Industrial data attack detection method, device, equipment and medium

Abstract

The present invention discloses an industrial data attack detection method, device, equipment and medium, which obtains key information of data access traffic by monitoring real-time data access traffic, determines the matching of data access traffic with preset rules according to the key information of data access traffic, generates alarm events, and predicts the next data attack behavior according to the alarm type of the alarm event and the alarm event correlation matrix. The present invention solves the problems of low accuracy of the existing multi-step attack correlation algorithm and difficulty in accurately discovering the attack mode behind the malicious attacker, and the detection method achieves higher correlation accuracy.

Description

Technical Field

[0001] The present invention relates to the field of industrial data security, and in particular to an industrial data attack detection method, device, equipment and medium. Background Art

[0002] In view of the risks faced by industrial Internet data security, attack detection technology has become one of the important means to protect industrial data security. At present, the industry has also made great progress in this technology. With the development of 5G and edge computing, edge servers carry more and more computing-intensive and delay-sensitive applications, and the attacks they face are becoming increasingly complex, especially the application of multi-step attack methods, which makes attacks more difficult to detect. Therefore, for complex application scenarios and various types of attacks, developing more accurate and real-time attack detection technology has become a top priority for ensuring edge computing security.

[0003] In terms of attack detection technology, typical attack methods in industrial control network scenarios include information detection (IP detection, operating system identification, industrial control equipment identification, software version identification, etc.), port scanning (Modbus 502 port, DNP320000 port, S7 102 port, etc.), industrial control protocol utilization (protocol is not encrypted, lack of identity authentication, etc.). These attacks will lead to the leakage or loss of industrial Internet data. For different network environments and attack types, the existing technology proposes a variety of detection technologies such as rule-based detection, state-based detection, and data-driven machine learning detection. These methods have their own advantages and solve the problem of attack detection in some threat scenarios. However, in terms of complex multi-step attacks, the existing technology still faces certain challenges, and there are at least the following technical problems:

[0004] (1) Rule-based methods require a lot of security domain knowledge, have poor detection effects on zero-day vulnerabilities, and are difficult to deal with complex multi-step attacks.

[0005] (2) Existing machine learning-based methods focus more on identifying the characteristics of the data itself and lack a good grasp of the correlation between attack steps;

[0006] (3) The state-based method is more applicable to idealized industrial control environments, but it faces the problem of difficulty in identifying actual environments.

[0007] The existing technology has a low recognition accuracy rate for complex multi-step attacks, making it difficult to accurately locate the attacker's specific attack mode, and it is easy for the attack to lead to industrial data leakage. Summary of the invention

[0008] In view of this, the present invention provides an industrial data attack detection method to solve the technical problems in the prior art that the recognition accuracy of complex multi-step attacks is low, it is difficult to accurately locate the attacker's specific attack mode, and it is easy to cause industrial data leakage.

[0009] According to a first aspect of the present invention, there is provided an industrial data attack detection method, comprising:

[0010] Monitor real-time data access traffic and obtain key information of the data access traffic;

[0011] According to the key information of the data access flow, the matching situation of the data access flow and the preset rule is judged, and an alarm event is generated, wherein the alarm event carries the alarm type information;

[0012] According to the alarm type of the alarm event and the alarm event correlation matrix, the next data attack behavior is predicted, wherein the alarm event correlation matrix is ​​generated by calculating the correlation between different types of alarm events, and the correlation between different types of alarm events is obtained by calculating the frequency and similarity of different types of alarm events.

[0013] According to a second aspect of the present invention, there is provided an industrial data attack detection device, comprising:

[0014] An acquisition module, used to monitor real-time data access traffic and acquire key information of the data access traffic;

[0015] An alarm module, used to determine the matching situation of the data access traffic with the preset rules according to the key information of the data access traffic, and generate an alarm event, wherein the alarm event carries the alarm type information;

[0016] The prediction module is used to predict the next data attack behavior according to the alarm type of the alarm event and the alarm event correlation matrix, wherein the alarm event correlation matrix is ​​generated by calculating the correlation between different types of alarm events, and the correlation between different types of alarm events is obtained by calculating the frequency and similarity of different types of alarm events.

[0017] According to a third aspect of the present invention, a computer device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above-mentioned industrial data attack detection method when executing the computer program.

[0018] According to a fourth aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the above-mentioned industrial data attack detection method are implemented.

[0019] Through the above technical scheme, the present invention provides an industrial data attack detection method, device, equipment and medium, which obtains key information of data access traffic by monitoring real-time data access traffic, judges the matching situation of data access traffic with preset rules based on the key information of data access traffic, generates alarm events, and predicts the next data attack behavior based on the alarm type of the alarm event and the alarm event correlation matrix.

[0020] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention and implement it according to the contents of the specification, and to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0022] Figure 1 A schematic diagram of an application scenario of industrial data attack detection provided in an embodiment of the present invention is shown;

[0023] Figure 2 A schematic diagram of a process flow of an industrial data attack detection method provided in an embodiment of the present invention is shown;

[0024] Figure 3 An example diagram showing the distribution of different types of alarm events at occurrence time points after aggregation provided in an embodiment of the present invention;

[0025] Figure 4 An example diagram of an alarm association directed graph provided in an embodiment of the present invention is shown;

[0026] Figure 5 A schematic structural diagram of an industrial data attack detection device provided in an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0027] The specific implementation of the present invention will be described in detail below with reference to the accompanying drawings and in combination with the embodiments. It should be noted that the embodiments and features in the embodiments of the present invention can be combined with each other without conflict.

[0028] An industrial data attack detection method provided in an embodiment of the present invention can be applied to Figure 1In the industrial Internet scenario, data is stored in industrial servers (industrial control servers) and sensors. Users access data in the industrial Internet through clients. All user access traffic needs to pass through a firewall. The firewall executes an industrial data attack detection method provided in an embodiment of the present invention. By monitoring real-time data access traffic, key information of data access traffic is obtained. According to the key information of data access traffic, the matching situation of data access traffic and preset rules is judged, and an alarm event is generated. According to the alarm type of the alarm event and the alarm event correlation matrix, the next data attack behavior is predicted.

[0029] Typical attack methods in industrial control network scenarios include information detection (IP detection, operating system identification, industrial control equipment identification, software version identification, etc.), port scanning (Modbus 502 port, DNP3 20000 port, S7 102 port, etc.), industrial control protocol exploitation (protocol is not encrypted, lack of authentication, etc.), malicious packet injection, DDoS attack, etc. For the above attacks, the security system needs to design a series of threat rules, so the snort tool is used to identify threats and set threat rules that conform to a specific format. Each rule can be configured with many fields, which usually vary depending on the usage scenario. When the snort rule runs, the data packet of the monitored access traffic is matched with the rule base. If the data packet meets the preset rules, an alarm will be sent. The alarm contains timestamp, alarm type, alarm priority, protocol, source IP address, source port, destination IP address and destination port. The basic format is as follows:

[0030]

[0031] The attack purpose of the Snort rule in the table corresponds to the key-value pair in the Snort rule (a regular matching formula can be used in the key-value pair). The attack type is determined based on the matching of the key-value pair.

[0032] Accordingly, specific examples of alarms are as follows, and the generated alarms can be aggregated and associated according to attributes to discover larger multi-step attack patterns. The alarm event ID can correspond to the alarm type classification, for example, ID: 1 corresponds to the alarm type of database port scanning.

[0033]

[0034] The embodiment of the present invention solves the problem that the existing multi-step attack correlation algorithm has low accuracy and is difficult to accurately discover the attack mode behind the malicious attacker. The embodiment of the present invention proposes a new correlation calculation method, which generates a multi-step attack directed graph (such as Figure 4As shown in the figure), the forward correlation is then calculated to predict the attacker’s next attack plan. Compared with existing algorithms, this algorithm achieves higher correlation accuracy.

[0035] The present invention is described in detail below through specific embodiments.

[0036] Embodiment 1

[0037] like Figure 2 As shown, an industrial data attack detection method provided in an embodiment of the present invention includes:

[0038] Step 201: monitor real-time data access traffic and obtain key information of data access traffic;

[0039] Among them, the key information of data access traffic obtained through firewalls and other devices includes the source IP, destination IP, source port, destination port, traffic size, etc. of each access session.

[0040] Step 202: According to the key information of the data access flow, the matching situation of the data access flow and the preset rules is determined, and an alarm event is generated;

[0041] The alarm event carries the alarm type information.

[0042] Step 203: predict the next data attack behavior according to the alarm type of the alarm event and the alarm event correlation matrix;

[0043] Among them, the alarm event correlation matrix is ​​generated by calculating the correlation between different types of alarm events. The correlation between different types of alarm events is obtained by calculating the frequency and similarity of different types of alarm events. The alarm event correlation matrix reflects the correlation between alarm events and can predict the most likely attack behavior of a certain alarm event in the next step.

[0044] Before step 201, it is necessary to generate an alarm association directed graph (such as Figure 4 Only when the attack detection of data access traffic is realized in real time, the following methods can be used:

[0045] Step 201-1, scan and detect the historical data access flow records of the industrial Internet, and generate an alarm event when the data access flow matches the preset rules;

[0046] Among them, the devices in the industrial Internet store historical data access traffic records, which need to be used to learn and generate attack detection models;

[0047] Step 201-2: Aggregate the generated alarm events according to the time window and the attack type;

[0048] Step 201-3: Calculate the correlation between different alarm events according to the alarm events after aggregation processing, and generate an alarm event correlation matrix;

[0049] Step 201 - 4 : Generate an alarm association directed graph according to the alarm event association matrix and the association threshold.

[0050] Step 201-1 includes:

[0051] Step 201-11, obtaining historical data access traffic;

[0052] Step 201 - 12: Analyze the historical data access traffic according to the preset Snort rules, and generate an alarm event when the data access traffic matches the preset Snort rules.

[0053] In order to realize the extraction, classification, time slice aggregation and feature aggregation of alarms, the original alarm events are aggregated into a small number of aggregated alarms, which can effectively reduce the calculation pressure of subsequent correlation analysis and make the security event correlation analysis more efficient. Therefore, step 201-2 includes:

[0054] Step 201-21, initializing an empty aggregate alarm list;

[0055] Step 201-22, traverse the alarm event, extract the key feature field of the alarm event, wherein the key feature field includes the attack type, source IP, destination IP, source port, destination port and the timestamp of the occurrence of the alarm event;

[0056] Step 201-23, dividing the alarm event into corresponding time windows according to the preset time windows and the timestamp of the occurrence of the alarm event, and generating a corresponding alarm event sequence;

[0057] This step is equivalent to alarm classification, which is classified according to the key features of the alarm and the similar aggregation rules established in advance, such as classification according to attributes such as type, source address, and destination address.

[0058] Step 201-24, generating an alarm aggregation hash value list according to the attack type and corresponding time window of the alarm event;

[0059] This step is equivalent to time slice aggregation. Within each category, the data is further divided and aggregated by time window. For example, the time window can be set to 1 minute or 5 minutes.

[0060] Step 201-25, traverse the alarm events, determine whether the alarm aggregate hash value corresponding to the alarm event exists in the alarm aggregate hash value list, and when it is determined that it exists, update the statistical information of the alarm event to the alarm event statistical feature list corresponding to the alarm aggregate hash value; when it is determined that it exists, initialize the alarm event statistical feature list corresponding to the alarm aggregate hash value.

[0061] Among them, for all alarms in the same category and the same time slice, the mean, variance, etc. of the features are counted to obtain the "representative" information of this category and this time slice. The representative alarms of a preset time slice of a certain category are stored after aggregation, which contains the main statistical features of the original alarms, and the aggregated alarm events are used as input for subsequent correlation analysis and identification. Step 201-2 is equivalent to using a hash table to aggregate alarms of the same time window and the same alarm type using a key, and aggregating the statistical features of the same type of alarm events in the same time window into an object array in a Key-Value manner, and the key is the hash value of the time window and the alarm type, so as to achieve the effect of compressing the alarm and reduce the computational burden of subsequent correlation analysis.

[0062] Step 201-3 includes:

[0063] Step 201-31, initializing the alarm event correlation matrix C to an all-zero matrix, and the number of iterations t is 0;

[0064] Step 201-32, reading the first alarm event sequence of the first time window w1 and the alarm event sequence of the second time window w2;

[0065] Step 201-33, calculating the similarity between the alarm events in w1 and w2;

[0066] Step 201-34, calculate the frequency of alarm events in w1 and w2;

[0067] Step 201-35: Calculate the alarm event correlation according to the similarity between the alarm events, the frequency of the alarm events, and the alarm event correlation of the previous iteration to generate an alarm event correlation matrix C.

[0068] It should be noted that, since step 201-2 aggregates the alarm events (equivalent to clustering, clustering the alarm events of the same type into one type), this step is to calculate the correlation between the alarm events of different types after aggregation. An element in the correlation matrix C between the alarm events of different types is calculated by installing the following formula, as follows:

[0069]

[0070] Among them, Figure 3The figure shows the distribution of different types of alarm events at the time of occurrence after aggregation. Different types of alarm events occur at different time points. The time windows w1 and w2 may overlap or not overlap, and their lengths may be equal or unequal. There is no specific limitation here. Elements in the alarm event correlation matrix Indicates the correlation between alarm event type i and alarm event type j. w1 and w2 represent two time windows. i and j represent the alarm types in the time windows. i is the alarm type in time window w1, and j is the alarm type in time window w2. , Represents the weight coefficient ( , Satisfying that the sum is 1 and both are greater than zero), freq is the frequency matrix, represents the frequency of alarm j occurring after alarm i occurs, represents the similarity between time windows w1 and w2, represents the frequency of alarm events in w1 and w2, To statistically analyze all alarm sequences within the time window w, traverse each alarm sequence, count the number of alarms of type j that appear first after the alarm of type i, and record it as count(i, j). Accordingly, within the time window w, traverse and count the number of other alarms of type j that appear after each type i, and normalize each count(i, j), as follows:

[0071]

[0072] The above formula is equivalent to dividing the frequency of alarm event type j (alarm event type j is the alarm type in time window w2, i and j can be equivalent to indicating that the same type of events occur in different time windows) after a certain alarm event type i by the sum of the frequencies of all types that appear after i (equivalent to the sum of the number of all alarm event types generated in time window w2 after alarm event type i). It is a probability that reflects the probability of the next type j alarm appearing after the type i alarm appears based on the statistical law within the window w.

[0073]

[0074] in Represents the weights of the source IP address, destination IP address, source port, and destination port. All are greater than 0 and less than 1, and the sum of its four parameters is 1, the function It is used to calculate the ratio of the size of the intersection to the size of the union of two sets x and y, expressed as follows:

[0075]

[0076] Based on the above calculation formula, the similarity and frequency matrix between the attack in the current time window and the attack in the subsequent time window are calculated one by one, and the correlation between the two types of alarm events is updated.

[0077] Step 201-4 includes:

[0078] Step 201-41, initializing the node set nodes, the edge set edges and the alarm event correlation matrix C;

[0079] Step 201-42, set the node with out-degree 0 as the starting point of the associated directed graph;

[0080] Step 201-43, determining whether the correlation degree is greater than a preset threshold;

[0081] When the correlation degree is greater than the preset threshold, check whether the corresponding directed edge already exists. When the corresponding directed edge does not exist, add it to the associated directed graph; when the corresponding directed edge exists, skip the execution; when the correlation degree is less than the preset threshold, skip the execution.

[0082] After obtaining the correlation matrix between different types of alarms, the correlation from one attack mode to other attack modes can be obtained. Through step 201-4, each attack mode is abstracted into a multi-step attack node on a directed graph, and a threshold of correlation is set. Only when the correlation between two nodes is greater than or equal to the threshold, a directed edge is generated from the source node to the target node. The value on the directed edge is the correlation (when the correlation threshold is 0.10), and the case below the threshold will be ignored. Figure 4 As shown, all nodes on each path in the directed graph are unique, that is, there is no cycle on each path. The generated directed graph may consist of multiple paths, and each directed path represents a multi-step attack sequence constructed by the association algorithm. Figure 4 The generated multi-step attack directed graph is interpreted as {paths}, which represents a global multi-step attack directed graph composed of multiple attack paths. The path set is paths = {path1, path2, ..., pathn}, and each path represents a potential attack sequence. In practical applications, there may be parallel, cross-cutting and aggregation between attack sequences. Parallelism means that the attacker uses different attack methods, cross-cutting means that the attacker's multiple attack schemes use some of the same attack methods, and aggregation means that the final attack methods of multiple attack sequences are consistent. Each attack path can be expressed as path = (nodes, edges, weight), which represents a single attack path, consisting of a node set, an edge set and a weight set (corresponding to a correlation set). Each edge in the graph represents a jump between two attack modes. There is a front-and-back relationship between the two, and the previous attack mode is a prerequisite for the latter.

[0083] Embodiment 2

[0084] The rule-based threat identification method cannot correctly identify all threats. In the face of 0-day attacks, the rule-based method cannot achieve effective identification. In order to improve the robustness of identification, the second embodiment of the present invention introduces a machine learning-based intrusion detection mechanism (which can be deployed on an IDS device) to perform secondary identification on network traffic. Accordingly, after step 201-1, it includes:

[0085] Step 201-1A: Perform feature engineering on the historical data access traffic records of the industrial Internet based on the Chimp Optimization Algorithm (ChOA) to achieve feature selection;

[0086] Among them, the chimpanzee algorithm simulates the hierarchy system and hunting mechanism of chimpanzee groups in nature. Its standard process is as follows:

[0087] Hierarchy setting: After the population is initialized, the group is divided into two layers according to the size of fitness: leadership and base layer. The leadership layer consists of four chimpanzees: attacker, chaser, barrier, and driver. They are the four solutions with the best fitness in this calculation. The other chimpanzees are unified as the base layer and update their positions according to the distance from the leader chimpanzee. In the continuous iteration process of the chimpanzee group, the chimpanzees in the base layer will also be continuously selected to replace them to update the leadership.

[0088] Driving and surrounding prey: The mathematical model of chimpanzees driving and surrounding prey can be expressed by the following mathematical formula:

[0089]

[0090]

[0091] t is the current iteration number, d is the distance between the chimpanzee and the prey, A, C, and m are coefficient vectors, is the prey position, and is the current chimpanzee position. A, C, and m are calculated by the following formula.

[0092]

[0093]

[0094]

[0095] Among them, f is the convergence factor, whose value decreases nonlinearly from a preset constant greater than 0 to 0 during the iteration process. The algorithm updates f by using different strategies of different types of chimpanzees, giving the chimpanzee group the ability to search the solution space in multiple ways. A is a random number between [f, -f]. At that time, the chimpanzee conducts a global search far away from the prey, and conversely, it conducts a local search close to the prey. r1 and r2 are random vectors between [0, 1]. m is a chaotic map, which represents the influence of the chimpanzee's food grabbing behavior during the hunting process.

[0096] Attacking prey: During the hunting process, the chimpanzee in the leadership position can better understand the location of the prey. Other chimpanzees update their own positions based on the position of the leader chimpanzee, and finally the attacker chimpanzee completes the hunting. This behavior can be expressed by the following formula, where the different subscripts of A, C, and m correspond to the different values ​​in the above formula:

[0097]

[0098]

[0099]

[0100]

[0101]

[0102] x attacker 、x barrier 、x chaser 、x driver They represent the position vectors of the attacker, obstacle, pursuer and driver respectively, and x(t + 1) represents the updated position vector.

[0103] In the final stage of hunting, the attraction of food causes chimpanzees to temporarily forget their hunting responsibilities and try to get food in the chaos. The chimpanzee algorithm uses chaotic mapping to describe this food-grabbing behavior and sets a 50% probability of choosing between the normal position and the chaotic position during the optimization process. This behavior helps the algorithm avoid falling into local optimality and solving high-dimensional problems. It is the most important factor that distinguishes the chimpanzee algorithm from other heuristic algorithms. The food-grabbing behavior can be expressed by a mathematical formula:

[0104] , is a random value between [0,1].

[0105] The above describes the application process of the standard chimpanzee algorithm. In the second embodiment of the present invention, the x(t + 1) position vector method is optimized. In order to improve the performance of the algorithm, the information exchange mechanism of particle swarm optimization is adopted, and the comprehensive experience between chimpanzee individuals and the individual chimpanzees themselves is considered. The new position update formula is as follows:

[0106]

[0107]

[0108] c1 is the social learning factor, c2 is the cognitive learning factor. The optimal setting is c1 = 2, c2 = 2. w1, w2, w3, w4 are inertia weights that affect the strength of global optimization ability. r3, r4 are two random numbers between [0,1].

[0109] In the second embodiment of the present invention, the feature selection of data access traffic is converted into a discrete mathematical problem, and the sigmoid function is used to convert The variable is a binary variable (0,1), if a feature is selected, the value of that position is set to 1 (i.e. is 1), if a feature is selected, the value at that position is 0.

[0110] , where r is the average of r3 and r4 mentioned above

[0111] The chimpanzee algorithm optimized in the second embodiment of the present invention optimizes the search process by balancing the two factors of fitness and distance. It is necessary to consider the performance of the classifier and minimize irrelevant features. Therefore, the fitness function is set to , where FS represents the number of selected features and FN represents the total number of features. The optimal setting in the actual application of this embodiment is set to 0.93. The feature selection is equivalent to a binary classification problem. In the classification task, each sample has only one certain category. If the category is predicted, the classification is correct, and if it is not predicted, the classification is wrong. Therefore, the most intuitive indicator is the accuracy rate.

[0112] Step 201-1B: classify the historical data access traffic records of the industrial Internet, compare them with the preset normal data access traffic model, and determine whether they conform to normal data access behavior;

[0113] Step 201-1C: When abnormal data access behavior is detected, the pre-set alarm rules are matched according to the specific characteristics of the abnormal traffic and an alarm event is generated, wherein the alarm event includes the occurrence time, alarm priority, alarm protocol, source address, source port, destination address and destination port.

[0114] Optionally, other similar intelligent optimization algorithms may be used in the second embodiment of the present invention. In addition, in this embodiment, the chimpanzee optimization algorithm is optimized by referring to the information exchange mechanism of particle swarm optimization.

[0115] Further, as Figure 2 The specific implementation of the method, the embodiment of the present invention provides an industrial data attack detection device, such as Figure 5 As shown, the device comprises:

[0116] An acquisition module 510 is used to monitor real-time data access traffic and acquire key information of the data access traffic;

[0117] The alarm module 520 is used to determine the matching situation of the data access traffic with the preset rules according to the key information of the data access traffic, and generate an alarm event, wherein the alarm event carries the alarm type information;

[0118] The prediction module 530 is used to predict the next data attack behavior based on the alarm type of the alarm event and the alarm event correlation matrix, wherein the alarm event correlation matrix is ​​generated by calculating the correlation between different types of alarm events, and the correlation between different types of alarm events is obtained by calculating the frequency and similarity of different types of alarm events.

[0119] An embodiment of the present invention provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the following steps are implemented:

[0120] Monitor real-time data access traffic and obtain key information about data access traffic;

[0121] According to the key information of data access traffic, the matching situation of data access traffic and preset rules is judged, and an alarm event is generated, wherein the alarm event corresponds to the alarm type;

[0122] According to the alarm type of the alarm event and the alarm event correlation matrix, the next data attack behavior is predicted, wherein the alarm event correlation matrix is ​​generated by calculating the correlation between different types of alarm events, and the correlation between different types of alarm events is obtained by calculating the frequency and similarity of different types of alarm events.

[0123] In an embodiment of the present invention, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the following steps are implemented:

[0124] Monitor real-time data access traffic and obtain key information about data access traffic;

[0125] According to the key information of data access traffic, the matching situation of data access traffic and preset rules is judged, and an alarm event is generated, wherein the alarm event corresponds to the alarm type;

[0126] According to the alarm type of the alarm event and the alarm event correlation matrix, the next data attack behavior is predicted, wherein the alarm event correlation matrix is ​​generated by calculating the correlation between different types of alarm events, and the correlation between different types of alarm events is obtained by calculating the frequency and similarity of different types of alarm events.

[0127] It should be noted that the above functions or steps that can be implemented by the computer-readable storage medium or computer device can refer to the relevant descriptions on the server side and the client side in the aforementioned method embodiment. To avoid repetition, they will not be described one by one here.

[0128] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided by the present invention can include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0129] Those skilled in the art can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example. In actual applications, the above-mentioned functions can be distributed and completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above.

[0130] The embodiments described above are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be included in the protection scope of the present invention.

Claims

1. An industrial data attack detection method, characterized in that: include: Monitor real-time data access traffic and obtain key information of the data access traffic; According to the key information of the data access flow, the matching situation of the data access flow and the preset rule is judged, and an alarm event is generated, wherein the alarm event carries the alarm type information; According to the alarm type of the alarm event and the alarm event correlation matrix, the next data attack behavior is predicted, wherein the alarm event correlation matrix is ​​generated by calculating the correlation between different types of alarm events, and the correlation between different types of alarm events is obtained by calculating the frequency and similarity of different types of alarm events, wherein the correlation is , w1 and w2 represent two time windows, i and j represent the alarm event types in the time windows respectively, i is the alarm event type in the time window w1, j is the alarm event type in the time window w2, , represents the weight coefficient, , The sum is 1 and both are greater than zero. Indicates the correlation between alarm event type i and alarm event type j, Indicates the frequency of alarm event type j occurring after alarm event type i occurs. , count(i, j) means the number of alarms of type j that appear first after the alarm of type i, similarity ,in Represents the weights of the source IP address, destination IP address, source port, and destination port. All are greater than 0 and less than 1, and the sum of its four parameters is 1, the function Used to calculate the ratio of the size of the intersection and the size of the union of two sets x and y. .

2. The industrial data attack detection method according to claim 1, characterized in that: Before the step of monitoring the real-time data access traffic and obtaining key information of the data access traffic, the method includes: Scan and detect the historical data access traffic records of the Industrial Internet, and generate alarm events when the data access traffic matches the preset rules; Aggregate the generated alarm events according to the time window and the attack type; According to the alarm events after aggregation processing, the correlation between different alarm events is calculated to generate the alarm event correlation matrix; According to the alarm event correlation matrix and correlation threshold, an alarm correlation directed graph is generated.

3. The industrial data attack detection method according to claim 2, characterized in that: The step of monitoring the historical data access traffic of the industrial Internet and generating an alarm event when the data access traffic matches a preset rule includes: Get historical data access traffic; According to the preset Snort rules, the historical data access traffic is analyzed, and an alarm event is generated when the data access traffic matches the preset Snort rules.

4. The industrial data attack detection method according to claim 2, characterized in that: After the step of scanning and detecting the historical data access flow records of the industrial Internet and generating an alarm event when the data access flow matches the preset rules, the method includes: Based on the Chimpanzee optimization algorithm, feature engineering is performed on the historical data access traffic records of the Industrial Internet to achieve feature selection; Classify the historical data access traffic records of the Industrial Internet and compare them with the preset normal data access traffic model to determine whether they conform to normal data access behavior; When abnormal data access behavior is detected, the pre-set alarm rules are matched and an alarm event is generated according to the specific characteristics of the abnormal traffic. The alarm event includes the occurrence time, alarm priority, alarm protocol, source address, source port, destination address and destination port.

5. The industrial data attack detection method according to claim 2, characterized in that: The step of aggregating the generated alarm events according to the time window and the attack type includes: Initialize an empty aggregate alarm list; Traverse the alarm event and extract the key feature fields of the alarm event, wherein the key feature fields include the attack type, source IP, destination IP, source port, destination port and the timestamp of the occurrence of the alarm event; According to the preset time window and the timestamp of the occurrence of the alarm event, the alarm event is divided into corresponding time windows to generate a corresponding alarm event sequence; Generate an alarm aggregation hash value list according to the attack type and corresponding time window of the alarm event; Traverse the alarm events and determine whether the alarm aggregate hash value corresponding to the alarm event exists in the alarm aggregate hash value list. When it is determined that it exists, update the statistical information of the alarm event to the alarm event statistical feature list corresponding to the alarm aggregate hash value; when it is determined that it exists, initialize the alarm event statistical feature list corresponding to the alarm aggregate hash value.

6. The industrial data attack detection method according to claim 2, characterized in that: The step of calculating the correlation between different alarm events according to the alarm events after aggregation processing and generating an alarm event correlation matrix includes: Initialize the alarm event correlation matrix C to an all-zero matrix, and the number of iterations t is 0; Read the first alarm event sequence of the first time window w1 and the alarm event sequence of the second time window w2; Calculate the similarity between the alarm events in w1 and w2; Calculate the frequency of alarm events in w1 and w2; According to the similarity between the alarm events, the frequency of the alarm events and the alarm event correlation of the previous iteration, the alarm event correlation is calculated to generate the alarm event correlation matrix C.

7. The industrial data attack detection method according to claim 2, characterized in that: The step of generating an alarm association directed graph according to the alarm event association matrix and the association threshold comprises: Initialize the node set nodes, edge set edges and alarm event correlation matrix C; Set the node with out-degree 0 as the starting point of the associated directed graph; Determine whether the correlation is greater than a preset threshold; When the correlation degree is greater than the preset threshold, check whether the corresponding directed edge already exists. When the corresponding directed edge does not exist, add it to the associated directed graph; when the corresponding directed edge exists, skip the execution; when the correlation degree is less than the preset threshold, skip the execution.

8. An industrial data attack detection device, characterized in that: include: An acquisition module, used to monitor real-time data access traffic and acquire key information of the data access traffic; An alarm module, used to determine the matching situation of the data access traffic with the preset rules according to the key information of the data access traffic, and generate an alarm event, wherein the alarm event carries the alarm type information; The prediction module is used to predict the next data attack behavior according to the alarm type of the alarm event and the alarm event correlation matrix, wherein the alarm event correlation matrix is ​​generated by calculating the correlation between different types of alarm events, and the correlation between different types of alarm events is obtained by calculating the frequency and similarity of different types of alarm events, wherein the correlation is , w1 and w2 represent two time windows, i and j represent the alarm event types in the time windows respectively, i is the alarm event type in the time window w1, j is the alarm event type in the time window w2, , represents the weight coefficient, , The sum is 1 and both are greater than zero. Indicates the correlation between alarm event type i and alarm event type j, Indicates the frequency of alarm event type j occurring after alarm event type i occurs. , count(i, j) means the number of alarms of type j that appear first after the alarm of type i, similarity ,in Represents the weights of the source IP address, destination IP address, source port, and destination port. All are greater than 0 and less than 1, and the sum of its four parameters is 1, the function Used to calculate the ratio of the size of the intersection and the size of the union of two sets x and y. .

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the industrial data attack detection method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the industrial data attack detection method according to any one of claims 1 to 7 are implemented.

Images