A freebsd system industry protocol deep inspection method

Abstract

The application discloses a Freebsd system industrial protocol deep inspection method, and relates to the technical field of industrial network security. The method injects a new industrial protocol deep inspection related module into three modules, namely, a Freebsd system kernel protocol stack, a communication intermediate library and a user space rule analysis program, so that the rate of industrial protocol inspection can be improved, network communication delay can be reduced, and normal production operation of the industrial control network can be ensured under the premise of guaranteeing the communication security of the industrial control network. Compared with traditional methods and prior art, the method has the advantages of not needing to completely change the system architecture, simultaneously considering performance and security, and providing more reliable security protection for the industrial control network.

Description

A method for deep inspection of industrial protocols in FreeBSD systems Technical Field

[0001] This invention relates to the field of industrial network security technology, specifically to a method for deep inspection of industrial protocols in the FreeBSD system. Background Technology

[0002] In the field of network security technology, ensuring the security and stability of industrial protocol communications has always been a crucial task. However, traditional data transmission methods between system kernel mode and user mode have a series of problems when performing in-depth inspections of industrial protocols. This method typically exhibits low performance and high communication latency, failing to meet the real-time requirements of industrial control network communications. In practical applications, due to the high real-time demands of industrial control networks, the limitations of this traditional method are becoming increasingly apparent.

[0003] In traditional methods, data transfer between system kernel mode and user mode requires multiple context switches, leading to performance degradation and increased communication latency. This is particularly concerning in industrial control systems, as any delay can cause production line interruptions or malfunctions, severely impacting industrial production. Furthermore, due to the complexity of industrial protocols, traditional methods require significant system resources for deep inspection, further increasing communication latency.

[0004] To address these issues, some attempts have been made to bypass the system kernel protocol stack using techniques such as DPDK or MAP to achieve deep inspection of industrial protocols. However, these methods face several difficulties and problems. First, the process is complex, requiring significant modifications and optimizations to existing systems, increasing the difficulty of implementation and the development cycle. Second, because these techniques may lead to a series of compatibility issues and instability when bypassing the system kernel, various problems may arise during development, further increasing the risk of implementation. Summary of the Invention

[0005] To overcome the shortcomings of the above technologies, this invention provides a method for deep inspection of industrial protocols in FreeBSD systems that does not require a complete change to the system architecture, while taking into account both performance and security, and providing more reliable security for industrial control networks.

[0006] The technical solution adopted by this invention to overcome its technical problems is:

[0007] A method for deep inspection of industrial protocols in FreeBSD systems includes the following steps:

[0008] a) The packet filtering rule processing submodule pfctl in the FreeBSD system processes and stores the industrial protocol rules issued by users;

[0009] b) The packet filtering rule communication intermediate library libpfctl in the FreeBSD system converts and processes industrial protocol rules;

[0010] c) The packet filtering rule processing submodule pf_nv in the FreeBSD system converts industrial protocol rules into ordinary strings;

[0011] d) The packet filtering and message processing submodule pf_ko in the FreeBSD system intercepts industrial protocol messages and performs in-depth inspections on them;

[0012] e) The packet filtering log processing submodule pf_log in the FreeBSD system generates industrial protocol deep inspection logs.

[0013] Furthermore, step a) includes the following steps:

[0014] a-1) In the header file of the packet filtering rule processing submodule pfctl in the FreeBSD system, create a new data structure user_struct_dpi to store the industrial protocol rule fields according to the industrial protocol standard specification, and add the data structure user_struct_dpi to the global rule structure V of the packet filtering rule processing submodule pfctl;

[0015] a-2) In accordance with the yacc specification, a new industrial protocol rule marker DPI is created in the pfctl submodule of the packet filtering rule processing module using the %token marker definition. In the lookup function's keywords array, the corresponding string of the industrial protocol rule marker DPI is set to dpi.

[0016] a-3) Create a new industrial protocol rule parsing tag dpi_rule using the %type type definer, and specify that the industrial protocol rule parsing tag dpi_rule is of the data structure user_struct_dpi in the global rule structure V;

[0017] a-4) Add the industrial protocol rule field to be parsed in the industrial protocol rule parsing tag dpi_rule;

[0018] a-5) Add industrial protocol rule processing logic to the rule processing function of the industrial protocol rule parsing tag dpi_rule. The industrial protocol rule processing logic receives the industrial protocol rules configured by the user and stores each industrial protocol rule field into the data structure user_struct_dpi using the subscript method.

[0019] a-6) Add the industrial protocol rule parsing tag dpi_rule to the global rule parsing tag pfrule of the packet filtering rule processing submodule pfctl;

[0020] a-7) The user sends the industrial protocol rule as dpi + industrial protocol rule field. After receiving the industrial protocol rule sent by the user, the packet filtering rule processing submodule pfctl sends it to the global rule parsing tag pfrule. The global rule parsing tag pfrule judges whether the dpi identifier input by the user is consistent with the string corresponding to the industrial protocol rule mark DPI. If they are consistent, the industrial protocol rule parsing tag dpi_rule calls the industrial protocol rule processing logic added in step a-5) to complete the processing and storage of the user input industrial protocol rule. Then, it sends the data structure user_struct_dpi to the packet filtering rule communication intermediate library libpfctl of the FreeBSD system.

[0021] Furthermore, in step a-4), each industrial protocol rule field is separated by a space. The first industrial protocol rule field is the industrial protocol rule marker DPI. The remaining industrial protocol rule fields, except for the first industrial protocol rule field, are filled one by one according to the type of the industrial protocol rule field defined in the data structure user_struct_dpi.

[0022] Furthermore, step b) includes the following steps:

[0023] b-1) The pfctl_add_rule function in the packet filtering rule communication intermediate library libpfctl receives the data structure user_struct_dpi. Based on the string dpi corresponding to the DPI marked by the industrial protocol rule in step a-2), it determines whether the rule stored in the data structure user_struct_dpi is an industrial protocol rule. If so, step b-2) is executed.

[0024] b-2) Create a new function pfctl_nv_add_dpi in the packet filtering rule communication intermediate library libpfctl. In the function pfctl_nv_add_dpi, create a new nvlist linked list named dpi. This linked list is used to store the industrial protocol rule fields.

[0025] b-3) Use the nvlist_add_number_array function to convert the format of the industrial protocol rule fields and add them to the dpi list. Then use the nvlist_add_nvlist function to add the dpi list to the global list nvparent of the packet filtering rule communication intermediate library libpfctl.

[0026] b-4) The packet filtering rule communication intermediate library libpfctl sends the global linked list nvparent to the packet filtering rule processing submodule pf_nv through the system function ioctl.

[0027] Furthermore, step c) includes the following steps:

[0028] c-1) Create a new data structure kernel_struct_dpi in the global storage area for packet filtering. The data structure kernel_struct_dpi is used to store fields according to the industrial protocol rules specified by the industrial protocol standard.

[0029] c-2) The pf_nvrule_to_krule function of the packet filtering rule processing submodule pf_nvzhong receives the global linked list nvparent and queries whether the dpi linked list exists in the global linked list nvparent through the nvlist_exit_nvlist function. If it does not exist, no operation is performed. If it exists, step c-3) is executed.

[0030] c-3) Create a new function pf_nvdpi_to_kdpi in the packet filtering rule processing submodule pf_nv. The function pf_nvdpi_to_kdpi calls the function pf_unit_array_nv in the FreeBSD system, which extracts each field of the industrial protocol rule stored in the dpi linked list, converts it into a normal string, and stores it in the data structure kernel_struct_dpi.

[0031] Furthermore, step d) includes the following steps:

[0032] d-1) Create a new HOOK entry function pf_test_dpi in the packet filtering message processing submodule pf_ko to intercept industrial protocol messages. Insert the function pf_test_dpi after the STATE_LOOKUP macro definition in the pf_test_state_tcp function of the packet filtering message processing submodule pf_ko. The HOOK entry function pf_test_dpi will intercept all industrial protocol messages.

[0033] d-2) Create a new dpi_callback function in the packet filtering message processing submodule pf_ko. After the dpi_callback function obtains the industrial protocol message intercepted by the HOOK entry function pf_test_dpi, it obtains each field of the industrial protocol message based on the standard specification of the industrial protocol. It matches each field of the obtained industrial protocol message with each field of the industrial protocol rule stored in the kernel_struct_dpi data structure and converted into a normal string. If any field fails to match, the industrial protocol message is blocked. If all fields match, the industrial protocol message is allowed to pass, thus completing the deep check of the industrial protocol message.

[0034] d-3) Send each field of the industrial protocol message and the deep inspection result of the industrial protocol message to the packet filtering log processing submodule pf_log in the FreeBSD system, and inform the packet filtering log processing submodule pf_log that the log type is dpi.

[0035] Furthermore, in step d-2), each field of the industrial protocol message is obtained by moving the pointer offset and applying the structure.

[0036] Furthermore, step e) includes the following steps:

[0037] e-1) The PFLOG_PACKET function of the packet filtering log processing submodule pf_log receives each field of the industrial protocol message and the deep inspection result of the industrial protocol message in step d-2), and determines the log of type dpi to be constructed according to the log type dpi provided in step d-3).

[0038] e-2) Add a new function dpi_log to the packet filtering log processing submodule pf_log. The function dpi_log generates an industrial protocol depth check log based on each field of the received industrial protocol message that is determined to be of type dpi and the depth check result of the industrial protocol message.

[0039] e-3) The global send function in the packet filtering log processing submodule pf_log sends the industrial protocol deep inspection log to the virtual network interface pflog. The user process can display and view the industrial protocol deep inspection log by listening to the virtual network interface pflog.

[0040] Furthermore, the method for generating the industrial protocol deep inspection log in step e-2) is as follows: the function dpi_log creates a log entry, and each field of the industrial protocol message is concatenated to the corresponding item of the log entry by direct assignment or memcpy. The reason of the log entry is set to dpi check, and the action of the log entry is set to pass or block according to the deep inspection result of the industrial protocol message, so as to obtain the complete industrial protocol deep inspection log.

[0041] The beneficial effects of this invention are: it effectively addresses the limitations of traditional deep inspection methods for industrial protocols, as well as the complexity and implementation difficulties associated with using DPDK or MAP. By cleverly introducing a new deep inspection module for industrial protocols into the FreeBSD system kernel protocol stack, communication intermediate library, and user-space rule parser, this method can efficiently perform protocol analysis, avoiding problems such as low performance, high latency, and poor real-time performance. Compared with traditional kernel-mode and user-mode data transmission methods, this method bypasses these traditional and cumbersome operations, thereby rapidly improving the speed and efficiency of protocol inspection. Furthermore, this method can meet the urgent need for real-time communication in industrial control networks, ensuring stable network operation by reducing communication latency. Overall, this invention not only fills the gaps in traditional methods but also provides excellent support for the safe, stable, and reliable operation of industrial control systems while maintaining high efficiency, operability, and controllability. Detailed Implementation

[0042] The present invention will be further described below.

[0043] A method for deep inspection of industrial protocols in FreeBSD systems includes the following steps:

[0044] a) The packet filtering rule processing submodule pfctl in the FreeBSD system processes and stores the industrial protocol rules issued by users.

[0045] b) The FreeBSD system's packet filtering rule communication intermediate library libpfctl converts and processes industrial protocol rules.

[0046] c) The packet filtering rule processing submodule pf_nv in the FreeBSD system converts industrial protocol rules into ordinary strings.

[0047] d) The packet filtering and message processing submodule pf_ko in the FreeBSD system intercepts industrial protocol messages and performs in-depth inspections on them.

[0048] e) The packet filtering log processing submodule pf_log in the FreeBSD system generates industrial protocol deep inspection logs.

[0049] By injecting new industrial protocol deep inspection modules into the FreeBSD system kernel protocol stack, communication middleware library, and userspace rule parser, the speed of industrial protocol inspection can be improved and network communication latency reduced while ensuring the security of industrial control network communication, thus ensuring the normal production operation of the industrial control network. Compared with traditional methods and existing technologies, this method has the advantage of not requiring a complete overhaul of the system architecture, while balancing performance and security, providing a more reliable security guarantee for industrial control networks.

[0050] In one embodiment of the present invention, step a) includes the following steps:

[0051] a-1) In the header file of the packet filtering rule processing submodule pfctl in the FreeBSD system, create a new data structure user_struct_dpi to store the industrial protocol rule fields according to the industrial protocol standard specification, and add the data structure user_struct_dpi to the global rule structure V of the packet filtering rule processing submodule pfctl.

[0052] a-2) In accordance with the yacc specification, a new industrial protocol rule marker DPI is created in the pfctl submodule using the %token marker definition. In the lookup function's keywords array, the corresponding string for the industrial protocol rule marker DPI is set to dpi.

[0053] a-3) Create a new industrial protocol rule parsing tag dpi_rule using the %type type definer, specifying that the industrial protocol rule parsing tag dpi_rule is of type user_struct_dpi, which is a data structure in the global rule structure V.

[0054] a-4) Add the industrial protocol rule field to be parsed in the industrial protocol rule parsing tag dpi_rule.

[0055] a-5) Add industrial protocol rule processing logic to the rule processing function of the industrial protocol rule parsing tag dpi_rule. The industrial protocol rule processing logic receives the industrial protocol rules configured by the user and stores each industrial protocol rule field into the data structure user_struct_dpi using the subscript method.

[0056] a-6) Add the industrial protocol rule parsing tag dpi_rule to the global rule parsing tag pfrule of the packet filtering rule processing submodule pfctl.

[0057] a-7) The user sends the industrial protocol rule as dpi + industrial protocol rule field. After receiving the industrial protocol rule sent by the user, the packet filtering rule processing submodule pfctl sends it to the global rule parsing tag pfrule. The global rule parsing tag pfrule judges whether the dpi identifier input by the user is consistent with the string corresponding to the industrial protocol rule mark DPI. If they are consistent, the industrial protocol rule parsing tag dpi_rule calls the industrial protocol rule processing logic added in step a-5) to complete the processing and storage of the user input industrial protocol rule. Then, it sends the data structure user_struct_dpi to the packet filtering rule communication intermediate library libpfctl of the FreeBSD system.

[0058] In this embodiment, preferably, each industrial protocol rule field in step a-4) is separated by a space, the first industrial protocol rule field is the industrial protocol rule marker DPI, and the remaining industrial protocol rule fields, except for the first industrial protocol rule field, are filled one by one according to the type of industrial protocol rule field defined in the data structure user_struct_dpi.

[0059] In one embodiment of the present invention, step b) includes the following steps:

[0060] b-1) The pfctl_add_rule function in the packet filtering rule communication intermediate library libpfctl receives the data structure user_struct_dpi. Based on the string dpi corresponding to the industrial protocol rule marker DPI in step a-2), it determines whether the rule stored in the data structure user_struct_dpi is an industrial protocol rule. If so, step b-2 is executed.

[0061] b-2) Create a new function pfctl_nv_add_dpi in the packet filtering rule communication intermediate library libpfctl. In the function pfctl_nv_add_dpi, create a new nvlist linked list named dpi. This linked list is used to store the industrial protocol rule fields.

[0062] b-3) Use the nvlist_add_number_array function to convert the format of the industrial protocol rule fields and add them to the dpi list. Then, use the nvlist_add_nvlist function to add the dpi list to the global list nvparent of the packet filtering rule communication intermediate library libpfctl.

[0063] b-4) The packet filtering rule communication intermediate library libpfctl sends the global linked list nvparent to the packet filtering rule processing submodule pf_nv through the system function ioctl.

[0064] In one embodiment of the present invention, step c) includes the following steps:

[0065] c-1) Create a new data structure kernel_struct_dpi in the global storage area for packet filtering. The data structure kernel_struct_dpi is used to store fields according to the industrial protocol rules specified by the industrial protocol standard.

[0066] c-2) The pf_nvrule_to_krule function of the packet filtering rule processing submodule pf_nvzhong receives the global linked list nvparent and checks whether the dpi linked list exists in the global linked list nvparent through the nvlist_exit_nvlist function. If it does not exist, no operation is performed. If it exists, step c-3 is executed.

[0067] c-3) Create a new function pf_nvdpi_to_kdpi in the packet filtering rule processing submodule pf_nv. The function pf_nvdpi_to_kdpi calls the function pf_unit_array_nv in the FreeBSD system, which extracts each field of the industrial protocol rule stored in the dpi linked list, converts it into a normal string, and stores it in the data structure kernel_struct_dpi.

[0068] In one embodiment of the present invention, step d) includes the following steps:

[0069] d-1) Create a new HOOK entry function pf_test_dpi in the packet filtering message processing submodule pf_ko to intercept industrial protocol messages. Insert the function pf_test_dpi after the STATE_LOOKUP macro definition in the pf_test_state_tcp function of the packet filtering message processing submodule pf_ko. The HOOK entry function pf_test_dpi will intercept all industrial protocol messages.

[0070] d-2) Create a new dpi_callback function in the packet filtering message processing submodule pf_ko. After the dpi_callback function obtains the industrial protocol message intercepted by the HOOK entry function pf_test_dpi, it obtains each field of the industrial protocol message based on the standard specification of the industrial protocol. It matches each field of the obtained industrial protocol message with each field of the industrial protocol rule converted into a normal string stored in the data structure kernel_struct_dpi. If any field fails to match, the industrial protocol message is blocked. If all fields match, the industrial protocol message is allowed to pass, thus completing the deep inspection of the industrial protocol message.

[0071] d-3) Send each field of the industrial protocol message and the deep inspection result of the industrial protocol message to the packet filtering log processing submodule pf_log in the FreeBSD system, and inform the packet filtering log processing submodule pf_log that the log type is dpi.

[0072] In this embodiment, preferably, in step d-2), each field of the industrial protocol message is obtained by moving the pointer offset and applying the structure.

[0073] In one embodiment of the present invention, step e) includes the following steps:

[0074] e-1) The PFLOG_PACKET function of the packet filtering log processing submodule pf_log receives each field of the industrial protocol message and the deep inspection result of the industrial protocol message in step d-2), and determines that a log of type dpi should be constructed based on the log type dpi provided in step d-3).

[0075] e-2) Add a new function dpi_log to the packet filtering log processing submodule pf_log. The function dpi_log generates an industrial protocol depth check log based on each field of the received industrial protocol message that is determined to be of type dpi and the depth check result of the industrial protocol message.

[0076] e-3) The global send function in the packet filtering log processing submodule pf_log sends the industrial protocol deep inspection log to the virtual network interface pflog. The user process can display and view the industrial protocol deep inspection log by listening to the virtual network interface pflog.

[0077] In this embodiment, preferably, the method for generating the industrial protocol deep check log in step e-2) is as follows: the function dpi_log creates a log entry, each field of the industrial protocol message is concatenated to the corresponding item of the log entry by direct assignment or memcpy, the reason of the log entry is set to dpi check, and the action of the log entry is set to pass or block according to the deep check result of the industrial protocol message, so as to obtain the complete industrial protocol deep check log.

[0078] Finally, it should be noted that the above descriptions are merely preferred embodiments of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments or make equivalent substitutions for some of the technical features. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for deep inspection of industrial protocols in FreeBSD systems, characterized in that, The process includes the following steps: a) The packet filtering rule processing submodule pfctl in the FreeBSD system processes and stores the industrial protocol rules issued by the user; b) The packet filtering rule communication middleware library libpfctl in the FreeBSD system converts the industrial protocol rules; c) The packet filtering rule processing submodule pf_nv in the FreeBSD system converts the industrial protocol rules into ordinary strings; d) The packet filtering message processing submodule pf_ko in the FreeBSD system intercepts the industrial protocol messages and performs deep inspection on them; e) The packet filtering log processing submodule pf_log in the FreeBSD system generates industrial protocol deep inspection logs. Step a) includes the following steps: a-1) In the header file of the packet filtering rule processing submodule pfctl in the FreeBSD system, a new data structure user_struct_dpi is created according to the industrial protocol standard specification to store the fields of the industrial protocol rules, and the data structure user_struct_dpi is added to the global rule structure V of the packet filtering rule processing submodule pfctl; a-2) According to ya The CC specification uses the %token flag definer in the packet filtering rule processing submodule pfctl to create a new industrial protocol rule flag DPI. In the lookup function's keywords array, the industrial protocol rule flag DPI is set to the corresponding string "dpi". a-3) A new industrial protocol rule parsing tag dpi_rule is created using the %type type definer, specifying its type as the data structure user_struct_dpi in the global rule structure V. a-4) The industrial protocol rule parsing tag dpi_rule is added to the industrial protocol rule parsing tag dpi_rule. a-5) Industrial protocol rule processing logic is added to the rule processing function of the industrial protocol rule parsing tag dpi_rule. This logic receives the user-configured industrial protocol rules and stores each industrial protocol rule field in the data structure user_struct_dpi using subscripting. a-6) The industrial protocol rule parsing tag dpi_rule is added to the global rule parsing tag pfrule in the packet filtering rule processing submodule pfctl.a-7) The user sends the industrial protocol rule as dpi + industrial protocol rule field. The packet filtering rule processing submodule pfctl receives the user-sent industrial protocol rule and sends it to the global rule parsing tag pfrule. The global rule parsing tag pfrule checks whether the user-input dpi identifier matches the string dpi corresponding to the industrial protocol rule marker DPI. If they match, the industrial protocol rule parsing tag dpi_rule calls the industrial protocol rule processing logic added in step a-5) to complete the processing and storage of the user-input industrial protocol rule. After that, the data structure user_struct_dpi is generated. The packet filtering rules are sent to the FreeBSD system's packet filtering rule communication intermediate library libpfctl; step b) includes the following steps: b-1) The pfctl_add_rule function in the packet filtering rule communication intermediate library libpfctl receives the data structure user_struct_dpi, and determines whether the rule stored in the data structure user_struct_dpi is an industrial protocol rule based on the string dpi corresponding to the industrial protocol rule marker DPI in step a-2). If it is, then step b-2) is executed; b-2) A new function is created in the packet filtering rule communication intermediate library libpfctl. The function `pfctl_nv_add_dpi` creates a new linked list named `nvlist` with the name `dpi`. This linked list is used to store industrial protocol rule fields. (b-3) The `nvlist_add_number_array` function converts the format of the industrial protocol rule fields and adds them to the `dpi` linked list. The `nvlist_add_nvlist` function then adds the `dpi` linked list to the global linked list `nvparent` of the packet filtering rule communication intermediate library `libpfctl`. (b-4) The packet filtering rule communication intermediate library `libpfctl`... pfctl sends the global linked list nvparent to the packet filtering rule processing submodule pf_nv through the system function ioctl; step d) includes the following steps: d-1) Create a new HOOK entry function pf_test_dpi in the packet filtering message processing submodule pf_ko for intercepting industrial protocol messages, and insert the function pf_test_dpi into the STATE_LOOKUP macro definition in the pf_test_state_tcp function of the packet filtering message processing submodule pf_ko. The HOOK entry function pf_test_dpi intercepts all industrial protocol messages;d-2) Create a new `dpi_callback` callback function in the packet filtering message processing submodule `pf_ko`. After obtaining the industrial protocol message intercepted by the HOOK entry function `pf_test_dpi`, the `dpi_callback` function retrieves each field of the industrial protocol message based on the standard specifications of the industrial protocol. It then matches each field of the retrieved industrial protocol message with each field of the industrial protocol rules (converted to ordinary strings) stored in the data structure `kernel_struct_dpi`. If any field fails to match, the industrial protocol message is blocked; if all fields match, the message is allowed to pass, completing the deep check of the industrial protocol message. d-3) Send each field of the industrial protocol message and the deep check result to the packet filtering log processing submodule `pf_log` in the FreeBSD system, informing the `pf_log` submodule that the log type is dpi.

2. The method for deep inspection of industrial protocols in FreeBSD systems according to claim 1, characterized in that: In step a-4), each industrial protocol rule field is separated by a space. The first industrial protocol rule field is the industrial protocol rule marker DPI. The remaining industrial protocol rule fields, except for the first industrial protocol rule field, are filled one by one according to the type of the industrial protocol rule field defined in the data structure user_struct_dpi.

3. The method for deep inspection of industrial protocols in FreeBSD systems according to claim 1, characterized in that, Step c) includes the following steps: c-1) Create a new data structure kernel_struct_dpi in the packet filtering global storage area. The data structure kernel_struct_dpi is used to store the industrial protocol rule fields according to the industrial protocol standard specification; c-2) The pf_nvrule_to_krule function of the packet filtering rule processing submodule pf_nvzhong receives the global linked list nvparent and queries whether the dpi linked list exists in the global linked list nvparent through the nvlist_exit_nvlist function. If it does not exist, no operation is performed. If it exists, step c-3) is executed; c-3) Create a new function pf_nvdpi_to_kdpi in the packet filtering rule processing submodule pf_nv. The function pf_nvdpi_to_kdpi calls the function pf_unit_array_nv in the FreeBSD system to extract each field of the industrial protocol rule stored in the dpi linked list in turn, convert it into a normal string, and store it in the data structure kernel_struct_dpi.

4. The method for deep inspection of industrial protocols in FreeBSD systems according to claim 1, characterized in that: In step d-2), each field of the industrial protocol message is obtained by moving the pointer offset and applying the structure.

5. The method for deep inspection of FreeBSD system industrial protocols according to claim 3, characterized in that, Step e) includes the following steps: e-1) The PFLOG_PACKET function of the packet filtering log processing submodule pf_log receives each field of the industrial protocol message and the deep inspection result of the industrial protocol message in step d-2), and determines that a log of type dpi should be constructed according to the log type dpi provided in step d-3); e-2) A new function dpi_log is added to the packet filtering log processing submodule pf_log. The function dpi_log generates an industrial protocol deep inspection log based on each field of the industrial protocol message that is determined to be a log of type dpi and the deep inspection result of the industrial protocol message; e-3) The industrial protocol deep inspection log is sent to the virtual network card pflog through the global send function in the packet filtering log processing submodule pf_log. The user process displays and views the industrial protocol deep inspection log by listening to the virtual network card pflog.

6. The method for deep inspection of industrial protocols in FreeBSD systems according to claim 5, characterized in that, The method for generating the industrial protocol deep inspection log in step e-2) is as follows: the function dpi_log creates a log entry, and each field of the industrial protocol message is concatenated to the corresponding item of the log entry by direct assignment or memcpy. The reason of the log entry is set to dpi check, and the action of the log entry is set to pass or block according to the deep inspection result of the industrial protocol message, so as to obtain the complete industrial protocol deep inspection log.