Industrial software non-buried point tracking analysis method and device based on industrial network

Abstract

The application provides an industrial software non-buried point tracking analysis method and device based on an industrial network, which comprises the following steps: S1, detecting and identifying an industrial intranet network topology of an industrial site, and generating a configuration map of the industrial site according to the industrial intranet network topology and / or an application program running list of the industrial software; S2, injecting a non-buried point real-time tracking sidecar agent into an edge device of a target site device of the industrial site according to the configuration map, and performing data synchronization on the edge device and the corresponding sidecar agent; and S3, when the target edge device runs an application program therein, the sidecar agent obtains analysis data from the tracking point to analyze the industrial software. The application is non-buried point and non-intrusive to the existing source code of the industrial software, is suitable for industrial networks and devices, has very low cost, and does not need to modify the existing source code of the industrial software.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of digitization, and in particular to a non-intrusive tracking analysis method and device for industrial software based on an industrial network. BACKGROUND

[0002] Generic non-intrusive codeless tracking / analytics systems are becoming increasingly important for modern industrial ecosystems. Tracking information includes on-promise software analytics of user behavior, operational logs, dynamic performance analysis, and fault testing to increase system optimization for individual edge points or systems within the entire industrial network environment, including centralized or distributed. The prior art does not provide a generic tracking solution or sample of architecture to support such application scenarios. Typically, after the industrial software is released, information needs to be collected to track the process experience of software use, so a specific technical solution is used to inject many monitoring points in the already released software product. For example, the traditional web software page and its image button are instrumented, the operation data of the user on the page (including mouse and keyboard operations, etc.) is collected to detect hot spots, so as to analyze and detect, for example, which software functions the customer needs in the background. Non-intrusive detection technology refers to that the original code of the software does not need to be changed, and the instrumented points are injected from a third-party software.

[0003] Therefore, there are still many unsolved problems in the prior art, one of which is that most of the existing solutions are intrusive to the existing code. In order to implement a product-level unified distributed tracking or logging system, the team usually needs to add a large amount of new intrusive code, and sometimes the current architecture must be refactored even if it does not have good aspect-oriented (AOP) execution. If the product has been deployed to end users, it will be even more complicated. There is no non-intrusive tracking solution and framework for industrial solutions on the market. The software deployed to the industrial computer or open controller is usually programmed by executable binary code of different programming languages, including Python, C / C++, C#, Java, etc., which are sometimes deployed through containers such as Docker. The complexity of such a solution makes it very difficult to inject code.

[0004] Another problem is that most of the time it does not have or has limited public internet access due to security and privacy concerns. Most operators do not want to use public PaaS / SaaS cloud solutions due to network security and data privacy concerns. Also, most of the time, industrial environments do not have or have limited public internet access. In this case, most of the tracking services and service mesh architectures are based on cloud or network technologies that cannot be applied.

[0005] Another problem is that it is difficult to implement a complex distributed solution for an industrial network execution environment. Modern industrial solutions are becoming more and more complex, including a large number of industrial computers, edge devices, and open controllers. Therefore, it is difficult to identify the network topology in a short time.

[0006] Another problem is that most customers are concerned about the performance of heavy solutions for user behavior analysis and tracking. End users do not want the performance of the entire system to be dragged down by third-party analysis and tracking services, and existing solutions are not fast enough, so it becomes more difficult to predict.

[0007] In addition, in the industrial field, it is difficult to perform a burying operation with a burying tool on the market because industrial devices include edge devices and industrial computers, open controllers, etc. Industrial devices do not have operating tools such as a mouse and a keyboard, and are usually based on an application that runs continuously. Also, sometimes industrial software does not perform a software design when executing a log and diagnostic information, so it is difficult to dynamically obtain the execution log and diagnostic information.

[0008] Also, the industrial field commonly uses an industrial service mesh, which is an architectural pattern. The microservice mesh has better performance and scalability, but has not been widely used. Leading network companies commonly use a service mesh architecture, but there are great differences in the industrial field. Many industrial networks are industrial intranets, such as Ethernet and profinet, and many factories do not have network connections, so the service network architecture cannot be applied.

[0009] Therefore, there is a need in the industry for a no-burying tracking / analysis mechanism that can be applied to the industrial field and automatically injects burying. SUMMARY

[0010] The first aspect of the present application provides an industrial software non-buried point tracking analysis method based on an industrial network, comprising the following steps: S1, detecting and identifying the network topology of an industrial intranet in an industrial site, and generating a configuration map of the industrial site according to the network topology of the industrial intranet and / or an application program running list of the industrial software; S2, injecting a non-buried point real-time tracking sidecar agent into an edge device of a target field device in the industrial site according to the configuration map, and performing data synchronization on the edge device and its corresponding sidecar agent, wherein the target edge device and its corresponding sidecar agent have at least one tracking point, and at least one application program of the industrial software runs in the target edge device; S3, when the target edge device runs the application program therein, the sidecar agent obtains analysis data from the tracking point to analyze the industrial software.

[0011] Further, the step S2 further comprises the following steps: reading an executable file of the application program in the edge device of the target field device, and the sidecar agent dynamically injects tracking points into the application program for burying points based on the executable file, so as to inject the non-buried point real-time tracking sidecar agent into the edge device of the target field device in the industrial site according to the configuration map, and perform data synchronization on the edge device and its corresponding sidecar agent.

[0012] Further, the step S2 further comprises the following steps: obtaining the source code of the industrial software, converting the source code into a virtual code tree to perform mapping on the virtual code tree and the executable file, and the sidecar agent dynamically injects tracking points into the application program for burying points based on the executable file, so as to inject the non-buried point real-time tracking sidecar agent into the edge device of the target field device in the industrial site according to the configuration map.

[0013] Further, the step S2 further comprises the following steps: establishing communication between all sidecar agents in the industrial site according to the network topology of the industrial intranet.

[0014] Further, the step S3 further comprises the following steps: when the target edge device runs the application program therein and runs to the tracking point, the sidecar agent obtains runtime node data from the tracking point, and performs classification and arrangement on all node data and unifies the format to analyze the industrial software.

[0015] Further, the step S1 further comprises the following steps: installing a hybrid control platform on an edge device or a local server in the industrial site.

[0016] Further, the edge device of the target field device runs a plurality of application programs of the industrial software, and each of the application programs corresponds to a sidecar agent.

[0017] Further, the step S2 further comprises the following steps: formulating an injection strategy according to the analysis purpose of the industrial software, and performing sidecar agent injection based on the injection strategy and the process tree and historical data of the industrial software according to the configuration map.

[0018] Further, when the application program is contained in the virtual machine, the step S2 further comprises the following step: passing through the virtual machine to perform injection of the sidecar agent.

[0019] The second aspect of the present application provides an industrial software non-buried point tracking analysis system based on an industrial network, characterized in that it comprises: a processor; and a memory coupled to the processor, the memory having stored therein instructions which, when executed by the processor, cause the electronic device to perform actions, the actions comprising: S1, detecting and identifying the network topology of the industrial intranet of an industrial field, and generating a configuration map of the industrial field according to the network topology of the industrial intranet and / or the running list of application programs of the industrial software; S2, injecting a non-buried point real-time tracking sidecar agent into the edge device of a target field device of the industrial field according to the configuration map, and performing data synchronization on the edge device and its corresponding sidecar agent, wherein the target edge device and its corresponding sidecar agent have at least one tracking point, and at least one application program of the industrial software runs in the target edge device; S3, when the target edge device runs the application program therein, the sidecar agent obtains analysis data from the tracking point to analyze the industrial software.

[0020] Further, the action S2 further comprises: reading the executable file of the application program in the edge device of the target field device, and the sidecar agent dynamically injects tracking points into the application program for burying points based on the executable file, to inject a non-buried point real-time tracking sidecar agent into the edge device of a target field device of the industrial field according to the configuration map, and perform data synchronization on the edge device and its corresponding sidecar agent.

[0021] Further, the action S2 further comprises: obtaining the source code of the industrial software, converting the source code into a virtual code tree to perform mapping on the virtual code tree and the executable file, and the sidecar agent dynamically injects tracking points into the application program for burying points based on the executable file, to inject a non-buried point real-time tracking sidecar agent into the edge device of a target field device of the industrial field according to the configuration map.

[0022] Further, the action S2 further comprises: establishing communication between all the edge devices of the target industrial field according to the industrial intranet network topology.

[0023] Further, the action S3 further comprises: when the target edge device runs the application program therein and runs to the tracing point, the edge agent obtains runtime node data from the tracing point, performs classification and uniform formatting on all the node data, and analyzes the industrial software.

[0024] Further, the action S1 further comprises: installing a hybrid control platform on an edge device or a local server of the target industrial field.

[0025] Further, the target edge device runs a plurality of application programs of the industrial software, and each of the application programs corresponds to an edge agent.

[0026] Further, the action S2 further comprises: formulating an injection strategy according to the analysis purpose of the industrial software, and performing edge agent injection based on the injection strategy, the process tree of the industrial software, and historical data according to the configuration map.

[0027] Further, when the application program is contained in the virtual machine, the action S2 further comprises: passing through the virtual machine to perform injection of the edge agent.

[0028] The third aspect of the present application provides an industrial software non-buried point tracking analysis device based on an industrial network, comprising: a detection and identification device that detects and identifies the industrial intranet network topology of an industrial field, and generates a configuration map of the industrial field according to the industrial intranet network topology and / or an application program running list of the industrial software; an injection device that injects non-buried point real-time tracking edge agents into edge devices of target field devices of the industrial field according to the configuration map, and performs data synchronization on the edge devices and their corresponding edge agents, wherein the target edge devices and their corresponding edge agents have at least one tracing point, and the target edge devices run at least one application program of the industrial software; and an analysis device that, when the target edge device runs the application program therein, the edge agent obtains analysis data from the tracing point to analyze the industrial software.

[0029] The fourth aspect of the present application provides a computer program product, which is tangibly stored on a computer readable medium and includes computer executable instructions that, when executed, cause at least one processor to perform the method of the first aspect of the present application.

[0030] The fifth aspect of the present application provides a computer readable medium having computer executable instructions stored thereon, the computer executable instructions, when executed, causing at least one processor to perform the method according to the first aspect of the present application.

[0031] The present application is non-intrusive and non-invasive to the existing source code of the industrial software, is suitable for industrial networks and devices, and has very low configuration and development and operation costs, and does not need to modify the existing source code of the industrial software. BRIEF DESCRIPTION OF DRAWINGS

[0032] Figure 1 Fig. 1 is a schematic diagram of an architecture of an industrial network-based non-invasive industrial software tracking and analysis device according to an embodiment of the present application;

[0033] Figure 2 Fig. 1 is a schematic diagram of an architecture of an industrial network-based non-invasive industrial software tracking and analysis device according to an embodiment of the present application; DETAILED DESCRIPTION

[0034] The specific embodiments of the present application are described below with reference to the accompanying drawings.

[0035] The present application provides an industrial network-based non-invasive industrial software tracking and analysis mechanism, which is based on an industrial service mesh and injects a tracking point through intelligent sidecar agents, and is driven by a hybrid control plane at an edge device end to perform real-time tracking of industrial software running on an industrial device.

[0036] The architecture of the industrial network-based non-invasive industrial software tracking and analysis mechanism provided by the present application provides a modern loose-coupled and non-intrusive architecture, which is suitable for industrial networks and devices. The industrial service mesh provided by the present application combines a plurality of non-invasive runtime real-time tracking sidecar agents, which can be driven by a hybrid control plane. The communication of the present application is based on high-speed communication of a hybrid virtual data platform core service between every two sidecar agents. All elements can be easily installed or automatically injected into an industrial computer or an edge device. Any existing engineering or runtime real-time solution can be easily integrated into the present application, and has very low configuration and development and operation costs, and does not need to modify the existing source code of the industrial software.

[0037] The first aspect of the present application provides an industrial network-based industrial software non-buried point tracking analysis method, comprising the following steps.

[0038] Firstly, step S1 is performed to detect and identify the industrial intranet network topology of an industrial site, and generate a configuration map of the industrial site according to the industrial intranet network topology and / or an application program running list of the industrial software. According to an embodiment of the present application, the industrial site is a factory using an industrial intranet (Ethernet and ProfiNET, etc.). The industrial site includes multiple field devices, wherein an industrial computer and an open controller serve as edge devices. The industrial computer and the open controller are edge devices when they serve as Internet of Things edge computing nodes of an industrial cloud. A plurality of programs run in the above edge devices, including a running state alarm system (NodeJS), a detection machine and a conveyor belt control process (GCC, driving PLC IO through RIB), an object recognition vision algorithm process (Python), a robot control process and a driver (GCC in a Docker), etc. In the application scenario of the present embodiment, the industrial software running in the factory does not have a unified log system and a user behavior analysis system, and lacks middleware such as performance analysis and system security analysis. If the above functions are to be added, the source code of all industrial software deployed applications needs to be modified, which is risky and has huge development costs. Therefore, the present application is used to perform a non-buried point industrial service grid, and a sidecar agent is deployed for each application program of each edge device to collect industrial software analysis data.

[0039] Figure 1 is a schematic diagram of the architecture of an industrial network-based non-buried point industrial software tracking analysis device according to an embodiment of the present application. As shown in Figure 1 , the non-buried point industrial software tracking analysis device 100 includes a hybrid control platform 110 at the edge device end, a configuration detector 120, an injector 130, a plurality of sidecar agents, a hybrid data platform 140 and a controller 150. The industrial site has many embedded devices, such as edge devices, which are connected with the industrial cloud to assist the industrial cloud to perform computing. The present application allocates a sidecar agent to each edge device, wherein at least one application program of industrial software runs in the edge device.

[0040] Preferably, the step S1 further includes the following step before it: installing the hybrid control platform 110 on an edge device or a local server of the industrial site. In the present embodiment, the hybrid control platform 110 is installed on a server industrial computer (not shown) serving as a local server of the factory.

[0041] The hybrid control platform 110 is the core device of the codeless industrial software tracking and analysis apparatus 100, which can be deployed to edge devices or local servers, and is optimized for industrial networks and industrial computer environments. The hybrid control platform 110 includes an industrial platform adapter and a codeless tracking engine, which is used to serve as an entry for visualizing tracking data aggregation through the controller 150, and provides a common application programming interface (API) for extensibility and tracking rule configuration. Among them, the codeless tracking engine collects telemetry data from the sidecar agent through the hybrid data platform 140. The hybrid control platform 110 is similar to the final definition of a general control platform, but it is optimized for industrial networks to conform to industrial standards through the industrial platform adapter, such as OPC UA, ProfiNET, Ethercat, Ethernet, Modbus IP, etc., which is also suitable for process image (message broker) execution.

[0042] Among them, the configuration detector 120 detects the on-promise network topology with the help of the runtime discovery service (RDS) in the sidecar agent, which is also used to detect the container type and running process list of the edge device or industrial computer. The configuration detector 120 finally generates a configuration map for the injector 130.

[0043] Among them, once the configuration detector 120 completes its work, the injector 130 will start. The injector 130 injects the codeless runtime real-time tracking sidecar agent into the target device, and attaches the sidecar agent to the specific process recommended by the configuration map. The application environment setting is also automatically changed by the change service.

[0044] Then step S2 is performed, and the codeless real-time tracking sidecar agent is injected into the edge device of the target field device of the industrial field according to the configuration map, and data synchronization is performed on the edge device and its corresponding sidecar agent, wherein the target edge device and its corresponding sidecar agent have at least one tracking point, and at least one application program running the industrial software in the target edge device. Preferably, multiple application programs running the industrial software in the edge device of the target field device are provided, and each application program corresponds to a sidecar agent.

[0045] Specifically, according to the configuration map, the factory has a first edge device 161, a third edge device 163, a fourth edge device 164, a fifth edge device 165, a sixth edge device 166, a seventh edge device 167, and an eighth edge device 168. Among them, two application programs of the industrial software run in the first edge device 161, which are a first application program APP1 and a second application program APP2. An application program runs in the third edge device 163, which is a third application program APP3. An application program runs in the fourth edge device 164, which is a fourth application program APP4. An application program runs in the fifth edge device 165, which is a fifth application program APP5. An application program runs in the sixth edge device 166, which is a sixth application program APP6. An application program runs in the seventh edge device 167, which is a seventh application program APP7. An application program runs in the eighth edge device 168, which is an eighth application program APP8. Each application program should deploy a sidecar proxy, so the first application program APP1 is allocated a first sidecar proxy 171 corresponding thereto, the second application program APP2 is allocated a second sidecar proxy 172 corresponding thereto, the third application program APP3 is allocated a third sidecar proxy 173 corresponding thereto, the fourth application program APP4 is allocated a fourth sidecar proxy 174 corresponding thereto, the fifth application program APP5 is allocated a fifth sidecar proxy 175 corresponding thereto, the sixth application program APP6 is allocated a sixth sidecar proxy 176 corresponding thereto, the seventh application program APP7 is allocated a seventh sidecar proxy 177 corresponding thereto, and the eighth application program APP8 is allocated an eighth sidecar proxy 178 corresponding thereto. The above-mentioned sidecar proxies are injected into the corresponding edge devices through the injector 130. The hybrid data platform 140 controls the above-mentioned sidecar proxies, so that the edge devices and the sidecar proxies are always data synchronized. The hybrid data platform 140 is used for communication between the sidecar proxies.

[0046] Specifically, Figure 2 is a structural schematic diagram of a sidecar proxy and an intelligent tracking injector of an industrial network-based trace analysis device for an industrial software according to an embodiment of the present application. The following takes the first sidecar proxy 171 as an example to explain the sidecar proxy and its injection process. As shown in FIG. 1, the first sidecar proxy 171 is injected into the first edge device 161 through the injector 130. The first edge device 161 is connected to the hybrid data platform 140 through the network 120. The hybrid data platform 140 is connected to the first edge device 161 through the network 120. Figure 2As shown, the first sidecar agent 171 includes a trace injector 1711, a data aggregator 1712, a communication configurator 1713, a fault injector 1714, and a virtual machine adapter 1715. The trace injector 1711 is used for sidecar agent injection, which further includes a virtual code tree analyzer 1711a, a binary analyzer 1711b, a binary injector 1711c, and a mapper 1711d. The data aggregator 1712 is used to collect runtime node data, and perform classification and uniform formatting on all node data for analysis of the industrial software. The communication configurator 1713 is used to configure communication between all sidecar agents. The fault injector 1714 is used to perform auxiliary functions, such as injecting error information into intelligent detection running logs to detect whether the application can run well under fault conditions when it is uncertain whether the application is running well. The virtual machine adapter 1715 is used to pass through the virtual machine containing the application. Runtime fault injection generates fault data or code for network fault testing, automatic system defect testing, and simulation trace fault to increase system stability. Runtime fault injection is a general design pattern, but does not need to be redesigned for industrial applications

[0047] As shown in Figure 2 Preferably, the step S2 further includes the following steps: formulating an injection strategy according to the analysis purpose of the industrial software, and performing sidecar agent injection based on the injection strategy and the process tree and historical data of the industrial software according to the configuration map. When the application is contained in the virtual machine, the step S2 further includes the following step: passing through the virtual machine to perform injection of the sidecar agent. The process tree of the industrial software refers to a list of all processes of the currently running application of the industrial computer, and some applications have more than one process. Sometimes the APP package runs in a container or a virtual machine, and the sidecar agent needs to be injected into the application by passing through the container.

[0048] In actual industrial software applications, some industrial software suppliers provide the source code of the industrial software, and some suppliers do not. Therefore, based on the two cases of providing source code and not providing source code of the industrial software, the present application has different sidecar agent injection steps and processes.

[0049] In the case where the industrial software provider does not provide the source code, the step S2 includes the following steps: the binary analyzer 1711b reads the executable file of the application in the edge device of the target field device, the binary injector 1711c dynamically traces the application based on the executable file, and the mapper 1711d injects the sidecar agent with no trace in real time into the edge device of the target field device of the industrial field according to the configuration map, and performs data synchronization on the edge device and the corresponding sidecar agent.

[0050] In this system, the industrial software has source code S, which, after compilation, becomes an executable file B. If the industrial software does not provide source code S, the binary analyzer 1711b directly reads the compiled executable file and sends it directly to the binary injector 1711c. The binary injector 1711c then analyzes the compiled executable file and performs the injection. For example, in... Figure 2 In the process, the binary injector 1711c analyzes the executable file and injects three trace points N1, N2 and N3 based on the analysis results.

[0051] The binary injector 1711c injects trace points into the binary executable file. These trace points are code snippets. For example, with Python binary format, locating specific functionalities is difficult, thus requiring reliance on the results of the binary analyzer 1711b. However, this is sometimes insufficient, especially for ELF format, resulting in inaccurate injection points. In such cases, if the end customer can provide the source code of the binary application, the virtual code tree analyzer 1711a is needed, which significantly improves injection accuracy. It should be noted that due to the customer's security-related non-functional requirements, automated injection must be accepted and licensed by the end user.

[0052] Therefore, when the industrial software supplier provides the source code S, step S2 further includes the following steps: obtaining the source code of the industrial software, the virtual code tree analyzer 1711a converting the source code into a virtual code tree to perform mapping between the virtual code tree and the executable file B using the mapper 1711d, and the sidecar agent dynamically injecting tracking points based on the executable file to embed tracking points, so as to inject the non-code-based real-time tracking sidecar agent into the edge device of the target field device in the industrial site according to the configuration map.

[0053] Preferably, step S2 further includes the following step: the communication configurator 1713 establishes communication between all sidecar agents in the industrial site according to the industrial intranet network topology.

[0054] Finally, in step S3, when the target edge device is running its application, the sidecar agent obtains analysis data from the tracking point of the collector 180 to analyze the industrial software. Preferably, step S3 further includes the following step: when the target edge device is running its application and reaches the tracking point, the sidecar agent obtains runtime node data from the tracking point, and uses the data aggregator 1712 to classify, organize, and unify the format of all node data for analysis of the industrial software.

[0055] Among them, such as Figure 2As shown, collector 180 acquires runtime node real-time data from the tracing points N1, N2 and N3 and sends to data aggregator 1712. Data aggregator 1712 performs sorting and uniform formatting of all node data for analysis of the industrial software to aggregate uniform data and subsequent indexing. Data aggregator 1712 collects unobtrusive tracing data from all injection nodes and performs data initialization filtering and aggregation, which also collects primary tracing data. Finally, data aggregator 1712 runs in the sidecar proxy 171 and with the target user software execution process.

[0056] Wherein, data aggregator 1712 transmits data out through communication configurator 1713, which needs to read data from hybrid control platform 110 to unify the aggregation results.

[0057] In addition, the network services of the sidecar proxy include multiple network designs, such as circuit breakers, load balancing, traffic control, health diagnosis, etc., which optimize the industrial network and provide control of the CTR ISM.

[0058] In addition, the unobtrusive runtime real-time tracing sidecar proxy is also the core device of the unobtrusive industrial software tracing and analysis equipment 100 provided by the present application. The sidecar proxy is actually an independent process from the existing engineering or runtime application. The sidecar proxy triggers many components, such as intelligent tracing injectors, network services (such as runtime discovery servers, etc.), runtime fault injection, and tracing data aggregators.

[0059] Wherein, the hybrid data platform 140 performs a high-speed switching fabric between each two sidecar proxies. The hybrid data platform 140 is a virtual execution, since it is part of the sidecar proxy and based on the core services. The hybrid data platform 140 does not forcefully control all TCP network communications, which is different from other popular market service mesh solutions, like all the original container executions. The hybrid data platform 140 only filters and forcefully controls and traces related data streams, which runs fast in the Linux Kernel through eBPF and does not bring additional performance degradation. Wherein, the controller 150 is used to visualize the aggregation of tracing data.

[0060] The second aspect of the present application provides an industrial software non-buried point tracking analysis system based on an industrial network, characterized in that it comprises: a processor; and a memory coupled with the processor, the memory having instructions stored therein, which, when executed by the processor, cause the electronic device to perform actions, the actions comprising: S1, detecting and identifying the network topology of an industrial intranet of an industrial site, and generating a configuration map of the industrial site according to the network topology of the industrial intranet and / or an application program running list of the industrial software; S2, injecting a non-buried point real-time tracking sidecar agent into an edge device of a target field device of the industrial site according to the configuration map, and performing data synchronization on the edge device and its corresponding sidecar agent, wherein the target edge device and its corresponding sidecar agent have at least one tracking point, and at least one application program of the industrial software runs in the target edge device; S3, when the target edge device runs the application program therein, the sidecar agent obtains analysis data from the tracking point to analyze the industrial software.

[0061] Further, the action S2 further comprises: reading an executable file of the application program in the edge device of the target field device, and the sidecar agent dynamically injects tracking points into the application program for burying points based on the executable file, so as to inject the non-buried point real-time tracking sidecar agent into the edge device of the target field device of the industrial site according to the configuration map, and perform data synchronization on the edge device and its corresponding sidecar agent.

[0062] Further, the action S2 further comprises: obtaining the source code of the industrial software, converting the source code into a virtual code tree to perform mapping on the virtual code tree and the executable file, and the sidecar agent dynamically injects tracking points into the application program for burying points based on the executable file, so as to inject the non-buried point real-time tracking sidecar agent into the edge device of the target field device of the industrial site according to the configuration map.

[0063] Further, the action S2 further comprises: establishing communication between all sidecar agents of the industrial site according to the network topology of the industrial intranet.

[0064] Further, the action S3 further comprises: when the target edge device runs the application program therein and runs to the tracking point, the sidecar agent obtains runtime node data from the tracking point, and performs classification and arrangement on all node data and unifies the format to analyze the industrial software.

[0065] Further, the action S1 further comprises: installing a hybrid control platform on an edge device or a local server of the industrial site.

[0066] Further, the edge device of the target field device runs a plurality of application programs of the industrial software, each of the application programs corresponds to a sidecar proxy.

[0067] Further, the action S2 further comprises: formulating an injection strategy according to the analysis purpose of the industrial software, and performing sidecar proxy injection according to the configuration map based on the injection strategy and the process tree and historical data of the industrial software.

[0068] Further, when the application program is contained in the virtual machine, the action S2 further comprises: passing through the virtual machine to perform injection of the sidecar proxy.

[0069] The third aspect of the present application provides an industrial software non-buried point tracking analysis device based on an industrial network, comprising: a detection and identification device that detects and identifies the network topology of an industrial intranet in an industrial field, and generates a configuration map of the industrial field according to the network topology of the industrial intranet and / or an application program running list of the industrial software; an injection device that injects a non-buried point real-time tracking sidecar proxy into the edge device of a target field device in the industrial field according to the configuration map, and performs data synchronization on the edge device and its corresponding sidecar proxy, wherein the target edge device and its corresponding sidecar proxy have at least one tracking point, and at least one application program of the industrial software runs in the target edge device; an analysis device that, when the application program runs in the target edge device, the sidecar proxy obtains analysis data from the tracking point to analyze the industrial software.

[0070] The fourth aspect of the present application provides a computer program product, which is tangibly stored on a computer readable medium and includes computer executable instructions that, when executed, cause at least one processor to perform the method of the first aspect of the present application.

[0071] The fifth aspect of the present application provides a computer readable medium having stored thereon computer executable instructions that, when executed, cause at least one processor to perform the method according to the first aspect of the present application.

[0072] Compared with the traditional tracking analysis mechanism, the architecture of the industrial network-based industrial software non-buried point tracking analysis mechanism provided by the present application has many advantages for real factories or manufacturing plants. The present application is non-buried and non-intrusive to the existing source code of industrial software, which is achieved by using a sidecar agent and an injector. The present application uses the Kernel service in the hybrid data platform for the analysis tracking of industrial software and network stream hijacking, which is achieved by eBPF, which can directly inject and run tracking code in the Linus Kernel. And it is suitable for industrial network environment, and there is no other configuration cost.

[0073] Many industrial systems, whether product level or research and development projects, can apply the architecture of the present application to achieve the non-buried point analysis tracking function of industrial software, and the additional cost paid for this is very limited. The present application can be easily deployed to real industrial environments, including industrial computers, edge devices, open controllers or other types of edge devices that manipulate machines such as PLCs and robots. In addition, the present application also does not require additional research and maintenance work. After some automatic configuration, the sidecar agent is injected into the existing deployed device, the tracking code is injected into the configured running process through the injector, and the analysis of the industrial software is realized after the data is collected. The present application can track data for the entire industrial ecosystem and generate reports.

[0074] Although the content of the present application has been described in detail through the above preferred embodiments, it should be recognized that the above description should not be considered as limiting the present application. After reading the above content, various modifications and alternatives of the present application will be apparent to those skilled in the art. Therefore, the protection scope of the present application should be defined by the appended claims. In addition, any reference signs in the claims should not be considered as limiting the claims; the word "comprising" does not exclude other claims or devices or steps not listed in the specification; the words "first", "second" and the like are only used to represent names, and do not represent any specific order.

Claims

1. An industrial software non-intrusive tracking and analysis method based on an industrial network, wherein, Comprising the steps of: S1, detecting and identifying the network topology of the industrial intranet of the industrial site, and generating a configuration map of the industrial site according to the network topology of the industrial intranet and / or the application running list of the industrial software; S2, injecting a real-time tracking sidecar agent without burying points into the edge device of the target field device of the industrial site according to the configuration map, and performing data synchronization on the edge device and its corresponding sidecar agent, wherein the edge device and its corresponding sidecar agent have at least one tracking point, and at least one application of the industrial software running in the edge device; S3, when the application running in the edge device, the sidecar agent obtains analysis data from the tracking point to analyze the industrial software. The step S2 further comprises the following steps:

2. The industrial network-based industrial software non-buried tracking analysis method according to claim 1, characterized in that, reading the executable file of the application in the edge device of the target field device, and the sidecar agent based on the executable file, dynamically injecting tracking points into the application for burying points, injecting a real-time tracking sidecar agent without burying points into the edge device of the target field device of the industrial site according to the configuration map, and performing data synchronization on the edge device and its corresponding sidecar agent. The step S2 further comprises the following steps:

3. The industrial network-based industrial software non-buried tracking analysis method according to claim 2, characterized in that, obtaining the source code of the industrial software, converting the source code into a virtual code tree to perform mapping on the virtual code tree and the executable file, and the sidecar agent based on the executable file dynamically injecting tracking points into the application for burying points, and injecting a real-time tracking sidecar agent without burying points into the edge device of the target field device of the industrial site according to the configuration map. The step S2 further comprises the following steps: establishing communication between all sidecar agents of the industrial site according to the network topology of the industrial intranet.

4. The industrial network-based industrial software non-buried tracking analysis method according to claim 1, characterized in that, The step S3 further comprises the following steps:

5. The industrial network-based industrial software non-buried tracking analysis method according to claim 1, characterized in that, When the application running in the edge device runs to the tracking point, the sidecar agent obtains runtime node data from the tracking point, and performs classification and arrangement on all node data and unifies the format to analyze the industrial software. The step S1 further comprises the following steps:

6. The industrial network-based industrial software non-buried tracking analysis method according to claim 1, characterized in that, installing a hybrid control platform on an edge device or a local server of the industrial site. The edge device of the target field device runs multiple applications of the industrial software, and each application corresponds to a sidecar agent.

7. The industrial network-based industrial software non-buried tracking analysis method according to claim 1, characterized in that, The step S2 further comprises the following steps:

8. The industrial network-based industrial software non-buried tracking analysis method according to claim 1, characterized in that, According to the analysis purpose of the industrial software, an injection strategy is formulated, and based on the injection strategy, the process tree and historical data of the industrial software, the sidecar agent injection is performed according to the configuration map. When the application is contained in a virtual machine, the step S2 further comprises the following steps: passing through the virtual machine to perform the injection of the sidecar agent.

9. The industrial network-based industrial software non-buried tracking analysis method according to claim 1, characterized in that, Comprising:

10. An industrial software non-intrusive tracking and analysis system based on an industrial network, characterized in that, a processor; and a memory coupled with the processor, the memory having stored therein instructions which, when executed by the processor, cause the system to perform actions, the actions comprising: ​ S1, detecting and identifying the industrial intranet network topology of the industrial site, and generating a configuration map of the industrial site according to the industrial intranet network topology and / or the application running list of the industrial software; S2, injecting a non-buried real-time tracking sidecar agent into the edge device of the target field device of the industrial site according to the configuration map, and performing data synchronization on the edge device and the corresponding sidecar agent, wherein the edge device and the corresponding sidecar agent have at least one tracking point, and at least one application of the industrial software runs in the edge device; S3, when the application in the edge device runs, the sidecar agent obtains analysis data from the tracking point to analyze the industrial software.

11. The industrial software non-buried tracking analysis system based on the industrial network according to claim 10, wherein the action S2 further comprises: reading the executable file of the application in the edge device of the target field device, and the sidecar agent dynamically injects tracking points into the application for burying points according to the executable file, and injects the non-buried real-time tracking sidecar agent into the edge device of the target field device of the industrial site according to the configuration map, and performs data synchronization on the edge device and the corresponding sidecar agent.

12. The industrial software non-buried tracking analysis system based on the industrial network according to claim 11, wherein the action S2 further comprises: obtaining the source code of the industrial software, converting the source code into a virtual code tree to perform mapping on the virtual code tree and the executable file, and the sidecar agent dynamically injects tracking points into the application for burying points according to the executable file, and injects the non-buried real-time tracking sidecar agent into the edge device of the target field device of the industrial site according to the configuration map.

13. The industrial software non-buried tracking analysis system based on the industrial network according to claim 10, wherein the communication between all sidecar agents of the industrial site is established according to the industrial intranet network topology.

14. The industrial software non-buried tracking analysis system based on the industrial network according to claim 10, wherein the action S3 further comprises: when the application in the edge device runs and runs to the tracking point, the sidecar agent obtains runtime node data from the tracking point, and performs classification and arrangement on all node data and unifies the format to analyze the industrial software.

15. The industrial software non-buried tracking analysis system based on the industrial network according to claim 10, wherein the action S1 further comprises: Therefore, action S2 further includes: installing a hybrid control platform on an edge device or a local server of the industrial site.

16. The industrial software non-buried tracking analysis system based on the industrial network according to claim 10, wherein a plurality of applications of the industrial software run in the edge device of the target field device, and each application corresponds to a sidecar agent. ​ ​ ​ ​ ​ ​ ​ ​ 17. The industrial network-based industrial software unobtrusive tracking and analysis system of claim 10, wherein the action S2 further comprises: developing an injection strategy according to the industrial software analysis purpose, and performing a sidecar proxy injection according to the injection strategy and a process tree and historical data of the industrial software based on the configuration map.

18. The industrial network-based industrial software unobtrusive tracking and analysis system of claim 10, wherein the action S2 further comprises: injecting the sidecar proxy through the virtual machine to execute the injection of the sidecar proxy. When, on the other hand, the application is housed in a virtual machine, then the action S2 also comprises: comprises:

19. An industrial software non-intrusive tracking and analysis apparatus based on an industrial network, wherein, a probing and identifying device that probes and identifies an industrial intranet network topology of an industrial site, and generates a configuration map of the industrial site according to the industrial intranet network topology and / or an application running list of the industrial software; an injection device that injects an unobtrusive real-time tracking sidecar proxy into an edge device of a target site device of the industrial site according to the configuration map, and performs data synchronization on the edge device and its corresponding sidecar proxy, wherein the edge device and its corresponding sidecar proxy have at least one tracking point, and at least one application of the industrial software runs in the edge device; an analysis device that, when the application in the edge device runs, the sidecar proxy obtains analysis data from the tracking point to analyze the industrial software.

20. A computer program product tangibly stored on a computer readable medium and comprising computer executable instructions that, when executed, cause at least one processor to perform the method of any one of claims 1 to 9.

21. A computer readable medium having computer executable instructions stored thereon that, when executed, cause at least one processor to perform the method of any one of claims 1 to 9. ​ ​

Images