target process belongs; that is, the list information of the target process can be determined according to the list information of the first historical process; in this way, the number of times of judging whether the target process is compliant by using artificial judgment can be reduced, so that the identification efficiency of the target process is improved.

[0076] In the use of the historical processes in the temporary database, the historical processes are regarded as reference objects, and the historical process most similar to the target process is found from the plurality of historical processes; in this process, the historical process most similar to the target process can be more accurately screened out through the similarity of the historical process and the target process and the credibility of the historical process itself, so that the accuracy of the judgment of the list to which the target process belongs by using the historical process is ensured.

[0077] In the above process, based on the preset credibility calculation rule, the specific steps of obtaining the credibility value of the historical process according to the operation record of the historical process are as follows.

[0078] The total running times, the allowed running times and the prohibited running times of the historical process are obtained according to the operation record of the historical process; the first credibility value is determined according to the credibility calculation rule, the total running times of the historical process, the allowed running times of the historical process and the prohibited running times of the historical process; the identity information of the operator who operates each historical process is obtained according to the operation record of the historical process; the permission information of the operator is determined according to the identity information of the operator; the second credibility value is determined according to the credibility calculation rule and the permission information of the operator; and the credibility value of the historical process is obtained according to the first credibility value and the second credibility value.

[0079] The operation records of the historical processes are stored in the temporary database, and the relevant information of the historical processes can be obtained by analyzing the operation records; the allowed running ratio value is obtained according to the total running times and the allowed running times of the historical processes; the allowed running ratio value represents the proportion of the allowed running times of the historical processes to the total running times; the forbidden running ratio value is obtained according to the total running times and the forbidden running times of the historical processes; the forbidden running ratio value represents the proportion of the forbidden running times of the historical processes to the total running times; the two ratio values are compared to determine the list information of the historical processes; that is, the list information of the historical processes is determined according to the allowed running ratio value and the forbidden running ratio value; and finally the first credibility value is determined according to the list information of the historical processes and the credibility calculation rule.

[0080] It can be understood that the first credibility value herein represents the credibility of the list information of the historical processes obtained according to the credibility calculation rule; because the list information of the historical processes is determined by the comparison result of the allowed running ratio value and the forbidden running ratio value, when the allowed running ratio value is much greater than the forbidden running ratio value, it means that the historical process has a high probability of belonging to the white list of the industrial control process; when the forbidden running ratio value is much greater than the allowed running ratio value, it means that the historical process has a high probability of belonging to the black list of the industrial control process; and when the allowed running ratio value and the forbidden running ratio value are not very different, the historical process may belong to the white list of the industrial control process or the black list of the industrial control process; therefore, the probability of the historical process belonging to the list is determined by using the credibility calculation rule.

[0081] It can be understood that the list information of the historical processes determined according to the allowed running ratio value and the forbidden running ratio value is also obtained based on the credibility calculation rule; specifically, the credibility calculation rule includes that when the allowed running ratio value is greater than a first threshold value or the forbidden running ratio value is greater than the first threshold value, the list information of the historical process is set to the corresponding white list or black list of the industrial control process; when the allowed running ratio value and the forbidden running ratio value are both not greater than the first threshold value, the difference between the allowed running ratio value and the forbidden running ratio value is calculated; if the difference is greater than a second threshold value, the list information of the historical process is set to the white list of the industrial control process, and if the difference is less than the second threshold value, the list information of the historical process is set to the black list of the industrial control process.

[0082] For example, the allowed running ratio value of the historical process A is 7, the forbidden running ratio value is 3, and the difference between the two is 4, which is greater than the second threshold value 2.5, so the allowed running ratio value 7 is set to the probability value 70% of the corresponding white list of the industrial control process, and the list information of the historical process A is obtained as the white list of the industrial control process, and the probability of the historical process A belonging to the white list of the industrial control process is 70%.

[0083] The credibility calculation rule further comprises a correspondence relationship between the probability and the credibility, that is, each list probability value of the historical process corresponds to a credibility, and then the corresponding credibility value can be obtained through the probability value of the list to which the historical process belongs, and the credibility value is the first credibility value.

[0084] After obtaining the first credibility values of the plurality of historical processes, identity information of an operator is obtained according to operation records of the historical processes; in the process of operating the process, it is necessary to determine whether the process is compliant through the industrial control process whitelist and the industrial control process blacklist, if the process cannot be found from the list, the operator needs to assist in judgment, the operator operates the process, and allows or prohibits the process to run, and the process is recorded and stored in the temporary database; therefore, the identity information of the operator can be determined through the temporary database, the permission information of the operator is determined according to the identity information; each operator has his own identity and permission, and the second credibility value can be determined according to the permission of the operator and the credibility calculation rule.

[0085] That is, the credibility calculation rule further comprises a permission credibility correspondence relationship, that is, the corresponding credibility can be obtained according to the permission of the operator, and the credibility is the second credibility value.

[0086] Finally, the first credibility value and the second credibility value are added to obtain the credibility value of the historical process.

[0087] Through the above-mentioned manner, the credibility value of the historical process can be calculated more accurately, in the calculation process, not only the operation record of the historical process is considered, but also the permission of the operator operating the historical process; the accuracy of the credibility calculation of the historical process is improved, and then the accuracy of determining the list information of the target process by using the historical process is improved.

[0088] Step S104: storing the target process into the industrial control process whitelist or the industrial control process blacklist according to the list information.

[0089] After the list information of the target process is determined, the target process can be added to the corresponding list; in this way, the storage of the list in the intranet environment is realized, the blacklist and the whitelist are screening of the process, and the safety of the industrial control system can be improved; therefore, through steps S101-S104, the safety of the industrial control system is improved, the safety update of the industrial control network is realized without connecting the external network, and the stability of the industrial control system and the continuity of the life service are ensured.

[0090] The application further provides an industrial control host software reinforcement system, which comprises an acquisition module, a calling module, an analysis module and a storage module.

[0091] In order to better execute the program of the above method, the application further provides a terminal, which comprises a memory and a processor.

[0092] The memory can be used to store instructions, programs, codes, code sets or instruction sets. The memory can comprise a program storage area and a data storage area, wherein the program storage area can store instructions for implementing an operating system, instructions for at least one function, and instructions for implementing the above industrial control host software reinforcement method, etc.; and the data storage area can store data involved in the above industrial control host software reinforcement method, etc.

[0093] The processor can comprise one or more processing cores. The processor executes various functions and processes data by running or executing instructions, program code sets or instruction sets stored in the memory, and calling data stored in the memory. The processor can be at least one of an application specific integrated circuit, a digital signal processor, a digital signal processing device, a programmable logic device, a field programmable gate array, a central processing unit, a controller, a microcontroller and a microprocessor. It can be understood that, for different devices, the electronic devices used to implement the functions of the processor can also be other devices, and the embodiments of the application are not limited in this regard.

[0094] The application further provides a computer readable storage medium, for example, various storage media capable of storing program codes such as a U disk, a mobile hard disk, a read only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk. The computer readable storage medium stores a computer program capable of being loaded by the processor and executing the above industrial control host software reinforcement method.

[0095] The above description is merely exemplary of the application and the application of the principles thereof. It is to be understood that modifications in the above procedure can be resorted to without departing from the scope of the disclosure or the application disclosed herein. Accordingly, what is desired to be protected by letters patent is set forth and supported by the drawings as follows.

Claims

1. An industrial control host software hardening method, characterized in that, The method comprises the following steps: acquiring a target process; calling a history process with a similarity to the target process reaching a threshold from a preset temporary database; obtaining list information of the target process according to the history process based on a preset process analysis rule, the list information indicating that the history process belongs to an industrial control process white list or an industrial control process black list; storing the target process into the industrial control process white list or the industrial control process black list according to the list information; the obtaining of the list information of the target process according to the history process based on the preset process analysis rule comprises the following steps: acquiring a similarity value of the history process; obtaining operation records of the history process according to the temporary database; obtaining a credibility value of the history process according to the operation records of the history process based on a preset credibility calculation rule; comparing the ratio of the similarity value to the credibility value of a plurality of history processes, and selecting a history process with the largest ratio, and marking the history process with the largest ratio as a first history process; obtaining list information of the first history process; determining the list information of the target process according to the list information of the first history process; the obtaining of the credibility value of the history process according to the operation records of the history process based on the preset credibility calculation rule comprises the following steps: obtaining a total running number, an allowed running number and a prohibited running number of the history process according to the operation records of the history process; determining a first credibility value according to the credibility calculation rule, the total running number of the history process, the allowed running number of the history process and the prohibited running number of the history process; obtaining identity information of an operator performing operation on the history process according to the operation records of the history process; determining permission information of the operator according to the identity information of the operator; determining a second credibility value according to the credibility calculation rule and the permission information of the operator; obtaining the credibility value of the history process according to the first credibility value and the second credibility value; the determining of the first credibility value according to the credibility calculation rule, the total running number of the history process, the allowed running number of the history process and the prohibited running number of the history process comprises the following steps: obtaining an allowed running proportion value according to the total running number and the allowed running number of the history process; obtaining a prohibited running proportion value according to the total running number and the prohibited running number of the history process; determining the list information of the history process according to the allowed running proportion value and the prohibited running proportion value; determining the first credibility value according to the list information of the history process and the credibility calculation rule; the determining of the list information of the history process according to the allowed running proportion value and the prohibited running proportion value comprises the following steps: when the allowed running proportion value is greater than a first threshold value, the list information of the history process belongs to the industrial control process white list; when the prohibited running proportion value is greater than the first threshold value, the list information of the history process belongs to the industrial control process black list; when the allowed running proportion value and the prohibited running proportion value are both not greater than the first threshold value, calculating a difference value of the allowed running proportion value and the prohibited running proportion value; If the difference is not less than the second threshold, the list information of the historical process belongs to the industrial control process white list; If the difference is less than the second threshold, the list information of the historical process belongs to the industrial control process black list.

2. The method of claim 1, wherein, The historical process with a similarity to the target process reaching a threshold is retrieved from a preset temporary database, including: Identity information of the target process is obtained according to the target process; The historical process is retrieved from the preset temporary database, and identity information of the historical process is obtained; Identity information of the historical process is matched with identity information of the target process to obtain a similarity value; The historical process in the temporary database is retrieved according to the similarity value and a preset similarity threshold.

3. The method of claim 1, wherein, After obtaining the target process, it is necessary to determine whether the target process belongs to the industrial control process white list or the industrial control process black list, including: The industrial control process white list and the industrial control process black list are retrieved, the industrial control process white list is used to store compliant processes, and the industrial control process black list is used to store non-compliant processes; Identity information of the target process is obtained according to the target process; Identity information of the target process is matched with identity information of the process in the industrial control process white list, and if the matching is successful, the target process belongs to the industrial control process white list; Identity information of the target process is matched with identity information of the process in the industrial control process black list, and if the matching is successful, the target process belongs to the industrial control process black list; When the target process does not belong to the industrial control process white list or the industrial control process black list, a historical process with a similarity to the target process reaching a threshold is retrieved from a preset temporary database.

4. An industrial host software hardening system, comprising: Including: An acquisition module (1) is configured to acquire a target process; A retrieval module (2) is configured to retrieve a historical process with a similarity to the target process reaching a threshold from a preset temporary database; An analysis module (3) is configured to obtain list information of the target process according to the historical process based on a preset process analysis rule, the list information indicating that the historical process belongs to an industrial control process white list or an industrial control process black list; A storage module (4) is configured to store the target process into the industrial control process white list or the industrial control process black list according to the list information; The obtaining of the list information of the target process according to the historical process based on the preset process analysis rule includes: A similarity value of the historical process is obtained; Operation records of the historical process are obtained according to the temporary database; A credibility value of the historical process is obtained according to the operation records of the historical process based on a preset credibility calculation rule; The ratio of the similarity value to the credibility value of a plurality of historical processes is compared, and a historical process with a maximum ratio is selected and marked as a first historical process; List information of the first historical process is obtained; List information of the target process is determined according to the list information of the first historical process; The obtaining of the credibility value of the historical process according to the operation records of the historical process based on the preset credibility calculation rule includes: According to the operation record of the historical process, total running times, allowed running times and forbidden running times of the historical process are obtained; According to the credibility calculation rule, the total running times, the allowed running times and the forbidden running times of the historical process, a first credibility value is determined; According to the operation record of the historical process, identity information of an operator who operates the historical process each time is obtained; According to the identity information of the operator, permission information of the operator is determined; According to the credibility calculation rule and the permission information of the operator, a second credibility value is determined; According to the first credibility value and the second credibility value, a credibility value of the historical process is obtained; The determination of the first credibility value according to the credibility calculation rule, the total running times, the allowed running times and the forbidden running times of the historical process comprises: According to the total running times and the allowed running times of the historical process, an allowed running proportion value is obtained; According to the total running times and the forbidden running times of the historical process, a forbidden running proportion value is obtained; According to the allowed running proportion value and the forbidden running proportion value, list information of the historical process is determined; According to the list information of the historical process and the credibility calculation rule, the first credibility value is determined; The determination of the list information of the historical process according to the allowed running proportion value and the forbidden running proportion value comprises: When the allowed running proportion value is greater than a first threshold value, the list information of the historical process belongs to a white list of industrial control processes; When the forbidden running proportion value is greater than the first threshold value, the list information of the historical process belongs to a black list of industrial control processes; When neither the allowed running proportion value nor the forbidden running proportion value is greater than the first threshold value, a difference value between the allowed running proportion value and the forbidden running proportion value is calculated; If the difference value is not less than a second threshold value, the list information of the historical process belongs to the white list of industrial control processes; If the difference value is less than the second threshold value, the list information of the historical process belongs to the black list of industrial control processes.

5. A terminal, characterized by comprising: A memory and a processor are included, and the memory stores computer program instructions capable of being loaded and executed by the processor to execute any one of the methods in claims 1-3.

6. A computer-readable storage medium, characterized in that, A memory stores computer program instructions capable of being loaded and executed by the processor to execute any one of the methods in claims 1-3.