Industrial protocol security detection method and system

Abstract

This invention relates to the field of industrial communication technology and discloses an industrial protocol security detection method and system. The method includes: determining characteristic detection fields of industrial control protocols based on industrial protocol message attributes; generating an industrial control protocol configuration library based on the characteristic detection fields; acquiring protocol messages sent by the industrial control system network in real time; parsing the protocol messages to obtain the characteristic detection fields; comparing the characteristic detection fields in the acquired protocol messages with the characteristic detection fields in the industrial control protocol configuration library; and issuing a protocol alarm if the comparison result shows that the characteristic detection fields in the protocol messages are inconsistent with those in the industrial control protocol configuration library. This invention can determine the legitimacy of industrial control protocols based on protocol configuration and least squares comparison, promptly detect the presence of attack devices in the network, and perform corresponding protection operations when such devices are present, thereby improving the security of industrial control protocols.

Description

Technical Field

[0001] This invention relates to the field of industrial communication technology, and in particular to an industrial protocol security detection method and system. Background Technology

[0002] With the increasing scale and intelligence of industrial control systems, and the integration of information technology and industrialization, industrial control systems are gradually evolving from closed and independent systems into the Industrial Internet. Industrial communication networks and industrial control protocols are playing an increasingly important role in control systems. However, the inherent defects of industrial communication protocols and the risk of industrial systems operating with inherent defects are becoming more apparent, leading to a continuous rise in security threats and attack risks faced by industrial control systems. Therefore, industrial control protocol detection and alarm systems play a crucial role and are a key focus of industrial control system security.

[0003] Because industrial control protocols are typically proprietary, there is a lack of methods for in-depth analysis of their function codes and parameters, making it difficult to detect and trigger alarms, thus limiting the protection of industrial control equipment. Therefore, a method for in-depth analysis of industrial control protocol data packets is needed to provide network security protection for industrial control systems. Summary of the Invention

[0004] This invention provides an industrial protocol security detection method and system to solve the above-mentioned technical problems in the prior art.

[0005] To provide a basic understanding of some aspects of the disclosed embodiments, a brief summary is given below. This summary is not intended as a general commentary, nor is it intended to identify key / important components or to describe the scope of protection of these embodiments. Its sole purpose is to present some concepts in a simple form as a prelude to the detailed description that follows.

[0006] According to a first aspect of the present invention, an industrial protocol security detection method is provided.

[0007] In one embodiment, the industrial protocol security detection method includes:

[0008] Based on the attributes of the industrial protocol messages, determine the characteristic detection fields of the industrial control protocol, and generate the industrial control protocol configuration library based on the characteristic detection fields;

[0009] The protocol messages sent by the industrial control system network are acquired in real time, and the protocol messages are parsed to obtain the feature detection fields in the protocol messages;

[0010] The feature detection fields in the acquired protocol message are compared with the feature detection fields in the industrial control protocol configuration library. If the comparison result shows that the feature detection fields in the protocol message are inconsistent with the feature detection fields in the industrial control protocol configuration library, a protocol alarm is triggered.

[0011] In one embodiment, the feature detection fields include: destination MAC, destination IP, protocol port, protocol number, protocol function code, and industrial control protocol parameters.

[0012] In one embodiment, parsing the protocol message to obtain the feature detection fields in the protocol message includes:

[0013] The protocol message is parsed to obtain an industrial control protocol quadruple containing the destination MAC, destination IP, protocol port, and protocol number;

[0014] The protocol message is parsed to obtain the protocol format of the protocol message, and the protocol function code of the protocol message is determined according to the protocol format.

[0015] Based on the protocol format and the protocol function code, determine the corresponding industrial control protocol parameters.

[0016] In one embodiment, when the feature detection field is the industrial control protocol parameter, comparing the feature detection field in the acquired protocol message with the feature detection field in the industrial control protocol configuration library includes:

[0017] When the industrial control protocol parameters are constant, the industrial control protocol parameters in the protocol message are directly compared with the industrial control protocol parameters in the industrial control protocol configuration library;

[0018] When the industrial control protocol parameter is an increase or decrease, the industrial control protocol parameter in the protocol message is compared with the industrial control protocol parameter in the industrial control protocol configuration library by fitting a least squares curve using the least squares method in the industrial control protocol configuration library.

[0019] When the industrial control protocol parameters are within a range of variation, the industrial control protocol parameters in the protocol message are compared with the industrial control protocol parameters in the industrial control protocol configuration library by fitting a least squares curve using the least squares method in the industrial control protocol configuration library.

[0020] In one embodiment, the calculation formula for the least squares method is:

[0021]

[0022] =

[0023] In the formula, It is a regression least squares function, fitting the least squares model; These are the model predictions based on the input feature values; In the formula It is the first Feature vectors of each sample; It is a constant of the selection function. It is the sum of squared residuals; n is the sum of all... Number; is the function value; m is a constant variable.

[0024] According to a second aspect of the present invention, an industrial protocol security detection system is provided.

[0025] In one embodiment, the industrial protocol security detection system includes:

[0026] The field configuration module is used to determine the feature detection fields of the industrial control protocol based on the attributes of the industrial protocol message, and generate the industrial control protocol configuration library based on the feature detection fields.

[0027] The field acquisition module is used to acquire protocol messages sent by the industrial control system network in real time, parse the protocol messages, and acquire the feature detection fields in the protocol messages.

[0028] The field comparison module is used to compare the feature detection fields in the acquired protocol message with the feature detection fields in the industrial control protocol configuration library, and to issue a protocol alarm if the comparison result shows that the feature detection fields in the protocol message are inconsistent with the feature detection fields in the industrial control protocol configuration library.

[0029] In one embodiment, the feature detection fields include: destination MAC, destination IP, protocol port, protocol number, protocol function code, and industrial control protocol parameters.

[0030] In one embodiment, when the field acquisition module parses the protocol message to obtain the feature detection field in the protocol message, it parses the protocol message to obtain an industrial control protocol quadruple containing the destination MAC, destination IP, protocol port, and protocol number; it parses the protocol message to obtain the protocol format of the protocol message, determines the protocol function code of the protocol message based on the protocol format, and determines the corresponding industrial control protocol parameters based on the protocol format and the protocol function code.

[0031] In one embodiment, the field comparison module includes: a fixed value comparison module, a first change value comparison module, and a second change value comparison module, wherein,

[0032] A fixed-value comparison module is used to directly compare the industrial control protocol parameters in the protocol message with the industrial control protocol parameters in the industrial control protocol configuration library when the industrial control protocol parameters are constant.

[0033] The first change value comparison module is used to compare the industrial control protocol parameters in the protocol message with the industrial control protocol parameters in the industrial control protocol configuration library by fitting a least squares curve using the least squares method in the industrial control protocol configuration library when the industrial control protocol parameters are increasing or decreasing.

[0034] The second change value comparison module is used to compare the industrial control protocol parameters in the protocol message with the industrial control protocol parameters in the industrial control protocol configuration library by fitting a least squares curve using the least squares method in the industrial control protocol configuration library when the industrial control protocol parameters are within a range of change values.

[0035] In one embodiment, the calculation formula for the least squares method is:

[0036]

[0037] =

[0038] In the formula, It is a regression least squares function, fitting the least squares model; These are the model predictions based on the input feature values; In the formula It is the first Feature vectors of each sample; It is a constant of the selection function. It is the sum of squared residuals; n is the sum of all... Number; is the function value; m is a constant variable.

[0039] The technical solutions provided by the embodiments of the present invention may include the following beneficial effects:

[0040] This invention can determine the legitimacy of industrial control protocols based on protocol configuration and least squares comparison, promptly detect the presence of attacking devices in the network, and perform corresponding protection operations when such devices are present, thereby improving the security of industrial control protocols.

[0041] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit the invention. Attached Figure Description

[0042] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0043] Figure 1 This is a flowchart illustrating an industrial protocol security detection method according to an exemplary embodiment;

[0044] Figure 2 This is a structural block diagram illustrating an industrial protocol security detection system according to an exemplary embodiment;

[0045] Figure 3 This is a flowchart illustrating the least squares method for curve fitting according to an exemplary embodiment;

[0046] Figure 4 This is a schematic diagram illustrating the least squares method for fitting curves according to an exemplary embodiment.

[0047] Figure 5 This is a schematic diagram of the structure of a computer device according to an exemplary embodiment. Detailed Implementation

[0048] The following description and accompanying drawings fully illustrate specific embodiments described herein to enable those skilled in the art to practice them. Some embodiments may include or substitute parts and features of other embodiments. The scope of the embodiments herein encompasses the entire scope of the claims and all available equivalents thereof. Throughout this document, the terms “first,” “second,” etc., are used only to distinguish one element from another without requiring or implying any actual relationship or order between the elements. Indeed, a first element can also be referred to as a second element, and vice versa. Furthermore, the terms “comprising,” “including,” or any other variations thereof are intended to cover non-exclusive inclusion, such that a structure, apparatus, or device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a structure, apparatus, or device. Without further limitation, an element defined by the phrase “comprising one…” does not exclude the presence of other identical elements in the structure, apparatus, or device that includes said element. The various embodiments described herein are presented in a progressive manner, with each embodiment focusing on its differences from other embodiments; similar or identical parts between embodiments can be referred to interchangeably.

[0049] The terms "longitudinal," "lateral," "upper," "lower," "front," "rear," "left," "right," "vertical," "horizontal," "top," "bottom," "inner," and "outer" used in this document to indicate orientations or positional relationships are based on the orientations or positional relationships shown in the accompanying drawings. They are used solely for the convenience of describing the document and for simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on the invention. In the description herein, unless otherwise specified and limited, the terms "installed," "connected," and "linked" should be interpreted broadly. For example, they can refer to mechanical or electrical connections, or internal connections between two elements; they can be direct connections or indirect connections through an intermediate medium. Those skilled in the art can understand the specific meaning of the above terms according to the specific circumstances.

[0050] In this document, unless otherwise stated, the term "multiple" means two or more.

[0051] In this article, the character " / " indicates that the objects before and after it are in an "or" relationship. For example, A / B means: A or B.

[0052] In this article, the term "and / or" describes an association between objects, indicating that three relationships can exist. For example, A and / or B means: A or B, or A and B.

[0053] It should be understood that although the steps in the flowchart are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order constraint on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the diagram may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the sub-steps or stages of other steps.

[0054] The modules in the apparatus or system of this application can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device in hardware form, or stored in the memory of a computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0055] Where there is no conflict, the embodiments and features in the embodiments of the present invention can be combined with each other.

[0056] Figure 1An embodiment of an industrial protocol security detection method of the present invention is shown.

[0057] In this optional embodiment, the industrial protocol security detection method includes:

[0058] Step S101: Determine the feature detection fields of the industrial control protocol based on the industrial protocol message attributes, and generate the industrial control protocol configuration library based on the feature detection fields.

[0059] Step S103: Real-time acquisition of protocol messages sent by the industrial control system network, parsing of the protocol messages, and acquisition of feature detection fields in the protocol messages;

[0060] Step S105: Compare the feature detection fields in the acquired protocol message with the feature detection fields in the industrial control protocol configuration library, and issue a protocol alarm if the comparison result shows that the feature detection fields in the protocol message are inconsistent with the feature detection fields in the industrial control protocol configuration library.

[0061] Figure 2 An embodiment of an industrial protocol security detection system according to the present invention is shown.

[0062] In this optional embodiment, the industrial protocol security detection system includes:

[0063] The field configuration module 201 is used to determine the feature detection fields of the industrial control protocol based on the attributes of the industrial protocol message, and to generate an industrial control protocol configuration library based on the feature detection fields.

[0064] The field acquisition module 203 is used to acquire protocol messages sent by the industrial control system network in real time, parse the protocol messages, and acquire the feature detection fields in the protocol messages.

[0065] The field comparison module 205 is used to compare the feature detection fields in the acquired protocol message with the feature detection fields in the industrial control protocol configuration library, and to issue a protocol alarm if the comparison result shows that the feature detection fields in the protocol message are inconsistent with the feature detection fields in the industrial control protocol configuration library.

[0066] In practical applications, alarms are triggered on an IP address basis. The feature detection fields include: destination MAC address, destination IP address, protocol port, protocol number, protocol function code, and industrial control protocol parameters. When parsing the protocol message to obtain the feature detection fields, the process involves parsing the message to obtain an industrial control protocol quadruple containing the destination MAC address, destination IP address, protocol port, and protocol number; parsing the message to obtain its protocol format; determining the protocol function code based on the format; and determining the corresponding industrial control protocol parameters based on the format and function code.

[0067] Correspondingly, when comparing the feature detection fields in the acquired protocol message with the feature detection fields in the industrial control protocol configuration library, the process involves extracting and parsing the quadruple in the protocol message. This involves analyzing and comparing the destination MAC, destination IP, protocol port, and protocol number bytes in the industrial control protocol configuration library. If the quadruple is incorrect, a protocol alarm is triggered; if the quadruple is correct, the next step of detection is performed. Additionally, one or more sets of function codes are extracted and parsed from the protocol message. The industrial protocol type is classified using the protocol number in the message and the protocol number in the industrial control protocol configuration library. Then, the industrial control protocol function codes are compared byte-by-byte. If the industrial control protocol function code is incorrect, a protocol alarm is triggered; if the industrial control protocol function code is correct, the next step of detection is performed. Finally, one or more sets of parameters are extracted and parsed from the protocol message. The industrial control protocol parameters are compared. If the industrial control protocol parameters are incorrect, a protocol alarm is triggered; if the industrial control protocol parameters are correct, the industrial control protocol is correct.

[0068] When the feature detection field is the industrial control protocol parameter, the feature detection field in the acquired protocol message is compared with the feature detection field in the industrial control protocol configuration library. If the industrial control protocol parameter is a constant value, the industrial control protocol parameter in the protocol message is directly compared with the industrial control protocol parameter in the industrial control protocol configuration library. If the industrial control protocol parameter is an increasing or decreasing value, the industrial control protocol parameter in the protocol message is compared with the industrial control protocol parameter in the industrial control protocol configuration library by fitting a least squares curve using the least squares method in the industrial control protocol configuration library. If the industrial control protocol parameter is a range-changing value, the industrial control protocol parameter in the protocol message is compared with the industrial control protocol parameter in the industrial control protocol configuration library by fitting a least squares curve using the least squares method in the industrial control protocol configuration library.

[0069] Correspondingly, the field comparison module includes: a fixed value comparison module (not shown in the figure), a first variable value comparison module (not shown in the figure), and a second variable value comparison module (not shown in the figure). The fixed value comparison module is used to directly compare the industrial control protocol parameters in the protocol message with the industrial control protocol parameters in the industrial control protocol configuration library when the industrial control protocol parameters are constant values. The first variable value comparison module is used to compare the industrial control protocol parameters in the protocol message with the industrial control protocol parameters in the industrial control protocol configuration library by fitting a least squares curve using the least squares method in the industrial control protocol configuration library when the industrial control protocol parameters are increasing or decreasing values. The second variable value comparison module is used to compare the industrial control protocol parameters in the protocol message with the industrial control protocol parameters in the industrial control protocol configuration library by fitting a least squares curve using the least squares method in the industrial control protocol configuration library when the industrial control protocol parameters are varying within a range.

[0070] Figure 3 The flowchart of the least squares curve fitting method of the present invention is shown. The least squares method is based on finding the best function match of the data by minimizing the sum of squared residuals.

[0071] Input initial parameters and First, obtain From 1 to of The inner product, and calculate 1 to Let the inner product be , and then, we can obtain... From 1 to of Inner product, obtained This allows us to obtain the best-fitting functional curve. The least squares method is as follows:

[0072]

[0073] =

[0074] In the formula, It is a regression least squares function, fitting the least squares model; These are the model predictions based on the input feature values; In the formula It is the first Feature vectors of each sample; It is a constant of the selection function. It is the sum of squared residuals; n is the sum of all... Number; is the function value; m is a constant variable.

[0075] Sum of Squares of Residuals For each constant We obtain the following by minimizing the partial derivatives and setting the result to zero:

[0076] =2

[0077] =2

[0078] =2

[0079] In the formula,

[0080] It is the sum of squared residuals For constants Partial derivative value;

[0081] It is the sum of squared residuals For constants Partial derivative value;

[0082] It is the sum of squared residuals For constants Partial derivative value.

[0083] Sum of squared residuals For each constant Using the partial derivatives to solve the simultaneous equations in symmetric form, we can transform the formula into matrix form:

[0084] =

[0085] The least squares method is: ;

[0086] In the formula, It is a regression least squares function; It is a constant of the selection function; yes The function; yes The first derivative; yes The second derivative; the first derivative as the gradient. The second derivative matrix serves as the Hessian matrix. If the least squares method converges, then the expression becomes... able to obtain The extreme points are found, and thus the extreme points are calculated. extremum.

[0087] Specifically, if and only if Approaching 0 is equivalent to ,but , , ,but ,Right now .

[0088]

[0089] In the formula, yes The second derivative; yes and The second derivative; yes and The second derivative of .

[0090] The solution is obtained using methods from linear solutions. , … , will optimize The constant is substituted back into the curve fitting equation to obtain the curve.

[0091] Figure 4 This diagram illustrates the operation of the least squares fitting curve of the present invention. The least squares fitting curve diagram is a curve, where the curve represents the value of a parameter register in the industrial control protocol, and is represented by a sine curve. The diagram shows 14 parameter points, some positively biased, some negatively biased, and some directly on the curve. This indicates that as the industrial control protocol message progresses, some positive or negative biases indicate a slight deviation in the message parameters. The least squares method minimizes the sum of squared residuals, conforming to the sine curve.

[0092] Figure 5 A diagram illustrating the internal structure of a computer device according to the present invention is shown. This computer device can be a server and includes a processor, memory, and a network interface connected via a system bus. The processor provides computing and control capabilities. The memory includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The database stores static and dynamic information data. The network interface communicates with external terminals via a network connection. When the computer program is executed by the processor, it implements the steps in the above-described method embodiments.

[0093] Those skilled in the art will understand that Figure 5 The structure shown is merely a block diagram of a portion of the structure related to the present invention and does not constitute a limitation on the computer device to which the present invention is applied. A specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0094] In one embodiment, a computer device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above method embodiments.

[0095] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the steps in the method embodiments described above.

[0096] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the methods described above. Any references to memory, storage, databases, or other media used in the embodiments provided by this invention can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, or optical storage, etc. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc.

[0097] This invention is not limited to the structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this invention is limited only by the appended claims.

Claims

1. An industrial protocol security detection method, characterized by, include: Based on the attributes of the industrial protocol messages, determine the characteristic detection fields of the industrial control protocol, and generate the industrial control protocol configuration library based on the characteristic detection fields; The protocol messages sent by the industrial control system network are acquired in real time, and the protocol messages are parsed to obtain the feature detection fields in the protocol messages; The feature detection fields in the acquired protocol message are compared with the feature detection fields in the industrial control protocol configuration library. If the comparison result shows that the feature detection fields in the protocol message are inconsistent with the feature detection fields in the industrial control protocol configuration library, a protocol alarm is triggered. The feature detection field includes industrial control protocol parameters; When the feature detection field is the industrial control protocol parameter, comparing the feature detection field in the acquired protocol message with the feature detection field in the industrial control protocol configuration library includes: when the industrial control protocol parameter is a constant value, directly comparing the industrial control protocol parameter in the protocol message with the industrial control protocol parameter in the industrial control protocol configuration library; when the industrial control protocol parameter is an increasing or decreasing value, comparing the industrial control protocol parameter in the protocol message with the industrial control protocol parameter in the industrial control protocol configuration library by fitting a least squares curve using the least squares method in the industrial control protocol configuration library; when the industrial control protocol parameter is a range-changing value, comparing the industrial control protocol parameter in the protocol message with the industrial control protocol parameter in the industrial control protocol configuration library by fitting a least squares curve using the least squares method in the industrial control protocol configuration library.

2. The industrial protocol security detection method according to claim 1, characterized in that, The feature detection fields include: Destination MAC, Destination IP, Protocol Port, Protocol Number, Protocol Function Code.

3. The industrial protocol security detection method according to claim 2, characterized in that, The protocol message is parsed to obtain the feature detection fields in the protocol message, including: The protocol message is parsed to obtain an industrial control protocol quadruple containing the destination MAC, destination IP, protocol port, and protocol number; The protocol message is parsed to obtain the protocol format of the protocol message, and the protocol function code of the protocol message is determined according to the protocol format. Based on the protocol format and the protocol function code, determine the corresponding industrial control protocol parameters.

4. The industrial protocol security detection method according to claim 1, characterized in that, The calculation formula for the least squares method is as follows: = In the formula, It is a regression least squares function, fitting the least squares model; These are the model predictions based on the input feature values; In the formula It is the first Feature vectors of each sample; It is a constant of the selection function. It is the sum of squared residuals; n is the sum of all... Number; is the function value; m is a constant variable.

5. An industrial protocol security detection system, characterized in that, include: The field configuration module is used to determine the feature detection fields of the industrial control protocol based on the attributes of the industrial protocol message, and generate the industrial control protocol configuration library based on the feature detection fields. The field acquisition module is used to acquire protocol messages sent by the industrial control system network in real time, parse the protocol messages, and acquire the feature detection fields in the protocol messages. The field comparison module is used to compare the feature detection fields in the acquired protocol message with the feature detection fields in the industrial control protocol configuration library, and to issue a protocol alarm if the comparison result shows that the feature detection fields in the protocol message are inconsistent with the feature detection fields in the industrial control protocol configuration library. The feature detection fields include: industrial control protocol parameters; The field comparison module includes: a fixed value comparison module, a first variable value comparison module, and a second variable value comparison module. The fixed value comparison module is used to directly compare the industrial control protocol parameters in the protocol message with the industrial control protocol parameters in the industrial control protocol configuration library when the industrial control protocol parameters are constant values. The first variable value comparison module is used to compare the industrial control protocol parameters in the protocol message with the industrial control protocol parameters in the industrial control protocol configuration library using a least squares curve fitted using the least squares method in the industrial control protocol configuration library when the industrial control protocol parameters are increasing or decreasing values. The second variable value comparison module is used to compare the industrial control protocol parameters in the protocol message with the industrial control protocol parameters in the industrial control protocol configuration library using a least squares curve fitted using the least squares method in the industrial control protocol configuration library when the industrial control protocol parameters are varying within a range.

6. The industrial protocol security detection system according to claim 5, characterized in that, The feature detection fields include: Destination MAC, Destination IP, Protocol Port, Protocol Number, Protocol Function Code.

7. The industrial protocol security detection system according to claim 6, characterized in that, When the field acquisition module parses the protocol message and obtains the feature detection fields in the protocol message, it parses the protocol message to obtain an industrial control protocol quadruple containing the destination MAC, destination IP, protocol port, and protocol number; it parses the protocol message to obtain the protocol format of the protocol message, determines the protocol function code of the protocol message based on the protocol format, and determines the corresponding industrial control protocol parameters based on the protocol format and the protocol function code.

8. The industrial protocol security detection system according to claim 5, characterized in that, The calculation formula for the least squares method is as follows: = In the formula, It is a regression least squares function, fitting the least squares model; These are the model predictions based on the input feature values; In the formula It is the first Feature vectors of each sample; It is a constant of the selection function. It is the sum of squared residuals; n is the sum of all... Number; is the function value; m is a constant variable.

Images